@tangle-network/agent-profile-materialize 0.15.2 → 0.17.0

package/dist/index.js

@@ -1,3735 +1,17 @@
-/**
- * materializeProfile — THE ONE per-harness profile materializer, shared by every
- * layer (cli-bridge host spawn, agent-dev-container box adapter, VB). It turns a
- * structured {@link AgentProfile} into a {@link WorkspacePlan}: the exact native
- * files to write into the run workspace (cwd), plus the env/flags some harnesses
- * need because they have NO cwd auto-discovery for certain dimensions.
- *
- * Routed per the VERIFIED capability matrix (harness-capability-matrix, 2026-06-14)
- * across every dimension (context, skills, mcp, hooks, subagents, commands).
- *
- * FAIL-CLOSED, not silent-drop: when a requested dimension has no path on the
- * chosen harness (e.g. kimi MCP is flag-only, hermes hooks are opt-in global), it
- * is recorded in `plan.unsupported` with the reason — never silently ignored,
- * which is exactly the "looks provisioned, loads nothing" trap.
- *
- * The ONLY trustworthy proof a dimension works is the in-session effect (skill
- * secret word, MCP tool called n>0, hook sentinel file) — see the canary tests.
- *
- * Types come from `@tangle-network/agent-interface` (the canonical AgentProfile
- * contract); this package adds only the harness-specific materialization + the
- * `node:fs` IO consumer. It was previously copied byte-for-byte into both
- * cli-bridge and agent-dev-container — this is the single source those re-export.
- */
+/** Stable public facade for profile materialization and workspace application. */
+export { applyAgentCandidateWorkspacePlan, materializeCandidateProfile, } from "./candidate.js";
+export { OPENCODE_NATIVE_TOOL_IDS, openCodeNativeToolId, } from "./control-maps.js";
+export { HARNESS_SKILL_DIRS, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_HARNESSES, skillDirForHarness, } from "./harness.js";
+export { openCodeMcpConfig } from "./mcp.js";
 export { modelIdsMatch, qualifyModelId } from "./model-id.js";
+export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, } from "./pi-models-config.js";
+export { applyWorkspacePlan, applyWorkspacePlanWithSecretProvider, } from "./plan-application.js";
+export { agentCandidateProfilePlanMaterial, canonicalizeAgentCandidateProfilePlan, captureAgentCandidateProfilePlan, hashWorkspacePlan, } from "./plan-digest.js";
+export { takeSystemPromptBinding } from "./plan-prompt.js";
+export { assertWorkspacePlanSupported, enforceWorkspacePlanSupport, } from "./plan-support.js";
+export { BINDABLE_LAUNCH_CONTROLS, EXECUTOR_SYSTEM_PROMPT_BINDINGS, isExecutorSystemPromptBinding, isSkippableDimension, SKIPPABLE_DIMENSIONS, WorkspacePlanCleanupError, } from "./plan-types.js";
+export { materializePrimeProfileControls, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
-import { createHash, randomUUID } from "node:crypto";
-import { closeSync, existsSync, fchmodSync, constants as fsConstants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32, } from "node:path";
-import { agentCandidateProfileActivationSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateProfilePlanMaterialSchema, agentCandidateProfileSchema, agentProfileSchema, agentProfileSecretRefSchema, canonicalCandidateBytes, canonicalCandidateDigest, resolveNativeWebTools, } from "@tangle-network/agent-interface";
-import { modelIdsMatch, qualifyModelId } from "./model-id.js";
-import { PRIME_MCP_UNSUPPORTED_REASON, PrimeHarnessStateError, rejectPrimeControl, rejectPrimeDeclaration, } from "./prime-fork.js";
-export const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER = Object.freeze({
-    async get() {
-        return undefined;
-    },
-});
-function describeUnresolvedRef(r) {
-    const name = typeof r.name === "string" ? r.name : undefined;
-    const path = typeof r.path === "string" ? r.path : undefined;
-    if (name && path)
-        return `"${name}" (${path})`;
-    if (name)
-        return `"${name}"`;
-    if (path)
-        return `"${path}"`;
-    return "resource";
-}
-/** Resolve inline bytes already present on the profile. Remote resources must
- * be resolved by {@link resolveAgentProfileResources} before materialization.
- *
- * FAIL-CLOSED: a ref that declares `kind: "inline"` is asserting its bytes are
- * already resolved, so missing/non-string `content` is a caller bug, not an
- * empty file — silently coercing it (`String(content ?? "")`) would produce a
- * file that "looks provisioned, loads nothing", exactly the trap this module's
- * docstring warns against. */
-function resolveInlineRef(ref) {
-    const r = ref;
-    if (typeof r.content === "string") {
-        return { name: String(r.name ?? r.path ?? "resource"), content: r.content };
-    }
-    if (r.kind === "inline") {
-        throw new Error(`Profile resource ${describeUnresolvedRef(r)} declares kind "inline" but has no string content`);
-    }
-    return null; // github / unresolved
-}
-/**
- * The harnesses this materializer can lower an AgentProfile into. `satisfies` binds every id to
- * the canonical harness enum, so a rename upstream is a compile error here rather than an
- * `isMaterializerHarness` that silently returns false for a harness that still exists.
- */
-export const MATERIALIZER_HARNESSES = [
-    "claude-code",
-    "nanoclaw",
-    "codex",
-    "opencode",
-    "kimi-code",
-    "pi",
-    "prime",
-    "gemini",
-    "hermes",
-    "openclaw",
-];
-const MATERIALIZER_HARNESS_SET = new Set(MATERIALIZER_HARNESSES);
-export function isMaterializerHarness(harness) {
-    return MATERIALIZER_HARNESS_SET.has(harness);
-}
-function assertMaterializerHarness(harness) {
-    if (!isMaterializerHarness(harness)) {
-        throw new Error(`Unsupported profile materialization harness "${harness}"`);
-    }
-}
-/**
- * The subset of {@link BINDABLE_LAUNCH_CONTROLS} the plan HANDS OVER rather than
- * executes: controls a caller reaches only by composing the harness's own
- * configuration, so no file, flag or env var the plan writes can touch them.
- *
- *   - `opencode.agent-prompt` — opencode's `agent.<name>.prompt` config field,
- *     the one control that replaces its built-in provider prompt. It binds to a
- *     SINGLE agent, and the agent is chosen at launch. A caller that builds
- *     opencode's config itself and picks the agent there reads neither
- *     `plan.files` nor `plan.flags`, so for that one the plan names the control
- *     and hands over the text in {@link WorkspacePlan.systemPromptBinding}.
- *
- * Every other bindable control names a capability the plan still lowers itself
- * once the caller has declared the plan's launch inputs really reach the spawn.
- */
-export const EXECUTOR_SYSTEM_PROMPT_BINDINGS = [
-    "opencode.agent-prompt",
-];
-const EXECUTOR_SYSTEM_PROMPT_BINDING_SET = new Set(EXECUTOR_SYSTEM_PROMPT_BINDINGS);
-export function isExecutorSystemPromptBinding(value) {
-    return EXECUTOR_SYSTEM_PROMPT_BINDING_SET.has(value);
-}
-/**
- * The dimensions `materializeProfile`'s `skip` option honors.
- *
- * Every other dimension is materialized unconditionally: generated plan files are pushed through
- * a single site that carries no dimension tag, so there is nothing to gate them on. Naming the
- * honored set keeps `skip: ["hooks"]` a loud rejection instead of a silent no-op.
- */
-export const SKIPPABLE_DIMENSIONS = [
-    "mcp",
-    "extensions",
-];
-const SKIPPABLE_DIMENSION_SET = new Set(SKIPPABLE_DIMENSIONS);
-export function isSkippableDimension(value) {
-    return SKIPPABLE_DIMENSION_SET.has(value);
-}
-/** Reject a dimension `materializeProfile` would not actually skip, rather than ignoring it. */
-function assertSkippableDimensions(skip) {
-    if (!skip)
-        return [];
-    const unsupportedSkips = skip.filter((dimension) => !isSkippableDimension(dimension));
-    if (unsupportedSkips.length > 0) {
-        throw new Error(`materializeProfile: cannot skip ${unsupportedSkips.join(", ")}. ` +
-            `Skippable dimensions are: ${SKIPPABLE_DIMENSIONS.join(", ")}.`);
-    }
-    return skip;
-}
-/**
- * Launcher controls an executor can declare it OWNS via `materializeProfile`'s
- * `binds` option.
- *
- * Some harness controls live outside any workspace: opencode's exact
- * system-prompt replacement (`agent.<name>.prompt`) binds to the ONE agent
- * whoever starts the process selects, which a plan-forwarding executor cannot
- * guarantee — so the plan refuses the intent (harnessSystemPromptIntents in
- * @tangle-network/agent-interface answers `replace: false` for opencode).
- *
- * The two declarations describe the two executor shapes that CAN reach it, and
- * each gets the lowering it can actually apply:
- *
- *   - `systemPrompt` — the executor applies the plan's launch flags to the
- *     spawn it owns, so the plan writes the generated `mode: primary` agent and
- *     selects it with `--agent`.
- *   - `opencode.agent-prompt` — the executor composes opencode's own config and
- *     picks the agent there, reading neither plan files nor plan flags, so the
- *     plan hands the text over in {@link WorkspacePlan.systemPromptBinding}
- *     instead of writing a workspace agent that would never be selected.
- *
- * They are mutually exclusive claims about the same caller: declaring both is a
- * caller bug, not a broader capability.
- */
-export const BINDABLE_LAUNCH_CONTROLS = [
-    "systemPrompt",
-    ...EXECUTOR_SYSTEM_PROMPT_BINDINGS,
-];
-const BINDABLE_LAUNCH_CONTROL_SET = new Set(BINDABLE_LAUNCH_CONTROLS);
-/** Reject a binding declaration this materializer has no lowering for, rather than ignoring it. */
-function assertBindableLaunchControls(binds) {
-    if (!binds)
-        return new Set();
-    const unknown = binds.filter((control) => !BINDABLE_LAUNCH_CONTROL_SET.has(control));
-    if (unknown.length > 0) {
-        throw new Error(`materializeProfile: cannot bind ${unknown.join(", ")}. ` +
-            `Bindable launch controls are: ${BINDABLE_LAUNCH_CONTROLS.join(", ")}.`);
-    }
-    const declared = new Set(binds);
-    const handedOver = [...EXECUTOR_SYSTEM_PROMPT_BINDINGS].filter((control) => declared.has(control));
-    if (declared.has("systemPrompt") && handedOver.length > 0) {
-        throw new Error(`materializeProfile: cannot bind systemPrompt together with ${handedOver.join(", ")}. ` +
-            "The first says the plan's launch flags reach the spawn; the second says " +
-            "the caller composes the harness config itself and reads neither.");
-    }
-    return declared;
-}
-/** The plan was applied, but one or more private staging files remain. */
-export class WorkspacePlanCleanupError extends AggregateError {
-    receipt;
-    temporaryPaths;
-    constructor(errors, receipt, temporaryPaths) {
-        super(errors, "Applied workspace plan but failed to remove temporary files");
-        this.name = "WorkspacePlanCleanupError";
-        this.receipt = receipt;
-        this.temporaryPaths = Object.freeze([...temporaryPaths]);
-    }
-}
-/** Fail when a profile asks for controls the chosen harness cannot execute. */
-export function assertWorkspacePlanSupported(plan) {
-    if (plan.unsupported.length > 0) {
-        throw new Error(formatUnsupported(plan.unsupported));
-    }
-}
-/**
- * Enforce plan supportability under the profile's `resources.failOnError`
- * policy. Strict by default: `failOnError` absent or `true` throws on any
- * unsupported dimension. An explicitly best-effort profile
- * (`failOnError: false`) materializes the supported subset instead; the
- * returned `"dimension: reason"` entries are what the caller must surface
- * as a warning so the skipped dimensions stay visible to operators.
- */
-export function enforceWorkspacePlanSupport(plan, failOnError) {
-    if (failOnError === false) {
-        return plan.unsupported.map(({ dimension, reason }) => `${dimension}: ${reason}`);
-    }
-    assertWorkspacePlanSupported(plan);
-    return [];
-}
-/**
- * The two prompt intents a plan carries, projected together onto an outgoing
- * object with each field omitted when the source does not carry it.
- *
- * One helper instead of a pair of inline spreads at each of the digest,
- * receipt, candidate, and spawn boundaries: the intents must travel as a pair,
- * and a projection that copies the replacement and forgets the addition drops
- * it silently — downstream cannot tell "the caller asked for nothing" from
- * "this boundary lost it". Adding a third intent later is one edit here rather
- * than nine.
- */
-function promptIntentFields(source, project) {
-    return {
-        ...(source.systemPrompt === undefined
-            ? {}
-            : { systemPrompt: project(source.systemPrompt) }),
-        ...(source.appendSystemPrompt === undefined
-            ? {}
-            : { appendSystemPrompt: project(source.appendSystemPrompt) }),
-    };
-}
-/** Identity projection for boundaries that pass the prompt intents through. */
-const samePromptIntentValue = (value) => value;
-/**
- * The launcher-bound intent, projected onto an outgoing object and omitted when
- * the source does not carry one.
- *
- * Beside {@link promptIntentFields} rather than inside it, because the two
- * disagree on both ends: the candidate boundaries that helper also serves have
- * no field for a binding — an {@link AgentCandidateWorkspacePlan} is built by a
- * caller that declares none, so it can never hold one — and a value projection
- * such as `candidatePublicString` has nothing to do to a structured binding.
- * Every boundary that carries the plan's own prompt intents calls both.
- */
-function systemPromptBindingField(source) {
-    return source.systemPromptBinding === undefined
-        ? {}
-        : { systemPromptBinding: { ...source.systemPromptBinding } };
-}
-/**
- * The replacement text this launcher must bind to `control`, or `undefined`
- * when the plan carries no launcher-bound intent.
- *
- * Throws for a binding addressed to a DIFFERENT control: the reader cannot
- * execute it, and answering `undefined` would start the agent with the
- * harness's own prompt still in force while nothing reported a problem — the
- * silent downgrade the binding exists to prevent. This is the seam where an
- * executor that cannot bind an intent says so, by name, instead of running a
- * profile whose prompt never took effect.
- */
-export function takeSystemPromptBinding(spawn, control) {
-    const binding = spawn.systemPromptBinding;
-    if (!binding)
-        return undefined;
-    if (binding.control !== control) {
-        throw new Error(`Workspace plan carries a system-prompt ${binding.intent} bound to ` +
-            `${binding.control}, which this executor cannot apply; it binds ${control}`);
-    }
-    return binding.systemPrompt;
-}
-// ─── Verified per-harness conventions (capability matrix) ───────────────────
-/**
- * Whether the harness LOADS its {@link CONTEXT_FILE} from cwd on its own.
- *
- * True for every harness whose CLI discovers the file by name (CLAUDE.md,
- * AGENTS.md, …). opencode is the exception: it reads only what its
- * `opencode.json` `instructions[]` names, so a caller writing context for
- * opencode must register the path as well as write it — see the `instructions`
- * lowering below, and the interactive TUI's persona fold.
- */
-export function harnessAutoLoadsContextFile(harness) {
-    assertMaterializerHarness(harness);
-    return harness !== "opencode";
-}
-/**
- * The project context file this harness reads from cwd — its stable, documented
- * ALWAYS-LOADED surface. Exported so a caller lowering additive context (e.g. a
- * bare TUI's persona, which has no per-message system channel) targets the same
- * file the materializer writes instructions to, instead of keeping its own copy
- * of this per-harness map.
- */
-export function harnessContextFile(harness) {
-    assertMaterializerHarness(harness);
-    // The map is keyed by HarnessId, but callers reach this from runtime strings
-    // (a registry spec name, a request field). A miss would otherwise return
-    // undefined behind a `string` return type and surface as an undefined write
-    // path much later.
-    const path = CONTEXT_FILE[harness];
-    if (!path) {
-        throw new Error(`No project context file is known for harness "${harness}"`);
-    }
-    return path;
-}
-/**
- * File codex's `model_instructions_file` config key reads.
- *
- * cwd-relative on purpose: codex resolves the key against the process working
- * directory, which is the same workspace root the plan is applied into, so the
- * flag stays correct under an executor that binds the workspace at a different
- * absolute path (docker, a jail, a remote box).
- */
-const CODEX_SYSTEM_PROMPT_FILE = ".codex/system-prompt.md";
-/**
- * File carrying opencode's ADDITION to its system prompt.
- *
- * Separate from opencode's instruction file rather than merged into it: the two
- * are different privilege levels of the same request, and one file for both
- * would leave the plan unable to say which intent produced which bytes.
- */
-const OPENCODE_APPEND_SYSTEM_PROMPT_FILE = ".opencode/agent-system-prompt.md";
-/**
- * Why a harness refuses a system-prompt REPLACEMENT.
- *
- * The reason names the control that does exist, so the refusal is actionable
- * without a capability-matrix lookup — a bare "unsupported" sends the caller
- * looking for a flag that was never there.
- */
-function systemPromptRefusal(harness) {
-    switch (harness) {
-        case "opencode":
-            // The control exists, so the reason names the two declarations that reach
-            // it rather than claiming opencode has none.
-            return 'opencode: the only system-prompt replacement is per-agent (`agent.<name>.prompt`), which binds to the agent selected at launch and a workspace plan cannot guarantee; an executor that applies the plan\'s "--agent" flag to its own spawn declares binds: ["systemPrompt"], and one that composes opencode\'s config itself declares binds: ["opencode.agent-prompt"]';
-        default:
-            return `${harness}: no verified exact system-prompt replacement control`;
-    }
-}
-/**
- * Why a harness refuses an ADDITION to the system prompt.
- *
- * gemini puts its context file in the system-prompt position, so the temptation
- * is to lower an addition there. That is refused because GEMINI.md is the ONE
- * file it auto-loads: an addition written there is byte-identical to the same
- * text under `prompt.instructions`, and no consumer could tell which intent the
- * caller expressed. opencode is not refused for the same situation, because it
- * loads exactly the files its config names and can therefore carry the two
- * intents in separate, separately-ordered files.
- */
-function appendSystemPromptRefusal(harness) {
-    switch (harness) {
-        case "gemini":
-            return "gemini: the only additive system-prompt channel is GEMINI.md memory, the single context file it auto-loads, which `prompt.instructions` already materializes — use it instead";
-        case "codex":
-            return "codex: no verified additive system-prompt control — its AGENTS.md lands in a developer/user message, not the system channel";
-        default:
-            return `${harness}: no verified additive system-prompt control`;
-    }
-}
-/** Project context file each harness actually reads from cwd. NEVER a constant. */
-const CONTEXT_FILE = {
-    "claude-code": "CLAUDE.md",
-    nanoclaw: "CLAUDE.md",
-    codex: "AGENTS.md",
-    opencode: ".opencode/profile-instructions.md",
-    "kimi-code": "AGENTS.md",
-    pi: "AGENTS.md",
-    // prime (PrimeIntellect-ai/prime-agent v0.7.0, be9e2fa0) walks cwd and its
-    // ancestors for AGENTS.md/CLAUDE.md, cwd first (fork resource-loader.ts:59
-    // candidates, :94-109 walk from cwd inside loadProjectContextFiles).
-    prime: "AGENTS.md",
-    gemini: "GEMINI.md", // current default; AGENTS.md only via .gemini/settings.json context.fileName
-    hermes: "HERMES.md", // highest-priority native name; only ONE context loads (first match)
-    openclaw: "AGENTS.md",
-};
-/**
- * The paths whose only possible author is this package, per
- * {@link PlanFile.ownership}.
- *
- * Codex names no system-prompt file of its own — `model_instructions_file`
- * takes whatever path it is given — and opencode names none either, since it
- * reads exactly the files its config lists. All three names below were chosen
- * here, so a file already at one of them is this materializer's own output from
- * an earlier application into the same workspace.
- *
- * That is an inference from the path name, not verified provenance: nothing
- * checks the existing bytes are prior materializer output, so a workspace that
- * carried a foreign file at one of these invented names is overwritten on the
- * first application. Accepted cost of stateless multi-turn re-application,
- * bounded by the names being ones no harness or user convention uses.
- *
- * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
- * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`, `opencode.json`. A user's repository
- * can carry any of those, and clobbering one is worse than refusing the turn.
- * For `opencode.json` this means a profile change that alters the
- * `instructions[]` membership between turns of one workspace refuses loudly
- * (the consolidated config no longer matches byte-for-byte) rather than
- * replacing a possibly user-authored config.
- */
-const MATERIALIZER_OWNED_PATHS = new Set([
-    CODEX_SYSTEM_PROMPT_FILE,
-    OPENCODE_APPEND_SYSTEM_PROMPT_FILE,
-    CONTEXT_FILE.opencode,
-]);
-/**
- * cwd-relative native skill dir per harness, or null if the harness has no
- * cwd skill primitive (skills live in a user/global dir the workspace plan
- * cannot reach). Public so consumers composing a profile can (a) render the
- * exact path the platform will mount a skill at into their prompts instead
- * of hardcoding `~/.claude/skills/...`, and (b) branch on skill support
- * ahead of materialization instead of catching the materialize-time throw.
- */
-export const HARNESS_SKILL_DIRS = {
-    "claude-code": ".claude/skills",
-    nanoclaw: ".claude/skills",
-    codex: ".codex/skills",
-    opencode: ".opencode/skills",
-    "kimi-code": ".kimi/skills",
-    pi: ".pi/skills",
-    // prime auto-discovers project skills from <cwd>/<configDir>/skills where the
-    // fork ships configDir ".prime/agent" (fork package.json piConfig, config.ts:494;
-    // package-manager.ts:885 projectBaseDir, :2175-2180 projectDirs.skills,
-    // :2209-2213 collectAutoSkillEntries). The loader recurses into
-    // <name>/SKILL.md subdirs (skills.ts:328-372).
-    prime: ".prime/agent/skills",
-    gemini: ".gemini/skills",
-    hermes: null, // skills are ~/.hermes/skills (user) only — no cwd discovery
-    openclaw: "skills", // <workspace>/skills/<name>/SKILL.md
-};
-const SKILL_DIR = HARNESS_SKILL_DIRS;
-/**
- * Resolve the cwd-relative directory `resources.skills` refs materialize
- * into on `harness`. `null` means the harness cannot receive cwd skills, the
- * same condition that surfaces as an `unsupported`
- * "skills" entry (and an {@link assertWorkspacePlanSupported} throw) at
- * materialize time, exposed here as branchable data.
- */
-export function skillDirForHarness(harness) {
-    assertMaterializerHarness(harness);
-    return HARNESS_SKILL_DIRS[harness];
-}
-// ─── Helpers ────────────────────────────────────────────────────────────────
-const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/;
-const collapse = (s) => s.replace(/\s+/g, " ").trim();
-const compareStrings = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
-const DEFAULT_FILE_MODE = 0o644;
-const PRIVATE_FILE_MODE = 0o600;
-const EXECUTABLE_FILE_MODE = 0o755;
-const DEFAULT_RESOURCE_FETCH_TIMEOUT_MS = 30_000;
-const OPENCODE_PRIMARY_AGENT_PREFIX = "tangle-profile-";
-const MAX_RESOURCE_BYTES = 10 * 1024 * 1024;
-const MAX_PROFILE_RESOURCE_BYTES = 32 * 1024 * 1024;
-const MAX_PROFILE_RESOURCE_REFS = 128;
-const MAX_CONCURRENT_RESOURCE_FETCHES = 8;
-const CLAUDE_SETTINGS_PATH = ".tangle/claude-settings.json";
-const SAFE_WRITE_FLAGS = fsConstants.O_WRONLY |
-    fsConstants.O_CREAT |
-    fsConstants.O_EXCL |
-    (typeof fsConstants.O_NOFOLLOW === "number" ? fsConstants.O_NOFOLLOW : 0);
-async function readResourceBody(response, description, consumeBytes) {
-    if (!response.body)
-        return "";
-    const reader = response.body.getReader();
-    const chunks = [];
-    let totalBytes = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            totalBytes += value.byteLength;
-            if (totalBytes > MAX_RESOURCE_BYTES) {
-                await reader.cancel().catch(() => undefined);
-                throw new Error(`GitHub profile resource exceeds ${MAX_RESOURCE_BYTES} bytes: ${description}`);
-            }
-            try {
-                consumeBytes(value.byteLength);
-            }
-            catch (error) {
-                await reader.cancel().catch(() => undefined);
-                throw error;
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)), totalBytes).toString("utf8");
-}
-async function mapWithConcurrency(values, concurrency, controller, transform) {
-    const results = new Array(values.length);
-    let nextIndex = 0;
-    let firstFailure;
-    const worker = async () => {
-        while (!firstFailure) {
-            const index = nextIndex++;
-            if (index >= values.length)
-                return;
-            try {
-                results[index] = await transform(values[index]);
-            }
-            catch (error) {
-                if (!firstFailure) {
-                    firstFailure = { error };
-                    controller.abort(error);
-                }
-            }
-        }
-    };
-    await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, async () => worker()));
-    if (firstFailure)
-        throw firstFailure.error;
-    return results;
-}
-function normalizeWorkspaceRelativePath(pathValue) {
-    if (typeof pathValue !== "string" ||
-        !pathValue ||
-        hasControlCharacter(pathValue)) {
-        throw new Error("Workspace file path must be non-empty and contain no control characters");
-    }
-    if (isAbsolute(pathValue) ||
-        win32.isAbsolute(pathValue) ||
-        /^[A-Za-z]:/.test(pathValue)) {
-        throw new Error(`Workspace file path must be relative: ${pathValue}`);
-    }
-    const segments = pathValue.replace(/\\/g, "/").split("/");
-    if (segments.some((segment) => !segment ||
-        segment === "." ||
-        segment === ".." ||
-        segment === ".git" ||
-        segment === ".sidecar")) {
-        throw new Error(`Workspace file path must be canonical: ${pathValue}`);
-    }
-    return segments.join("/");
-}
-function hasControlCharacter(value) {
-    for (let index = 0; index < value.length; index++) {
-        const code = value.charCodeAt(index);
-        if (code < 0x20 || code === 0x7f)
-            return true;
-    }
-    return false;
-}
-function validateFileMode(mode) {
-    const normalized = mode ?? DEFAULT_FILE_MODE;
-    if (!Number.isInteger(normalized) || normalized < 0 || normalized > 0o777) {
-        throw new Error(`Workspace file mode must be between 0o000 and 0o777: ${mode}`);
-    }
-    return normalized;
-}
-/**
- * Resolve every GitHub resource to exact inline bytes before materialization.
- * The profile's default harness does not affect resource resolution.
- */
-export async function resolveAgentProfileResources(inputProfile, options = {}) {
-    const profile = agentProfileSchema.parse(inputProfile);
-    const resources = profile.resources;
-    if (!resources)
-        return profile;
-    const refs = [
-        ...(resources.files?.map((mount) => mount.resource) ?? []),
-        ...(resources.tools ?? []),
-        ...(resources.skills ?? []),
-        ...(resources.agents ?? []),
-        ...(resources.commands ?? []),
-        ...(typeof resources.instructions === "object"
-            ? [resources.instructions]
-            : []),
-    ];
-    if (refs.length > MAX_PROFILE_RESOURCE_REFS) {
-        throw new Error(`AgentProfile may contain at most ${MAX_PROFILE_RESOURCE_REFS} resource references`);
-    }
-    const batchController = new AbortController();
-    let fetchedBytes = 0;
-    const consumeFetchedBytes = (bytes) => {
-        fetchedBytes += bytes;
-        if (fetchedBytes > MAX_PROFILE_RESOURCE_BYTES) {
-            throw new Error(`GitHub profile resources exceed ${MAX_PROFILE_RESOURCE_BYTES} total bytes`);
-        }
-    };
-    const resolveRef = async (ref) => {
-        if (ref.kind === "inline")
-            return ref;
-        const repository = ref.repository ?? options.repository;
-        if (!repository) {
-            throw new Error(`GitHub profile resource "${ref.path}" requires repository`);
-        }
-        const [owner, repo, ...extraRepositoryParts] = repository.split("/");
-        if (!owner ||
-            !repo ||
-            extraRepositoryParts.length > 0 ||
-            !/^[A-Za-z0-9_.-]+$/.test(owner) ||
-            !/^[A-Za-z0-9_.-]+$/.test(repo)) {
-            throw new Error(`GitHub profile resource repository must be owner/repo: ${repository}`);
-        }
-        const resourcePath = normalizeWorkspaceRelativePath(ref.path);
-        const gitRef = ref.ref ?? "main";
-        if (!gitRef ||
-            hasControlCharacter(gitRef) ||
-            gitRef.split("/").some((segment) => !segment || segment === "..")) {
-            throw new Error(`Invalid GitHub profile resource ref: ${gitRef}`);
-        }
-        const encoded = (value) => value.split("/").map(encodeURIComponent).join("/");
-        const url = `https://raw.githubusercontent.com/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encoded(gitRef)}/${encoded(resourcePath)}`;
-        const controller = new AbortController();
-        const abortRequest = () => controller.abort(batchController.signal.reason);
-        batchController.signal.addEventListener("abort", abortRequest, {
-            once: true,
-        });
-        const timeoutError = new Error(`GitHub profile resource timed out: ${repository}/${resourcePath}@${gitRef}`);
-        const timeout = setTimeout(() => controller.abort(timeoutError), options.timeoutMs ?? DEFAULT_RESOURCE_FETCH_TIMEOUT_MS);
-        try {
-            const fetchResource = options.fetch ?? globalThis.fetch;
-            const response = await fetchResource(url, { signal: controller.signal });
-            if (!response.ok) {
-                throw new Error(`Failed to fetch GitHub profile resource ${repository}/${resourcePath}@${gitRef}: ${response.status} ${response.statusText}`);
-            }
-            const contentLength = Number(response.headers.get("content-length"));
-            if (Number.isFinite(contentLength) &&
-                contentLength > MAX_RESOURCE_BYTES) {
-                throw new Error(`GitHub profile resource exceeds ${MAX_RESOURCE_BYTES} bytes: ${repository}/${resourcePath}`);
-            }
-            const content = await readResourceBody(response, `${repository}/${resourcePath}`, consumeFetchedBytes);
-            return {
-                kind: "inline",
-                name: ref.name ?? basename(resourcePath),
-                content,
-            };
-        }
-        catch (error) {
-            if (controller.signal.aborted && controller.signal.reason !== undefined) {
-                throw controller.signal.reason;
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeout);
-            batchController.signal.removeEventListener("abort", abortRequest);
-        }
-    };
-    const resolvedRefs = await mapWithConcurrency(refs, MAX_CONCURRENT_RESOURCE_FETCHES, batchController, resolveRef);
-    let resolvedIndex = 0;
-    const takeRef = () => resolvedRefs[resolvedIndex++];
-    const takeRefs = (values) => values?.map(takeRef);
-    const resolvedResources = {
-        ...resources,
-        files: resources.files === undefined
-            ? undefined
-            : resources.files.map((mount) => ({
-                ...mount,
-                resource: takeRef(),
-            })),
-        tools: takeRefs(resources.tools),
-        skills: takeRefs(resources.skills),
-        agents: takeRefs(resources.agents),
-        commands: takeRefs(resources.commands),
-        instructions: typeof resources.instructions === "object"
-            ? takeRef()
-            : resources.instructions,
-    };
-    return agentProfileSchema.parse({ ...profile, resources: resolvedResources });
-}
-/** Normalize any skill markdown (VB frontmatter `skill:`/`description:`, or raw) into a
- *  harness SKILL.md with `name:`/`description:` frontmatter the harnesses require. */
-export function normalizeSkillMd(name, raw) {
-    const m = raw.match(FRONTMATTER_RE);
-    const fm = m?.[1] ?? "";
-    const body = (m?.[2] ?? raw).trim();
-    let desc = `Skill ${name}. Use when the task matches its domain.`;
-    if (fm) {
-        const lines = fm.split("\n");
-        const i = lines.findIndex((l) => /^description:/.test(l));
-        if (i >= 0) {
-            const inline = (lines[i] ?? "").replace(/^description:\s*/, "").trim();
-            if (inline && ![">", "|", ">-", "|-"].includes(inline))
-                desc = collapse(inline);
-            else {
-                const buf = [];
-                for (let j = i + 1; j < lines.length; j++) {
-                    const ln = lines[j] ?? "";
-                    if (/^\s+\S/.test(ln))
-                        buf.push(ln.trim());
-                    else if (ln.trim() === "")
-                        continue;
-                    else
-                        break;
-                }
-                if (buf.length)
-                    desc = collapse(buf.join(" "));
-            }
-        }
-    }
-    return `---\nname: ${name}\ndescription: ${JSON.stringify(desc)}\n---\n\n${body}\n`;
-}
-const tomlStr = (s) => JSON.stringify(s); // valid TOML basic string
-function isProfilePublicConfigValue(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        value.kind === "public" &&
-        typeof value.value === "string");
-}
-function isProfileSecretRef(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        value.kind === "secret-ref" &&
-        typeof value.key === "string");
-}
-function workspacePlanConfigValue(value) {
-    return isProfilePublicConfigValue(value) ? value.value : { ...value };
-}
-function serializeWorkspacePlanJson(value) {
-    const secretSlots = [];
-    const lower = (current, path, arrayEntry = false) => {
-        if (isProfilePublicConfigValue(current))
-            return current.value;
-        if (isProfileSecretRef(current)) {
-            secretSlots.push({ path: [...path], ref: { ...current } });
-            return null;
-        }
-        if (Array.isArray(current)) {
-            return current.map((entry, index) => lower(entry, [...path, index], true));
-        }
-        if (current && typeof current === "object") {
-            const output = Object.create(null);
-            for (const [key, entry] of Object.entries(current)) {
-                const lowered = lower(entry, [...path, key]);
-                if (lowered !== undefined) {
-                    Object.defineProperty(output, key, {
-                        value: lowered,
-                        enumerable: true,
-                        configurable: true,
-                        writable: true,
-                    });
-                }
-            }
-            return output;
-        }
-        return current === undefined && arrayEntry ? null : current;
-    };
-    const content = JSON.stringify(lower(value, []), null, 2);
-    if (content === undefined) {
-        throw new Error("Generated profile JSON must have a serializable root");
-    }
-    return {
-        content,
-        ...(secretSlots.length === 0 ? {} : { secretSlots }),
-    };
-}
-function workspacePlanArgumentSegments(value) {
-    return typeof value === "string" ? [value] : [...value.segments];
-}
-function concatWorkspacePlanArguments(...values) {
-    const segments = values.flatMap(workspacePlanArgumentSegments);
-    if (segments.every((segment) => typeof segment === "string")) {
-        return segments.join("");
-    }
-    return { kind: "workspace-plan-argument-template", segments };
-}
-function joinWorkspacePlanArguments(values, separator) {
-    if (values.length === 0)
-        return "";
-    const joined = [];
-    for (const [index, value] of values.entries()) {
-        if (index > 0)
-            joined.push(separator);
-        joined.push(value);
-    }
-    return concatWorkspacePlanArguments(...joined);
-}
-function tomlProfileConfigValue(value) {
-    if (isProfilePublicConfigValue(value))
-        return tomlStr(value.value);
-    return {
-        kind: "workspace-plan-argument-template",
-        segments: [
-            {
-                kind: "secret",
-                ref: { ...value },
-                encoding: "json-string",
-            },
-        ],
-    };
-}
-// ─── The materializer ─────────────────────────────────────────────────────────
-/**
- * Build the WorkspacePlan for `profile` on `harness`. Pure — no IO. The caller
- * writes plan.files into the run cwd and applies plan.env/plan.flags to the spawn.
- * The explicit target harness takes precedence over the profile's default.
- */
-export function materializeProfile(inputProfile, harness, opts = {}) {
-    assertMaterializerHarness(harness);
-    const profile = agentProfileSchema.parse(inputProfile);
-    const h = harness;
-    const skip = new Set(assertSkippableDimensions(opts.skip));
-    const binds = assertBindableLaunchControls(opts.binds);
-    const plan = {
-        harness: h,
-        files: [],
-        env: {},
-        flags: [],
-        unsupported: [],
-        requires: [],
-    };
-    // Every plan file is tagged by provenance at the single push site: `add`
-    // (harness-generated native config) vs `addExplicitResource` (a profile
-    // resource ref's bytes, passed through verbatim). Downstream consumers that
-    // reinterpret a specific generated file by relPath (e.g. opencode.json as
-    // the synthetic native config) must gate on `source === "generated"` —
-    // otherwise a user resource mounted at the same conventional path is
-    // silently misread as trusted harness config.
-    const pushPlanFile = (relPath, serialized, source, mode) => {
-        const normalizedPath = normalizeWorkspaceRelativePath(relPath);
-        const content = typeof serialized === "string" ? serialized : serialized.content;
-        const secretSlots = typeof serialized === "string" ? undefined : serialized.secretSlots;
-        const fileMode = mode ??
-            (secretSlots !== undefined && secretSlots.length > 0
-                ? PRIVATE_FILE_MODE
-                : undefined);
-        plan.files.push({
-            relPath: normalizedPath,
-            content,
-            source,
-            // Only a path this package invented AND generated here is its own to
-            // replace; the same path carrying a caller's `resources` mount is that
-            // caller's file, whatever its name.
-            ...(source === "generated" && MATERIALIZER_OWNED_PATHS.has(normalizedPath)
-                ? { ownership: "materializer" }
-                : {}),
-            ...(fileMode === undefined ? {} : { mode: validateFileMode(fileMode) }),
-            ...(secretSlots === undefined
-                ? {}
-                : {
-                    secretSlots: secretSlots.map((slot) => ({
-                        path: [...slot.path],
-                        ref: { ...slot.ref },
-                    })),
-                }),
-        });
-    };
-    const add = (relPath, content, mode) => pushPlanFile(relPath, content, "generated", mode);
-    const unsupported = (dimension, reason) => plan.unsupported.push({ dimension, reason });
-    const explicitResourcePaths = new Map();
-    const addExplicitResource = (dimension, relPath, content, mode) => {
-        const normalizedPath = normalizeWorkspaceRelativePath(relPath);
-        const previousDimension = explicitResourcePaths.get(normalizedPath);
-        if (previousDimension) {
-            throw new Error(`Duplicate profile resource path: ${normalizedPath} (${previousDimension}, ${dimension})`);
-        }
-        // Refuse at plan time so {@link MATERIALIZER_OWNED_PATHS} stays true: those
-        // paths are replaced on every re-application, so a mount there would be
-        // silently overwritten by the next turn rather than kept.
-        if (MATERIALIZER_OWNED_PATHS.has(normalizedPath)) {
-            throw new Error(`Profile resource path is reserved by the materializer: ${normalizedPath} (${dimension}). ` +
-                "This package writes that path itself and replaces it on re-application, so a mount " +
-                "there cannot survive; choose another path.");
-        }
-        explicitResourcePaths.set(normalizedPath, dimension);
-        pushPlanFile(normalizedPath, content, "user", mode);
-    };
-    // 1) GENERIC FILES → exact workspace-relative paths. Inline refs are
-    // deterministic; remote refs must be resolved by an async caller first.
-    const fileMountPaths = new Set();
-    for (const mount of profile.resources?.files ?? []) {
-        const relPath = normalizeWorkspaceRelativePath(mount.path);
-        if (fileMountPaths.has(relPath)) {
-            throw new Error(`Duplicate workspace file mount: ${relPath}`);
-        }
-        fileMountPaths.add(relPath);
-        if (mount.executable !== undefined &&
-            typeof mount.executable !== "boolean") {
-            throw new Error(`Workspace file executable must be a boolean: ${relPath}`);
-        }
-        const resource = resolveInlineRef(mount.resource);
-        if (!resource) {
-            unsupported("files", `file mount "${relPath}" is not inline (github refs need async pre-resolution)`);
-            continue;
-        }
-        addExplicitResource("files", relPath, resource.content, mount.executable ? EXECUTABLE_FILE_MODE : DEFAULT_FILE_MODE);
-    }
-    // 2) PROVIDER-NATIVE TOOLS → only OpenCode exposes a verified cwd path.
-    for (const ref of profile.resources?.tools ?? []) {
-        const resource = resolveInlineRef(ref);
-        if (!resource) {
-            unsupported("tools", "tool ref is not inline (github refs need async pre-resolution)");
-            continue;
-        }
-        if (h !== "opencode") {
-            unsupported("tools", `${h}: no verified cwd-native file tool path; use MCP or a native extension`);
-            continue;
-        }
-        addExplicitResource("tools", `.opencode/tools/${resource.name}`, resource.content);
-    }
-    // 3) PROVIDER-NATIVE AGENTS → raw native definitions at verified cwd paths.
-    for (const ref of profile.resources?.agents ?? []) {
-        const resource = resolveInlineRef(ref);
-        if (!resource) {
-            unsupported("subagents", "agent ref is not inline (github refs need async pre-resolution)");
-            continue;
-        }
-        const directory = agentResourceDirectory(h);
-        if (!directory) {
-            unsupported("subagents", `${h}: agent definitions have no verified cwd-native resource path`);
-            continue;
-        }
-        const relPath = `${directory}/${resource.name}`;
-        addExplicitResource("subagents", relPath, resource.content);
-        if (h === "codex") {
-            const roleName = codexAgentRoleName(resource.name);
-            if (!roleName) {
-                unsupported("subagents", `codex: agent resource "${resource.name}" must use a lowercase role name`);
-            }
-            else {
-                registerCodexAgent(plan, roleName, relPath, roleName);
-            }
-        }
-    }
-    // 4) PROMPT. Replacing the harness's own system prompt and adding to it are
-    // two intents against one channel, and a harness almost never has both. Each
-    // lowers ONLY to a control whose measured job is exactly that intent; the
-    // other is refused. Substituting one for the other is the silent downgrade
-    // this section exists to prevent — an addition standing in for a replacement
-    // leaves the instructions the caller asked to delete in force, and a
-    // replacement standing in for an addition deletes the harness's own prompt.
-    // Neither is visible in the result, which is why both fail closed instead.
-    //
-    // `instructions` is a third, lower-privilege surface (the harness's
-    // AGENTS.md/CLAUDE.md-style context file). On gemini and opencode that surface
-    // does reach the model in the system-prompt position, so an addition can be
-    // lowered there ONLY where the plan can keep the two apart. opencode can: it
-    // loads exactly the files `opencode.json` `instructions[]` names, so the
-    // addition gets its own file registered ahead of the instruction file. gemini
-    // cannot: GEMINI.md is the one context file it auto-loads, so an addition
-    // lowered there would be byte-indistinguishable from `instructions`, which is
-    // one-channel-two-meanings recreated a level down.
-    //
-    // Which harness owns which intent is the measured harnessSystemPromptIntents
-    // table in @tangle-network/agent-interface; the mechanics per owned cell live
-    // here.
-    if (profile.prompt?.systemPrompt !== undefined) {
-        if (h === "claude-code" || h === "pi" || h === "prime") {
-            // claude-code `--system-prompt`, pi `--system-prompt`: both take the
-            // replacement as a launch argument the executor supplies, and both
-            // measurably drop the harness's built-in prompt from the wire request.
-            // prime inherits the same flag pair from its pi line (fork
-            // cli/args.ts:139-143 → resourceLoaderOptions main.ts:745-746, the
-            // replacement deletes the built-in prompt: resource-loader.ts:482-485,
-            // system-prompt.ts:72-73).
-            plan.systemPrompt = profile.prompt.systemPrompt;
-        }
-        else if (h === "codex") {
-            // codex has no replacement FLAG; its control is the config key
-            // `model_instructions_file`, which reads a cwd-relative file and becomes
-            // the request's entire `instructions` field. File + flag keeps the plan
-            // self-applying for every executor that already forwards plan.flags.
-            add(CODEX_SYSTEM_PROMPT_FILE, profile.prompt.systemPrompt);
-            plan.flags.push("-c", `model_instructions_file=${CODEX_SYSTEM_PROMPT_FILE}`);
-        }
-        else if (h === "gemini") {
-            add(".gemini/system.md", profile.prompt.systemPrompt);
-            plan.env.GEMINI_SYSTEM_MD = "1";
-        }
-        else if (h === "opencode") {
-            // opencode's replacement control is `agent.<name>.prompt`: it binds to
-            // ONE agent, and the agent is chosen at launch, so executing it means
-            // writing that agent AND selecting it. There are two shapes of executor
-            // that can promise one of those, and each gets the lowering it can apply;
-            // an executor that promises neither gets the refusal, because a plan
-            // written for an unknown launcher cannot deliver either half.
-            //
-            // No shape can express an EMPTY replacement — an agent `prompt` with no
-            // text falls back to the built-in prompt instead of deleting it — so the
-            // guard sits above the split and no path bypasses it.
-            const systemPrompt = profile.prompt.systemPrompt;
-            if (systemPrompt.trim().length === 0) {
-                throw new Error("opencode cannot express an empty exact system-prompt replacement");
-            }
-            if (binds.has("opencode.agent-prompt")) {
-                // A caller that composes opencode's own config and picks the agent
-                // itself owns the control outright; it does not read plan files or
-                // forward plan flags, so a workspace agent would never be selected.
-                // Hand it the intent named against the exact control it claimed.
-                plan.systemPromptBinding = {
-                    intent: "replace",
-                    control: "opencode.agent-prompt",
-                    systemPrompt,
-                };
-            }
-            else if (binds.has("systemPrompt")) {
-                // A caller that applies the plan's launch flags to the spawn it owns
-                // lets the plan execute the control itself: a `mode: primary` agent
-                // file holding the prompt, plus the `--agent` flag that selects it.
-                // Without the flag the file is inert and the built-in prompt the
-                // caller asked to delete stays in force, so the two are pushed
-                // together or not at all.
-                const primaryAgentName = `${OPENCODE_PRIMARY_AGENT_PREFIX}${sha256(systemPrompt).slice(0, 16)}`;
-                const primaryAgentPath = `.opencode/agents/${primaryAgentName}.md`;
-                if (profile.subagents?.[primaryAgentName] !== undefined) {
-                    throw new Error(`opencode: subagent name "${primaryAgentName}" is reserved for the profile primary agent`);
-                }
-                plan.systemPrompt = systemPrompt;
-                add(primaryAgentPath, ["---", "mode: primary", "---", systemPrompt, ""].join("\n"));
-                plan.flags.push("--agent", primaryAgentName);
-            }
-            else {
-                unsupported("systemPrompt", systemPromptRefusal(h));
-            }
-        }
-        else {
-            unsupported("systemPrompt", systemPromptRefusal(h));
-        }
-    }
-    // Ordered registration list for opencode, whose TUI and headless runs read
-    // ONLY the files named here. Addition first so it frames the lower-privilege
-    // instruction file that follows, matching the order the model receives them.
-    const openCodeInstructionFiles = [];
-    // A launcher that declared `opencode.agent-prompt` composes opencode's config
-    // itself and reads neither plan files nor plan flags, so the workspace
-    // `opencode.json` that registers these additive files would never load.
-    // Lowering them anyway would be the silent drop this module refuses to
-    // perform, so each additive intent is refused by name instead: the launcher
-    // owns the `instructions[]` channel too and must compose it in the config it
-    // builds.
-    const openCodeConfigUnreachable = h === "opencode" && binds.has("opencode.agent-prompt");
-    if (profile.prompt?.appendSystemPrompt !== undefined) {
-        const appendSystemPrompt = profile.prompt.appendSystemPrompt;
-        if (appendSystemPrompt.trim().length === 0) {
-            throw new Error("prompt.appendSystemPrompt must be non-empty text");
-        }
-        if (openCodeConfigUnreachable) {
-            unsupported("appendSystemPrompt", "opencode: the launcher that binds opencode.agent-prompt composes opencode's config itself and loads no workspace opencode.json, so an addition registered there would never reach the model; compose it into the launcher's own instructions[]");
-        }
-        else if (h === "opencode") {
-            // opencode composes config-declared `instructions[]` file contents into
-            // the same single role:"system" message as its built-in prompt, which
-            // stays in place (its replacement control is the separate per-agent
-            // `prompt` field). A dedicated file keeps this intent addressable on its
-            // own rather than merged into the instruction file.
-            add(OPENCODE_APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt.endsWith("\n")
-                ? appendSystemPrompt
-                : `${appendSystemPrompt}\n`);
-            openCodeInstructionFiles.push(OPENCODE_APPEND_SYSTEM_PROMPT_FILE);
-        }
-        else if (h === "claude-code" || h === "pi" || h === "prime") {
-            // claude-code `--append-system-prompt`, pi `--append-system-prompt`: both
-            // add the caller's text to the harness's own system prompt, which stays
-            // on the wire intact. prime inherits the same flag from its pi line (fork
-            // cli/args.ts:139-143, the addition appends after the built-in prompt:
-            // system-prompt.ts:61,109-110). Carried beside the replacement rather
-            // than merged into it, so an executor applies each through its own
-            // control and the plan's identity distinguishes the two intents.
-            plan.appendSystemPrompt = appendSystemPrompt;
-        }
-        else {
-            unsupported("appendSystemPrompt", appendSystemPromptRefusal(h));
-        }
-    }
-    const instr = [];
-    if (profile.prompt?.instructions?.length)
-        instr.push(...profile.prompt.instructions);
-    const resInstr = profile.resources?.instructions;
-    if (typeof resInstr === "string")
-        instr.push(resInstr);
-    else if (resInstr && resInstr.kind === "inline")
-        instr.push(resInstr.content);
-    else if (resInstr) {
-        unsupported("instructions", "instruction ref is not inline (github refs need async pre-resolution)");
-    }
-    if (instr.length) {
-        if (openCodeConfigUnreachable) {
-            unsupported("instructions", "opencode: the launcher that binds opencode.agent-prompt composes opencode's config itself and loads no workspace opencode.json, so an instruction file registered there would never reach the model; compose it into the launcher's own instructions[]");
-        }
-        else {
-            const instructionPath = CONTEXT_FILE[h];
-            add(instructionPath, `${instr.join("\n\n")}\n`);
-            if (h === "opencode")
-                openCodeInstructionFiles.push(instructionPath);
-            // gemini reads AGENTS.md only via settings; we write GEMINI.md so no extra step.
-        }
-    }
-    // ONE opencode.json write for the whole prompt section: top-level JSON merge
-    // is last-wins per key, and two `add` calls at the same relPath are a
-    // duplicate-file error, so a second write would drop whichever lost.
-    if (openCodeInstructionFiles.length > 0) {
-        add("opencode.json", serializeWorkspacePlanJson({
-            $schema: "https://opencode.ai/config.json",
-            instructions: openCodeInstructionFiles,
-        }));
-    }
-    // 5) ACTIVE EXECUTION CONTROLS. These alter the tools visible to the primary
-    // process and its permission policy, so they must be lowered into native
-    // launch/config inputs rather than merely retained in profile metadata.
-    materializeExecutionControls(h, profile.tools, profile.permissions, profile.modes, plan, add, unsupported);
-    if ((profile.connections?.length ?? 0) > 0) {
-        unsupported("connections", `${h}: Hub connections must be resolved to authorized MCP servers by the execution runtime`);
-    }
-    if (profile.confidential !== undefined) {
-        unsupported("confidential", `${h}: confidential execution requires runtime placement and attestation, not workspace files`);
-    }
-    // 6) SKILLS → native skill dir, from resources.skills refs (the box's shape), or
-    //    fail-closed (hermes has no cwd skill dir; github refs need async pre-resolution).
-    for (const ref of profile.resources?.skills ?? []) {
-        const r = resolveInlineRef(ref);
-        if (!r) {
-            unsupported("skills", "skill ref is not inline (github refs need async pre-resolution)");
-            continue;
-        }
-        const dir = SKILL_DIR[h];
-        if (!dir) {
-            unsupported("skills", `${h}: no cwd skill dir (skills live in a user/global dir); skill "${r.name}" not mounted`);
-            continue;
-        }
-        addExplicitResource("skills", `${dir}/${r.name}/SKILL.md`, normalizeSkillMd(r.name, r.content));
-    }
-    // 7) MCP -> each harness's native configuration and launch controls.
-    const mcp = activeMcpServers(profile.mcp);
-    if (!skip.has("mcp") && Object.keys(mcp).length)
-        materializeMcp(h, mcp, plan, add, unsupported);
-    // 8) HOOKS → per-harness format; cwd-native only for claude/codex/gemini/opencode(plugin).
-    const hooks = profile.hooks ?? {};
-    if (Object.keys(hooks).length)
-        materializeHooks(h, hooks, add, unsupported, plan);
-    // 9) SUBAGENTS → cwd-native for claude/codex/opencode/gemini; flag/global elsewhere.
-    const subagents = profile.subagents ?? {};
-    for (const [name, sa] of Object.entries(subagents))
-        materializeSubagent(h, name, sa, plan, add, unsupported);
-    if (!skip.has("extensions")) {
-        for (const namespace of extensionNamespaces(h)) {
-            const extension = profile.extensions?.[namespace];
-            if (extension && Object.keys(extension).length > 0) {
-                unsupported("extensions", `${h}: extension namespace "${namespace}" requires provider-native handling`);
-            }
-        }
-    }
-    // 10) COMMANDS → cwd-native (resources.commands refs); "commands are skills" on kimi.
-    for (const ref of profile.resources?.commands ?? []) {
-        const r = resolveInlineRef(ref);
-        if (!r) {
-            unsupported("commands", "command ref is not inline (github needs pre-resolution)");
-            continue;
-        }
-        materializeCommand(h, r.name, r.content, (path, content, mode) => addExplicitResource("commands", path, content, mode), unsupported);
-    }
-    for (const [relPath, dimension] of explicitResourcePaths) {
-        const writers = plan.files.filter((file) => file.relPath === relPath).length;
-        if (writers > 1) {
-            throw new Error(`Profile ${dimension} resource conflicts with generated harness file: ${relPath}`);
-        }
-    }
-    // Merge native multi-writer JSON files (for example Claude settings from both
-    // mcp and hooks) so the second writer cannot clobber the first.
-    plan.files = mergeJsonFiles(plan.files).sort((a, b) => compareStrings(a.relPath, b.relPath));
-    if (profile.resources?.failOnError && plan.unsupported.length) {
-        throw new Error(formatUnsupported(plan.unsupported));
-    }
-    return plan;
-}
-function activeMcpServers(servers) {
-    return Object.fromEntries(Object.entries(servers ?? {}).filter((entry) => entry[1].enabled !== false));
-}
-function extensionNamespaces(harness) {
-    return [harness];
-}
-/**
- * Materialize a sealed candidate profile without weakening its process values.
- * Codex and Claude hooks use generated no-shell wrappers to preserve executable,
- * argv, and environment values separately. Other hook formats fail closed.
- */
-export function materializeCandidateProfile(profile, harness, opts = {}) {
-    assertMaterializerHarness(harness);
-    const candidate = agentCandidateProfileSchema.parse(profile);
-    verifyCandidateInlineResources(candidate);
-    const hookLowering = lowerCandidateHooks(candidate.hooks, harness);
-    const candidateResources = candidate.resources
-        ? candidateResourcesForClassicMaterializer(candidate.resources, opts.resolvedResources)
-        : {};
-    candidateResources.files = [
-        ...(candidateResources.files ?? []),
-        ...hookLowering.wrapperFiles,
-    ];
-    const classicProfile = {
-        ...candidate,
-        resources: candidateResources,
-        mcp: candidateMcpRecordForClassicMaterializer(candidate.mcp),
-        hooks: hookLowering.hooks,
-    };
-    const classicPlan = materializeProfile(classicProfile, harness, {
-        binds: opts.binds,
-    });
-    // Canonical candidate evidence has no field for a launcher-addressed binding.
-    // Refuse that shape instead of returning a candidate plan whose receipt would
-    // omit the exact control still owed by the launcher.
-    if (classicPlan.systemPromptBinding !== undefined) {
-        throw new Error(`Sealed candidate evidence cannot represent a system-prompt binding to ${classicPlan.systemPromptBinding.control}`);
-    }
-    if (hookLowering.unsupportedReason) {
-        classicPlan.unsupported.push({
-            dimension: "hooks",
-            reason: hookLowering.unsupportedReason,
-        });
-    }
-    classicPlan.unsupported.sort((left, right) => compareStrings(`${left.dimension}\0${left.reason}`, `${right.dimension}\0${right.reason}`));
-    assertWorkspacePlanSupported(classicPlan);
-    return {
-        sourceProfileDigest: canonicalCandidateDigest(candidate),
-        harness: classicPlan.harness,
-        files: classicPlan.files,
-        env: candidatePublicRecord(classicPlan.env),
-        flags: classicPlan.flags.map(candidatePublicArgument),
-        ...promptIntentFields(classicPlan, candidatePublicValue),
-        unsupported: classicPlan.unsupported,
-    };
-}
-function lowerCandidateHooks(hooks, harness) {
-    if (!hooks || Object.keys(hooks).length === 0)
-        return { wrapperFiles: [] };
-    const nativeHarness = harness;
-    if (nativeHarness !== "codex" && nativeHarness !== "claude-code") {
-        return {
-            wrapperFiles: [],
-            unsupportedReason: `${nativeHarness} hook configuration requires an unverified command-string mapping; ` +
-                "sealed candidate hooks preserve executable, argv, and env separately",
-        };
-    }
-    const wrapperFiles = [];
-    const lowered = {};
-    for (const [event, commands] of Object.entries(hooks)) {
-        lowered[event] = commands.map((command, index) => {
-            const wrapper = candidateHookWrapper(event, index, command);
-            wrapperFiles.push({
-                path: wrapper.path,
-                resource: {
-                    kind: "inline",
-                    name: wrapper.path,
-                    content: wrapper.content,
-                },
-            });
-            return {
-                command: `node ${wrapper.path}`,
-                timeoutMs: command.timeoutMs,
-                blocking: command.blocking,
-                matcher: command.matcher,
-            };
-        });
-    }
-    return { hooks: lowered, wrapperFiles };
-}
-function candidateHookWrapper(event, index, command) {
-    const args = (command.args ?? []).map(candidatePublicString);
-    const env = Object.fromEntries(Object.entries(command.env ?? {})
-        .sort(([left], [right]) => compareStrings(left, right))
-        .map(([name, value]) => [name, candidatePublicString(value)]));
-    const wrapperId = canonicalCandidateDigest({
-        event,
-        index,
-        executable: command.executable,
-        args,
-        env,
-        timeoutMs: command.timeoutMs ?? null,
-        blocking: command.blocking ?? null,
-        matcher: command.matcher ?? null,
-    }).slice("sha256:".length);
-    const path = `.tangle/profile-hooks/${wrapperId}.mjs`;
-    const content = hookWrapperSource(command.executable, args, env);
-    return { path, content };
-}
-function agentResourceDirectory(harness) {
-    switch (harness) {
-        case "claude-code":
-        case "nanoclaw":
-            return ".claude/agents";
-        case "codex":
-            return ".codex/agents";
-        case "opencode":
-            return ".opencode/agents";
-        case "gemini":
-            return ".gemini/agents";
-        default:
-            return null;
-    }
-}
-function candidateMcpRecordForClassicMaterializer(servers) {
-    if (!servers)
-        return undefined;
-    return Object.fromEntries(Object.entries(servers)
-        .filter((entry) => entry[1].enabled !== false)
-        .map(([name, server]) => [
-        name,
-        candidateMcpForClassicMaterializer(server),
-    ]));
-}
-function candidateMcpForClassicMaterializer(server) {
-    return {
-        command: server.command,
-        ...(server.transport === undefined ? {} : { transport: server.transport }),
-        ...(server.args === undefined
-            ? {}
-            : {
-                args: server.args.map((value) => profilePublicValue(candidatePublicString(value))),
-            }),
-        ...(server.env === undefined
-            ? {}
-            : {
-                env: Object.fromEntries(Object.entries(server.env).map(([name, value]) => [
-                    name,
-                    profilePublicValue(candidatePublicString(value)),
-                ])),
-            }),
-        ...(server.cwd === undefined ? {} : { cwd: server.cwd }),
-    };
-}
-function candidateResourcesForClassicMaterializer(resources, resolvedResources) {
-    const convert = (ref) => {
-        if (ref.kind === "inline") {
-            return { kind: "inline", name: ref.name, content: ref.content };
-        }
-        const content = resolvedResources?.get(ref.sha256);
-        if (content !== undefined) {
-            verifyCandidateResourceBytes(ref, content, ref.name ?? ref.path);
-            return {
-                kind: "inline",
-                name: ref.name ?? ref.path.split("/").at(-1) ?? "resource",
-                content,
-            };
-        }
-        return {
-            kind: "github",
-            repository: `${ref.repository.owner}/${ref.repository.repo}`,
-            path: ref.path,
-            ref: ref.commit,
-            name: ref.name,
-        };
-    };
-    return {
-        files: resources.files?.map((mount) => ({
-            path: mount.path,
-            resource: convert(mount.resource),
-            executable: mount.executable,
-        })),
-        tools: resources.tools?.map(convert),
-        skills: resources.skills?.map(convert),
-        agents: resources.agents?.map(convert),
-        commands: resources.commands?.map(convert),
-        instructions: typeof resources.instructions === "string"
-            ? resources.instructions
-            : resources.instructions
-                ? convert(resources.instructions)
-                : undefined,
-        // The candidate wrapper owns the complete unsupported check after it adds
-        // dimensions that the classic materializer cannot represent.
-        failOnError: false,
-    };
-}
-function candidatePublicString(value) {
-    if (value.kind !== "public") {
-        throw new Error("Candidate materialization accepts public config values only");
-    }
-    return value.value;
-}
-function candidatePublicValue(value) {
-    return { kind: "public", value };
-}
-function profilePublicValue(value) {
-    return { kind: "public", value };
-}
-function candidatePublicArgument(value) {
-    if (typeof value !== "string") {
-        throw new Error("Candidate materialization cannot emit private launch arguments");
-    }
-    return candidatePublicValue(value);
-}
-function candidatePublicRecord(values) {
-    return Object.fromEntries(Object.entries(values).map(([name, value]) => {
-        if (typeof value !== "string") {
-            throw new Error("Candidate materialization cannot emit private environment values");
-        }
-        return [name, candidatePublicValue(value)];
-    }));
-}
-function verifyCandidateInlineResources(profile) {
-    const resources = profile.resources;
-    if (!resources)
-        return;
-    const refs = [
-        ...(resources.files?.map((mount) => mount.resource) ?? []),
-        ...(resources.tools ?? []),
-        ...(resources.skills ?? []),
-        ...(resources.agents ?? []),
-        ...(resources.commands ?? []),
-        ...(typeof resources.instructions === "object"
-            ? [resources.instructions]
-            : []),
-    ];
-    for (const ref of refs) {
-        if (ref.kind !== "inline")
-            continue;
-        verifyCandidateResourceBytes(ref, ref.content, ref.name);
-    }
-}
-function verifyCandidateResourceBytes(ref, content, label) {
-    const bytes = Buffer.from(content, "utf8");
-    const digest = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-    if (bytes.byteLength !== ref.byteLength || digest !== ref.sha256) {
-        throw new Error(`Candidate resource integrity mismatch: ${label}`);
-    }
-}
-function formatUnsupported(unsupported) {
-    return `Unable to materialize ${unsupported.length} profile resource(s):\n${unsupported
-        .map(({ dimension, reason }) => `- ${dimension}: ${reason}`)
-        .join("\n")}`;
-}
-/** Collapse multiple PlanFiles with the same relPath: top-level-merge JSON, last-wins
- *  for non-JSON. settings.json contributors use disjoint top-level keys, so this unions them. */
-function mergeJsonFiles(files) {
-    const byPath = new Map();
-    for (const f of files) {
-        const prev = byPath.get(f.relPath);
-        if (!prev) {
-            byPath.set(f.relPath, f);
-            continue;
-        }
-        if (f.relPath.endsWith(".json")) {
-            try {
-                const next = JSON.parse(f.content);
-                const merged = {
-                    ...JSON.parse(prev.content),
-                    ...next,
-                };
-                const replacedRoots = new Set(Object.keys(next));
-                const secretSlots = [
-                    ...(prev.secretSlots ?? []).filter((slot) => typeof slot.path[0] === "string" &&
-                        !replacedRoots.has(slot.path[0])),
-                    ...(f.secretSlots ?? []),
-                ];
-                const { secretSlots: _previousSecretSlots, ...previousFile } = prev;
-                byPath.set(f.relPath, {
-                    ...previousFile,
-                    content: JSON.stringify(merged, null, 2),
-                    ...(secretSlots.length > 0 ? { mode: PRIVATE_FILE_MODE } : {}),
-                    ...(secretSlots.length === 0 ? {} : { secretSlots }),
-                });
-                continue;
-            }
-            catch {
-                /* fall through to last-wins */
-            }
-        }
-        byPath.set(f.relPath, f); // non-JSON or parse-fail: last wins
-    }
-    return [...byPath.values()];
-}
-function valueAtJsonPath(root, path) {
-    let current = root;
-    for (const segment of path) {
-        if (current === null ||
-            typeof current !== "object" ||
-            !Object.hasOwn(current, segment)) {
-            return undefined;
-        }
-        current = current[segment];
-    }
-    return current;
-}
-function normalizePlanFileSecretSlots(file) {
-    if (file.secretSlots === undefined)
-        return [];
-    if (file.source !== "generated" ||
-        !file.relPath.endsWith(".json") ||
-        file.secretSlots.length === 0) {
-        throw new Error(`Workspace secret slots require a generated JSON file: ${file.relPath}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(file.content);
-    }
-    catch {
-        throw new Error(`Workspace secret slots require valid JSON content: ${file.relPath}`);
-    }
-    const seen = new Set();
-    return file.secretSlots.map((slot) => {
-        if (!Array.isArray(slot.path) || slot.path.length === 0) {
-            throw new Error(`Workspace secret slot path must be non-empty: ${file.relPath}`);
-        }
-        const path = slot.path.map((segment) => {
-            if ((typeof segment !== "string" && typeof segment !== "number") ||
-                (typeof segment === "number" &&
-                    (!Number.isSafeInteger(segment) || segment < 0))) {
-                throw new Error(`Workspace secret slot path is invalid: ${file.relPath}`);
-            }
-            return segment;
-        });
-        const identity = JSON.stringify(path);
-        if (seen.has(identity)) {
-            throw new Error(`Duplicate workspace secret slot path: ${file.relPath} ${identity}`);
-        }
-        seen.add(identity);
-        if (valueAtJsonPath(parsed, path) !== null) {
-            throw new Error(`Workspace secret slot must point at a null placeholder: ${file.relPath} ${identity}`);
-        }
-        return {
-            path,
-            ref: agentProfileSecretRefSchema.parse(slot.ref),
-        };
-    });
-}
-function normalizePlanFiles(files) {
-    const seen = new Set();
-    return files
-        .map((file) => {
-        const relPath = normalizeWorkspaceRelativePath(file.relPath);
-        if (seen.has(relPath)) {
-            throw new Error(`Duplicate workspace plan file: ${relPath}`);
-        }
-        seen.add(relPath);
-        if (typeof file.content !== "string") {
-            throw new Error(`Workspace file content must be a string: ${relPath}`);
-        }
-        const mode = validateFileMode(file.mode);
-        const secretSlots = normalizePlanFileSecretSlots(file);
-        if (secretSlots.length > 0 && (mode & 0o077) !== 0) {
-            throw new Error(`Workspace secret-bearing file must not grant group or other access: ${relPath}`);
-        }
-        return {
-            relPath,
-            content: file.content,
-            mode,
-            ownership: file.ownership ?? "shared",
-            secretSlots,
-        };
-    })
-        .sort((a, b) => compareStrings(a.relPath, b.relPath));
-}
-const sha256 = (value) => createHash("sha256").update(value, "utf8").digest("hex");
-function normalizeWorkspacePlanArgument(value) {
-    if (typeof value === "string")
-        return value;
-    if (value.kind !== "workspace-plan-argument-template" ||
-        !Array.isArray(value.segments) ||
-        value.segments.length === 0) {
-        throw new Error("Workspace plan argument template is malformed");
-    }
-    const segments = [];
-    for (const segment of value.segments) {
-        if (typeof segment === "string") {
-            const previous = segments.at(-1);
-            if (typeof previous === "string") {
-                segments[segments.length - 1] = previous + segment;
-            }
-            else if (segment.length > 0) {
-                segments.push(segment);
-            }
-            continue;
-        }
-        if (segment.kind !== "secret" ||
-            (segment.encoding !== "raw" && segment.encoding !== "json-string")) {
-            throw new Error("Workspace plan secret argument segment is malformed");
-        }
-        segments.push({
-            kind: "secret",
-            ref: agentProfileSecretRefSchema.parse(segment.ref),
-            encoding: segment.encoding,
-        });
-    }
-    if (segments.every((segment) => typeof segment === "string")) {
-        return segments.join("");
-    }
-    return { kind: "workspace-plan-argument-template", segments };
-}
-/**
- * Hash the exact files, modes, flags, environment, and unsupported dimensions
- * represented by a plan. Array order is preserved only where it changes spawn
- * behavior; unordered maps and file records are canonicalized first.
- */
-export function hashWorkspacePlan(plan) {
-    const files = normalizePlanFiles(plan.files).map((file) => ({
-        relPath: file.relPath,
-        mode: file.mode,
-        contentSha256: sha256(file.content),
-        // Ownership decides whether re-application may replace the file, so two
-        // plans identical in bytes but different here behave differently in the
-        // same workspace — the digest a receipt proves must say which one ran.
-        ownership: file.ownership,
-        ...(file.secretSlots.length === 0
-            ? {}
-            : {
-                secretSlots: [...file.secretSlots].sort((left, right) => compareStrings(JSON.stringify(left.path), JSON.stringify(right.path))),
-            }),
-    }));
-    const env = Object.fromEntries(Object.entries(plan.env)
-        .sort(([a], [b]) => compareStrings(a, b))
-        .map(([name, value]) => [
-        name,
-        typeof value === "string"
-            ? value
-            : agentProfileSecretRefSchema.parse(value),
-    ]));
-    const unsupported = [...plan.unsupported].sort((a, b) => compareStrings(`${a.dimension}\0${a.reason}`, `${b.dimension}\0${b.reason}`));
-    // A plan that needs an extension is not the same plan as one that does not, even when every
-    // byte it writes is identical — the digest is what a receipt proves, so it must say so.
-    const requires = [...(plan.requires ?? [])].sort((a, b) => compareStrings(`${a.kind}\0${a.id}`, `${b.kind}\0${b.id}`));
-    const canonical = JSON.stringify({
-        harness: plan.harness,
-        files,
-        env,
-        flags: plan.flags.map(normalizeWorkspacePlanArgument),
-        ...promptIntentFields(plan, samePromptIntentValue),
-        // A plan that owes a launcher a replacement is not the same plan as one
-        // that owes nothing, even when every byte it writes is identical.
-        ...systemPromptBindingField(plan),
-        unsupported,
-        ...(requires.length === 0 ? {} : { requires }),
-    });
-    return `sha256:${sha256(canonical)}`;
-}
-/** Build the exact digest-free identity document required by agent-interface. */
-export function agentCandidateProfilePlanMaterial(plan) {
-    const material = {
-        sourceProfileDigest: plan.sourceProfileDigest,
-        harness: plan.harness,
-        files: normalizePlanFiles(plan.files).map((file) => ({
-            relPath: file.relPath,
-            mode: file.mode,
-            contentSha256: `sha256:${sha256(file.content)}`,
-        })),
-        env: Object.fromEntries(Object.entries(plan.env).sort(([left], [right]) => compareStrings(left, right))),
-        flags: [...plan.flags],
-        ...promptIntentFields(plan, samePromptIntentValue),
-        unsupported: [...plan.unsupported].sort((left, right) => compareStrings(`${left.dimension}\0${left.reason}`, `${right.dimension}\0${right.reason}`)),
-    };
-    return agentCandidateProfilePlanMaterialSchema.parse(material);
-}
-/**
- * Return the RFC 8785 UTF-8 bytes and SHA-256 identity of a candidate profile
- * plan. The returned bytes are the exact bytes embedded in receipt evidence.
- */
-export function canonicalizeAgentCandidateProfilePlan(plan) {
-    const material = agentCandidateProfilePlanMaterial(plan);
-    const bytes = canonicalCandidateBytes(material);
-    const digest = canonicalCandidateDigest(material);
-    return { material, bytes, digest };
-}
-/** Capture portable evidence of the exact canonical profile-plan bytes. */
-export function captureAgentCandidateProfilePlan(plan) {
-    const canonical = canonicalizeAgentCandidateProfilePlan(plan);
-    const artifact = {
-        encoding: "base64",
-        content: Buffer.from(canonical.bytes).toString("base64"),
-        sha256: canonical.digest,
-        byteLength: canonical.bytes.byteLength,
-    };
-    return agentCandidateProfilePlanEvidenceSchema.parse({
-        kind: "agent-profile-workspace-plan",
-        digest: canonical.digest,
-        material: canonical.material,
-        artifact,
-    });
-}
-/**
- * Apply a candidate plan and return its spawn values together with captured
- * canonical evidence. No caller needs to re-serialize or reinterpret the plan.
- */
-export function applyAgentCandidateWorkspacePlan(plan, workspaceDir, targetWorkspace) {
-    assertWorkspacePlanSupported(plan);
-    const profilePlan = captureAgentCandidateProfilePlan(plan);
-    const activationFiles = normalizePlanFiles(plan.files).map((file) => ({
-        path: file.relPath,
-        mode: file.mode,
-        content: file.content,
-    }));
-    const activationMaterial = {
-        kind: "agent-candidate-profile-activation",
-        profilePlan,
-        files: activationFiles,
-    };
-    const profileActivation = agentCandidateProfileActivationSchema.parse({
-        ...activationMaterial,
-        digest: canonicalCandidateDigest(activationMaterial),
-    });
-    const applied = applyWorkspacePlan({
-        harness: plan.harness,
-        files: plan.files,
-        env: Object.fromEntries(Object.entries(plan.env).map(([name, value]) => [
-            name,
-            candidatePublicString(value),
-        ])),
-        flags: plan.flags.map(candidatePublicString),
-        ...promptIntentFields(plan, candidatePublicString),
-        unsupported: plan.unsupported,
-    }, workspaceDir);
-    return {
-        profileActivation,
-        application: {
-            planDigest: profilePlan.digest,
-            targetWorkspace,
-            mountPaths: applied.written,
-        },
-        env: { ...plan.env },
-        flags: [...plan.flags],
-        ...promptIntentFields(plan, samePromptIntentValue),
-        unsupported: [...plan.unsupported],
-    };
-}
-/**
- * Apply a public-only WorkspacePlan. A plan with any secret reference fails
- * before the first write; private executors use
- * {@link applyWorkspacePlanWithSecretProvider} instead.
- */
-export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
-    return applyResolvedWorkspacePlan(plan, resolvePublicWorkspacePlan(plan), workspaceDir, options).receipt;
-}
-/**
- * Resolve opaque profile references through an executor-owned provider, then
- * apply the resulting private native files and launch inputs. Resolution
- * completes before any workspace write, and resolved values never enter the
- * public plan, digest, receipt, logs, or error messages.
- */
-export async function applyWorkspacePlanWithSecretProvider(plan, workspaceDir, secretProvider, options = {}) {
-    const planDigest = hashWorkspacePlan(plan);
-    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider);
-    return applyResolvedWorkspacePlan(plan, resolved, workspaceDir, options, planDigest);
-}
-function secretRefLabel(ref) {
-    return JSON.stringify(ref.key);
-}
-function requireResolvedSecretValue(ref, value) {
-    if (typeof value !== "string" || value.trim().length === 0) {
-        throw new Error(`AgentProfile secret provider returned no value for ${secretRefLabel(ref)}`);
-    }
-    return value;
-}
-function setValueAtJsonPath(root, path, value) {
-    let current = root;
-    for (const segment of path.slice(0, -1)) {
-        if (current === null ||
-            typeof current !== "object" ||
-            !Object.hasOwn(current, segment)) {
-            throw new Error("Generated profile JSON secret path no longer exists");
-        }
-        current = current[segment];
-    }
-    const finalSegment = path.at(-1);
-    if (finalSegment === undefined ||
-        current === null ||
-        typeof current !== "object" ||
-        !Object.hasOwn(current, finalSegment)) {
-        throw new Error("Generated profile JSON secret path no longer exists");
-    }
-    Object.defineProperty(current, finalSegment, {
-        value,
-        enumerable: true,
-        configurable: true,
-        writable: true,
-    });
-}
-function resolvePublicWorkspacePlan(plan) {
-    const files = normalizePlanFiles(plan.files);
-    for (const file of files) {
-        const ref = file.secretSlots[0]?.ref;
-        if (ref) {
-            throw new Error(`Workspace plan requires an AgentProfileSecretProvider for ${secretRefLabel(ref)}`);
-        }
-    }
-    const env = Object.fromEntries(Object.entries(plan.env).map(([name, value]) => {
-        if (typeof value !== "string") {
-            throw new Error(`Workspace plan requires an AgentProfileSecretProvider for ${secretRefLabel(value)}`);
-        }
-        return [name, value];
-    }));
-    const flags = plan.flags.map((argument) => {
-        const normalized = normalizeWorkspacePlanArgument(argument);
-        if (typeof normalized !== "string") {
-            const segment = normalized.segments.find((value) => typeof value !== "string");
-            if (!segment) {
-                throw new Error("Workspace plan argument template is malformed");
-            }
-            throw new Error(`Workspace plan requires an AgentProfileSecretProvider for ${secretRefLabel(segment.ref)}`);
-        }
-        return normalized;
-    });
-    return {
-        files,
-        env,
-        flags,
-        ...promptIntentFields(plan, samePromptIntentValue),
-        ...systemPromptBindingField(plan),
-    };
-}
-async function resolvePrivateWorkspacePlan(plan, secretProvider) {
-    if (!secretProvider || typeof secretProvider.get !== "function") {
-        throw new Error("AgentProfileSecretProvider.get is required");
-    }
-    const pending = new Map();
-    const resolveRef = async (input) => {
-        const ref = agentProfileSecretRefSchema.parse(input);
-        let raw = pending.get(ref.key);
-        if (!raw) {
-            raw = (async () => {
-                let value;
-                try {
-                    value = await secretProvider.get(ref.key);
-                }
-                catch {
-                    throw new Error(`AgentProfile secret provider failed for ${secretRefLabel(ref)}`);
-                }
-                return requireResolvedSecretValue(ref, value);
-            })();
-            pending.set(ref.key, raw);
-        }
-        const value = await raw;
-        return ref.format === "bearer" ? `Bearer ${value}` : value;
-    };
-    const files = await Promise.all(normalizePlanFiles(plan.files).map(async (file) => {
-        if (file.secretSlots.length === 0)
-            return file;
-        const parsed = JSON.parse(file.content);
-        const values = await Promise.all(file.secretSlots.map(async (slot) => ({
-            path: slot.path,
-            value: await resolveRef(slot.ref),
-        })));
-        for (const resolved of values) {
-            setValueAtJsonPath(parsed, resolved.path, resolved.value);
-        }
-        return {
-            ...file,
-            content: JSON.stringify(parsed, null, 2),
-            secretSlots: [],
-        };
-    }));
-    const env = Object.fromEntries(await Promise.all(Object.entries(plan.env).map(async ([name, value]) => [
-        name,
-        typeof value === "string" ? value : await resolveRef(value),
-    ])));
-    const flags = await Promise.all(plan.flags.map(async (argument) => {
-        const normalized = normalizeWorkspacePlanArgument(argument);
-        if (typeof normalized === "string")
-            return normalized;
-        const segments = await Promise.all(normalized.segments.map(async (segment) => {
-            if (typeof segment === "string")
-                return segment;
-            const value = await resolveRef(segment.ref);
-            return segment.encoding === "json-string"
-                ? JSON.stringify(value)
-                : value;
-        }));
-        return segments.join("");
-    }));
-    return {
-        files,
-        env,
-        flags,
-        ...promptIntentFields(plan, samePromptIntentValue),
-        ...systemPromptBindingField(plan),
-    };
-}
-function safeWorkspacePlanReceipt(plan, written, workspacePlanDigest = hashWorkspacePlan(plan)) {
-    return {
-        workspacePlanDigest,
-        env: Object.fromEntries(Object.entries(plan.env).map(([name, value]) => [
-            name,
-            typeof value === "string" ? value : { ...value },
-        ])),
-        flags: plan.flags.map(normalizeWorkspacePlanArgument),
-        ...promptIntentFields(plan, samePromptIntentValue),
-        ...systemPromptBindingField(plan),
-        unsupported: plan.unsupported.map((entry) => ({ ...entry })),
-        written: [...written],
-    };
-}
-function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDir, options, publicPlanDigest = hashWorkspacePlan(publicPlan)) {
-    const workspaceRoot = resolve(workspaceDir);
-    const runtimeOnlyFiles = new Set((options.runtimeOnlyFiles ?? []).map(normalizeWorkspaceRelativePath));
-    const existingFiles = options.existingFiles ?? "allow-identical";
-    if (existingFiles !== "allow-identical" && existingFiles !== "reject") {
-        throw new Error(`Unsupported existing workspace file policy: ${existingFiles}`);
-    }
-    const resolvedFiles = resolvedPlan.files;
-    const privateRuntimeFiles = Object.fromEntries(resolvedFiles
-        .filter((file) => runtimeOnlyFiles.has(file.relPath))
-        .map((file) => [file.relPath, file.content]));
-    const files = resolvedFiles
-        .filter((file) => !runtimeOnlyFiles.has(file.relPath))
-        .map((file) => ({
-        ...file,
-        absPath: resolveWorkspaceFilePath(workspaceRoot, file.relPath),
-    }));
-    // A prior application of THIS EXACT plan makes the workspace the running
-    // agent's live state: a file the agent edited or removed since then is the
-    // session's own memory, not a conflict, so a byte comparison against the
-    // plan would refuse a resume the caller proved is unchanged. The digest the
-    // caller passes is its own record of what it already applied here; only the
-    // caller can know that, which is why this is an option and not an inference
-    // from disk. `reject` is not short-circuited: that policy asserts an empty
-    // target and must keep failing on any pre-existing path.
-    if (existingFiles === "allow-identical" &&
-        options.appliedPlanDigest !== undefined &&
-        options.appliedPlanDigest === publicPlanDigest) {
-        return {
-            receipt: safeWorkspacePlanReceipt(publicPlan, files.map((file) => file.relPath), publicPlanDigest),
-            spawn: {
-                env: { ...resolvedPlan.env },
-                flags: [...resolvedPlan.flags],
-                ...promptIntentFields(resolvedPlan, samePromptIntentValue),
-                ...systemPromptBindingField(resolvedPlan),
-            },
-            runtimeOnlyFiles: privateRuntimeFiles,
-        };
-    }
-    // A path this package invented can only hold this package's own earlier
-    // output, so re-applying into the same workspace replaces it rather than
-    // failing the turn. `reject` still refuses: that policy is "nothing may
-    // pre-exist here", which is a statement about the workspace, not authorship.
-    const mayReplace = (file) => existingFiles === "allow-identical" && file.ownership === "materializer";
-    // Validate the complete plan before the first write so a late traversal or
-    // existing symlink cannot leave a partially materialized workspace.
-    for (const file of files) {
-        assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-        if (workspaceFileExists(file.absPath) &&
-            !mayReplace(file) &&
-            (existingFiles === "reject" || !workspaceFileMatches(file))) {
-            throw new Error(workspaceFileConflictMessage(file, existingFiles, publicPlanDigest));
-        }
-    }
-    // Parent directories remain on failure because they may contain concurrent
-    // workspace state that this call does not own.
-    for (const file of files) {
-        mkdirSync(dirname(file.absPath), { recursive: true });
-    }
-    for (const file of files) {
-        assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-    }
-    const prepared = [];
-    // Prepared temp links stay alive through publication and rollback. Their
-    // inodes distinguish files created here from concurrent replacements.
-    try {
-        for (const file of files) {
-            if (existingFiles === "allow-identical" &&
-                workspaceFileExists(file.absPath) &&
-                workspaceFileMatches(file)) {
-                continue;
-            }
-            prepared.push(prepareWorkspaceFile(workspaceRoot, file));
-        }
-        for (const entry of prepared) {
-            assertNoSymlinkPathComponents(workspaceRoot, entry.file.absPath);
-            try {
-                linkSync(entry.temporaryPath, entry.file.absPath);
-                entry.published = true;
-            }
-            catch (error) {
-                if (isFsError(error, "EEXIST") &&
-                    existingFiles === "allow-identical" &&
-                    workspaceFileMatches(entry.file)) {
-                    continue;
-                }
-                if (isFsError(error, "EEXIST") && mayReplace(entry.file)) {
-                    // rename() replaces in one step, so no window exists in which the
-                    // path is missing and a concurrent spawn reads nothing. The staged
-                    // inode moves onto the path, which is what rollback identifies the
-                    // file by, so an abort still removes exactly what this call
-                    // published — leaving the path ABSENT rather than restored to the
-                    // superseded bytes. That is the fail-closed direction: the harness
-                    // whose flag names a missing file refuses to start, whereas silently
-                    // restored previous-turn bytes would run the wrong prompt.
-                    assertNoSymlinkPathComponents(workspaceRoot, entry.file.absPath);
-                    renameSync(entry.temporaryPath, entry.file.absPath);
-                    entry.published = true;
-                    continue;
-                }
-                if (isFsError(error, "EEXIST")) {
-                    throw new Error(workspaceFileConflictMessage(entry.file, existingFiles, publicPlanDigest), { cause: error });
-                }
-                throw error;
-            }
-        }
-    }
-    catch (error) {
-        const cleanupErrors = [];
-        for (const entry of [...prepared].reverse()) {
-            try {
-                if (entry.published &&
-                    workspacePathHasIdentity(entry.file.absPath, entry.identity)) {
-                    unlinkSync(entry.file.absPath);
-                }
-            }
-            catch (cleanupError) {
-                cleanupErrors.push(cleanupError);
-            }
-            try {
-                if (workspacePathHasIdentity(entry.temporaryPath, entry.identity)) {
-                    unlinkSync(entry.temporaryPath);
-                }
-            }
-            catch (cleanupError) {
-                cleanupErrors.push(cleanupError);
-            }
-        }
-        if (cleanupErrors.length > 0) {
-            throw new AggregateError([error, ...cleanupErrors], "Failed to apply workspace plan and roll back published files");
-        }
-        throw error;
-    }
-    const receipt = safeWorkspacePlanReceipt(publicPlan, files.map((file) => file.relPath), publicPlanDigest);
-    const cleanupErrors = [];
-    const temporaryPaths = [];
-    for (const entry of prepared) {
-        try {
-            unlinkSync(entry.temporaryPath);
-        }
-        catch (error) {
-            if (!isFsError(error, "ENOENT")) {
-                cleanupErrors.push(error);
-                temporaryPaths.push(entry.temporaryPath);
-            }
-        }
-    }
-    if (cleanupErrors.length > 0) {
-        throw new WorkspacePlanCleanupError(cleanupErrors, receipt, temporaryPaths);
-    }
-    return {
-        receipt,
-        spawn: {
-            env: { ...resolvedPlan.env },
-            flags: [...resolvedPlan.flags],
-            ...promptIntentFields(resolvedPlan, samePromptIntentValue),
-            ...systemPromptBindingField(resolvedPlan),
-        },
-        runtimeOnlyFiles: privateRuntimeFiles,
-    };
-}
-function workspaceFileExists(pathValue) {
-    try {
-        lstatSync(pathValue);
-        return true;
-    }
-    catch (error) {
-        if (isFsError(error, "ENOENT"))
-            return false;
-        throw error;
-    }
-}
-function workspaceFileMatches(file) {
-    const stats = lstatSync(file.absPath);
-    return (stats.isFile() &&
-        (stats.mode & 0o777) === file.mode &&
-        readFileSync(file.absPath, "utf8") === file.content);
-}
-function sha256Hex(content) {
-    return createHash("sha256").update(content).digest("hex");
-}
-/**
- * The refusal names what differs — planned versus existing content digest,
- * mode, or file kind — plus the plan digest, so the operator can tell a
- * mid-session profile swap from an agent-edited workspace file without
- * reproducing the workspace. Reads here are best-effort diagnosis inside an
- * already-failing path; an unreadable existing file is reported, not thrown
- * over.
- */
-function workspaceFileConflictMessage(file, existingFiles, planDigest) {
-    const prefix = `Refusing to replace existing workspace file: ${file.relPath}`;
-    if (existingFiles === "reject") {
-        return `${prefix} — the reject policy forbids any pre-existing plan path (plan ${planDigest})`;
-    }
-    const planned = `planned sha256:${sha256Hex(file.content)} mode ${file.mode.toString(8)}`;
-    let existing;
-    try {
-        const stats = lstatSync(file.absPath);
-        if (!stats.isFile()) {
-            existing = stats.isSymbolicLink()
-                ? "existing path is a symlink, not a regular file"
-                : "existing path is not a regular file";
-        }
-        else {
-            const mode = (stats.mode & 0o777).toString(8);
-            existing = `existing sha256:${sha256Hex(readFileSync(file.absPath))} mode ${mode}`;
-        }
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        existing = `existing file unreadable: ${message}`;
-    }
-    return `${prefix} — ${planned} != ${existing} (plan ${planDigest})`;
-}
-function prepareWorkspaceFile(workspaceRoot, file) {
-    assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-    const temporaryPath = join(dirname(file.absPath), `.agent-profile-${randomUUID()}.tmp`);
-    let descriptor;
-    try {
-        descriptor = openSync(temporaryPath, SAFE_WRITE_FLAGS, 0o600);
-        writeFileSync(descriptor, file.content, "utf8");
-        fchmodSync(descriptor, file.mode);
-        const stats = fstatSync(descriptor);
-        const descriptorToClose = descriptor;
-        descriptor = undefined;
-        closeSync(descriptorToClose);
-        return {
-            file,
-            temporaryPath,
-            identity: { device: stats.dev, inode: stats.ino },
-            published: false,
-        };
-    }
-    catch (error) {
-        const cleanupErrors = [];
-        if (descriptor !== undefined) {
-            try {
-                closeSync(descriptor);
-            }
-            catch (cleanupError) {
-                cleanupErrors.push(cleanupError);
-            }
-        }
-        try {
-            unlinkSync(temporaryPath);
-        }
-        catch (cleanupError) {
-            if (!isFsError(cleanupError, "ENOENT"))
-                cleanupErrors.push(cleanupError);
-        }
-        if (cleanupErrors.length > 0) {
-            throw new AggregateError([error, ...cleanupErrors], `Failed to prepare workspace file: ${file.relPath}`);
-        }
-        throw error;
-    }
-}
-function workspacePathHasIdentity(pathValue, identity) {
-    try {
-        const stats = lstatSync(pathValue);
-        return stats.dev === identity.device && stats.ino === identity.inode;
-    }
-    catch (error) {
-        if (isFsError(error, "ENOENT"))
-            return false;
-        throw error;
-    }
-}
-function resolveWorkspaceFilePath(workspaceRoot, relativePath) {
-    const targetPath = resolve(workspaceRoot, ...relativePath.split("/"));
-    const targetRelativePath = relative(workspaceRoot, targetPath);
-    if (!targetRelativePath ||
-        targetRelativePath === ".." ||
-        targetRelativePath.startsWith(`..${sep}`) ||
-        isAbsolute(targetRelativePath)) {
-        throw new Error(`Refusing to materialize profile file outside workspace: ${relativePath}`);
-    }
-    return targetPath;
-}
-function assertNoSymlinkPathComponents(workspaceRoot, targetPath) {
-    const targetRelativePath = relative(workspaceRoot, targetPath);
-    let currentPath = workspaceRoot;
-    const components = ["", ...targetRelativePath.split(sep)];
-    for (const [index, component] of components.entries()) {
-        if (component)
-            currentPath = join(currentPath, component);
-        let stats;
-        try {
-            stats = lstatSync(currentPath);
-        }
-        catch (error) {
-            if (isFsError(error, "ENOENT"))
-                return;
-            if (isFsError(error, "ELOOP")) {
-                throw new Error(`Refusing to materialize profile file through symlink path: ${targetRelativePath}`);
-            }
-            throw error;
-        }
-        if (stats.isSymbolicLink()) {
-            throw new Error(`Refusing to materialize profile file through symlink path: ${targetRelativePath}`);
-        }
-        const isTarget = index === components.length - 1;
-        if ((!isTarget && !stats.isDirectory()) || (isTarget && !stats.isFile())) {
-            throw new Error(`Refusing to materialize profile file through non-file path: ${targetRelativePath}`);
-        }
-    }
-}
-function isFsError(error, code) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === code);
-}
-// ─── Per-dimension routing (verified matrix) ────────────────────────────────
-function materializeExecutionControls(h, tools, permissions, modes, plan, add, unsupported) {
-    const toolEntries = Object.entries(tools ?? {}).sort(([left], [right]) => compareStrings(left, right));
-    const permissionEntries = Object.entries(permissions ?? {}).sort(([left], [right]) => compareStrings(left, right));
-    switch (h) {
-        case "claude-code": {
-            if (toolEntries.length > 0 || permissionEntries.length > 0) {
-                const nativeTools = mapSupportedBooleanEntries(toolEntries, claudeToolName, (name) => unsupported("tools", `claude-code: no verified native tool mapping for "${name}"`), "claude-code tool");
-                const nativePermissions = mapSupportedPermissionEntries(permissionEntries, claudeToolName, (name) => unsupported("permissions", `claude-code: no verified native permission mapping for "${name}"`), "claude-code permission");
-                const rules = claudePermissionRules(nativePermissions);
-                for (const [tool, enabled] of nativeTools) {
-                    rules[enabled ? "allow" : "deny"].push(tool);
-                }
-                add(CLAUDE_SETTINGS_PATH, serializeWorkspacePlanJson({
-                    permissions: sealClaudePermissionRules(rules),
-                }));
-                registerClaudeSettings(plan);
-            }
-            break;
-        }
-        case "opencode": {
-            const enforceableTools = toolEntries.filter(([name, enabled]) => {
-                if (normalizedControlName(name) !== "lsp" || !enabled)
-                    return true;
-                unsupported("tools", "opencode: the LSP tool is disabled by the runtime and cannot be enabled exactly");
-                return false;
-            });
-            const enforceablePermissions = permissionEntries.filter(([name, policy]) => {
-                if (normalizedControlName(name) !== "read")
-                    return true;
-                if (!permissionAllowsEverything(policy)) {
-                    unsupported("permissions", "opencode: read access cannot be denied or approval-gated");
-                }
-                return false;
-            });
-            const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`), "opencode tool");
-            const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
-            if (enforceableTools.length > 0 || permissionEntries.length > 0) {
-                add("opencode.json", serializeWorkspacePlanJson({
-                    $schema: "https://opencode.ai/config.json",
-                    ...(nativeTools.length > 0
-                        ? { tools: Object.fromEntries(nativeTools) }
-                        : {}),
-                    ...(nativePermissions.length > 0
-                        ? { permission: Object.fromEntries(nativePermissions) }
-                        : {}),
-                }));
-            }
-            break;
-        }
-        case "codex": {
-            const searchEntries = [];
-            for (const [name, enabled] of toolEntries) {
-                const posture = resolveNativeWebTools({ [name]: enabled });
-                if (posture.search === enabled && posture.fetch === undefined) {
-                    searchEntries.push([name, enabled]);
-                    continue;
-                }
-                if (posture.fetch === enabled && posture.search === undefined) {
-                    if (enabled) {
-                        unsupported("tools", `codex: native web fetch is unavailable for "${name}"`);
-                    }
-                    continue;
-                }
-                unsupported("tools", `codex: no verified primary-process tool mapping for "${name}"`);
-            }
-            const nativeSearch = mapSupportedBooleanEntries(searchEntries, () => "web_search", () => undefined, "codex tool");
-            if (nativeSearch[0]) {
-                plan.flags.push("-c", `tools.web_search=${nativeSearch[0][1]}`);
-            }
-            if (permissionEntries.length > 0) {
-                unsupported("permissions", "codex: no verified primary-process permission policy mapping");
-            }
-            break;
-        }
-        case "pi": {
-            const nativeTools = mapSupportedBooleanEntries(toolEntries, piToolId, (name) => unsupported("tools", `pi: tool name "${name}" is empty after trimming`), "pi tool");
-            const nativePermissions = mapSupportedPermissionEntries(permissionEntries, piToolId, (name) => unsupported("permissions", `pi: permission name "${name}" is empty after trimming`), "pi permission");
-            const enabled = new Set(nativeTools
-                .filter(([, value]) => value)
-                .map(([name]) => name)
-                .sort(compareStrings));
-            const excluded = new Set(nativeTools
-                .filter(([, value]) => !value)
-                .map(([name]) => name)
-                .sort(compareStrings));
-            for (const [name, policy] of nativePermissions) {
-                if (typeof policy !== "string") {
-                    unsupported("permissions", `pi: conditional permission policy for "${name}" has no verified headless mapping`);
-                    continue;
-                }
-                if (policy === "ask") {
-                    unsupported("permissions", `pi: permission policy "ask" for "${name}" requires an interactive decision surface`);
-                    continue;
-                }
-                if (policy === "allow") {
-                    if (excluded.has(name)) {
-                        throw new Error(`pi execution control "${name}" conflicts between disabled and allow`);
-                    }
-                    continue;
-                }
-                if (enabled.has(name)) {
-                    throw new Error(`pi execution control "${name}" conflicts between enabled and deny`);
-                }
-                excluded.add(name);
-            }
-            if (enabled.size > 0 || excluded.size > 0) {
-                add(PI_EXECUTION_CONTROL_EXTENSION_PATH, piExecutionControlExtensionSource([...enabled], [...excluded]));
-                plan.flags.push("--extension", PI_EXECUTION_CONTROL_EXTENSION_PATH);
-            }
-            if (excluded.size > 0) {
-                plan.flags.push("--exclude-tools", [...excluded].sort(compareStrings).join(","));
-            }
-            break;
-        }
-        default:
-            if (toolEntries.length > 0) {
-                unsupported("tools", `${h}: no verified primary-process tool availability mapping`);
-            }
-            if (permissionEntries.length > 0) {
-                unsupported("permissions", `${h}: no verified primary-process permission policy mapping`);
-            }
-    }
-    if (modes && Object.keys(modes).length > 0) {
-        unsupported("modes", `${h}: resolve one named AgentProfile mode before materialization`);
-    }
-}
-function piExecutionControlExtensionSource(enabledTools, excludedTools) {
-    return [
-        'import { writeSync } from "node:fs";',
-        `const enabledTools = Object.freeze(${JSON.stringify(enabledTools)});`,
-        `const excludedTools = Object.freeze(${JSON.stringify(excludedTools)});`,
-        "",
-        "function failProfile(message) {",
-        "  try {",
-        '    writeSync(2, "Pi profile execution controls failed: " + message + "\\n");',
-        "  } finally {",
-        "    process.exit(78);",
-        "  }",
-        "}",
-        "",
-        "function resolveTool(reference, available, required) {",
-        "  if (available.includes(reference)) return reference;",
-        "  const folded = reference.toLowerCase();",
-        "  const matches = available.filter((name) => name.toLowerCase() === folded);",
-        "  if (matches.length === 1) return matches[0];",
-        "  if (matches.length > 1) {",
-        "    failProfile('tool \"' + reference + '\" is ambiguous: ' + matches.join(\", \"));",
-        "  }",
-        "  if (required) {",
-        "    failProfile('requested tool \"' + reference + '\" is unavailable');",
-        "  }",
-        "  return undefined;",
-        "}",
-        "",
-        "function applyControls(pi) {",
-        "  const available = pi.getAllTools().map((tool) => tool.name);",
-        "  for (const reference of excludedTools) {",
-        "    const remaining = resolveTool(reference, available, false);",
-        "    if (remaining !== undefined) {",
-        "      failProfile(",
-        "        'excluded tool \"' + reference + '\" remains available as \"' + remaining +",
-        "        '\"; pass its exact registered Pi name',",
-        "      );",
-        "    }",
-        "  }",
-        "  const enabled = enabledTools.map((name) =>",
-        "    resolveTool(name, available, true),",
-        "  );",
-        "  const active = new Set(pi.getActiveTools());",
-        "  for (const name of enabled) active.add(name);",
-        "  pi.setActiveTools([...active]);",
-        "}",
-        "",
-        "export default function applyProfileExecutionControls(pi) {",
-        '  pi.on("before_agent_start", () => applyControls(pi));',
-        '  pi.on("turn_start", () => applyControls(pi));',
-        "}",
-        "",
-    ].join("\n");
-}
-function normalizedControlName(name) {
-    return name.replace(/[^a-zA-Z0-9_]/g, "").toLowerCase();
-}
-function nativeWebToolKind(name) {
-    const posture = resolveNativeWebTools({ [name]: true });
-    if (posture.search === true && posture.fetch === undefined)
-        return "search";
-    if (posture.fetch === true && posture.search === undefined)
-        return "fetch";
-    return undefined;
-}
-const CLAUDE_TOOL_NAMES = {
-    askuserquestion: "AskUserQuestion",
-    bash: "Bash",
-    edit: "Edit",
-    glob: "Glob",
-    grep: "Grep",
-    notebookedit: "NotebookEdit",
-    read: "Read",
-    skill: "Skill",
-    task: "Task",
-    taskoutput: "TaskOutput",
-    todowrite: "TodoWrite",
-    webfetch: "WebFetch",
-    websearch: "WebSearch",
-    write: "Write",
-};
-function claudeToolName(name) {
-    const web = nativeWebToolKind(name);
-    if (web === "search")
-        return "WebSearch";
-    if (web === "fetch")
-        return "WebFetch";
-    return CLAUDE_TOOL_NAMES[normalizedControlName(name)];
-}
-/** Tool IDs reported by the OpenCode binary shipped in the Sandbox image. */
-export const OPENCODE_NATIVE_TOOL_IDS = [
-    "apply_patch",
-    "bash",
-    "codesearch",
-    "edit",
-    "glob",
-    "grep",
-    "question",
-    "read",
-    "skill",
-    "task",
-    "todowrite",
-    "webfetch",
-    "websearch",
-    "write",
-];
-const OPENCODE_NATIVE_TOOL_ID_SET = new Set(OPENCODE_NATIVE_TOOL_IDS);
-/** Resolve portable and legacy profile names to current OpenCode tool IDs. */
-export function openCodeNativeToolId(name) {
-    const web = nativeWebToolKind(name);
-    if (web === "search")
-        return "websearch";
-    if (web === "fetch")
-        return "webfetch";
-    const normalized = normalizedControlName(name);
-    if (normalized === "patch")
-        return "apply_patch";
-    return OPENCODE_NATIVE_TOOL_ID_SET.has(normalized) ? normalized : undefined;
-}
-function openCodeToolName(name) {
-    return openCodeNativeToolId(name);
-}
-function openCodePermissionName(name) {
-    const normalized = normalizedControlName(name);
-    if (["write", "edit"].includes(normalized))
-        return "edit";
-    const web = nativeWebToolKind(name);
-    if (web === "search")
-        return "websearch";
-    if (web === "fetch")
-        return "webfetch";
-    if (["bash", "mcp", "doom_loop", "external_directory"].includes(normalized)) {
-        return normalized;
-    }
-    return normalized !== "read" && OPENCODE_NATIVE_TOOL_ID_SET.has(normalized)
-        ? normalized
-        : undefined;
-}
-const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution-controls.ts";
-/**
- * Translate only portable spellings whose Pi equivalent differs.
- *
- * Every other exact name is resolved against Pi's live registry, keeping
- * extension and MCP tools profile-configurable without a static catalog.
- */
-function piToolId(name) {
-    const trimmed = name.trim();
-    if (trimmed.length === 0)
-        return undefined;
-    const portableName = trimmed.toLowerCase();
-    if (portableName === "shell")
-        return "bash";
-    if (portableName === "glob")
-        return "find";
-    return trimmed;
-}
-function mapSupportedBooleanEntries(entries, mapName, onUnsupported, label) {
-    return mapControlEntries(entries, mapName, onUnsupported, (left, right, nativeName) => {
-        if (left !== right)
-            throw new Error(`${label} aliases disagree for "${nativeName}"`);
-        return left;
-    });
-}
-function permissionAllowsEverything(policy) {
-    return typeof policy === "string"
-        ? policy === "allow"
-        : Object.values(policy).every((value) => value === "allow");
-}
-function mapSupportedPermissionEntries(entries, mapName, onUnsupported, label) {
-    return mapControlEntries(entries, mapName, onUnsupported, (left, right, nativeName) => mergePermissionPolicies(left, right, `${label} "${nativeName}"`));
-}
-function mapControlEntries(entries, mapName, onUnsupported, merge) {
-    const mapped = new Map();
-    for (const [name, value] of entries) {
-        const nativeName = mapName(name);
-        if (!nativeName) {
-            onUnsupported(name);
-            continue;
-        }
-        const previous = mapped.get(nativeName);
-        mapped.set(nativeName, previous === undefined ? value : merge(previous, value, nativeName));
-    }
-    return [...mapped.entries()].sort(([left], [right]) => compareStrings(left, right));
-}
-function mergePermissionPolicies(left, right, label) {
-    if (typeof left === "string" || typeof right === "string") {
-        if (left !== right)
-            throw new Error(`${label} aliases disagree`);
-        return left;
-    }
-    const merged = { ...left };
-    for (const [specifier, decision] of Object.entries(right)) {
-        const previous = merged[specifier];
-        if (previous !== undefined && previous !== decision) {
-            throw new Error(`${label} aliases disagree for "${specifier}"`);
-        }
-        merged[specifier] = decision;
-    }
-    return Object.fromEntries(Object.entries(merged).sort(([leftKey], [rightKey]) => compareStrings(leftKey, rightKey)));
-}
-function claudePermissionRules(entries) {
-    const rules = {
-        allow: [],
-        ask: [],
-        deny: [],
-    };
-    for (const [tool, policy] of entries) {
-        if (typeof policy === "string") {
-            rules[policy].push(tool);
-            continue;
-        }
-        for (const [specifier, decision] of Object.entries(policy).sort(([left], [right]) => compareStrings(left, right))) {
-            rules[decision].push(specifier === "*" ? tool : `${tool}(${specifier})`);
-        }
-    }
-    rules.allow.sort(compareStrings);
-    rules.ask.sort(compareStrings);
-    rules.deny.sort(compareStrings);
-    return rules;
-}
-function sealClaudePermissionRules(rules) {
-    const owner = new Map();
-    for (const decision of ["allow", "ask", "deny"]) {
-        for (const rule of rules[decision]) {
-            const previous = owner.get(rule);
-            if (previous && previous !== decision) {
-                throw new Error(`claude-code execution control "${rule}" conflicts between ${previous} and ${decision}`);
-            }
-            owner.set(rule, decision);
-        }
-    }
-    return {
-        allow: [...new Set(rules.allow)].sort(compareStrings),
-        ask: [...new Set(rules.ask)].sort(compareStrings),
-        deny: [...new Set(rules.deny)].sort(compareStrings),
-    };
-}
-function materializeMcp(h, mcp, plan, add, unsupported) {
-    switch (h) {
-        case "claude-code": {
-            const servers = {};
-            for (const [name, server] of Object.entries(mcp)) {
-                if (server.url) {
-                    servers[name] = {
-                        type: server.transport ?? "http",
-                        url: server.url,
-                        ...(server.headers ? { headers: server.headers } : {}),
-                    };
-                    continue;
-                }
-                if (server.cwd !== undefined) {
-                    unsupported("mcp", `${h}: local MCP server "${name}" does not support a cwd field`);
-                }
-                servers[name] = {
-                    type: "stdio",
-                    command: server.command,
-                    ...(server.args ? { args: server.args } : {}),
-                    ...(server.env ? { env: server.env } : {}),
-                };
-            }
-            const relPath = ".tangle/claude-mcp.json";
-            add(relPath, serializeWorkspacePlanJson({ mcpServers: servers }));
-            plan.flags.push("--mcp-config", relPath, "--strict-mcp-config");
-            break;
-        }
-        case "nanoclaw":
-            unsupported("mcp", "nanoclaw MCP must be injected through options.mcpServers by its SDK adapter");
-            break;
-        case "codex": {
-            const servers = [];
-            for (const [name, server] of Object.entries(mcp).sort(([left], [right]) => compareStrings(left, right))) {
-                if (server.url && server.transport === "sse") {
-                    unsupported("mcp", `codex: remote MCP server "${name}" uses unsupported SSE transport`);
-                    continue;
-                }
-                servers.push(concatWorkspacePlanArguments(`${tomlStr(name)} = `, codexMcpServerToml(name, server, plan)));
-            }
-            if (servers.length > 0) {
-                // Runtime overrides do not require persisted project trust. Header values
-                // ride environment variables so credentials never appear in argv.
-                plan.flags.push("-c", concatWorkspacePlanArguments("mcp_servers={ ", joinWorkspacePlanArguments(servers, ", "), " }"));
-            }
-            break;
-        }
-        case "opencode":
-            // opencode.json "mcp" block (local|remote).
-            add("opencode.json", serializeWorkspacePlanJson({
-                $schema: "https://opencode.ai/config.json",
-                mcp: openCodeMcpConfig(mcp),
-            }));
-            break;
-        case "gemini": {
-            const servers = {};
-            for (const [name, server] of Object.entries(mcp)) {
-                if (server.url) {
-                    servers[name] = {
-                        [server.transport === "sse" ? "url" : "httpUrl"]: server.url,
-                        ...(server.headers ? { headers: server.headers } : {}),
-                    };
-                    continue;
-                }
-                servers[name] = {
-                    command: server.command,
-                    ...(server.args ? { args: server.args } : {}),
-                    ...(server.env ? { env: server.env } : {}),
-                    ...(server.cwd ? { cwd: server.cwd } : {}),
-                };
-            }
-            add(".gemini/settings.json", serializeWorkspacePlanJson({ mcpServers: servers }));
-            break;
-        }
-        case "kimi-code": {
-            // NO cwd auto-discovery — kimi needs an explicit --mcp-config-file FLAG.
-            const rel = ".kimi/mcp.json";
-            const servers = Object.fromEntries(Object.entries(mcp).map(([name, server]) => [
-                name,
-                kimiMcpServer(server),
-            ]));
-            add(rel, serializeWorkspacePlanJson({ mcpServers: servers }));
-            plan.flags.push("--mcp-config-file", rel);
-            break;
-        }
-        case "pi": {
-            // pi ships NO MCP. It arrives from the `pi-mcp-adapter` extension, which discovers
-            // `<cwd>/.pi/mcp.json` (adapter 2.17.0 config.ts:17) and also registers a `--mcp-config`
-            // flag (index.ts:252). The flag is registered BY the extension, so passing it when the
-            // extension is absent is not a fallback — it is an unknown flag.
-            //
-            // This was previously marked unsupported because a workspace file cannot install an
-            // extension. That reasoning was right about the constraint and wrong about the conclusion:
-            // the file half is perfectly materializable, and the half that is not becomes a declared
-            // requirement the executor enforces. Marking the whole dimension unsupported pushed both
-            // halves onto every consumer, and two of them independently rebuilt it.
-            const rel = ".pi/mcp.json";
-            const servers = Object.fromEntries(Object.entries(mcp).map(([name, server]) => [
-                name,
-                // `directTools` promotes this server's verbs to first-class pi tools. Without it the
-                // agent gets one generic `mcp` tool and must connect, then describe, then call — three
-                // round trips of discovery before it can do anything. Per-server, because the adapter
-                // lets a per-server value override the global `settings.directTools` (direct-tools.ts:135).
-                { ...piMcpServer(server), directTools: true },
-            ]));
-            // serializeWorkspacePlanJson, NOT JSON.stringify: it unwraps public config values to their
-            // bytes and lifts any secret-ref into a tracked slot the applier resolves. Stringifying
-            // straight would write `{"kind":"public","value":"..."}` into the file as an argv entry.
-            add(rel, serializeWorkspacePlanJson({ mcpServers: servers }));
-            plan.requires?.push({
-                kind: "harness-extension",
-                dimension: "mcp",
-                id: "npm:pi-mcp-adapter",
-                reason: "pi has no built-in MCP; without this extension the servers in .pi/mcp.json are never read and the agent starts with none of their tools",
-                remedy: "pi install npm:pi-mcp-adapter",
-            });
-            break;
-        }
-        case "prime":
-            // The fork's MCP config surface (`mcpServers` in <agentDir>/settings.json,
-            // fork settings-manager.ts:98-120,219) IS read at startup, but a
-            // user-declared server never becomes model-visible: the host McpManager
-            // only registers OAuth providers and serves mcp.config/refresh
-            // host-requests (fork core/mcp/mcp-manager.ts:62-124,156-181), skips
-            // stdio servers entirely (mcp-manager.ts:73), and nothing generates a
-            // skill or prompt section for it — materializing profile.mcp would be a
-            // silently dropped control.
-            unsupported("mcp", "prime: settings.json mcpServers never becomes model-visible (fork mcp-manager.ts:62-124 " +
-                "registers OAuth providers only and skips stdio servers) — model-visible MCP is exactly " +
-                "the fork's built-in catalog skills");
-            break;
-        case "hermes":
-            unsupported("mcp", "hermes MCP is global config.yaml (mcp_servers), no cwd discovery — write to the hermes global config or pass a config flag");
-            break;
-        case "openclaw":
-            unsupported("mcp", "openclaw MCP is central ~/.openclaw/openclaw.json (mcp.servers), no cwd discovery");
-            break;
-    }
-}
-function tomlInlineStringTable(values) {
-    return `{ ${Object.entries(values)
-        .sort(([left], [right]) => compareStrings(left, right))
-        .map(([key, value]) => `${tomlStr(key)} = ${tomlStr(value)}`)
-        .join(", ")} }`;
-}
-function codexMcpServerToml(name, server, plan) {
-    const fields = [];
-    if (server.url) {
-        fields.push(`url = ${tomlStr(server.url)}`);
-        if (server.headers && Object.keys(server.headers).length > 0) {
-            const envHeaders = {};
-            for (const [header, value] of Object.entries(server.headers).sort(([left], [right]) => compareStrings(left, right))) {
-                const envName = `TANGLE_MCP_HEADER_${sha256(`${name}\0${header}`)
-                    .slice(0, 24)
-                    .toUpperCase()}`;
-                setPlanEnvironment(plan, envName, value);
-                envHeaders[header] = envName;
-            }
-            fields.push(`env_http_headers = ${tomlInlineStringTable(envHeaders)}`);
-        }
-    }
-    else {
-        if (!server.command) {
-            throw new Error(`Codex MCP server "${name}" must define url or command`);
-        }
-        fields.push(`command = ${tomlStr(server.command)}`);
-        if (server.args?.length) {
-            fields.push(concatWorkspacePlanArguments("args = [", joinWorkspacePlanArguments(server.args.map(tomlProfileConfigValue), ", "), "]"));
-        }
-        if (server.cwd)
-            fields.push(`cwd = ${tomlStr(server.cwd)}`);
-        if (server.env && Object.keys(server.env).length > 0) {
-            const envNames = Object.keys(server.env).sort(compareStrings);
-            for (const envName of envNames) {
-                setPlanEnvironment(plan, envName, server.env[envName]);
-            }
-            fields.push(`env_vars = [${envNames.map(tomlStr).join(", ")}]`);
-        }
-    }
-    return concatWorkspacePlanArguments("{ ", joinWorkspacePlanArguments(fields, ", "), " }");
-}
-function setPlanEnvironment(plan, name, value) {
-    const normalized = typeof value === "string" ? value : workspacePlanConfigValue(value);
-    const previous = plan.env[name];
-    if (previous !== undefined &&
-        JSON.stringify(previous) !== JSON.stringify(normalized)) {
-        throw new Error(`profile environment values disagree for ${name}`);
-    }
-    plan.env[name] = normalized;
-}
-/**
- * Lower one canonical MCP server to the shape `pi-mcp-adapter` reads from `.pi/mcp.json`.
- *
- * The adapter consumes the same `{mcpServers: {...}}` document Claude and Kimi use, so this
- * mirrors {@link kimiMcpServer} rather than inventing a pi dialect. `directTools` is added by the
- * caller, not here, because it is a policy about tool surfacing rather than a property of the
- * server definition.
- */
-function piMcpServer(server) {
-    return kimiMcpServer(server);
-}
-function kimiMcpServer(server) {
-    if (server.url) {
-        return {
-            url: server.url,
-            transport: server.transport ?? "http",
-            ...(server.headers ? { headers: server.headers } : {}),
-        };
-    }
-    return {
-        command: server.command,
-        ...(server.args ? { args: server.args } : {}),
-        ...(server.env ? { env: server.env } : {}),
-        ...(server.cwd ? { cwd: server.cwd } : {}),
-    };
-}
-/** Lower canonical MCP definitions to OpenCode's native startup configuration. */
-export function openCodeMcpConfig(mcp) {
-    const out = {};
-    for (const [name, s] of Object.entries(mcp)) {
-        if (s.enabled === false)
-            continue;
-        if (s.url) {
-            if (s.transport === "sse") {
-                throw new Error(`OpenCode MCP server "${name}" uses unsupported SSE transport`);
-            }
-            out[name] = {
-                type: "remote",
-                url: s.url,
-                enabled: true,
-                ...(s.headers ? { headers: s.headers } : {}),
-            };
-            continue;
-        }
-        if (!s.command) {
-            throw new Error(`OpenCode MCP server "${name}" must define either url or command`);
-        }
-        if (s.cwd !== undefined) {
-            throw new Error(`OpenCode MCP server "${name}" does not support a cwd field`);
-        }
-        out[name] = {
-            type: "local",
-            command: [s.command, ...(s.args ?? [])],
-            enabled: true,
-            ...(s.env ? { environment: s.env } : {}),
-        };
-    }
-    return out;
-}
-function materializeHooks(h, hooks, add, unsupported, plan) {
-    switch (h) {
-        case "claude-code": {
-            // Claude settings hooks{} — each event → [{matcher, hooks:[{type:command,command}]}].
-            const settingsHooks = {};
-            for (const [event, cmds] of Object.entries(hooks)) {
-                if (!hookEventSupported("claude-code", event)) {
-                    unsupported("hooks", `claude-code: unsupported hook event "${event}"`);
-                    continue;
-                }
-                settingsHooks[event] = cmds.map((c) => ({
-                    matcher: c.matcher ?? "*",
-                    hooks: [
-                        {
-                            type: "command",
-                            command: materializedHookCommand(event, c, add, plan),
-                            ...(c.timeoutMs ? { timeout: timeoutSeconds(c.timeoutMs) } : {}),
-                            ...(c.blocking === false ? { async: true } : {}),
-                        },
-                    ],
-                }));
-            }
-            add(CLAUDE_SETTINGS_PATH, serializeWorkspacePlanJson({ hooks: settingsHooks }));
-            registerClaudeSettings(plan);
-            break;
-        }
-        case "nanoclaw":
-            unsupported("hooks", "nanoclaw's chat bridge does not expose Claude Code hook settings to the spawned agent");
-            break;
-        case "gemini": {
-            const settingsHooks = {};
-            for (const [event, cmds] of Object.entries(hooks)) {
-                if (!hookEventSupported("gemini", event)) {
-                    unsupported("hooks", `gemini: unsupported hook event "${event}"`);
-                    continue;
-                }
-                if (cmds.some((command) => command.blocking === false)) {
-                    unsupported("hooks", `gemini: hook event "${event}" does not support non-blocking commands`);
-                }
-                settingsHooks[event] = cmds.map((c) => ({
-                    matcher: c.matcher ?? "*",
-                    hooks: [
-                        {
-                            type: "command",
-                            command: materializedHookCommand(event, c, add, plan),
-                            ...(c.timeoutMs ? { timeout: c.timeoutMs } : {}),
-                        },
-                    ],
-                }));
-            }
-            add(".gemini/settings.json", serializeWorkspacePlanJson({ hooks: settingsHooks }));
-            break;
-        }
-        case "codex": {
-            for (const [event, cmds] of Object.entries(hooks).sort(([left], [right]) => compareStrings(left, right))) {
-                if (!hookEventSupported("codex", event)) {
-                    unsupported("hooks", `codex: unsupported hook event "${event}"`);
-                    continue;
-                }
-                if (cmds.some((command) => command.blocking === false)) {
-                    unsupported("hooks", `codex: hook event "${event}" cannot execute asynchronous commands`);
-                    continue;
-                }
-                const entries = cmds.map((command) => {
-                    const handler = [
-                        `type = ${tomlStr("command")}`,
-                        `command = ${tomlStr(materializedHookCommand(event, command, add, plan))}`,
-                        ...(command.timeoutMs
-                            ? [`timeout = ${timeoutSeconds(command.timeoutMs)}`]
-                            : []),
-                    ];
-                    return `{ matcher = ${tomlStr(command.matcher ?? "*")}, hooks = [{ ${handler.join(", ")} }] }`;
-                });
-                plan.flags.push("-c", `hooks.${event}=[${entries.join(", ")}]`);
-            }
-            break;
-        }
-        case "opencode":
-            unsupported("hooks", "opencode hooks require executable JS/TS plugins; command hooks cannot be translated exactly");
-            break;
-        case "kimi-code":
-            unsupported("hooks", "kimi hooks are [[hooks]] in the config TOML loaded via --config-file, not cwd — pass --config-file");
-            break;
-        case "pi":
-            unsupported("hooks", "pi hooks are TS extensions (.pi/extensions/*.ts) — build an extension");
-            break;
-        case "prime":
-            unsupported("hooks", "prime hooks are TS extensions (fork core/extensions), not command hooks — build an extension");
-            break;
-        case "hermes":
-            unsupported("hooks", "hermes project plugins do not expose an exact command-hook mapping");
-            break;
-        case "openclaw":
-            unsupported("hooks", "openclaw hooks are DISABLED by default — enable in ~/.openclaw/openclaw.json; cwd hooks/ alone is a no-op");
-            break;
-    }
-}
-function registerClaudeSettings(plan) {
-    for (let index = 0; index < plan.flags.length - 1; index += 1) {
-        if (plan.flags[index] === "--settings" &&
-            plan.flags[index + 1] === CLAUDE_SETTINGS_PATH) {
-            return;
-        }
-    }
-    plan.flags.push("--settings", CLAUDE_SETTINGS_PATH);
-}
-const CLAUDE_HOOK_EVENTS = new Set([
-    "ConfigChange",
-    "CwdChanged",
-    "Elicitation",
-    "ElicitationResult",
-    "FileChanged",
-    "InstructionsLoaded",
-    "MessageDisplay",
-    "Notification",
-    "PermissionDenied",
-    "PermissionRequest",
-    "PostCompact",
-    "PostToolBatch",
-    "PostToolUse",
-    "PostToolUseFailure",
-    "PreCompact",
-    "PreToolUse",
-    "SessionEnd",
-    "SessionStart",
-    "Setup",
-    "Stop",
-    "StopFailure",
-    "SubagentStart",
-    "SubagentStop",
-    "TaskCompleted",
-    "TaskCreated",
-    "TeammateIdle",
-    "UserPromptExpansion",
-    "UserPromptSubmit",
-    "WorktreeCreate",
-    "WorktreeRemove",
-]);
-const CODEX_HOOK_EVENTS = new Set([
-    "PermissionRequest",
-    "PostCompact",
-    "PostToolUse",
-    "PreCompact",
-    "PreToolUse",
-    "SessionStart",
-    "Stop",
-    "SubagentStart",
-    "SubagentStop",
-    "UserPromptSubmit",
-]);
-const GEMINI_HOOK_EVENTS = new Set([
-    "AfterAgent",
-    "AfterModel",
-    "AfterTool",
-    "BeforeAgent",
-    "BeforeModel",
-    "BeforeTool",
-    "BeforeToolSelection",
-    "Notification",
-    "PreCompress",
-    "SessionEnd",
-    "SessionStart",
-]);
-function hookEventSupported(harness, event) {
-    switch (harness) {
-        case "claude-code":
-            return CLAUDE_HOOK_EVENTS.has(event);
-        case "codex":
-            return CODEX_HOOK_EVENTS.has(event);
-        case "gemini":
-            return GEMINI_HOOK_EVENTS.has(event);
-        default:
-            return false;
-    }
-}
-function timeoutSeconds(timeoutMs) {
-    return Math.max(1, Math.ceil(timeoutMs / 1000));
-}
-function materializedHookCommand(event, command, add, plan) {
-    if (!command.env || Object.keys(command.env).length === 0) {
-        return command.command;
-    }
-    const wrapperId = canonicalCandidateDigest({
-        event,
-        command: command.command,
-        env: Object.fromEntries(Object.entries(command.env).sort(([left], [right]) => compareStrings(left, right))),
-    }).slice("sha256:".length);
-    const path = `.tangle/profile-hooks/${wrapperId}.mjs`;
-    const envSources = Object.fromEntries(Object.entries(command.env)
-        .sort(([left], [right]) => compareStrings(left, right))
-        .map(([name, value]) => {
-        const sourceName = `TANGLE_PROFILE_HOOK_${sha256(`${wrapperId}\0${name}`)
-            .slice(0, 24)
-            .toUpperCase()}`;
-        setPlanEnvironment(plan, sourceName, value);
-        return [name, sourceName];
-    }));
-    add(path, hookWrapperSourceFromEnvironment("/bin/sh", ["-c", command.command], envSources));
-    return `node ${path}`;
-}
-function hookWrapperSourceFromEnvironment(executable, args, envSources) {
-    return [
-        'import { spawnSync } from "node:child_process"',
-        `const executable = ${JSON.stringify(executable)}`,
-        `const args = ${JSON.stringify(args)}`,
-        `const envSources = ${JSON.stringify(envSources)}`,
-        "const extraEnv = {}",
-        "for (const [name, source] of Object.entries(envSources)) {",
-        "  const value = process.env[source]",
-        "  if (value === undefined) {",
-        '    console.error("missing materialized hook environment " + source)',
-        "    process.exit(127)",
-        "  }",
-        "  extraEnv[name] = value",
-        "}",
-        "const result = spawnSync(executable, args, {",
-        '  stdio: "inherit",',
-        "  env: { ...process.env, ...extraEnv },",
-        "  shell: false,",
-        "})",
-        "if (result.error) {",
-        "  console.error(result.error.message)",
-        "  process.exit(127)",
-        "}",
-        "if (result.signal) {",
-        '  console.error("hook terminated by " + result.signal)',
-        "  process.exit(1)",
-        "}",
-        "process.exit(result.status ?? 1)",
-        "",
-    ].join("\n");
-}
-function hookWrapperSource(executable, args, env) {
-    return [
-        'import { spawnSync } from "node:child_process"',
-        `const executable = ${JSON.stringify(executable)}`,
-        `const args = ${JSON.stringify(args)}`,
-        `const extraEnv = ${JSON.stringify(env)}`,
-        "const result = spawnSync(executable, args, {",
-        '  stdio: "inherit",',
-        "  env: { ...process.env, ...extraEnv },",
-        "  shell: false,",
-        "})",
-        "if (result.error) {",
-        "  console.error(result.error.message)",
-        "  process.exit(127)",
-        "}",
-        "if (result.signal) {",
-        '  console.error("hook terminated by " + result.signal)',
-        "  process.exit(1)",
-        "}",
-        "process.exit(result.status ?? 1)",
-        "",
-    ].join("\n");
-}
-function materializeSubagent(h, name, sa, plan, add, unsupported) {
-    if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
-        unsupported("subagents", `${h}: subagent name "${name}" must use lowercase letters, digits, underscores, or hyphens`);
-        return;
-    }
-    switch (h) {
-        case "claude-code":
-        case "nanoclaw": {
-            const fm = ["---", `name: ${name}`];
-            fm.push(`description: ${JSON.stringify(sa.description ?? name)}`);
-            if (sa.model)
-                fm.push(`model: ${JSON.stringify(sa.model)}`);
-            if (sa.tools) {
-                const tools = Object.entries(sa.tools);
-                const allowed = tools
-                    .filter(([, enabled]) => enabled)
-                    .map(([tool]) => tool);
-                const denied = tools
-                    .filter(([, enabled]) => !enabled)
-                    .map(([tool]) => tool);
-                if (allowed.length > 0)
-                    fm.push(`tools: ${JSON.stringify(allowed)}`);
-                if (denied.length > 0)
-                    fm.push(`disallowedTools: ${JSON.stringify(denied)}`);
-            }
-            if (sa.maxSteps !== undefined)
-                fm.push(`maxTurns: ${sa.maxSteps}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model", "tools", "maxSteps"]), unsupported);
-            fm.push("---", "", sa.prompt ?? sa.description ?? name);
-            add(`.claude/agents/${name}.md`, `${fm.join("\n")}\n`);
-            break;
-        }
-        case "opencode": {
-            const fm = [
-                "---",
-                `description: ${JSON.stringify(sa.description ?? name)}`,
-                "mode: subagent",
-            ];
-            if (sa.model)
-                fm.push(`model: ${JSON.stringify(sa.model)}`);
-            if (sa.tools)
-                fm.push(`tools: ${JSON.stringify(sa.tools)}`);
-            if (sa.permissions)
-                fm.push(`permission: ${JSON.stringify(sa.permissions)}`);
-            if (sa.maxSteps !== undefined)
-                fm.push(`steps: ${sa.maxSteps}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set([
-                "description",
-                "prompt",
-                "model",
-                "tools",
-                "permissions",
-                "maxSteps",
-            ]), unsupported);
-            fm.push("---", "", sa.prompt ?? "");
-            add(`.opencode/agents/${name}.md`, `${fm.join("\n")}\n`);
-            break;
-        }
-        case "gemini": {
-            const tools = sa.tools
-                ? Object.entries(sa.tools)
-                    .filter(([, enabled]) => enabled)
-                    .map(([tool]) => tool)
-                : undefined;
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model", "tools", "maxSteps"]), unsupported);
-            add(`.gemini/agents/${name}.md`, [
-                "---",
-                `name: ${name}`,
-                `description: ${JSON.stringify(sa.description ?? name)}`,
-                "kind: local",
-                ...(sa.model ? [`model: ${JSON.stringify(sa.model)}`] : []),
-                ...(tools ? [`tools: ${JSON.stringify(tools)}`] : []),
-                ...(sa.maxSteps !== undefined ? [`max_turns: ${sa.maxSteps}`] : []),
-                "---",
-                "",
-                sa.prompt ?? "",
-                "",
-            ].join("\n"));
-            break;
-        }
-        case "codex": {
-            const relPath = `.codex/agents/${name}.toml`;
-            const lines = [
-                `name = ${tomlStr(name)}`,
-                `description = ${tomlStr(sa.description ?? name)}`,
-                `developer_instructions = ${tomlStr(sa.prompt ?? sa.description ?? name)}`,
-            ];
-            if (sa.model)
-                lines.push(`model = ${tomlStr(sa.model)}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model"]), unsupported);
-            add(relPath, `${lines.join("\n")}\n`);
-            registerCodexAgent(plan, name, relPath, sa.description ?? name);
-            break;
-        }
-        case "prime":
-            // Prime subagents ARE expressible — as entries in the continual-harness
-            // store at <agentDir>/harness/harness_state.json (fork refinement.ts:269-279,
-            // re-read on every system-prompt build: agent-session.ts:7548-7554) — but
-            // that store lives under the executor-owned agent dir, which no
-            // workspace-relative plan file can reach. Executors that own the agent
-            // dir seed it with seedPrimeProfileSubagents; the plan stays fail-closed
-            // so a plan-forwarding caller can never believe the roster is in force.
-            unsupported("subagents", `prime: subagents live in the agent-dir continual-harness store (<agentDir>/harness/harness_state.json), outside any workspace plan — seed "${name}" with seedPrimeProfileSubagents from the executor that owns the agent dir`);
-            break;
-        default:
-            unsupported("subagents", `${h}: subagents have no cwd file (config/flag/global only); "${name}" not mounted`);
-    }
-}
-function codexAgentRoleName(resourceName) {
-    const name = resourceName.endsWith(".toml")
-        ? resourceName.slice(0, -".toml".length)
-        : resourceName;
-    return /^[a-z0-9][a-z0-9_-]*$/.test(name) ? name : undefined;
-}
-function registerCodexAgent(plan, name, configFile, description) {
-    plan.flags.push("-c", `agents.${name}.description=${tomlStr(description)}`, "-c", `agents.${name}.config_file=${tomlStr(configFile)}`);
-}
-function reportUnsupportedSubagentFields(harness, name, subagent, supported, unsupported) {
-    for (const field of [
-        "description",
-        "prompt",
-        "model",
-        "tools",
-        "permissions",
-        "maxSteps",
-        "metadata",
-    ]) {
-        if (subagent[field] !== undefined && !supported.has(field)) {
-            unsupported("subagents", `${harness}: subagent "${name}" does not support ${field}`);
-        }
-    }
-}
-function materializeCommand(h, name, body, add, unsupported) {
-    switch (h) {
-        case "claude-code":
-        case "nanoclaw":
-            add(`.claude/commands/${name}.md`, body.endsWith("\n") ? body : `${body}\n`);
-            break;
-        case "opencode":
-            add(`.opencode/commands/${name}.md`, body.endsWith("\n") ? body : `${body}\n`);
-            break;
-        case "gemini":
-            add(`.gemini/commands/${name}.toml`, `prompt = ${tomlStr(body)}\n`);
-            break;
-        case "pi":
-            add(`.pi/prompts/${name}.md`, body.endsWith("\n") ? body : `${body}\n`);
-            break;
-        case "prime":
-            // Auto-discovered project prompt templates: <cwd>/.prime/agent/prompts
-            // (fork prompt-templates.ts:218 resolves CONFIG_DIR_NAME "prompts";
-            // package-manager.ts:2176-2180 auto-adds the same projectDirs.prompts).
-            add(`.prime/agent/prompts/${name}.md`, body.endsWith("\n") ? body : `${body}\n`);
-            break;
-        case "kimi-code":
-            unsupported("commands", "kimi commands ARE skills (/skill:<name>) — provide as a skill instead");
-            break;
-        case "codex":
-            unsupported("commands", "codex project commands unsupported (~/.codex/prompts is user-global only)");
-            break;
-        default:
-            unsupported("commands", `${h}: no cwd command path`);
-    }
-}
-// ─── Prime agent-dir lowering ────────────────────────────────────────────────
-//
-// Prime (PrimeIntellect-ai/prime-agent v0.7.0, be9e2fa0) reads several profile
-// dimensions from its AGENT DIR — a per-process config root the EXECUTOR owns
-// (env PRIME_AGENT_CODING_AGENT_DIR, fork config.ts:498,521-527), which no
-// workspace-relative plan file can reach. The helpers below are that lowering,
-// shared so cli-bridge's prime backend and sdk-provider-prime consume one
-// implementation instead of hand-rolling byte-divergent copies. Every control
-// accepted here is backed by a verified read path in the pinned fork; every
-// other control is rejected loudly so a caller can never believe a
-// behavior-relevant setting is in force when it is not. The verified paths:
-//
-// - `prompt.systemPrompt` / `prompt.appendSystemPrompt` → `--system-prompt` /
-//   `--append-system-prompt` (cli/args.ts:139-143). Both ride
-//   `AgentSessionRuntimeConfig` (main.ts:643-644) through BOTH acp spawn
-//   paths — the daemon-client create request (main.ts:1512-1520 →
-//   daemon-mode.ts:1310/1478) and the in-process fallback — into
-//   `resourceLoaderOptions` (main.ts:745-746), where the replacement DELETES
-//   the built-in prompt (resource-loader.ts:482-485, system-prompt.ts:72-73)
-//   and the addition appends after it (system-prompt.ts:61,109-110). Values
-//   are materialized as FILES under the agent dir because the flag value is
-//   read as a file when the path exists (resource-loader.ts:41-56), which
-//   keeps literal-vs-path resolution deterministic AND removes the argv size
-//   ceiling an inline flag value would run into (Linux MAX_ARG_STRLEN).
-//
-// - `prompt.instructions` / `resources.instructions` → `<agentDir>/AGENTS.md`.
-//   The agent dir IS an instruction surface: `loadProjectContextFiles`
-//   (resource-loader.ts:76) reads the agent dir's own AGENTS.md/CLAUDE.md as
-//   the GLOBAL context file (:86 `loadContextFileFromDir(resolvedAgentDir)`,
-//   candidates at :59) BEFORE walking the cwd ancestors (:94-112), and the
-//   result is loaded unless `--no-context-files` (:476). Writing it here
-//   touches no caller workspace content, which is what the agent-dir lowering
-//   exists to guarantee. (`materializeProfile(profile, "prime")` lowers the
-//   same intent to the cwd AGENTS.md for callers that own the workspace
-//   instead of the agent dir.)
-//
-// - `resources.skills` (inline refs) → `--skill <agentDir>/profile/skills`
-//   (cli/args.ts:207-209 → main.ts:652 → agent-session-config.ts:67 →
-//   additionalSkillPaths, resource-loader.ts:437-442). An explicit flag rather
-//   than the agent dir's auto-discovered `skills/` tree (package-manager.ts:884
-//   global base, :2171 skills dir, :2240-2246 discovery), which also loads but
-//   goes through the fork's global-vs-project dedupe (package-manager.ts:880,
-//   "project scope wins over global") — so an unrelated project-scope skill of
-//   the same name silently shadows the profile's. The loader recurses into
-//   `<name>/SKILL.md` subdirs (skills.ts:328-372) and loaded skills are
-//   rendered into the system prompt (agent-session.ts:4272-4291,
-//   system-prompt.ts:87-89). The fork silently DROPS a SKILL.md without a
-//   frontmatter description (skills.ts:416-419), so content is normalized
-//   through {@link normalizeSkillMd}, which guarantees one.
-//
-// - `subagents` → `subagent` entries in the fork's continual-harness store at
-//   `<agentDir>/harness/harness_state.json` (refinement.ts:269-279). The
-//   store is re-read on every system-prompt build (agent-session.ts:4288,
-//   7548-7554) and subagent entries render as a task-shaped roster the model
-//   spawns via `await rlm('<task>')` (refinement.ts:483-496); the kernel
-//   reaches the same store through the host-set RLM_GLOBAL_HARNESS_STATE_DIR
-//   (agent-session.ts:8805).
-//
-// Kept REJECTED with the fork evidence — see {@link PRIME_MCP_UNSUPPORTED_REASON}
-// for `mcp`/`connections`, and the per-control reasons in
-// {@link readPrimeProfileControls} for permissions, tools, hooks, modes,
-// confidential, and the resource kinds with no agent-dir read path.
-//
-// The store is AGENT-OWNED: it is written by the agent mid-session and rides
-// every later system prompt. A store that exists but no longer parses
-// therefore fails the turn ({@link PrimeHarnessStateError}) rather than being
-// reseeded from empty — the fork's own loader degrades to empty in-process
-// (refinement.ts:290-300), but an executor that OVERWRITES the file makes that
-// degradation permanent and destroys the evidence of what happened.
-/** Skill name rules enforced by the fork's Agent Skills loader (skills.ts:122-147). */
-const PRIME_SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const PRIME_MAX_SKILL_NAME_LENGTH = 64;
-const PRIME_PROFILE_DIR_NAME = "profile";
-const PRIME_SKILLS_DIR_NAME = "skills";
-const PRIME_SYSTEM_PROMPT_FILE = "system-prompt.md";
-const PRIME_APPEND_SYSTEM_PROMPT_FILE = "append-system-prompt.md";
-/** Agent-dir global context file the fork reads (resource-loader.ts:59,86). */
-const PRIME_CONTEXT_FILE = "AGENTS.md";
-/** Fork continual-harness store location under the agent dir (refinement.ts:269-279). */
-const PRIME_HARNESS_DIR_NAME = "harness";
-const PRIME_HARNESS_STATE_FILE = "harness_state.json";
-const PRIME_HARNESS_KINDS = ["prompt", "memory", "skill", "subagent"];
-/**
- * Provenance marker for entries pinned from the profile. Stale removal keys on
- * it, so agent-written (`source: "agent"`) and user-written entries are never
- * touched.
- */
-const PRIME_PROFILE_ENTRY_SOURCE = "profile";
-/**
- * Provenance markers written by executors that predate this shared lowering.
- *
- * Pruning keys on the source tag, so an executor that switches to the shared
- * implementation would otherwise leave its own earlier entries behind forever:
- * they match no current profile and no current source, and the model's
- * spawnable roster silently accumulates duplicates of every subagent. They are
- * adopted (pruned or replaced) on the first shared run instead.
- */
-const PRIME_LEGACY_PROFILE_ENTRY_SOURCES = [
-    "cli-bridge-profile",
-];
-/** True when the controls materialize anything at all. */
-export function hasPrimeProfileMaterial(controls) {
-    return (controls.systemPrompt !== undefined ||
-        controls.appendSystemPrompt !== undefined ||
-        primeProfileNeedsAgentDir(controls) ||
-        controls.skills.length > 0);
-}
-/**
- * True when the controls must WRITE INTO the agent dir itself.
- *
- * Prompt files and skill dirs are named by a flag, so they can live anywhere
- * the agent can read (`--system-prompt` / `--append-system-prompt` resolve a
- * path when it exists, fork resource-loader.ts:41-56; `--skill` takes an
- * arbitrary dir, :437-442). The context file and the continual-harness store
- * are located BY the agent dir and have no flag, so they cannot move.
- *
- * An executor pointed at an agent dir it does not own (an operator's shared
- * dir) uses this to refuse exactly the controls it would have to write there,
- * while still binding the ones it can materialize elsewhere.
- */
-export function primeProfileNeedsAgentDir(controls) {
-    return controls.instructions !== undefined || controls.subagents.length > 0;
-}
-/**
- * Read one instruction block, which the profile may carry inline or as a
- * resource ref. Only inline refs are accepted: resolving a GitHub-backed ref
- * fetches remote content, which is `resolveAgentProfileResources`' job and
- * must happen before a profile reaches an executor.
- */
-function primeInstructionBlock(value, control) {
-    if (typeof value === "string")
-        return value;
-    if (value.kind === "inline")
-        return value.content;
-    rejectPrimeControl(control, "only inline resource refs are accepted — resolve GitHub-backed refs " +
-        "(resolveAgentProfileResources) before handing the profile to this lowering.");
-}
-/**
- * Validate and extract the profile controls the prime agent-dir lowering
- * materializes. Throws {@link PrimeProfileError} on any control (or control
- * facet) the fork has no verified read path for — partial acceptance would
- * silently drop the rest.
- */
-export function readPrimeProfileControls(profile) {
-    const controls = { skills: [], subagents: [] };
-    if (!profile)
-        return controls;
-    if (profile.harness !== undefined && profile.harness !== "prime") {
-        rejectPrimeDeclaration("harness", `prime cannot run a profile pinned to harness "${profile.harness}" — ` +
-            'only "prime" (or an unset harness preference) is accepted.');
-    }
-    // An entry with `enabled: false` is OFF, not requested. A fully disabled map
-    // asks for nothing, so accepting it drops no control — which is the only
-    // thing this refusal exists to prevent.
-    const requestedMcp = Object.keys(activeMcpServers(profile.mcp));
-    if (requestedMcp.length > 0) {
-        rejectPrimeControl(`mcp: ${requestedMcp.join(", ")}`, PRIME_MCP_UNSUPPORTED_REASON);
-    }
-    if (profile.connections !== undefined) {
-        rejectPrimeControl("connections", `a hub connection grant resolves to MCP tools, and ${PRIME_MCP_UNSUPPORTED_REASON}`);
-    }
-    if (profile.permissions !== undefined) {
-        rejectPrimeControl("permissions", "prime-agent exposes no permission control at all (full flag scan of fork " +
-            "cli/args.ts:93-295; native tools run unconditionally), so a permission map " +
-            "would be accepted and never enforced.");
-    }
-    if (profile.tools !== undefined) {
-        rejectPrimeControl("tools", "the only per-run tool control is `--tools` over the single builtin `ipython` " +
-            "(fork cli/args.ts:63-64,156-167); bash/edit and the rest are extension-provided " +
-            "and not addressable per run, so a harness-neutral tool map cannot bind to it.");
-    }
-    if (profile.hooks !== undefined) {
-        rejectPrimeControl("hooks", "prime-agent has no hook mechanism (fork cli/args.ts flag scan; extensions are " +
-            "host-trusted JS modules loaded into the agent process, not caller command hooks).");
-    }
-    if (profile.modes !== undefined) {
-        rejectPrimeControl("modes", "prime-agent has no mode concept (fork cli/args.ts flag scan).");
-    }
-    if (profile.confidential !== undefined) {
-        rejectPrimeControl("confidential", "confidential execution is a property of the executor's isolation boundary, not " +
-            "of the agent dir; this lowering cannot establish it.");
-    }
-    const instructionBlocks = [];
-    if (profile.prompt) {
-        const { systemPrompt, appendSystemPrompt, instructions } = profile.prompt;
-        const knownPromptFields = new Set([
-            "systemPrompt",
-            "appendSystemPrompt",
-            "instructions",
-        ]);
-        const unknown = Object.entries(profile.prompt)
-            .filter(([key, value]) => !knownPromptFields.has(key) && value !== undefined)
-            .map(([key]) => key);
-        if (unknown.length > 0) {
-            rejectPrimeControl(`prompt fields: ${unknown.join(", ")}`, "no verified prime-agent read path exists for them.");
-        }
-        if (systemPrompt !== undefined) {
-            if (typeof systemPrompt !== "string" || systemPrompt.trim() === "") {
-                rejectPrimeDeclaration("prompt.systemPrompt", "an empty replacement would delete the built-in system prompt and " +
-                    "install nothing.");
-            }
-            controls.systemPrompt = systemPrompt;
-        }
-        if (appendSystemPrompt !== undefined) {
-            if (typeof appendSystemPrompt !== "string" ||
-                appendSystemPrompt.trim() === "") {
-                rejectPrimeDeclaration("prompt.appendSystemPrompt", "must be non-empty text.");
-            }
-            controls.appendSystemPrompt = appendSystemPrompt;
-        }
-        for (const block of instructions ?? []) {
-            if (typeof block === "string" && block.trim() !== "")
-                instructionBlocks.push(block);
-        }
-    }
-    if (profile.resources) {
-        const { skills, instructions, failOnError, ...unsupported } = profile.resources;
-        const rejectedKeys = Object.entries(unsupported)
-            .filter(([, value]) => value !== undefined)
-            .map(([key]) => key);
-        if (rejectedKeys.length > 0) {
-            rejectPrimeControl(`resources: ${rejectedKeys.join(", ")}`, "only resources.skills (--skill dirs, fork resource-loader.ts:437-442) and " +
-                "resources.instructions (agent-dir AGENTS.md, resource-loader.ts:86) have a " +
-                "verified prime-agent read path. Generic workspace files, tool files, " +
-                "subagent-definition files and prompt templates either have no headless read " +
-                "path or would run caller-authored code inside the agent process.");
-        }
-        if (failOnError === false) {
-            rejectPrimeControl("resources.failOnError: false", "this lowering always fails loud on a resource it cannot " +
-                "materialize; lenient materialization is not implemented.");
-        }
-        if (instructions !== undefined) {
-            const block = primeInstructionBlock(instructions, "resources.instructions");
-            if (block.trim() !== "")
-                instructionBlocks.push(block);
-        }
-        const seen = new Set();
-        for (const [index, ref] of (skills ?? []).entries()) {
-            if (ref.kind !== "inline") {
-                rejectPrimeControl(`resources.skills[${index}]`, "only inline skill refs are accepted — resolve GitHub-backed refs " +
-                    "(resolveAgentProfileResources) before handing the profile to " +
-                    "this lowering.");
-            }
-            const name = ref.name;
-            if (!PRIME_SKILL_NAME_RE.test(name) ||
-                name.length > PRIME_MAX_SKILL_NAME_LENGTH) {
-                rejectPrimeDeclaration(`resources.skills[${index}]`, `name ${JSON.stringify(name)} is not a valid prime skill name — it becomes the ` +
-                    "skill directory name, so it must be lowercase a-z0-9 with single hyphens, at " +
-                    `most ${PRIME_MAX_SKILL_NAME_LENGTH} chars (fork skills.ts:122-147).`);
-            }
-            if (seen.has(name)) {
-                rejectPrimeDeclaration("resources.skills", `declares ${JSON.stringify(name)} twice; duplicate skill names collide in the ` +
-                    "fork's skill registry, which keeps only the first and warns.");
-            }
-            seen.add(name);
-            if (ref.content.trim() === "") {
-                rejectPrimeDeclaration(`resources.skills[${index}]`, `skill ${JSON.stringify(name)} declares no content.`);
-            }
-            controls.skills.push({ name, content: ref.content });
-        }
-    }
-    if (instructionBlocks.length > 0) {
-        controls.instructions = instructionBlocks.join("\n\n");
-    }
-    if (profile.subagents) {
-        const usedIds = new Map();
-        for (const [name, spec] of Object.entries(profile.subagents)) {
-            if (name.trim() === "") {
-                rejectPrimeDeclaration("subagents", "a subagent name must be non-empty.");
-            }
-            const inexpressible = [
-                ["model", spec.model],
-                ["tools", spec.tools],
-                ["permissions", spec.permissions],
-                ["maxSteps", spec.maxSteps],
-            ]
-                .filter(([, value]) => value !== undefined)
-                .map(([key]) => key);
-            if (inexpressible.length > 0) {
-                rejectPrimeControl(`subagents[${JSON.stringify(name)}] fields: ${inexpressible.join(", ")}`, "a prime continual-harness subagent spec is prompt-roster " +
-                    "guidance for `await rlm('<task>')` (fork refinement.ts:483-496) " +
-                    "and pins no model, tool set, permission, or step budget on the " +
-                    "spawned child.");
-            }
-            if (!spec.description?.trim() && !spec.prompt?.trim()) {
-                rejectPrimeDeclaration(`subagents[${JSON.stringify(name)}]`, "declares no behavior — a spec needs a description and/or prompt, since an " +
-                    "empty entry gives the model an empty roster line.");
-            }
-            const id = primeSubagentEntryId(name);
-            const clash = usedIds.get(id);
-            if (clash !== undefined) {
-                rejectPrimeDeclaration(`subagents[${JSON.stringify(name)}]`, `collides with subagent ${JSON.stringify(clash)} on harness-state id ` +
-                    `${JSON.stringify(id)}.`);
-            }
-            usedIds.set(id, name);
-            controls.subagents.push({
-                name,
-                description: spec.description,
-                prompt: spec.prompt,
-                metadata: spec.metadata,
-            });
-        }
-    }
-    return controls;
-}
-/**
- * Refuse a run whose selected model disagrees with the profile's own.
- *
- * One authority per run: a profile names the model it was written and scored
- * against, so running it on a different one silently scores a different agent.
- * Both sides go through {@link modelIdsMatch}, so the qualification level a
- * caller happened to use is not a conflict.
- *
- * `provider` is the executor's PROVIDER SELECTION, and is compared only when
- * the executor's provider is part of model identity. An executor whose
- * provider key is merely a namespace inside the agent dir passes it as
- * undefined and gets the model-name comparison alone.
- */
-export function assertPrimeModelAgreement(profile, selected) {
-    const declared = profile?.model?.default;
-    const declaredProvider = profile?.model?.provider;
-    if (declared !== undefined) {
-        const selectedId = qualifyModelId(selected.provider, selected.model);
-        const declaredId = qualifyModelId(declaredProvider, declared);
-        if (!modelIdsMatch(selectedId, declaredId, selected.provider)) {
-            rejectPrimeDeclaration("model.default", `the run selects ${JSON.stringify(selectedId)} but the profile names ` +
-                `${JSON.stringify(declaredId)}; a profile must not be scored against a model it ` +
-                "does not name.");
-        }
-        return;
-    }
-    if (selected.provider !== undefined &&
-        declaredProvider !== undefined &&
-        declaredProvider !== selected.provider) {
-        rejectPrimeDeclaration("model.provider", `the run selects provider ${JSON.stringify(selected.provider)} but the profile names ` +
-            `${JSON.stringify(declaredProvider)}.`);
-    }
-}
-/** Deterministic harness-state entry id for a profile subagent name. */
-export function primeSubagentEntryId(name) {
-    const slug = name
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, "-")
-        .replace(/^-+|-+$/g, "");
-    return `profile-${slug || "subagent"}`;
-}
-/**
- * Write one agent-dir file atomically (temp + rename).
- *
- * Every file this lowering writes lands in a directory a LIVE agent may be
- * reading: prime reloads models.json at model-resolution time and re-reads the
- * harness store on every system-prompt build, so a partial write is observable.
- * `mode` is applied to the temp file before the rename, so the final file is
- * never briefly world-readable.
- */
-export function writePrimeAgentFile(path, data, mode = 0o600) {
-    mkdirSync(dirname(path), { recursive: true });
-    const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
-    writeFileSync(temp, data, { mode });
-    renameSync(temp, path);
-}
-/**
- * Materialize the validated controls and return the extra spawn args that bind
- * them. Runs before every spawn (same place models.json is materialized), so a
- * continual agent dir is re-pinned to the current profile on each fresh prime
- * process.
- */
-export function materializePrimeProfileControls(agentDir, controls, options = {}) {
-    const { flagFileRoot = agentDir, warn } = options;
-    const args = [];
-    const profileDir = join(flagFileRoot, PRIME_PROFILE_DIR_NAME);
-    if (controls.systemPrompt !== undefined) {
-        const promptPath = join(profileDir, PRIME_SYSTEM_PROMPT_FILE);
-        writePrimeAgentFile(promptPath, controls.systemPrompt);
-        args.push("--system-prompt", promptPath);
-    }
-    if (controls.appendSystemPrompt !== undefined) {
-        const appendPath = join(profileDir, PRIME_APPEND_SYSTEM_PROMPT_FILE);
-        writePrimeAgentFile(appendPath, controls.appendSystemPrompt);
-        args.push("--append-system-prompt", appendPath);
-    }
-    if (controls.instructions !== undefined) {
-        writePrimeAgentFile(join(agentDir, PRIME_CONTEXT_FILE), `${controls.instructions}\n`);
-    }
-    if (controls.skills.length > 0) {
-        const skillsRoot = join(profileDir, PRIME_SKILLS_DIR_NAME);
-        for (const skill of controls.skills) {
-            writePrimeAgentFile(join(skillsRoot, skill.name, "SKILL.md"), normalizeSkillMd(skill.name, skill.content));
-        }
-        args.push("--skill", skillsRoot);
-    }
-    seedPrimeProfileSubagents(agentDir, controls.subagents, warn);
-    return args;
-}
-/**
- * Remove the files a PREVIOUS materialization of this lowering wrote, so a
- * profile that shrank cannot leave a stale instruction file or skill behind for
- * the next run against the same dirs.
- *
- * Only the paths this lowering NAMES are removed. There is deliberately no
- * manifest: a manifest would live where the agent can write it, and reading a
- * delete list out of agent-writable state turns pruning into an arbitrary-path
- * delete.
- */
-export function prunePrimeProfileMaterial(agentDir, options = {}) {
-    const { flagFileRoot = agentDir } = options;
-    rmSync(join(flagFileRoot, PRIME_PROFILE_DIR_NAME), {
-        recursive: true,
-        force: true,
-    });
-    rmSync(join(agentDir, PRIME_CONTEXT_FILE), { force: true });
-}
-/**
- * Upsert profile subagent specs into the fork's global continual-harness
- * store and remove profile-sourced entries the current profile no longer
- * declares. Agent-written entries (`source: "agent"`) — and every top-level
- * key this lowering does not manage — are preserved untouched.
- *
- * A store that exists but no longer parses raises
- * {@link PrimeHarnessStateError}: the file is the agent's own self-modification
- * state, and overwriting it destroys what the run was supposed to observe.
- */
-export function seedPrimeProfileSubagents(agentDir, subagents, warn) {
-    const statePath = join(agentDir, PRIME_HARNESS_DIR_NAME, PRIME_HARNESS_STATE_FILE);
-    let state = {};
-    if (existsSync(statePath)) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(statePath, "utf8"));
-        }
-        catch (err) {
-            throw new PrimeHarnessStateError(statePath, err instanceof Error ? err.message : String(err));
-        }
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new PrimeHarnessStateError(statePath, "the store is not a JSON object");
-        }
-        state = parsed;
-    }
-    else if (subagents.length === 0) {
-        // Nothing to pin and nothing stale to remove.
-        return;
-    }
-    const rawEntries = state.entries;
-    const entries = rawEntries && typeof rawEntries === "object" && !Array.isArray(rawEntries)
-        ? rawEntries
-        : {};
-    for (const kind of PRIME_HARNESS_KINDS) {
-        const records = entries[kind];
-        if (!records || typeof records !== "object" || Array.isArray(records)) {
-            entries[kind] = {};
-        }
-    }
-    const existing = entries.subagent;
-    const desiredIds = new Set(subagents.map((s) => primeSubagentEntryId(s.name)));
-    let changed = false;
-    for (const [id, entry] of Object.entries(existing)) {
-        const source = entry?.source;
-        const isLegacy = typeof source === "string" &&
-            PRIME_LEGACY_PROFILE_ENTRY_SOURCES.includes(source);
-        if (isLegacy) {
-            warn?.("prime: adopting a subagent entry left by a pre-shared executor", {
-                statePath,
-                id,
-                source,
-            });
-        }
-        if ((source === PRIME_PROFILE_ENTRY_SOURCE || isLegacy) &&
-            !desiredIds.has(id)) {
-            delete existing[id];
-            changed = true;
-        }
-    }
-    const now = new Date().toISOString();
-    for (const spec of subagents) {
-        const id = primeSubagentEntryId(spec.name);
-        const content = [spec.description?.trim(), spec.prompt?.trim()]
-            .filter((part) => !!part)
-            .join("\n\n");
-        const previous = existing[id];
-        if (previous &&
-            previous.source === PRIME_PROFILE_ENTRY_SOURCE &&
-            previous.title === spec.name &&
-            previous.content === content) {
-            continue;
-        }
-        existing[id] = {
-            id,
-            kind: "subagent",
-            title: spec.name,
-            content,
-            path: PRIME_PROFILE_ENTRY_SOURCE,
-            scope: "global",
-            reference: {},
-            arguments: {},
-            metadata: spec.metadata ?? {},
-            source: PRIME_PROFILE_ENTRY_SOURCE,
-            created_at: previous?.created_at ?? now,
-            updated_at: now,
-            version: previous && typeof previous.version === "number"
-                ? previous.version + 1
-                : 1,
-        };
-        changed = true;
-    }
-    if (!changed)
-        return;
-    writePrimeAgentFile(statePath, `${JSON.stringify({
-        ...state,
-        schema: typeof state.schema === "number" ? state.schema : 1,
-        entries,
-        refinements: Array.isArray(state.refinements) ? state.refinements : [],
-    }, null, 2)}\n`);
-}
+export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
+export { materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
+export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";