@tangle-network/agent-profile-materialize 0.17.0 → 0.17.1

package/dist/execution-controls.js

@@ -35,8 +35,8 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
             const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`), "opencode tool");
             const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
             if (enforceableTools.length > 0 || permissionEntries.length > 0) {
-                add("opencode.json", serializeWorkspacePlanJson({
-                    $schema: "https://opencode.ai/config.json",
+                add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
+                    $schema: OPENCODE_CONFIG_SCHEMA,
                     ...(nativeTools.length > 0
                         ? { tools: Object.fromEntries(nativeTools) }
                         : {}),
@@ -180,7 +180,7 @@ function piExecutionControlExtensionSource(enabledTools, excludedTools) {
 }
 import { resolveNativeWebTools } from "@tangle-network/agent-interface";
 import { claudePermissionRules, claudeToolName, mapSupportedBooleanEntries, mapSupportedPermissionEntries, normalizedControlName, openCodePermissionName, openCodeToolName, PI_EXECUTION_CONTROL_EXTENSION_PATH, permissionAllowsEverything, piToolId, sealClaudePermissionRules, } from "./control-maps.js";
-import { CLAUDE_SETTINGS_PATH } from "./harness.js";
+import { CLAUDE_SETTINGS_PATH, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, } from "./harness.js";
 import { registerClaudeSettings } from "./hooks.js";
 import { serializeWorkspacePlanJson } from "./plan-json.js";
 import { compareStrings } from "./workspace-files.js";

package/dist/harness.d.ts

@@ -4,6 +4,8 @@ export declare function isMaterializerHarness(harness: string): harness is Harne
 export declare function assertMaterializerHarness(harness: string): asserts harness is HarnessId;
 export declare const CODEX_SYSTEM_PROMPT_FILE = ".codex/system-prompt.md";
 export declare const OPENCODE_APPEND_SYSTEM_PROMPT_FILE = ".opencode/agent-system-prompt.md";
+export declare const OPENCODE_CONFIG_FILE = "opencode.json";
+export declare const OPENCODE_CONFIG_SCHEMA = "https://opencode.ai/config.json";
 export declare const OPENCODE_PRIMARY_AGENT_PREFIX = "tangle-profile-";
 export declare const CLAUDE_SETTINGS_PATH = ".tangle/claude-settings.json";
 export declare function harnessAutoLoadsContextFile(harness: HarnessId): boolean;
@@ -38,30 +40,52 @@ export declare function appendSystemPromptRefusal(harness: HarnessId): string;
 /** Project context file each harness actually reads from cwd. NEVER a constant. */
 export declare const CONTEXT_FILE: Record<HarnessId, string>;
 /**
- * The paths whose only possible author is this package, per
- * {@link PlanFile.ownership}.
+ * The paths a profile resource may never mount.
  *
  * Codex names no system-prompt file of its own — `model_instructions_file`
  * takes whatever path it is given — and opencode names none either, since it
  * reads exactly the files its config lists. All three names below were chosen
  * here, so a file already at one of them is this materializer's own output from
- * an earlier application into the same workspace.
+ * an earlier application into the same workspace, and a mount there could not
+ * survive the next application.
  *
  * That is an inference from the path name, not verified provenance: nothing
  * checks the existing bytes are prior materializer output, so a workspace that
  * carried a foreign file at one of these invented names is overwritten on the
  * first application. Accepted cost of stateless multi-turn re-application,
  * bounded by the names being ones no harness or user convention uses.
+ */
+export declare const MATERIALIZER_RESERVED_PATHS: ReadonlySet<string>;
+/**
+ * The paths whose generated content is wholly this package's output, per
+ * {@link PlanFile.ownership}: the reserved names plus `opencode.json`, which
+ * carries only the registrations this package generates from the profile.
+ *
+ * `opencode.json` is a documented name a user repository can carry, so the
+ * name alone proves nothing and a profile resource may still mount it. An
+ * existing file there is replaced only when {@link isMaterializerOutput}
+ * recognizes its bytes as this package's own earlier output.
  *
  * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
- * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`, `opencode.json`. A user's repository
- * can carry any of those, and clobbering one is worse than refusing the turn.
- * For `opencode.json` this means a profile change that alters the
- * `instructions[]` membership between turns of one workspace refuses loudly
- * (the consolidated config no longer matches byte-for-byte) rather than
- * replacing a possibly user-authored config.
+ * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`. A user's repository can carry any of
+ * those with content this package cannot tell from its own, and clobbering
+ * one is worse than refusing the turn.
  */
 export declare const MATERIALIZER_OWNED_PATHS: ReadonlySet<string>;
+/** The top-level keys this package writes into `opencode.json`. */
+export declare const OPENCODE_CONFIG_KEYS: ReadonlySet<string>;
+/**
+ * Whether the file already at owned path `relPath` is this package's own
+ * earlier output. A reserved name proves that by itself, so `content` is read
+ * only for `opencode.json`; `undefined` content means no regular file is there.
+ *
+ * An `opencode.json` this package wrote holds the opencode schema id, only the
+ * keys this package writes, and only instruction paths this package invented.
+ * A user config that holds nothing else is indistinguishable from that output
+ * and is replaced too; a config with any other key, or with an instruction path
+ * of the user's own, is refused.
+ */
+export declare function isMaterializerOutput(relPath: string, content: () => string | undefined): boolean;
 /**
  * cwd-relative native skill dir per harness, or null if the harness has no
  * cwd skill primitive (skills live in a user/global dir the workspace plan

package/dist/harness.js

@@ -21,6 +21,8 @@ export function assertMaterializerHarness(harness) {
 }
 export const CODEX_SYSTEM_PROMPT_FILE = ".codex/system-prompt.md";
 export const OPENCODE_APPEND_SYSTEM_PROMPT_FILE = ".opencode/agent-system-prompt.md";
+export const OPENCODE_CONFIG_FILE = "opencode.json";
+export const OPENCODE_CONFIG_SCHEMA = "https://opencode.ai/config.json";
 export const OPENCODE_PRIMARY_AGENT_PREFIX = "tangle-profile-";
 export const CLAUDE_SETTINGS_PATH = ".tangle/claude-settings.json";
 export function harnessAutoLoadsContextFile(harness) {
@@ -101,34 +103,95 @@ export const CONTEXT_FILE = {
     openclaw: "AGENTS.md",
 };
 /**
- * The paths whose only possible author is this package, per
- * {@link PlanFile.ownership}.
+ * The paths a profile resource may never mount.
  *
  * Codex names no system-prompt file of its own — `model_instructions_file`
  * takes whatever path it is given — and opencode names none either, since it
  * reads exactly the files its config lists. All three names below were chosen
  * here, so a file already at one of them is this materializer's own output from
- * an earlier application into the same workspace.
+ * an earlier application into the same workspace, and a mount there could not
+ * survive the next application.
  *
  * That is an inference from the path name, not verified provenance: nothing
  * checks the existing bytes are prior materializer output, so a workspace that
  * carried a foreign file at one of these invented names is overwritten on the
  * first application. Accepted cost of stateless multi-turn re-application,
  * bounded by the names being ones no harness or user convention uses.
- *
- * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
- * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`, `opencode.json`. A user's repository
- * can carry any of those, and clobbering one is worse than refusing the turn.
- * For `opencode.json` this means a profile change that alters the
- * `instructions[]` membership between turns of one workspace refuses loudly
- * (the consolidated config no longer matches byte-for-byte) rather than
- * replacing a possibly user-authored config.
  */
-export const MATERIALIZER_OWNED_PATHS = new Set([
+export const MATERIALIZER_RESERVED_PATHS = new Set([
     CODEX_SYSTEM_PROMPT_FILE,
     OPENCODE_APPEND_SYSTEM_PROMPT_FILE,
     CONTEXT_FILE.opencode,
 ]);
+/**
+ * The paths whose generated content is wholly this package's output, per
+ * {@link PlanFile.ownership}: the reserved names plus `opencode.json`, which
+ * carries only the registrations this package generates from the profile.
+ *
+ * `opencode.json` is a documented name a user repository can carry, so the
+ * name alone proves nothing and a profile resource may still mount it. An
+ * existing file there is replaced only when {@link isMaterializerOutput}
+ * recognizes its bytes as this package's own earlier output.
+ *
+ * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
+ * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`. A user's repository can carry any of
+ * those with content this package cannot tell from its own, and clobbering
+ * one is worse than refusing the turn.
+ */
+export const MATERIALIZER_OWNED_PATHS = new Set([
+    ...MATERIALIZER_RESERVED_PATHS,
+    OPENCODE_CONFIG_FILE,
+]);
+/** The top-level keys this package writes into `opencode.json`. */
+export const OPENCODE_CONFIG_KEYS = new Set([
+    "$schema",
+    "instructions",
+    "mcp",
+    "tools",
+    "permission",
+]);
+/**
+ * Whether the file already at owned path `relPath` is this package's own
+ * earlier output. A reserved name proves that by itself, so `content` is read
+ * only for `opencode.json`; `undefined` content means no regular file is there.
+ *
+ * An `opencode.json` this package wrote holds the opencode schema id, only the
+ * keys this package writes, and only instruction paths this package invented.
+ * A user config that holds nothing else is indistinguishable from that output
+ * and is replaced too; a config with any other key, or with an instruction path
+ * of the user's own, is refused.
+ */
+export function isMaterializerOutput(relPath, content) {
+    if (MATERIALIZER_RESERVED_PATHS.has(relPath))
+        return true;
+    if (relPath !== OPENCODE_CONFIG_FILE)
+        return false;
+    const bytes = content();
+    if (bytes === undefined)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes);
+    }
+    catch {
+        return false;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return false;
+    }
+    const config = parsed;
+    if (config.$schema !== OPENCODE_CONFIG_SCHEMA)
+        return false;
+    if (!Object.keys(config).every((key) => OPENCODE_CONFIG_KEYS.has(key))) {
+        return false;
+    }
+    const instructions = config.instructions;
+    if (instructions === undefined)
+        return true;
+    return (Array.isArray(instructions) &&
+        instructions.every((entry) => entry === OPENCODE_APPEND_SYSTEM_PROMPT_FILE ||
+            entry === CONTEXT_FILE.opencode));
+}
 /**
  * cwd-relative native skill dir per harness, or null if the harness has no
  * cwd skill primitive (skills live in a user/global dir the workspace plan

package/dist/mcp.js

@@ -47,8 +47,8 @@ export function materializeMcp(h, mcp, plan, add, unsupported) {
         }
         case "opencode":
             // opencode.json "mcp" block (local|remote).
-            add("opencode.json", serializeWorkspacePlanJson({
-                $schema: "https://opencode.ai/config.json",
+            add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
+                $schema: OPENCODE_CONFIG_SCHEMA,
                 mcp: openCodeMcpConfig(mcp),
             }));
             break;
@@ -238,6 +238,7 @@ export function openCodeMcpConfig(mcp) {
     }
     return out;
 }
+import { OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA } from "./harness.js";
 import { sha256 } from "./plan-digest.js";
 import { concatWorkspacePlanArguments, joinWorkspacePlanArguments, serializeWorkspacePlanJson, tomlProfileConfigValue, tomlStr, } from "./plan-json.js";
 import { setPlanEnvironment } from "./profile-plan.js";

package/dist/plan-types.d.ts

@@ -28,16 +28,20 @@ export interface PlanFile {
      * Who owns the PATH — which decides whether an existing file there may be
      * replaced.
      *
-     * `"materializer"` = a path this package invented. No harness convention
-     * names it and no user authors it, so a file already there can only be this
-     * materializer's own output from an earlier application into the same
-     * workspace, and replacing it is how turn two of a resumed session gets the
-     * current profile instead of the previous one.
+     * `"materializer"` = a path whose generated content is wholly this
+     * package's output: a name this package invented, or `opencode.json`, which
+     * carries only the registrations generated from the profile. A file already
+     * there is this materializer's own output from an earlier application into
+     * the same workspace, and replacing it is how turn two of a resumed session
+     * gets the current profile instead of the previous one. Application replaces
+     * it only when the existing bytes prove that provenance — by the name for an
+     * invented path, by the content for `opencode.json`.
      *
      * `"shared"` (the default, and every other file) = a path the user or the
-     * harness also owns — `CLAUDE.md`, `AGENTS.md`, `opencode.json`,
-     * `.gemini/system.md` are all documented, user-authorable names. An existing
-     * file there may be the caller's own work, so it is never replaced.
+     * harness also owns — `CLAUDE.md`, `AGENTS.md`, `.gemini/system.md` are all
+     * documented, user-authorable names whose content this package cannot tell
+     * from its own. An existing file there may be the caller's own work, so it is
+     * never replaced.
      *
      * Optional because hand-constructed plans have no path provenance to report;
      * absent reads as `"shared"`, the safe answer.

package/dist/profile-plan.js

@@ -1,4 +1,4 @@
-import { MATERIALIZER_OWNED_PATHS } from "./harness.js";
+import { MATERIALIZER_OWNED_PATHS, MATERIALIZER_RESERVED_PATHS, } from "./harness.js";
 import { workspacePlanConfigValue } from "./plan-json.js";
 import { mergeJsonFiles } from "./plan-normalize.js";
 import { formatUnsupported } from "./plan-support.js";
@@ -47,7 +47,7 @@ export function createProfilePlanBuilder(harness) {
         if (previousDimension) {
             throw new Error(`Duplicate profile resource path: ${normalizedPath} (${previousDimension}, ${dimension})`);
         }
-        if (MATERIALIZER_OWNED_PATHS.has(normalizedPath)) {
+        if (MATERIALIZER_RESERVED_PATHS.has(normalizedPath)) {
             throw new Error(`Profile resource path is reserved by the materializer: ${normalizedPath} (${dimension}). ` +
                 "This package writes that path itself and replaces it on re-application, so a mount " +
                 "there cannot survive; choose another path.");

package/dist/profile-prompt.js

@@ -1,4 +1,4 @@
-import { appendSystemPromptRefusal, CODEX_SYSTEM_PROMPT_FILE, CONTEXT_FILE, OPENCODE_APPEND_SYSTEM_PROMPT_FILE, OPENCODE_PRIMARY_AGENT_PREFIX, systemPromptRefusal, } from "./harness.js";
+import { appendSystemPromptRefusal, CODEX_SYSTEM_PROMPT_FILE, CONTEXT_FILE, OPENCODE_APPEND_SYSTEM_PROMPT_FILE, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, OPENCODE_PRIMARY_AGENT_PREFIX, systemPromptRefusal, } from "./harness.js";
 import { sha256 } from "./plan-digest.js";
 import { serializeWorkspacePlanJson } from "./plan-json.js";
 export function lowerProfilePrompt(profile, harness, binds, builder) {
@@ -97,8 +97,8 @@ export function lowerProfilePrompt(profile, harness, binds, builder) {
         }
     }
     if (openCodeInstructionFiles.length > 0) {
-        add("opencode.json", serializeWorkspacePlanJson({
-            $schema: "https://opencode.ai/config.json",
+        add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
+            $schema: OPENCODE_CONFIG_SCHEMA,
             instructions: openCodeInstructionFiles,
         }));
     }

package/dist/workspace-apply.js

@@ -37,11 +37,14 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
             runtimeOnlyFiles: privateRuntimeFiles,
         };
     }
-    // A path this package invented can only hold this package's own earlier
-    // output, so re-applying into the same workspace replaces it rather than
-    // failing the turn. `reject` still refuses: that policy is "nothing may
-    // pre-exist here", which is a statement about the workspace, not authorship.
-    const mayReplace = (file) => existingFiles === "allow-identical" && file.ownership === "materializer";
+    // An owned path holds this package's own earlier output, so re-applying
+    // into the same workspace replaces it rather than failing the turn — once
+    // the bytes already there prove that provenance. `reject` still refuses:
+    // that policy is "nothing may pre-exist here", which is a statement about
+    // the workspace, not authorship.
+    const mayReplace = (file) => existingFiles === "allow-identical" &&
+        file.ownership === "materializer" &&
+        isMaterializerOutput(file.relPath, () => regularFileContent(file.absPath));
     // Validate the complete plan before the first write so a late traversal or
     // existing symlink cannot leave a partially materialized workspace.
     for (const file of files) {
@@ -170,6 +173,11 @@ function workspaceFileExists(pathValue) {
         throw error;
     }
 }
+function regularFileContent(pathValue) {
+    return lstatSync(pathValue).isFile()
+        ? readFileSync(pathValue, "utf8")
+        : undefined;
+}
 function workspaceFileMatches(file) {
     const stats = lstatSync(file.absPath);
     return (stats.isFile() &&
@@ -327,6 +335,7 @@ export function safeWorkspacePlanReceipt(plan, written, workspacePlanDigest = ha
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, fchmodSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { isMaterializerOutput } from "./harness.js";
 import { hashWorkspacePlan } from "./plan-digest.js";
 import { normalizeWorkspacePlanArgument, } from "./plan-normalize.js";
 import { promptIntentFields, samePromptIntentValue, systemPromptBindingField, } from "./plan-prompt.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "main": "./dist/index.js",