@tangle-network/agent-profile-materialize 0.17.0 → 0.17.3

package/dist/execution-controls.js

@@ -35,8 +35,8 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
             const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`), "opencode tool");
             const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
             if (enforceableTools.length > 0 || permissionEntries.length > 0) {
-                add("opencode.json", serializeWorkspacePlanJson({
-                    $schema: "https://opencode.ai/config.json",
+                add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
+                    $schema: OPENCODE_CONFIG_SCHEMA,
                     ...(nativeTools.length > 0
                         ? { tools: Object.fromEntries(nativeTools) }
                         : {}),
@@ -180,7 +180,7 @@ function piExecutionControlExtensionSource(enabledTools, excludedTools) {
 }
 import { resolveNativeWebTools } from "@tangle-network/agent-interface";
 import { claudePermissionRules, claudeToolName, mapSupportedBooleanEntries, mapSupportedPermissionEntries, normalizedControlName, openCodePermissionName, openCodeToolName, PI_EXECUTION_CONTROL_EXTENSION_PATH, permissionAllowsEverything, piToolId, sealClaudePermissionRules, } from "./control-maps.js";
-import { CLAUDE_SETTINGS_PATH } from "./harness.js";
+import { CLAUDE_SETTINGS_PATH, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, } from "./harness.js";
 import { registerClaudeSettings } from "./hooks.js";
 import { serializeWorkspacePlanJson } from "./plan-json.js";
 import { compareStrings } from "./workspace-files.js";

package/dist/harness.d.ts

@@ -4,6 +4,8 @@ export declare function isMaterializerHarness(harness: string): harness is Harne
 export declare function assertMaterializerHarness(harness: string): asserts harness is HarnessId;
 export declare const CODEX_SYSTEM_PROMPT_FILE = ".codex/system-prompt.md";
 export declare const OPENCODE_APPEND_SYSTEM_PROMPT_FILE = ".opencode/agent-system-prompt.md";
+export declare const OPENCODE_CONFIG_FILE = "opencode.json";
+export declare const OPENCODE_CONFIG_SCHEMA = "https://opencode.ai/config.json";
 export declare const OPENCODE_PRIMARY_AGENT_PREFIX = "tangle-profile-";
 export declare const CLAUDE_SETTINGS_PATH = ".tangle/claude-settings.json";
 export declare function harnessAutoLoadsContextFile(harness: HarnessId): boolean;
@@ -38,30 +40,52 @@ export declare function appendSystemPromptRefusal(harness: HarnessId): string;
 /** Project context file each harness actually reads from cwd. NEVER a constant. */
 export declare const CONTEXT_FILE: Record<HarnessId, string>;
 /**
- * The paths whose only possible author is this package, per
- * {@link PlanFile.ownership}.
+ * The paths a profile resource may never mount.
  *
  * Codex names no system-prompt file of its own — `model_instructions_file`
  * takes whatever path it is given — and opencode names none either, since it
  * reads exactly the files its config lists. All three names below were chosen
  * here, so a file already at one of them is this materializer's own output from
- * an earlier application into the same workspace.
+ * an earlier application into the same workspace, and a mount there could not
+ * survive the next application.
  *
  * That is an inference from the path name, not verified provenance: nothing
  * checks the existing bytes are prior materializer output, so a workspace that
  * carried a foreign file at one of these invented names is overwritten on the
  * first application. Accepted cost of stateless multi-turn re-application,
  * bounded by the names being ones no harness or user convention uses.
+ */
+export declare const MATERIALIZER_RESERVED_PATHS: ReadonlySet<string>;
+/**
+ * The paths whose generated content is wholly this package's output, per
+ * {@link PlanFile.ownership}: the reserved names plus `opencode.json`, which
+ * carries only the registrations this package generates from the profile.
+ *
+ * `opencode.json` is a documented name a user repository can carry, so the
+ * name alone proves nothing and a profile resource may still mount it. An
+ * existing file there is replaced only when {@link isMaterializerOutput}
+ * recognizes its bytes as this package's own earlier output.
  *
  * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
- * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`, `opencode.json`. A user's repository
- * can carry any of those, and clobbering one is worse than refusing the turn.
- * For `opencode.json` this means a profile change that alters the
- * `instructions[]` membership between turns of one workspace refuses loudly
- * (the consolidated config no longer matches byte-for-byte) rather than
- * replacing a possibly user-authored config.
+ * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`. A user's repository can carry any of
+ * those with content this package cannot tell from its own, and clobbering
+ * one is worse than refusing the turn.
  */
 export declare const MATERIALIZER_OWNED_PATHS: ReadonlySet<string>;
+/** The top-level keys this package writes into `opencode.json`. */
+export declare const OPENCODE_CONFIG_KEYS: ReadonlySet<string>;
+/**
+ * Whether the file already at owned path `relPath` is this package's own
+ * earlier output. A reserved name proves that by itself, so `content` is read
+ * only for `opencode.json`; `undefined` content means no regular file is there.
+ *
+ * An `opencode.json` this package wrote holds the opencode schema id, only the
+ * keys this package writes, and only instruction paths this package invented.
+ * A user config that holds nothing else is indistinguishable from that output
+ * and is replaced too; a config with any other key, or with an instruction path
+ * of the user's own, is refused.
+ */
+export declare function isMaterializerOutput(relPath: string, content: () => string | undefined): boolean;
 /**
  * cwd-relative native skill dir per harness, or null if the harness has no
  * cwd skill primitive (skills live in a user/global dir the workspace plan

package/dist/harness.js

@@ -21,6 +21,8 @@ export function assertMaterializerHarness(harness) {
 }
 export const CODEX_SYSTEM_PROMPT_FILE = ".codex/system-prompt.md";
 export const OPENCODE_APPEND_SYSTEM_PROMPT_FILE = ".opencode/agent-system-prompt.md";
+export const OPENCODE_CONFIG_FILE = "opencode.json";
+export const OPENCODE_CONFIG_SCHEMA = "https://opencode.ai/config.json";
 export const OPENCODE_PRIMARY_AGENT_PREFIX = "tangle-profile-";
 export const CLAUDE_SETTINGS_PATH = ".tangle/claude-settings.json";
 export function harnessAutoLoadsContextFile(harness) {
@@ -101,34 +103,95 @@ export const CONTEXT_FILE = {
     openclaw: "AGENTS.md",
 };
 /**
- * The paths whose only possible author is this package, per
- * {@link PlanFile.ownership}.
+ * The paths a profile resource may never mount.
  *
  * Codex names no system-prompt file of its own — `model_instructions_file`
  * takes whatever path it is given — and opencode names none either, since it
  * reads exactly the files its config lists. All three names below were chosen
  * here, so a file already at one of them is this materializer's own output from
- * an earlier application into the same workspace.
+ * an earlier application into the same workspace, and a mount there could not
+ * survive the next application.
  *
  * That is an inference from the path name, not verified provenance: nothing
  * checks the existing bytes are prior materializer output, so a workspace that
  * carried a foreign file at one of these invented names is overwritten on the
  * first application. Accepted cost of stateless multi-turn re-application,
  * bounded by the names being ones no harness or user convention uses.
- *
- * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
- * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`, `opencode.json`. A user's repository
- * can carry any of those, and clobbering one is worse than refusing the turn.
- * For `opencode.json` this means a profile change that alters the
- * `instructions[]` membership between turns of one workspace refuses loudly
- * (the consolidated config no longer matches byte-for-byte) rather than
- * replacing a possibly user-authored config.
  */
-export const MATERIALIZER_OWNED_PATHS = new Set([
+export const MATERIALIZER_RESERVED_PATHS = new Set([
     CODEX_SYSTEM_PROMPT_FILE,
     OPENCODE_APPEND_SYSTEM_PROMPT_FILE,
     CONTEXT_FILE.opencode,
 ]);
+/**
+ * The paths whose generated content is wholly this package's output, per
+ * {@link PlanFile.ownership}: the reserved names plus `opencode.json`, which
+ * carries only the registrations this package generates from the profile.
+ *
+ * `opencode.json` is a documented name a user repository can carry, so the
+ * name alone proves nothing and a profile resource may still mount it. An
+ * existing file there is replaced only when {@link isMaterializerOutput}
+ * recognizes its bytes as this package's own earlier output.
+ *
+ * Deliberately absent: `.gemini/system.md` (gemini's own documented name),
+ * `GEMINI.md`, `CLAUDE.md`, `AGENTS.md`. A user's repository can carry any of
+ * those with content this package cannot tell from its own, and clobbering
+ * one is worse than refusing the turn.
+ */
+export const MATERIALIZER_OWNED_PATHS = new Set([
+    ...MATERIALIZER_RESERVED_PATHS,
+    OPENCODE_CONFIG_FILE,
+]);
+/** The top-level keys this package writes into `opencode.json`. */
+export const OPENCODE_CONFIG_KEYS = new Set([
+    "$schema",
+    "instructions",
+    "mcp",
+    "tools",
+    "permission",
+]);
+/**
+ * Whether the file already at owned path `relPath` is this package's own
+ * earlier output. A reserved name proves that by itself, so `content` is read
+ * only for `opencode.json`; `undefined` content means no regular file is there.
+ *
+ * An `opencode.json` this package wrote holds the opencode schema id, only the
+ * keys this package writes, and only instruction paths this package invented.
+ * A user config that holds nothing else is indistinguishable from that output
+ * and is replaced too; a config with any other key, or with an instruction path
+ * of the user's own, is refused.
+ */
+export function isMaterializerOutput(relPath, content) {
+    if (MATERIALIZER_RESERVED_PATHS.has(relPath))
+        return true;
+    if (relPath !== OPENCODE_CONFIG_FILE)
+        return false;
+    const bytes = content();
+    if (bytes === undefined)
+        return false;
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes);
+    }
+    catch {
+        return false;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return false;
+    }
+    const config = parsed;
+    if (config.$schema !== OPENCODE_CONFIG_SCHEMA)
+        return false;
+    if (!Object.keys(config).every((key) => OPENCODE_CONFIG_KEYS.has(key))) {
+        return false;
+    }
+    const instructions = config.instructions;
+    if (instructions === undefined)
+        return true;
+    return (Array.isArray(instructions) &&
+        instructions.every((entry) => entry === OPENCODE_APPEND_SYSTEM_PROMPT_FILE ||
+            entry === CONTEXT_FILE.opencode));
+}
 /**
  * cwd-relative native skill dir per harness, or null if the harness has no
  * cwd skill primitive (skills live in a user/global dir the workspace plan

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export type { HarnessId } from "./harness.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_HARNESSES, skillDirForHarness, } from "./harness.js";
 export type { OpenCodeMcpConfig } from "./mcp.js";
 export { openCodeMcpConfig } from "./mcp.js";
-export { modelIdsMatch, qualifyModelId } from "./model-id.js";
+export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
 export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, type PiModelsConfigFile, type PiModelsConfigInput, } from "./pi-models-config.js";
 export { applyWorkspacePlan, applyWorkspacePlanWithSecretProvider, } from "./plan-application.js";
 export { agentCandidateProfilePlanMaterial, canonicalizeAgentCandidateProfilePlan, captureAgentCandidateProfilePlan, hashWorkspacePlan, } from "./plan-digest.js";

package/dist/index.js

@@ -3,7 +3,7 @@ export { applyAgentCandidateWorkspacePlan, materializeCandidateProfile, } from "
 export { OPENCODE_NATIVE_TOOL_IDS, openCodeNativeToolId, } from "./control-maps.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_HARNESSES, skillDirForHarness, } from "./harness.js";
 export { openCodeMcpConfig } from "./mcp.js";
-export { modelIdsMatch, qualifyModelId } from "./model-id.js";
+export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
 export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, } from "./pi-models-config.js";
 export { applyWorkspacePlan, applyWorkspacePlanWithSecretProvider, } from "./plan-application.js";
 export { agentCandidateProfilePlanMaterial, canonicalizeAgentCandidateProfilePlan, captureAgentCandidateProfilePlan, hashWorkspacePlan, } from "./plan-digest.js";

package/dist/mcp.js

@@ -47,8 +47,8 @@ export function materializeMcp(h, mcp, plan, add, unsupported) {
         }
         case "opencode":
             // opencode.json "mcp" block (local|remote).
-            add("opencode.json", serializeWorkspacePlanJson({
-                $schema: "https://opencode.ai/config.json",
+            add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
+                $schema: OPENCODE_CONFIG_SCHEMA,
                 mcp: openCodeMcpConfig(mcp),
             }));
             break;
@@ -238,6 +238,7 @@ export function openCodeMcpConfig(mcp) {
     }
     return out;
 }
+import { OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA } from "./harness.js";
 import { sha256 } from "./plan-digest.js";
 import { concatWorkspacePlanArguments, joinWorkspacePlanArguments, serializeWorkspacePlanJson, tomlProfileConfigValue, tomlStr, } from "./plan-json.js";
 import { setPlanEnvironment } from "./profile-plan.js";

package/dist/model-id.d.ts

@@ -26,6 +26,19 @@
  * `qualifyModelId(p, qualifyModelId(p, m)) === qualifyModelId(p, m)`.
  */
 export declare function qualifyModelId<T extends string | undefined>(provider: string | undefined, modelId: T): T;
+/**
+ * Remove one exact `provider/` qualification from `modelId`.
+ *
+ * This is the inverse operation for a model id that was qualified by this
+ * provider. It removes only the known outer prefix and preserves upstream
+ * segments such as `zai/glm-4.7`.
+ *
+ * The helper removes one outer qualification per call. It leaves missing
+ * providers and model ids unchanged.
+ */
+export declare function unqualifyModelId(provider: string | undefined, modelId: string): string;
+export declare function unqualifyModelId(provider: string | undefined, modelId: undefined): undefined;
+export declare function unqualifyModelId(provider: string | undefined, modelId: string | undefined): string | undefined;
 /**
  * Do two model ids name the same model?
  *

package/dist/model-id.js

@@ -32,6 +32,14 @@ export function qualifyModelId(provider, modelId) {
         return modelId;
     return `${provider}/${modelId}`;
 }
+export function unqualifyModelId(provider, modelId) {
+    if (!provider || !modelId)
+        return modelId;
+    const providerPrefix = `${provider}/`;
+    return modelId.startsWith(providerPrefix)
+        ? modelId.slice(providerPrefix.length)
+        : modelId;
+}
 /**
  * Do two model ids name the same model?
  *

package/dist/plan-types.d.ts

@@ -28,16 +28,20 @@ export interface PlanFile {
      * Who owns the PATH — which decides whether an existing file there may be
      * replaced.
      *
-     * `"materializer"` = a path this package invented. No harness convention
-     * names it and no user authors it, so a file already there can only be this
-     * materializer's own output from an earlier application into the same
-     * workspace, and replacing it is how turn two of a resumed session gets the
-     * current profile instead of the previous one.
+     * `"materializer"` = a path whose generated content is wholly this
+     * package's output: a name this package invented, or `opencode.json`, which
+     * carries only the registrations generated from the profile. A file already
+     * there is this materializer's own output from an earlier application into
+     * the same workspace, and replacing it is how turn two of a resumed session
+     * gets the current profile instead of the previous one. Application replaces
+     * it only when the existing bytes prove that provenance — by the name for an
+     * invented path, by the content for `opencode.json`.
      *
      * `"shared"` (the default, and every other file) = a path the user or the
-     * harness also owns — `CLAUDE.md`, `AGENTS.md`, `opencode.json`,
-     * `.gemini/system.md` are all documented, user-authorable names. An existing
-     * file there may be the caller's own work, so it is never replaced.
+     * harness also owns — `CLAUDE.md`, `AGENTS.md`, `.gemini/system.md` are all
+     * documented, user-authorable names whose content this package cannot tell
+     * from its own. An existing file there may be the caller's own work, so it is
+     * never replaced.
      *
      * Optional because hand-constructed plans have no path provenance to report;
      * absent reads as `"shared"`, the safe answer.
@@ -277,16 +281,21 @@ export declare class WorkspacePlanCleanupError extends AggregateError {
 export interface ApplyWorkspacePlanOptions {
     /** Plan files consumed in memory by the runtime and never persisted to cwd. */
     runtimeOnlyFiles?: readonly string[];
+    /** Own newly written workspace files as the process that will read them. */
+    ownership?: {
+        uid: number;
+        gid: number;
+    };
     /** Existing workspace paths are either exact idempotent inputs or forbidden. */
     existingFiles?: "allow-identical" | "reject";
     /**
      * `workspacePlanDigest` of a plan a prior call already applied into this
-     * workspace. When it equals this plan's digest, application writes no files:
-     * the workspace holds the running agent's live state, and a file the agent
-     * edited or removed since the prior application stays exactly as the agent
-     * left it. Env, flags, prompt intents, and the receipt are still produced.
-     * A different digest applies normally, so a plan that changed mid-session
-     * still meets the existing-file refusal.
+     * workspace. When it equals this plan's digest, application changes no file
+     * content. It can repair ownership on unchanged materializer-owned files.
+     * A file the agent edited or removed stays exactly as the agent left it.
+     * Env, flags, prompt intents, and the receipt are still produced. A different
+     * digest applies normally, so a changed plan still meets the existing-file
+     * refusal.
      */
     appliedPlanDigest?: string;
 }

package/dist/profile-plan.js

@@ -1,4 +1,4 @@
-import { MATERIALIZER_OWNED_PATHS } from "./harness.js";
+import { MATERIALIZER_OWNED_PATHS, MATERIALIZER_RESERVED_PATHS, } from "./harness.js";
 import { workspacePlanConfigValue } from "./plan-json.js";
 import { mergeJsonFiles } from "./plan-normalize.js";
 import { formatUnsupported } from "./plan-support.js";
@@ -47,7 +47,7 @@ export function createProfilePlanBuilder(harness) {
         if (previousDimension) {
             throw new Error(`Duplicate profile resource path: ${normalizedPath} (${previousDimension}, ${dimension})`);
         }
-        if (MATERIALIZER_OWNED_PATHS.has(normalizedPath)) {
+        if (MATERIALIZER_RESERVED_PATHS.has(normalizedPath)) {
             throw new Error(`Profile resource path is reserved by the materializer: ${normalizedPath} (${dimension}). ` +
                 "This package writes that path itself and replaces it on re-application, so a mount " +
                 "there cannot survive; choose another path.");

package/dist/profile-prompt.js

@@ -1,4 +1,4 @@
-import { appendSystemPromptRefusal, CODEX_SYSTEM_PROMPT_FILE, CONTEXT_FILE, OPENCODE_APPEND_SYSTEM_PROMPT_FILE, OPENCODE_PRIMARY_AGENT_PREFIX, systemPromptRefusal, } from "./harness.js";
+import { appendSystemPromptRefusal, CODEX_SYSTEM_PROMPT_FILE, CONTEXT_FILE, OPENCODE_APPEND_SYSTEM_PROMPT_FILE, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, OPENCODE_PRIMARY_AGENT_PREFIX, systemPromptRefusal, } from "./harness.js";
 import { sha256 } from "./plan-digest.js";
 import { serializeWorkspacePlanJson } from "./plan-json.js";
 export function lowerProfilePrompt(profile, harness, binds, builder) {
@@ -97,8 +97,8 @@ export function lowerProfilePrompt(profile, harness, binds, builder) {
         }
     }
     if (openCodeInstructionFiles.length > 0) {
-        add("opencode.json", serializeWorkspacePlanJson({
-            $schema: "https://opencode.ai/config.json",
+        add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
+            $schema: OPENCODE_CONFIG_SCHEMA,
             instructions: openCodeInstructionFiles,
         }));
     }

package/dist/workspace-apply-files.d.ts

@@ -0,0 +1,50 @@
+declare function workspaceFileExists(pathValue: string): boolean;
+declare function regularFileContent(pathValue: string): string | undefined;
+declare function workspaceFileMatches(file: NormalizedPlanFile & {
+    absPath: string;
+}): boolean;
+declare function workspaceFileHasOwnership(pathValue: string, ownership: {
+    uid: number;
+    gid: number;
+}): boolean;
+declare function validateWorkspaceOwnership(ownership: ApplyWorkspacePlanOptions["ownership"]): {
+    uid: number;
+    gid: number;
+} | undefined;
+/**
+ * The refusal names what differs — planned versus existing content digest,
+ * mode, or file kind — plus the plan digest, so the operator can tell a
+ * mid-session profile swap from an agent-edited workspace file without
+ * reproducing the workspace. Reads here are best-effort diagnosis inside an
+ * already-failing path; an unreadable existing file is reported, not thrown
+ * over.
+ */
+declare function workspaceFileConflictMessage(file: NormalizedPlanFile & {
+    absPath: string;
+}, existingFiles: "allow-identical" | "reject", planDigest: string): string;
+interface WorkspaceFileIdentity {
+    device: number;
+    inode: number;
+}
+interface PreparedWorkspaceFile {
+    file: NormalizedPlanFile & {
+        absPath: string;
+    };
+    temporaryPath: string;
+    identity: WorkspaceFileIdentity;
+    published: boolean;
+}
+declare function prepareWorkspaceFile(workspaceRoot: string, file: NormalizedPlanFile & {
+    absPath: string;
+}, ownership: {
+    uid: number;
+    gid: number;
+} | undefined): PreparedWorkspaceFile;
+declare function workspacePathHasIdentity(pathValue: string, identity: WorkspaceFileIdentity): boolean;
+declare function resolveWorkspaceFilePath(workspaceRoot: string, relativePath: string): string;
+declare function assertNoSymlinkPathComponents(workspaceRoot: string, targetPath: string): void;
+declare function isFsError(error: unknown, code: string): error is NodeJS.ErrnoException;
+export type { PreparedWorkspaceFile };
+export { assertNoSymlinkPathComponents, isFsError, prepareWorkspaceFile, regularFileContent, resolveWorkspaceFilePath, validateWorkspaceOwnership, workspaceFileConflictMessage, workspaceFileExists, workspaceFileHasOwnership, workspaceFileMatches, workspacePathHasIdentity, };
+import type { NormalizedPlanFile } from "./plan-normalize.js";
+import type { ApplyWorkspacePlanOptions } from "./plan-types.js";

package/dist/workspace-apply-files.js

@@ -0,0 +1,178 @@
+function workspaceFileExists(pathValue) {
+    try {
+        lstatSync(pathValue);
+        return true;
+    }
+    catch (error) {
+        if (isFsError(error, "ENOENT"))
+            return false;
+        throw error;
+    }
+}
+function regularFileContent(pathValue) {
+    return lstatSync(pathValue).isFile()
+        ? readFileSync(pathValue, "utf8")
+        : undefined;
+}
+function workspaceFileMatches(file) {
+    const stats = lstatSync(file.absPath);
+    return (stats.isFile() &&
+        (stats.mode & 0o777) === file.mode &&
+        readFileSync(file.absPath, "utf8") === file.content);
+}
+function workspaceFileHasOwnership(pathValue, ownership) {
+    const stats = lstatSync(pathValue);
+    return (stats.isFile() && stats.uid === ownership.uid && stats.gid === ownership.gid);
+}
+function validateWorkspaceOwnership(ownership) {
+    if (ownership === undefined)
+        return undefined;
+    if (!Number.isInteger(ownership.uid) ||
+        ownership.uid < 0 ||
+        !Number.isInteger(ownership.gid) ||
+        ownership.gid < 0) {
+        throw new Error("Workspace file ownership must use non-negative integer uid/gid values");
+    }
+    return ownership;
+}
+function sha256Hex(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+/**
+ * The refusal names what differs — planned versus existing content digest,
+ * mode, or file kind — plus the plan digest, so the operator can tell a
+ * mid-session profile swap from an agent-edited workspace file without
+ * reproducing the workspace. Reads here are best-effort diagnosis inside an
+ * already-failing path; an unreadable existing file is reported, not thrown
+ * over.
+ */
+function workspaceFileConflictMessage(file, existingFiles, planDigest) {
+    const prefix = `Refusing to replace existing workspace file: ${file.relPath}`;
+    if (existingFiles === "reject") {
+        return `${prefix} — the reject policy forbids any pre-existing plan path (plan ${planDigest})`;
+    }
+    const planned = `planned sha256:${sha256Hex(file.content)} mode ${file.mode.toString(8)}`;
+    let existing;
+    try {
+        const stats = lstatSync(file.absPath);
+        if (!stats.isFile()) {
+            existing = stats.isSymbolicLink()
+                ? "existing path is a symlink, not a regular file"
+                : "existing path is not a regular file";
+        }
+        else {
+            const mode = (stats.mode & 0o777).toString(8);
+            existing = `existing sha256:${sha256Hex(readFileSync(file.absPath))} mode ${mode}`;
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        existing = `existing file unreadable: ${message}`;
+    }
+    return `${prefix} — ${planned} != ${existing} (plan ${planDigest})`;
+}
+function prepareWorkspaceFile(workspaceRoot, file, ownership) {
+    assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
+    const temporaryPath = join(dirname(file.absPath), `.agent-profile-${randomUUID()}.tmp`);
+    let descriptor;
+    try {
+        descriptor = openSync(temporaryPath, SAFE_WRITE_FLAGS, 0o600);
+        writeFileSync(descriptor, file.content, "utf8");
+        if (ownership)
+            fchownSync(descriptor, ownership.uid, ownership.gid);
+        fchmodSync(descriptor, file.mode);
+        const stats = fstatSync(descriptor);
+        const descriptorToClose = descriptor;
+        descriptor = undefined;
+        closeSync(descriptorToClose);
+        return {
+            file,
+            temporaryPath,
+            identity: { device: stats.dev, inode: stats.ino },
+            published: false,
+        };
+    }
+    catch (error) {
+        const cleanupErrors = [];
+        if (descriptor !== undefined) {
+            try {
+                closeSync(descriptor);
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(cleanupError);
+            }
+        }
+        try {
+            unlinkSync(temporaryPath);
+        }
+        catch (cleanupError) {
+            if (!isFsError(cleanupError, "ENOENT"))
+                cleanupErrors.push(cleanupError);
+        }
+        if (cleanupErrors.length > 0) {
+            throw new AggregateError([error, ...cleanupErrors], `Failed to prepare workspace file: ${file.relPath}`);
+        }
+        throw error;
+    }
+}
+function workspacePathHasIdentity(pathValue, identity) {
+    try {
+        const stats = lstatSync(pathValue);
+        return stats.dev === identity.device && stats.ino === identity.inode;
+    }
+    catch (error) {
+        if (isFsError(error, "ENOENT"))
+            return false;
+        throw error;
+    }
+}
+function resolveWorkspaceFilePath(workspaceRoot, relativePath) {
+    const targetPath = resolve(workspaceRoot, ...relativePath.split("/"));
+    const targetRelativePath = relative(workspaceRoot, targetPath);
+    if (!targetRelativePath ||
+        targetRelativePath === ".." ||
+        targetRelativePath.startsWith(`..${sep}`) ||
+        isAbsolute(targetRelativePath)) {
+        throw new Error(`Refusing to materialize profile file outside workspace: ${relativePath}`);
+    }
+    return targetPath;
+}
+function assertNoSymlinkPathComponents(workspaceRoot, targetPath) {
+    const targetRelativePath = relative(workspaceRoot, targetPath);
+    let currentPath = workspaceRoot;
+    const components = ["", ...targetRelativePath.split(sep)];
+    for (const [index, component] of components.entries()) {
+        if (component)
+            currentPath = join(currentPath, component);
+        let stats;
+        try {
+            stats = lstatSync(currentPath);
+        }
+        catch (error) {
+            if (isFsError(error, "ENOENT"))
+                return;
+            if (isFsError(error, "ELOOP")) {
+                throw new Error(`Refusing to materialize profile file through symlink path: ${targetRelativePath}`);
+            }
+            throw error;
+        }
+        if (stats.isSymbolicLink()) {
+            throw new Error(`Refusing to materialize profile file through symlink path: ${targetRelativePath}`);
+        }
+        const isTarget = index === components.length - 1;
+        if ((!isTarget && !stats.isDirectory()) || (isTarget && !stats.isFile())) {
+            throw new Error(`Refusing to materialize profile file through non-file path: ${targetRelativePath}`);
+        }
+    }
+}
+function isFsError(error, code) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === code);
+}
+export { assertNoSymlinkPathComponents, isFsError, prepareWorkspaceFile, regularFileContent, resolveWorkspaceFilePath, validateWorkspaceOwnership, workspaceFileConflictMessage, workspaceFileExists, workspaceFileHasOwnership, workspaceFileMatches, workspacePathHasIdentity, };
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, fchmodSync, fchownSync, fstatSync, lstatSync, openSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { SAFE_WRITE_FLAGS } from "./workspace-files.js";

package/dist/workspace-apply.js

@@ -1,6 +1,10 @@
 export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDir, options, publicPlanDigest = hashWorkspacePlan(publicPlan)) {
     const workspaceRoot = resolve(workspaceDir);
     const runtimeOnlyFiles = new Set((options.runtimeOnlyFiles ?? []).map(normalizeWorkspaceRelativePath));
+    const ownership = validateWorkspaceOwnership(options.ownership);
+    const privateFilePaths = new Set(normalizePlanFiles(publicPlan.files)
+        .filter((file) => file.secretSlots.length > 0)
+        .map((file) => file.relPath));
     const existingFiles = options.existingFiles ?? "allow-identical";
     if (existingFiles !== "allow-identical" && existingFiles !== "reject") {
         throw new Error(`Unsupported existing workspace file policy: ${existingFiles}`);
@@ -15,17 +19,31 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
         ...file,
         absPath: resolveWorkspaceFilePath(workspaceRoot, file.relPath),
     }));
-    // A prior application of THIS EXACT plan makes the workspace the running
-    // agent's live state: a file the agent edited or removed since then is the
-    // session's own memory, not a conflict, so a byte comparison against the
-    // plan would refuse a resume the caller proved is unchanged. The digest the
-    // caller passes is its own record of what it already applied here; only the
-    // caller can know that, which is why this is an option and not an inference
-    // from disk. `reject` is not short-circuited: that policy asserts an empty
-    // target and must keep failing on any pre-existing path.
-    if (existingFiles === "allow-identical" &&
+    // A prior application of this exact plan makes the workspace live agent
+    // state. Preserve changed and removed files. Refresh private generated files
+    // because the public digest excludes secret values, and repair unchanged
+    // materializer files that still have the writer's ownership. `reject` does
+    // not use this path because it requires an empty target.
+    const resumeSamePlan = existingFiles === "allow-identical" &&
         options.appliedPlanDigest !== undefined &&
-        options.appliedPlanDigest === publicPlanDigest) {
+        options.appliedPlanDigest === publicPlanDigest;
+    const filesToApply = resumeSamePlan
+        ? files.filter((file) => {
+            if (file.ownership !== "materializer")
+                return false;
+            assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
+            if (!workspaceFileExists(file.absPath))
+                return false;
+            const matches = workspaceFileMatches(file);
+            const hasCurrentOwnership = ownership === undefined ||
+                workspaceFileHasOwnership(file.absPath, ownership);
+            if (privateFilePaths.has(file.relPath)) {
+                return !matches || !hasCurrentOwnership;
+            }
+            return matches && !hasCurrentOwnership;
+        })
+        : files;
+    if (resumeSamePlan && filesToApply.length === 0) {
         return {
             receipt: safeWorkspacePlanReceipt(publicPlan, files.map((file) => file.relPath), publicPlanDigest),
             spawn: {
@@ -37,14 +55,17 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
             runtimeOnlyFiles: privateRuntimeFiles,
         };
     }
-    // A path this package invented can only hold this package's own earlier
-    // output, so re-applying into the same workspace replaces it rather than
-    // failing the turn. `reject` still refuses: that policy is "nothing may
-    // pre-exist here", which is a statement about the workspace, not authorship.
-    const mayReplace = (file) => existingFiles === "allow-identical" && file.ownership === "materializer";
+    // An owned path holds this package's own earlier output, so re-applying
+    // into the same workspace replaces it rather than failing the turn — once
+    // the bytes already there prove that provenance. `reject` still refuses:
+    // that policy is "nothing may pre-exist here", which is a statement about
+    // the workspace, not authorship.
+    const mayReplace = (file) => existingFiles === "allow-identical" &&
+        file.ownership === "materializer" &&
+        isMaterializerOutput(file.relPath, () => regularFileContent(file.absPath));
     // Validate the complete plan before the first write so a late traversal or
     // existing symlink cannot leave a partially materialized workspace.
-    for (const file of files) {
+    for (const file of filesToApply) {
         assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
         if (workspaceFileExists(file.absPath) &&
             !mayReplace(file) &&
@@ -54,23 +75,26 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
     }
     // Parent directories remain on failure because they may contain concurrent
     // workspace state that this call does not own.
-    for (const file of files) {
+    for (const file of filesToApply) {
         mkdirSync(dirname(file.absPath), { recursive: true });
     }
-    for (const file of files) {
+    for (const file of filesToApply) {
         assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
     }
     const prepared = [];
     // Prepared temp links stay alive through publication and rollback. Their
     // inodes distinguish files created here from concurrent replacements.
     try {
-        for (const file of files) {
+        for (const file of filesToApply) {
             if (existingFiles === "allow-identical" &&
                 workspaceFileExists(file.absPath) &&
-                workspaceFileMatches(file)) {
+                workspaceFileMatches(file) &&
+                (file.ownership !== "materializer" ||
+                    ownership === undefined ||
+                    workspaceFileHasOwnership(file.absPath, ownership))) {
                 continue;
             }
-            prepared.push(prepareWorkspaceFile(workspaceRoot, file));
+            prepared.push(prepareWorkspaceFile(workspaceRoot, file, ownership));
         }
         for (const entry of prepared) {
             assertNoSymlinkPathComponents(workspaceRoot, entry.file.absPath);
@@ -81,7 +105,10 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
             catch (error) {
                 if (isFsError(error, "EEXIST") &&
                     existingFiles === "allow-identical" &&
-                    workspaceFileMatches(entry.file)) {
+                    workspaceFileMatches(entry.file) &&
+                    (entry.file.ownership !== "materializer" ||
+                        ownership === undefined ||
+                        workspaceFileHasOwnership(entry.file.absPath, ownership))) {
                     continue;
                 }
                 if (isFsError(error, "EEXIST") && mayReplace(entry.file)) {
@@ -159,157 +186,6 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
         runtimeOnlyFiles: privateRuntimeFiles,
     };
 }
-function workspaceFileExists(pathValue) {
-    try {
-        lstatSync(pathValue);
-        return true;
-    }
-    catch (error) {
-        if (isFsError(error, "ENOENT"))
-            return false;
-        throw error;
-    }
-}
-function workspaceFileMatches(file) {
-    const stats = lstatSync(file.absPath);
-    return (stats.isFile() &&
-        (stats.mode & 0o777) === file.mode &&
-        readFileSync(file.absPath, "utf8") === file.content);
-}
-function sha256Hex(content) {
-    return createHash("sha256").update(content).digest("hex");
-}
-/**
- * The refusal names what differs — planned versus existing content digest,
- * mode, or file kind — plus the plan digest, so the operator can tell a
- * mid-session profile swap from an agent-edited workspace file without
- * reproducing the workspace. Reads here are best-effort diagnosis inside an
- * already-failing path; an unreadable existing file is reported, not thrown
- * over.
- */
-function workspaceFileConflictMessage(file, existingFiles, planDigest) {
-    const prefix = `Refusing to replace existing workspace file: ${file.relPath}`;
-    if (existingFiles === "reject") {
-        return `${prefix} — the reject policy forbids any pre-existing plan path (plan ${planDigest})`;
-    }
-    const planned = `planned sha256:${sha256Hex(file.content)} mode ${file.mode.toString(8)}`;
-    let existing;
-    try {
-        const stats = lstatSync(file.absPath);
-        if (!stats.isFile()) {
-            existing = stats.isSymbolicLink()
-                ? "existing path is a symlink, not a regular file"
-                : "existing path is not a regular file";
-        }
-        else {
-            const mode = (stats.mode & 0o777).toString(8);
-            existing = `existing sha256:${sha256Hex(readFileSync(file.absPath))} mode ${mode}`;
-        }
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        existing = `existing file unreadable: ${message}`;
-    }
-    return `${prefix} — ${planned} != ${existing} (plan ${planDigest})`;
-}
-function prepareWorkspaceFile(workspaceRoot, file) {
-    assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-    const temporaryPath = join(dirname(file.absPath), `.agent-profile-${randomUUID()}.tmp`);
-    let descriptor;
-    try {
-        descriptor = openSync(temporaryPath, SAFE_WRITE_FLAGS, 0o600);
-        writeFileSync(descriptor, file.content, "utf8");
-        fchmodSync(descriptor, file.mode);
-        const stats = fstatSync(descriptor);
-        const descriptorToClose = descriptor;
-        descriptor = undefined;
-        closeSync(descriptorToClose);
-        return {
-            file,
-            temporaryPath,
-            identity: { device: stats.dev, inode: stats.ino },
-            published: false,
-        };
-    }
-    catch (error) {
-        const cleanupErrors = [];
-        if (descriptor !== undefined) {
-            try {
-                closeSync(descriptor);
-            }
-            catch (cleanupError) {
-                cleanupErrors.push(cleanupError);
-            }
-        }
-        try {
-            unlinkSync(temporaryPath);
-        }
-        catch (cleanupError) {
-            if (!isFsError(cleanupError, "ENOENT"))
-                cleanupErrors.push(cleanupError);
-        }
-        if (cleanupErrors.length > 0) {
-            throw new AggregateError([error, ...cleanupErrors], `Failed to prepare workspace file: ${file.relPath}`);
-        }
-        throw error;
-    }
-}
-function workspacePathHasIdentity(pathValue, identity) {
-    try {
-        const stats = lstatSync(pathValue);
-        return stats.dev === identity.device && stats.ino === identity.inode;
-    }
-    catch (error) {
-        if (isFsError(error, "ENOENT"))
-            return false;
-        throw error;
-    }
-}
-function resolveWorkspaceFilePath(workspaceRoot, relativePath) {
-    const targetPath = resolve(workspaceRoot, ...relativePath.split("/"));
-    const targetRelativePath = relative(workspaceRoot, targetPath);
-    if (!targetRelativePath ||
-        targetRelativePath === ".." ||
-        targetRelativePath.startsWith(`..${sep}`) ||
-        isAbsolute(targetRelativePath)) {
-        throw new Error(`Refusing to materialize profile file outside workspace: ${relativePath}`);
-    }
-    return targetPath;
-}
-function assertNoSymlinkPathComponents(workspaceRoot, targetPath) {
-    const targetRelativePath = relative(workspaceRoot, targetPath);
-    let currentPath = workspaceRoot;
-    const components = ["", ...targetRelativePath.split(sep)];
-    for (const [index, component] of components.entries()) {
-        if (component)
-            currentPath = join(currentPath, component);
-        let stats;
-        try {
-            stats = lstatSync(currentPath);
-        }
-        catch (error) {
-            if (isFsError(error, "ENOENT"))
-                return;
-            if (isFsError(error, "ELOOP")) {
-                throw new Error(`Refusing to materialize profile file through symlink path: ${targetRelativePath}`);
-            }
-            throw error;
-        }
-        if (stats.isSymbolicLink()) {
-            throw new Error(`Refusing to materialize profile file through symlink path: ${targetRelativePath}`);
-        }
-        const isTarget = index === components.length - 1;
-        if ((!isTarget && !stats.isDirectory()) || (isTarget && !stats.isFile())) {
-            throw new Error(`Refusing to materialize profile file through non-file path: ${targetRelativePath}`);
-        }
-    }
-}
-function isFsError(error, code) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === code);
-}
 export function safeWorkspacePlanReceipt(plan, written, workspacePlanDigest = hashWorkspacePlan(plan)) {
     return {
         workspacePlanDigest,
@@ -324,11 +200,12 @@ export function safeWorkspacePlanReceipt(plan, written, workspacePlanDigest = ha
         written: [...written],
     };
 }
-import { createHash, randomUUID } from "node:crypto";
-import { closeSync, fchmodSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { linkSync, mkdirSync, renameSync, unlinkSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { isMaterializerOutput } from "./harness.js";
 import { hashWorkspacePlan } from "./plan-digest.js";
-import { normalizeWorkspacePlanArgument, } from "./plan-normalize.js";
+import { normalizePlanFiles, normalizeWorkspacePlanArgument, } from "./plan-normalize.js";
 import { promptIntentFields, samePromptIntentValue, systemPromptBindingField, } from "./plan-prompt.js";
 import { WorkspacePlanCleanupError } from "./plan-types.js";
-import { normalizeWorkspaceRelativePath, SAFE_WRITE_FLAGS, } from "./workspace-files.js";
+import { assertNoSymlinkPathComponents, isFsError, prepareWorkspaceFile, regularFileContent, resolveWorkspaceFilePath, validateWorkspaceOwnership, workspaceFileConflictMessage, workspaceFileExists, workspaceFileHasOwnership, workspaceFileMatches, workspacePathHasIdentity, } from "./workspace-apply-files.js";
+import { normalizeWorkspaceRelativePath } from "./workspace-files.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.17.0",
+  "version": "0.17.3",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "main": "./dist/index.js",