@tangle-network/agent-profile-materialize 0.20.8 → 0.21.0

package/dist/control-maps.d.ts

@@ -14,7 +14,15 @@ export declare const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution
  * extension and MCP tools profile-configurable without a static catalog.
  */
 export declare function piToolId(name: string): string | undefined;
-export declare function mapSupportedBooleanEntries(entries: [string, boolean][], mapName: (name: string) => string | undefined, onUnsupported: (name: string) => void, label: string): [string, boolean][];
+/**
+ * Map tool switches to native ids; spellings of one tool keep its explicit off.
+ *
+ * Products compose profiles in layers: a shared allowlist, then a product
+ * constraint that disables a native tool under its own spelling. Physim adds
+ * `webfetch: false` over an allowlist holding `web_fetch: true`. Off is the
+ * only value that honours every layer, so it wins regardless of entry order.
+ */
+export declare function mapSupportedBooleanEntries(entries: [string, boolean][], mapName: (name: string) => string | undefined, onUnsupported: (name: string) => void): [string, boolean][];
 export declare function permissionAllowsEverything(policy: AgentProfilePermission): boolean;
 export declare function mapSupportedPermissionEntries(entries: [string, AgentProfilePermission][], mapName: (name: string) => string | undefined, onUnsupported: (name: string) => void, label: string): [string, AgentProfilePermission][];
 export declare function claudePermissionRules(entries: [string, AgentProfilePermission][]): {
@@ -22,6 +30,11 @@ export declare function claudePermissionRules(entries: [string, AgentProfilePerm
     ask: string[];
     deny: string[];
 };
+/**
+ * Give each Claude rule one decision. A tool switch and a permission can name
+ * the same rule; the stricter decision wins, as deny already beats allow
+ * inside Claude Code.
+ */
 export declare function sealClaudePermissionRules(rules: {
     allow: string[];
     ask: string[];

package/dist/control-maps.js

@@ -101,12 +101,16 @@ export function piToolId(name) {
         return "find";
     return trimmed;
 }
-export function mapSupportedBooleanEntries(entries, mapName, onUnsupported, label) {
-    return mapControlEntries(entries, mapName, onUnsupported, (left, right, nativeName) => {
-        if (left !== right)
-            throw new Error(`${label} aliases disagree for "${nativeName}"`);
-        return left;
-    });
+/**
+ * Map tool switches to native ids; spellings of one tool keep its explicit off.
+ *
+ * Products compose profiles in layers: a shared allowlist, then a product
+ * constraint that disables a native tool under its own spelling. Physim adds
+ * `webfetch: false` over an allowlist holding `web_fetch: true`. Off is the
+ * only value that honours every layer, so it wins regardless of entry order.
+ */
+export function mapSupportedBooleanEntries(entries, mapName, onUnsupported) {
+    return mapControlEntries(entries, mapName, onUnsupported, (left, right) => left && right);
 }
 export function permissionAllowsEverything(policy) {
     return typeof policy === "string"
@@ -129,21 +133,43 @@ function mapControlEntries(entries, mapName, onUnsupported, merge) {
     }
     return [...mapped.entries()].sort(([left], [right]) => compareStrings(left, right));
 }
+const PERMISSION_RESTRICTION = {
+    allow: 0,
+    ask: 1,
+    deny: 2,
+};
+function stricterDecision(left, right) {
+    return PERMISSION_RESTRICTION[right] > PERMISSION_RESTRICTION[left]
+        ? right
+        : left;
+}
+/**
+ * Merge policies whose names resolve to one native tool; the stricter
+ * decision wins, as an explicit off does for tool switches.
+ *
+ * Pattern rules merge only when both spellings list the same patterns in the
+ * same order. OpenCode applies the last matching pattern, so any other pair
+ * has no merge at least as strict as each spelling: `{"*": "deny"}` beside
+ * `{"https://x/*": "allow"}` would allow x. Those pairs stay contradictions
+ * that `executionControlConflict` reports at admission.
+ */
 function mergePermissionPolicies(left, right, label) {
+    if (typeof left === "string" && typeof right === "string") {
+        return stricterDecision(left, right);
+    }
     if (typeof left === "string" || typeof right === "string") {
-        if (left !== right)
-            throw new Error(`${label} aliases disagree`);
-        return left;
+        throw new Error(`${label} aliases mix a whole-tool decision with pattern rules`);
     }
-    const merged = { ...left };
-    for (const [specifier, decision] of Object.entries(right)) {
-        const previous = merged[specifier];
-        if (previous !== undefined && previous !== decision) {
-            throw new Error(`${label} aliases disagree for "${specifier}"`);
-        }
-        merged[specifier] = decision;
+    const patterns = Object.keys(left);
+    const rightPatterns = Object.keys(right);
+    if (patterns.length !== rightPatterns.length ||
+        rightPatterns.some((pattern, index) => pattern !== patterns[index])) {
+        throw new Error(`${label} aliases set different pattern rules`);
     }
-    return Object.fromEntries(Object.entries(merged).sort(([leftKey], [rightKey]) => compareStrings(leftKey, rightKey)));
+    return Object.fromEntries(Object.entries(left).map(([pattern, decision]) => [
+        pattern,
+        stricterDecision(decision, right[pattern] ?? decision),
+    ]));
 }
 export function claudePermissionRules(entries) {
     const rules = {
@@ -165,22 +191,32 @@ export function claudePermissionRules(entries) {
     rules.deny.sort(compareStrings);
     return rules;
 }
+/**
+ * Give each Claude rule one decision. A tool switch and a permission can name
+ * the same rule; the stricter decision wins, as deny already beats allow
+ * inside Claude Code.
+ */
 export function sealClaudePermissionRules(rules) {
     const owner = new Map();
     for (const decision of ["allow", "ask", "deny"]) {
         for (const rule of rules[decision]) {
             const previous = owner.get(rule);
-            if (previous && previous !== decision) {
-                throw new Error(`claude-code execution control "${rule}" conflicts between ${previous} and ${decision}`);
-            }
-            owner.set(rule, decision);
+            owner.set(rule, previous === undefined
+                ? decision
+                : stricterDecision(previous, decision));
         }
     }
-    return {
-        allow: [...new Set(rules.allow)].sort(compareStrings),
-        ask: [...new Set(rules.ask)].sort(compareStrings),
-        deny: [...new Set(rules.deny)].sort(compareStrings),
+    const sealed = {
+        allow: [],
+        ask: [],
+        deny: [],
     };
+    for (const [rule, decision] of owner)
+        sealed[decision].push(rule);
+    sealed.allow.sort(compareStrings);
+    sealed.ask.sort(compareStrings);
+    sealed.deny.sort(compareStrings);
+    return sealed;
 }
 import { resolveNativeWebTools } from "@tangle-network/agent-interface";
 import { compareStrings } from "./workspace-files.js";

package/dist/execution-controls.js

@@ -4,7 +4,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
     switch (h) {
         case "claude-code": {
             if (toolEntries.length > 0 || permissionEntries.length > 0) {
-                const nativeTools = mapSupportedBooleanEntries(toolEntries, claudeToolName, (name) => unsupported("tools", `claude-code: no verified native tool mapping for "${name}"`), "claude-code tool");
+                const nativeTools = mapSupportedBooleanEntries(toolEntries, claudeToolName, (name) => unsupported("tools", `claude-code: no verified native tool mapping for "${name}"`));
                 const nativePermissions = mapSupportedPermissionEntries(permissionEntries, claudeToolName, (name) => unsupported("permissions", `claude-code: no verified native permission mapping for "${name}"`), "claude-code permission");
                 const rules = claudePermissionRules(nativePermissions);
                 for (const [tool, enabled] of nativeTools) {
@@ -32,7 +32,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                 }
                 return false;
             });
-            const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`), "opencode tool");
+            const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`));
             const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
             if (enforceableTools.length > 0 || permissionEntries.length > 0) {
                 add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
@@ -49,6 +49,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
         }
         case "codex": {
             const searchEntries = [];
+            const fetchEntries = [];
             for (const [name, enabled] of toolEntries) {
                 const posture = resolveNativeWebTools({ [name]: enabled });
                 if (posture.search === enabled && posture.fetch === undefined) {
@@ -56,14 +57,20 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                     continue;
                 }
                 if (posture.fetch === enabled && posture.search === undefined) {
-                    if (enabled) {
-                        unsupported("tools", `codex: native web fetch is unavailable for "${name}"`);
-                    }
+                    fetchEntries.push([name, enabled]);
                     continue;
                 }
                 unsupported("tools", `codex: no verified primary-process tool mapping for "${name}"`);
             }
-            const nativeSearch = mapSupportedBooleanEntries(searchEntries, () => "web_search", () => undefined, "codex tool");
+            // Codex has no native fetch: only a fetch that stays on after its
+            // spellings merge asks for something this harness cannot run.
+            const nativeFetch = mapSupportedBooleanEntries(fetchEntries, () => "web_fetch", () => undefined);
+            if (nativeFetch[0]?.[1]) {
+                for (const [name] of fetchEntries) {
+                    unsupported("tools", `codex: native web fetch is unavailable for "${name}"`);
+                }
+            }
+            const nativeSearch = mapSupportedBooleanEntries(searchEntries, () => "web_search", () => undefined);
             if (nativeSearch[0]) {
                 plan.flags.push("-c", `tools.web_search=${nativeSearch[0][1]}`);
             }
@@ -73,7 +80,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
             break;
         }
         case "pi": {
-            const nativeTools = mapSupportedBooleanEntries(toolEntries, piToolId, (name) => unsupported("tools", `pi: tool name "${name}" is empty after trimming`), "pi tool");
+            const nativeTools = mapSupportedBooleanEntries(toolEntries, piToolId, (name) => unsupported("tools", `pi: tool name "${name}" is empty after trimming`));
             const nativePermissions = mapSupportedPermissionEntries(permissionEntries, piToolId, (name) => unsupported("permissions", `pi: permission name "${name}" is empty after trimming`), "pi permission");
             const enabled = new Set(nativeTools
                 .filter(([, value]) => value)
@@ -92,15 +99,12 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                     unsupported("permissions", `pi: permission policy "ask" for "${name}" requires an interactive decision surface`);
                     continue;
                 }
-                if (policy === "allow") {
-                    if (excluded.has(name)) {
-                        throw new Error(`pi execution control "${name}" conflicts between disabled and allow`);
-                    }
+                // The stricter control holds, as across spellings of one tool: an
+                // allow keeps a disabled tool disabled, and a deny excludes an
+                // enabled one.
+                if (policy === "allow")
                     continue;
-                }
-                if (enabled.has(name)) {
-                    throw new Error(`pi execution control "${name}" conflicts between enabled and deny`);
-                }
+                enabled.delete(name);
                 excluded.add(name);
             }
             if (enabled.size > 0 || excluded.size > 0) {

package/dist/harness.d.ts

@@ -79,7 +79,7 @@ export declare const MATERIALIZER_CONTEXT_PATHS: ReadonlySet<string>;
  * `opencode.json` and every context file is a documented name a user repository
  * can carry, so the name alone proves nothing and a profile resource may still
  * mount one. An existing file there is replaced only when
- * {@link isMaterializerOutput} recognizes its bytes as this package's own
+ * {@link materializerReplacement} recognizes its bytes as this package's own
  * earlier output.
  *
  * Deliberately absent: `.gemini/system.md`, the file `prompt.systemPrompt`
@@ -110,11 +110,14 @@ export declare function markMaterializerSubagent(relPath: string, content: strin
  * (`.gemini/system.md`; `.codex/system-prompt.md` is a reserved name this
  * package invented and needs no marker to be owned).
  *
- * It carries the digest of everything BELOW it, which the subagent marker does
- * not need. `CLAUDE.md` is claude-code's own memory file and the agent appends
- * to it mid-session, so a bare marker would still sit on line 1 of a file the
- * agent has since rewritten. Ownership has to mean "these are still our bytes",
- * not "this package wrote here once".
+ * It carries the digest of the generated body below it, which the subagent
+ * marker does not need. `CLAUDE.md` is claude-code's own memory file and the
+ * agent appends to it mid-session, so a bare marker would still sit on line 1
+ * of a file the agent has since rewritten. The digest tells which leading bytes
+ * are still this package's own: the next materialization replaces exactly
+ * those and keeps what the agent appended below them
+ * ({@link generatedContextAppendix}). The marker's wording is part of every
+ * marker already written into live workspaces, so it stays as it is.
  *
  * A reserved context path — opencode's invented instruction file — is returned
  * unchanged: its NAME already proves the provenance, and nothing else may mount
@@ -134,21 +137,15 @@ export declare function markMaterializerContextFile(relPath: string, content: st
  */
 export declare function isMaterializerOwnedPath(relPath: string): boolean;
 /**
- * Whether the file already at owned path `relPath` is this package's own
- * earlier output. A reserved name proves that by itself. Native agent files
- * require the generated marker; context files require the marker AND the body
- * digest it commits to, so an agent that appended to its memory file is no
- * longer holding this package's bytes. An exact unmarked copy of the planned
- * file is adopted once for upgrades from materializer versions without that
- * marker. `undefined` content means no regular file is there.
- *
- * An `opencode.json` this package wrote holds the opencode schema id, only the
- * keys this package writes, and only instruction paths this package invented.
- * A user config that holds nothing else is indistinguishable from that output
- * and is replaced too; a config with any other key, or with an instruction path
- * of the user's own, is refused.
+ * The bytes to publish at owned path `relPath` over the file already there, or
+ * `undefined` when that file is not this package's earlier output and must be
+ * refused (`undefined` content: no regular file there). For a context file the
+ * replacement is the planned file followed by whatever the agent appended
+ * below the generated body (claude-code appends its memory to `CLAUDE.md`). A
+ * body written before the marker existed is adopted once, only when it is
+ * byte-identical to the body this plan writes.
  */
-export declare function isMaterializerOutput(relPath: string, content: () => string | undefined, plannedContent?: string): boolean;
+export declare function materializerReplacement(relPath: string, content: () => string | undefined, plannedContent: string): string | undefined;
 /**
  * cwd-relative native skill dir per harness, or null if the harness has no
  * cwd skill primitive (skills live in a user/global dir the workspace plan

package/dist/harness.js

@@ -153,7 +153,7 @@ export const MATERIALIZER_CONTEXT_PATHS = new Set([...CONTEXT_FILE_PATHS].filter
  * `opencode.json` and every context file is a documented name a user repository
  * can carry, so the name alone proves nothing and a profile resource may still
  * mount one. An existing file there is replaced only when
- * {@link isMaterializerOutput} recognizes its bytes as this package's own
+ * {@link materializerReplacement} recognizes its bytes as this package's own
  * earlier output.
  *
  * Deliberately absent: `.gemini/system.md`, the file `prompt.systemPrompt`
@@ -214,11 +214,14 @@ function materializerContextMarker(body) {
  * (`.gemini/system.md`; `.codex/system-prompt.md` is a reserved name this
  * package invented and needs no marker to be owned).
  *
- * It carries the digest of everything BELOW it, which the subagent marker does
- * not need. `CLAUDE.md` is claude-code's own memory file and the agent appends
- * to it mid-session, so a bare marker would still sit on line 1 of a file the
- * agent has since rewritten. Ownership has to mean "these are still our bytes",
- * not "this package wrote here once".
+ * It carries the digest of the generated body below it, which the subagent
+ * marker does not need. `CLAUDE.md` is claude-code's own memory file and the
+ * agent appends to it mid-session, so a bare marker would still sit on line 1
+ * of a file the agent has since rewritten. The digest tells which leading bytes
+ * are still this package's own: the next materialization replaces exactly
+ * those and keeps what the agent appended below them
+ * ({@link generatedContextAppendix}). The marker's wording is part of every
+ * marker already written into live workspaces, so it stays as it is.
  *
  * A reserved context path — opencode's invented instruction file — is returned
  * unchanged: its NAME already proves the provenance, and nothing else may mount
@@ -232,16 +235,55 @@ export function markMaterializerContextFile(relPath, content) {
         return content;
     return `${materializerContextMarker(content)}\n${content}`;
 }
+const MATERIALIZER_CONTEXT_MARKER_HEAD = `<!-- ${MATERIALIZER_MARKER} sha256:`;
+const MATERIALIZER_CONTEXT_MARKER_TAIL = `; ${MATERIALIZER_CONTEXT_MARKER_NOTE} -->`;
+const SHA256_HEX = /^[0-9a-f]{64}$/u;
 /**
- * Whether `existing` is a context file this package wrote and nothing edited
- * afterwards: line 1 is exactly the marker computed over every byte below it.
+ * Text an agent appended below this package's generated context body: `""`
+ * for exact output, `undefined` when no marker is on line 1 or no leading part
+ * of the body matches its digest (an edit inside the generated part). Each
+ * line boundary is a candidate end; one incremental hash walks the body once.
  */
-function isMarkedContextOutput(existing) {
+function generatedContextAppendix(existing) {
     const lineEnd = existing.indexOf("\n");
     if (lineEnd === -1)
-        return false;
-    return (existing.slice(0, lineEnd) ===
-        materializerContextMarker(existing.slice(lineEnd + 1)));
+        return undefined;
+    const marker = existing.slice(0, lineEnd);
+    if (!marker.startsWith(MATERIALIZER_CONTEXT_MARKER_HEAD) ||
+        !marker.endsWith(MATERIALIZER_CONTEXT_MARKER_TAIL)) {
+        return undefined;
+    }
+    const digest = marker.slice(MATERIALIZER_CONTEXT_MARKER_HEAD.length, marker.length - MATERIALIZER_CONTEXT_MARKER_TAIL.length);
+    if (!SHA256_HEX.test(digest))
+        return undefined;
+    const body = existing.slice(lineEnd + 1);
+    // No cut at 0: a generated body is never empty, so it never adopts a whole file.
+    const boundaries = [];
+    for (let newline = body.indexOf("\n"); newline !== -1; newline = body.indexOf("\n", newline + 1)) {
+        boundaries.push(newline, newline + 1);
+    }
+    if (boundaries.length === 0 ||
+        boundaries[boundaries.length - 1] !== body.length) {
+        boundaries.push(body.length);
+    }
+    const hash = createHash("sha256");
+    let hashed = 0;
+    for (const end of boundaries) {
+        hash.update(body.slice(hashed, end), "utf8");
+        hashed = end;
+        if (hash.copy().digest("hex") === digest)
+            return body.slice(end);
+    }
+    return undefined;
+}
+/** The planned context file, then the agent's appended text on its own line. */
+function withContextAppendix(plannedContent, appendix) {
+    if (appendix === "" ||
+        plannedContent.endsWith("\n") ||
+        appendix.startsWith("\n")) {
+        return `${plannedContent}${appendix}`;
+    }
+    return `${plannedContent}\n${appendix}`;
 }
 /**
  * Whether a generated file occupies a path that the profile materializer owns.
@@ -267,13 +309,43 @@ const OPENCODE_CONFIG_KEYS = new Set([
     "permission",
 ]);
 /**
- * Whether the file already at owned path `relPath` is this package's own
- * earlier output. A reserved name proves that by itself. Native agent files
- * require the generated marker; context files require the marker AND the body
- * digest it commits to, so an agent that appended to its memory file is no
- * longer holding this package's bytes. An exact unmarked copy of the planned
- * file is adopted once for upgrades from materializer versions without that
- * marker. `undefined` content means no regular file is there.
+ * The bytes to publish at owned path `relPath` over the file already there, or
+ * `undefined` when that file is not this package's earlier output and must be
+ * refused (`undefined` content: no regular file there). For a context file the
+ * replacement is the planned file followed by whatever the agent appended
+ * below the generated body (claude-code appends its memory to `CLAUDE.md`). A
+ * body written before the marker existed is adopted once, only when it is
+ * byte-identical to the body this plan writes.
+ */
+export function materializerReplacement(relPath, content, plannedContent) {
+    if (!MATERIALIZER_CONTEXT_PATHS.has(relPath)) {
+        return isMaterializerOutput(relPath, content, plannedContent)
+            ? plannedContent
+            : undefined;
+    }
+    const existing = content();
+    if (existing === undefined)
+        return undefined;
+    const appendix = generatedContextAppendix(existing);
+    if (appendix === "")
+        return plannedContent;
+    // Appended text rides only on a marked plan, which the next version recognizes.
+    if (generatedContextAppendix(plannedContent) !== "")
+        return undefined;
+    if (appendix !== undefined) {
+        return withContextAppendix(plannedContent, appendix);
+    }
+    return existing === plannedContent.slice(plannedContent.indexOf("\n") + 1)
+        ? plannedContent
+        : undefined;
+}
+/**
+ * Whether the file already at owned path `relPath`, other than a context file,
+ * is this package's own earlier output. A reserved name proves that by itself.
+ * Native agent files require the generated marker. An exact unmarked copy of
+ * the planned native agent file is adopted once for upgrades from materializer
+ * versions without that marker. `undefined` content means no regular file is
+ * there.
  *
  * An `opencode.json` this package wrote holds the opencode schema id, only the
  * keys this package writes, and only instruction paths this package invented.
@@ -281,7 +353,7 @@ const OPENCODE_CONFIG_KEYS = new Set([
  * and is replaced too; a config with any other key, or with an instruction path
  * of the user's own, is refused.
  */
-export function isMaterializerOutput(relPath, content, plannedContent) {
+function isMaterializerOutput(relPath, content, plannedContent) {
     if (MATERIALIZER_RESERVED_PATHS.has(relPath))
         return true;
     if (MATERIALIZER_SUBAGENT_PATH.test(relPath)) {
@@ -291,8 +363,6 @@ export function isMaterializerOutput(relPath, content, plannedContent) {
         const markerPrefix = materializerSubagentMarkerPrefix(relPath);
         if (existing.startsWith(markerPrefix))
             return true;
-        if (plannedContent === undefined)
-            return false;
         if (!plannedContent.startsWith(markerPrefix))
             return false;
         const legacyContent = relPath.endsWith(".toml")
@@ -300,23 +370,6 @@ export function isMaterializerOutput(relPath, content, plannedContent) {
             : `---\n${plannedContent.slice(markerPrefix.length)}`;
         return existing === legacyContent;
     }
-    if (MATERIALIZER_CONTEXT_PATHS.has(relPath)) {
-        const existing = content();
-        if (existing === undefined)
-            return false;
-        if (isMarkedContextOutput(existing))
-            return true;
-        // A workspace materialized before this marker existed carries the body
-        // alone. Adopt it once, and only when it is byte-identical to the body this
-        // plan writes, so upgrading the package does not turn every resumed session
-        // into a refusal. A body that differs is either a user's file or an earlier
-        // profile's, and neither can be told apart without the marker.
-        if (plannedContent === undefined)
-            return false;
-        if (!isMarkedContextOutput(plannedContent))
-            return false;
-        return existing === plannedContent.slice(plannedContent.indexOf("\n") + 1);
-    }
     if (relPath !== OPENCODE_CONFIG_FILE)
         return false;
     const bytes = content();

package/dist/index.d.ts

@@ -21,6 +21,6 @@ export type { PrimeProfileErrorKind, PrimeThinkingLevel, } from "./prime-fork.js
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
 export type { PrimeProfileControls, PrimeProfileSkill, PrimeProfileSubagent, } from "./prime-profile.js";
 export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
-export { materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
+export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
 export type { ResolveAgentProfileResourcesOptions } from "./resource-resolution.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";

package/dist/index.js

@@ -14,5 +14,5 @@ export { BINDABLE_LAUNCH_CONTROLS, EXECUTOR_SYSTEM_PROMPT_BINDINGS, isExecutorSy
 export { materializePrimeProfileControls, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
 export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
-export { materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
+export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";

package/dist/profile-materializer.d.ts

@@ -2,6 +2,16 @@ import type { AgentProfile, AgentProfileSecretProvider, AgentRuntimeAttachments
 import { type HarnessId } from "./harness.js";
 import { type BindableLaunchControl, type PlanFileRoot, type SkippableDimension, type WorkspacePlan } from "./plan-types.js";
 export declare const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER: AgentProfileSecretProvider;
+/**
+ * Why a profile's tool and permission controls cannot reach one native policy
+ * on this harness, or undefined when they can.
+ *
+ * Admission boundaries (profile save, Sandbox create) call this so a
+ * contradictory control set is refused when it is submitted, not when a
+ * user's turn materializes it. Controls a harness cannot enforce are not
+ * contradictions: `resources.failOnError` decides those per turn.
+ */
+export declare function executionControlConflict(profile: Pick<AgentProfile, "tools" | "permissions">, harness: HarnessId): string | undefined;
 /**
  * Build a pure workspace plan for one canonical harness.
  * The caller applies files, environment, and flags at its process boundary.

package/dist/profile-materializer.js

@@ -14,6 +14,25 @@ export const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER = Object.freeze({
         return undefined;
     },
 });
+/**
+ * Why a profile's tool and permission controls cannot reach one native policy
+ * on this harness, or undefined when they can.
+ *
+ * Admission boundaries (profile save, Sandbox create) call this so a
+ * contradictory control set is refused when it is submitted, not when a
+ * user's turn materializes it. Controls a harness cannot enforce are not
+ * contradictions: `resources.failOnError` decides those per turn.
+ */
+export function executionControlConflict(profile, harness) {
+    const builder = createProfilePlanBuilder(harness);
+    try {
+        materializeExecutionControls(harness, profile.tools, profile.permissions, undefined, builder.plan, builder.add, builder.unsupported);
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+    return undefined;
+}
 /**
  * Build a pure workspace plan for one canonical harness.
  * The caller applies files, environment, and flags at its process boundary.

package/dist/workspace-apply-files.d.ts

@@ -1,4 +1,9 @@
 declare function workspaceFileExists(pathValue: string): boolean;
+/**
+ * A regular file's text, or `undefined` when no regular file is there or its
+ * bytes are not UTF-8. This package writes only UTF-8, so such bytes are not
+ * its output, and decoding them lossily would rewrite them on replacement.
+ */
 declare function regularFileContent(pathValue: string): string | undefined;
 declare function workspaceFileMatches(file: NormalizedPlanFile & {
     absPath: string;
@@ -33,6 +38,8 @@ interface PreparedWorkspaceFile {
     temporaryPath: string;
     identity: WorkspaceFileIdentity;
     published: boolean;
+    /** A link to the replaced file while it holds an agent's text, for rollback. */
+    superseded?: string;
 }
 declare function prepareWorkspaceFile(workspaceRoot: string, file: NormalizedPlanFile & {
     absPath: string;

package/dist/workspace-apply-files.js

@@ -9,10 +9,24 @@ function workspaceFileExists(pathValue) {
         throw error;
     }
 }
+const STRICT_UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+/**
+ * A regular file's text, or `undefined` when no regular file is there or its
+ * bytes are not UTF-8. This package writes only UTF-8, so such bytes are not
+ * its output, and decoding them lossily would rewrite them on replacement.
+ */
 function regularFileContent(pathValue) {
-    return lstatSync(pathValue).isFile()
-        ? readFileSync(pathValue, "utf8")
-        : undefined;
+    if (!lstatSync(pathValue).isFile())
+        return undefined;
+    const bytes = readFileSync(pathValue);
+    try {
+        return STRICT_UTF8.decode(bytes);
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            return undefined;
+        throw error;
+    }
 }
 function workspaceFileMatches(file) {
     const stats = lstatSync(file.absPath);

package/dist/workspace-apply.js

@@ -70,35 +70,53 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
     }
     // An owned path holds this package's own earlier output, so re-applying
     // into the same workspace replaces it rather than failing the turn — once
-    // the bytes already there prove that provenance. `reject` still refuses:
-    // that policy is "nothing may pre-exist here", which is a statement about
-    // the workspace, not authorship.
-    const mayReplace = (file) => existingFiles === "allow-identical" &&
-        file.ownership === "materializer" &&
-        isMaterializerOutput(file.relPath, () => regularFileContent(file.absPath), file.content);
+    // the bytes already there prove that provenance. The replacement keeps what
+    // an agent appended below a generated context file (its memory), so it can
+    // differ from the planned bytes. `reject` still refuses: that policy is
+    // "nothing may pre-exist here", which is a statement about the workspace,
+    // not authorship.
+    const plannedContent = new Map(filesToApply.map((file) => [fileIdentity(file), file.content]));
+    const replacement = (file) => {
+        const planned = plannedContent.get(fileIdentity(file));
+        if (existingFiles !== "allow-identical" ||
+            file.ownership !== "materializer" ||
+            planned === undefined) {
+            return undefined;
+        }
+        return materializerReplacement(file.relPath, () => regularFileContent(file.absPath), planned);
+    };
     // Validate the complete plan before the first write so a late traversal or
     // existing symlink cannot leave a partially materialized workspace.
+    const writes = [];
     for (const file of filesToApply) {
         assertNoSymlinkPathComponents(file.rootDir, file.absPath);
-        if (workspaceFileExists(file.absPath) &&
-            !mayReplace(file) &&
-            (existingFiles === "reject" || !workspaceFileMatches(file))) {
+        if (!workspaceFileExists(file.absPath)) {
+            writes.push(file);
+            continue;
+        }
+        const content = replacement(file);
+        if (content !== undefined) {
+            writes.push({ ...file, content });
+            continue;
+        }
+        if (existingFiles === "reject" || !workspaceFileMatches(file)) {
             throw new Error(workspaceFileConflictMessage(file, existingFiles, publicPlanDigest));
         }
+        writes.push(file);
     }
     // Parent directories remain on failure because they may contain concurrent
     // workspace state that this call does not own.
-    for (const file of filesToApply) {
+    for (const file of writes) {
         mkdirSync(dirname(file.absPath), { recursive: true });
     }
-    for (const file of filesToApply) {
+    for (const file of writes) {
         assertNoSymlinkPathComponents(file.rootDir, file.absPath);
     }
     const prepared = [];
     // Prepared temp links stay alive through publication and rollback. Their
     // inodes distinguish files created here from concurrent replacements.
     try {
-        for (const file of filesToApply) {
+        for (const file of writes) {
             if (existingFiles === "allow-identical" &&
                 workspaceFileExists(file.absPath) &&
                 workspaceFileMatches(file) &&
@@ -124,7 +142,12 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
                         workspaceFileHasOwnership(entry.file.absPath, ownership))) {
                     continue;
                 }
-                if (isFsError(error, "EEXIST") && mayReplace(entry.file)) {
+                if (isFsError(error, "EEXIST") &&
+                    replacement(entry.file) === entry.file.content) {
+                    // The replacement is recomposed from the bytes there now, so an
+                    // agent append that landed since validation refuses below instead
+                    // of being overwritten; one landing between that read and the
+                    // rename is not detected.
                     // rename() replaces in one step, so no window exists in which the
                     // path is missing and a concurrent spawn reads nothing. The staged
                     // inode moves onto the path, which is what rollback identifies the
@@ -132,8 +155,16 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
                     // published — leaving the path ABSENT rather than restored to the
                     // superseded bytes. That is the fail-closed direction: the harness
                     // whose flag names a missing file refuses to start, whereas silently
-                    // restored previous-turn bytes would run the wrong prompt.
+                    // restored previous-turn bytes would run the wrong prompt. A replaced
+                    // file that holds an agent's appended text is the exception: it is
+                    // linked aside first and restored, because removing it would delete
+                    // the agent's own text.
                     assertNoSymlinkPathComponents(rootFor(entry.file.root), entry.file.absPath);
+                    if (entry.file.content !== plannedContent.get(fileIdentity(entry.file))) {
+                        const superseded = join(dirname(entry.file.absPath), `.agent-profile-${randomUUID()}.superseded`);
+                        linkSync(entry.file.absPath, superseded);
+                        entry.superseded = superseded;
+                    }
                     renameSync(entry.temporaryPath, entry.file.absPath);
                     entry.published = true;
                     continue;
@@ -151,12 +182,25 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
             try {
                 if (entry.published &&
                     workspacePathHasIdentity(entry.file.absPath, entry.identity)) {
-                    unlinkSync(entry.file.absPath);
+                    if (entry.superseded) {
+                        renameSync(entry.superseded, entry.file.absPath);
+                    }
+                    else {
+                        unlinkSync(entry.file.absPath);
+                    }
                 }
             }
             catch (cleanupError) {
                 cleanupErrors.push(cleanupError);
             }
+            try {
+                if (entry.superseded)
+                    unlinkSync(entry.superseded);
+            }
+            catch (cleanupError) {
+                if (!isFsError(cleanupError, "ENOENT"))
+                    cleanupErrors.push(cleanupError);
+            }
             try {
                 if (workspacePathHasIdentity(entry.temporaryPath, entry.identity)) {
                     unlinkSync(entry.temporaryPath);
@@ -175,13 +219,17 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
     const cleanupErrors = [];
     const temporaryPaths = [];
     for (const entry of prepared) {
-        try {
-            unlinkSync(entry.temporaryPath);
-        }
-        catch (error) {
-            if (!isFsError(error, "ENOENT")) {
-                cleanupErrors.push(error);
-                temporaryPaths.push(entry.temporaryPath);
+        for (const path of [entry.temporaryPath, entry.superseded]) {
+            if (path === undefined)
+                continue;
+            try {
+                unlinkSync(path);
+            }
+            catch (error) {
+                if (!isFsError(error, "ENOENT")) {
+                    cleanupErrors.push(error);
+                    temporaryPaths.push(path);
+                }
             }
         }
     }
@@ -216,9 +264,10 @@ function safeWorkspacePlanReceipt(plan, writtenFiles, workspacePlanDigest = hash
         writtenFiles: writtenFiles.map((file) => ({ ...file })),
     };
 }
+import { randomUUID } from "node:crypto";
 import { linkSync, mkdirSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, isAbsolute, resolve } from "node:path";
-import { isMaterializerOutput } from "./harness.js";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { materializerReplacement } from "./harness.js";
 import { hashWorkspacePlan } from "./plan-digest.js";
 import { normalizePlanFiles, normalizeWorkspacePlanArgument, } from "./plan-normalize.js";
 import { promptIntentFields, samePromptIntentValue, systemPromptBindingField, } from "./plan-prompt.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.20.8",
+  "version": "0.21.0",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {
@@ -25,14 +25,14 @@
     "dist"
   ],
   "devDependencies": {
-    "@tangle-network/agent-interface": "2.13.0",
-    "@tangle-network/agent-interface-current": "npm:@tangle-network/agent-interface@2.13.0",
+    "@tangle-network/agent-interface": "3.0.0",
+    "@tangle-network/agent-interface-current": "npm:@tangle-network/agent-interface@3.0.0",
     "@types/node": "25.6.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
-    "@tangle-network/agent-interface": "^2.13.0"
+    "@tangle-network/agent-interface": "^3.0.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",