@tangle-network/agent-profile-materialize 0.20.9 → 0.22.0

package/dist/control-maps.d.ts

@@ -14,7 +14,15 @@ export declare const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution
  * extension and MCP tools profile-configurable without a static catalog.
  */
 export declare function piToolId(name: string): string | undefined;
-export declare function mapSupportedBooleanEntries(entries: [string, boolean][], mapName: (name: string) => string | undefined, onUnsupported: (name: string) => void, label: string): [string, boolean][];
+/**
+ * Map tool switches to native ids; spellings of one tool keep its explicit off.
+ *
+ * Products compose profiles in layers: a shared allowlist, then a product
+ * constraint that disables a native tool under its own spelling. Physim adds
+ * `webfetch: false` over an allowlist holding `web_fetch: true`. Off is the
+ * only value that honours every layer, so it wins regardless of entry order.
+ */
+export declare function mapSupportedBooleanEntries(entries: [string, boolean][], mapName: (name: string) => string | undefined, onUnsupported: (name: string) => void): [string, boolean][];
 export declare function permissionAllowsEverything(policy: AgentProfilePermission): boolean;
 export declare function mapSupportedPermissionEntries(entries: [string, AgentProfilePermission][], mapName: (name: string) => string | undefined, onUnsupported: (name: string) => void, label: string): [string, AgentProfilePermission][];
 export declare function claudePermissionRules(entries: [string, AgentProfilePermission][]): {
@@ -22,6 +30,11 @@ export declare function claudePermissionRules(entries: [string, AgentProfilePerm
     ask: string[];
     deny: string[];
 };
+/**
+ * Give each Claude rule one decision. A tool switch and a permission can name
+ * the same rule; the stricter decision wins, as deny already beats allow
+ * inside Claude Code.
+ */
 export declare function sealClaudePermissionRules(rules: {
     allow: string[];
     ask: string[];

package/dist/control-maps.js

@@ -101,12 +101,16 @@ export function piToolId(name) {
         return "find";
     return trimmed;
 }
-export function mapSupportedBooleanEntries(entries, mapName, onUnsupported, label) {
-    return mapControlEntries(entries, mapName, onUnsupported, (left, right, nativeName) => {
-        if (left !== right)
-            throw new Error(`${label} aliases disagree for "${nativeName}"`);
-        return left;
-    });
+/**
+ * Map tool switches to native ids; spellings of one tool keep its explicit off.
+ *
+ * Products compose profiles in layers: a shared allowlist, then a product
+ * constraint that disables a native tool under its own spelling. Physim adds
+ * `webfetch: false` over an allowlist holding `web_fetch: true`. Off is the
+ * only value that honours every layer, so it wins regardless of entry order.
+ */
+export function mapSupportedBooleanEntries(entries, mapName, onUnsupported) {
+    return mapControlEntries(entries, mapName, onUnsupported, (left, right) => left && right);
 }
 export function permissionAllowsEverything(policy) {
     return typeof policy === "string"
@@ -129,21 +133,43 @@ function mapControlEntries(entries, mapName, onUnsupported, merge) {
     }
     return [...mapped.entries()].sort(([left], [right]) => compareStrings(left, right));
 }
+const PERMISSION_RESTRICTION = {
+    allow: 0,
+    ask: 1,
+    deny: 2,
+};
+function stricterDecision(left, right) {
+    return PERMISSION_RESTRICTION[right] > PERMISSION_RESTRICTION[left]
+        ? right
+        : left;
+}
+/**
+ * Merge policies whose names resolve to one native tool; the stricter
+ * decision wins, as an explicit off does for tool switches.
+ *
+ * Pattern rules merge only when both spellings list the same patterns in the
+ * same order. OpenCode applies the last matching pattern, so any other pair
+ * has no merge at least as strict as each spelling: `{"*": "deny"}` beside
+ * `{"https://x/*": "allow"}` would allow x. Those pairs stay contradictions
+ * that `executionControlConflict` reports at admission.
+ */
 function mergePermissionPolicies(left, right, label) {
+    if (typeof left === "string" && typeof right === "string") {
+        return stricterDecision(left, right);
+    }
     if (typeof left === "string" || typeof right === "string") {
-        if (left !== right)
-            throw new Error(`${label} aliases disagree`);
-        return left;
+        throw new Error(`${label} aliases mix a whole-tool decision with pattern rules`);
     }
-    const merged = { ...left };
-    for (const [specifier, decision] of Object.entries(right)) {
-        const previous = merged[specifier];
-        if (previous !== undefined && previous !== decision) {
-            throw new Error(`${label} aliases disagree for "${specifier}"`);
-        }
-        merged[specifier] = decision;
+    const patterns = Object.keys(left);
+    const rightPatterns = Object.keys(right);
+    if (patterns.length !== rightPatterns.length ||
+        rightPatterns.some((pattern, index) => pattern !== patterns[index])) {
+        throw new Error(`${label} aliases set different pattern rules`);
     }
-    return Object.fromEntries(Object.entries(merged).sort(([leftKey], [rightKey]) => compareStrings(leftKey, rightKey)));
+    return Object.fromEntries(Object.entries(left).map(([pattern, decision]) => [
+        pattern,
+        stricterDecision(decision, right[pattern] ?? decision),
+    ]));
 }
 export function claudePermissionRules(entries) {
     const rules = {
@@ -165,22 +191,32 @@ export function claudePermissionRules(entries) {
     rules.deny.sort(compareStrings);
     return rules;
 }
+/**
+ * Give each Claude rule one decision. A tool switch and a permission can name
+ * the same rule; the stricter decision wins, as deny already beats allow
+ * inside Claude Code.
+ */
 export function sealClaudePermissionRules(rules) {
     const owner = new Map();
     for (const decision of ["allow", "ask", "deny"]) {
         for (const rule of rules[decision]) {
             const previous = owner.get(rule);
-            if (previous && previous !== decision) {
-                throw new Error(`claude-code execution control "${rule}" conflicts between ${previous} and ${decision}`);
-            }
-            owner.set(rule, decision);
+            owner.set(rule, previous === undefined
+                ? decision
+                : stricterDecision(previous, decision));
         }
     }
-    return {
-        allow: [...new Set(rules.allow)].sort(compareStrings),
-        ask: [...new Set(rules.ask)].sort(compareStrings),
-        deny: [...new Set(rules.deny)].sort(compareStrings),
+    const sealed = {
+        allow: [],
+        ask: [],
+        deny: [],
     };
+    for (const [rule, decision] of owner)
+        sealed[decision].push(rule);
+    sealed.allow.sort(compareStrings);
+    sealed.ask.sort(compareStrings);
+    sealed.deny.sort(compareStrings);
+    return sealed;
 }
 import { resolveNativeWebTools } from "@tangle-network/agent-interface";
 import { compareStrings } from "./workspace-files.js";

package/dist/execution-controls.js

@@ -4,7 +4,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
     switch (h) {
         case "claude-code": {
             if (toolEntries.length > 0 || permissionEntries.length > 0) {
-                const nativeTools = mapSupportedBooleanEntries(toolEntries, claudeToolName, (name) => unsupported("tools", `claude-code: no verified native tool mapping for "${name}"`), "claude-code tool");
+                const nativeTools = mapSupportedBooleanEntries(toolEntries, claudeToolName, (name) => unsupported("tools", `claude-code: no verified native tool mapping for "${name}"`));
                 const nativePermissions = mapSupportedPermissionEntries(permissionEntries, claudeToolName, (name) => unsupported("permissions", `claude-code: no verified native permission mapping for "${name}"`), "claude-code permission");
                 const rules = claudePermissionRules(nativePermissions);
                 for (const [tool, enabled] of nativeTools) {
@@ -32,7 +32,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                 }
                 return false;
             });
-            const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`), "opencode tool");
+            const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`));
             const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
             if (enforceableTools.length > 0 || permissionEntries.length > 0) {
                 add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
@@ -49,6 +49,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
         }
         case "codex": {
             const searchEntries = [];
+            const fetchEntries = [];
             for (const [name, enabled] of toolEntries) {
                 const posture = resolveNativeWebTools({ [name]: enabled });
                 if (posture.search === enabled && posture.fetch === undefined) {
@@ -56,14 +57,20 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                     continue;
                 }
                 if (posture.fetch === enabled && posture.search === undefined) {
-                    if (enabled) {
-                        unsupported("tools", `codex: native web fetch is unavailable for "${name}"`);
-                    }
+                    fetchEntries.push([name, enabled]);
                     continue;
                 }
                 unsupported("tools", `codex: no verified primary-process tool mapping for "${name}"`);
             }
-            const nativeSearch = mapSupportedBooleanEntries(searchEntries, () => "web_search", () => undefined, "codex tool");
+            // Codex has no native fetch: only a fetch that stays on after its
+            // spellings merge asks for something this harness cannot run.
+            const nativeFetch = mapSupportedBooleanEntries(fetchEntries, () => "web_fetch", () => undefined);
+            if (nativeFetch[0]?.[1]) {
+                for (const [name] of fetchEntries) {
+                    unsupported("tools", `codex: native web fetch is unavailable for "${name}"`);
+                }
+            }
+            const nativeSearch = mapSupportedBooleanEntries(searchEntries, () => "web_search", () => undefined);
             if (nativeSearch[0]) {
                 plan.flags.push("-c", `tools.web_search=${nativeSearch[0][1]}`);
             }
@@ -73,7 +80,7 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
             break;
         }
         case "pi": {
-            const nativeTools = mapSupportedBooleanEntries(toolEntries, piToolId, (name) => unsupported("tools", `pi: tool name "${name}" is empty after trimming`), "pi tool");
+            const nativeTools = mapSupportedBooleanEntries(toolEntries, piToolId, (name) => unsupported("tools", `pi: tool name "${name}" is empty after trimming`));
             const nativePermissions = mapSupportedPermissionEntries(permissionEntries, piToolId, (name) => unsupported("permissions", `pi: permission name "${name}" is empty after trimming`), "pi permission");
             const enabled = new Set(nativeTools
                 .filter(([, value]) => value)
@@ -92,15 +99,12 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                     unsupported("permissions", `pi: permission policy "ask" for "${name}" requires an interactive decision surface`);
                     continue;
                 }
-                if (policy === "allow") {
-                    if (excluded.has(name)) {
-                        throw new Error(`pi execution control "${name}" conflicts between disabled and allow`);
-                    }
+                // The stricter control holds, as across spellings of one tool: an
+                // allow keeps a disabled tool disabled, and a deny excludes an
+                // enabled one.
+                if (policy === "allow")
                     continue;
-                }
-                if (enabled.has(name)) {
-                    throw new Error(`pi execution control "${name}" conflicts between enabled and deny`);
-                }
+                enabled.delete(name);
                 excluded.add(name);
             }
             if (enabled.size > 0 || excluded.size > 0) {

package/dist/harness.d.ts

@@ -79,7 +79,7 @@ export declare const MATERIALIZER_CONTEXT_PATHS: ReadonlySet<string>;
  * `opencode.json` and every context file is a documented name a user repository
  * can carry, so the name alone proves nothing and a profile resource may still
  * mount one. An existing file there is replaced only when
- * {@link isMaterializerOutput} recognizes its bytes as this package's own
+ * {@link materializerReplacement} recognizes its bytes as this package's own
  * earlier output.
  *
  * Deliberately absent: `.gemini/system.md`, the file `prompt.systemPrompt`
@@ -110,11 +110,14 @@ export declare function markMaterializerSubagent(relPath: string, content: strin
  * (`.gemini/system.md`; `.codex/system-prompt.md` is a reserved name this
  * package invented and needs no marker to be owned).
  *
- * It carries the digest of everything BELOW it, which the subagent marker does
- * not need. `CLAUDE.md` is claude-code's own memory file and the agent appends
- * to it mid-session, so a bare marker would still sit on line 1 of a file the
- * agent has since rewritten. Ownership has to mean "these are still our bytes",
- * not "this package wrote here once".
+ * It carries the digest of the generated body below it, which the subagent
+ * marker does not need. `CLAUDE.md` is claude-code's own memory file and the
+ * agent appends to it mid-session, so a bare marker would still sit on line 1
+ * of a file the agent has since rewritten. The digest tells which leading bytes
+ * are still this package's own: the next materialization replaces exactly
+ * those and keeps what the agent appended below them
+ * ({@link generatedContextAppendix}). The marker's wording is part of every
+ * marker already written into live workspaces, so it stays as it is.
  *
  * A reserved context path — opencode's invented instruction file — is returned
  * unchanged: its NAME already proves the provenance, and nothing else may mount
@@ -134,21 +137,15 @@ export declare function markMaterializerContextFile(relPath: string, content: st
  */
 export declare function isMaterializerOwnedPath(relPath: string): boolean;
 /**
- * Whether the file already at owned path `relPath` is this package's own
- * earlier output. A reserved name proves that by itself. Native agent files
- * require the generated marker; context files require the marker AND the body
- * digest it commits to, so an agent that appended to its memory file is no
- * longer holding this package's bytes. An exact unmarked copy of the planned
- * file is adopted once for upgrades from materializer versions without that
- * marker. `undefined` content means no regular file is there.
- *
- * An `opencode.json` this package wrote holds the opencode schema id, only the
- * keys this package writes, and only instruction paths this package invented.
- * A user config that holds nothing else is indistinguishable from that output
- * and is replaced too; a config with any other key, or with an instruction path
- * of the user's own, is refused.
+ * The bytes to publish at owned path `relPath` over the file already there, or
+ * `undefined` when that file is not this package's earlier output and must be
+ * refused (`undefined` content: no regular file there). For a context file the
+ * replacement is the planned file followed by whatever the agent appended
+ * below the generated body (claude-code appends its memory to `CLAUDE.md`). A
+ * body written before the marker existed is adopted once, only when it is
+ * byte-identical to the body this plan writes.
  */
-export declare function isMaterializerOutput(relPath: string, content: () => string | undefined, plannedContent?: string): boolean;
+export declare function materializerReplacement(relPath: string, content: () => string | undefined, plannedContent: string): string | undefined;
 /**
  * cwd-relative native skill dir per harness, or null if the harness has no
  * cwd skill primitive (skills live in a user/global dir the workspace plan

package/dist/harness.js

@@ -153,7 +153,7 @@ export const MATERIALIZER_CONTEXT_PATHS = new Set([...CONTEXT_FILE_PATHS].filter
  * `opencode.json` and every context file is a documented name a user repository
  * can carry, so the name alone proves nothing and a profile resource may still
  * mount one. An existing file there is replaced only when
- * {@link isMaterializerOutput} recognizes its bytes as this package's own
+ * {@link materializerReplacement} recognizes its bytes as this package's own
  * earlier output.
  *
  * Deliberately absent: `.gemini/system.md`, the file `prompt.systemPrompt`
@@ -214,11 +214,14 @@ function materializerContextMarker(body) {
  * (`.gemini/system.md`; `.codex/system-prompt.md` is a reserved name this
  * package invented and needs no marker to be owned).
  *
- * It carries the digest of everything BELOW it, which the subagent marker does
- * not need. `CLAUDE.md` is claude-code's own memory file and the agent appends
- * to it mid-session, so a bare marker would still sit on line 1 of a file the
- * agent has since rewritten. Ownership has to mean "these are still our bytes",
- * not "this package wrote here once".
+ * It carries the digest of the generated body below it, which the subagent
+ * marker does not need. `CLAUDE.md` is claude-code's own memory file and the
+ * agent appends to it mid-session, so a bare marker would still sit on line 1
+ * of a file the agent has since rewritten. The digest tells which leading bytes
+ * are still this package's own: the next materialization replaces exactly
+ * those and keeps what the agent appended below them
+ * ({@link generatedContextAppendix}). The marker's wording is part of every
+ * marker already written into live workspaces, so it stays as it is.
  *
  * A reserved context path — opencode's invented instruction file — is returned
  * unchanged: its NAME already proves the provenance, and nothing else may mount
@@ -232,16 +235,55 @@ export function markMaterializerContextFile(relPath, content) {
         return content;
     return `${materializerContextMarker(content)}\n${content}`;
 }
+const MATERIALIZER_CONTEXT_MARKER_HEAD = `<!-- ${MATERIALIZER_MARKER} sha256:`;
+const MATERIALIZER_CONTEXT_MARKER_TAIL = `; ${MATERIALIZER_CONTEXT_MARKER_NOTE} -->`;
+const SHA256_HEX = /^[0-9a-f]{64}$/u;
 /**
- * Whether `existing` is a context file this package wrote and nothing edited
- * afterwards: line 1 is exactly the marker computed over every byte below it.
+ * Text an agent appended below this package's generated context body: `""`
+ * for exact output, `undefined` when no marker is on line 1 or no leading part
+ * of the body matches its digest (an edit inside the generated part). Each
+ * line boundary is a candidate end; one incremental hash walks the body once.
  */
-function isMarkedContextOutput(existing) {
+function generatedContextAppendix(existing) {
     const lineEnd = existing.indexOf("\n");
     if (lineEnd === -1)
-        return false;
-    return (existing.slice(0, lineEnd) ===
-        materializerContextMarker(existing.slice(lineEnd + 1)));
+        return undefined;
+    const marker = existing.slice(0, lineEnd);
+    if (!marker.startsWith(MATERIALIZER_CONTEXT_MARKER_HEAD) ||
+        !marker.endsWith(MATERIALIZER_CONTEXT_MARKER_TAIL)) {
+        return undefined;
+    }
+    const digest = marker.slice(MATERIALIZER_CONTEXT_MARKER_HEAD.length, marker.length - MATERIALIZER_CONTEXT_MARKER_TAIL.length);
+    if (!SHA256_HEX.test(digest))
+        return undefined;
+    const body = existing.slice(lineEnd + 1);
+    // No cut at 0: a generated body is never empty, so it never adopts a whole file.
+    const boundaries = [];
+    for (let newline = body.indexOf("\n"); newline !== -1; newline = body.indexOf("\n", newline + 1)) {
+        boundaries.push(newline, newline + 1);
+    }
+    if (boundaries.length === 0 ||
+        boundaries[boundaries.length - 1] !== body.length) {
+        boundaries.push(body.length);
+    }
+    const hash = createHash("sha256");
+    let hashed = 0;
+    for (const end of boundaries) {
+        hash.update(body.slice(hashed, end), "utf8");
+        hashed = end;
+        if (hash.copy().digest("hex") === digest)
+            return body.slice(end);
+    }
+    return undefined;
+}
+/** The planned context file, then the agent's appended text on its own line. */
+function withContextAppendix(plannedContent, appendix) {
+    if (appendix === "" ||
+        plannedContent.endsWith("\n") ||
+        appendix.startsWith("\n")) {
+        return `${plannedContent}${appendix}`;
+    }
+    return `${plannedContent}\n${appendix}`;
 }
 /**
  * Whether a generated file occupies a path that the profile materializer owns.
@@ -267,13 +309,43 @@ const OPENCODE_CONFIG_KEYS = new Set([
     "permission",
 ]);
 /**
- * Whether the file already at owned path `relPath` is this package's own
- * earlier output. A reserved name proves that by itself. Native agent files
- * require the generated marker; context files require the marker AND the body
- * digest it commits to, so an agent that appended to its memory file is no
- * longer holding this package's bytes. An exact unmarked copy of the planned
- * file is adopted once for upgrades from materializer versions without that
- * marker. `undefined` content means no regular file is there.
+ * The bytes to publish at owned path `relPath` over the file already there, or
+ * `undefined` when that file is not this package's earlier output and must be
+ * refused (`undefined` content: no regular file there). For a context file the
+ * replacement is the planned file followed by whatever the agent appended
+ * below the generated body (claude-code appends its memory to `CLAUDE.md`). A
+ * body written before the marker existed is adopted once, only when it is
+ * byte-identical to the body this plan writes.
+ */
+export function materializerReplacement(relPath, content, plannedContent) {
+    if (!MATERIALIZER_CONTEXT_PATHS.has(relPath)) {
+        return isMaterializerOutput(relPath, content, plannedContent)
+            ? plannedContent
+            : undefined;
+    }
+    const existing = content();
+    if (existing === undefined)
+        return undefined;
+    const appendix = generatedContextAppendix(existing);
+    if (appendix === "")
+        return plannedContent;
+    // Appended text rides only on a marked plan, which the next version recognizes.
+    if (generatedContextAppendix(plannedContent) !== "")
+        return undefined;
+    if (appendix !== undefined) {
+        return withContextAppendix(plannedContent, appendix);
+    }
+    return existing === plannedContent.slice(plannedContent.indexOf("\n") + 1)
+        ? plannedContent
+        : undefined;
+}
+/**
+ * Whether the file already at owned path `relPath`, other than a context file,
+ * is this package's own earlier output. A reserved name proves that by itself.
+ * Native agent files require the generated marker. An exact unmarked copy of
+ * the planned native agent file is adopted once for upgrades from materializer
+ * versions without that marker. `undefined` content means no regular file is
+ * there.
  *
  * An `opencode.json` this package wrote holds the opencode schema id, only the
  * keys this package writes, and only instruction paths this package invented.
@@ -281,7 +353,7 @@ const OPENCODE_CONFIG_KEYS = new Set([
  * and is replaced too; a config with any other key, or with an instruction path
  * of the user's own, is refused.
  */
-export function isMaterializerOutput(relPath, content, plannedContent) {
+function isMaterializerOutput(relPath, content, plannedContent) {
     if (MATERIALIZER_RESERVED_PATHS.has(relPath))
         return true;
     if (MATERIALIZER_SUBAGENT_PATH.test(relPath)) {
@@ -291,8 +363,6 @@ export function isMaterializerOutput(relPath, content, plannedContent) {
         const markerPrefix = materializerSubagentMarkerPrefix(relPath);
         if (existing.startsWith(markerPrefix))
             return true;
-        if (plannedContent === undefined)
-            return false;
         if (!plannedContent.startsWith(markerPrefix))
             return false;
         const legacyContent = relPath.endsWith(".toml")
@@ -300,23 +370,6 @@ export function isMaterializerOutput(relPath, content, plannedContent) {
             : `---\n${plannedContent.slice(markerPrefix.length)}`;
         return existing === legacyContent;
     }
-    if (MATERIALIZER_CONTEXT_PATHS.has(relPath)) {
-        const existing = content();
-        if (existing === undefined)
-            return false;
-        if (isMarkedContextOutput(existing))
-            return true;
-        // A workspace materialized before this marker existed carries the body
-        // alone. Adopt it once, and only when it is byte-identical to the body this
-        // plan writes, so upgrading the package does not turn every resumed session
-        // into a refusal. A body that differs is either a user's file or an earlier
-        // profile's, and neither can be told apart without the marker.
-        if (plannedContent === undefined)
-            return false;
-        if (!isMarkedContextOutput(plannedContent))
-            return false;
-        return existing === plannedContent.slice(plannedContent.indexOf("\n") + 1);
-    }
     if (relPath !== OPENCODE_CONFIG_FILE)
         return false;
     const bytes = content();

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-/** Stable public facade for profile materialization and workspace application. */
 export { applyAgentCandidateWorkspacePlan, materializeCandidateProfile, } from "./candidate.js";
 export type { AgentCandidateWorkspacePlan, AgentCandidateWorkspacePlanReceipt, ApplyAgentCandidateWorkspacePlanOptions, MaterializeCandidateProfileOptions, } from "./candidate-types.js";
 export { OPENCODE_NATIVE_TOOL_IDS, openCodeNativeToolId, } from "./control-maps.js";
 export type { HarnessId } from "./harness.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsAgentContextFile, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_CONTEXT_PATHS, MATERIALIZER_HARNESSES, markMaterializerContextFile, skillDirForHarness, } from "./harness.js";
-export { joinSystemPromptAdditions, keepsHarnessSystemPrompt, } from "./harness-prompt.js";
+export * from "./harness-prompt.js";
+export { type ConcurrentProfileRevision, ensurePublicConcurrentProfileRoots, type ManagedWorkspaceFileDigest, type ManagedWorkspaceManifest, preparePublicConcurrentProfileRevision, } from "./managed-workspace.js";
 export type { OpenCodeMcpConfig } from "./mcp.js";
 export { openCodeMcpConfig } from "./mcp.js";
 export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
@@ -21,6 +21,7 @@ export type { PrimeProfileErrorKind, PrimeThinkingLevel, } from "./prime-fork.js
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
 export type { PrimeProfileControls, PrimeProfileSkill, PrimeProfileSubagent, } from "./prime-profile.js";
 export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
-export { materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
+export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
 export type { ResolveAgentProfileResourcesOptions } from "./resource-resolution.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
+export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";

package/dist/index.js

@@ -1,8 +1,8 @@
-/** Stable public facade for profile materialization and workspace application. */
 export { applyAgentCandidateWorkspacePlan, materializeCandidateProfile, } from "./candidate.js";
 export { OPENCODE_NATIVE_TOOL_IDS, openCodeNativeToolId, } from "./control-maps.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsAgentContextFile, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_CONTEXT_PATHS, MATERIALIZER_HARNESSES, markMaterializerContextFile, skillDirForHarness, } from "./harness.js";
-export { joinSystemPromptAdditions, keepsHarnessSystemPrompt, } from "./harness-prompt.js";
+export * from "./harness-prompt.js";
+export { ensurePublicConcurrentProfileRoots, preparePublicConcurrentProfileRevision, } from "./managed-workspace.js";
 export { openCodeMcpConfig } from "./mcp.js";
 export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
 export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, resolvePiRuntimePaths, } from "./pi-models-config.js";
@@ -14,5 +14,6 @@ export { BINDABLE_LAUNCH_CONTROLS, EXECUTOR_SYSTEM_PROMPT_BINDINGS, isExecutorSy
 export { materializePrimeProfileControls, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
 export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
-export { materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
+export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
+export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";

package/dist/managed-workspace-bind.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
+export declare function bindConcurrentLaunch(plan: WorkspacePlan, application: WorkspacePlanApplication, revisionWorkspaceDir: string, options?: {
+    readonly secretOpenCodeRevisionCwd?: boolean;
+}): WorkspacePlanApplication["spawn"];

package/dist/managed-workspace-bind.js

@@ -0,0 +1,94 @@
+import { join } from "node:path";
+export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, options = {}) {
+    if (plan.requires?.length) {
+        throw new Error(`Concurrent ${plan.harness} profile needs a native extension that this launcher cannot attest`);
+    }
+    if (application.spawn.systemPromptBinding) {
+        throw new Error(`Concurrent ${plan.harness} profile has an unbound system prompt control`);
+    }
+    const flags = [...application.spawn.flags];
+    const env = { ...application.spawn.env };
+    const supportedFiles = new Set();
+    const bindFlagFile = (flag, relPath) => {
+        const index = flags.findIndex((value, at) => value === flag && flags[at + 1] === relPath);
+        if (index < 0)
+            throw new Error(`Concurrent ${plan.harness} profile lacks ${flag} for ${relPath}`);
+        flags[index + 1] = join(revisionWorkspaceDir, relPath);
+        supportedFiles.add(relPath);
+    };
+    switch (plan.harness) {
+        case "claude-code":
+            for (const relPath of [
+                ".tangle/claude-mcp.json",
+                ".tangle/claude-settings.json",
+            ]) {
+                if (plan.files.some((file) => file.relPath === relPath)) {
+                    bindFlagFile(relPath.endsWith("mcp.json") ? "--mcp-config" : "--settings", relPath);
+                }
+            }
+            break;
+        case "codex":
+            if (plan.files.some((file) => file.relPath === ".codex/system-prompt.md")) {
+                const original = "model_instructions_file=.codex/system-prompt.md";
+                const index = flags.findIndex((value, at) => value === original && flags[at - 1] === "-c");
+                if (index < 0)
+                    throw new Error("Concurrent codex profile lacks model_instructions_file binding");
+                flags[index] =
+                    `model_instructions_file=${join(revisionWorkspaceDir, ".codex/system-prompt.md")}`;
+                supportedFiles.add(".codex/system-prompt.md");
+            }
+            break;
+        case "kimi-code":
+            if (plan.files.some((file) => file.relPath === ".kimi/mcp.json")) {
+                bindFlagFile("--mcp-config-file", ".kimi/mcp.json");
+            }
+            break;
+        case "opencode": {
+            const runtimeConfig = application.runtimeOnlyFiles["opencode.json"];
+            if (runtimeConfig !== undefined)
+                env.OPENCODE_CONFIG_CONTENT = runtimeConfig;
+            const configFile = plan.files.find((file) => file.relPath === "opencode.json");
+            if (configFile) {
+                env.OPENCODE_CONFIG = join(revisionWorkspaceDir, "opencode.json");
+                env.TANGLE_PROFILE_REVISION_WORKSPACE = revisionWorkspaceDir;
+                supportedFiles.add("opencode.json");
+                const config = JSON.parse(configFile.content);
+                if (Array.isArray(config.instructions)) {
+                    for (const entry of config.instructions) {
+                        const prefix = "{env:TANGLE_PROFILE_REVISION_WORKSPACE}/";
+                        if (typeof entry !== "string" || !entry.startsWith(prefix)) {
+                            throw new Error("Concurrent OpenCode instruction lacks an explicit revision binding");
+                        }
+                        supportedFiles.add(entry.slice(prefix.length));
+                    }
+                }
+            }
+            break;
+        }
+    }
+    for (const file of plan.files) {
+        if (file.source !== "generated") {
+            if (options.secretOpenCodeRevisionCwd &&
+                plan.harness === "opencode" &&
+                (file.root ?? "workspace") === "workspace" &&
+                (file.relPath.startsWith("reference/") ||
+                    file.relPath.startsWith(".opencode/skills/"))) {
+                // The secret launcher uses this immutable revision tree as native cwd.
+                // These content-only resources are therefore visible without writing
+                // into the shared workspace or changing native authority config.
+                continue;
+            }
+            throw new Error(`Concurrent ${plan.harness} profile resource ${file.relPath} needs a shared-workspace collision-safe copy`);
+        }
+        if ((file.root ?? "workspace") !== "workspace" ||
+            !supportedFiles.has(file.relPath)) {
+            throw new Error(`Concurrent ${plan.harness} profile cannot redirect native file ${file.relPath}; use a verified launch control`);
+        }
+    }
+    for (const name of Object.keys(application.runtimeOnlyFiles)) {
+        if (plan.harness !== "opencode" || name !== "opencode.json") {
+            throw new Error(`Concurrent ${plan.harness} profile cannot bind runtime-only file ${name}`);
+        }
+    }
+    return { ...application.spawn, flags, env };
+}