@tangle-network/agent-profile-materialize 0.20.9 → 0.22.0

package/dist/secret-concurrent-revision.js

@@ -0,0 +1,164 @@
+import { execFileSync } from "node:child_process";
+import { createHash, createHmac } from "node:crypto";
+import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { assertLaunchRoot, listRevisionFiles, makeStageWritable, prepareExplicitOpenCodePlan, } from "./managed-workspace.js";
+import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
+import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
+import { assertWorkspacePlanSupported } from "./plan-support.js";
+/**
+ * Publish a resolved revision for exactly one native subprocess UID. The
+ * executor-owned naming key hides low-entropy credential guesses from paths;
+ * the resolved digest and manifest never leave this server-side result.
+ */
+export async function prepareSecretConcurrentProfileRevision(input) {
+    if (process.platform !== "linux" ||
+        process.getuid?.() !== 0 ||
+        !Number.isSafeInteger(input.subprocessUid) ||
+        input.subprocessUid < 200_000 ||
+        input.namingKey.length !== 32 ||
+        !input.ownerId) {
+        throw new Error("Secret concurrent profile needs a root executor and reserved identity");
+    }
+    const plan = prepareExplicitOpenCodePlan(input.plan);
+    if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
+        throw new Error("Secret OpenCode reserves its native config directory");
+    }
+    assertWorkspacePlanSupported(plan);
+    assertLaunchRoot(input.launchRoot);
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, input.options);
+    try {
+        // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
+        // An agent-owned HOME may hold SQLite state, never native authority.
+        mkdirSync(join(prepared.root, "workspace", ".config", "opencode"), {
+            recursive: true,
+            mode: 0o700,
+        });
+        const identity = createHmac("sha256", input.namingKey)
+            .update(input.ownerId)
+            .update("\0")
+            .update(String(input.subprocessUid))
+            .update("\0")
+            .update(prepared.manifest.materializedDigest)
+            .digest("hex");
+        const directory = join(input.launchRoot, `revision-${identity}`);
+        const spawn = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretOpenCodeRevisionCwd: true });
+        prepared.manifest.launchDigest = createHash("sha256")
+            .update(JSON.stringify(spawn))
+            .digest("hex");
+        writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
+        const existing = lstatIfPresent(directory);
+        if (existing) {
+            assertPublishedSecretRevision(directory, prepared.manifest);
+            prepared.dispose();
+        }
+        else {
+            try {
+                makeSecretRevisionReadOnly(prepared.root, input.subprocessUid);
+                renameSync(prepared.root, directory);
+            }
+            catch (error) {
+                const raced = lstatIfPresent(directory);
+                if (!raced?.isDirectory() || raced.isSymbolicLink())
+                    throw error;
+                assertPublishedSecretRevision(directory, prepared.manifest);
+                makeStageWritable(prepared.root);
+                prepared.dispose();
+            }
+        }
+        return {
+            directory,
+            manifest: prepared.manifest,
+            application: { ...prepared.application, spawn },
+        };
+    }
+    catch (error) {
+        if (lstatIfPresent(prepared.root)) {
+            makeStageWritable(prepared.root);
+            prepared.dispose();
+        }
+        throw error;
+    }
+}
+function secretRevisionPaths(root) {
+    const all = [root];
+    const exposed = [root];
+    const walk = (directory) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const child = join(directory, entry.name);
+            const stat = lstatSync(child);
+            if (stat.uid !== 0 || stat.isSymbolicLink()) {
+                throw new Error("Secret concurrent profile stage contains an untrusted inode");
+            }
+            if (!stat.isDirectory() && !stat.isFile()) {
+                throw new Error("Secret concurrent profile stage contains a special file");
+            }
+            all.push(child);
+            if (entry.name !== "manifest.json" || directory !== root) {
+                exposed.push(child);
+            }
+            if (stat.isDirectory())
+                walk(child);
+        }
+    };
+    walk(root);
+    return { all, exposed };
+}
+function runSetfacl(args, paths) {
+    for (let start = 0; start < paths.length; start += 64) {
+        execFileSync("/usr/bin/setfacl", [...args, "--", ...paths.slice(start, start + 64)], {
+            env: { PATH: "/usr/bin:/bin", LANG: "C" },
+            timeout: 30_000,
+            stdio: "pipe",
+        });
+    }
+}
+function makeSecretRevisionReadOnly(root, uid) {
+    const paths = secretRevisionPaths(root);
+    // Remove inherited named ACLs before widening the ACL mask for this UID.
+    runSetfacl(["-b"], paths.all);
+    for (const path of paths.all) {
+        const stat = lstatSync(path);
+        chmodSync(path, stat.isDirectory() ? 0o500 : stat.mode & 0o111 ? 0o500 : 0o400);
+    }
+    // The private manifest has resolved-file hashes. The CLI can read its native
+    // files, but never the executor inventory or another revision's files.
+    runSetfacl(["-m", `u:${uid}:r-X`], paths.exposed);
+}
+function assertPublishedSecretRevision(directory, expected) {
+    const root = lstatSync(directory);
+    if (!root.isDirectory() ||
+        root.isSymbolicLink() ||
+        root.uid !== 0 ||
+        (root.mode & 0o222) !== 0) {
+        throw new Error("Secret concurrent profile revision is not immutable");
+    }
+    const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
+    if (persisted.materializedDigest !== expected.materializedDigest ||
+        persisted.launchDigest !== expected.launchDigest) {
+        throw new Error("Secret concurrent profile revision digest collision");
+    }
+    for (const file of expected.files) {
+        const filePath = join(directory, file.root, file.relPath);
+        const stat = lstatSync(filePath);
+        if (!stat.isFile() ||
+            stat.isSymbolicLink() ||
+            stat.uid !== 0 ||
+            (stat.mode & 0o222) !== 0 ||
+            createHash("sha256").update(readFileSync(filePath)).digest("hex") !==
+                file.sha256) {
+            throw new Error("Secret concurrent profile revision file changed");
+        }
+    }
+    const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
+    for (const rootName of ["workspace", "agent"]) {
+        for (const relPath of listRevisionFiles(join(directory, rootName))) {
+            if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
+                throw new Error("Secret concurrent profile revision has an unexpected file");
+            }
+        }
+    }
+    if (expectedPaths.size) {
+        throw new Error("Secret concurrent profile revision is missing a manifest file");
+    }
+}

package/dist/workspace-apply-files.d.ts

@@ -1,4 +1,9 @@
 declare function workspaceFileExists(pathValue: string): boolean;
+/**
+ * A regular file's text, or `undefined` when no regular file is there or its
+ * bytes are not UTF-8. This package writes only UTF-8, so such bytes are not
+ * its output, and decoding them lossily would rewrite them on replacement.
+ */
 declare function regularFileContent(pathValue: string): string | undefined;
 declare function workspaceFileMatches(file: NormalizedPlanFile & {
     absPath: string;
@@ -33,6 +38,8 @@ interface PreparedWorkspaceFile {
     temporaryPath: string;
     identity: WorkspaceFileIdentity;
     published: boolean;
+    /** A link to the replaced file while it holds an agent's text, for rollback. */
+    superseded?: string;
 }
 declare function prepareWorkspaceFile(workspaceRoot: string, file: NormalizedPlanFile & {
     absPath: string;

package/dist/workspace-apply-files.js

@@ -9,10 +9,24 @@ function workspaceFileExists(pathValue) {
         throw error;
     }
 }
+const STRICT_UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+/**
+ * A regular file's text, or `undefined` when no regular file is there or its
+ * bytes are not UTF-8. This package writes only UTF-8, so such bytes are not
+ * its output, and decoding them lossily would rewrite them on replacement.
+ */
 function regularFileContent(pathValue) {
-    return lstatSync(pathValue).isFile()
-        ? readFileSync(pathValue, "utf8")
-        : undefined;
+    if (!lstatSync(pathValue).isFile())
+        return undefined;
+    const bytes = readFileSync(pathValue);
+    try {
+        return STRICT_UTF8.decode(bytes);
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            return undefined;
+        throw error;
+    }
 }
 function workspaceFileMatches(file) {
     const stats = lstatSync(file.absPath);

package/dist/workspace-apply.js

@@ -70,35 +70,53 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
     }
     // An owned path holds this package's own earlier output, so re-applying
     // into the same workspace replaces it rather than failing the turn — once
-    // the bytes already there prove that provenance. `reject` still refuses:
-    // that policy is "nothing may pre-exist here", which is a statement about
-    // the workspace, not authorship.
-    const mayReplace = (file) => existingFiles === "allow-identical" &&
-        file.ownership === "materializer" &&
-        isMaterializerOutput(file.relPath, () => regularFileContent(file.absPath), file.content);
+    // the bytes already there prove that provenance. The replacement keeps what
+    // an agent appended below a generated context file (its memory), so it can
+    // differ from the planned bytes. `reject` still refuses: that policy is
+    // "nothing may pre-exist here", which is a statement about the workspace,
+    // not authorship.
+    const plannedContent = new Map(filesToApply.map((file) => [fileIdentity(file), file.content]));
+    const replacement = (file) => {
+        const planned = plannedContent.get(fileIdentity(file));
+        if (existingFiles !== "allow-identical" ||
+            file.ownership !== "materializer" ||
+            planned === undefined) {
+            return undefined;
+        }
+        return materializerReplacement(file.relPath, () => regularFileContent(file.absPath), planned);
+    };
     // Validate the complete plan before the first write so a late traversal or
     // existing symlink cannot leave a partially materialized workspace.
+    const writes = [];
     for (const file of filesToApply) {
         assertNoSymlinkPathComponents(file.rootDir, file.absPath);
-        if (workspaceFileExists(file.absPath) &&
-            !mayReplace(file) &&
-            (existingFiles === "reject" || !workspaceFileMatches(file))) {
+        if (!workspaceFileExists(file.absPath)) {
+            writes.push(file);
+            continue;
+        }
+        const content = replacement(file);
+        if (content !== undefined) {
+            writes.push({ ...file, content });
+            continue;
+        }
+        if (existingFiles === "reject" || !workspaceFileMatches(file)) {
             throw new Error(workspaceFileConflictMessage(file, existingFiles, publicPlanDigest));
         }
+        writes.push(file);
     }
     // Parent directories remain on failure because they may contain concurrent
     // workspace state that this call does not own.
-    for (const file of filesToApply) {
+    for (const file of writes) {
         mkdirSync(dirname(file.absPath), { recursive: true });
     }
-    for (const file of filesToApply) {
+    for (const file of writes) {
         assertNoSymlinkPathComponents(file.rootDir, file.absPath);
     }
     const prepared = [];
     // Prepared temp links stay alive through publication and rollback. Their
     // inodes distinguish files created here from concurrent replacements.
     try {
-        for (const file of filesToApply) {
+        for (const file of writes) {
             if (existingFiles === "allow-identical" &&
                 workspaceFileExists(file.absPath) &&
                 workspaceFileMatches(file) &&
@@ -124,7 +142,12 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
                         workspaceFileHasOwnership(entry.file.absPath, ownership))) {
                     continue;
                 }
-                if (isFsError(error, "EEXIST") && mayReplace(entry.file)) {
+                if (isFsError(error, "EEXIST") &&
+                    replacement(entry.file) === entry.file.content) {
+                    // The replacement is recomposed from the bytes there now, so an
+                    // agent append that landed since validation refuses below instead
+                    // of being overwritten; one landing between that read and the
+                    // rename is not detected.
                     // rename() replaces in one step, so no window exists in which the
                     // path is missing and a concurrent spawn reads nothing. The staged
                     // inode moves onto the path, which is what rollback identifies the
@@ -132,8 +155,16 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
                     // published — leaving the path ABSENT rather than restored to the
                     // superseded bytes. That is the fail-closed direction: the harness
                     // whose flag names a missing file refuses to start, whereas silently
-                    // restored previous-turn bytes would run the wrong prompt.
+                    // restored previous-turn bytes would run the wrong prompt. A replaced
+                    // file that holds an agent's appended text is the exception: it is
+                    // linked aside first and restored, because removing it would delete
+                    // the agent's own text.
                     assertNoSymlinkPathComponents(rootFor(entry.file.root), entry.file.absPath);
+                    if (entry.file.content !== plannedContent.get(fileIdentity(entry.file))) {
+                        const superseded = join(dirname(entry.file.absPath), `.agent-profile-${randomUUID()}.superseded`);
+                        linkSync(entry.file.absPath, superseded);
+                        entry.superseded = superseded;
+                    }
                     renameSync(entry.temporaryPath, entry.file.absPath);
                     entry.published = true;
                     continue;
@@ -151,12 +182,25 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
             try {
                 if (entry.published &&
                     workspacePathHasIdentity(entry.file.absPath, entry.identity)) {
-                    unlinkSync(entry.file.absPath);
+                    if (entry.superseded) {
+                        renameSync(entry.superseded, entry.file.absPath);
+                    }
+                    else {
+                        unlinkSync(entry.file.absPath);
+                    }
                 }
             }
             catch (cleanupError) {
                 cleanupErrors.push(cleanupError);
             }
+            try {
+                if (entry.superseded)
+                    unlinkSync(entry.superseded);
+            }
+            catch (cleanupError) {
+                if (!isFsError(cleanupError, "ENOENT"))
+                    cleanupErrors.push(cleanupError);
+            }
             try {
                 if (workspacePathHasIdentity(entry.temporaryPath, entry.identity)) {
                     unlinkSync(entry.temporaryPath);
@@ -175,13 +219,17 @@ export function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDi
     const cleanupErrors = [];
     const temporaryPaths = [];
     for (const entry of prepared) {
-        try {
-            unlinkSync(entry.temporaryPath);
-        }
-        catch (error) {
-            if (!isFsError(error, "ENOENT")) {
-                cleanupErrors.push(error);
-                temporaryPaths.push(entry.temporaryPath);
+        for (const path of [entry.temporaryPath, entry.superseded]) {
+            if (path === undefined)
+                continue;
+            try {
+                unlinkSync(path);
+            }
+            catch (error) {
+                if (!isFsError(error, "ENOENT")) {
+                    cleanupErrors.push(error);
+                    temporaryPaths.push(path);
+                }
             }
         }
     }
@@ -216,9 +264,10 @@ function safeWorkspacePlanReceipt(plan, writtenFiles, workspacePlanDigest = hash
         writtenFiles: writtenFiles.map((file) => ({ ...file })),
     };
 }
+import { randomUUID } from "node:crypto";
 import { linkSync, mkdirSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, isAbsolute, resolve } from "node:path";
-import { isMaterializerOutput } from "./harness.js";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { materializerReplacement } from "./harness.js";
 import { hashWorkspacePlan } from "./plan-digest.js";
 import { normalizePlanFiles, normalizeWorkspacePlanArgument, } from "./plan-normalize.js";
 import { promptIntentFields, samePromptIntentValue, systemPromptBindingField, } from "./plan-prompt.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.20.9",
+  "version": "0.22.0",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {
@@ -25,14 +25,14 @@
     "dist"
   ],
   "devDependencies": {
-    "@tangle-network/agent-interface": "2.17.0",
-    "@tangle-network/agent-interface-current": "npm:@tangle-network/agent-interface@2.17.0",
+    "@tangle-network/agent-interface": "3.0.0",
+    "@tangle-network/agent-interface-current": "npm:@tangle-network/agent-interface@3.0.0",
     "@types/node": "25.6.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
-    "@tangle-network/agent-interface": "^2.13.0"
+    "@tangle-network/agent-interface": "^3.0.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",