@tangle-network/agent-profile-materialize 0.21.0 → 0.22.1

package/dist/control-maps.d.ts

@@ -6,6 +6,11 @@ export declare const OPENCODE_NATIVE_TOOL_IDS: readonly ["apply_patch", "bash",
 export declare function openCodeNativeToolId(name: string): string | undefined;
 export declare function openCodeToolName(name: string): string | undefined;
 export declare function openCodePermissionName(name: string): string | undefined;
+/** OpenCode 1.x registers MCP tools as sanitized server + "_" + tool.
+ * Accept exact tools and a server-wide rule only for this profile's servers.
+ * A generic permission spelling must never become a grant to an undeclared MCP.
+ */
+export declare function openCodeDeclaredMcpPermissionName(name: string, aliases: readonly string[]): string | undefined;
 export declare const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution-controls.ts";
 /**
  * Translate only portable spellings whose Pi equivalent differs.

package/dist/control-maps.js

@@ -68,6 +68,8 @@ export function openCodeToolName(name) {
     return openCodeNativeToolId(name);
 }
 export function openCodePermissionName(name) {
+    if (name.includes("*") || name.includes("?"))
+        return undefined;
     const normalized = normalizedControlName(name);
     if (["write", "edit"].includes(normalized))
         return "edit";
@@ -83,6 +85,36 @@ export function openCodePermissionName(name) {
         ? normalized
         : undefined;
 }
+/** OpenCode 1.x registers MCP tools as sanitized server + "_" + tool.
+ * Accept exact tools and a server-wide rule only for this profile's servers.
+ * A generic permission spelling must never become a grant to an undeclared MCP.
+ */
+export function openCodeDeclaredMcpPermissionName(name, aliases) {
+    const servers = aliases.map((alias) => ({
+        alias,
+        native: alias.replace(/[^a-zA-Z0-9_-]/g, "_"),
+    }));
+    const matches = servers.filter(({ native }) => name.startsWith(`${native}_`));
+    const match = matches[0];
+    if (!match)
+        return undefined;
+    const { native } = match;
+    const tool = name.slice(native.length + 1);
+    if (tool !== "*" && !/^[a-zA-Z0-9_-]+$/.test(tool))
+        return undefined;
+    // Colliding or nested prefixes cannot identify one server's authority:
+    // foo_* also matches foo_bar_read, including a server named foo_bar.
+    if (matches.length !== 1 ||
+        servers.some((server) => server !== matches[0] &&
+            (server.native.startsWith(`${native}_`) ||
+                native.startsWith(`${server.native}_`)))) {
+        throw new Error(`opencode: ambiguous declared MCP permission "${name}"`);
+    }
+    if (tool !== "*" && openCodePermissionName(name) !== undefined) {
+        throw new Error(`opencode: permission "${name}" names both a native and MCP tool`);
+    }
+    return name;
+}
 export const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution-controls.ts";
 /**
  * Translate only portable spellings whose Pi equivalent differs.

package/dist/execution-controls.d.ts

@@ -1,4 +1,4 @@
-export declare function materializeExecutionControls(h: HarnessId, tools: Record<string, boolean> | undefined, permissions: Record<string, AgentProfilePermission> | undefined, modes: AgentProfile["modes"], plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void): void;
+export declare function materializeExecutionControls(h: HarnessId, tools: Record<string, boolean> | undefined, permissions: Record<string, AgentProfilePermission> | undefined, modes: AgentProfile["modes"], plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void, mcpAliases?: readonly string[]): void;
 import type { AgentProfile, AgentProfilePermission } from "@tangle-network/agent-interface";
 import type { HarnessId } from "./harness.js";
 import type { AddPlanFile } from "./plan-json.js";

package/dist/execution-controls.js

@@ -1,4 +1,4 @@
-export function materializeExecutionControls(h, tools, permissions, modes, plan, add, unsupported) {
+export function materializeExecutionControls(h, tools, permissions, modes, plan, add, unsupported, mcpAliases = []) {
     const toolEntries = Object.entries(tools ?? {}).sort(([left], [right]) => compareStrings(left, right));
     const permissionEntries = Object.entries(permissions ?? {}).sort(([left], [right]) => compareStrings(left, right));
     switch (h) {
@@ -33,7 +33,8 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                 return false;
             });
             const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`));
-            const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
+            const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, (name) => openCodeDeclaredMcpPermissionName(name, mcpAliases) ??
+                openCodePermissionName(name), (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
             if (enforceableTools.length > 0 || permissionEntries.length > 0) {
                 add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
                     $schema: OPENCODE_CONFIG_SCHEMA,
@@ -183,7 +184,7 @@ function piExecutionControlExtensionSource(enabledTools, excludedTools) {
     ].join("\n");
 }
 import { resolveNativeWebTools } from "@tangle-network/agent-interface";
-import { claudePermissionRules, claudeToolName, mapSupportedBooleanEntries, mapSupportedPermissionEntries, normalizedControlName, openCodePermissionName, openCodeToolName, PI_EXECUTION_CONTROL_EXTENSION_PATH, permissionAllowsEverything, piToolId, sealClaudePermissionRules, } from "./control-maps.js";
+import { claudePermissionRules, claudeToolName, mapSupportedBooleanEntries, mapSupportedPermissionEntries, normalizedControlName, openCodeDeclaredMcpPermissionName, openCodePermissionName, openCodeToolName, PI_EXECUTION_CONTROL_EXTENSION_PATH, permissionAllowsEverything, piToolId, sealClaudePermissionRules, } from "./control-maps.js";
 import { CLAUDE_SETTINGS_PATH, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, } from "./harness.js";
 import { registerClaudeSettings } from "./hooks.js";
 import { serializeWorkspacePlanJson } from "./plan-json.js";

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-/** Stable public facade for profile materialization and workspace application. */
 export { applyAgentCandidateWorkspacePlan, materializeCandidateProfile, } from "./candidate.js";
 export type { AgentCandidateWorkspacePlan, AgentCandidateWorkspacePlanReceipt, ApplyAgentCandidateWorkspacePlanOptions, MaterializeCandidateProfileOptions, } from "./candidate-types.js";
 export { OPENCODE_NATIVE_TOOL_IDS, openCodeNativeToolId, } from "./control-maps.js";
 export type { HarnessId } from "./harness.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsAgentContextFile, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_CONTEXT_PATHS, MATERIALIZER_HARNESSES, markMaterializerContextFile, skillDirForHarness, } from "./harness.js";
-export { joinSystemPromptAdditions, keepsHarnessSystemPrompt, } from "./harness-prompt.js";
+export * from "./harness-prompt.js";
+export { type ConcurrentProfileRevision, ensurePublicConcurrentProfileRoots, type ManagedWorkspaceFileDigest, type ManagedWorkspaceManifest, preparePublicConcurrentProfileRevision, } from "./managed-workspace.js";
 export type { OpenCodeMcpConfig } from "./mcp.js";
 export { openCodeMcpConfig } from "./mcp.js";
 export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
@@ -24,3 +24,4 @@ export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAg
 export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
 export type { ResolveAgentProfileResourcesOptions } from "./resource-resolution.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
+export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";

package/dist/index.js

@@ -1,8 +1,8 @@
-/** Stable public facade for profile materialization and workspace application. */
 export { applyAgentCandidateWorkspacePlan, materializeCandidateProfile, } from "./candidate.js";
 export { OPENCODE_NATIVE_TOOL_IDS, openCodeNativeToolId, } from "./control-maps.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsAgentContextFile, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_CONTEXT_PATHS, MATERIALIZER_HARNESSES, markMaterializerContextFile, skillDirForHarness, } from "./harness.js";
-export { joinSystemPromptAdditions, keepsHarnessSystemPrompt, } from "./harness-prompt.js";
+export * from "./harness-prompt.js";
+export { ensurePublicConcurrentProfileRoots, preparePublicConcurrentProfileRevision, } from "./managed-workspace.js";
 export { openCodeMcpConfig } from "./mcp.js";
 export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
 export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, resolvePiRuntimePaths, } from "./pi-models-config.js";
@@ -16,3 +16,4 @@ export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_EN
 export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
 export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, } from "./profile-materializer.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
+export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";

package/dist/managed-workspace-bind.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
+export declare function bindConcurrentLaunch(plan: WorkspacePlan, application: WorkspacePlanApplication, revisionWorkspaceDir: string, options?: {
+    readonly secretOpenCodeRevisionCwd?: boolean;
+}): WorkspacePlanApplication["spawn"];

package/dist/managed-workspace-bind.js

@@ -0,0 +1,94 @@
+import { join } from "node:path";
+export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, options = {}) {
+    if (plan.requires?.length) {
+        throw new Error(`Concurrent ${plan.harness} profile needs a native extension that this launcher cannot attest`);
+    }
+    if (application.spawn.systemPromptBinding) {
+        throw new Error(`Concurrent ${plan.harness} profile has an unbound system prompt control`);
+    }
+    const flags = [...application.spawn.flags];
+    const env = { ...application.spawn.env };
+    const supportedFiles = new Set();
+    const bindFlagFile = (flag, relPath) => {
+        const index = flags.findIndex((value, at) => value === flag && flags[at + 1] === relPath);
+        if (index < 0)
+            throw new Error(`Concurrent ${plan.harness} profile lacks ${flag} for ${relPath}`);
+        flags[index + 1] = join(revisionWorkspaceDir, relPath);
+        supportedFiles.add(relPath);
+    };
+    switch (plan.harness) {
+        case "claude-code":
+            for (const relPath of [
+                ".tangle/claude-mcp.json",
+                ".tangle/claude-settings.json",
+            ]) {
+                if (plan.files.some((file) => file.relPath === relPath)) {
+                    bindFlagFile(relPath.endsWith("mcp.json") ? "--mcp-config" : "--settings", relPath);
+                }
+            }
+            break;
+        case "codex":
+            if (plan.files.some((file) => file.relPath === ".codex/system-prompt.md")) {
+                const original = "model_instructions_file=.codex/system-prompt.md";
+                const index = flags.findIndex((value, at) => value === original && flags[at - 1] === "-c");
+                if (index < 0)
+                    throw new Error("Concurrent codex profile lacks model_instructions_file binding");
+                flags[index] =
+                    `model_instructions_file=${join(revisionWorkspaceDir, ".codex/system-prompt.md")}`;
+                supportedFiles.add(".codex/system-prompt.md");
+            }
+            break;
+        case "kimi-code":
+            if (plan.files.some((file) => file.relPath === ".kimi/mcp.json")) {
+                bindFlagFile("--mcp-config-file", ".kimi/mcp.json");
+            }
+            break;
+        case "opencode": {
+            const runtimeConfig = application.runtimeOnlyFiles["opencode.json"];
+            if (runtimeConfig !== undefined)
+                env.OPENCODE_CONFIG_CONTENT = runtimeConfig;
+            const configFile = plan.files.find((file) => file.relPath === "opencode.json");
+            if (configFile) {
+                env.OPENCODE_CONFIG = join(revisionWorkspaceDir, "opencode.json");
+                env.TANGLE_PROFILE_REVISION_WORKSPACE = revisionWorkspaceDir;
+                supportedFiles.add("opencode.json");
+                const config = JSON.parse(configFile.content);
+                if (Array.isArray(config.instructions)) {
+                    for (const entry of config.instructions) {
+                        const prefix = "{env:TANGLE_PROFILE_REVISION_WORKSPACE}/";
+                        if (typeof entry !== "string" || !entry.startsWith(prefix)) {
+                            throw new Error("Concurrent OpenCode instruction lacks an explicit revision binding");
+                        }
+                        supportedFiles.add(entry.slice(prefix.length));
+                    }
+                }
+            }
+            break;
+        }
+    }
+    for (const file of plan.files) {
+        if (file.source !== "generated") {
+            if (options.secretOpenCodeRevisionCwd &&
+                plan.harness === "opencode" &&
+                (file.root ?? "workspace") === "workspace" &&
+                (file.relPath.startsWith("reference/") ||
+                    file.relPath.startsWith(".opencode/skills/"))) {
+                // The secret launcher uses this immutable revision tree as native cwd.
+                // These content-only resources are therefore visible without writing
+                // into the shared workspace or changing native authority config.
+                continue;
+            }
+            throw new Error(`Concurrent ${plan.harness} profile resource ${file.relPath} needs a shared-workspace collision-safe copy`);
+        }
+        if ((file.root ?? "workspace") !== "workspace" ||
+            !supportedFiles.has(file.relPath)) {
+            throw new Error(`Concurrent ${plan.harness} profile cannot redirect native file ${file.relPath}; use a verified launch control`);
+        }
+    }
+    for (const name of Object.keys(application.runtimeOnlyFiles)) {
+        if (plan.harness !== "opencode" || name !== "opencode.json") {
+            throw new Error(`Concurrent ${plan.harness} profile cannot bind runtime-only file ${name}`);
+        }
+    }
+    return { ...application.spawn, flags, env };
+}

package/dist/managed-workspace-stage.d.ts

@@ -0,0 +1,24 @@
+import { lstatSync } from "node:fs";
+import type { AgentProfileSecretProvider } from "@tangle-network/agent-interface";
+import type { ManagedWorkspaceManifest } from "./managed-workspace-types.js";
+import type { ApplyWorkspacePlanOptions, WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
+export interface PreparedManagedWorkspace {
+    /** Entire profile-owned tree. The caller owns its lifetime through the turn. */
+    root: string;
+    /** Use as the native harness cwd only inside an isolated workspace view. */
+    workspaceDir: string;
+    agentDir: string;
+    manifest: ManagedWorkspaceManifest;
+    application: WorkspacePlanApplication;
+    dispose(): void;
+}
+export declare function assertPrivateManagedRoot(root: string): void;
+/**
+ * Stage one complete plan under an executor-owned reserved root. The ordinary
+ * materializer still resolves secrets and validates/writes every native file;
+ * only its destination changes. A failed stage removes its private files.
+ * The caller must keep the returned tree while an admitted turn uses it and
+ * dispose it after that turn, so a later binding cannot expose old secrets.
+ */
+export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles">): Promise<PreparedManagedWorkspace>;
+export declare function lstatIfPresent(path: string): ReturnType<typeof lstatSync> | null;

package/dist/managed-workspace-stage.js

@@ -0,0 +1,195 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync, } from "node:fs";
+import { basename, dirname, extname, join, resolve, sep } from "node:path";
+import { applyWorkspacePlanWithSecretProvider } from "./plan-application.js";
+import { hashWorkspacePlan } from "./plan-digest.js";
+import { normalizeWorkspaceRelativePath } from "./workspace-files.js";
+export function assertPrivateManagedRoot(root) {
+    if (!root || resolve(root) !== root) {
+        throw new Error("Managed workspace root must be an absolute path");
+    }
+    const rootStat = lstatSync(root);
+    if (!rootStat.isDirectory() ||
+        realpathSync(root) !== root ||
+        (rootStat.mode & 0o077) !== 0 ||
+        rootStat.uid !== process.getuid?.()) {
+        throw new Error("Managed workspace root must be a private real directory");
+    }
+}
+/**
+ * Stage one complete plan under an executor-owned reserved root. The ordinary
+ * materializer still resolves secrets and validates/writes every native file;
+ * only its destination changes. A failed stage removes its private files.
+ * The caller must keep the returned tree while an admitted turn uses it and
+ * dispose it after that turn, so a later binding cannot expose old secrets.
+ */
+export async function prepareManagedWorkspacePlan(plan, managedRoot, sharedWorkspaceDir, secretProvider, options = {}) {
+    assertPrivateManagedRoot(managedRoot);
+    assertSharedWorkspaceRoot(sharedWorkspaceDir);
+    const planDigest = hashWorkspacePlan(plan);
+    const stage = mkdtempSync(join(managedRoot, `plan-${planDigest.slice(7)}-`));
+    const workspaceDir = join(stage, "workspace");
+    const agentDir = join(stage, "agent");
+    try {
+        mkdirSync(workspaceDir);
+        mkdirSync(agentDir);
+        const application = await applyWorkspacePlanWithSecretProvider(plan, workspaceDir, secretProvider, { ...options, agentDir, existingFiles: "reject" });
+        const files = application.receipt.writtenFiles.map((written) => {
+            const path = join(written.root === "agent" ? agentDir : workspaceDir, written.relPath);
+            const stat = lstatSync(path);
+            if (!stat.isFile() || stat.isSymbolicLink()) {
+                throw new Error(`Managed workspace file is not regular: ${written.relPath}`);
+            }
+            const bytes = readFileSync(path);
+            const authored = plan.files.find((file) => (file.root ?? "workspace") === written.root &&
+                normalizeWorkspaceRelativePath(file.relPath) === written.relPath);
+            return {
+                ...written,
+                source: authored?.source,
+                ownership: authored?.ownership,
+                size: bytes.length,
+                mode: stat.mode & 0o777,
+                visible: true,
+                sha256: createHash("sha256").update(bytes).digest("hex"),
+            };
+        });
+        const conflicts = [];
+        for (const file of [...files]) {
+            if (file.root !== "workspace")
+                continue;
+            const reason = sharedPathCollision(sharedWorkspaceDir, file.relPath);
+            if (!reason)
+                continue;
+            const copyRelPath = sideCopyPath(sharedWorkspaceDir, workspaceDir, file.relPath, planDigest, reason);
+            const copyPath = join(workspaceDir, copyRelPath);
+            mkdirSync(dirname(copyPath), { recursive: true });
+            copyFileSync(join(workspaceDir, file.relPath), copyPath);
+            const copyStat = lstatSync(copyPath);
+            const copyBytes = readFileSync(copyPath);
+            file.visible = false;
+            files.push({
+                ...file,
+                relPath: copyRelPath,
+                relocatedFrom: file.relPath,
+                size: copyBytes.length,
+                mode: copyStat.mode & 0o777,
+                visible: true,
+                sha256: createHash("sha256").update(copyBytes).digest("hex"),
+            });
+            conflicts.push({ relPath: file.relPath, copyRelPath, reason });
+        }
+        files.sort((left, right) => `${left.root}:${left.relPath}`.localeCompare(`${right.root}:${right.relPath}`));
+        conflicts.sort((left, right) => left.relPath.localeCompare(right.relPath));
+        const runtimeOnlyFiles = Object.entries(application.runtimeOnlyFiles)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, content]) => ({
+            name,
+            size: Buffer.byteLength(content),
+            sha256: createHash("sha256").update(content).digest("hex"),
+        }));
+        const spawnDigest = createHash("sha256")
+            .update(JSON.stringify(application.spawn))
+            .digest("hex");
+        const materializedDigest = `sha256:${createHash("sha256")
+            .update(JSON.stringify({
+            planDigest,
+            files,
+            conflicts,
+            runtimeOnlyFiles,
+            spawnDigest,
+        }))
+            .digest("hex")}`;
+        const manifest = {
+            workspacePlanDigest: planDigest,
+            materializedDigest,
+            files,
+            conflicts,
+            runtimeOnlyFiles,
+            spawnDigest,
+        };
+        writeFileSync(join(stage, "manifest.json"), JSON.stringify(manifest), {
+            mode: 0o600,
+            flag: "wx",
+        });
+        return {
+            root: stage,
+            workspaceDir,
+            agentDir,
+            manifest,
+            application,
+            dispose: () => rmSync(stage, { recursive: true, force: true }),
+        };
+    }
+    catch (error) {
+        rmSync(stage, { recursive: true, force: true });
+        throw error;
+    }
+}
+export function lstatIfPresent(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function assertSharedWorkspaceRoot(root) {
+    if (!root ||
+        resolve(root) !== root ||
+        !lstatSync(root).isDirectory() ||
+        realpathSync(root) !== root) {
+        throw new Error("Shared workspace must be an absolute real directory");
+    }
+}
+function sharedPathCollision(root, relPath) {
+    const target = resolve(root, relPath);
+    if (target !== root && !target.startsWith(`${root}${sep}`)) {
+        throw new Error(`Profile path escapes shared workspace: ${relPath}`);
+    }
+    let cursor = root;
+    const segments = relPath.split(/[\\/]+/);
+    for (const [index, segment] of segments.entries()) {
+        cursor = join(cursor, segment);
+        const stat = lstatIfPresent(cursor);
+        if (!stat)
+            return null;
+        if (stat.isSymbolicLink())
+            return "symlink";
+        if (index < segments.length - 1 && !stat.isDirectory())
+            return "existing";
+    }
+    return "existing";
+}
+function sideCopyPath(sharedRoot, stagedRoot, relPath, planDigest, reason) {
+    const ancestor = reason === "symlink" ? firstSymlinkAncestor(sharedRoot, relPath) : null;
+    const neighbor = ancestor
+        ? join(dirname(ancestor), `${basename(ancestor)}.${relPath.slice(ancestor.length + 1).replace(/[\\/]+/g, ".")}`)
+        : relPath;
+    const name = basename(neighbor);
+    const extension = extname(name);
+    const stem = name.slice(0, name.length - extension.length);
+    for (let attempt = 0; attempt < 100; attempt++) {
+        const suffix = attempt ? `-${attempt}` : "";
+        const candidate = join(dirname(neighbor), `${stem}.profile-${planDigest.slice(7, 19)}${suffix}${extension}`);
+        if (!lstatIfPresent(join(stagedRoot, candidate)) &&
+            !sharedPathCollision(sharedRoot, candidate)) {
+            return candidate;
+        }
+    }
+    throw new Error(`No unused profile copy path beside ${relPath}`);
+}
+function firstSymlinkAncestor(root, relPath) {
+    const segments = relPath.split(/[\\/]+/);
+    let cursor = root;
+    for (const [index, segment] of segments.entries()) {
+        if (index === segments.length - 1)
+            break;
+        cursor = join(cursor, segment);
+        if (lstatIfPresent(cursor)?.isSymbolicLink()) {
+            return segments.slice(0, index + 1).join(sep);
+        }
+    }
+    return null;
+}

package/dist/managed-workspace-types.d.ts

@@ -0,0 +1,38 @@
+import type { PlanFile, PlanFileRoot } from "./plan-types.js";
+export interface ManagedWorkspaceFileDigest {
+    root: PlanFileRoot;
+    relPath: string;
+    source: PlanFile["source"];
+    ownership: PlanFile["ownership"];
+    size: number;
+    mode: number;
+    /** The host view exposes only visible entries for this pinned turn. */
+    visible: boolean;
+    /** A side copy of this original path, when a user file won the collision. */
+    relocatedFrom?: string;
+    /** Digest of the actual staged bytes, including resolved secret leaves. Private. */
+    sha256: string;
+}
+/** Private executor inventory; never expose hashes of resolved credentials. */
+export interface ManagedWorkspaceManifest {
+    workspacePlanDigest: string;
+    /** Hashes the resolved stage inventory and launch inputs, not only public refs. */
+    materializedDigest: string;
+    files: ManagedWorkspaceFileDigest[];
+    /** User-owned path stays in place; profile bytes are staged beside it. */
+    conflicts: Array<{
+        relPath: string;
+        copyRelPath: string;
+        reason: "existing" | "symlink";
+    }>;
+    /** Resolved for the runtime but intentionally absent from the visible tree. */
+    runtimeOnlyFiles: Array<{
+        name: string;
+        size: number;
+        sha256: string;
+    }>;
+    /** Private digest of resolved spawn controls, including secret-bearing env. */
+    spawnDigest: string;
+    /** Exact native spawn controls after absolute revision paths are bound. */
+    launchDigest?: string;
+}

package/dist/managed-workspace-types.js

@@ -0,0 +1 @@
+export {};

package/dist/managed-workspace.d.ts

@@ -0,0 +1,37 @@
+import type { AgentProfileSecretProvider } from "@tangle-network/agent-interface";
+import type { ManagedWorkspaceManifest } from "./managed-workspace-types.js";
+import type { ApplyWorkspacePlanOptions, WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
+export type { ManagedWorkspaceFileDigest, ManagedWorkspaceManifest, } from "./managed-workspace-types.js";
+/** A private, write-once revision and the exact inputs for one native spawn. */
+export interface ConcurrentProfileRevision {
+    directory: string;
+    manifest: ManagedWorkspaceManifest;
+    application: WorkspacePlanApplication;
+}
+/** Create the two executor-owned roots on one filesystem. */
+export declare function ensurePublicConcurrentProfileRoots(base: string): {
+    managedRoot: string;
+    launchRoot: string;
+};
+/**
+ * Materialize PUBLIC profile material beside the shared workspace. Processes
+ * in one sandbox share a uid and can read each other's revision files and env.
+ * Callers must not use this path for confidential profile text or credentials.
+ * Only native controls with a verified explicit launch path are admitted.
+ * A separate reaper owns removal after no native process reads the revision.
+ */
+export declare function preparePublicConcurrentProfileRevision(input: {
+    plan: WorkspacePlan;
+    managedRoot: string;
+    /** Root-owned, agent-traversable publication root on the same filesystem. */
+    launchRoot: string;
+    sharedWorkspaceDir: string;
+    ownerId: string;
+    secretProvider: AgentProfileSecretProvider;
+    options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles">;
+}): Promise<ConcurrentProfileRevision>;
+/** Move OpenCode's cwd-discovered primary agent into its explicit JSON config. */
+export declare function prepareExplicitOpenCodePlan(plan: WorkspacePlan): WorkspacePlan;
+export declare function listRevisionFiles(root: string, prefix?: string): string[];
+export declare function assertLaunchRoot(root: string): void;
+export declare function makeStageWritable(root: string): void;

package/dist/managed-workspace.js

@@ -0,0 +1,283 @@
+import { createHash } from "node:crypto";
+import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, writeFileSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
+import { assertPrivateManagedRoot, lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
+import { assertWorkspacePlanSupported } from "./plan-support.js";
+/** Create the two executor-owned roots on one filesystem. */
+export function ensurePublicConcurrentProfileRoots(base) {
+    if (process.getuid?.() !== 0 || !base || resolve(base) !== base) {
+        throw new Error("Concurrent profile roots require an absolute path and a root executor");
+    }
+    if (!lstatIfPresent(base)) {
+        mkdirSync(base, { mode: 0o711 });
+        chmodSync(base, 0o711);
+    }
+    const managedRoot = join(base, "private");
+    const launchRoot = join(base, "launch");
+    if (!lstatIfPresent(managedRoot))
+        mkdirSync(managedRoot, { mode: 0o700 });
+    if (!lstatIfPresent(launchRoot)) {
+        mkdirSync(launchRoot, { mode: 0o711 });
+        chmodSync(launchRoot, 0o711);
+    }
+    assertPrivateManagedRoot(managedRoot);
+    assertLaunchRoot(launchRoot);
+    const baseStat = lstatSync(base);
+    if (!baseStat.isDirectory() ||
+        baseStat.isSymbolicLink() ||
+        realpathSync(base) !== base ||
+        baseStat.uid !== 0 ||
+        (baseStat.mode & 0o777) !== 0o711) {
+        throw new Error("Concurrent profile base must be a root-owned 0711 real directory");
+    }
+    return { managedRoot, launchRoot };
+}
+/**
+ * Materialize PUBLIC profile material beside the shared workspace. Processes
+ * in one sandbox share a uid and can read each other's revision files and env.
+ * Callers must not use this path for confidential profile text or credentials.
+ * Only native controls with a verified explicit launch path are admitted.
+ * A separate reaper owns removal after no native process reads the revision.
+ */
+export async function preparePublicConcurrentProfileRevision(input) {
+    if (!input.ownerId)
+        throw new Error("Concurrent profile revision needs a binding owner");
+    if (input.options?.ownership) {
+        throw new Error("Concurrent profile files must remain executor-owned and read-only");
+    }
+    if (input.plan.files.some((file) => (file.secretSlots?.length ?? 0) > 0) ||
+        Object.values(input.plan.env).some((value) => typeof value !== "string") ||
+        input.plan.flags.some((value) => typeof value !== "string")) {
+        throw new Error("Concurrent profile secrets need per-profile process identity; this sandbox has one subprocess identity");
+    }
+    const plan = prepareExplicitOpenCodePlan(input.plan);
+    assertWorkspacePlanSupported(plan);
+    assertLaunchRoot(input.launchRoot);
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, input.options);
+    try {
+        const identity = createHash("sha256")
+            .update(`${input.ownerId}\0${prepared.manifest.materializedDigest}`)
+            .digest("hex");
+        const directory = join(input.launchRoot, `revision-${identity}`);
+        // Validate every native file before publishing a revision that a launcher
+        // could mistake for a complete profile.
+        const spawn = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"));
+        prepared.manifest.launchDigest = createHash("sha256")
+            .update(JSON.stringify(spawn))
+            .digest("hex");
+        writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
+        const existing = lstatIfPresent(directory);
+        if (existing) {
+            assertPublishedRevision(directory, prepared.manifest);
+            prepared.dispose();
+        }
+        else {
+            try {
+                // Keep the top directory private and writable for rename. The child
+                // tree is complete and read-only before publication.
+                makeRevisionReadOnly(prepared.root, false);
+                renameSync(prepared.root, directory);
+                // This is the publication point: agents cannot traverse the root
+                // before its mode changes from 0700 to 0555.
+                chmodSync(directory, 0o555);
+            }
+            catch (error) {
+                const raced = lstatIfPresent(directory);
+                if (!raced?.isDirectory() || raced.isSymbolicLink())
+                    throw error;
+                assertPublishedRevision(directory, prepared.manifest);
+                makeStageWritable(prepared.root);
+                prepared.dispose();
+            }
+        }
+        return {
+            directory,
+            manifest: prepared.manifest,
+            application: { ...prepared.application, spawn },
+        };
+    }
+    catch (error) {
+        // A published revision is never removed here; only an unpublished stage is.
+        if (lstatIfPresent(prepared.root)) {
+            makeStageWritable(prepared.root);
+            prepared.dispose();
+        }
+        throw error;
+    }
+}
+/** Move OpenCode's cwd-discovered primary agent into its explicit JSON config. */
+export function prepareExplicitOpenCodePlan(plan) {
+    if (plan.harness !== "opencode")
+        return plan;
+    for (const name of [
+        "OPENCODE_CONFIG",
+        "OPENCODE_CONFIG_CONTENT",
+        "TANGLE_PROFILE_REVISION_WORKSPACE",
+    ]) {
+        if (Object.hasOwn(plan.env, name)) {
+            throw new Error(`Concurrent OpenCode reserves ${name} for its launch binding`);
+        }
+    }
+    const configFile = plan.files.find((file) => file.relPath === "opencode.json");
+    if (configFile?.source !== "generated" ||
+        (configFile.root ?? "workspace") !== "workspace") {
+        throw new Error("Concurrent OpenCode requires a generated opencode.json");
+    }
+    const config = JSON.parse(configFile.content);
+    if (!config || typeof config !== "object" || Array.isArray(config)) {
+        throw new Error("Concurrent OpenCode config must be an object");
+    }
+    const body = config;
+    let files = [...plan.files];
+    if (plan.systemPrompt !== undefined) {
+        const agentFlag = plan.flags.indexOf("--agent");
+        const agentName = plan.flags[agentFlag + 1];
+        if (agentFlag < 0 ||
+            typeof agentName !== "string" ||
+            !/^tangle-profile-[a-f0-9]{16}$/.test(agentName)) {
+            throw new Error("Concurrent OpenCode requires the materializer's primary agent selection");
+        }
+        const primaryPath = `.opencode/agents/${agentName}.md`;
+        const primary = files.find((file) => file.relPath === primaryPath);
+        if (primary?.source !== "generated" ||
+            (primary.root ?? "workspace") !== "workspace") {
+            throw new Error("Concurrent OpenCode primary agent must be generated");
+        }
+        files = files.filter((file) => file !== primary);
+        const agents = body.agent;
+        if (agents !== undefined &&
+            (typeof agents !== "object" || agents === null || Array.isArray(agents))) {
+            throw new Error("Concurrent OpenCode agent config must be an object");
+        }
+        if (agents && Object.hasOwn(agents, agentName)) {
+            throw new Error("Concurrent OpenCode primary agent collides with config");
+        }
+        body.agent = {
+            ...agents,
+            [agentName]: { mode: "primary", prompt: plan.systemPrompt },
+        };
+    }
+    const instructions = body.instructions;
+    if (instructions !== undefined) {
+        if (!Array.isArray(instructions) ||
+            instructions.some((entry) => typeof entry !== "string")) {
+            throw new Error("Concurrent OpenCode instructions must be generated file paths");
+        }
+        body.instructions = instructions.map((relPath) => {
+            const file = files.find((candidate) => candidate.relPath === relPath);
+            if (file?.source !== "generated" ||
+                (file.root ?? "workspace") !== "workspace") {
+                throw new Error(`Concurrent OpenCode cannot redirect instruction ${relPath}`);
+            }
+            return `{env:TANGLE_PROFILE_REVISION_WORKSPACE}/${relPath}`;
+        });
+    }
+    return {
+        ...plan,
+        files: files.map((file) => file === configFile ? { ...file, content: JSON.stringify(body) } : file),
+    };
+}
+function assertPublishedRevision(directory, expected) {
+    const root = lstatSync(directory);
+    if (!root.isDirectory() ||
+        root.isSymbolicLink() ||
+        (root.mode & 0o777) !== 0o555) {
+        throw new Error("Concurrent profile revision is not fully published");
+    }
+    const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
+    if (persisted.materializedDigest !== expected.materializedDigest ||
+        persisted.launchDigest !== expected.launchDigest) {
+        throw new Error("Concurrent profile revision digest collision");
+    }
+    for (const file of expected.files) {
+        const path = join(directory, file.root, file.relPath);
+        const stat = lstatSync(path);
+        if (!stat.isFile() ||
+            stat.isSymbolicLink() ||
+            (stat.mode & 0o222) !== 0 ||
+            createHash("sha256").update(readFileSync(path)).digest("hex") !==
+                file.sha256) {
+            throw new Error(`Concurrent profile revision file changed: ${file.relPath}`);
+        }
+    }
+    const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
+    for (const rootName of ["workspace", "agent"]) {
+        for (const relPath of listRevisionFiles(join(directory, rootName))) {
+            if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
+                throw new Error(`Concurrent profile revision has an unexpected file: ${rootName}/${relPath}`);
+            }
+        }
+    }
+    if (expectedPaths.size) {
+        throw new Error("Concurrent profile revision is missing a manifest file");
+    }
+}
+export function listRevisionFiles(root, prefix = "") {
+    const found = [];
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory())
+            found.push(...listRevisionFiles(join(root, entry.name), relPath));
+        else if (entry.isFile())
+            found.push(relPath);
+        else
+            throw new Error(`Concurrent profile revision has a non-regular path: ${relPath}`);
+    }
+    return found;
+}
+export function assertLaunchRoot(root) {
+    if (!root || resolve(root) !== root) {
+        throw new Error("Concurrent profile launch root must be absolute");
+    }
+    const stat = lstatSync(root);
+    if (!stat.isDirectory() ||
+        stat.isSymbolicLink() ||
+        realpathSync(root) !== root ||
+        (stat.mode & 0o022) !== 0 ||
+        (stat.mode & 0o111) !== 0o111 ||
+        stat.uid !== process.getuid?.()) {
+        throw new Error("Concurrent profile launch root must be executor-owned, real, traversable, and not writable by agent users");
+    }
+    let ancestor = dirname(root);
+    while (ancestor !== root) {
+        const ancestorStat = lstatSync(ancestor);
+        if (!ancestorStat.isDirectory() ||
+            ancestorStat.isSymbolicLink() ||
+            (ancestorStat.mode & 0o001) === 0) {
+            throw new Error(`Concurrent profile launch root has a non-traversable ancestor: ${ancestor}`);
+        }
+        if (ancestor === dirname(ancestor))
+            break;
+        ancestor = dirname(ancestor);
+    }
+}
+function makeRevisionReadOnly(root, publishRoot = true) {
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory()) {
+            makeRevisionReadOnly(path);
+        }
+        else if (entry.isFile()) {
+            const mode = lstatSync(path).mode & 0o111;
+            chmodSync(path, mode ? 0o555 : 0o444);
+        }
+        else {
+            throw new Error(`Concurrent profile revision contains a non-regular path: ${entry.name}`);
+        }
+    }
+    if (publishRoot)
+        chmodSync(root, 0o555);
+}
+export function makeStageWritable(root) {
+    if (!lstatIfPresent(root))
+        return;
+    chmodSync(root, 0o700);
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory())
+            makeStageWritable(path);
+        else if (entry.isFile())
+            chmodSync(path, 0o600);
+    }
+}

package/dist/profile-materializer.d.ts

@@ -11,7 +11,7 @@ export declare const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER: AgentProfileSecr
  * user's turn materializes it. Controls a harness cannot enforce are not
  * contradictions: `resources.failOnError` decides those per turn.
  */
-export declare function executionControlConflict(profile: Pick<AgentProfile, "tools" | "permissions">, harness: HarnessId): string | undefined;
+export declare function executionControlConflict(profile: Pick<AgentProfile, "tools" | "permissions" | "mcp">, harness: HarnessId): string | undefined;
 /**
  * Build a pure workspace plan for one canonical harness.
  * The caller applies files, environment, and flags at its process boundary.

package/dist/profile-materializer.js

@@ -26,7 +26,7 @@ export const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER = Object.freeze({
 export function executionControlConflict(profile, harness) {
     const builder = createProfilePlanBuilder(harness);
     try {
-        materializeExecutionControls(harness, profile.tools, profile.permissions, undefined, builder.plan, builder.add, builder.unsupported);
+        materializeExecutionControls(harness, profile.tools, profile.permissions, undefined, builder.plan, builder.add, builder.unsupported, Object.keys(activeMcpServers(profile.mcp)));
     }
     catch (error) {
         return error instanceof Error ? error.message : String(error);
@@ -53,7 +53,7 @@ export function materializeProfile(inputProfile, harness, opts = {}) {
     const builder = createProfilePlanBuilder(harness);
     lowerProfileResources(profile, harness, builder);
     lowerProfilePrompt(profile, harness, binds, instructionsRoot, builder);
-    materializeExecutionControls(harness, profile.tools, profile.permissions, profile.modes, builder.plan, builder.add, builder.unsupported);
+    materializeExecutionControls(harness, profile.tools, profile.permissions, profile.modes, builder.plan, builder.add, builder.unsupported, skip.has("mcp") ? [] : Object.keys(activeMcpServers(profile.mcp)));
     if ((profile.connections?.length ?? 0) > 0) {
         builder.unsupported("connections", `${harness}: Hub connections must be resolved to authorized MCP servers by the execution runtime`);
     }

package/dist/secret-concurrent-revision.d.ts

@@ -0,0 +1,21 @@
+import type { AgentProfileSecretProvider } from "@tangle-network/agent-interface";
+import { type ConcurrentProfileRevision } from "./managed-workspace.js";
+import type { ApplyWorkspacePlanOptions, WorkspacePlan } from "./plan-types.js";
+/**
+ * Publish a resolved revision for exactly one native subprocess UID. The
+ * executor-owned naming key hides low-entropy credential guesses from paths;
+ * the resolved digest and manifest never leave this server-side result.
+ */
+export declare function prepareSecretConcurrentProfileRevision(input: {
+    plan: WorkspacePlan;
+    /** Trusted executor transport only; never read from the mutable native HOME. */
+    providerConfig?: Record<string, unknown>;
+    managedRoot: string;
+    launchRoot: string;
+    sharedWorkspaceDir: string;
+    ownerId: string;
+    subprocessUid: number;
+    namingKey: Uint8Array;
+    secretProvider: AgentProfileSecretProvider;
+    options?: Pick<ApplyWorkspacePlanOptions, "runtimeOnlyFiles">;
+}): Promise<ConcurrentProfileRevision>;

package/dist/secret-concurrent-revision.js

@@ -0,0 +1,180 @@
+import { execFileSync } from "node:child_process";
+import { createHash, createHmac } from "node:crypto";
+import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { assertLaunchRoot, listRevisionFiles, makeStageWritable, prepareExplicitOpenCodePlan, } from "./managed-workspace.js";
+import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
+import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
+import { assertWorkspacePlanSupported } from "./plan-support.js";
+/**
+ * Publish a resolved revision for exactly one native subprocess UID. The
+ * executor-owned naming key hides low-entropy credential guesses from paths;
+ * the resolved digest and manifest never leave this server-side result.
+ */
+export async function prepareSecretConcurrentProfileRevision(input) {
+    if (process.platform !== "linux" ||
+        process.getuid?.() !== 0 ||
+        !Number.isSafeInteger(input.subprocessUid) ||
+        input.subprocessUid < 200_000 ||
+        input.namingKey.length !== 32 ||
+        !input.ownerId) {
+        throw new Error("Secret concurrent profile needs a root executor and reserved identity");
+    }
+    let plan = prepareExplicitOpenCodePlan(input.plan);
+    if (input.providerConfig) {
+        plan = {
+            ...plan,
+            files: plan.files.map((file) => file.relPath === "opencode.json" &&
+                file.source === "generated" &&
+                (file.root ?? "workspace") === "workspace"
+                ? {
+                    ...file,
+                    content: JSON.stringify({
+                        ...JSON.parse(file.content),
+                        provider: input.providerConfig,
+                    }),
+                }
+                : file),
+        };
+    }
+    if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
+        throw new Error("Secret OpenCode reserves its native config directory");
+    }
+    assertWorkspacePlanSupported(plan);
+    assertLaunchRoot(input.launchRoot);
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, input.options);
+    try {
+        // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
+        // An agent-owned HOME may hold SQLite state, never native authority.
+        mkdirSync(join(prepared.root, "workspace", ".config", "opencode"), {
+            recursive: true,
+            mode: 0o700,
+        });
+        const identity = createHmac("sha256", input.namingKey)
+            .update(input.ownerId)
+            .update("\0")
+            .update(String(input.subprocessUid))
+            .update("\0")
+            .update(prepared.manifest.materializedDigest)
+            .digest("hex");
+        const directory = join(input.launchRoot, `revision-${identity}`);
+        const spawn = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretOpenCodeRevisionCwd: true });
+        prepared.manifest.launchDigest = createHash("sha256")
+            .update(JSON.stringify(spawn))
+            .digest("hex");
+        writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
+        const existing = lstatIfPresent(directory);
+        if (existing) {
+            assertPublishedSecretRevision(directory, prepared.manifest);
+            prepared.dispose();
+        }
+        else {
+            try {
+                makeSecretRevisionReadOnly(prepared.root, input.subprocessUid);
+                renameSync(prepared.root, directory);
+            }
+            catch (error) {
+                const raced = lstatIfPresent(directory);
+                if (!raced?.isDirectory() || raced.isSymbolicLink())
+                    throw error;
+                assertPublishedSecretRevision(directory, prepared.manifest);
+                makeStageWritable(prepared.root);
+                prepared.dispose();
+            }
+        }
+        return {
+            directory,
+            manifest: prepared.manifest,
+            application: { ...prepared.application, spawn },
+        };
+    }
+    catch (error) {
+        if (lstatIfPresent(prepared.root)) {
+            makeStageWritable(prepared.root);
+            prepared.dispose();
+        }
+        throw error;
+    }
+}
+function secretRevisionPaths(root) {
+    const all = [root];
+    const exposed = [root];
+    const walk = (directory) => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const child = join(directory, entry.name);
+            const stat = lstatSync(child);
+            if (stat.uid !== 0 || stat.isSymbolicLink()) {
+                throw new Error("Secret concurrent profile stage contains an untrusted inode");
+            }
+            if (!stat.isDirectory() && !stat.isFile()) {
+                throw new Error("Secret concurrent profile stage contains a special file");
+            }
+            all.push(child);
+            if (entry.name !== "manifest.json" || directory !== root) {
+                exposed.push(child);
+            }
+            if (stat.isDirectory())
+                walk(child);
+        }
+    };
+    walk(root);
+    return { all, exposed };
+}
+function runSetfacl(args, paths) {
+    for (let start = 0; start < paths.length; start += 64) {
+        execFileSync("/usr/bin/setfacl", [...args, "--", ...paths.slice(start, start + 64)], {
+            env: { PATH: "/usr/bin:/bin", LANG: "C" },
+            timeout: 30_000,
+            stdio: "pipe",
+        });
+    }
+}
+function makeSecretRevisionReadOnly(root, uid) {
+    const paths = secretRevisionPaths(root);
+    // Remove inherited named ACLs before widening the ACL mask for this UID.
+    runSetfacl(["-b"], paths.all);
+    for (const path of paths.all) {
+        const stat = lstatSync(path);
+        chmodSync(path, stat.isDirectory() ? 0o500 : stat.mode & 0o111 ? 0o500 : 0o400);
+    }
+    // The private manifest has resolved-file hashes. The CLI can read its native
+    // files, but never the executor inventory or another revision's files.
+    runSetfacl(["-m", `u:${uid}:r-X`], paths.exposed);
+}
+function assertPublishedSecretRevision(directory, expected) {
+    const root = lstatSync(directory);
+    if (!root.isDirectory() ||
+        root.isSymbolicLink() ||
+        root.uid !== 0 ||
+        (root.mode & 0o222) !== 0) {
+        throw new Error("Secret concurrent profile revision is not immutable");
+    }
+    const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
+    if (persisted.materializedDigest !== expected.materializedDigest ||
+        persisted.launchDigest !== expected.launchDigest) {
+        throw new Error("Secret concurrent profile revision digest collision");
+    }
+    for (const file of expected.files) {
+        const filePath = join(directory, file.root, file.relPath);
+        const stat = lstatSync(filePath);
+        if (!stat.isFile() ||
+            stat.isSymbolicLink() ||
+            stat.uid !== 0 ||
+            (stat.mode & 0o222) !== 0 ||
+            createHash("sha256").update(readFileSync(filePath)).digest("hex") !==
+                file.sha256) {
+            throw new Error("Secret concurrent profile revision file changed");
+        }
+    }
+    const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
+    for (const rootName of ["workspace", "agent"]) {
+        for (const relPath of listRevisionFiles(join(directory, rootName))) {
+            if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
+                throw new Error("Secret concurrent profile revision has an unexpected file");
+            }
+        }
+    }
+    if (expectedPaths.size) {
+        throw new Error("Secret concurrent profile revision is missing a manifest file");
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {