@tangle-network/agent-profile-materialize 0.22.0 → 0.22.1

package/dist/control-maps.d.ts

@@ -6,6 +6,11 @@ export declare const OPENCODE_NATIVE_TOOL_IDS: readonly ["apply_patch", "bash",
 export declare function openCodeNativeToolId(name: string): string | undefined;
 export declare function openCodeToolName(name: string): string | undefined;
 export declare function openCodePermissionName(name: string): string | undefined;
+/** OpenCode 1.x registers MCP tools as sanitized server + "_" + tool.
+ * Accept exact tools and a server-wide rule only for this profile's servers.
+ * A generic permission spelling must never become a grant to an undeclared MCP.
+ */
+export declare function openCodeDeclaredMcpPermissionName(name: string, aliases: readonly string[]): string | undefined;
 export declare const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution-controls.ts";
 /**
  * Translate only portable spellings whose Pi equivalent differs.

package/dist/control-maps.js

@@ -68,6 +68,8 @@ export function openCodeToolName(name) {
     return openCodeNativeToolId(name);
 }
 export function openCodePermissionName(name) {
+    if (name.includes("*") || name.includes("?"))
+        return undefined;
     const normalized = normalizedControlName(name);
     if (["write", "edit"].includes(normalized))
         return "edit";
@@ -83,6 +85,36 @@ export function openCodePermissionName(name) {
         ? normalized
         : undefined;
 }
+/** OpenCode 1.x registers MCP tools as sanitized server + "_" + tool.
+ * Accept exact tools and a server-wide rule only for this profile's servers.
+ * A generic permission spelling must never become a grant to an undeclared MCP.
+ */
+export function openCodeDeclaredMcpPermissionName(name, aliases) {
+    const servers = aliases.map((alias) => ({
+        alias,
+        native: alias.replace(/[^a-zA-Z0-9_-]/g, "_"),
+    }));
+    const matches = servers.filter(({ native }) => name.startsWith(`${native}_`));
+    const match = matches[0];
+    if (!match)
+        return undefined;
+    const { native } = match;
+    const tool = name.slice(native.length + 1);
+    if (tool !== "*" && !/^[a-zA-Z0-9_-]+$/.test(tool))
+        return undefined;
+    // Colliding or nested prefixes cannot identify one server's authority:
+    // foo_* also matches foo_bar_read, including a server named foo_bar.
+    if (matches.length !== 1 ||
+        servers.some((server) => server !== matches[0] &&
+            (server.native.startsWith(`${native}_`) ||
+                native.startsWith(`${server.native}_`)))) {
+        throw new Error(`opencode: ambiguous declared MCP permission "${name}"`);
+    }
+    if (tool !== "*" && openCodePermissionName(name) !== undefined) {
+        throw new Error(`opencode: permission "${name}" names both a native and MCP tool`);
+    }
+    return name;
+}
 export const PI_EXECUTION_CONTROL_EXTENSION_PATH = ".tangle/pi-execution-controls.ts";
 /**
  * Translate only portable spellings whose Pi equivalent differs.

package/dist/execution-controls.d.ts

@@ -1,4 +1,4 @@
-export declare function materializeExecutionControls(h: HarnessId, tools: Record<string, boolean> | undefined, permissions: Record<string, AgentProfilePermission> | undefined, modes: AgentProfile["modes"], plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void): void;
+export declare function materializeExecutionControls(h: HarnessId, tools: Record<string, boolean> | undefined, permissions: Record<string, AgentProfilePermission> | undefined, modes: AgentProfile["modes"], plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void, mcpAliases?: readonly string[]): void;
 import type { AgentProfile, AgentProfilePermission } from "@tangle-network/agent-interface";
 import type { HarnessId } from "./harness.js";
 import type { AddPlanFile } from "./plan-json.js";

package/dist/execution-controls.js

@@ -1,4 +1,4 @@
-export function materializeExecutionControls(h, tools, permissions, modes, plan, add, unsupported) {
+export function materializeExecutionControls(h, tools, permissions, modes, plan, add, unsupported, mcpAliases = []) {
     const toolEntries = Object.entries(tools ?? {}).sort(([left], [right]) => compareStrings(left, right));
     const permissionEntries = Object.entries(permissions ?? {}).sort(([left], [right]) => compareStrings(left, right));
     switch (h) {
@@ -33,7 +33,8 @@ export function materializeExecutionControls(h, tools, permissions, modes, plan,
                 return false;
             });
             const nativeTools = mapSupportedBooleanEntries(enforceableTools, openCodeToolName, (name) => unsupported("tools", `opencode: no verified native tool mapping for "${name}"`));
-            const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, openCodePermissionName, (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
+            const nativePermissions = mapSupportedPermissionEntries(enforceablePermissions, (name) => openCodeDeclaredMcpPermissionName(name, mcpAliases) ??
+                openCodePermissionName(name), (name) => unsupported("permissions", `opencode: no verified native permission mapping for "${name}"`), "opencode permission");
             if (enforceableTools.length > 0 || permissionEntries.length > 0) {
                 add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
                     $schema: OPENCODE_CONFIG_SCHEMA,
@@ -183,7 +184,7 @@ function piExecutionControlExtensionSource(enabledTools, excludedTools) {
     ].join("\n");
 }
 import { resolveNativeWebTools } from "@tangle-network/agent-interface";
-import { claudePermissionRules, claudeToolName, mapSupportedBooleanEntries, mapSupportedPermissionEntries, normalizedControlName, openCodePermissionName, openCodeToolName, PI_EXECUTION_CONTROL_EXTENSION_PATH, permissionAllowsEverything, piToolId, sealClaudePermissionRules, } from "./control-maps.js";
+import { claudePermissionRules, claudeToolName, mapSupportedBooleanEntries, mapSupportedPermissionEntries, normalizedControlName, openCodeDeclaredMcpPermissionName, openCodePermissionName, openCodeToolName, PI_EXECUTION_CONTROL_EXTENSION_PATH, permissionAllowsEverything, piToolId, sealClaudePermissionRules, } from "./control-maps.js";
 import { CLAUDE_SETTINGS_PATH, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, } from "./harness.js";
 import { registerClaudeSettings } from "./hooks.js";
 import { serializeWorkspacePlanJson } from "./plan-json.js";

package/dist/profile-materializer.d.ts

@@ -11,7 +11,7 @@ export declare const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER: AgentProfileSecr
  * user's turn materializes it. Controls a harness cannot enforce are not
  * contradictions: `resources.failOnError` decides those per turn.
  */
-export declare function executionControlConflict(profile: Pick<AgentProfile, "tools" | "permissions">, harness: HarnessId): string | undefined;
+export declare function executionControlConflict(profile: Pick<AgentProfile, "tools" | "permissions" | "mcp">, harness: HarnessId): string | undefined;
 /**
  * Build a pure workspace plan for one canonical harness.
  * The caller applies files, environment, and flags at its process boundary.

package/dist/profile-materializer.js

@@ -26,7 +26,7 @@ export const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER = Object.freeze({
 export function executionControlConflict(profile, harness) {
     const builder = createProfilePlanBuilder(harness);
     try {
-        materializeExecutionControls(harness, profile.tools, profile.permissions, undefined, builder.plan, builder.add, builder.unsupported);
+        materializeExecutionControls(harness, profile.tools, profile.permissions, undefined, builder.plan, builder.add, builder.unsupported, Object.keys(activeMcpServers(profile.mcp)));
     }
     catch (error) {
         return error instanceof Error ? error.message : String(error);
@@ -53,7 +53,7 @@ export function materializeProfile(inputProfile, harness, opts = {}) {
     const builder = createProfilePlanBuilder(harness);
     lowerProfileResources(profile, harness, builder);
     lowerProfilePrompt(profile, harness, binds, instructionsRoot, builder);
-    materializeExecutionControls(harness, profile.tools, profile.permissions, profile.modes, builder.plan, builder.add, builder.unsupported);
+    materializeExecutionControls(harness, profile.tools, profile.permissions, profile.modes, builder.plan, builder.add, builder.unsupported, skip.has("mcp") ? [] : Object.keys(activeMcpServers(profile.mcp)));
     if ((profile.connections?.length ?? 0) > 0) {
         builder.unsupported("connections", `${harness}: Hub connections must be resolved to authorized MCP servers by the execution runtime`);
     }

package/dist/secret-concurrent-revision.d.ts

@@ -8,6 +8,8 @@ import type { ApplyWorkspacePlanOptions, WorkspacePlan } from "./plan-types.js";
  */
 export declare function prepareSecretConcurrentProfileRevision(input: {
     plan: WorkspacePlan;
+    /** Trusted executor transport only; never read from the mutable native HOME. */
+    providerConfig?: Record<string, unknown>;
     managedRoot: string;
     launchRoot: string;
     sharedWorkspaceDir: string;

package/dist/secret-concurrent-revision.js

@@ -20,7 +20,23 @@ export async function prepareSecretConcurrentProfileRevision(input) {
         !input.ownerId) {
         throw new Error("Secret concurrent profile needs a root executor and reserved identity");
     }
-    const plan = prepareExplicitOpenCodePlan(input.plan);
+    let plan = prepareExplicitOpenCodePlan(input.plan);
+    if (input.providerConfig) {
+        plan = {
+            ...plan,
+            files: plan.files.map((file) => file.relPath === "opencode.json" &&
+                file.source === "generated" &&
+                (file.root ?? "workspace") === "workspace"
+                ? {
+                    ...file,
+                    content: JSON.stringify({
+                        ...JSON.parse(file.content),
+                        provider: input.providerConfig,
+                    }),
+                }
+                : file),
+        };
+    }
     if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
         throw new Error("Secret OpenCode reserves its native config directory");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {