@tangle-network/agent-profile-materialize 0.22.2 → 0.22.3

package/dist/managed-workspace-bind.js

@@ -1,4 +1,22 @@
 import { join } from "node:path";
+/**
+ * Paths OpenCode discovers relative to its native cwd: content-only resources,
+ * skills, and its standard agent and command definitions (OpenCode reads
+ * `.opencode/{agent,agents}/**\/*.md` and `.opencode/{command,commands}/**\/*.md`).
+ */
+const SECRET_REVISION_NATIVE_PATH = /^(?:reference\/|\.opencode\/skills\/|\.opencode\/(?:agents?|commands?)\/(?:[^./][^/]*\/)*[^./][^/]*\.md$)/u;
+/**
+ * A secret OpenCode revision runs OpenCode from its immutable, digest-attested
+ * revision tree, so a file at one of OpenCode's own discovery paths is visible
+ * there without a shared-workspace write. The binding stays limited to
+ * OpenCode's standard paths, never an app's own directory.
+ */
+function ridesSecretRevision(plan, file, options) {
+    return (options.secretOpenCodeRevisionCwd === true &&
+        plan.harness === "opencode" &&
+        (file.root ?? "workspace") === "workspace" &&
+        SECRET_REVISION_NATIVE_PATH.test(file.relPath));
+}
 export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, options = {}) {
     if (plan.requires?.length) {
         throw new Error(`Concurrent ${plan.harness} profile needs a native extension that this launcher cannot attest`);
@@ -67,17 +85,9 @@ export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, op
         }
     }
     for (const file of plan.files) {
+        if (ridesSecretRevision(plan, file, options))
+            continue;
         if (file.source !== "generated") {
-            if (options.secretOpenCodeRevisionCwd &&
-                plan.harness === "opencode" &&
-                (file.root ?? "workspace") === "workspace" &&
-                (file.relPath.startsWith("reference/") ||
-                    file.relPath.startsWith(".opencode/skills/"))) {
-                // The secret launcher uses this immutable revision tree as native cwd.
-                // These content-only resources are therefore visible without writing
-                // into the shared workspace or changing native authority config.
-                continue;
-            }
             throw new Error(`Concurrent ${plan.harness} profile resource ${file.relPath} needs a shared-workspace collision-safe copy`);
         }
         if ((file.root ?? "workspace") !== "workspace" ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.22.2",
+  "version": "0.22.3",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {
@@ -41,6 +41,7 @@
     "test": "pnpm run test:installed-peer && pnpm run test:current-peer",
     "test:installed-peer": "vitest run",
     "test:current-peer": "vitest run --config vitest.current-peer.config.ts",
+    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts",
     "test:watch": "vitest"
   }
 }