@tangle-network/agent-profile-materialize 0.22.2 → 0.22.4

package/dist/managed-workspace-bind.js

@@ -1,4 +1,22 @@
 import { join } from "node:path";
+/**
+ * Paths OpenCode discovers relative to its native cwd: content-only resources,
+ * skills, and its standard agent and command definitions (OpenCode reads
+ * `.opencode/{agent,agents}/**\/*.md` and `.opencode/{command,commands}/**\/*.md`).
+ */
+const SECRET_REVISION_NATIVE_PATH = /^(?:reference\/|\.opencode\/skills\/|\.opencode\/(?:agents?|commands?)\/(?:[^./][^/]*\/)*[^./][^/]*\.md$)/u;
+/**
+ * A secret OpenCode revision runs OpenCode from its immutable, digest-attested
+ * revision tree, so a file at one of OpenCode's own discovery paths is visible
+ * there without a shared-workspace write. The binding stays limited to
+ * OpenCode's standard paths, never an app's own directory.
+ */
+function ridesSecretRevision(plan, file, options) {
+    return (options.secretOpenCodeRevisionCwd === true &&
+        plan.harness === "opencode" &&
+        (file.root ?? "workspace") === "workspace" &&
+        SECRET_REVISION_NATIVE_PATH.test(file.relPath));
+}
 export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, options = {}) {
     if (plan.requires?.length) {
         throw new Error(`Concurrent ${plan.harness} profile needs a native extension that this launcher cannot attest`);
@@ -67,17 +85,9 @@ export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, op
         }
     }
     for (const file of plan.files) {
+        if (ridesSecretRevision(plan, file, options))
+            continue;
         if (file.source !== "generated") {
-            if (options.secretOpenCodeRevisionCwd &&
-                plan.harness === "opencode" &&
-                (file.root ?? "workspace") === "workspace" &&
-                (file.relPath.startsWith("reference/") ||
-                    file.relPath.startsWith(".opencode/skills/"))) {
-                // The secret launcher uses this immutable revision tree as native cwd.
-                // These content-only resources are therefore visible without writing
-                // into the shared workspace or changing native authority config.
-                continue;
-            }
             throw new Error(`Concurrent ${plan.harness} profile resource ${file.relPath} needs a shared-workspace collision-safe copy`);
         }
         if ((file.root ?? "workspace") !== "workspace" ||

package/dist/mcp.d.ts

@@ -3,7 +3,7 @@ export declare function materializeMcp(h: HarnessId, mcp: Record<string, ActiveA
  * The header a harness sends to a remote MCP server whose tool-call timeout it
  * raised, carrying the timeout it applied in milliseconds. A server may hold a
  * call for nearly that long. A server that does not see the header must assume
- * the harness default, 60 s for Claude Code and Codex.
+ * the harness default, 60 s for Claude Code, Codex and OpenCode.
  */
 export declare const MCP_TOOL_TIMEOUT_HEADER = "X-Mcp-Tool-Timeout-Ms";
 /** OpenCode-native MCP configuration used by workspace and startup paths. */
@@ -12,14 +12,24 @@ export type OpenCodeMcpConfig = Record<string, {
     url: string;
     enabled: boolean;
     headers?: Record<string, AgentProfileConfigValue>;
+    /** Milliseconds; OpenCode bounds this server's connect, tool listing and tool calls by it. */
+    timeout?: number;
+    /** `false` turns off OpenCode's OAuth discovery for this server. */
+    oauth?: false;
 } | {
     type: "local";
     command: Array<string | AgentProfileConfigValue>;
     enabled: boolean;
     environment?: Record<string, AgentProfileConfigValue>;
+    timeout?: number;
 }>;
-/** Lower canonical MCP definitions to OpenCode's native startup configuration. */
-export declare function openCodeMcpConfig(mcp: Record<string, AgentProfileMcpServer>): OpenCodeMcpConfig;
+/**
+ * Lower canonical MCP definitions to OpenCode's native startup configuration.
+ * `toolTimeouts` holds the validated `metadata.toolTimeoutMs` of each server
+ * that declared one; without it OpenCode applies the MCP SDK's 60 s default to
+ * every tool call.
+ */
+export declare function openCodeMcpConfig(mcp: Record<string, AgentProfileMcpServer>, toolTimeouts?: ReadonlyMap<string, number>): OpenCodeMcpConfig;
 import type { AgentProfileConfigValue, AgentProfileMcpServer } from "@tangle-network/agent-interface";
 import type { AddPlanFile } from "./plan-json.js";
 import type { HarnessId, Unsupported, WorkspacePlan } from "./plan-types.js";

package/dist/mcp.js

@@ -58,7 +58,7 @@ export function materializeMcp(h, mcp, plan, add, unsupported) {
             // opencode.json "mcp" block (local|remote).
             add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
                 $schema: OPENCODE_CONFIG_SCHEMA,
-                mcp: openCodeMcpConfig(mcp),
+                mcp: openCodeMcpConfig(mcp, mcpToolTimeouts(mcp, h, unsupported)),
             }));
             break;
         case "gemini": {
@@ -156,7 +156,7 @@ function tomlInlineStringTable(values) {
  * The header a harness sends to a remote MCP server whose tool-call timeout it
  * raised, carrying the timeout it applied in milliseconds. A server may hold a
  * call for nearly that long. A server that does not see the header must assume
- * the harness default, 60 s for Claude Code and Codex.
+ * the harness default, 60 s for Claude Code, Codex and OpenCode.
  */
 export const MCP_TOOL_TIMEOUT_HEADER = "X-Mcp-Tool-Timeout-Ms";
 const MIN_MCP_TOOL_TIMEOUT_MS = 1_000;
@@ -270,21 +270,38 @@ function kimiMcpServer(server) {
         ...(server.cwd ? { cwd: server.cwd } : {}),
     };
 }
-/** Lower canonical MCP definitions to OpenCode's native startup configuration. */
-export function openCodeMcpConfig(mcp) {
+const carriesAuthorization = (headers) => Object.keys(headers ?? {}).some((header) => header.toLowerCase() === "authorization");
+/**
+ * Lower canonical MCP definitions to OpenCode's native startup configuration.
+ * `toolTimeouts` holds the validated `metadata.toolTimeoutMs` of each server
+ * that declared one; without it OpenCode applies the MCP SDK's 60 s default to
+ * every tool call.
+ */
+export function openCodeMcpConfig(mcp, toolTimeouts = new Map()) {
     const out = {};
     for (const [name, s] of Object.entries(mcp)) {
         if (s.enabled === false)
             continue;
+        // OpenCode also bounds connect and tool listing by this value, so a server
+        // that hangs on connect holds startup that long; a refused connection still
+        // fails at once.
+        const timeout = toolTimeouts.get(name);
         if (s.url) {
             if (s.transport === "sse") {
                 throw new Error(`OpenCode MCP server "${name}" uses unsupported SSE transport`);
             }
+            const headers = withAppliedToolTimeout(s.headers, timeout);
             out[name] = {
                 type: "remote",
                 url: s.url,
                 enabled: true,
-                ...(s.headers ? { headers: s.headers } : {}),
+                ...(headers ? { headers } : {}),
+                ...(timeout !== undefined ? { timeout } : {}),
+                // A server that takes its credential from these headers has no OAuth
+                // flow. With OAuth on, OpenCode answers its 401 with OAuth discovery at
+                // the server's origin, and the agent sees that discovery's failure
+                // instead of the server's refusal.
+                ...(carriesAuthorization(s.headers) ? { oauth: false } : {}),
             };
             continue;
         }
@@ -299,6 +316,7 @@ export function openCodeMcpConfig(mcp) {
             command: [s.command, ...(s.args ?? [])],
             enabled: true,
             ...(s.env ? { environment: s.env } : {}),
+            ...(timeout !== undefined ? { timeout } : {}),
         };
     }
     return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.22.2",
+  "version": "0.22.4",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {
@@ -41,6 +41,7 @@
     "test": "pnpm run test:installed-peer && pnpm run test:current-peer",
     "test:installed-peer": "vitest run",
     "test:current-peer": "vitest run --config vitest.current-peer.config.ts",
+    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts",
     "test:watch": "vitest"
   }
 }