@tangle-network/agent-profile-materialize 0.23.0 → 0.23.1

package/dist/managed-workspace-stage.d.ts

@@ -20,5 +20,5 @@ export declare function assertPrivateManagedRoot(root: string): void;
  * The caller must keep the returned tree while an admitted turn uses it and
  * dispose it after that turn, so a later binding cannot expose old secrets.
  */
-export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles">): Promise<PreparedManagedWorkspace>;
+export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotEnvironment">): Promise<PreparedManagedWorkspace>;
 export declare function lstatIfPresent(path: string): ReturnType<typeof lstatSync> | null;

package/dist/plan-application.js

@@ -9,7 +9,7 @@ export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
  */
 export async function applyWorkspacePlanWithSecretProvider(plan, workspaceDir, secretProvider, options = {}) {
     const planDigest = hashWorkspacePlan(plan);
-    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider);
+    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotEnvironment);
     return applyResolvedWorkspacePlan(plan, resolved, workspaceDir, options, planDigest);
 }
 function secretRefLabel(ref) {
@@ -78,13 +78,27 @@ function resolvePublicWorkspacePlan(plan) {
         ...systemPromptBindingField(plan),
     };
 }
-async function resolvePrivateWorkspacePlan(plan, secretProvider) {
+/**
+ * OpenCode substitutes `{env:NAME}` textually into its config before parsing
+ * it, so only a value that cannot break out of a JSON string or start another
+ * substitution may be referenced; any other value is written in place.
+ */
+const SUBSTITUTABLE_SECRET_VALUE = /^[\x20-\x7e]+$/;
+const UNSUBSTITUTABLE_SECRET_CHARACTERS = /["\\{}]/;
+function secretSlotEnvironmentName(ref) {
+    const digest = createHash("sha256")
+        .update(ref.key, "utf8")
+        .digest("hex")
+        .slice(0, 24)
+        .toUpperCase();
+    return `TANGLE_PROFILE_SECRET_${digest}`;
+}
+async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotEnvironment) {
     if (!secretProvider || typeof secretProvider.get !== "function") {
         throw new Error("AgentProfileSecretProvider.get is required");
     }
     const pending = new Map();
-    const resolveRef = async (input) => {
-        const ref = agentProfileSecretRefSchema.parse(input);
+    const resolveRawRef = (ref) => {
         let raw = pending.get(ref.key);
         if (!raw) {
             raw = (async () => {
@@ -99,16 +113,33 @@ async function resolvePrivateWorkspacePlan(plan, secretProvider) {
             })();
             pending.set(ref.key, raw);
         }
-        const value = await raw;
+        return raw;
+    };
+    const resolveRef = async (input) => {
+        const ref = agentProfileSecretRefSchema.parse(input);
+        const value = await resolveRawRef(ref);
         return ref.format === "bearer" ? `Bearer ${value}` : value;
     };
+    const resolveFileSlot = async (input) => {
+        const ref = agentProfileSecretRefSchema.parse(input);
+        const value = await resolveRawRef(ref);
+        if (!fileSlotEnvironment ||
+            !SUBSTITUTABLE_SECRET_VALUE.test(value) ||
+            UNSUBSTITUTABLE_SECRET_CHARACTERS.test(value)) {
+            return ref.format === "bearer" ? `Bearer ${value}` : value;
+        }
+        const name = secretSlotEnvironmentName(ref);
+        fileSlotEnvironment[name] = value;
+        return ref.format === "bearer" ? `Bearer {env:${name}}` : `{env:${name}}`;
+    };
     const files = await Promise.all(normalizePlanFiles(plan.files).map(async (file) => {
         if (file.secretSlots.length === 0)
             return file;
+        // Generated native config files with secret slots are JSON objects.
         const parsed = JSON.parse(file.content);
         const values = await Promise.all(file.secretSlots.map(async (slot) => ({
             path: slot.path,
-            value: await resolveRef(slot.ref),
+            value: await resolveFileSlot(slot.ref),
         })));
         for (const resolved of values) {
             setValueAtJsonPath(parsed, resolved.path, resolved.value);
@@ -145,6 +176,7 @@ async function resolvePrivateWorkspacePlan(plan, secretProvider) {
         ...systemPromptBindingField(plan),
     };
 }
+import { createHash } from "node:crypto";
 import { agentProfileSecretRefSchema } from "@tangle-network/agent-interface";
 import { hashWorkspacePlan } from "./plan-digest.js";
 import { normalizePlanFiles, normalizeWorkspacePlanArgument, } from "./plan-normalize.js";

package/dist/plan-types.d.ts

@@ -320,6 +320,15 @@ export interface ApplyWorkspacePlanOptions {
      * refusal.
      */
     appliedPlanDigest?: string;
+    /**
+     * Receives the values of secrets that JSON file slots reference instead of
+     * containing. When set, a slot whose resolved value is safe to substitute
+     * is written as `{env:NAME}` (OpenCode config substitution) and the value
+     * lands here under NAME, so file bytes and every digest over them stay
+     * identical when only a secret's value changes. The caller must add these
+     * entries to the launch environment after digesting the launch.
+     */
+    secretFileSlotEnvironment?: Record<string, string>;
 }
 import type { AgentProfileSecretRef } from "@tangle-network/agent-interface";
 import type { HarnessId } from "./harness.js";

package/dist/secret-concurrent-revision.js

@@ -42,7 +42,10 @@ export async function prepareSecretConcurrentProfileRevision(input) {
     }
     assertWorkspacePlanSupported(plan);
     assertLaunchRoot(input.launchRoot);
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, input.options);
+    // Secret values stay out of the revision: file slots reference them, so an
+    // unchanged profile with a rotated per-turn secret reuses this revision.
+    const secretEnvironment = {};
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotEnvironment: secretEnvironment });
     try {
         // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
         // An agent-owned HOME may hold SQLite state, never native authority.
@@ -82,10 +85,14 @@ export async function prepareSecretConcurrentProfileRevision(input) {
                 prepared.dispose();
             }
         }
+        // Added after launchDigest so the digest and receipt never cover a value.
         return {
             directory,
             manifest: prepared.manifest,
-            application: { ...prepared.application, spawn },
+            application: {
+                ...prepared.application,
+                spawn: { ...spawn, env: { ...spawn.env, ...secretEnvironment } },
+            },
         };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.23.0",
+  "version": "0.23.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "repository": {