@tangle-network/agent-profile-materialize 0.25.2 → 0.25.4

package/dist/harness.js

@@ -348,14 +348,15 @@ export function materializerReplacement(relPath, content, plannedContent) {
  * there.
  *
  * An `opencode.json` this package wrote holds the opencode schema id, only the
- * keys this package writes, and only instruction paths this package invented.
- * A user config that holds nothing else is indistinguishable from that output
- * and is replaced too; a config with any other key, or with an instruction path
- * of the user's own, is refused.
+ * keys this package writes, and only instruction paths this package invented;
+ * a user config holding nothing else is replaced too, any other key or own
+ * instruction path is refused.
  */
 function isMaterializerOutput(relPath, content, plannedContent) {
     if (MATERIALIZER_RESERVED_PATHS.has(relPath))
         return true;
+    if (relPath === ".pi/mcp.json" || relPath === ".kimi/mcp.json")
+        return isMaterializerMcpConfig(relPath, content);
     if (MATERIALIZER_SUBAGENT_PATH.test(relPath)) {
         const existing = content();
         if (existing === undefined)
@@ -435,3 +436,4 @@ export function skillDirForHarness(harness) {
     return HARNESS_SKILL_DIRS[harness];
 }
 import { createHash } from "node:crypto";
+import { isMaterializerMcpConfig } from "./mcp-config-ownership.js";

package/dist/index.d.ts

@@ -5,8 +5,8 @@ export type { HarnessId } from "./harness.js";
 export { HARNESS_SKILL_DIRS, harnessAutoLoadsAgentContextFile, harnessAutoLoadsContextFile, harnessContextFile, isMaterializerHarness, MATERIALIZER_CONTEXT_PATHS, MATERIALIZER_HARNESSES, markMaterializerContextFile, skillDirForHarness, } from "./harness.js";
 export * from "./harness-prompt.js";
 export { type ConcurrentProfileRevision, ensurePublicConcurrentProfileRoots, type ManagedWorkspaceFileDigest, type ManagedWorkspaceManifest, preparePublicConcurrentProfileRevision, } from "./managed-workspace.js";
-export type { OpenCodeMcpConfig } from "./mcp.js";
-export { openCodeMcpConfig } from "./mcp.js";
+export { type OpenCodeMcpConfig, openCodeMcpConfig } from "./mcp.js";
+export { isMaterializerMcpConfig } from "./mcp-config-ownership.js";
 export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
 export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, type PiModelsConfigFile, type PiModelsConfigInput, type PiRuntimePaths, resolvePiRuntimePaths, } from "./pi-models-config.js";
 export { applyWorkspacePlan, applyWorkspacePlanWithSecretProvider, } from "./plan-application.js";
@@ -15,8 +15,7 @@ export { takeSystemPromptBinding } from "./plan-prompt.js";
 export { assertWorkspacePlanSupported, enforceWorkspacePlanSupport, } from "./plan-support.js";
 export type { ApplyWorkspacePlanOptions, BindableLaunchControl, ExecutorSystemPromptBinding, PlanFile, PlanFileRoot, PlanFileSecretSlot, PlanRequirement, SkippableDimension, Unsupported, WorkspacePlan, WorkspacePlanApplication, WorkspacePlanArgument, WorkspacePlanArgumentTemplate, WorkspacePlanConfigValue, WorkspacePlanReceipt, WorkspacePlanSecretSegment, WorkspacePlanSpawnInputs, WorkspacePlanSystemPromptBinding, WorkspacePlanWrittenFile, } from "./plan-types.js";
 export { BINDABLE_LAUNCH_CONTROLS, EXECUTOR_SYSTEM_PROMPT_BINDINGS, isExecutorSystemPromptBinding, isSkippableDimension, SKIPPABLE_DIMENSIONS, WorkspacePlanCleanupError, } from "./plan-types.js";
-export type { PrimeMaterializeOptions } from "./prime-agent-dir.js";
-export { materializePrimeProfileControls, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
+export { materializePrimeProfileControls, type PrimeMaterializeOptions, primeHarnessStatePath, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
 export type { PrimeProfileErrorKind, PrimeThinkingLevel, } from "./prime-fork.js";
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
 export type { PrimeProfileControls, PrimeProfileSkill, PrimeProfileSubagent, } from "./prime-profile.js";

package/dist/index.js

@@ -4,6 +4,7 @@ export { HARNESS_SKILL_DIRS, harnessAutoLoadsAgentContextFile, harnessAutoLoadsC
 export * from "./harness-prompt.js";
 export { ensurePublicConcurrentProfileRoots, preparePublicConcurrentProfileRevision, } from "./managed-workspace.js";
 export { openCodeMcpConfig } from "./mcp.js";
+export { isMaterializerMcpConfig } from "./mcp-config-ownership.js";
 export { modelIdsMatch, qualifyModelId, unqualifyModelId, } from "./model-id.js";
 export { buildPiModelsConfig, buildPiModelsConfigFile, PI_MODELS_CONFIG_PATH, resolvePiRuntimePaths, } from "./pi-models-config.js";
 export { applyWorkspacePlan, applyWorkspacePlanWithSecretProvider, } from "./plan-application.js";
@@ -11,7 +12,7 @@ export { agentCandidateProfilePlanMaterial, canonicalizeAgentCandidateProfilePla
 export { takeSystemPromptBinding } from "./plan-prompt.js";
 export { assertWorkspacePlanSupported, enforceWorkspacePlanSupport, } from "./plan-support.js";
 export { BINDABLE_LAUNCH_CONTROLS, EXECUTOR_SYSTEM_PROMPT_BINDINGS, isExecutorSystemPromptBinding, isSkippableDimension, SKIPPABLE_DIMENSIONS, WorkspacePlanCleanupError, } from "./plan-types.js";
-export { materializePrimeProfileControls, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
+export { materializePrimeProfileControls, primeHarnessStatePath, prunePrimeProfileMaterial, seedPrimeProfileSubagents, writePrimeAgentFile, } from "./prime-agent-dir.js";
 export { matchPrimeKernelDeadMarker, PRIME_AGENT_DIR_ENV_VAR, PRIME_AGENT_DIR_ENV_VARS, PRIME_FORK_INSTALL, PRIME_FORK_PIN, PRIME_HARNESS_STATE_ENV_DENYLIST, PRIME_KERNEL_DEAD_MARKERS, PRIME_KERNEL_ENV_PASSTHROUGH, PRIME_MCP_UNSUPPORTED_REASON, PRIME_THINKING_LEVELS, PrimeHarnessStateError, PrimeProfileError, parsePrimeModelsJson, primeAgentDirEnv, primeApiKeyEnvNames, primeThinkingLevel, stripPrimeJsonComments, } from "./prime-fork.js";
 export { assertPrimeModelAgreement, hasPrimeProfileMaterial, primeProfileNeedsAgentDir, primeSubagentEntryId, readPrimeProfileControls, } from "./prime-profile.js";
 export * from "./profile-bundle-cache.js";

package/dist/mcp-config-ownership.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Harness MCP config files this package generates wholesale from
+ * `profile.mcp`: exactly one `mcpServers` object whose entries carry only
+ * the fields the generators write. Recognizable by that shape alone (no
+ * schema id to key on), so an existing file holding ONLY those registrations
+ * is this package's earlier output and a new plan replaces it — a per-turn
+ * profile changes these bytes routinely (physim's MCP env carries turn
+ * state). Anything else at the path (a user's own keys, extra fields) still
+ * refuses: the name alone proves nothing, same rule as `opencode.json`.
+ */
+/** Paths owned by this rule. `.gemini/settings.json` is deliberately absent:
+ *  it is a broader user settings file the package only contributes one key
+ *  to, so its bytes cannot prove authorship. */
+export declare const MATERIALIZER_MCP_CONFIG_PATHS: Set<string>;
+/** The parsed form this rule accepts: `JSON.parse` output narrowed at the
+ *  I/O boundary by {@link parseMcpServersConfig}. */
+export interface McpServersConfig {
+    mcpServers: Record<string, Record<string, unknown>>;
+}
+/** Parse workspace bytes into the one shape this rule owns, or `null` when
+ *  the bytes are anything else (not an object, other top-level keys, or
+ *  server entries that are not objects). The I/O boundary for
+ *  {@link isGeneratedMcpConfigShape}. */
+export declare function parseMcpServersConfig(bytes: string): McpServersConfig | null;
+/** Whether a parsed MCP config carries ONLY the registrations this package
+ *  generates: no extra top-level keys, and every server entry holds only
+ *  generated fields. A user's own key anywhere makes this `false`. */
+export declare function isGeneratedMcpConfigShape(config: McpServersConfig): boolean;
+/** Whether the existing file at `relPath` is this package's own earlier MCP
+ *  config output (shape rule above). `undefined` content = no regular file. */
+export declare function isMaterializerMcpConfig(relPath: string, content: () => string | undefined): boolean;

package/dist/mcp-config-ownership.js

@@ -0,0 +1,79 @@
+/**
+ * Harness MCP config files this package generates wholesale from
+ * `profile.mcp`: exactly one `mcpServers` object whose entries carry only
+ * the fields the generators write. Recognizable by that shape alone (no
+ * schema id to key on), so an existing file holding ONLY those registrations
+ * is this package's earlier output and a new plan replaces it — a per-turn
+ * profile changes these bytes routinely (physim's MCP env carries turn
+ * state). Anything else at the path (a user's own keys, extra fields) still
+ * refuses: the name alone proves nothing, same rule as `opencode.json`.
+ */
+/** Paths owned by this rule. `.gemini/settings.json` is deliberately absent:
+ *  it is a broader user settings file the package only contributes one key
+ *  to, so its bytes cannot prove authorship. */
+export const MATERIALIZER_MCP_CONFIG_PATHS = new Set([
+    ".pi/mcp.json",
+    ".kimi/mcp.json",
+]);
+const GENERATED_MCP_SERVER_KEYS = new Set([
+    "command",
+    "args",
+    "env",
+    "cwd",
+    "url",
+    "httpUrl",
+    "headers",
+    "transport",
+    "enabled",
+    "directTools",
+]);
+/** Parse workspace bytes into the one shape this rule owns, or `null` when
+ *  the bytes are anything else (not an object, other top-level keys, or
+ *  server entries that are not objects). The I/O boundary for
+ *  {@link isGeneratedMcpConfigShape}. */
+export function parseMcpServersConfig(bytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return null;
+    }
+    const { mcpServers } = parsed;
+    if (mcpServers === null ||
+        typeof mcpServers !== "object" ||
+        Array.isArray(mcpServers)) {
+        return null;
+    }
+    for (const server of Object.values(mcpServers)) {
+        if (server === null ||
+            typeof server !== "object" ||
+            Array.isArray(server)) {
+            return null;
+        }
+    }
+    return { mcpServers: mcpServers };
+}
+/** Whether a parsed MCP config carries ONLY the registrations this package
+ *  generates: no extra top-level keys, and every server entry holds only
+ *  generated fields. A user's own key anywhere makes this `false`. */
+export function isGeneratedMcpConfigShape(config) {
+    const keys = Object.keys(config);
+    if (keys.length !== 1 || keys[0] !== "mcpServers")
+        return false;
+    return Object.values(config.mcpServers).every((server) => Object.keys(server).every((key) => GENERATED_MCP_SERVER_KEYS.has(key)));
+}
+/** Whether the existing file at `relPath` is this package's own earlier MCP
+ *  config output (shape rule above). `undefined` content = no regular file. */
+export function isMaterializerMcpConfig(relPath, content) {
+    if (!MATERIALIZER_MCP_CONFIG_PATHS.has(relPath))
+        return false;
+    const bytes = content();
+    if (bytes === undefined)
+        return false;
+    const config = parseMcpServersConfig(bytes);
+    return config !== null && isGeneratedMcpConfigShape(config);
+}

package/dist/prime-agent-dir.d.ts

@@ -1,4 +1,19 @@
 export declare function writePrimeAgentFile(path: string, data: string, mode?: number): void;
+/**
+ * File access on a prime agent dir. The default reads and writes the local
+ * filesystem as the calling process. An executor whose agent dir belongs to
+ * another user (a root sidecar that demotes prime-agent) passes reads it took
+ * as that user and replays the writes as that user, so it never touches the
+ * agent's files with its own rights.
+ */
+export interface PrimeAgentDirIo {
+    /** The file's text, or undefined when it does not exist. */
+    read(path: string): string | undefined;
+    /** Replace the whole file: atomic and owner-only. */
+    write(path: string, data: string): void;
+}
+/** The fork's continual-harness store, the only agent-dir file a materialization reads. */
+export declare function primeHarnessStatePath(agentDir: string): string;
 export interface PrimeMaterializeOptions {
     /**
      * Where the FLAG-NAMED files go — the prompt files and the skills root.
@@ -14,6 +29,8 @@ export interface PrimeMaterializeOptions {
      * (currently: adopting entries a pre-shared executor left behind).
      */
     warn?: (msg: string, meta?: Record<string, unknown>) => void;
+    /** Agent-dir file access; the local filesystem when omitted. */
+    io?: PrimeAgentDirIo;
 }
 /**
  * Materialize the validated controls and return the extra spawn args that bind
@@ -43,5 +60,5 @@ export declare function prunePrimeProfileMaterial(agentDir: string, options?: Pi
  * {@link PrimeHarnessStateError}: the file is the agent's own self-modification
  * state, and overwriting it destroys what the run was supposed to observe.
  */
-export declare function seedPrimeProfileSubagents(agentDir: string, subagents: PrimeProfileSubagent[], warn?: (msg: string, meta?: Record<string, unknown>) => void): void;
+export declare function seedPrimeProfileSubagents(agentDir: string, subagents: PrimeProfileSubagent[], warn?: (msg: string, meta?: Record<string, unknown>) => void, io?: PrimeAgentDirIo): void;
 import type { PrimeProfileControls, PrimeProfileSubagent } from "./prime-profile.js";

package/dist/prime-agent-dir.js

@@ -4,6 +4,14 @@ export function writePrimeAgentFile(path, data, mode = 0o600) {
     writeFileSync(temp, data, { mode });
     renameSync(temp, path);
 }
+const localPrimeAgentDirIo = {
+    read: (path) => (existsSync(path) ? readFileSync(path, "utf8") : undefined),
+    write: (path, data) => writePrimeAgentFile(path, data),
+};
+/** The fork's continual-harness store, the only agent-dir file a materialization reads. */
+export function primeHarnessStatePath(agentDir) {
+    return join(agentDir, PRIME_HARNESS_DIR_NAME, PRIME_HARNESS_STATE_FILE);
+}
 /**
  * Materialize the validated controls and return the extra spawn args that bind
  * them. Runs before every spawn (same place models.json is materialized), so a
@@ -11,30 +19,30 @@ export function writePrimeAgentFile(path, data, mode = 0o600) {
  * process.
  */
 export function materializePrimeProfileControls(agentDir, controls, options = {}) {
-    const { flagFileRoot = agentDir, warn } = options;
+    const { flagFileRoot = agentDir, warn, io = localPrimeAgentDirIo } = options;
     const args = [];
     const profileDir = join(flagFileRoot, PRIME_PROFILE_DIR_NAME);
     if (controls.systemPrompt !== undefined) {
         const promptPath = join(profileDir, PRIME_SYSTEM_PROMPT_FILE);
-        writePrimeAgentFile(promptPath, controls.systemPrompt);
+        io.write(promptPath, controls.systemPrompt);
         args.push("--system-prompt", promptPath);
     }
     if (controls.appendSystemPrompt !== undefined) {
         const appendPath = join(profileDir, PRIME_APPEND_SYSTEM_PROMPT_FILE);
-        writePrimeAgentFile(appendPath, controls.appendSystemPrompt);
+        io.write(appendPath, controls.appendSystemPrompt);
         args.push("--append-system-prompt", appendPath);
     }
     if (controls.instructions !== undefined) {
-        writePrimeAgentFile(join(agentDir, PRIME_CONTEXT_FILE), `${controls.instructions}\n`);
+        io.write(join(agentDir, PRIME_CONTEXT_FILE), `${controls.instructions}\n`);
     }
     if (controls.skills.length > 0) {
         const skillsRoot = join(profileDir, PRIME_SKILLS_DIR_NAME);
         for (const skill of controls.skills) {
-            writePrimeAgentFile(join(skillsRoot, skill.name, "SKILL.md"), normalizeSkillMd(skill.name, skill.content));
+            io.write(join(skillsRoot, skill.name, "SKILL.md"), normalizeSkillMd(skill.name, skill.content));
         }
         args.push("--skill", skillsRoot);
     }
-    seedPrimeProfileSubagents(agentDir, controls.subagents, warn);
+    seedPrimeProfileSubagents(agentDir, controls.subagents, warn, io);
     return args;
 }
 /**
@@ -65,13 +73,14 @@ export function prunePrimeProfileMaterial(agentDir, options = {}) {
  * {@link PrimeHarnessStateError}: the file is the agent's own self-modification
  * state, and overwriting it destroys what the run was supposed to observe.
  */
-export function seedPrimeProfileSubagents(agentDir, subagents, warn) {
-    const statePath = join(agentDir, PRIME_HARNESS_DIR_NAME, PRIME_HARNESS_STATE_FILE);
+export function seedPrimeProfileSubagents(agentDir, subagents, warn, io = localPrimeAgentDirIo) {
+    const statePath = primeHarnessStatePath(agentDir);
     let state = {};
-    if (existsSync(statePath)) {
+    const stored = io.read(statePath);
+    if (stored !== undefined) {
         let parsed;
         try {
-            parsed = JSON.parse(readFileSync(statePath, "utf8"));
+            parsed = JSON.parse(stored);
         }
         catch (err) {
             throw new PrimeHarnessStateError(statePath, err instanceof Error ? err.message : String(err));
@@ -149,7 +158,7 @@ export function seedPrimeProfileSubagents(agentDir, subagents, warn) {
     }
     if (!changed)
         return;
-    writePrimeAgentFile(statePath, `${JSON.stringify({
+    io.write(statePath, `${JSON.stringify({
         ...state,
         schema: typeof state.schema === "number" ? state.schema : 1,
         entries,

package/dist/workspace-files.d.ts

@@ -1,4 +1,4 @@
-export declare const compareStrings: (a: string, b: string) => 1 | -1 | 0;
+export declare const compareStrings: (a: string, b: string) => 1 | 0 | -1;
 export declare const DEFAULT_FILE_MODE = 420;
 export declare const PRIVATE_FILE_MODE = 384;
 export declare const EXECUTABLE_FILE_MODE = 493;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.25.2",
-  "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
+  "version": "0.25.4",
+  "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/tangle-network/agent-dev-container.git",
+    "url": "git+https://github.com/tangle-network/agent-container.git",
     "directory": "packages/agent-profile-materialize"
   },
   "main": "./dist/index.js",