@tangle-network/agent-profile-materialize 0.26.0 → 0.26.2

package/dist/managed-workspace-bind.d.ts

@@ -1,4 +1,4 @@
 import type { WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
 export declare function bindConcurrentLaunch(plan: WorkspacePlan, application: WorkspacePlanApplication, revisionWorkspaceDir: string, options?: {
-    readonly secretOpenCodeConfigDirectory?: boolean;
+    readonly secretOpenCodeRevision?: boolean;
 }): WorkspacePlanApplication["spawn"];

package/dist/managed-workspace-bind.js

@@ -1,18 +1,22 @@
 import { join } from "node:path";
 /**
- * Paths OpenCode discovers relative to its native cwd: content-only resources,
- * skills, and its standard agent and command definitions (OpenCode reads
+ * Paths a secret OpenCode revision serves from its own immutable tree:
+ * read-only profile content under `reference/`, skills, and OpenCode's
+ * standard agent and command definitions (OpenCode reads
  * `.opencode/{agent,agents}/**\/*.md` and `.opencode/{command,commands}/**\/*.md`).
  */
-const SECRET_REVISION_NATIVE_PATH = /^(?:\.opencode\/skills\/|\.opencode\/(?:agents?|commands?)\/(?:[^./][^/]*\/)*[^./][^/]*\.md$)/u;
+const SECRET_REVISION_NATIVE_PATH = /^(?:reference\/|\.opencode\/skills\/|\.opencode\/(?:agents?|commands?)\/(?:[^./][^/]*\/)*[^./][^/]*\.md$)/u;
 /**
- * A secret OpenCode revision binds its immutable, digest-attested .opencode
- * directory explicitly, so native agent, command and skill resources remain
- * visible without discovering mutable shared-workspace configuration. The binding stays limited to
- * OpenCode's standard paths, never an app's own directory.
+ * A secret OpenCode turn launches with its revision's `workspace` as cwd and
+ * that tree's `.opencode` as its explicit config directory (the sealed launch
+ * in sdk-provider-opencode). So skills, agents and commands load from the
+ * digest-attested revision, and a cwd-relative `reference/` path resolves to
+ * this revision's own read-only copy, never to the shared workspace that
+ * concurrent revisions share. The binding stays limited to these paths, never
+ * an app's own directory.
  */
 function ridesSecretRevision(plan, file, options) {
-    return (options.secretOpenCodeConfigDirectory === true &&
+    return (options.secretOpenCodeRevision === true &&
         plan.harness === "opencode" &&
         (file.root ?? "workspace") === "workspace" &&
         SECRET_REVISION_NATIVE_PATH.test(file.relPath));

package/dist/secret-concurrent-revision.js

@@ -29,11 +29,10 @@ export async function prepareSecretConcurrentProfileRevision(input) {
             throw new Error(`Secret OpenCode reserves ${name} for its launch binding`);
         }
     }
+    // Workspace `reference/` files stay in this revision's read-only tree. The
+    // sealed launch runs from that tree, so a cwd-relative `reference/` path
+    // reads this revision's copy and nothing is written to the shared workspace.
     let plan = prepareExplicitOpenCodePlan(input.plan);
-    if (plan.files.some((file) => (file.root ?? "workspace") === "workspace" &&
-        file.relPath.startsWith("reference/"))) {
-        throw new Error("Secret OpenCode cannot bind cwd-relative reference resources to a shared data workspace");
-    }
     if (input.providerConfig) {
         plan = {
             ...plan,
@@ -80,7 +79,7 @@ export async function prepareSecretConcurrentProfileRevision(input) {
             .update(prepared.manifest.materializedDigest)
             .digest("hex");
         const directory = join(input.launchRoot, `revision-${identity}`);
-        const bound = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretOpenCodeConfigDirectory: true });
+        const bound = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretOpenCodeRevision: true });
         const spawn = {
             ...bound,
             env: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -34,6 +34,10 @@
   "peerDependencies": {
     "@tangle-network/agent-interface": "^3.0.0 || ^4.0.0 || ^5.0.0"
   },
+  "tangleRelease": {
+    "sourceSha": "48d1261ddd76219c35be25a869689fbb120c5f31",
+    "mergedAt": "2026-10-19T00:38:28-06:00"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "check-types": "tsc --noEmit",
@@ -41,7 +45,7 @@
     "test": "pnpm run test:installed-peer && pnpm run test:current-peer",
     "test:installed-peer": "vitest run",
     "test:current-peer": "vitest run --config vitest.current-peer.config.ts",
-    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts",
+    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts tests/secret-reference-resources.test.ts",
     "test:watch": "vitest"
   }
 }