@tangle-network/agent-profile-materialize 0.26.2 → 0.26.3

package/dist/index.d.ts

@@ -26,3 +26,4 @@ export * from "./profile-start-check.js";
 export type { ResolveAgentProfileResourcesOptions } from "./resource-resolution.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
 export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";
+export * from "./secret-session-view.js";

package/dist/index.js

@@ -20,3 +20,4 @@ export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE
 export * from "./profile-start-check.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
 export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";
+export * from "./secret-session-view.js";

package/dist/secret-concurrent-revision.d.ts

@@ -19,3 +19,4 @@ export declare function prepareSecretConcurrentProfileRevision(input: {
     secretProvider: AgentProfileSecretProvider;
     options?: Pick<ApplyWorkspacePlanOptions, "runtimeOnlyFiles">;
 }): Promise<ConcurrentProfileRevision>;
+export declare function runSetfacl(args: string[], paths: readonly string[]): void;

package/dist/secret-concurrent-revision.js

@@ -154,7 +154,7 @@ function secretRevisionPaths(root) {
     walk(root);
     return { all, exposed };
 }
-function runSetfacl(args, paths) {
+export function runSetfacl(args, paths) {
     for (let start = 0; start < paths.length; start += 64) {
         execFileSync("/usr/bin/setfacl", [...args, "--", ...paths.slice(start, start + 64)], {
             env: { PATH: "/usr/bin:/bin", LANG: "C" },

package/dist/secret-session-view.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
+ * native session at the directory it was created in, so a session resumed on
+ * a later turn keeps this path while each turn's revision changes. The name
+ * binds the shared workspace, the session and its subprocess UID, so two
+ * sessions never share a view.
+ */
+export declare function secretSessionViewWorkspace(input: {
+    launchRoot: string;
+    sharedWorkspaceDir: string;
+    sessionId: string;
+    subprocessUid: number;
+}): string;
+/**
+ * Point a session's view at one published secret revision before the
+ * session's turn runs. The view's `reference/` becomes a fresh tree of hard
+ * links to the revision's read-only files (the same inodes, owner, mode and
+ * ACL), so the session reads this turn's files and nothing the previous
+ * revision held. The view holds nothing else, so OpenCode's config search
+ * finds no config there; profile config stays bound by absolute path.
+ *
+ * The swap is not atomic for a reader that is already running: the caller
+ * runs one turn of a session at a time and binds before that turn spawns.
+ */
+export declare function bindSecretSessionView(input: {
+    launchRoot: string;
+    viewWorkspaceDir: string;
+    revisionWorkspaceDir: string;
+    subprocessUid: number;
+}): void;

package/dist/secret-session-view.js

@@ -0,0 +1,136 @@
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { assertLaunchRoot } from "./managed-workspace.js";
+import { runSetfacl } from "./secret-concurrent-revision.js";
+/** The only cwd-relative content a secret OpenCode revision serves. */
+const VIEW_ENTRY = "reference";
+/**
+ * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
+ * native session at the directory it was created in, so a session resumed on
+ * a later turn keeps this path while each turn's revision changes. The name
+ * binds the shared workspace, the session and its subprocess UID, so two
+ * sessions never share a view.
+ */
+export function secretSessionViewWorkspace(input) {
+    if (!input.sessionId)
+        throw new Error("Secret session view needs a session");
+    const name = createHash("sha256")
+        .update("tangle-secret-session-view\0")
+        .update(input.sharedWorkspaceDir)
+        .update("\0")
+        .update(input.sessionId)
+        .update("\0")
+        .update(String(input.subprocessUid))
+        .digest("hex");
+    return join(input.launchRoot, `session-${name}`, "workspace");
+}
+/**
+ * Point a session's view at one published secret revision before the
+ * session's turn runs. The view's `reference/` becomes a fresh tree of hard
+ * links to the revision's read-only files (the same inodes, owner, mode and
+ * ACL), so the session reads this turn's files and nothing the previous
+ * revision held. The view holds nothing else, so OpenCode's config search
+ * finds no config there; profile config stays bound by absolute path.
+ *
+ * The swap is not atomic for a reader that is already running: the caller
+ * runs one turn of a session at a time and binds before that turn spawns.
+ */
+export function bindSecretSessionView(input) {
+    const { launchRoot, viewWorkspaceDir, revisionWorkspaceDir } = input;
+    if (process.platform !== "linux" ||
+        process.getuid?.() !== 0 ||
+        !Number.isSafeInteger(input.subprocessUid) ||
+        input.subprocessUid < 200_000) {
+        throw new Error("Secret session view needs a root executor and reserved identity");
+    }
+    assertLaunchRoot(launchRoot);
+    const viewRoot = dirname(viewWorkspaceDir);
+    if (!isLaunchWorkspace(launchRoot, viewWorkspaceDir, /^session-[a-f0-9]{64}$/)) {
+        throw new Error("Secret session view is not a launch-root session path");
+    }
+    if (!isLaunchWorkspace(launchRoot, revisionWorkspaceDir, /^revision-[a-f0-9]{64}$/) ||
+        !isSealedNode(lstatSync(revisionWorkspaceDir), "directory")) {
+        throw new Error("Secret session view needs a published revision");
+    }
+    for (const directory of [viewRoot, viewWorkspaceDir]) {
+        const stat = lstatIfPresent(directory);
+        if (!stat)
+            mkdirSync(directory, { mode: 0o700 });
+        else if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== 0) {
+            throw new Error("Secret session view is not an executor-owned directory");
+        }
+    }
+    if (readdirSync(viewWorkspaceDir).some((name) => name !== VIEW_ENTRY)) {
+        throw new Error("Secret session view holds an unexpected entry");
+    }
+    // Only this function writes a view. An interrupted bind leaves a staged or
+    // retired tree beside `workspace`, never inside it.
+    clearBesideWorkspace(viewRoot);
+    const source = join(revisionWorkspaceDir, VIEW_ENTRY);
+    const sourceStat = lstatIfPresent(source);
+    let staged;
+    if (sourceStat) {
+        if (!isSealedNode(sourceStat, "directory")) {
+            throw new Error("Secret revision reference/ is not sealed");
+        }
+        staged = join(viewRoot, `.stage-${randomBytes(8).toString("hex")}`);
+        const directories = linkSealedTree(source, staged);
+        sealDirectories(directories, input.subprocessUid);
+    }
+    const current = join(viewWorkspaceDir, VIEW_ENTRY);
+    if (lstatIfPresent(current)) {
+        renameSync(current, join(viewRoot, `.retired-${randomBytes(8).toString("hex")}`));
+    }
+    if (staged)
+        renameSync(staged, current);
+    clearBesideWorkspace(viewRoot);
+    sealDirectories([viewRoot, viewWorkspaceDir], input.subprocessUid);
+}
+function isLaunchWorkspace(launchRoot, workspace, name) {
+    return (basename(workspace) === "workspace" &&
+        dirname(dirname(workspace)) === launchRoot &&
+        name.test(basename(dirname(workspace))));
+}
+function lstatIfPresent(path) {
+    return lstatSync(path, { throwIfNoEntry: false });
+}
+function isSealedNode(stat, kind) {
+    return (!stat.isSymbolicLink() &&
+        (kind === "directory" ? stat.isDirectory() : stat.isFile()) &&
+        stat.uid === 0 &&
+        (stat.mode & 0o222) === 0);
+}
+/** Hard-link a sealed revision tree; returns every directory it created. */
+function linkSealedTree(source, target) {
+    mkdirSync(target, { mode: 0o700 });
+    const directories = [target];
+    for (const name of readdirSync(source)) {
+        const from = join(source, name);
+        const stat = lstatSync(from);
+        if (isSealedNode(stat, "directory")) {
+            directories.push(...linkSealedTree(from, join(target, name)));
+        }
+        else if (isSealedNode(stat, "file")) {
+            linkSync(from, join(target, name));
+        }
+        else {
+            throw new Error("Secret revision reference/ holds an unsealed inode");
+        }
+    }
+    return directories;
+}
+/** Root-owned, read-only, and traversable only by the session's UID. */
+function sealDirectories(directories, uid) {
+    runSetfacl(["-b"], directories);
+    for (const directory of directories)
+        chmodSync(directory, 0o500);
+    runSetfacl(["-m", `u:${uid}:r-X`], directories);
+}
+function clearBesideWorkspace(viewRoot) {
+    for (const name of readdirSync(viewRoot)) {
+        if (name !== "workspace") {
+            rmSync(join(viewRoot, name), { recursive: true, force: true });
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.26.2",
+  "version": "0.26.3",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^3.0.0 || ^4.0.0 || ^5.0.0"
   },
   "tangleRelease": {
-    "sourceSha": "48d1261ddd76219c35be25a869689fbb120c5f31",
-    "mergedAt": "2026-10-19T00:38:28-06:00"
+    "sourceSha": "c7971c78f69c191b991da10bcb17ac1a30ab66b2",
+    "mergedAt": "2026-10-19T02:02:40-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -45,7 +45,7 @@
     "test": "pnpm run test:installed-peer && pnpm run test:current-peer",
     "test:installed-peer": "vitest run",
     "test:current-peer": "vitest run --config vitest.current-peer.config.ts",
-    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts tests/secret-reference-resources.test.ts",
+    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts tests/secret-reference-resources.test.ts tests/secret-session-view.test.ts",
     "test:watch": "vitest"
   }
 }