@tangle-network/agent-profile-materialize 0.26.2 → 0.26.4

package/dist/index.d.ts

@@ -26,3 +26,4 @@ export * from "./profile-start-check.js";
 export type { ResolveAgentProfileResourcesOptions } from "./resource-resolution.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
 export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";
+export * from "./secret-session-view.js";

package/dist/index.js

@@ -20,3 +20,4 @@ export { executionControlConflict, materializeProfile, UNAVAILABLE_AGENT_PROFILE
 export * from "./profile-start-check.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
 export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";
+export * from "./secret-session-view.js";

package/dist/managed-workspace-stage.d.ts

@@ -20,5 +20,5 @@ export declare function assertPrivateManagedRoot(root: string): void;
  * The caller must keep the returned tree while an admitted turn uses it and
  * dispose it after that turn, so a later binding cannot expose old secrets.
  */
-export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotEnvironment">): Promise<PreparedManagedWorkspace>;
+export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotsByReference">): Promise<PreparedManagedWorkspace>;
 export declare function lstatIfPresent(path: string): ReturnType<typeof lstatSync> | null;

package/dist/plan-application.js

@@ -9,7 +9,7 @@ export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
  */
 export async function applyWorkspacePlanWithSecretProvider(plan, workspaceDir, secretProvider, options = {}) {
     const planDigest = hashWorkspacePlan(plan);
-    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotEnvironment);
+    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotsByReference === true);
     return applyResolvedWorkspacePlan(plan, resolved, workspaceDir, options, planDigest);
 }
 function secretRefLabel(ref) {
@@ -81,7 +81,7 @@ function resolvePublicWorkspacePlan(plan) {
 /**
  * OpenCode substitutes `{env:NAME}` textually into its config before parsing
  * it, so only a value that cannot break out of a JSON string or start another
- * substitution may be referenced; any other value is written in place.
+ * substitution may stand behind a reference.
  */
 const SUBSTITUTABLE_SECRET_VALUE = /^[\x20-\x7e]+$/;
 const UNSUBSTITUTABLE_SECRET_CHARACTERS = /["\\{}]/;
@@ -93,7 +93,7 @@ function secretSlotEnvironmentName(ref) {
         .toUpperCase();
     return `TANGLE_PROFILE_SECRET_${digest}`;
 }
-async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotEnvironment) {
+async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotsByReference) {
     if (!secretProvider || typeof secretProvider.get !== "function") {
         throw new Error("AgentProfileSecretProvider.get is required");
     }
@@ -123,13 +123,16 @@ async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotEnviron
     const resolveFileSlot = async (input) => {
         const ref = agentProfileSecretRefSchema.parse(input);
         const value = await resolveRawRef(ref);
-        if (!fileSlotEnvironment ||
-            !SUBSTITUTABLE_SECRET_VALUE.test(value) ||
-            UNSUBSTITUTABLE_SECRET_CHARACTERS.test(value)) {
+        if (!fileSlotsByReference) {
             return ref.format === "bearer" ? `Bearer ${value}` : value;
         }
+        // Never write the value in place: the file is readable by the process
+        // that loads it, and so by every tool that process runs.
+        if (!SUBSTITUTABLE_SECRET_VALUE.test(value) ||
+            UNSUBSTITUTABLE_SECRET_CHARACTERS.test(value)) {
+            throw new Error(`AgentProfile secret ${secretRefLabel(ref)} has a value that cannot be referenced from a secret OpenCode config: it may hold only printable ASCII without quotes, backslashes or braces`);
+        }
         const name = secretSlotEnvironmentName(ref);
-        fileSlotEnvironment[name] = value;
         return ref.format === "bearer" ? `Bearer {env:${name}}` : `{env:${name}}`;
     };
     const files = await Promise.all(normalizePlanFiles(plan.files).map(async (file) => {

package/dist/plan-types.d.ts

@@ -321,14 +321,13 @@ export interface ApplyWorkspacePlanOptions {
      */
     appliedPlanDigest?: string;
     /**
-     * Receives the values of secrets that JSON file slots reference instead of
-     * containing. When set, a slot whose resolved value is safe to substitute
-     * is written as `{env:NAME}` (OpenCode config substitution) and the value
-     * lands here under NAME, so file bytes and every digest over them stay
-     * identical when only a secret's value changes. The caller must add these
-     * entries to the launch environment after digesting the launch.
+     * Write every JSON file secret slot as an `{env:NAME}` reference (OpenCode
+     * config substitution) and never its value, so file bytes and every digest
+     * over them stay identical when only a secret's value changes. The value is
+     * not returned: a native process that held it would hand it to every tool
+     * it runs. A value that could not be substituted safely is refused.
      */
-    secretFileSlotEnvironment?: Record<string, string>;
+    secretFileSlotsByReference?: true;
 }
 import type { AgentProfileSecretRef } from "@tangle-network/agent-interface";
 import type { HarnessId } from "./harness.js";

package/dist/secret-concurrent-revision.d.ts

@@ -19,3 +19,4 @@ export declare function prepareSecretConcurrentProfileRevision(input: {
     secretProvider: AgentProfileSecretProvider;
     options?: Pick<ApplyWorkspacePlanOptions, "runtimeOnlyFiles">;
 }): Promise<ConcurrentProfileRevision>;
+export declare function runSetfacl(args: string[], paths: readonly string[]): void;

package/dist/secret-concurrent-revision.js

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { assertLaunchRoot, listRevisionFiles, makeStageWritable, prepareExplicitOpenCodePlan, } from "./managed-workspace.js";
 import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
 import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
+import { normalizeWorkspacePlanArgument } from "./plan-normalize.js";
 import { assertWorkspacePlanSupported } from "./plan-support.js";
 /**
  * Publish a resolved revision for exactly one native subprocess UID. The
@@ -52,12 +53,20 @@ export async function prepareSecretConcurrentProfileRevision(input) {
     if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
         throw new Error("Secret OpenCode reserves its native config directory");
     }
+    // OpenCode and every process it spawns run as the session UID, so a value in
+    // its environment, argv or config is readable by the agent's own shell
+    // (`/proc/<pid>/environ`, `/proc/<pid>/cmdline`, `cat`). No profile secret
+    // value may reach the launch: config slots stay references whose values the
+    // launch never receives (#11875).
+    if (Object.values(plan.env).some((value) => typeof value !== "string") ||
+        plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
+        throw new Error("Secret OpenCode refuses a profile secret in its launch environment or arguments");
+    }
     assertWorkspacePlanSupported(plan);
     assertLaunchRoot(input.launchRoot);
-    // Secret values stay out of the revision: file slots reference them, so an
-    // unchanged profile with a rotated per-turn secret reuses this revision.
-    const secretEnvironment = {};
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotEnvironment: secretEnvironment });
+    // File slots reference their secrets, so an unchanged profile with a rotated
+    // per-turn secret reuses this revision.
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotsByReference: true });
     try {
         // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
         // An agent-owned HOME may hold SQLite state, never native authority.
@@ -112,14 +121,10 @@ export async function prepareSecretConcurrentProfileRevision(input) {
                 prepared.dispose();
             }
         }
-        // Added after launchDigest so the digest and receipt never cover a value.
         return {
             directory,
             manifest: prepared.manifest,
-            application: {
-                ...prepared.application,
-                spawn: { ...spawn, env: { ...spawn.env, ...secretEnvironment } },
-            },
+            application: { ...prepared.application, spawn },
         };
     }
     catch (error) {
@@ -154,7 +159,7 @@ function secretRevisionPaths(root) {
     walk(root);
     return { all, exposed };
 }
-function runSetfacl(args, paths) {
+export function runSetfacl(args, paths) {
     for (let start = 0; start < paths.length; start += 64) {
         execFileSync("/usr/bin/setfacl", [...args, "--", ...paths.slice(start, start + 64)], {
             env: { PATH: "/usr/bin:/bin", LANG: "C" },

package/dist/secret-session-view.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
+ * native session at the directory it was created in, so a session resumed on
+ * a later turn keeps this path while each turn's revision changes. The name
+ * binds the shared workspace, the session and its subprocess UID, so two
+ * sessions never share a view.
+ */
+export declare function secretSessionViewWorkspace(input: {
+    launchRoot: string;
+    sharedWorkspaceDir: string;
+    sessionId: string;
+    subprocessUid: number;
+}): string;
+/**
+ * Point a session's view at one published secret revision before the
+ * session's turn runs. The view's `reference/` becomes a fresh tree of hard
+ * links to the revision's read-only files (the same inodes, owner, mode and
+ * ACL), so the session reads this turn's files and nothing the previous
+ * revision held. The view holds nothing else, so OpenCode's config search
+ * finds no config there; profile config stays bound by absolute path.
+ *
+ * The swap is not atomic for a reader that is already running: the caller
+ * runs one turn of a session at a time and binds before that turn spawns.
+ */
+export declare function bindSecretSessionView(input: {
+    launchRoot: string;
+    viewWorkspaceDir: string;
+    revisionWorkspaceDir: string;
+    subprocessUid: number;
+}): void;

package/dist/secret-session-view.js

@@ -0,0 +1,136 @@
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { assertLaunchRoot } from "./managed-workspace.js";
+import { runSetfacl } from "./secret-concurrent-revision.js";
+/** The only cwd-relative content a secret OpenCode revision serves. */
+const VIEW_ENTRY = "reference";
+/**
+ * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
+ * native session at the directory it was created in, so a session resumed on
+ * a later turn keeps this path while each turn's revision changes. The name
+ * binds the shared workspace, the session and its subprocess UID, so two
+ * sessions never share a view.
+ */
+export function secretSessionViewWorkspace(input) {
+    if (!input.sessionId)
+        throw new Error("Secret session view needs a session");
+    const name = createHash("sha256")
+        .update("tangle-secret-session-view\0")
+        .update(input.sharedWorkspaceDir)
+        .update("\0")
+        .update(input.sessionId)
+        .update("\0")
+        .update(String(input.subprocessUid))
+        .digest("hex");
+    return join(input.launchRoot, `session-${name}`, "workspace");
+}
+/**
+ * Point a session's view at one published secret revision before the
+ * session's turn runs. The view's `reference/` becomes a fresh tree of hard
+ * links to the revision's read-only files (the same inodes, owner, mode and
+ * ACL), so the session reads this turn's files and nothing the previous
+ * revision held. The view holds nothing else, so OpenCode's config search
+ * finds no config there; profile config stays bound by absolute path.
+ *
+ * The swap is not atomic for a reader that is already running: the caller
+ * runs one turn of a session at a time and binds before that turn spawns.
+ */
+export function bindSecretSessionView(input) {
+    const { launchRoot, viewWorkspaceDir, revisionWorkspaceDir } = input;
+    if (process.platform !== "linux" ||
+        process.getuid?.() !== 0 ||
+        !Number.isSafeInteger(input.subprocessUid) ||
+        input.subprocessUid < 200_000) {
+        throw new Error("Secret session view needs a root executor and reserved identity");
+    }
+    assertLaunchRoot(launchRoot);
+    const viewRoot = dirname(viewWorkspaceDir);
+    if (!isLaunchWorkspace(launchRoot, viewWorkspaceDir, /^session-[a-f0-9]{64}$/)) {
+        throw new Error("Secret session view is not a launch-root session path");
+    }
+    if (!isLaunchWorkspace(launchRoot, revisionWorkspaceDir, /^revision-[a-f0-9]{64}$/) ||
+        !isSealedNode(lstatSync(revisionWorkspaceDir), "directory")) {
+        throw new Error("Secret session view needs a published revision");
+    }
+    for (const directory of [viewRoot, viewWorkspaceDir]) {
+        const stat = lstatIfPresent(directory);
+        if (!stat)
+            mkdirSync(directory, { mode: 0o700 });
+        else if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== 0) {
+            throw new Error("Secret session view is not an executor-owned directory");
+        }
+    }
+    if (readdirSync(viewWorkspaceDir).some((name) => name !== VIEW_ENTRY)) {
+        throw new Error("Secret session view holds an unexpected entry");
+    }
+    // Only this function writes a view. An interrupted bind leaves a staged or
+    // retired tree beside `workspace`, never inside it.
+    clearBesideWorkspace(viewRoot);
+    const source = join(revisionWorkspaceDir, VIEW_ENTRY);
+    const sourceStat = lstatIfPresent(source);
+    let staged;
+    if (sourceStat) {
+        if (!isSealedNode(sourceStat, "directory")) {
+            throw new Error("Secret revision reference/ is not sealed");
+        }
+        staged = join(viewRoot, `.stage-${randomBytes(8).toString("hex")}`);
+        const directories = linkSealedTree(source, staged);
+        sealDirectories(directories, input.subprocessUid);
+    }
+    const current = join(viewWorkspaceDir, VIEW_ENTRY);
+    if (lstatIfPresent(current)) {
+        renameSync(current, join(viewRoot, `.retired-${randomBytes(8).toString("hex")}`));
+    }
+    if (staged)
+        renameSync(staged, current);
+    clearBesideWorkspace(viewRoot);
+    sealDirectories([viewRoot, viewWorkspaceDir], input.subprocessUid);
+}
+function isLaunchWorkspace(launchRoot, workspace, name) {
+    return (basename(workspace) === "workspace" &&
+        dirname(dirname(workspace)) === launchRoot &&
+        name.test(basename(dirname(workspace))));
+}
+function lstatIfPresent(path) {
+    return lstatSync(path, { throwIfNoEntry: false });
+}
+function isSealedNode(stat, kind) {
+    return (!stat.isSymbolicLink() &&
+        (kind === "directory" ? stat.isDirectory() : stat.isFile()) &&
+        stat.uid === 0 &&
+        (stat.mode & 0o222) === 0);
+}
+/** Hard-link a sealed revision tree; returns every directory it created. */
+function linkSealedTree(source, target) {
+    mkdirSync(target, { mode: 0o700 });
+    const directories = [target];
+    for (const name of readdirSync(source)) {
+        const from = join(source, name);
+        const stat = lstatSync(from);
+        if (isSealedNode(stat, "directory")) {
+            directories.push(...linkSealedTree(from, join(target, name)));
+        }
+        else if (isSealedNode(stat, "file")) {
+            linkSync(from, join(target, name));
+        }
+        else {
+            throw new Error("Secret revision reference/ holds an unsealed inode");
+        }
+    }
+    return directories;
+}
+/** Root-owned, read-only, and traversable only by the session's UID. */
+function sealDirectories(directories, uid) {
+    runSetfacl(["-b"], directories);
+    for (const directory of directories)
+        chmodSync(directory, 0o500);
+    runSetfacl(["-m", `u:${uid}:r-X`], directories);
+}
+function clearBesideWorkspace(viewRoot) {
+    for (const name of readdirSync(viewRoot)) {
+        if (name !== "workspace") {
+            rmSync(join(viewRoot, name), { recursive: true, force: true });
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.26.2",
+  "version": "0.26.4",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^3.0.0 || ^4.0.0 || ^5.0.0"
   },
   "tangleRelease": {
-    "sourceSha": "48d1261ddd76219c35be25a869689fbb120c5f31",
-    "mergedAt": "2026-10-19T00:38:28-06:00"
+    "sourceSha": "7375b922752bb85e4e7541a519be661c363b115f",
+    "mergedAt": "2026-10-19T05:43:15-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -45,7 +45,7 @@
     "test": "pnpm run test:installed-peer && pnpm run test:current-peer",
     "test:installed-peer": "vitest run",
     "test:current-peer": "vitest run --config vitest.current-peer.config.ts",
-    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts tests/secret-reference-resources.test.ts",
+    "test:root": "node ../../scripts/ci/vitest-as-root.mjs tests/concurrent-subagents.test.ts tests/secret-provider-revision.test.ts tests/secret-reference-resources.test.ts tests/secret-session-view.test.ts",
     "test:watch": "vitest"
   }
 }