@tangle-network/agent-profile-materialize 0.26.3 → 0.26.5

package/dist/managed-workspace-stage.d.ts

@@ -20,5 +20,5 @@ export declare function assertPrivateManagedRoot(root: string): void;
  * The caller must keep the returned tree while an admitted turn uses it and
  * dispose it after that turn, so a later binding cannot expose old secrets.
  */
-export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotEnvironment">): Promise<PreparedManagedWorkspace>;
+export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotReferences">): Promise<PreparedManagedWorkspace>;
 export declare function lstatIfPresent(path: string): ReturnType<typeof lstatSync> | null;

package/dist/plan-application.js

@@ -9,7 +9,7 @@ export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
  */
 export async function applyWorkspacePlanWithSecretProvider(plan, workspaceDir, secretProvider, options = {}) {
     const planDigest = hashWorkspacePlan(plan);
-    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotEnvironment);
+    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotReferences);
     return applyResolvedWorkspacePlan(plan, resolved, workspaceDir, options, planDigest);
 }
 function secretRefLabel(ref) {
@@ -81,7 +81,7 @@ function resolvePublicWorkspacePlan(plan) {
 /**
  * OpenCode substitutes `{env:NAME}` textually into its config before parsing
  * it, so only a value that cannot break out of a JSON string or start another
- * substitution may be referenced; any other value is written in place.
+ * substitution may stand behind a reference.
  */
 const SUBSTITUTABLE_SECRET_VALUE = /^[\x20-\x7e]+$/;
 const UNSUBSTITUTABLE_SECRET_CHARACTERS = /["\\{}]/;
@@ -93,7 +93,7 @@ function secretSlotEnvironmentName(ref) {
         .toUpperCase();
     return `TANGLE_PROFILE_SECRET_${digest}`;
 }
-async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotEnvironment) {
+async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotReferences) {
     if (!secretProvider || typeof secretProvider.get !== "function") {
         throw new Error("AgentProfileSecretProvider.get is required");
     }
@@ -123,13 +123,17 @@ async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotEnviron
     const resolveFileSlot = async (input) => {
         const ref = agentProfileSecretRefSchema.parse(input);
         const value = await resolveRawRef(ref);
-        if (!fileSlotEnvironment ||
-            !SUBSTITUTABLE_SECRET_VALUE.test(value) ||
-            UNSUBSTITUTABLE_SECRET_CHARACTERS.test(value)) {
+        if (!fileSlotReferences) {
             return ref.format === "bearer" ? `Bearer ${value}` : value;
         }
+        // Never write the value in place: the file is readable by the process
+        // that loads it, and so by every tool that process runs.
+        if (!SUBSTITUTABLE_SECRET_VALUE.test(value) ||
+            UNSUBSTITUTABLE_SECRET_CHARACTERS.test(value)) {
+            throw new Error(`AgentProfile secret ${secretRefLabel(ref)} has a value that cannot be referenced from a secret OpenCode config: it may hold only printable ASCII without quotes, backslashes or braces`);
+        }
         const name = secretSlotEnvironmentName(ref);
-        fileSlotEnvironment[name] = value;
+        fileSlotReferences[name] = value;
         return ref.format === "bearer" ? `Bearer {env:${name}}` : `{env:${name}}`;
     };
     const files = await Promise.all(normalizePlanFiles(plan.files).map(async (file) => {

package/dist/plan-types.d.ts

@@ -321,14 +321,15 @@ export interface ApplyWorkspacePlanOptions {
      */
     appliedPlanDigest?: string;
     /**
-     * Receives the values of secrets that JSON file slots reference instead of
-     * containing. When set, a slot whose resolved value is safe to substitute
-     * is written as `{env:NAME}` (OpenCode config substitution) and the value
-     * lands here under NAME, so file bytes and every digest over them stay
-     * identical when only a secret's value changes. The caller must add these
-     * entries to the launch environment after digesting the launch.
+     * Write every JSON file secret slot as an `{env:NAME}` reference (OpenCode
+     * config substitution) and never its value, so file bytes and every digest
+     * over them stay identical when only a secret's value changes. The value
+     * lands here under NAME for the executor alone: never put it in the launch
+     * environment, argv or any file the native process reads, because that
+     * process hands everything it holds to every tool it runs. A value that
+     * could not be substituted safely is refused.
      */
-    secretFileSlotEnvironment?: Record<string, string>;
+    secretFileSlotReferences?: Record<string, string>;
 }
 import type { AgentProfileSecretRef } from "@tangle-network/agent-interface";
 import type { HarnessId } from "./harness.js";

package/dist/secret-concurrent-revision.d.ts

@@ -18,5 +18,13 @@ export declare function prepareSecretConcurrentProfileRevision(input: {
     namingKey: Uint8Array;
     secretProvider: AgentProfileSecretProvider;
     options?: Pick<ApplyWorkspacePlanOptions, "runtimeOnlyFiles">;
-}): Promise<ConcurrentProfileRevision>;
+}): Promise<ConcurrentProfileRevision & {
+    /**
+     * The value behind each `{env:NAME}` reference in the revision's config,
+     * for the executor alone: the launch never receives them. An executor
+     * that serves a referencing MCP server through its own loopback proxy
+     * resolves the server's headers here.
+     */
+    secretReferences: Readonly<Record<string, string>>;
+}>;
 export declare function runSetfacl(args: string[], paths: readonly string[]): void;

package/dist/secret-concurrent-revision.js

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { assertLaunchRoot, listRevisionFiles, makeStageWritable, prepareExplicitOpenCodePlan, } from "./managed-workspace.js";
 import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
 import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
+import { normalizeWorkspacePlanArgument } from "./plan-normalize.js";
 import { assertWorkspacePlanSupported } from "./plan-support.js";
 /**
  * Publish a resolved revision for exactly one native subprocess UID. The
@@ -52,12 +53,21 @@ export async function prepareSecretConcurrentProfileRevision(input) {
     if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
         throw new Error("Secret OpenCode reserves its native config directory");
     }
+    // OpenCode and every process it spawns run as the session UID, so a value in
+    // its environment, argv or config is readable by the agent's own shell
+    // (`/proc/<pid>/environ`, `/proc/<pid>/cmdline`, `cat`). No profile secret
+    // value may reach the launch: config slots stay references whose values the
+    // launch never receives (#11875).
+    if (Object.values(plan.env).some((value) => typeof value !== "string") ||
+        plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
+        throw new Error("Secret OpenCode refuses a profile secret in its launch environment or arguments");
+    }
     assertWorkspacePlanSupported(plan);
     assertLaunchRoot(input.launchRoot);
-    // Secret values stay out of the revision: file slots reference them, so an
-    // unchanged profile with a rotated per-turn secret reuses this revision.
-    const secretEnvironment = {};
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotEnvironment: secretEnvironment });
+    // File slots reference their secrets, so an unchanged profile with a rotated
+    // per-turn secret reuses this revision.
+    const secretReferences = {};
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotReferences: secretReferences });
     try {
         // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
         // An agent-owned HOME may hold SQLite state, never native authority.
@@ -112,14 +122,11 @@ export async function prepareSecretConcurrentProfileRevision(input) {
                 prepared.dispose();
             }
         }
-        // Added after launchDigest so the digest and receipt never cover a value.
         return {
             directory,
             manifest: prepared.manifest,
-            application: {
-                ...prepared.application,
-                spawn: { ...spawn, env: { ...spawn.env, ...secretEnvironment } },
-            },
+            application: { ...prepared.application, spawn },
+            secretReferences,
         };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.26.3",
+  "version": "0.26.5",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^3.0.0 || ^4.0.0 || ^5.0.0"
   },
   "tangleRelease": {
-    "sourceSha": "c7971c78f69c191b991da10bcb17ac1a30ab66b2",
-    "mergedAt": "2026-10-19T02:02:40-06:00"
+    "sourceSha": "264ba6910963c1036183ef29fe6ed3dadb465256",
+    "mergedAt": "2026-10-19T06:31:19-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",