@tangle-network/agent-profile-materialize 0.26.4 → 0.26.5

package/dist/managed-workspace-stage.d.ts

@@ -20,5 +20,5 @@ export declare function assertPrivateManagedRoot(root: string): void;
  * The caller must keep the returned tree while an admitted turn uses it and
  * dispose it after that turn, so a later binding cannot expose old secrets.
  */
-export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotsByReference">): Promise<PreparedManagedWorkspace>;
+export declare function prepareManagedWorkspacePlan(plan: WorkspacePlan, managedRoot: string, sharedWorkspaceDir: string, secretProvider: AgentProfileSecretProvider, options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles" | "secretFileSlotReferences">): Promise<PreparedManagedWorkspace>;
 export declare function lstatIfPresent(path: string): ReturnType<typeof lstatSync> | null;

package/dist/plan-application.js

@@ -9,7 +9,7 @@ export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
  */
 export async function applyWorkspacePlanWithSecretProvider(plan, workspaceDir, secretProvider, options = {}) {
     const planDigest = hashWorkspacePlan(plan);
-    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotsByReference === true);
+    const resolved = await resolvePrivateWorkspacePlan(plan, secretProvider, options.secretFileSlotReferences);
     return applyResolvedWorkspacePlan(plan, resolved, workspaceDir, options, planDigest);
 }
 function secretRefLabel(ref) {
@@ -93,7 +93,7 @@ function secretSlotEnvironmentName(ref) {
         .toUpperCase();
     return `TANGLE_PROFILE_SECRET_${digest}`;
 }
-async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotsByReference) {
+async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotReferences) {
     if (!secretProvider || typeof secretProvider.get !== "function") {
         throw new Error("AgentProfileSecretProvider.get is required");
     }
@@ -123,7 +123,7 @@ async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotsByRefe
     const resolveFileSlot = async (input) => {
         const ref = agentProfileSecretRefSchema.parse(input);
         const value = await resolveRawRef(ref);
-        if (!fileSlotsByReference) {
+        if (!fileSlotReferences) {
             return ref.format === "bearer" ? `Bearer ${value}` : value;
         }
         // Never write the value in place: the file is readable by the process
@@ -133,6 +133,7 @@ async function resolvePrivateWorkspacePlan(plan, secretProvider, fileSlotsByRefe
             throw new Error(`AgentProfile secret ${secretRefLabel(ref)} has a value that cannot be referenced from a secret OpenCode config: it may hold only printable ASCII without quotes, backslashes or braces`);
         }
         const name = secretSlotEnvironmentName(ref);
+        fileSlotReferences[name] = value;
         return ref.format === "bearer" ? `Bearer {env:${name}}` : `{env:${name}}`;
     };
     const files = await Promise.all(normalizePlanFiles(plan.files).map(async (file) => {

package/dist/plan-types.d.ts

@@ -323,11 +323,13 @@ export interface ApplyWorkspacePlanOptions {
     /**
      * Write every JSON file secret slot as an `{env:NAME}` reference (OpenCode
      * config substitution) and never its value, so file bytes and every digest
-     * over them stay identical when only a secret's value changes. The value is
-     * not returned: a native process that held it would hand it to every tool
-     * it runs. A value that could not be substituted safely is refused.
+     * over them stay identical when only a secret's value changes. The value
+     * lands here under NAME for the executor alone: never put it in the launch
+     * environment, argv or any file the native process reads, because that
+     * process hands everything it holds to every tool it runs. A value that
+     * could not be substituted safely is refused.
      */
-    secretFileSlotsByReference?: true;
+    secretFileSlotReferences?: Record<string, string>;
 }
 import type { AgentProfileSecretRef } from "@tangle-network/agent-interface";
 import type { HarnessId } from "./harness.js";

package/dist/secret-concurrent-revision.d.ts

@@ -18,5 +18,13 @@ export declare function prepareSecretConcurrentProfileRevision(input: {
     namingKey: Uint8Array;
     secretProvider: AgentProfileSecretProvider;
     options?: Pick<ApplyWorkspacePlanOptions, "runtimeOnlyFiles">;
-}): Promise<ConcurrentProfileRevision>;
+}): Promise<ConcurrentProfileRevision & {
+    /**
+     * The value behind each `{env:NAME}` reference in the revision's config,
+     * for the executor alone: the launch never receives them. An executor
+     * that serves a referencing MCP server through its own loopback proxy
+     * resolves the server's headers here.
+     */
+    secretReferences: Readonly<Record<string, string>>;
+}>;
 export declare function runSetfacl(args: string[], paths: readonly string[]): void;

package/dist/secret-concurrent-revision.js

@@ -66,7 +66,8 @@ export async function prepareSecretConcurrentProfileRevision(input) {
     assertLaunchRoot(input.launchRoot);
     // File slots reference their secrets, so an unchanged profile with a rotated
     // per-turn secret reuses this revision.
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotsByReference: true });
+    const secretReferences = {};
+    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotReferences: secretReferences });
     try {
         // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
         // An agent-owned HOME may hold SQLite state, never native authority.
@@ -125,6 +126,7 @@ export async function prepareSecretConcurrentProfileRevision(input) {
             directory,
             manifest: prepared.manifest,
             application: { ...prepared.application, spawn },
+            secretReferences,
         };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.26.4",
+  "version": "0.26.5",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^3.0.0 || ^4.0.0 || ^5.0.0"
   },
   "tangleRelease": {
-    "sourceSha": "7375b922752bb85e4e7541a519be661c363b115f",
-    "mergedAt": "2026-10-19T05:43:15-06:00"
+    "sourceSha": "264ba6910963c1036183ef29fe6ed3dadb465256",
+    "mergedAt": "2026-10-19T06:31:19-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",