@tangle-network/agent-profile-materialize 0.26.9 → 0.27.1

package/dist/index.d.ts

@@ -27,3 +27,4 @@ export type { ResolveAgentProfileResourcesOptions } from "./resource-resolution.
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
 export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";
 export * from "./secret-session-view.js";
+export * from "./tool-bin-path.js";

package/dist/index.js

@@ -21,3 +21,4 @@ export * from "./profile-start-check.js";
 export { normalizeSkillMd, resolveAgentProfileResources, } from "./resource-resolution.js";
 export { prepareSecretConcurrentProfileRevision } from "./secret-concurrent-revision.js";
 export * from "./secret-session-view.js";
+export * from "./tool-bin-path.js";

package/dist/managed-workspace-bind.js

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 /**
  * Paths a secret OpenCode revision serves from its own immutable tree:
  * read-only profile content under `reference/`, skills, and OpenCode's
@@ -88,9 +88,19 @@ export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, op
             break;
         }
     }
+    // A declared executable reference/ tool runs from the immutable revision:
+    // its directory, absolute in that revision, joins the launch PATH.
+    const toolBinDirs = [];
     for (const file of plan.files) {
-        if (ridesSecretRevision(plan, file, options))
+        if (ridesSecretRevision(plan, file, options)) {
+            if (file.relPath.startsWith("reference/") &&
+                ((file.mode ?? 0) & 0o111) !== 0) {
+                const dir = join(revisionWorkspaceDir, dirname(file.relPath));
+                if (!toolBinDirs.includes(dir))
+                    toolBinDirs.push(dir);
+            }
             continue;
+        }
         if (file.source !== "generated") {
             throw new Error(`Concurrent ${plan.harness} profile resource ${file.relPath} needs a shared-workspace collision-safe copy`);
         }
@@ -104,5 +114,10 @@ export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, op
             throw new Error(`Concurrent ${plan.harness} profile cannot bind runtime-only file ${name}`);
         }
     }
-    return { ...application.spawn, flags, env };
+    return {
+        ...application.spawn,
+        flags,
+        env,
+        ...(toolBinDirs.length > 0 ? { toolBinDirs } : {}),
+    };
 }

package/dist/plan-normalize.d.ts

@@ -7,9 +7,6 @@ export interface NormalizedPlanFile {
     ownership: NonNullable<PlanFile["ownership"]>;
     secretSlots: PlanFileSecretSlot[];
 }
-export type JsonValue = null | boolean | number | string | JsonValue[] | {
-    [key: string]: JsonValue;
-};
 export declare function normalizePlanFiles(files: PlanFile[]): NormalizedPlanFile[];
 export declare function normalizeWorkspacePlanArgument(value: WorkspacePlanArgument): WorkspacePlanArgument;
 import type { PlanFile, PlanFileRoot, PlanFileSecretSlot, WorkspacePlanArgument } from "./plan-types.js";

package/dist/plan-types.d.ts

@@ -284,6 +284,13 @@ export interface WorkspacePlanSpawnInputs {
     appendSystemPrompt?: string;
     /** Read it with {@link takeSystemPromptBinding}, which refuses a foreign control. */
     systemPromptBinding?: WorkspacePlanSystemPromptBinding;
+    /**
+     * Absolute dirs of the profile's declared executable `reference/` tools in
+     * the immutable revision the launch runs from. The provider puts them on
+     * the launch PATH in place of the app's own tool dirs (bindLaunchToolBinDirs),
+     * so a profile names its CLI bare.
+     */
+    toolBinDirs?: string[];
 }
 /** Result of applying a public plan at the private executor boundary. */
 export interface WorkspacePlanApplication {

package/dist/profile-bundle-cache.js

@@ -3,7 +3,7 @@ import { mkdirSync, readdirSync, rmSync } from "node:fs";
 import { mkdir, open, readFile, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { join } from "node:path";
 import { PROFILE_BUNDLE_DEFAULT_MAX_BYTES, PROFILE_BUNDLE_MAX_BYTES, PROFILE_BUNDLE_MAX_FILE_BYTES, PROFILE_BUNDLE_MAX_FILES, PROFILE_BUNDLE_SCHEMA, } from "./profile-bundle-key.js";
-import { evictProfileBundles, evictUnlocked, fsyncDir, hasPendingRootWork, loadLru, pathExists, profileBundleManifestPath, readManifestFile, saveLru, sweepProfileBundleCache, sweepUnlocked, withRootLock, } from "./profile-bundle-lru.js";
+import { evictProfileBundles, evictUnlocked, fsyncDir, hasPendingRootWork, loadLru, pathExistsFollowingLinks, profileBundleManifestPath, readManifestFile, saveLru, sweepProfileBundleCache, sweepUnlocked, withRootLock, } from "./profile-bundle-lru.js";
 import { hasControlCharacter, normalizeWorkspaceRelativePath, validateFileMode, } from "./workspace-files.js";
 export * from "./profile-bundle-key.js";
 export { evictProfileBundles, profileBundleManifestPath, sweepProfileBundleCache, } from "./profile-bundle-lru.js";
@@ -142,7 +142,7 @@ export async function admitProfileBundle(root, manifest, readObject) {
                 }
                 totalBytes += buffer.byteLength;
                 const object = join(root, "objects", entry.sha256);
-                if (await pathExists(object)) {
+                if (await pathExistsFollowingLinks(object)) {
                     // Already admitted; the bytes above were re-verified, so drop the temp.
                     continue;
                 }

package/dist/profile-bundle-lru.d.ts

@@ -17,7 +17,7 @@ export interface ProfileBundleLru {
         createdAt: string;
     }>;
 }
-export declare function pathExists(path: string): Promise<boolean>;
+export declare function pathExistsFollowingLinks(path: string): Promise<boolean>;
 export declare function fsyncDir(dir: string): Promise<void>;
 export declare function withRootLock<T>(root: string, run: () => Promise<T>): Promise<T>;
 /** Synchronous open must not sweep a root with pending asynchronous work. */

package/dist/profile-bundle-lru.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { open, readdir, readFile, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { compareStrings } from "./workspace-files.js";
-export async function pathExists(path) {
+export async function pathExistsFollowingLinks(path) {
     try {
         await stat(path);
         return true;
@@ -150,7 +150,7 @@ export async function evictUnlocked(root, maxBytes) {
     const lru = await loadLru(root);
     const objectsDir = join(root, "objects");
     for (const sha of Object.keys(lru.objects)) {
-        if (!(await pathExists(join(objectsDir, sha)))) {
+        if (!(await pathExistsFollowingLinks(join(objectsDir, sha)))) {
             delete lru.objects[sha];
         }
     }

package/dist/tool-bin-path.d.ts

@@ -0,0 +1,23 @@
+/** The colon-separated, absolute CLI bin dirs a sandbox app mounts for its tools. */
+export declare const SANDBOX_TOOL_BIN_DIRS_ENV = "SANDBOX_TOOL_BIN_DIRS";
+/**
+ * The tool bin dirs a `SANDBOX_TOOL_BIN_DIRS` value names, or `[]` when it is
+ * unset or blank.
+ *
+ * Fail loud, never silently degrade: a malformed value (a relative segment,
+ * or an empty segment from a stray/leading/trailing colon) throws rather than
+ * silently dropping a tool dir from PATH or admitting a relative path that
+ * resolves against whatever the process cwd happens to be.
+ */
+export declare function parseSandboxToolBinDirs(value: string | undefined): string[];
+/**
+ * A launch environment whose tool bin dirs are `toolBinDirs`, at the TAIL of
+ * PATH after every Nix, npm, image and system entry, so a tool never shadows
+ * a platform-owned binary of the same name.
+ *
+ * They replace `appToolBinDirs` (by default the dirs the environment's own
+ * `SANDBOX_TOOL_BIN_DIRS` names) wherever those sit in PATH, so an app's older
+ * copy of the same tool cannot win by PATH order. Relative PATH entries are
+ * dropped too: they resolve against whatever cwd the turn moves to.
+ */
+export declare function bindLaunchToolBinDirs(env: Readonly<Record<string, string | undefined>>, toolBinDirs: readonly string[], appToolBinDirs?: readonly string[]): Record<string, string | undefined>;

package/dist/tool-bin-path.js

@@ -0,0 +1,61 @@
+import { isAbsolute } from "node:path";
+/** The colon-separated, absolute CLI bin dirs a sandbox app mounts for its tools. */
+export const SANDBOX_TOOL_BIN_DIRS_ENV = "SANDBOX_TOOL_BIN_DIRS";
+/**
+ * The tool bin dirs a `SANDBOX_TOOL_BIN_DIRS` value names, or `[]` when it is
+ * unset or blank.
+ *
+ * Fail loud, never silently degrade: a malformed value (a relative segment,
+ * or an empty segment from a stray/leading/trailing colon) throws rather than
+ * silently dropping a tool dir from PATH or admitting a relative path that
+ * resolves against whatever the process cwd happens to be.
+ */
+export function parseSandboxToolBinDirs(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return [];
+    const segments = trimmed.split(":");
+    for (const segment of segments) {
+        if (!segment || !isAbsolute(segment)) {
+            throw new Error(`SANDBOX_TOOL_BIN_DIRS must be a colon-separated list of absolute paths with no empty segments, got: ${trimmed}`);
+        }
+    }
+    return segments;
+}
+function assertToolBinDir(dir) {
+    // A ':' would split one declared dir into several PATH entries, admitting
+    // a dir no profile declared.
+    if (!dir || !isAbsolute(dir) || dir.includes(":")) {
+        throw new Error(`a tool bin dir must be an absolute path without ':', got: ${dir}`);
+    }
+}
+/**
+ * A launch environment whose tool bin dirs are `toolBinDirs`, at the TAIL of
+ * PATH after every Nix, npm, image and system entry, so a tool never shadows
+ * a platform-owned binary of the same name.
+ *
+ * They replace `appToolBinDirs` (by default the dirs the environment's own
+ * `SANDBOX_TOOL_BIN_DIRS` names) wherever those sit in PATH, so an app's older
+ * copy of the same tool cannot win by PATH order. Relative PATH entries are
+ * dropped too: they resolve against whatever cwd the turn moves to.
+ */
+export function bindLaunchToolBinDirs(env, toolBinDirs, appToolBinDirs = parseSandboxToolBinDirs(env[SANDBOX_TOOL_BIN_DIRS_ENV])) {
+    for (const dir of toolBinDirs)
+        assertToolBinDir(dir);
+    const dirs = [...new Set(toolBinDirs)];
+    // No PATH to bind: the spawner appends SANDBOX_TOOL_BIN_DIRS to its default.
+    if (env.PATH === undefined) {
+        return { ...env, [SANDBOX_TOOL_BIN_DIRS_ENV]: dirs.join(":") };
+    }
+    const replaced = new Set(appToolBinDirs);
+    const entries = env.PATH.split(":").filter((entry) => isAbsolute(entry) && !replaced.has(entry));
+    for (const dir of dirs) {
+        if (!entries.includes(dir))
+            entries.push(dir);
+    }
+    return {
+        ...env,
+        PATH: entries.join(":"),
+        [SANDBOX_TOOL_BIN_DIRS_ENV]: dirs.join(":"),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.26.9",
+  "version": "0.27.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^3.0.0 || ^4.0.0 || ^5.0.0"
   },
   "tangleRelease": {
-    "sourceSha": "be89262c7e1faaedf04926a27d0ecbf17d91a318",
-    "mergedAt": "2026-10-19T23:54:34-06:00"
+    "sourceSha": "5a536a79fbd83dfa11da194bf5348cf0d73f224d",
+    "mergedAt": "2026-10-21T05:59:51-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",