@tangle-network/agent-profile-materialize 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -60,9 +60,17 @@ export interface WorkspacePlanReceipt {
     unsupported: Unsupported[];
     written: string[];
 }
+/** The plan was applied, but one or more private staging files remain. */
+export declare class WorkspacePlanCleanupError extends AggregateError {
+    readonly receipt: WorkspacePlanReceipt;
+    readonly temporaryPaths: readonly string[];
+    constructor(errors: readonly unknown[], receipt: WorkspacePlanReceipt, temporaryPaths: readonly string[]);
+}
 export interface ApplyWorkspacePlanOptions {
     /** Plan files consumed in memory by the runtime and never persisted to cwd. */
     runtimeOnlyFiles?: readonly string[];
+    /** Existing workspace paths are either exact idempotent inputs or forbidden. */
+    existingFiles?: "allow-identical" | "reject";
 }
 /** Fail when a profile asks for controls the chosen harness cannot execute. */
 export declare function assertWorkspacePlanSupported(plan: Pick<WorkspacePlan, "unsupported">): void;

package/dist/index.js

@@ -22,7 +22,7 @@
  * cli-bridge and agent-dev-container — this is the single source those re-export.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { closeSync, fchmodSync, constants as fsConstants, linkSync, lstatSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { closeSync, fchmodSync, constants as fsConstants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32, } from "node:path";
 import { agentCandidateProfileActivationSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateProfilePlanMaterialSchema, agentCandidateProfileSchema, agentProfileSchema, canonicalCandidateBytes, canonicalCandidateDigest, resolveNativeWebTools, } from "@tangle-network/agent-interface";
 /** Resolve inline bytes already present on the profile. Remote resources must
@@ -37,6 +37,17 @@ function resolveInlineRef(ref) {
     }
     return null; // github / unresolved
 }
+/** The plan was applied, but one or more private staging files remain. */
+export class WorkspacePlanCleanupError extends AggregateError {
+    receipt;
+    temporaryPaths;
+    constructor(errors, receipt, temporaryPaths) {
+        super(errors, "Applied workspace plan but failed to remove temporary files");
+        this.name = "WorkspacePlanCleanupError";
+        this.receipt = receipt;
+        this.temporaryPaths = Object.freeze([...temporaryPaths]);
+    }
+}
 /** Fail when a profile asks for controls the chosen harness cannot execute. */
 export function assertWorkspacePlanSupported(plan) {
     if (plan.unsupported.length > 0) {
@@ -952,6 +963,10 @@ export function applyAgentCandidateWorkspacePlan(plan, workspaceDir, targetWorks
 export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
     const workspaceRoot = resolve(workspaceDir);
     const runtimeOnlyFiles = new Set((options.runtimeOnlyFiles ?? []).map(normalizeWorkspaceRelativePath));
+    const existingFiles = options.existingFiles ?? "allow-identical";
+    if (existingFiles !== "allow-identical" && existingFiles !== "reject") {
+        throw new Error(`Unsupported existing workspace file policy: ${existingFiles}`);
+    }
     const files = normalizePlanFiles(plan.files)
         .filter((file) => !runtimeOnlyFiles.has(file.relPath))
         .map((file) => ({
@@ -962,24 +977,77 @@ export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
     // existing symlink cannot leave a partially materialized workspace.
     for (const file of files) {
         assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-        if (workspaceFileExists(file.absPath) && !workspaceFileMatches(file)) {
+        if (workspaceFileExists(file.absPath) &&
+            (existingFiles === "reject" || !workspaceFileMatches(file))) {
             throw new Error(`Refusing to replace existing workspace file: ${file.relPath}`);
         }
     }
+    // Parent directories remain on failure because they may contain concurrent
+    // workspace state that this call does not own.
     for (const file of files) {
         mkdirSync(dirname(file.absPath), { recursive: true });
     }
     for (const file of files) {
         assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
     }
-    const written = [];
-    for (const file of files) {
-        if (!workspaceFileExists(file.absPath)) {
-            writeWorkspaceFile(workspaceRoot, file);
+    const prepared = [];
+    // Prepared temp links stay alive through publication and rollback. Their
+    // inodes distinguish files created here from concurrent replacements.
+    try {
+        for (const file of files) {
+            if (existingFiles === "allow-identical" &&
+                workspaceFileExists(file.absPath) &&
+                workspaceFileMatches(file)) {
+                continue;
+            }
+            prepared.push(prepareWorkspaceFile(workspaceRoot, file));
+        }
+        for (const entry of prepared) {
+            assertNoSymlinkPathComponents(workspaceRoot, entry.file.absPath);
+            try {
+                linkSync(entry.temporaryPath, entry.file.absPath);
+                entry.published = true;
+            }
+            catch (error) {
+                if (isFsError(error, "EEXIST") &&
+                    existingFiles === "allow-identical" &&
+                    workspaceFileMatches(entry.file)) {
+                    continue;
+                }
+                if (isFsError(error, "EEXIST")) {
+                    throw new Error(`Refusing to replace existing workspace file: ${entry.file.relPath}`, { cause: error });
+                }
+                throw error;
+            }
         }
-        written.push(file.relPath);
     }
-    return {
+    catch (error) {
+        const cleanupErrors = [];
+        for (const entry of [...prepared].reverse()) {
+            try {
+                if (entry.published &&
+                    workspacePathHasIdentity(entry.file.absPath, entry.identity)) {
+                    unlinkSync(entry.file.absPath);
+                }
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(cleanupError);
+            }
+            try {
+                if (workspacePathHasIdentity(entry.temporaryPath, entry.identity)) {
+                    unlinkSync(entry.temporaryPath);
+                }
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(cleanupError);
+            }
+        }
+        if (cleanupErrors.length > 0) {
+            throw new AggregateError([error, ...cleanupErrors], "Failed to apply workspace plan and roll back published files");
+        }
+        throw error;
+    }
+    const receipt = {
         workspacePlanDigest: hashWorkspacePlan(plan),
         env: plan.env,
         flags: plan.flags,
@@ -987,8 +1055,25 @@ export function applyWorkspacePlan(plan, workspaceDir, options = {}) {
             ? {}
             : { systemPrompt: plan.systemPrompt }),
         unsupported: plan.unsupported,
-        written,
+        written: files.map((file) => file.relPath),
     };
+    const cleanupErrors = [];
+    const temporaryPaths = [];
+    for (const entry of prepared) {
+        try {
+            unlinkSync(entry.temporaryPath);
+        }
+        catch (error) {
+            if (!isFsError(error, "ENOENT")) {
+                cleanupErrors.push(error);
+                temporaryPaths.push(entry.temporaryPath);
+            }
+        }
+    }
+    if (cleanupErrors.length > 0) {
+        throw new WorkspacePlanCleanupError(cleanupErrors, receipt, temporaryPaths);
+    }
+    return receipt;
 }
 function workspaceFileExists(pathValue) {
     try {
@@ -1007,6 +1092,59 @@ function workspaceFileMatches(file) {
         (stats.mode & 0o777) === file.mode &&
         readFileSync(file.absPath, "utf8") === file.content);
 }
+function prepareWorkspaceFile(workspaceRoot, file) {
+    assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
+    const temporaryPath = join(dirname(file.absPath), `.agent-profile-${randomUUID()}.tmp`);
+    let descriptor;
+    try {
+        descriptor = openSync(temporaryPath, SAFE_WRITE_FLAGS, 0o600);
+        writeFileSync(descriptor, file.content, "utf8");
+        fchmodSync(descriptor, file.mode);
+        const stats = fstatSync(descriptor);
+        const descriptorToClose = descriptor;
+        descriptor = undefined;
+        closeSync(descriptorToClose);
+        return {
+            file,
+            temporaryPath,
+            identity: { device: stats.dev, inode: stats.ino },
+            published: false,
+        };
+    }
+    catch (error) {
+        const cleanupErrors = [];
+        if (descriptor !== undefined) {
+            try {
+                closeSync(descriptor);
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(cleanupError);
+            }
+        }
+        try {
+            unlinkSync(temporaryPath);
+        }
+        catch (cleanupError) {
+            if (!isFsError(cleanupError, "ENOENT"))
+                cleanupErrors.push(cleanupError);
+        }
+        if (cleanupErrors.length > 0) {
+            throw new AggregateError([error, ...cleanupErrors], `Failed to prepare workspace file: ${file.relPath}`);
+        }
+        throw error;
+    }
+}
+function workspacePathHasIdentity(pathValue, identity) {
+    try {
+        const stats = lstatSync(pathValue);
+        return stats.dev === identity.device && stats.ino === identity.inode;
+    }
+    catch (error) {
+        if (isFsError(error, "ENOENT"))
+            return false;
+        throw error;
+    }
+}
 function resolveWorkspaceFilePath(workspaceRoot, relativePath) {
     const targetPath = resolve(workspaceRoot, ...relativePath.split("/"));
     const targetRelativePath = relative(workspaceRoot, targetPath);
@@ -1046,40 +1184,6 @@ function assertNoSymlinkPathComponents(workspaceRoot, targetPath) {
         }
     }
 }
-function writeWorkspaceFile(workspaceRoot, file) {
-    assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-    const temporaryPath = join(dirname(file.absPath), `.agent-profile-${randomUUID()}.tmp`);
-    let descriptor;
-    try {
-        descriptor = openSync(temporaryPath, SAFE_WRITE_FLAGS, 0o600);
-        writeFileSync(descriptor, file.content, "utf8");
-        fchmodSync(descriptor, file.mode);
-        closeSync(descriptor);
-        descriptor = undefined;
-        assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
-        try {
-            linkSync(temporaryPath, file.absPath);
-        }
-        catch (error) {
-            if (!isFsError(error, "EEXIST") || !workspaceFileMatches(file)) {
-                throw error;
-            }
-        }
-        unlinkSync(temporaryPath);
-    }
-    catch (error) {
-        if (descriptor !== undefined)
-            closeSync(descriptor);
-        try {
-            unlinkSync(temporaryPath);
-        }
-        catch (cleanupError) {
-            if (!isFsError(cleanupError, "ENOENT"))
-                throw cleanupError;
-        }
-        throw error;
-    }
-}
 function isFsError(error, code) {
     return (typeof error === "object" &&
         error !== null &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "main": "./dist/index.js",