@tangle-network/agent-profile-materialize 1.1.4 → 1.1.6

package/dist/hooks.d.ts

@@ -1,6 +1,6 @@
 export declare function materializeHooks(h: HarnessId, hooks: Record<string, AgentProfileHookCommand[]>, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void, plan: WorkspacePlan): void;
 export declare function registerClaudeSettings(plan: WorkspacePlan): void;
-export declare function hookWrapperSource(executable: string, args: string[], env: Record<string, string>): string;
+export declare function hookWrapperSource(executable: string, args: string[], extraEnv: Record<string, string>, envSources?: Record<string, string>): string;
 import type { AgentProfileHookCommand } from "@tangle-network/agent-interface";
 import type { AddPlanFile } from "./plan-json.js";
 import type { HarnessId, Unsupported, WorkspacePlan } from "./plan-types.js";

package/dist/hooks.js

@@ -195,47 +195,36 @@ function materializedHookCommand(event, command, add, plan) {
         setPlanEnvironment(plan, sourceName, value);
         return [name, sourceName];
     }));
-    add(path, hookWrapperSourceFromEnvironment("/bin/sh", ["-c", command.command], envSources));
+    add(path, hookWrapperSource("/bin/sh", ["-c", command.command], {}, envSources));
     return `node ${path}`;
 }
-function hookWrapperSourceFromEnvironment(executable, args, envSources) {
-    return [
-        'import { spawnSync } from "node:child_process"',
-        `const executable = ${JSON.stringify(executable)}`,
-        `const args = ${JSON.stringify(args)}`,
-        `const envSources = ${JSON.stringify(envSources)}`,
-        "const extraEnv = {}",
-        "for (const [name, source] of Object.entries(envSources)) {",
-        "  const value = process.env[source]",
-        "  if (value === undefined) {",
-        '    console.error("missing materialized hook environment " + source)',
-        "    process.exit(127)",
-        "  }",
-        "  extraEnv[name] = value",
-        "}",
-        "const result = spawnSync(executable, args, {",
-        '  stdio: "inherit",',
-        "  env: { ...process.env, ...extraEnv },",
-        "  shell: false,",
-        "})",
-        "if (result.error) {",
-        "  console.error(result.error.message)",
-        "  process.exit(127)",
-        "}",
-        "if (result.signal) {",
-        '  console.error("hook terminated by " + result.signal)',
-        "  process.exit(1)",
-        "}",
-        "process.exit(result.status ?? 1)",
-        "",
-    ].join("\n");
-}
-export function hookWrapperSource(executable, args, env) {
+// Classic plan env accepts string | AgentProfileConfigValue (public | secretRef)
+// in profile-plan.ts: keep resolved secrets out of workspace files by carrying
+// source names and resolving at runtime, failing closed with 127 when missing.
+// candidatePublicString rejects non-public values, so candidates inline them
+// to keep sealed bundles self-contained without a runtime environment channel.
+export function hookWrapperSource(executable, args, extraEnv, envSources) {
+    if (envSources !== undefined && Object.keys(extraEnv).length > 0) {
+        throw new Error("Hook wrapper cannot mix inline environment values and sources");
+    }
     return [
         'import { spawnSync } from "node:child_process"',
         `const executable = ${JSON.stringify(executable)}`,
         `const args = ${JSON.stringify(args)}`,
-        `const extraEnv = ${JSON.stringify(env)}`,
+        ...(envSources === undefined
+            ? [`const extraEnv = ${JSON.stringify(extraEnv)}`]
+            : [
+                `const envSources = ${JSON.stringify(envSources)}`,
+                "const extraEnv = {}",
+                "for (const [name, source] of Object.entries(envSources)) {",
+                "  const value = process.env[source]",
+                "  if (value === undefined) {",
+                '    console.error("missing materialized hook environment " + source)',
+                "    process.exit(127)",
+                "  }",
+                "  extraEnv[name] = value",
+                "}",
+            ]),
         "const result = spawnSync(executable, args, {",
         '  stdio: "inherit",',
         "  env: { ...process.env, ...extraEnv },",

package/dist/plan-types.d.ts

@@ -267,7 +267,7 @@ export interface WorkspacePlanReceipt {
     systemPromptBinding?: WorkspacePlanSystemPromptBinding;
     unsupported: Unsupported[];
     /**
-     * Legacy workspace-root paths for existing workspace-only consumers.
+     * Workspace-root paths, for consumers that mount the workspace only.
      * Agent-root files are available in `writtenFiles` and are never encoded as
      * an `agent:` path because that spelling is legal in the workspace root.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^5.10.2"
   },
   "tangleRelease": {
-    "sourceSha": "63d47e506531a1ed0a1102912ca799cd3df4ae98",
-    "mergedAt": "2026-10-28T10:01:26-06:00"
+    "sourceSha": "317182be2d49d5ca117256b3c807d12ad023a844",
+    "mergedAt": "2026-10-29T05:44:32-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",