@tangle-network/agent-profile-materialize 1.1.5 → 1.1.7

package/dist/hooks.d.ts

@@ -1,6 +1,6 @@
 export declare function materializeHooks(h: HarnessId, hooks: Record<string, AgentProfileHookCommand[]>, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void, plan: WorkspacePlan): void;
 export declare function registerClaudeSettings(plan: WorkspacePlan): void;
-export declare function hookWrapperSource(executable: string, args: string[], env: Record<string, string>): string;
+export declare function hookWrapperSource(executable: string, args: string[], extraEnv: Record<string, string>, envSources?: Record<string, string>): string;
 import type { AgentProfileHookCommand } from "@tangle-network/agent-interface";
 import type { AddPlanFile } from "./plan-json.js";
 import type { HarnessId, Unsupported, WorkspacePlan } from "./plan-types.js";

package/dist/hooks.js

@@ -195,47 +195,36 @@ function materializedHookCommand(event, command, add, plan) {
         setPlanEnvironment(plan, sourceName, value);
         return [name, sourceName];
     }));
-    add(path, hookWrapperSourceFromEnvironment("/bin/sh", ["-c", command.command], envSources));
+    add(path, hookWrapperSource("/bin/sh", ["-c", command.command], {}, envSources));
     return `node ${path}`;
 }
-function hookWrapperSourceFromEnvironment(executable, args, envSources) {
-    return [
-        'import { spawnSync } from "node:child_process"',
-        `const executable = ${JSON.stringify(executable)}`,
-        `const args = ${JSON.stringify(args)}`,
-        `const envSources = ${JSON.stringify(envSources)}`,
-        "const extraEnv = {}",
-        "for (const [name, source] of Object.entries(envSources)) {",
-        "  const value = process.env[source]",
-        "  if (value === undefined) {",
-        '    console.error("missing materialized hook environment " + source)',
-        "    process.exit(127)",
-        "  }",
-        "  extraEnv[name] = value",
-        "}",
-        "const result = spawnSync(executable, args, {",
-        '  stdio: "inherit",',
-        "  env: { ...process.env, ...extraEnv },",
-        "  shell: false,",
-        "})",
-        "if (result.error) {",
-        "  console.error(result.error.message)",
-        "  process.exit(127)",
-        "}",
-        "if (result.signal) {",
-        '  console.error("hook terminated by " + result.signal)',
-        "  process.exit(1)",
-        "}",
-        "process.exit(result.status ?? 1)",
-        "",
-    ].join("\n");
-}
-export function hookWrapperSource(executable, args, env) {
+// Classic plan env accepts string | AgentProfileConfigValue (public | secretRef)
+// in profile-plan.ts: keep resolved secrets out of workspace files by carrying
+// source names and resolving at runtime, failing closed with 127 when missing.
+// candidatePublicString rejects non-public values, so candidates inline them
+// to keep sealed bundles self-contained without a runtime environment channel.
+export function hookWrapperSource(executable, args, extraEnv, envSources) {
+    if (envSources !== undefined && Object.keys(extraEnv).length > 0) {
+        throw new Error("Hook wrapper cannot mix inline environment values and sources");
+    }
     return [
         'import { spawnSync } from "node:child_process"',
         `const executable = ${JSON.stringify(executable)}`,
         `const args = ${JSON.stringify(args)}`,
-        `const extraEnv = ${JSON.stringify(env)}`,
+        ...(envSources === undefined
+            ? [`const extraEnv = ${JSON.stringify(extraEnv)}`]
+            : [
+                `const envSources = ${JSON.stringify(envSources)}`,
+                "const extraEnv = {}",
+                "for (const [name, source] of Object.entries(envSources)) {",
+                "  const value = process.env[source]",
+                "  if (value === undefined) {",
+                '    console.error("missing materialized hook environment " + source)',
+                "    process.exit(127)",
+                "  }",
+                "  extraEnv[name] = value",
+                "}",
+            ]),
         "const result = spawnSync(executable, args, {",
         '  stdio: "inherit",',
         "  env: { ...process.env, ...extraEnv },",

package/dist/managed-workspace-bind.d.ts

@@ -1,4 +1,4 @@
 import type { WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
 export declare function bindConcurrentLaunch(plan: WorkspacePlan, application: WorkspacePlanApplication, revisionWorkspaceDir: string, options?: {
-    readonly secretOpenCodeRevision?: boolean;
+    readonly secretRevision?: boolean;
 }): WorkspacePlanApplication["spawn"];

package/dist/managed-workspace-bind.js

@@ -1,12 +1,6 @@
 import { dirname, join } from "node:path";
 import { CODEX_SYSTEM_PROMPT_FILE } from "./harness.js";
 import { bindWorkspaceLaunchFlags } from "./workspace-launch.js";
-/**
- * Paths a secret OpenCode revision serves from its own immutable tree:
- * read-only profile content under `reference/`, skills, and OpenCode's
- * standard agent and command definitions (OpenCode reads
- * `.opencode/{agent,agents}/**\/*.md` and `.opencode/{command,commands}/**\/*.md`).
- */
 const SECRET_REVISION_NATIVE_PATH = /^(?:reference\/|\.opencode\/skills\/|\.opencode\/(?:agents?|commands?)\/(?:[^./][^/]*\/)*[^./][^/]*\.md$)/u;
 export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, options = {}) {
     if (plan.requires?.length) {
@@ -44,10 +38,6 @@ export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, op
                 supportedFiles.add(CODEX_SYSTEM_PROMPT_FILE);
             }
             break;
-        // kimi-code has no case: kimi-code 2.x discovers MCP only from
-        // <cwd>/.kimi-code/mcp.json and has no launch flag that rebinds it to the
-        // revision, so a concurrent kimi-code plan carrying one fails closed in
-        // the redirect check below.
         case "opencode": {
             const runtimeConfig = application.runtimeOnlyFiles["opencode.json"];
             if (runtimeConfig !== undefined)
@@ -75,13 +65,17 @@ export function bindConcurrentLaunch(plan, application, revisionWorkspaceDir, op
     // its directory, absolute in that revision, joins the launch PATH.
     const toolBinDirs = [];
     for (const file of plan.files) {
-        // Secret OpenCode launches from its immutable revision workspace, with
-        // that revision's .opencode as config directory. These relative native
-        // resources therefore read the revision, never the shared workspace.
-        if (options.secretOpenCodeRevision === true &&
-            plan.harness === "opencode" &&
+        // Private launches read their exact user resources from a sealed session
+        // view. Generated native authority keeps its verified absolute binding.
+        if (options.secretRevision === true &&
             (file.root ?? "workspace") === "workspace" &&
-            SECRET_REVISION_NATIVE_PATH.test(file.relPath)) {
+            (file.source === "user" ||
+                (plan.harness === "opencode" &&
+                    SECRET_REVISION_NATIVE_PATH.test(file.relPath)))) {
+            if (plan.harness === "codex" &&
+                /^\.codex\/(?:config\.toml|auth\.json)$/u.test(file.relPath)) {
+                throw new Error("Secret Codex profile resource claims native authority");
+            }
             if (file.relPath.startsWith("reference/") &&
                 ((file.mode ?? 0) & 0o111) !== 0) {
                 const dir = join(revisionWorkspaceDir, dirname(file.relPath));

package/dist/managed-workspace.d.ts

@@ -2,36 +2,30 @@ import type { AgentProfileSecretProvider } from "@tangle-network/agent-interface
 import type { ManagedWorkspaceManifest } from "./managed-workspace-types.js";
 import type { ApplyWorkspacePlanOptions, WorkspacePlan, WorkspacePlanApplication } from "./plan-types.js";
 export type { ManagedWorkspaceFileDigest, ManagedWorkspaceManifest, } from "./managed-workspace-types.js";
-/** A private, write-once revision and the exact inputs for one native spawn. */
 export interface ConcurrentProfileRevision {
     directory: string;
     manifest: ManagedWorkspaceManifest;
     application: WorkspacePlanApplication;
 }
-/** Create the two executor-owned roots on one filesystem. */
 export declare function ensurePublicConcurrentProfileRoots(base: string): {
     managedRoot: string;
     launchRoot: string;
 };
-/**
- * Materialize PUBLIC profile material beside the shared workspace. Processes
- * in one sandbox share a uid and can read each other's revision files and env.
- * Callers must not use this path for confidential profile text or credentials.
- * Only native controls with a verified explicit launch path are admitted.
- * A separate reaper owns removal after no native process reads the revision.
- */
 export declare function preparePublicConcurrentProfileRevision(input: {
     plan: WorkspacePlan;
     managedRoot: string;
-    /** Root-owned, agent-traversable publication root on the same filesystem. */
     launchRoot: string;
     sharedWorkspaceDir: string;
     ownerId: string;
     secretProvider: AgentProfileSecretProvider;
     options?: Pick<ApplyWorkspacePlanOptions, "ownership" | "runtimeOnlyFiles">;
 }): Promise<ConcurrentProfileRevision>;
-/** Move OpenCode's cwd-discovered primary agent into its explicit JSON config. */
+export declare function publishConcurrentProfileRevision(prepared: Omit<ConcurrentProfileRevision, "directory"> & {
+    root: string;
+    dispose(): void;
+}, directory: string, bind: (directory: string) => WorkspacePlanApplication["spawn"], seal: (root: string) => void, privateRevision?: boolean): ConcurrentProfileRevision;
 export declare function prepareExplicitOpenCodePlan(plan: WorkspacePlan): WorkspacePlan;
+export declare function assertPublishedRevision(directory: string, expected: ManagedWorkspaceManifest, inodeOwnerUid?: number): void;
 export declare function listRevisionFiles(root: string, prefix?: string): string[];
 export declare function assertLaunchRoot(root: string): void;
 export declare function makeStageWritable(root: string): void;

package/dist/managed-workspace.js

@@ -4,7 +4,6 @@ import { dirname, join, resolve } from "node:path";
 import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
 import { assertPrivateManagedRoot, lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
 import { assertWorkspacePlanSupported } from "./plan-support.js";
-/** Create the two executor-owned roots on one filesystem. */
 export function ensurePublicConcurrentProfileRoots(base) {
     if (process.getuid?.() !== 0 || !base || resolve(base) !== base) {
         throw new Error("Concurrent profile roots require an absolute path and a root executor");
@@ -33,13 +32,6 @@ export function ensurePublicConcurrentProfileRoots(base) {
     }
     return { managedRoot, launchRoot };
 }
-/**
- * Materialize PUBLIC profile material beside the shared workspace. Processes
- * in one sandbox share a uid and can read each other's revision files and env.
- * Callers must not use this path for confidential profile text or credentials.
- * Only native controls with a verified explicit launch path are admitted.
- * A separate reaper owns removal after no native process reads the revision.
- */
 export async function preparePublicConcurrentProfileRevision(input) {
     if (!input.ownerId)
         throw new Error("Concurrent profile revision needs a binding owner");
@@ -55,38 +47,34 @@ export async function preparePublicConcurrentProfileRevision(input) {
     assertWorkspacePlanSupported(plan);
     assertLaunchRoot(input.launchRoot);
     const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, input.options);
+    const identity = createHash("sha256")
+        .update(`${input.ownerId}\0${prepared.manifest.materializedDigest}`)
+        .digest("hex");
+    return publishConcurrentProfileRevision(prepared, join(input.launchRoot, `revision-${identity}`), (directory) => bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace")), (root) => makeRevisionReadOnly(root, false));
+}
+export function publishConcurrentProfileRevision(prepared, directory, bind, seal, privateRevision = false) {
+    const assertExisting = () => assertPublishedRevision(directory, prepared.manifest, privateRevision ? 0 : undefined);
     try {
-        const identity = createHash("sha256")
-            .update(`${input.ownerId}\0${prepared.manifest.materializedDigest}`)
-            .digest("hex");
-        const directory = join(input.launchRoot, `revision-${identity}`);
-        // Validate every native file before publishing a revision that a launcher
-        // could mistake for a complete profile.
-        const spawn = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"));
+        const spawn = bind(directory);
         prepared.manifest.launchDigest = createHash("sha256")
             .update(JSON.stringify(spawn))
             .digest("hex");
         writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
-        const existing = lstatIfPresent(directory);
-        if (existing) {
-            assertPublishedRevision(directory, prepared.manifest);
+        if (lstatIfPresent(directory)) {
+            assertExisting();
             prepared.dispose();
         }
         else {
             try {
-                // Keep the top directory private and writable for rename. The child
-                // tree is complete and read-only before publication.
-                makeRevisionReadOnly(prepared.root, false);
+                seal(prepared.root);
                 renameSync(prepared.root, directory);
-                // This is the publication point: agents cannot traverse the root
-                // before its mode changes from 0700 to 0555.
-                chmodSync(directory, 0o555);
+                if (!privateRevision)
+                    chmodSync(directory, 0o555);
             }
             catch (error) {
-                const raced = lstatIfPresent(directory);
-                if (!raced?.isDirectory() || raced.isSymbolicLink())
+                if (!lstatIfPresent(directory))
                     throw error;
-                assertPublishedRevision(directory, prepared.manifest);
+                assertExisting();
                 makeStageWritable(prepared.root);
                 prepared.dispose();
             }
@@ -96,16 +84,12 @@ export async function preparePublicConcurrentProfileRevision(input) {
             manifest: prepared.manifest,
             application: {
                 ...prepared.application,
-                receipt: {
-                    ...prepared.application.receipt,
-                    flags: [...spawn.flags],
-                },
+                receipt: { ...prepared.application.receipt, flags: [...spawn.flags] },
                 spawn,
             },
         };
     }
     catch (error) {
-        // A published revision is never removed here; only an unpublished stage is.
         if (lstatIfPresent(prepared.root)) {
             makeStageWritable(prepared.root);
             prepared.dispose();
@@ -113,7 +97,6 @@ export async function preparePublicConcurrentProfileRevision(input) {
         throw error;
     }
 }
-/** Move OpenCode's cwd-discovered primary agent into its explicit JSON config. */
 export function prepareExplicitOpenCodePlan(plan) {
     if (plan.harness !== "opencode")
         return plan;
@@ -185,40 +168,41 @@ export function prepareExplicitOpenCodePlan(plan) {
         files: files.map((file) => file === configFile ? { ...file, content: JSON.stringify(body) } : file),
     };
 }
-function assertPublishedRevision(directory, expected) {
+export function assertPublishedRevision(directory, expected, inodeOwnerUid) {
+    const label = inodeOwnerUid === undefined ? "Concurrent" : "Secret concurrent";
     const root = lstatSync(directory);
     if (!root.isDirectory() ||
-        root.isSymbolicLink() ||
-        (root.mode & 0o777) !== 0o555) {
-        throw new Error("Concurrent profile revision is not fully published");
+        (inodeOwnerUid === undefined
+            ? (root.mode & 0o777) !== 0o555
+            : root.uid !== inodeOwnerUid || (root.mode & 0o222) !== 0)) {
+        throw new Error(`${label} profile revision is not fully published or immutable`);
     }
     const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
     if (persisted.materializedDigest !== expected.materializedDigest ||
         persisted.launchDigest !== expected.launchDigest) {
-        throw new Error("Concurrent profile revision digest collision");
+        throw new Error(`${label} profile revision digest collision`);
     }
     for (const file of expected.files) {
         const path = join(directory, file.root, file.relPath);
         const stat = lstatSync(path);
         if (!stat.isFile() ||
-            stat.isSymbolicLink() ||
+            (inodeOwnerUid !== undefined && stat.uid !== inodeOwnerUid) ||
             (stat.mode & 0o222) !== 0 ||
             createHash("sha256").update(readFileSync(path)).digest("hex") !==
                 file.sha256) {
-            throw new Error(`Concurrent profile revision file changed: ${file.relPath}`);
+            throw new Error(`${label} profile revision file changed`);
         }
     }
     const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
     for (const rootName of ["workspace", "agent"]) {
         for (const relPath of listRevisionFiles(join(directory, rootName))) {
             if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
-                throw new Error(`Concurrent profile revision has an unexpected file: ${rootName}/${relPath}`);
+                throw new Error(`${label} profile revision has an unexpected file`);
             }
         }
     }
-    if (expectedPaths.size) {
-        throw new Error("Concurrent profile revision is missing a manifest file");
-    }
+    if (expectedPaths.size)
+        throw new Error(`${label} profile revision is missing a manifest file`);
 }
 export function listRevisionFiles(root, prefix = "") {
     const found = [];
@@ -239,7 +223,6 @@ export function assertLaunchRoot(root) {
     }
     const stat = lstatSync(root);
     if (!stat.isDirectory() ||
-        stat.isSymbolicLink() ||
         realpathSync(root) !== root ||
         (stat.mode & 0o022) !== 0 ||
         (stat.mode & 0o111) !== 0o111 ||
@@ -249,9 +232,7 @@ export function assertLaunchRoot(root) {
     let ancestor = dirname(root);
     while (ancestor !== root) {
         const ancestorStat = lstatSync(ancestor);
-        if (!ancestorStat.isDirectory() ||
-            ancestorStat.isSymbolicLink() ||
-            (ancestorStat.mode & 0o001) === 0) {
+        if (!ancestorStat.isDirectory() || (ancestorStat.mode & 0o001) === 0) {
             throw new Error(`Concurrent profile launch root has a non-traversable ancestor: ${ancestor}`);
         }
         if (ancestor === dirname(ancestor))

package/dist/secret-concurrent-revision.d.ts

@@ -1,4 +1,4 @@
-import type { AgentProfileSecretProvider } from "@tangle-network/agent-interface";
+import { type AgentProfileSecretProvider } from "@tangle-network/agent-interface";
 import { type ConcurrentProfileRevision } from "./managed-workspace.js";
 import type { ApplyWorkspacePlanOptions, WorkspacePlan } from "./plan-types.js";
 /**

package/dist/secret-concurrent-revision.js

@@ -1,10 +1,11 @@
 import { execFileSync } from "node:child_process";
 import { createHash, createHmac } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { chmodSync, lstatSync, mkdirSync, readdirSync } from "node:fs";
 import { join } from "node:path";
-import { assertLaunchRoot, listRevisionFiles, makeStageWritable, prepareExplicitOpenCodePlan, } from "./managed-workspace.js";
+import { agentProfileSecretRefSchema, } from "@tangle-network/agent-interface";
+import { assertLaunchRoot, prepareExplicitOpenCodePlan, publishConcurrentProfileRevision, } from "./managed-workspace.js";
 import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
-import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
+import { prepareManagedWorkspacePlan } from "./managed-workspace-stage.js";
 import { normalizeWorkspacePlanArgument } from "./plan-normalize.js";
 import { assertWorkspacePlanSupported } from "./plan-support.js";
 /** Refuse an executor that cannot isolate the revision, or a plan that claims its launch names. */
@@ -21,9 +22,10 @@ function assertSecretRevisionLaunch(input) {
         "OPENCODE_DISABLE_PROJECT_CONFIG",
         "OPENCODE_CONFIG_DIR",
         "TANGLE_SHARED_WORKSPACE",
+        "TANGLE_PROFILE_REVISION_WORKSPACE",
     ]) {
         if (Object.hasOwn(input.plan.env, name)) {
-            throw new Error(`Secret OpenCode reserves ${name} for its launch binding`);
+            throw new Error(`Secret ${input.plan.harness} reserves ${name} for its launch binding`);
         }
     }
 }
@@ -67,27 +69,29 @@ function secretOpenCodePlan(sourcePlan, providerConfig, secretReferences) {
     }
     return plan;
 }
-/** Publish the staged revision read-only, or adopt an identical one already published. */
-function publishSecretRevision(prepared, directory, subprocessUid) {
-    const existing = lstatIfPresent(directory);
-    if (existing) {
-        assertPublishedSecretRevision(directory, prepared.manifest);
-        prepared.dispose();
-    }
-    else {
-        try {
-            makeSecretRevisionReadOnly(prepared.root, subprocessUid);
-            renameSync(prepared.root, directory);
-        }
-        catch (error) {
-            const raced = lstatIfPresent(directory);
-            if (!raced?.isDirectory() || raced.isSymbolicLink())
-                throw error;
-            assertPublishedSecretRevision(directory, prepared.manifest);
-            makeStageWritable(prepared.root);
-            prepared.dispose();
+/** Codex's native readback identifies which held values belong to MCP servers. */
+async function secretCodexPlan(plan, references, provider) {
+    const env = { ...plan.env };
+    for (const [variable, value] of Object.entries(env)) {
+        if (/^(?:CODEX_|XDG_|HOME$)/u.test(variable)) {
+            throw new Error(`Secret Codex reserves ${variable} for its launch binding`);
         }
-    }
+        if (typeof value === "string" && !variable.startsWith("TANGLE_MCP_HEADER_"))
+            continue;
+        const ref = typeof value === "string"
+            ? undefined
+            : agentProfileSecretRefSchema.parse(value);
+        const raw = ref ? await provider.get(ref.key) : value;
+        if (typeof raw !== "string" || !raw.trim())
+            throw new Error("Secret Codex MCP value is unavailable");
+        const name = `${HELD_VALUE_PREFIX}${createHash("sha256").update(`codex-mcp-env\0${variable}`).digest("hex").slice(0, 24).toUpperCase()}`;
+        references[name] = ref?.format === "bearer" ? `Bearer ${raw}` : raw;
+        env[variable] = `{env:${name}}`;
+    }
+    if (plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
+        throw new Error("Secret Codex refuses a profile secret in native arguments");
+    }
+    return { ...plan, env };
 }
 /**
  * Publish a resolved revision for exactly one native subprocess UID. The
@@ -97,62 +101,53 @@ function publishSecretRevision(prepared, directory, subprocessUid) {
 export async function prepareSecretConcurrentProfileRevision(input) {
     assertSecretRevisionLaunch(input);
     const secretReferences = {};
-    const plan = secretOpenCodePlan(input.plan, input.providerConfig, secretReferences);
+    if (input.plan.harness !== "codex" && input.plan.harness !== "opencode") {
+        throw new Error("Secret profile has no verified native launch binding");
+    }
+    const plan = input.plan.harness === "codex"
+        ? await secretCodexPlan(input.plan, secretReferences, input.secretProvider)
+        : secretOpenCodePlan(input.plan, input.providerConfig, secretReferences);
     assertWorkspacePlanSupported(plan);
     assertLaunchRoot(input.launchRoot);
     // File slots reference their secrets, so an unchanged profile with a rotated
     // per-turn secret reuses this revision.
     const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotReferences: secretReferences });
-    try {
-        // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
-        // An agent-owned HOME may hold SQLite state, never native authority.
-        mkdirSync(join(prepared.root, "workspace", ".config", "opencode"), {
-            recursive: true,
-            mode: 0o700,
-        });
-        mkdirSync(join(prepared.root, "workspace", ".opencode"), {
-            recursive: true,
-            mode: 0o700,
-        });
-        const identity = createHmac("sha256", input.namingKey)
-            .update(input.sharedWorkspaceDir)
-            .update("\0")
-            .update(input.ownerId)
-            .update("\0")
-            .update(String(input.subprocessUid))
-            .update("\0")
-            .update(prepared.manifest.materializedDigest)
-            .digest("hex");
-        const directory = join(input.launchRoot, `revision-${identity}`);
-        const bound = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretOpenCodeRevision: true });
-        const spawn = {
+    const identity = createHmac("sha256", input.namingKey)
+        .update(input.sharedWorkspaceDir)
+        .update("\0")
+        .update(input.ownerId)
+        .update("\0")
+        .update(String(input.subprocessUid))
+        .update("\0")
+        .update(prepared.manifest.materializedDigest)
+        .digest("hex");
+    const revision = publishConcurrentProfileRevision(prepared, join(input.launchRoot, `revision-${identity}`), (directory) => {
+        // OpenCode's sealed XDG tree never reads authority from native HOME.
+        if (plan.harness === "opencode")
+            for (const relPath of [".config/opencode", ".opencode"]) {
+                mkdirSync(join(prepared.root, "workspace", relPath), {
+                    recursive: true,
+                    mode: 0o700,
+                });
+            }
+        const bound = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretRevision: true });
+        return {
             ...bound,
             env: {
                 ...bound.env,
-                OPENCODE_DISABLE_PROJECT_CONFIG: "1",
-                OPENCODE_CONFIG_DIR: join(directory, "workspace", ".opencode"),
+                ...(plan.harness === "opencode"
+                    ? {
+                        OPENCODE_DISABLE_PROJECT_CONFIG: "1",
+                        OPENCODE_CONFIG_DIR: join(directory, "workspace", ".opencode"),
+                    }
+                    : {
+                        TANGLE_PROFILE_REVISION_WORKSPACE: join(directory, "workspace"),
+                    }),
                 TANGLE_SHARED_WORKSPACE: input.sharedWorkspaceDir,
             },
         };
-        prepared.manifest.launchDigest = createHash("sha256")
-            .update(JSON.stringify(spawn))
-            .digest("hex");
-        writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
-        publishSecretRevision(prepared, directory, input.subprocessUid);
-        return {
-            directory,
-            manifest: prepared.manifest,
-            application: { ...prepared.application, spawn },
-            secretReferences,
-        };
-    }
-    catch (error) {
-        if (lstatIfPresent(prepared.root)) {
-            makeStageWritable(prepared.root);
-            prepared.dispose();
-        }
-        throw error;
-    }
+    }, (root) => makeSecretRevisionReadOnly(root, input.subprocessUid), true);
+    return { ...revision, secretReferences };
 }
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** How `servableMcpServer` recognizes a header value the executor holds. */
@@ -252,40 +247,3 @@ function makeSecretRevisionReadOnly(root, uid) {
     // files, but never the executor inventory or another revision's files.
     runSetfacl(["-m", `u:${uid}:r-X`], paths.exposed);
 }
-function assertPublishedSecretRevision(directory, expected) {
-    const root = lstatSync(directory);
-    if (!root.isDirectory() ||
-        root.isSymbolicLink() ||
-        root.uid !== 0 ||
-        (root.mode & 0o222) !== 0) {
-        throw new Error("Secret concurrent profile revision is not immutable");
-    }
-    const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
-    if (persisted.materializedDigest !== expected.materializedDigest ||
-        persisted.launchDigest !== expected.launchDigest) {
-        throw new Error("Secret concurrent profile revision digest collision");
-    }
-    for (const file of expected.files) {
-        const filePath = join(directory, file.root, file.relPath);
-        const stat = lstatSync(filePath);
-        if (!stat.isFile() ||
-            stat.isSymbolicLink() ||
-            stat.uid !== 0 ||
-            (stat.mode & 0o222) !== 0 ||
-            createHash("sha256").update(readFileSync(filePath)).digest("hex") !==
-                file.sha256) {
-            throw new Error("Secret concurrent profile revision file changed");
-        }
-    }
-    const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
-    for (const rootName of ["workspace", "agent"]) {
-        for (const relPath of listRevisionFiles(join(directory, rootName))) {
-            if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
-                throw new Error("Secret concurrent profile revision has an unexpected file");
-            }
-        }
-    }
-    if (expectedPaths.size) {
-        throw new Error("Secret concurrent profile revision is missing a manifest file");
-    }
-}

package/dist/secret-session-view.d.ts

@@ -1,9 +1,7 @@
 /**
- * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
- * native session at the directory it was created in, so a session resumed on
- * a later turn keeps this path while each turn's revision changes. The name
- * binds the shared workspace, the session and its subprocess UID, so two
- * sessions never share a view.
+ * The stable, sealed cwd of one secret session. Native resume keeps this path
+ * while each turn's revision changes. Its name binds the workspace, session
+ * and subprocess UID, so two sessions never share a view.
  */
 export declare function secretSessionViewWorkspace(input: {
     launchRoot: string;
@@ -12,21 +10,12 @@ export declare function secretSessionViewWorkspace(input: {
     subprocessUid: number;
 }): string;
 /**
- * Point a session's view at one published secret revision before the
- * session's turn runs. The view's `reference/` and `.opencode/skills/` become
- * fresh trees of hard links to the revision's read-only files (the same
- * inodes, owner, mode and ACL), so the session reads this turn's files and
- * skills and nothing the previous revision held. A product's skill index
- * names `.opencode/skills/<id>/SKILL.md` cwd-relative, and OpenCode's skill
- * tool lists the same files through the revision's config directory.
+ * Bind every supplied workspace resource at its literal path, using the same
+ * root-owned, read-only inode and ACL as the published revision. Generated
+ * native configuration stays bound by absolute path, outside this cwd.
  *
- * The view holds nothing else: no `opencode.json`, and a `.opencode/` with
- * only the revision's digest-attested skills, which the launch does not load
- * as project config (it sets OPENCODE_DISABLE_PROJECT_CONFIG). Profile config
- * stays bound by absolute path.
- *
- * The swap is not atomic for a reader that is already running: the caller
- * runs one turn of a session at a time and binds before that turn spawns.
+ * The caller serializes a session's turns and binds before spawning: replacing
+ * a cwd while a previous native process still reads it is not supported.
  */
 export declare function bindSecretSessionView(input: {
     launchRoot: string;

package/dist/secret-session-view.js

@@ -1,28 +1,13 @@
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, } from "node:fs";
+import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { HARNESS_SKILL_DIRS } from "./harness.js";
-import { assertLaunchRoot } from "./managed-workspace.js";
+import { assertLaunchRoot, assertPublishedRevision, } from "./managed-workspace.js";
 import { runSetfacl } from "./secret-concurrent-revision.js";
-/** The profile's read-only files, which products name cwd-relative. */
-const REFERENCE_ENTRY = "reference";
+import { normalizeWorkspaceRelativePath } from "./workspace-files.js";
 /**
- * The profile's mounted skills, at the cwd-relative directory the platform
- * publishes for products to name in their prompts (`.opencode/skills`).
- */
-const SKILLS_DIR = HARNESS_SKILL_DIRS.opencode;
-const SKILLS_ENTRY = dirname(SKILLS_DIR);
-/** The only cwd-relative content a secret OpenCode session view serves. */
-const VIEW_ENTRIES = new Set([
-    REFERENCE_ENTRY,
-    SKILLS_ENTRY,
-]);
-/**
- * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
- * native session at the directory it was created in, so a session resumed on
- * a later turn keeps this path while each turn's revision changes. The name
- * binds the shared workspace, the session and its subprocess UID, so two
- * sessions never share a view.
+ * The stable, sealed cwd of one secret session. Native resume keeps this path
+ * while each turn's revision changes. Its name binds the workspace, session
+ * and subprocess UID, so two sessions never share a view.
  */
 export function secretSessionViewWorkspace(input) {
     if (!input.sessionId)
@@ -38,21 +23,12 @@ export function secretSessionViewWorkspace(input) {
     return join(input.launchRoot, `session-${name}`, "workspace");
 }
 /**
- * Point a session's view at one published secret revision before the
- * session's turn runs. The view's `reference/` and `.opencode/skills/` become
- * fresh trees of hard links to the revision's read-only files (the same
- * inodes, owner, mode and ACL), so the session reads this turn's files and
- * skills and nothing the previous revision held. A product's skill index
- * names `.opencode/skills/<id>/SKILL.md` cwd-relative, and OpenCode's skill
- * tool lists the same files through the revision's config directory.
- *
- * The view holds nothing else: no `opencode.json`, and a `.opencode/` with
- * only the revision's digest-attested skills, which the launch does not load
- * as project config (it sets OPENCODE_DISABLE_PROJECT_CONFIG). Profile config
- * stays bound by absolute path.
+ * Bind every supplied workspace resource at its literal path, using the same
+ * root-owned, read-only inode and ACL as the published revision. Generated
+ * native configuration stays bound by absolute path, outside this cwd.
  *
- * The swap is not atomic for a reader that is already running: the caller
- * runs one turn of a session at a time and binds before that turn spawns.
+ * The caller serializes a session's turns and binds before spawning: replacing
+ * a cwd while a previous native process still reads it is not supported.
  */
 export function bindSecretSessionView(input) {
     const { launchRoot, viewWorkspaceDir, revisionWorkspaceDir } = input;
@@ -67,66 +43,86 @@ export function bindSecretSessionView(input) {
     if (!isLaunchWorkspace(launchRoot, viewWorkspaceDir, /^session-[a-f0-9]{64}$/)) {
         throw new Error("Secret session view is not a launch-root session path");
     }
+    const revisionRoot = dirname(revisionWorkspaceDir);
+    const manifestPath = join(revisionRoot, "manifest.json");
     if (!isLaunchWorkspace(launchRoot, revisionWorkspaceDir, /^revision-[a-f0-9]{64}$/) ||
-        !isSealedNode(lstatSync(revisionWorkspaceDir), "directory")) {
+        realpathSync(revisionWorkspaceDir) !== revisionWorkspaceDir ||
+        !isSealedNode(lstatSync(revisionRoot), "directory") ||
+        !isSealedNode(lstatSync(revisionWorkspaceDir), "directory") ||
+        !isSealedNode(lstatSync(manifestPath), "file")) {
         throw new Error("Secret session view needs a published revision");
     }
-    for (const directory of [viewRoot, viewWorkspaceDir]) {
-        const stat = lstatIfPresent(directory);
-        if (!stat)
-            mkdirSync(directory, { mode: 0o700 });
-        else if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== 0) {
-            throw new Error("Secret session view is not an executor-owned directory");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    for (const file of manifest.files) {
+        if (!["workspace", "agent"].includes(file.root) ||
+            normalizeWorkspaceRelativePath(file.relPath) !== file.relPath) {
+            throw new Error("Secret revision resource path is not canonical");
         }
     }
-    if (readdirSync(viewWorkspaceDir).some((name) => !VIEW_ENTRIES.has(name))) {
-        throw new Error("Secret session view holds an unexpected entry");
+    assertPublishedRevision(revisionRoot, manifest, 0);
+    const current = lstatIfPresent(viewRoot);
+    if (!current)
+        mkdirSync(viewRoot, { mode: 0o700 });
+    else if (!current.isDirectory() ||
+        current.isSymbolicLink() ||
+        current.uid !== 0 ||
+        (current.mode & 0o022) !== 0) {
+        throw new Error("Secret session view is not an executor-owned directory");
     }
-    // Only this function writes a view. An interrupted bind leaves a staged or
-    // retired tree beside `workspace`, never inside it.
-    clearBesideWorkspace(viewRoot);
-    const staged = new Map();
-    const reference = sealedRevisionDirectory(revisionWorkspaceDir, REFERENCE_ENTRY);
-    if (reference) {
-        const target = besideWorkspace(viewRoot, "stage");
-        sealDirectories(linkSealedTree(reference, target), input.subprocessUid);
-        staged.set(REFERENCE_ENTRY, target);
-    }
-    const skills = sealedRevisionDirectory(revisionWorkspaceDir, SKILLS_DIR);
-    if (skills) {
-        const target = besideWorkspace(viewRoot, "stage");
-        mkdirSync(target, { mode: 0o700 });
-        const directories = [
-            target,
-            ...linkSealedTree(skills, join(target, basename(SKILLS_DIR))),
-        ];
-        sealDirectories(directories, input.subprocessUid);
-        staged.set(SKILLS_ENTRY, target);
-    }
-    for (const entry of VIEW_ENTRIES) {
-        const current = join(viewWorkspaceDir, entry);
-        if (lstatIfPresent(current)) {
-            renameSync(current, besideWorkspace(viewRoot, "retired"));
+    const workspace = lstatIfPresent(viewWorkspaceDir);
+    if (workspace) {
+        if (!isSealedNode(workspace, "directory")) {
+            throw new Error("Secret session view is not an executor-owned directory");
         }
-        const next = staged.get(entry);
-        if (next)
-            renameSync(next, current);
+        assertSealedTree(viewWorkspaceDir);
     }
+    // An interrupted bind leaves its staging/retired tree beside workspace.
     clearBesideWorkspace(viewRoot);
-    sealDirectories([viewRoot, viewWorkspaceDir], input.subprocessUid);
-}
-/** A sealed directory of the published revision, or undefined when absent. */
-function sealedRevisionDirectory(revisionWorkspaceDir, relPath) {
-    const source = join(revisionWorkspaceDir, relPath);
-    const stat = lstatIfPresent(source);
-    if (!stat)
-        return undefined;
-    if (!isSealedNode(stat, "directory")) {
-        throw new Error(`Secret revision ${relPath}/ is not sealed`);
+    const staged = besideWorkspace(viewRoot, "stage");
+    const retired = besideWorkspace(viewRoot, "retired");
+    mkdirSync(staged, { mode: 0o700 });
+    const directories = new Set([staged]);
+    try {
+        for (const file of manifest.files) {
+            if (file.root !== "workspace" || file.source !== "user")
+                continue;
+            const relative = file.relPath;
+            const source = join(revisionWorkspaceDir, relative);
+            let ancestor = dirname(source);
+            while (ancestor !== revisionRoot) {
+                if (!isSealedNode(lstatSync(ancestor), "directory")) {
+                    throw new Error("Secret revision resource has an unsealed ancestor");
+                }
+                ancestor = dirname(ancestor);
+            }
+            const target = join(staged, relative);
+            mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+            linkSync(source, target);
+            ancestor = dirname(target);
+            while (ancestor !== staged) {
+                directories.add(ancestor);
+                ancestor = dirname(ancestor);
+            }
+        }
+        sealDirectories([...directories], input.subprocessUid);
+        if (lstatIfPresent(viewWorkspaceDir))
+            renameSync(viewWorkspaceDir, retired);
+        try {
+            renameSync(staged, viewWorkspaceDir);
+        }
+        catch (error) {
+            if (lstatIfPresent(retired))
+                renameSync(retired, viewWorkspaceDir);
+            throw error;
+        }
+        sealDirectories([viewRoot], input.subprocessUid);
+        clearBesideWorkspace(viewRoot);
+    }
+    finally {
+        rmSync(staged, { recursive: true, force: true });
     }
-    return source;
 }
-/** A fresh staged or retired path beside the view's `workspace`. */
+/** A fresh staged or retired path beside the view's workspace. */
 function besideWorkspace(viewRoot, kind) {
     return join(viewRoot, `.${kind}-${randomBytes(8).toString("hex")}`);
 }
@@ -144,24 +140,15 @@ function isSealedNode(stat, kind) {
         stat.uid === 0 &&
         (stat.mode & 0o222) === 0);
 }
-/** Hard-link a sealed revision tree; returns every directory it created. */
-function linkSealedTree(source, target) {
-    mkdirSync(target, { mode: 0o700 });
-    const directories = [target];
-    for (const name of readdirSync(source)) {
-        const from = join(source, name);
-        const stat = lstatSync(from);
-        if (isSealedNode(stat, "directory")) {
-            directories.push(...linkSealedTree(from, join(target, name)));
-        }
-        else if (isSealedNode(stat, "file")) {
-            linkSync(from, join(target, name));
-        }
-        else {
-            throw new Error("Secret revision reference/ holds an unsealed inode");
-        }
+function assertSealedTree(root) {
+    const stat = lstatSync(root);
+    if (isSealedNode(stat, "directory")) {
+        for (const name of readdirSync(root))
+            assertSealedTree(join(root, name));
+    }
+    else if (!isSealedNode(stat, "file")) {
+        throw new Error("Secret session view holds an unexpected or unsealed entry");
     }
-    return directories;
 }
 /** Root-owned, read-only, and traversable only by the session's UID. */
 function sealDirectories(directories, uid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-container, and VB).",
   "type": "module",
   "repository": {
@@ -35,8 +35,8 @@
     "@tangle-network/agent-interface": "^5.10.2"
   },
   "tangleRelease": {
-    "sourceSha": "3adca738603b0b972c48f75100cb139a503b6652",
-    "mergedAt": "2026-10-28T20:53:28-06:00"
+    "sourceSha": "9802462d5041a120e98d4fec5bb975765462494c",
+    "mergedAt": "2026-10-29T06:14:09-06:00"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",