@tangle-network/agent-profile-materialize 1.1.6 → 1.1.8

package/dist/profile-prompt.js

@@ -1,107 +0,0 @@
-import { appendSystemPromptRefusal, CODEX_SYSTEM_PROMPT_FILE, CONTEXT_FILE, markMaterializerContextFile, markMaterializerSubagent, OPENCODE_APPEND_SYSTEM_PROMPT_FILE, OPENCODE_CONFIG_FILE, OPENCODE_CONFIG_SCHEMA, OPENCODE_PRIMARY_AGENT_PREFIX, systemPromptRefusal, } from "./harness.js";
-import { sha256 } from "./plan-digest.js";
-import { serializeWorkspacePlanJson } from "./plan-json.js";
-export function lowerProfilePrompt(profile, harness, binds, instructionsRoot, builder) {
-    const { plan, add, addAtRoot, unsupported } = builder;
-    if (profile.prompt?.systemPrompt !== undefined) {
-        if (harness === "claude-code" || harness === "pi" || harness === "prime") {
-            plan.systemPrompt = profile.prompt.systemPrompt;
-        }
-        else if (harness === "codex") {
-            add(CODEX_SYSTEM_PROMPT_FILE, profile.prompt.systemPrompt);
-            plan.flags.push("-c", `model_instructions_file=${CODEX_SYSTEM_PROMPT_FILE}`);
-        }
-        else if (harness === "gemini") {
-            add(".gemini/system.md", profile.prompt.systemPrompt);
-            plan.env.GEMINI_SYSTEM_MD = "1";
-        }
-        else if (harness === "opencode") {
-            const systemPrompt = profile.prompt.systemPrompt;
-            if (systemPrompt.trim().length === 0) {
-                throw new Error("opencode cannot express an empty exact system-prompt replacement");
-            }
-            if (binds.has("opencode.agent-prompt")) {
-                plan.systemPromptBinding = {
-                    intent: "replace",
-                    control: "opencode.agent-prompt",
-                    systemPrompt,
-                };
-            }
-            else if (binds.has("systemPrompt")) {
-                const primaryAgentName = `${OPENCODE_PRIMARY_AGENT_PREFIX}${sha256(systemPrompt).slice(0, 16)}`;
-                const primaryAgentPath = `.opencode/agents/${primaryAgentName}.md`;
-                if (profile.subagents?.[primaryAgentName] !== undefined) {
-                    throw new Error(`opencode: subagent name "${primaryAgentName}" is reserved for the profile primary agent`);
-                }
-                plan.systemPrompt = systemPrompt;
-                add(primaryAgentPath, markMaterializerSubagent(primaryAgentPath, ["---", "mode: primary", "---", systemPrompt, ""].join("\n")));
-                plan.flags.push("--agent", primaryAgentName);
-            }
-            else {
-                unsupported("systemPrompt", systemPromptRefusal(harness));
-            }
-        }
-        else {
-            unsupported("systemPrompt", systemPromptRefusal(harness));
-        }
-    }
-    const openCodeInstructionFiles = [];
-    const openCodeConfigUnreachable = harness === "opencode" && binds.has("opencode.agent-prompt");
-    if (profile.prompt?.appendSystemPrompt !== undefined) {
-        const appendSystemPrompt = profile.prompt.appendSystemPrompt;
-        if (appendSystemPrompt.trim().length === 0) {
-            throw new Error("prompt.appendSystemPrompt must be non-empty text");
-        }
-        if (openCodeConfigUnreachable) {
-            unsupported("appendSystemPrompt", "opencode: the launcher that binds opencode.agent-prompt composes opencode's config itself and loads no workspace opencode.json, so an addition registered there would never reach the model; compose it into the launcher's own instructions[]");
-        }
-        else if (harness === "opencode") {
-            add(OPENCODE_APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt.endsWith("\n")
-                ? appendSystemPrompt
-                : `${appendSystemPrompt}\n`);
-            openCodeInstructionFiles.push(OPENCODE_APPEND_SYSTEM_PROMPT_FILE);
-        }
-        else if (harness === "claude-code" ||
-            harness === "pi" ||
-            harness === "prime") {
-            plan.appendSystemPrompt = appendSystemPrompt;
-        }
-        else {
-            unsupported("appendSystemPrompt", appendSystemPromptRefusal(harness));
-        }
-    }
-    const instructions = [...(profile.prompt?.instructions ?? [])];
-    const resourceInstructions = profile.resources?.instructions;
-    if (typeof resourceInstructions === "string") {
-        instructions.push(resourceInstructions);
-    }
-    else if (resourceInstructions && resourceInstructions.kind === "inline") {
-        instructions.push(resourceInstructions.content);
-    }
-    else if (resourceInstructions) {
-        unsupported("instructions", "instruction ref is not inline (github refs need async pre-resolution)");
-    }
-    if (instructions.length) {
-        if (harness === "codex" && binds.has("codex.developer-instructions")) {
-            // Codex's developer channel composes profile context without replacing
-            // repository AGENTS.md or the harness's own system instructions.
-            plan.appendSystemPrompt = instructions.join("\n\n");
-        }
-        else if (openCodeConfigUnreachable) {
-            unsupported("instructions", "opencode: the launcher that binds opencode.agent-prompt composes opencode's config itself and loads no workspace opencode.json, so an instruction file registered there would never reach the model; compose it into the launcher's own instructions[]");
-        }
-        else {
-            const instructionPath = CONTEXT_FILE[harness];
-            addAtRoot(instructionsRoot, instructionPath, markMaterializerContextFile(instructionPath, `${instructions.join("\n\n")}\n`));
-            if (harness === "opencode") {
-                openCodeInstructionFiles.push(instructionPath);
-            }
-        }
-    }
-    if (openCodeInstructionFiles.length > 0) {
-        add(OPENCODE_CONFIG_FILE, serializeWorkspacePlanJson({
-            $schema: OPENCODE_CONFIG_SCHEMA,
-            instructions: openCodeInstructionFiles,
-        }));
-    }
-}

package/dist/profile-support.d.ts

@@ -1,8 +0,0 @@
-import type { AgentProfile, AgentProfileMcpServer } from "@tangle-network/agent-interface";
-import type { HarnessId } from "./harness.js";
-type ActiveAgentProfileMcpServer = Exclude<AgentProfileMcpServer, {
-    enabled: false;
-}>;
-export declare function activeMcpServers(servers: AgentProfile["mcp"]): Record<string, ActiveAgentProfileMcpServer>;
-export declare function extensionNamespaces(harness: HarnessId): string[];
-export {};

package/dist/profile-support.js

@@ -1,6 +0,0 @@
-export function activeMcpServers(servers) {
-    return Object.fromEntries(Object.entries(servers ?? {}).filter((entry) => entry[1].enabled !== false));
-}
-export function extensionNamespaces(harness) {
-    return [harness];
-}

package/dist/resource-lowering.d.ts

@@ -1,6 +0,0 @@
-import type { AgentProfile } from "@tangle-network/agent-interface";
-import type { HarnessId } from "./harness.js";
-import type { ProfilePlanBuilder } from "./profile-plan.js";
-export declare function lowerProfileResources(profile: AgentProfile, harness: HarnessId, builder: ProfilePlanBuilder): void;
-export declare function lowerProfileSkills(profile: AgentProfile, harness: HarnessId, builder: ProfilePlanBuilder): void;
-export declare function lowerProfileCommands(profile: AgentProfile, harness: HarnessId, builder: ProfilePlanBuilder): void;

package/dist/resource-lowering.js

@@ -1,103 +0,0 @@
-import { materializeCommand } from "./commands.js";
-import { HARNESS_SKILL_DIRS } from "./harness.js";
-import { normalizeSkillMd, resolveInlineRef } from "./resource-resolution.js";
-import { codexAgentRoleName, registerCodexAgent } from "./subagents.js";
-import { DEFAULT_FILE_MODE, EXECUTABLE_FILE_MODE, normalizeWorkspaceRelativePath, } from "./workspace-files.js";
-export function lowerProfileResources(profile, harness, builder) {
-    const { plan, addExplicitResource, unsupported } = builder;
-    const fileMountPaths = new Set();
-    for (const mount of profile.resources?.files ?? []) {
-        const relPath = normalizeWorkspaceRelativePath(mount.path);
-        if (fileMountPaths.has(relPath)) {
-            throw new Error(`Duplicate workspace file mount: ${relPath}`);
-        }
-        fileMountPaths.add(relPath);
-        if (mount.executable !== undefined &&
-            typeof mount.executable !== "boolean") {
-            throw new Error(`Workspace file executable must be a boolean: ${relPath}`);
-        }
-        const resource = resolveInlineRef(mount.resource);
-        if (!resource) {
-            unsupported("files", `file mount "${relPath}" is not inline (github refs need async pre-resolution)`);
-            continue;
-        }
-        addExplicitResource("files", relPath, resource.content, mount.executable ? EXECUTABLE_FILE_MODE : DEFAULT_FILE_MODE);
-    }
-    for (const ref of profile.resources?.tools ?? []) {
-        const resource = resolveInlineRef(ref);
-        if (!resource) {
-            unsupported("tools", "tool ref is not inline (github refs need async pre-resolution)");
-            continue;
-        }
-        if (harness !== "opencode") {
-            unsupported("tools", `${harness}: no verified cwd-native file tool path; use MCP or a native extension`);
-            continue;
-        }
-        addExplicitResource("tools", `.opencode/tools/${resource.name}`, resource.content);
-    }
-    for (const ref of profile.resources?.agents ?? []) {
-        const resource = resolveInlineRef(ref);
-        if (!resource) {
-            unsupported("subagents", "agent ref is not inline (github refs need async pre-resolution)");
-            continue;
-        }
-        const directory = agentResourceDirectory(harness);
-        if (!directory) {
-            unsupported("subagents", `${harness}: agent definitions have no verified cwd-native resource path`);
-            continue;
-        }
-        const relPath = `${directory}/${resource.name}`;
-        addExplicitResource("subagents", relPath, resource.content);
-        if (harness === "codex") {
-            const roleName = codexAgentRoleName(resource.name);
-            if (!roleName) {
-                unsupported("subagents", `codex: agent resource "${resource.name}" must use a lowercase role name`);
-            }
-            else {
-                registerCodexAgent(plan, roleName, relPath, roleName);
-            }
-        }
-    }
-}
-export function lowerProfileSkills(profile, harness, builder) {
-    const { addExplicitResource, unsupported } = builder;
-    for (const ref of profile.resources?.skills ?? []) {
-        const resource = resolveInlineRef(ref);
-        if (!resource) {
-            unsupported("skills", "skill ref is not inline (github refs need async pre-resolution)");
-            continue;
-        }
-        const directory = HARNESS_SKILL_DIRS[harness];
-        if (!directory) {
-            unsupported("skills", `${harness}: no cwd skill dir (skills live in a user/global dir); skill "${resource.name}" not mounted`);
-            continue;
-        }
-        addExplicitResource("skills", `${directory}/${resource.name}/SKILL.md`, normalizeSkillMd(resource.name, resource.content));
-    }
-}
-export function lowerProfileCommands(profile, harness, builder) {
-    const { addExplicitResource, unsupported } = builder;
-    for (const ref of profile.resources?.commands ?? []) {
-        const resource = resolveInlineRef(ref);
-        if (!resource) {
-            unsupported("commands", "command ref is not inline (github needs pre-resolution)");
-            continue;
-        }
-        materializeCommand(harness, resource.name, resource.content, (path, content, mode) => addExplicitResource("commands", path, content, mode), unsupported);
-    }
-}
-function agentResourceDirectory(harness) {
-    switch (harness) {
-        case "claude-code":
-        case "nanoclaw":
-            return ".claude/agents";
-        case "codex":
-            return ".codex/agents";
-        case "opencode":
-            return ".opencode/agents";
-        case "gemini":
-            return ".gemini/agents";
-        default:
-            return null;
-    }
-}

package/dist/resource-resolution.d.ts

@@ -1,27 +0,0 @@
-/** Resolve inline bytes already present on the profile. Remote resources must
- * be resolved by {@link resolveAgentProfileResources} before materialization.
- *
- * FAIL-CLOSED: a ref that declares `kind: "inline"` is asserting its bytes are
- * already resolved, so missing/non-string `content` is a caller bug, not an
- * empty file — silently coercing it (`String(content ?? "")`) would produce a
- * file that "looks provisioned, loads nothing", exactly the trap this module's
- * docstring warns against. */
-export declare function resolveInlineRef(ref: AgentProfileResourceRef): {
-    name: string;
-    content: string;
-} | null;
-export interface ResolveAgentProfileResourcesOptions {
-    /** Repository used when a GitHub resource omits its own `repository`. */
-    repository?: string;
-    fetch?: typeof globalThis.fetch;
-    timeoutMs?: number;
-}
-/**
- * Resolve every GitHub resource to exact inline bytes before materialization.
- * The profile's default harness does not affect resource resolution.
- */
-export declare function resolveAgentProfileResources(inputProfile: AgentProfile, options?: ResolveAgentProfileResourcesOptions): Promise<AgentProfile>;
-/** Normalize any skill markdown (VB frontmatter `skill:`/`description:`, or raw) into a
- *  harness SKILL.md with `name:`/`description:` frontmatter the harnesses require. */
-export declare function normalizeSkillMd(name: string, raw: string): string;
-import type { AgentProfile, AgentProfileResourceRef } from "@tangle-network/agent-interface";

package/dist/resource-resolution.js

@@ -1,265 +0,0 @@
-function describeUnresolvedRef(r) {
-    const name = typeof r.name === "string" ? r.name : undefined;
-    const path = typeof r.path === "string" ? r.path : undefined;
-    if (name && path)
-        return `"${name}" (${path})`;
-    if (name)
-        return `"${name}"`;
-    if (path)
-        return `"${path}"`;
-    return "resource";
-}
-/** Resolve inline bytes already present on the profile. Remote resources must
- * be resolved by {@link resolveAgentProfileResources} before materialization.
- *
- * FAIL-CLOSED: a ref that declares `kind: "inline"` is asserting its bytes are
- * already resolved, so missing/non-string `content` is a caller bug, not an
- * empty file — silently coercing it (`String(content ?? "")`) would produce a
- * file that "looks provisioned, loads nothing", exactly the trap this module's
- * docstring warns against. */
-export function resolveInlineRef(ref) {
-    const r = ref;
-    if (typeof r.content === "string") {
-        return { name: String(r.name ?? r.path ?? "resource"), content: r.content };
-    }
-    if (r.kind === "inline") {
-        throw new Error(`Profile resource ${describeUnresolvedRef(r)} declares kind "inline" but has no string content`);
-    }
-    return null; // github / unresolved
-}
-const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/;
-const collapse = (s) => s.replace(/\s+/g, " ").trim();
-function frontmatterScalar(value) {
-    const trimmed = value.trim();
-    if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
-        try {
-            const parsed = JSON.parse(trimmed);
-            if (typeof parsed === "string")
-                return parsed;
-        }
-        catch {
-            return trimmed;
-        }
-    }
-    if (trimmed.startsWith("'") && trimmed.endsWith("'")) {
-        return trimmed.slice(1, -1).replaceAll("''", "'");
-    }
-    return trimmed;
-}
-function frontmatterValue(frontmatter, field) {
-    const lines = frontmatter.split("\n");
-    const index = lines.findIndex((line) => line.startsWith(`${field}:`));
-    if (index < 0)
-        return undefined;
-    const inline = (lines[index] ?? "").slice(field.length + 1).trim();
-    if (inline && ![">", "|", ">-", "|-"].includes(inline)) {
-        return frontmatterScalar(inline);
-    }
-    const block = [];
-    for (let offset = index + 1; offset < lines.length; offset += 1) {
-        const line = lines[offset] ?? "";
-        if (/^\s+\S/.test(line))
-            block.push(line.trim());
-        else if (line.trim() !== "")
-            break;
-    }
-    const value = collapse(block.join(" "));
-    return value || undefined;
-}
-const DEFAULT_RESOURCE_FETCH_TIMEOUT_MS = 30_000;
-const MAX_RESOURCE_BYTES = 10 * 1024 * 1024;
-const MAX_PROFILE_RESOURCE_BYTES = 32 * 1024 * 1024;
-const MAX_PROFILE_RESOURCE_REFS = 128;
-const MAX_CONCURRENT_RESOURCE_FETCHES = 8;
-async function readResourceBody(response, description, consumeBytes) {
-    if (!response.body)
-        return "";
-    const reader = response.body.getReader();
-    const chunks = [];
-    let totalBytes = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            totalBytes += value.byteLength;
-            if (totalBytes > MAX_RESOURCE_BYTES) {
-                await reader.cancel().catch(() => undefined);
-                throw new Error(`GitHub profile resource exceeds ${MAX_RESOURCE_BYTES} bytes: ${description}`);
-            }
-            try {
-                consumeBytes(value.byteLength);
-            }
-            catch (error) {
-                await reader.cancel().catch(() => undefined);
-                throw error;
-            }
-            chunks.push(value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)), totalBytes).toString("utf8");
-}
-async function mapWithConcurrency(values, concurrency, controller, transform) {
-    const results = new Array(values.length);
-    let nextIndex = 0;
-    let firstFailure;
-    const worker = async () => {
-        while (!firstFailure) {
-            const index = nextIndex++;
-            if (index >= values.length)
-                return;
-            try {
-                results[index] = await transform(values[index]);
-            }
-            catch (error) {
-                if (!firstFailure) {
-                    firstFailure = { error };
-                    controller.abort(error);
-                }
-            }
-        }
-    };
-    await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, async () => worker()));
-    if (firstFailure)
-        throw firstFailure.error;
-    return results;
-}
-/**
- * Resolve every GitHub resource to exact inline bytes before materialization.
- * The profile's default harness does not affect resource resolution.
- */
-export async function resolveAgentProfileResources(inputProfile, options = {}) {
-    const profile = agentProfileSchema.parse(inputProfile);
-    const resources = profile.resources;
-    if (!resources)
-        return profile;
-    const refs = [
-        ...(resources.files?.map((mount) => mount.resource) ?? []),
-        ...(resources.tools ?? []),
-        ...(resources.skills ?? []),
-        ...(resources.agents ?? []),
-        ...(resources.commands ?? []),
-        ...(typeof resources.instructions === "object"
-            ? [resources.instructions]
-            : []),
-    ];
-    if (refs.length > MAX_PROFILE_RESOURCE_REFS) {
-        throw new Error(`AgentProfile may contain at most ${MAX_PROFILE_RESOURCE_REFS} resource references`);
-    }
-    const batchController = new AbortController();
-    let fetchedBytes = 0;
-    const consumeFetchedBytes = (bytes) => {
-        fetchedBytes += bytes;
-        if (fetchedBytes > MAX_PROFILE_RESOURCE_BYTES) {
-            throw new Error(`GitHub profile resources exceed ${MAX_PROFILE_RESOURCE_BYTES} total bytes`);
-        }
-    };
-    const resolveRef = async (ref) => {
-        if (ref.kind === "inline")
-            return ref;
-        const repository = ref.repository ?? options.repository;
-        if (!repository) {
-            throw new Error(`GitHub profile resource "${ref.path}" requires repository`);
-        }
-        const [owner, repo, ...extraRepositoryParts] = repository.split("/");
-        if (!owner ||
-            !repo ||
-            extraRepositoryParts.length > 0 ||
-            !/^[A-Za-z0-9_.-]+$/.test(owner) ||
-            !/^[A-Za-z0-9_.-]+$/.test(repo)) {
-            throw new Error(`GitHub profile resource repository must be owner/repo: ${repository}`);
-        }
-        const resourcePath = normalizeWorkspaceRelativePath(ref.path);
-        const gitRef = ref.ref ?? "main";
-        if (!gitRef ||
-            hasControlCharacter(gitRef) ||
-            gitRef.split("/").some((segment) => !segment || segment === "..")) {
-            throw new Error(`Invalid GitHub profile resource ref: ${gitRef}`);
-        }
-        const encoded = (value) => value.split("/").map(encodeURIComponent).join("/");
-        const url = `https://raw.githubusercontent.com/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encoded(gitRef)}/${encoded(resourcePath)}`;
-        const controller = new AbortController();
-        const abortRequest = () => controller.abort(batchController.signal.reason);
-        batchController.signal.addEventListener("abort", abortRequest, {
-            once: true,
-        });
-        const timeoutError = new Error(`GitHub profile resource timed out: ${repository}/${resourcePath}@${gitRef}`);
-        const timeout = setTimeout(() => controller.abort(timeoutError), options.timeoutMs ?? DEFAULT_RESOURCE_FETCH_TIMEOUT_MS);
-        try {
-            const fetchResource = options.fetch ?? globalThis.fetch;
-            const response = await fetchResource(url, { signal: controller.signal });
-            if (!response.ok) {
-                throw new Error(`Failed to fetch GitHub profile resource ${repository}/${resourcePath}@${gitRef}: ${response.status} ${response.statusText}`);
-            }
-            const contentLength = Number(response.headers.get("content-length"));
-            if (Number.isFinite(contentLength) &&
-                contentLength > MAX_RESOURCE_BYTES) {
-                throw new Error(`GitHub profile resource exceeds ${MAX_RESOURCE_BYTES} bytes: ${repository}/${resourcePath}`);
-            }
-            const content = await readResourceBody(response, `${repository}/${resourcePath}`, consumeFetchedBytes);
-            return {
-                kind: "inline",
-                name: ref.name ?? basename(resourcePath),
-                content,
-            };
-        }
-        catch (error) {
-            if (controller.signal.aborted && controller.signal.reason !== undefined) {
-                throw controller.signal.reason;
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeout);
-            batchController.signal.removeEventListener("abort", abortRequest);
-        }
-    };
-    const resolvedRefs = await mapWithConcurrency(refs, MAX_CONCURRENT_RESOURCE_FETCHES, batchController, resolveRef);
-    let resolvedIndex = 0;
-    const takeRef = () => resolvedRefs[resolvedIndex++];
-    const takeRefs = (values) => values?.map(takeRef);
-    const resolvedResources = {
-        ...resources,
-        files: resources.files === undefined
-            ? undefined
-            : resources.files.map((mount) => ({
-                ...mount,
-                resource: takeRef(),
-            })),
-        tools: takeRefs(resources.tools),
-        skills: takeRefs(resources.skills),
-        agents: takeRefs(resources.agents),
-        commands: takeRefs(resources.commands),
-        instructions: typeof resources.instructions === "object"
-            ? takeRef()
-            : resources.instructions,
-    };
-    return agentProfileSchema.parse({ ...profile, resources: resolvedResources });
-}
-/** Normalize any skill markdown (VB frontmatter `skill:`/`description:`, or raw) into a
- *  harness SKILL.md with `name:`/`description:` frontmatter the harnesses require. */
-export function normalizeSkillMd(name, raw) {
-    const m = raw.match(FRONTMATTER_RE);
-    const fm = m?.[1] ?? "";
-    const body = (m?.[2] ?? raw).trim();
-    if (fm &&
-        frontmatterValue(fm, "name") === name &&
-        (frontmatterValue(fm, "description")?.trim().length ?? 0) > 0) {
-        return raw;
-    }
-    let desc = `Skill ${name}. Use when the task matches its domain.`;
-    const declaredDescription = fm
-        ? frontmatterValue(fm, "description")
-        : undefined;
-    if (declaredDescription)
-        desc = collapse(declaredDescription);
-    return `---\nname: ${name}\ndescription: ${JSON.stringify(desc)}\n---\n\n${body}\n`;
-}
-import { basename } from "node:path";
-import { agentProfileSchema } from "@tangle-network/agent-interface";
-import { hasControlCharacter, normalizeWorkspaceRelativePath, } from "./workspace-files.js";

package/dist/secret-concurrent-revision.d.ts

@@ -1,30 +0,0 @@
-import type { AgentProfileSecretProvider } from "@tangle-network/agent-interface";
-import { type ConcurrentProfileRevision } from "./managed-workspace.js";
-import type { ApplyWorkspacePlanOptions, WorkspacePlan } from "./plan-types.js";
-/**
- * Publish a resolved revision for exactly one native subprocess UID. The
- * executor-owned naming key hides low-entropy credential guesses from paths;
- * the resolved digest and manifest never leave this server-side result.
- */
-export declare function prepareSecretConcurrentProfileRevision(input: {
-    plan: WorkspacePlan;
-    /** Trusted executor transport only; never read from the mutable native HOME. */
-    providerConfig?: Record<string, unknown>;
-    managedRoot: string;
-    launchRoot: string;
-    sharedWorkspaceDir: string;
-    ownerId: string;
-    subprocessUid: number;
-    namingKey: Uint8Array;
-    secretProvider: AgentProfileSecretProvider;
-    options?: Pick<ApplyWorkspacePlanOptions, "runtimeOnlyFiles">;
-}): Promise<ConcurrentProfileRevision & {
-    /**
-     * The value behind each `{env:NAME}` reference in the revision's config,
-     * for the executor alone: the launch never receives them. An executor
-     * that serves a referencing MCP server through its own loopback proxy
-     * resolves the server's headers here.
-     */
-    secretReferences: Readonly<Record<string, string>>;
-}>;
-export declare function runSetfacl(args: string[], paths: readonly string[]): void;