@tangle-network/agent-profile-materialize 1.1.6 → 1.1.8

package/dist/secret-concurrent-revision.js

@@ -1,291 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { createHash, createHmac } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
-import { join } from "node:path";
-import { assertLaunchRoot, listRevisionFiles, makeStageWritable, prepareExplicitOpenCodePlan, } from "./managed-workspace.js";
-import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
-import { lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
-import { normalizeWorkspacePlanArgument } from "./plan-normalize.js";
-import { assertWorkspacePlanSupported } from "./plan-support.js";
-/** Refuse an executor that cannot isolate the revision, or a plan that claims its launch names. */
-function assertSecretRevisionLaunch(input) {
-    if (process.platform !== "linux" ||
-        process.getuid?.() !== 0 ||
-        !Number.isSafeInteger(input.subprocessUid) ||
-        input.subprocessUid < 200_000 ||
-        input.namingKey.length !== 32 ||
-        !input.ownerId) {
-        throw new Error("Secret concurrent profile needs a root executor and reserved identity");
-    }
-    for (const name of [
-        "OPENCODE_DISABLE_PROJECT_CONFIG",
-        "OPENCODE_CONFIG_DIR",
-        "TANGLE_SHARED_WORKSPACE",
-    ]) {
-        if (Object.hasOwn(input.plan.env, name)) {
-            throw new Error(`Secret OpenCode reserves ${name} for its launch binding`);
-        }
-    }
-}
-/**
- * The OpenCode plan the revision materializes: the trusted provider config
- * merged in, and every public MCP header turned into a reference.
- */
-function secretOpenCodePlan(sourcePlan, providerConfig, secretReferences) {
-    // Workspace `reference/` files stay in this revision's read-only tree. The
-    // sealed launch runs from that tree, so a cwd-relative `reference/` path
-    // reads this revision's copy and nothing is written to the shared workspace.
-    let plan = prepareExplicitOpenCodePlan(sourcePlan);
-    if (providerConfig) {
-        plan = {
-            ...plan,
-            files: plan.files.map((file) => file.relPath === "opencode.json" &&
-                file.source === "generated" &&
-                (file.root ?? "workspace") === "workspace"
-                ? {
-                    ...file,
-                    content: JSON.stringify({
-                        ...JSON.parse(file.content),
-                        provider: providerConfig,
-                    }),
-                }
-                : file),
-        };
-    }
-    plan = referencePublicMcpHeaders(plan, secretReferences);
-    if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
-        throw new Error("Secret OpenCode reserves its native config directory");
-    }
-    // OpenCode and every process it spawns run as the session UID, so a value in
-    // its environment, argv or config is readable by the agent's own shell
-    // (`/proc/<pid>/environ`, `/proc/<pid>/cmdline`, `cat`). No profile secret
-    // value may reach the launch: config slots stay references whose values the
-    // launch never receives (#11875).
-    if (Object.values(plan.env).some((value) => typeof value !== "string") ||
-        plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
-        throw new Error("Secret OpenCode refuses a profile secret in its launch environment or arguments");
-    }
-    return plan;
-}
-/** Publish the staged revision read-only, or adopt an identical one already published. */
-function publishSecretRevision(prepared, directory, subprocessUid) {
-    const existing = lstatIfPresent(directory);
-    if (existing) {
-        assertPublishedSecretRevision(directory, prepared.manifest);
-        prepared.dispose();
-    }
-    else {
-        try {
-            makeSecretRevisionReadOnly(prepared.root, subprocessUid);
-            renameSync(prepared.root, directory);
-        }
-        catch (error) {
-            const raced = lstatIfPresent(directory);
-            if (!raced?.isDirectory() || raced.isSymbolicLink())
-                throw error;
-            assertPublishedSecretRevision(directory, prepared.manifest);
-            makeStageWritable(prepared.root);
-            prepared.dispose();
-        }
-    }
-}
-/**
- * Publish a resolved revision for exactly one native subprocess UID. The
- * executor-owned naming key hides low-entropy credential guesses from paths;
- * the resolved digest and manifest never leave this server-side result.
- */
-export async function prepareSecretConcurrentProfileRevision(input) {
-    assertSecretRevisionLaunch(input);
-    const secretReferences = {};
-    const plan = secretOpenCodePlan(input.plan, input.providerConfig, secretReferences);
-    assertWorkspacePlanSupported(plan);
-    assertLaunchRoot(input.launchRoot);
-    // File slots reference their secrets, so an unchanged profile with a rotated
-    // per-turn secret reuses this revision.
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotReferences: secretReferences });
-    try {
-        // XDG_CONFIG_HOME is bound to this executor-owned tree at native launch.
-        // An agent-owned HOME may hold SQLite state, never native authority.
-        mkdirSync(join(prepared.root, "workspace", ".config", "opencode"), {
-            recursive: true,
-            mode: 0o700,
-        });
-        mkdirSync(join(prepared.root, "workspace", ".opencode"), {
-            recursive: true,
-            mode: 0o700,
-        });
-        const identity = createHmac("sha256", input.namingKey)
-            .update(input.sharedWorkspaceDir)
-            .update("\0")
-            .update(input.ownerId)
-            .update("\0")
-            .update(String(input.subprocessUid))
-            .update("\0")
-            .update(prepared.manifest.materializedDigest)
-            .digest("hex");
-        const directory = join(input.launchRoot, `revision-${identity}`);
-        const bound = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretOpenCodeRevision: true });
-        const spawn = {
-            ...bound,
-            env: {
-                ...bound.env,
-                OPENCODE_DISABLE_PROJECT_CONFIG: "1",
-                OPENCODE_CONFIG_DIR: join(directory, "workspace", ".opencode"),
-                TANGLE_SHARED_WORKSPACE: input.sharedWorkspaceDir,
-            },
-        };
-        prepared.manifest.launchDigest = createHash("sha256")
-            .update(JSON.stringify(spawn))
-            .digest("hex");
-        writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
-        publishSecretRevision(prepared, directory, input.subprocessUid);
-        return {
-            directory,
-            manifest: prepared.manifest,
-            application: { ...prepared.application, spawn },
-            secretReferences,
-        };
-    }
-    catch (error) {
-        if (lstatIfPresent(prepared.root)) {
-            makeStageWritable(prepared.root);
-            prepared.dispose();
-        }
-        throw error;
-    }
-}
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** How `servableMcpServer` recognizes a header value the executor holds. */
-const HELD_VALUE_PREFIX = "TANGLE_PROFILE_SECRET_";
-/**
- * A remote MCP server's public header values never reach the sealed launch:
- * the executor's loopback proxy replaces the server's url and headers there.
- * They did reach the revision's bytes, so a value that changes every turn (a
- * run id, a message id) gave each turn its own digest, revision directory,
- * receipt and native health check. Each such value becomes a reference the
- * executor resolves, as a secret slot already does, and the revision names
- * only the header. The value stays as public as the profile declared it; it is
- * held beside the secret references and nothing the native process can read
- * carries it.
- *
- * A value that already looks like a reference, or is empty, stays in place.
- */
-function referencePublicMcpHeaders(plan, references) {
-    const configFile = plan.files.find((file) => file.relPath === "opencode.json" &&
-        file.source === "generated" &&
-        (file.root ?? "workspace") === "workspace");
-    if (!configFile)
-        return plan;
-    const config = JSON.parse(configFile.content);
-    if (!isRecord(config) || !isRecord(config.mcp))
-        return plan;
-    let changed = false;
-    for (const [server, entry] of Object.entries(config.mcp)) {
-        if (!isRecord(entry) || entry.type !== "remote")
-            continue;
-        if (!isRecord(entry.headers))
-            continue;
-        for (const [header, value] of Object.entries(entry.headers)) {
-            if (typeof value !== "string" || value === "")
-                continue;
-            if (/\{(?:env|file):/.test(value))
-                continue;
-            const name = `${HELD_VALUE_PREFIX}${createHash("sha256")
-                .update(`public-mcp-header\0${server}\0${header}`, "utf8")
-                .digest("hex")
-                .slice(0, 24)
-                .toUpperCase()}`;
-            references[name] = value;
-            entry.headers[header] = `{env:${name}}`;
-            changed = true;
-        }
-    }
-    if (!changed)
-        return plan;
-    return {
-        ...plan,
-        files: plan.files.map((file) => file === configFile ? { ...file, content: JSON.stringify(config) } : file),
-    };
-}
-function secretRevisionPaths(root) {
-    const all = [root];
-    const exposed = [root];
-    const walk = (directory) => {
-        for (const entry of readdirSync(directory, { withFileTypes: true })) {
-            const child = join(directory, entry.name);
-            const stat = lstatSync(child);
-            if (stat.uid !== 0 || stat.isSymbolicLink()) {
-                throw new Error("Secret concurrent profile stage contains an untrusted inode");
-            }
-            if (!stat.isDirectory() && !stat.isFile()) {
-                throw new Error("Secret concurrent profile stage contains a special file");
-            }
-            all.push(child);
-            if (entry.name !== "manifest.json" || directory !== root) {
-                exposed.push(child);
-            }
-            if (stat.isDirectory())
-                walk(child);
-        }
-    };
-    walk(root);
-    return { all, exposed };
-}
-export function runSetfacl(args, paths) {
-    for (let start = 0; start < paths.length; start += 64) {
-        execFileSync("/usr/bin/setfacl", [...args, "--", ...paths.slice(start, start + 64)], {
-            env: { PATH: "/usr/bin:/bin", LANG: "C" },
-            timeout: 30_000,
-            stdio: "pipe",
-        });
-    }
-}
-function makeSecretRevisionReadOnly(root, uid) {
-    const paths = secretRevisionPaths(root);
-    // Remove inherited named ACLs before widening the ACL mask for this UID.
-    runSetfacl(["-b"], paths.all);
-    for (const path of paths.all) {
-        const stat = lstatSync(path);
-        chmodSync(path, stat.isDirectory() ? 0o500 : stat.mode & 0o111 ? 0o500 : 0o400);
-    }
-    // The private manifest has resolved-file hashes. The CLI can read its native
-    // files, but never the executor inventory or another revision's files.
-    runSetfacl(["-m", `u:${uid}:r-X`], paths.exposed);
-}
-function assertPublishedSecretRevision(directory, expected) {
-    const root = lstatSync(directory);
-    if (!root.isDirectory() ||
-        root.isSymbolicLink() ||
-        root.uid !== 0 ||
-        (root.mode & 0o222) !== 0) {
-        throw new Error("Secret concurrent profile revision is not immutable");
-    }
-    const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
-    if (persisted.materializedDigest !== expected.materializedDigest ||
-        persisted.launchDigest !== expected.launchDigest) {
-        throw new Error("Secret concurrent profile revision digest collision");
-    }
-    for (const file of expected.files) {
-        const filePath = join(directory, file.root, file.relPath);
-        const stat = lstatSync(filePath);
-        if (!stat.isFile() ||
-            stat.isSymbolicLink() ||
-            stat.uid !== 0 ||
-            (stat.mode & 0o222) !== 0 ||
-            createHash("sha256").update(readFileSync(filePath)).digest("hex") !==
-                file.sha256) {
-            throw new Error("Secret concurrent profile revision file changed");
-        }
-    }
-    const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
-    for (const rootName of ["workspace", "agent"]) {
-        for (const relPath of listRevisionFiles(join(directory, rootName))) {
-            if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
-                throw new Error("Secret concurrent profile revision has an unexpected file");
-            }
-        }
-    }
-    if (expectedPaths.size) {
-        throw new Error("Secret concurrent profile revision is missing a manifest file");
-    }
-}

package/dist/secret-session-view.d.ts

@@ -1,36 +0,0 @@
-/**
- * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
- * native session at the directory it was created in, so a session resumed on
- * a later turn keeps this path while each turn's revision changes. The name
- * binds the shared workspace, the session and its subprocess UID, so two
- * sessions never share a view.
- */
-export declare function secretSessionViewWorkspace(input: {
-    launchRoot: string;
-    sharedWorkspaceDir: string;
-    sessionId: string;
-    subprocessUid: number;
-}): string;
-/**
- * Point a session's view at one published secret revision before the
- * session's turn runs. The view's `reference/` and `.opencode/skills/` become
- * fresh trees of hard links to the revision's read-only files (the same
- * inodes, owner, mode and ACL), so the session reads this turn's files and
- * skills and nothing the previous revision held. A product's skill index
- * names `.opencode/skills/<id>/SKILL.md` cwd-relative, and OpenCode's skill
- * tool lists the same files through the revision's config directory.
- *
- * The view holds nothing else: no `opencode.json`, and a `.opencode/` with
- * only the revision's digest-attested skills, which the launch does not load
- * as project config (it sets OPENCODE_DISABLE_PROJECT_CONFIG). Profile config
- * stays bound by absolute path.
- *
- * The swap is not atomic for a reader that is already running: the caller
- * runs one turn of a session at a time and binds before that turn spawns.
- */
-export declare function bindSecretSessionView(input: {
-    launchRoot: string;
-    viewWorkspaceDir: string;
-    revisionWorkspaceDir: string;
-    subprocessUid: number;
-}): void;

package/dist/secret-session-view.js

@@ -1,179 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, } from "node:fs";
-import { basename, dirname, join } from "node:path";
-import { HARNESS_SKILL_DIRS } from "./harness.js";
-import { assertLaunchRoot } from "./managed-workspace.js";
-import { runSetfacl } from "./secret-concurrent-revision.js";
-/** The profile's read-only files, which products name cwd-relative. */
-const REFERENCE_ENTRY = "reference";
-/**
- * The profile's mounted skills, at the cwd-relative directory the platform
- * publishes for products to name in their prompts (`.opencode/skills`).
- */
-const SKILLS_DIR = HARNESS_SKILL_DIRS.opencode;
-const SKILLS_ENTRY = dirname(SKILLS_DIR);
-/** The only cwd-relative content a secret OpenCode session view serves. */
-const VIEW_ENTRIES = new Set([
-    REFERENCE_ENTRY,
-    SKILLS_ENTRY,
-]);
-/**
- * The stable, sealed cwd of one secret OpenCode session. OpenCode reopens a
- * native session at the directory it was created in, so a session resumed on
- * a later turn keeps this path while each turn's revision changes. The name
- * binds the shared workspace, the session and its subprocess UID, so two
- * sessions never share a view.
- */
-export function secretSessionViewWorkspace(input) {
-    if (!input.sessionId)
-        throw new Error("Secret session view needs a session");
-    const name = createHash("sha256")
-        .update("tangle-secret-session-view\0")
-        .update(input.sharedWorkspaceDir)
-        .update("\0")
-        .update(input.sessionId)
-        .update("\0")
-        .update(String(input.subprocessUid))
-        .digest("hex");
-    return join(input.launchRoot, `session-${name}`, "workspace");
-}
-/**
- * Point a session's view at one published secret revision before the
- * session's turn runs. The view's `reference/` and `.opencode/skills/` become
- * fresh trees of hard links to the revision's read-only files (the same
- * inodes, owner, mode and ACL), so the session reads this turn's files and
- * skills and nothing the previous revision held. A product's skill index
- * names `.opencode/skills/<id>/SKILL.md` cwd-relative, and OpenCode's skill
- * tool lists the same files through the revision's config directory.
- *
- * The view holds nothing else: no `opencode.json`, and a `.opencode/` with
- * only the revision's digest-attested skills, which the launch does not load
- * as project config (it sets OPENCODE_DISABLE_PROJECT_CONFIG). Profile config
- * stays bound by absolute path.
- *
- * The swap is not atomic for a reader that is already running: the caller
- * runs one turn of a session at a time and binds before that turn spawns.
- */
-export function bindSecretSessionView(input) {
-    const { launchRoot, viewWorkspaceDir, revisionWorkspaceDir } = input;
-    if (process.platform !== "linux" ||
-        process.getuid?.() !== 0 ||
-        !Number.isSafeInteger(input.subprocessUid) ||
-        input.subprocessUid < 200_000) {
-        throw new Error("Secret session view needs a root executor and reserved identity");
-    }
-    assertLaunchRoot(launchRoot);
-    const viewRoot = dirname(viewWorkspaceDir);
-    if (!isLaunchWorkspace(launchRoot, viewWorkspaceDir, /^session-[a-f0-9]{64}$/)) {
-        throw new Error("Secret session view is not a launch-root session path");
-    }
-    if (!isLaunchWorkspace(launchRoot, revisionWorkspaceDir, /^revision-[a-f0-9]{64}$/) ||
-        !isSealedNode(lstatSync(revisionWorkspaceDir), "directory")) {
-        throw new Error("Secret session view needs a published revision");
-    }
-    for (const directory of [viewRoot, viewWorkspaceDir]) {
-        const stat = lstatIfPresent(directory);
-        if (!stat)
-            mkdirSync(directory, { mode: 0o700 });
-        else if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== 0) {
-            throw new Error("Secret session view is not an executor-owned directory");
-        }
-    }
-    if (readdirSync(viewWorkspaceDir).some((name) => !VIEW_ENTRIES.has(name))) {
-        throw new Error("Secret session view holds an unexpected entry");
-    }
-    // Only this function writes a view. An interrupted bind leaves a staged or
-    // retired tree beside `workspace`, never inside it.
-    clearBesideWorkspace(viewRoot);
-    const staged = new Map();
-    const reference = sealedRevisionDirectory(revisionWorkspaceDir, REFERENCE_ENTRY);
-    if (reference) {
-        const target = besideWorkspace(viewRoot, "stage");
-        sealDirectories(linkSealedTree(reference, target), input.subprocessUid);
-        staged.set(REFERENCE_ENTRY, target);
-    }
-    const skills = sealedRevisionDirectory(revisionWorkspaceDir, SKILLS_DIR);
-    if (skills) {
-        const target = besideWorkspace(viewRoot, "stage");
-        mkdirSync(target, { mode: 0o700 });
-        const directories = [
-            target,
-            ...linkSealedTree(skills, join(target, basename(SKILLS_DIR))),
-        ];
-        sealDirectories(directories, input.subprocessUid);
-        staged.set(SKILLS_ENTRY, target);
-    }
-    for (const entry of VIEW_ENTRIES) {
-        const current = join(viewWorkspaceDir, entry);
-        if (lstatIfPresent(current)) {
-            renameSync(current, besideWorkspace(viewRoot, "retired"));
-        }
-        const next = staged.get(entry);
-        if (next)
-            renameSync(next, current);
-    }
-    clearBesideWorkspace(viewRoot);
-    sealDirectories([viewRoot, viewWorkspaceDir], input.subprocessUid);
-}
-/** A sealed directory of the published revision, or undefined when absent. */
-function sealedRevisionDirectory(revisionWorkspaceDir, relPath) {
-    const source = join(revisionWorkspaceDir, relPath);
-    const stat = lstatIfPresent(source);
-    if (!stat)
-        return undefined;
-    if (!isSealedNode(stat, "directory")) {
-        throw new Error(`Secret revision ${relPath}/ is not sealed`);
-    }
-    return source;
-}
-/** A fresh staged or retired path beside the view's `workspace`. */
-function besideWorkspace(viewRoot, kind) {
-    return join(viewRoot, `.${kind}-${randomBytes(8).toString("hex")}`);
-}
-function isLaunchWorkspace(launchRoot, workspace, name) {
-    return (basename(workspace) === "workspace" &&
-        dirname(dirname(workspace)) === launchRoot &&
-        name.test(basename(dirname(workspace))));
-}
-function lstatIfPresent(path) {
-    return lstatSync(path, { throwIfNoEntry: false });
-}
-function isSealedNode(stat, kind) {
-    return (!stat.isSymbolicLink() &&
-        (kind === "directory" ? stat.isDirectory() : stat.isFile()) &&
-        stat.uid === 0 &&
-        (stat.mode & 0o222) === 0);
-}
-/** Hard-link a sealed revision tree; returns every directory it created. */
-function linkSealedTree(source, target) {
-    mkdirSync(target, { mode: 0o700 });
-    const directories = [target];
-    for (const name of readdirSync(source)) {
-        const from = join(source, name);
-        const stat = lstatSync(from);
-        if (isSealedNode(stat, "directory")) {
-            directories.push(...linkSealedTree(from, join(target, name)));
-        }
-        else if (isSealedNode(stat, "file")) {
-            linkSync(from, join(target, name));
-        }
-        else {
-            throw new Error("Secret revision reference/ holds an unsealed inode");
-        }
-    }
-    return directories;
-}
-/** Root-owned, read-only, and traversable only by the session's UID. */
-function sealDirectories(directories, uid) {
-    runSetfacl(["-b"], directories);
-    for (const directory of directories)
-        chmodSync(directory, 0o500);
-    runSetfacl(["-m", `u:${uid}:r-X`], directories);
-}
-function clearBesideWorkspace(viewRoot) {
-    for (const name of readdirSync(viewRoot)) {
-        if (name !== "workspace") {
-            rmSync(join(viewRoot, name), { recursive: true, force: true });
-        }
-    }
-}

package/dist/subagents.d.ts

@@ -1,6 +0,0 @@
-export declare function materializeSubagent(h: HarnessId, name: string, sa: AgentSubagentProfile, plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void): void;
-export declare function codexAgentRoleName(resourceName: string): string | undefined;
-export declare function registerCodexAgent(plan: WorkspacePlan, name: string, configFile: string, description: string): void;
-import type { AgentSubagentProfile } from "@tangle-network/agent-interface";
-import type { AddPlanFile } from "./plan-json.js";
-import type { HarnessId, Unsupported, WorkspacePlan } from "./plan-types.js";

package/dist/subagents.js

@@ -1,137 +0,0 @@
-export function materializeSubagent(h, name, sa, plan, add, unsupported) {
-    if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
-        unsupported("subagents", `${h}: subagent name "${name}" must use lowercase letters, digits, underscores, or hyphens`);
-        return;
-    }
-    switch (h) {
-        case "claude-code":
-        case "nanoclaw": {
-            const fm = ["---", `name: ${name}`];
-            fm.push(`description: ${JSON.stringify(sa.description ?? name)}`);
-            if (sa.model)
-                fm.push(`model: ${JSON.stringify(sa.model)}`);
-            if (sa.tools) {
-                const tools = Object.entries(sa.tools);
-                const allowed = tools
-                    .filter(([, enabled]) => enabled)
-                    .map(([tool]) => tool);
-                const denied = tools
-                    .filter(([, enabled]) => !enabled)
-                    .map(([tool]) => tool);
-                if (allowed.length > 0)
-                    fm.push(`tools: ${JSON.stringify(allowed)}`);
-                if (denied.length > 0)
-                    fm.push(`disallowedTools: ${JSON.stringify(denied)}`);
-            }
-            if (sa.maxSteps !== undefined)
-                fm.push(`maxTurns: ${sa.maxSteps}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model", "tools", "maxSteps"]), unsupported);
-            fm.push("---", "", sa.prompt ?? sa.description ?? name);
-            const relPath = `.claude/agents/${name}.md`;
-            add(relPath, markMaterializerSubagent(relPath, `${fm.join("\n")}\n`));
-            break;
-        }
-        case "opencode": {
-            const fm = [
-                "---",
-                `description: ${JSON.stringify(sa.description ?? name)}`,
-                "mode: subagent",
-            ];
-            if (sa.model)
-                fm.push(`model: ${JSON.stringify(sa.model)}`);
-            if (sa.tools)
-                fm.push(`tools: ${JSON.stringify(sa.tools)}`);
-            if (sa.permissions)
-                fm.push(`permission: ${JSON.stringify(sa.permissions)}`);
-            if (sa.maxSteps !== undefined)
-                fm.push(`steps: ${sa.maxSteps}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set([
-                "description",
-                "prompt",
-                "model",
-                "tools",
-                "permissions",
-                "maxSteps",
-            ]), unsupported);
-            fm.push("---", "", sa.prompt ?? "");
-            const relPath = `.opencode/agents/${name}.md`;
-            add(relPath, markMaterializerSubagent(relPath, `${fm.join("\n")}\n`));
-            break;
-        }
-        case "gemini": {
-            const tools = sa.tools
-                ? Object.entries(sa.tools)
-                    .filter(([, enabled]) => enabled)
-                    .map(([tool]) => tool)
-                : undefined;
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model", "tools", "maxSteps"]), unsupported);
-            const relPath = `.gemini/agents/${name}.md`;
-            add(relPath, markMaterializerSubagent(relPath, [
-                "---",
-                `name: ${name}`,
-                `description: ${JSON.stringify(sa.description ?? name)}`,
-                "kind: local",
-                ...(sa.model ? [`model: ${JSON.stringify(sa.model)}`] : []),
-                ...(tools ? [`tools: ${JSON.stringify(tools)}`] : []),
-                ...(sa.maxSteps !== undefined ? [`max_turns: ${sa.maxSteps}`] : []),
-                "---",
-                "",
-                sa.prompt ?? "",
-                "",
-            ].join("\n")));
-            break;
-        }
-        case "codex": {
-            const relPath = `.codex/agents/${name}.toml`;
-            const lines = [
-                `name = ${tomlStr(name)}`,
-                `description = ${tomlStr(sa.description ?? name)}`,
-                `developer_instructions = ${tomlStr(sa.prompt ?? sa.description ?? name)}`,
-            ];
-            if (sa.model)
-                lines.push(`model = ${tomlStr(sa.model)}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model"]), unsupported);
-            add(relPath, markMaterializerSubagent(relPath, `${lines.join("\n")}\n`));
-            registerCodexAgent(plan, name, relPath, sa.description ?? name);
-            break;
-        }
-        case "prime":
-            // Prime subagents ARE expressible — as entries in the continual-harness
-            // store at <agentDir>/harness/harness_state.json (fork refinement.ts:269-279,
-            // re-read on every system-prompt build: agent-session.ts:7548-7554) — but
-            // that store lives under the executor-owned agent dir, which no
-            // workspace-relative plan file can reach. Executors that own the agent
-            // dir seed it with seedPrimeProfileSubagents; the plan stays fail-closed
-            // so a plan-forwarding caller can never believe the roster is in force.
-            unsupported("subagents", `prime: subagents live in the agent-dir continual-harness store (<agentDir>/harness/harness_state.json), outside any workspace plan — seed "${name}" with seedPrimeProfileSubagents from the executor that owns the agent dir`);
-            break;
-        default:
-            unsupported("subagents", `${h}: subagents have no cwd file (config/flag/global only); "${name}" not mounted`);
-    }
-}
-export function codexAgentRoleName(resourceName) {
-    const name = resourceName.endsWith(".toml")
-        ? resourceName.slice(0, -".toml".length)
-        : resourceName;
-    return /^[a-z0-9][a-z0-9_-]*$/.test(name) ? name : undefined;
-}
-export function registerCodexAgent(plan, name, configFile, description) {
-    plan.flags.push("-c", `agents.${name}.description=${tomlStr(description)}`, "-c", `agents.${name}.config_file=${tomlStr(configFile)}`);
-}
-function reportUnsupportedSubagentFields(harness, name, subagent, supported, unsupported) {
-    for (const field of [
-        "description",
-        "prompt",
-        "model",
-        "tools",
-        "permissions",
-        "maxSteps",
-        "metadata",
-    ]) {
-        if (subagent[field] !== undefined && !supported.has(field)) {
-            unsupported("subagents", `${harness}: subagent "${name}" does not support ${field}`);
-        }
-    }
-}
-import { markMaterializerSubagent } from "./harness.js";
-import { tomlStr } from "./plan-json.js";

package/dist/tool-bin-path.d.ts

@@ -1,23 +0,0 @@
-/** The colon-separated, absolute CLI bin dirs a sandbox app mounts for its tools. */
-export declare const SANDBOX_TOOL_BIN_DIRS_ENV = "SANDBOX_TOOL_BIN_DIRS";
-/**
- * The tool bin dirs a `SANDBOX_TOOL_BIN_DIRS` value names, or `[]` when it is
- * unset or blank.
- *
- * Fail loud, never silently degrade: a malformed value (a relative segment,
- * or an empty segment from a stray/leading/trailing colon) throws rather than
- * silently dropping a tool dir from PATH or admitting a relative path that
- * resolves against whatever the process cwd happens to be.
- */
-export declare function parseSandboxToolBinDirs(value: string | undefined): string[];
-/**
- * A launch environment whose tool bin dirs are `toolBinDirs`, at the TAIL of
- * PATH after every Nix, npm, image and system entry, so a tool never shadows
- * a platform-owned binary of the same name.
- *
- * They replace `appToolBinDirs` (by default the dirs the environment's own
- * `SANDBOX_TOOL_BIN_DIRS` names) wherever those sit in PATH, so an app's older
- * copy of the same tool cannot win by PATH order. Relative PATH entries are
- * dropped too: they resolve against whatever cwd the turn moves to.
- */
-export declare function bindLaunchToolBinDirs(env: Readonly<Record<string, string | undefined>>, toolBinDirs: readonly string[], appToolBinDirs?: readonly string[]): Record<string, string | undefined>;