@tangle-network/agent-profile-materialize 1.1.6 → 1.1.8

package/dist/managed-workspace.js

@@ -1,290 +0,0 @@
-import { createHash } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, writeFileSync, } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
-import { assertPrivateManagedRoot, lstatIfPresent, prepareManagedWorkspacePlan, } from "./managed-workspace-stage.js";
-import { assertWorkspacePlanSupported } from "./plan-support.js";
-/** Create the two executor-owned roots on one filesystem. */
-export function ensurePublicConcurrentProfileRoots(base) {
-    if (process.getuid?.() !== 0 || !base || resolve(base) !== base) {
-        throw new Error("Concurrent profile roots require an absolute path and a root executor");
-    }
-    if (!lstatIfPresent(base)) {
-        mkdirSync(base, { mode: 0o711 });
-        chmodSync(base, 0o711);
-    }
-    const managedRoot = join(base, "private");
-    const launchRoot = join(base, "launch");
-    if (!lstatIfPresent(managedRoot))
-        mkdirSync(managedRoot, { mode: 0o700 });
-    if (!lstatIfPresent(launchRoot)) {
-        mkdirSync(launchRoot, { mode: 0o711 });
-        chmodSync(launchRoot, 0o711);
-    }
-    assertPrivateManagedRoot(managedRoot);
-    assertLaunchRoot(launchRoot);
-    const baseStat = lstatSync(base);
-    if (!baseStat.isDirectory() ||
-        baseStat.isSymbolicLink() ||
-        realpathSync(base) !== base ||
-        baseStat.uid !== 0 ||
-        (baseStat.mode & 0o777) !== 0o711) {
-        throw new Error("Concurrent profile base must be a root-owned 0711 real directory");
-    }
-    return { managedRoot, launchRoot };
-}
-/**
- * Materialize PUBLIC profile material beside the shared workspace. Processes
- * in one sandbox share a uid and can read each other's revision files and env.
- * Callers must not use this path for confidential profile text or credentials.
- * Only native controls with a verified explicit launch path are admitted.
- * A separate reaper owns removal after no native process reads the revision.
- */
-export async function preparePublicConcurrentProfileRevision(input) {
-    if (!input.ownerId)
-        throw new Error("Concurrent profile revision needs a binding owner");
-    if (input.options?.ownership) {
-        throw new Error("Concurrent profile files must remain executor-owned and read-only");
-    }
-    if (input.plan.files.some((file) => (file.secretSlots?.length ?? 0) > 0) ||
-        Object.values(input.plan.env).some((value) => typeof value !== "string") ||
-        input.plan.flags.some((value) => typeof value !== "string")) {
-        throw new Error("Concurrent profile secrets need per-profile process identity; this sandbox has one subprocess identity");
-    }
-    const plan = prepareExplicitOpenCodePlan(input.plan);
-    assertWorkspacePlanSupported(plan);
-    assertLaunchRoot(input.launchRoot);
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, input.options);
-    try {
-        const identity = createHash("sha256")
-            .update(`${input.ownerId}\0${prepared.manifest.materializedDigest}`)
-            .digest("hex");
-        const directory = join(input.launchRoot, `revision-${identity}`);
-        // Validate every native file before publishing a revision that a launcher
-        // could mistake for a complete profile.
-        const spawn = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"));
-        prepared.manifest.launchDigest = createHash("sha256")
-            .update(JSON.stringify(spawn))
-            .digest("hex");
-        writeFileSync(join(prepared.root, "manifest.json"), JSON.stringify(prepared.manifest));
-        const existing = lstatIfPresent(directory);
-        if (existing) {
-            assertPublishedRevision(directory, prepared.manifest);
-            prepared.dispose();
-        }
-        else {
-            try {
-                // Keep the top directory private and writable for rename. The child
-                // tree is complete and read-only before publication.
-                makeRevisionReadOnly(prepared.root, false);
-                renameSync(prepared.root, directory);
-                // This is the publication point: agents cannot traverse the root
-                // before its mode changes from 0700 to 0555.
-                chmodSync(directory, 0o555);
-            }
-            catch (error) {
-                const raced = lstatIfPresent(directory);
-                if (!raced?.isDirectory() || raced.isSymbolicLink())
-                    throw error;
-                assertPublishedRevision(directory, prepared.manifest);
-                makeStageWritable(prepared.root);
-                prepared.dispose();
-            }
-        }
-        return {
-            directory,
-            manifest: prepared.manifest,
-            application: {
-                ...prepared.application,
-                receipt: {
-                    ...prepared.application.receipt,
-                    flags: [...spawn.flags],
-                },
-                spawn,
-            },
-        };
-    }
-    catch (error) {
-        // A published revision is never removed here; only an unpublished stage is.
-        if (lstatIfPresent(prepared.root)) {
-            makeStageWritable(prepared.root);
-            prepared.dispose();
-        }
-        throw error;
-    }
-}
-/** Move OpenCode's cwd-discovered primary agent into its explicit JSON config. */
-export function prepareExplicitOpenCodePlan(plan) {
-    if (plan.harness !== "opencode")
-        return plan;
-    for (const name of [
-        "OPENCODE_CONFIG",
-        "OPENCODE_CONFIG_CONTENT",
-        "TANGLE_PROFILE_REVISION_WORKSPACE",
-    ]) {
-        if (Object.hasOwn(plan.env, name)) {
-            throw new Error(`Concurrent OpenCode reserves ${name} for its launch binding`);
-        }
-    }
-    const configFile = plan.files.find((file) => file.relPath === "opencode.json");
-    if (configFile?.source !== "generated" ||
-        (configFile.root ?? "workspace") !== "workspace") {
-        throw new Error("Concurrent OpenCode requires a generated opencode.json");
-    }
-    const config = JSON.parse(configFile.content);
-    if (!config || typeof config !== "object" || Array.isArray(config)) {
-        throw new Error("Concurrent OpenCode config must be an object");
-    }
-    const body = config;
-    let files = [...plan.files];
-    if (plan.systemPrompt !== undefined) {
-        const agentFlag = plan.flags.indexOf("--agent");
-        const agentName = plan.flags[agentFlag + 1];
-        if (agentFlag < 0 ||
-            typeof agentName !== "string" ||
-            !/^tangle-profile-[a-f0-9]{16}$/.test(agentName)) {
-            throw new Error("Concurrent OpenCode requires the materializer's primary agent selection");
-        }
-        const primaryPath = `.opencode/agents/${agentName}.md`;
-        const primary = files.find((file) => file.relPath === primaryPath);
-        if (primary?.source !== "generated" ||
-            (primary.root ?? "workspace") !== "workspace") {
-            throw new Error("Concurrent OpenCode primary agent must be generated");
-        }
-        files = files.filter((file) => file !== primary);
-        const agents = body.agent;
-        if (agents !== undefined &&
-            (typeof agents !== "object" || agents === null || Array.isArray(agents))) {
-            throw new Error("Concurrent OpenCode agent config must be an object");
-        }
-        if (agents && Object.hasOwn(agents, agentName)) {
-            throw new Error("Concurrent OpenCode primary agent collides with config");
-        }
-        body.agent = {
-            ...agents,
-            [agentName]: { mode: "primary", prompt: plan.systemPrompt },
-        };
-    }
-    const instructions = body.instructions;
-    if (instructions !== undefined) {
-        if (!Array.isArray(instructions) ||
-            instructions.some((entry) => typeof entry !== "string")) {
-            throw new Error("Concurrent OpenCode instructions must be generated file paths");
-        }
-        body.instructions = instructions.map((relPath) => {
-            const file = files.find((candidate) => candidate.relPath === relPath);
-            if (file?.source !== "generated" ||
-                (file.root ?? "workspace") !== "workspace") {
-                throw new Error(`Concurrent OpenCode cannot redirect instruction ${relPath}`);
-            }
-            return `{env:TANGLE_PROFILE_REVISION_WORKSPACE}/${relPath}`;
-        });
-    }
-    return {
-        ...plan,
-        files: files.map((file) => file === configFile ? { ...file, content: JSON.stringify(body) } : file),
-    };
-}
-function assertPublishedRevision(directory, expected) {
-    const root = lstatSync(directory);
-    if (!root.isDirectory() ||
-        root.isSymbolicLink() ||
-        (root.mode & 0o777) !== 0o555) {
-        throw new Error("Concurrent profile revision is not fully published");
-    }
-    const persisted = JSON.parse(readFileSync(join(directory, "manifest.json"), "utf8"));
-    if (persisted.materializedDigest !== expected.materializedDigest ||
-        persisted.launchDigest !== expected.launchDigest) {
-        throw new Error("Concurrent profile revision digest collision");
-    }
-    for (const file of expected.files) {
-        const path = join(directory, file.root, file.relPath);
-        const stat = lstatSync(path);
-        if (!stat.isFile() ||
-            stat.isSymbolicLink() ||
-            (stat.mode & 0o222) !== 0 ||
-            createHash("sha256").update(readFileSync(path)).digest("hex") !==
-                file.sha256) {
-            throw new Error(`Concurrent profile revision file changed: ${file.relPath}`);
-        }
-    }
-    const expectedPaths = new Set(expected.files.map((file) => `${file.root}/${file.relPath}`));
-    for (const rootName of ["workspace", "agent"]) {
-        for (const relPath of listRevisionFiles(join(directory, rootName))) {
-            if (!expectedPaths.delete(`${rootName}/${relPath}`)) {
-                throw new Error(`Concurrent profile revision has an unexpected file: ${rootName}/${relPath}`);
-            }
-        }
-    }
-    if (expectedPaths.size) {
-        throw new Error("Concurrent profile revision is missing a manifest file");
-    }
-}
-export function listRevisionFiles(root, prefix = "") {
-    const found = [];
-    for (const entry of readdirSync(root, { withFileTypes: true })) {
-        const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
-        if (entry.isDirectory())
-            found.push(...listRevisionFiles(join(root, entry.name), relPath));
-        else if (entry.isFile())
-            found.push(relPath);
-        else
-            throw new Error(`Concurrent profile revision has a non-regular path: ${relPath}`);
-    }
-    return found;
-}
-export function assertLaunchRoot(root) {
-    if (!root || resolve(root) !== root) {
-        throw new Error("Concurrent profile launch root must be absolute");
-    }
-    const stat = lstatSync(root);
-    if (!stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        realpathSync(root) !== root ||
-        (stat.mode & 0o022) !== 0 ||
-        (stat.mode & 0o111) !== 0o111 ||
-        stat.uid !== process.getuid?.()) {
-        throw new Error("Concurrent profile launch root must be executor-owned, real, traversable, and not writable by agent users");
-    }
-    let ancestor = dirname(root);
-    while (ancestor !== root) {
-        const ancestorStat = lstatSync(ancestor);
-        if (!ancestorStat.isDirectory() ||
-            ancestorStat.isSymbolicLink() ||
-            (ancestorStat.mode & 0o001) === 0) {
-            throw new Error(`Concurrent profile launch root has a non-traversable ancestor: ${ancestor}`);
-        }
-        if (ancestor === dirname(ancestor))
-            break;
-        ancestor = dirname(ancestor);
-    }
-}
-function makeRevisionReadOnly(root, publishRoot = true) {
-    for (const entry of readdirSync(root, { withFileTypes: true })) {
-        const path = join(root, entry.name);
-        if (entry.isDirectory()) {
-            makeRevisionReadOnly(path);
-        }
-        else if (entry.isFile()) {
-            const mode = lstatSync(path).mode & 0o111;
-            chmodSync(path, mode ? 0o555 : 0o444);
-        }
-        else {
-            throw new Error(`Concurrent profile revision contains a non-regular path: ${entry.name}`);
-        }
-    }
-    if (publishRoot)
-        chmodSync(root, 0o555);
-}
-export function makeStageWritable(root) {
-    if (!lstatIfPresent(root))
-        return;
-    chmodSync(root, 0o700);
-    for (const entry of readdirSync(root, { withFileTypes: true })) {
-        const path = join(root, entry.name);
-        if (entry.isDirectory())
-            makeStageWritable(path);
-        else if (entry.isFile())
-            chmodSync(path, 0o600);
-    }
-}

package/dist/mcp-config-ownership.d.ts

@@ -1,13 +0,0 @@
-/**
- * Harness MCP config files this package generates wholesale from
- * `profile.mcp`: exactly one `mcpServers` object whose entries carry only
- * the fields the generators write. Recognizable by that shape alone (no
- * schema id to key on), so an existing file holding ONLY those registrations
- * is this package's earlier output and a new plan replaces it — a per-turn
- * profile changes these bytes routinely (physim's MCP env carries turn
- * state). Anything else at the path (a user's own keys, extra fields) still
- * refuses: the name alone proves nothing, same rule as `opencode.json`.
- */
-/** Whether the existing file at `relPath` is this package's own earlier MCP
- *  config output (shape rule above). `undefined` content = no regular file. */
-export declare function isMaterializerMcpConfig(relPath: string, content: () => string | undefined): boolean;

package/dist/mcp-config-ownership.js

@@ -1,79 +0,0 @@
-/**
- * Harness MCP config files this package generates wholesale from
- * `profile.mcp`: exactly one `mcpServers` object whose entries carry only
- * the fields the generators write. Recognizable by that shape alone (no
- * schema id to key on), so an existing file holding ONLY those registrations
- * is this package's earlier output and a new plan replaces it — a per-turn
- * profile changes these bytes routinely (physim's MCP env carries turn
- * state). Anything else at the path (a user's own keys, extra fields) still
- * refuses: the name alone proves nothing, same rule as `opencode.json`.
- */
-/** Paths owned by this rule. `.gemini/settings.json` is deliberately absent:
- *  it is a broader user settings file the package only contributes one key
- *  to, so its bytes cannot prove authorship. */
-const MATERIALIZER_MCP_CONFIG_PATHS = new Set([
-    ".pi/mcp.json",
-    ".kimi-code/mcp.json",
-]);
-const GENERATED_MCP_SERVER_KEYS = new Set([
-    "command",
-    "args",
-    "env",
-    "cwd",
-    "url",
-    "httpUrl",
-    "headers",
-    "transport",
-    "enabled",
-    "directTools",
-]);
-/** Parse workspace bytes into the one shape this rule owns, or `null` when
- *  the bytes are anything else (not an object, other top-level keys, or
- *  server entries that are not objects). The I/O boundary for
- *  {@link isGeneratedMcpConfigShape}. */
-function parseMcpServersConfig(bytes) {
-    let parsed;
-    try {
-        parsed = JSON.parse(bytes);
-    }
-    catch {
-        return null;
-    }
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        return null;
-    }
-    const { mcpServers } = parsed;
-    if (mcpServers === null ||
-        typeof mcpServers !== "object" ||
-        Array.isArray(mcpServers)) {
-        return null;
-    }
-    for (const server of Object.values(mcpServers)) {
-        if (server === null ||
-            typeof server !== "object" ||
-            Array.isArray(server)) {
-            return null;
-        }
-    }
-    return { mcpServers: mcpServers };
-}
-/** Whether a parsed MCP config carries ONLY the registrations this package
- *  generates: no extra top-level keys, and every server entry holds only
- *  generated fields. A user's own key anywhere makes this `false`. */
-function isGeneratedMcpConfigShape(config) {
-    const keys = Object.keys(config);
-    if (keys.length !== 1 || keys[0] !== "mcpServers")
-        return false;
-    return Object.values(config.mcpServers).every((server) => Object.keys(server).every((key) => GENERATED_MCP_SERVER_KEYS.has(key)));
-}
-/** Whether the existing file at `relPath` is this package's own earlier MCP
- *  config output (shape rule above). `undefined` content = no regular file. */
-export function isMaterializerMcpConfig(relPath, content) {
-    if (!MATERIALIZER_MCP_CONFIG_PATHS.has(relPath))
-        return false;
-    const bytes = content();
-    if (bytes === undefined)
-        return false;
-    const config = parseMcpServersConfig(bytes);
-    return config !== null && isGeneratedMcpConfigShape(config);
-}

package/dist/mcp-opencode.d.ts

@@ -1,25 +0,0 @@
-/** OpenCode-native MCP configuration used by workspace and startup paths. */
-export type OpenCodeMcpConfig = Record<string, {
-    type: "remote";
-    url: string;
-    enabled: boolean;
-    headers?: Record<string, AgentProfileConfigValue>;
-    /** Milliseconds; OpenCode bounds this server's connect, tool listing and tool calls by it. */
-    timeout?: number;
-    /** `false` turns off OpenCode's OAuth discovery for this server. */
-    oauth?: false;
-} | {
-    type: "local";
-    command: Array<string | AgentProfileConfigValue>;
-    enabled: boolean;
-    environment?: Record<string, AgentProfileConfigValue>;
-    timeout?: number;
-}>;
-/**
- * Lower canonical MCP definitions to OpenCode's native startup configuration.
- * `toolTimeouts` holds the validated `metadata.toolTimeoutMs` of each server
- * that declared one; without it OpenCode applies the MCP SDK's 60 s default to
- * every tool call.
- */
-export declare function openCodeMcpConfig(mcp: Record<string, AgentProfileMcpServer>, toolTimeouts?: ReadonlyMap<string, number>): OpenCodeMcpConfig;
-import type { AgentProfileConfigValue, AgentProfileMcpServer } from "@tangle-network/agent-interface";

package/dist/mcp-opencode.js

@@ -1,52 +0,0 @@
-const carriesAuthorization = (headers) => Object.keys(headers ?? {}).some((header) => header.toLowerCase() === "authorization");
-/**
- * Lower canonical MCP definitions to OpenCode's native startup configuration.
- * `toolTimeouts` holds the validated `metadata.toolTimeoutMs` of each server
- * that declared one; without it OpenCode applies the MCP SDK's 60 s default to
- * every tool call.
- */
-export function openCodeMcpConfig(mcp, toolTimeouts = new Map()) {
-    const out = {};
-    for (const [name, s] of Object.entries(mcp)) {
-        if (s.enabled === false)
-            continue;
-        // OpenCode also bounds connect and tool listing by this value, so a server
-        // that hangs on connect holds startup that long; a refused connection still
-        // fails at once.
-        const timeout = toolTimeouts.get(name);
-        if (s.url) {
-            if (s.transport === "sse") {
-                throw new Error(`OpenCode MCP server "${name}" uses unsupported SSE transport`);
-            }
-            const headers = withAppliedToolTimeout(s.headers, timeout);
-            out[name] = {
-                type: "remote",
-                url: s.url,
-                enabled: true,
-                ...(headers ? { headers } : {}),
-                ...(timeout !== undefined ? { timeout } : {}),
-                // A server that takes its credential from these headers has no OAuth
-                // flow. With OAuth on, OpenCode answers its 401 with OAuth discovery at
-                // the server's origin, and the agent sees that discovery's failure
-                // instead of the server's refusal.
-                ...(carriesAuthorization(s.headers) ? { oauth: false } : {}),
-            };
-            continue;
-        }
-        if (!s.command) {
-            throw new Error(`OpenCode MCP server "${name}" must define either url or command`);
-        }
-        if (s.cwd !== undefined) {
-            throw new Error(`OpenCode MCP server "${name}" does not support a cwd field`);
-        }
-        out[name] = {
-            type: "local",
-            command: [s.command, ...(s.args ?? [])],
-            enabled: true,
-            ...(s.env ? { environment: s.env } : {}),
-            ...(timeout !== undefined ? { timeout } : {}),
-        };
-    }
-    return out;
-}
-import { withAppliedToolTimeout } from "./mcp-timeouts.js";

package/dist/mcp-timeouts.d.ts

@@ -1,7 +0,0 @@
-export type ActiveAgentProfileMcpServer = Exclude<AgentProfileMcpServer, {
-    enabled: false;
-}>;
-export declare function mcpToolTimeouts(mcp: Record<string, ActiveAgentProfileMcpServer>, h: HarnessId, unsupported: (d: Unsupported["dimension"], r: string) => void): Map<string, number>;
-export declare function withAppliedToolTimeout(headers: Record<string, AgentProfileConfigValue> | undefined, appliedTimeoutMs: number | undefined): Record<string, AgentProfileConfigValue> | undefined;
-import type { AgentProfileConfigValue, AgentProfileMcpServer } from "@tangle-network/agent-interface";
-import type { HarnessId, Unsupported } from "./plan-types.js";

package/dist/mcp-timeouts.js

@@ -1,48 +0,0 @@
-/**
- * The header a harness sends to a remote MCP server whose tool-call timeout it
- * raised, carrying the timeout it applied in milliseconds. A server may hold a
- * call for nearly that long. A server that does not see the header must assume
- * the harness default, 60 s for Claude Code, Codex and OpenCode.
- */
-const MCP_TOOL_TIMEOUT_HEADER = "X-Mcp-Tool-Timeout-Ms";
-const MIN_MCP_TOOL_TIMEOUT_MS = 1_000;
-const MAX_MCP_TOOL_TIMEOUT_MS = 3_600_000;
-/**
- * The tool-call timeout a profile asks the harness to give one MCP server,
- * from `metadata.toolTimeoutMs`. Profile metadata is open in every published
- * schema, so a profile carrying it validates against older consumers, which
- * ignore it. A malformed value is reported, never guessed.
- */
-function mcpToolTimeoutMs(server, name, h, unsupported) {
-    const value = server.metadata?.toolTimeoutMs;
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== "number" ||
-        !Number.isSafeInteger(value) ||
-        value < MIN_MCP_TOOL_TIMEOUT_MS ||
-        value > MAX_MCP_TOOL_TIMEOUT_MS) {
-        unsupported("mcp", `${h}: MCP server "${name}" metadata.toolTimeoutMs must be an integer from ${MIN_MCP_TOOL_TIMEOUT_MS} to ${MAX_MCP_TOOL_TIMEOUT_MS}`);
-        return undefined;
-    }
-    return value;
-}
-export function mcpToolTimeouts(mcp, h, unsupported) {
-    const timeouts = new Map();
-    for (const [name, server] of Object.entries(mcp)) {
-        const value = mcpToolTimeoutMs(server, name, h, unsupported);
-        if (value !== undefined)
-            timeouts.set(name, value);
-    }
-    return timeouts;
-}
-export function withAppliedToolTimeout(headers, appliedTimeoutMs) {
-    if (appliedTimeoutMs === undefined)
-        return headers;
-    return {
-        ...headers,
-        [MCP_TOOL_TIMEOUT_HEADER]: {
-            kind: "public",
-            value: String(appliedTimeoutMs),
-        },
-    };
-}

package/dist/mcp.d.ts

@@ -1,4 +0,0 @@
-export declare function materializeMcp(h: HarnessId, mcp: Record<string, ActiveAgentProfileMcpServer>, plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void): void;
-import { type ActiveAgentProfileMcpServer } from "./mcp-timeouts.js";
-import type { AddPlanFile } from "./plan-json.js";
-import type { HarnessId, Unsupported, WorkspacePlan } from "./plan-types.js";