@tangle-network/agent-runtime 0.94.8 → 0.94.10

package/dist/{chunk-FRXDOBFP.js → chunk-C3UKLQ54.js}

@@ -657,6 +657,7 @@ function errMessage(err) {
 
 // src/mcp/worktree.ts
 import { spawn } from "child_process";
+import { isAbsolute, win32 } from "path";
 async function runGitAsync(args, cwd, runner) {
   if (runner) return runner(args, { cwd });
   return new Promise((resolve, reject) => {
@@ -675,11 +676,14 @@ async function runGitAsync(args, cwd, runner) {
 }
 function ensureGitOk(step, result) {
   if (result.exitCode !== 0) {
-    throw new Error(
-      `worktree: git ${step} failed (exit ${result.exitCode}): ${result.stderr.slice(0, 400)}`
-    );
+    throw gitFailure(step, result);
   }
 }
+function gitFailure(step, result) {
+  return new Error(
+    `worktree: git ${step} failed (exit ${result.exitCode}): ${result.stderr.slice(0, 400)}`
+  );
+}
 async function createWorktree(options) {
   const variants = options.variantsDir ?? ".agent-worktrees";
   const baseRef = options.baseRef ?? "HEAD";
@@ -697,20 +701,59 @@ async function createWorktree(options) {
 }
 async function captureWorktreeDiff(options) {
   const baseRef = options.baseRef ?? options.worktree.baseSha;
-  await runGitAsync(["add", "-A"], options.worktree.path, options.runGit);
+  const pathspecs = worktreeDiffPathspecs(options.excludePaths ?? []);
+  const staged = await runGitAsync(
+    ["add", "-A", ...pathspecs.length > 0 ? ["--", ".", ...pathspecs] : []],
+    options.worktree.path,
+    options.runGit
+  );
+  ensureGitOk("add -A", staged);
   const patch = await runGitAsync(
-    ["diff", "--cached", baseRef],
+    ["diff", "--cached", baseRef, ...pathspecs.length > 0 ? ["--", ".", ...pathspecs] : []],
     options.worktree.path,
     options.runGit
   );
+  ensureGitOk(`diff --cached ${baseRef}`, patch);
   const shortstat = await runGitAsync(
-    ["diff", "--cached", "--shortstat", baseRef],
+    [
+      "diff",
+      "--cached",
+      "--shortstat",
+      baseRef,
+      ...pathspecs.length > 0 ? ["--", ".", ...pathspecs] : []
+    ],
     options.worktree.path,
     options.runGit
   );
+  ensureGitOk(`diff --cached --shortstat ${baseRef}`, shortstat);
   const stats = parseShortstat(shortstat.stdout);
   return { patch: patch.stdout, stats };
 }
+function worktreeDiffPathspecs(paths) {
+  const normalized = /* @__PURE__ */ new Set();
+  for (const path2 of paths) {
+    if (typeof path2 !== "string" || path2.length === 0 || path2.includes("\\") || hasControlCharacter(path2) || isAbsolute(path2) || win32.isAbsolute(path2)) {
+      throw new Error(
+        `worktree: excluded path must be a canonical repository-relative path: ${path2}`
+      );
+    }
+    const segments = path2.split("/");
+    if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+      throw new Error(
+        `worktree: excluded path must be a canonical repository-relative path: ${path2}`
+      );
+    }
+    normalized.add(path2);
+  }
+  return [...normalized].sort((left, right) => left.localeCompare(right)).map((path2) => `:(top,exclude,literal)${path2}`);
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
 function parseShortstat(text) {
   const out = { filesChanged: 0, insertions: 0, deletions: 0 };
   const filesMatch = text.match(/(\d+)\s+files?\s+changed/);
@@ -726,19 +769,22 @@ async function removeWorktree(options) {
   const args = ["worktree", "remove"];
   if (force) args.push("--force");
   args.push(options.worktree.path);
-  const result = await runGitAsync(args, options.repoRoot, options.runGit);
-  if (result.exitCode !== 0 && !/not a working tree/.test(result.stderr)) {
-    await runGitAsync(
-      ["branch", "-D", options.worktree.branch],
-      options.repoRoot,
-      options.runGit
-    ).catch(() => void 0);
-  }
-  await runGitAsync(
+  const removal = await runGitAsync(args, options.repoRoot, options.runGit);
+  const removalError = removal.exitCode !== 0 && !/not a working tree/iu.test(removal.stderr) ? gitFailure(`worktree remove ${options.worktree.path}`, removal) : void 0;
+  const branchRemoval = await runGitAsync(
     ["branch", "-D", options.worktree.branch],
     options.repoRoot,
     options.runGit
-  ).catch(() => void 0);
+  );
+  const branchError = branchRemoval.exitCode !== 0 && !/branch .+ not found/iu.test(branchRemoval.stderr) ? gitFailure(`branch -D ${options.worktree.branch}`, branchRemoval) : void 0;
+  if (removalError && branchError) {
+    throw new AggregateError(
+      [removalError, branchError],
+      "worktree: failed to remove worktree and branch"
+    );
+  }
+  if (removalError) throw removalError;
+  if (branchError) throw branchError;
 }
 
 // src/runtime/router-client.ts
@@ -1960,6 +2006,11 @@ import { randomUUID } from "crypto";
 
 // src/mcp/worktree-harness.ts
 import { spawn as spawn2 } from "child_process";
+import { createHash } from "crypto";
+import {
+  applyWorkspacePlan,
+  materializeProfile
+} from "@tangle-network/agent-profile-materialize";
 var defaultCheckOutputCap = 16e3;
 async function runWorktreeHarness(opts) {
   const runHarness = opts.runHarness ?? runLocalHarness;
@@ -1976,9 +2027,24 @@ async function runWorktreeHarness(opts) {
     worktree,
     repoRoot: opts.repoRoot,
     ...opts.runGit ? { runGit: opts.runGit } : {}
-  }).catch(() => void 0);
+  });
   try {
-    const { command, args } = harnessInvocation(opts.harness, opts.profile, opts.taskPrompt, {
+    assertSupportedWorktreeProfile(opts.profile, opts.harness);
+    const resourceInstructions = resolveResourceInstructions(opts.profile);
+    const workspaceProfile = materializationOnlyProfile(opts.profile);
+    const plan = materializeProfile(workspaceProfile, opts.harness);
+    if (plan.unsupported.length > 0) {
+      throw new Error(
+        `runWorktreeHarness: profile cannot be materialized for ${opts.harness}: ${plan.unsupported.map(({ dimension, reason }) => `${dimension}: ${reason}`).join("; ")}`
+      );
+    }
+    assertSafeMaterializedPaths(plan);
+    const applied = applyWorkspacePlan(plan, worktree.path);
+    if (applied.unsupported.length > 0) {
+      throw new Error("runWorktreeHarness: applied profile unexpectedly retained unsupported rows");
+    }
+    const invocationProfile = profileWithResourceInstructions(opts.profile, resourceInstructions);
+    const { command, args } = harnessInvocation(opts.harness, invocationProfile, opts.taskPrompt, {
       // This helper created the candidate worktree above; autonomous Claude
       // edits are permitted only inside that isolated checkout.
       dangerouslySkipPermissions: opts.harness === "claude",
@@ -1988,7 +2054,8 @@ async function runWorktreeHarness(opts) {
       harness: opts.harness,
       cwd: worktree.path,
       taskPrompt: opts.taskPrompt,
-      invocation: { command, args },
+      invocation: { command, args: [...args, ...applied.flags] },
+      env: { ...process.env, ...applied.env },
       ...opts.codexReproducible ? { codexReproducible: true } : {},
       ...opts.codexReadDeniedPaths ? { codexReadDeniedPaths: opts.codexReadDeniedPaths } : {},
       ...opts.harnessTimeoutMs !== void 0 ? { timeoutMs: opts.harnessTimeoutMs } : {},
@@ -1996,6 +2063,7 @@ async function runWorktreeHarness(opts) {
     });
     const diff = await captureWorktreeDiff({
       worktree,
+      excludePaths: applied.written,
       ...opts.runGit ? { runGit: opts.runGit } : {}
     });
     const checks = await runWorktreeChecks({
@@ -2011,6 +2079,7 @@ async function runWorktreeHarness(opts) {
       branch: worktree.branch,
       patch: diff.patch,
       stats: diff.stats,
+      profileMaterialization: profileMaterializationReceipt(applied, resourceInstructions),
       harness: {
         name: opts.harness,
         exitCode: harnessResult.exitCode,
@@ -2037,10 +2106,141 @@ async function runWorktreeHarness(opts) {
     };
     return { worktree, result, cleanup };
   } catch (err) {
-    await cleanup();
+    try {
+      await cleanup();
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [err, cleanupError],
+        "runWorktreeHarness: run failed and worktree cleanup also failed"
+      );
+    }
     throw err;
   }
 }
+function resolveResourceInstructions(profile) {
+  const instructions = profile.resources?.instructions;
+  if (instructions === void 0) return void 0;
+  if (typeof instructions === "string")
+    return instructions.trim().length > 0 ? instructions : void 0;
+  if (instructions.kind === "inline" && typeof instructions.content === "string") {
+    return instructions.content.trim().length > 0 ? instructions.content : void 0;
+  }
+  throw new Error(
+    "runWorktreeHarness: resources.instructions must be a string or inline resource; remote refs require pre-resolution"
+  );
+}
+function profileWithResourceInstructions(profile, resourceInstructions) {
+  let resources;
+  if (profile.resources) {
+    const { instructions: _instructions, ...structuralResources } = profile.resources;
+    resources = structuralResources;
+  }
+  return {
+    ...profile,
+    ...resources ? { resources } : {},
+    ...resourceInstructions === void 0 ? {} : {
+      prompt: {
+        ...profile.prompt,
+        instructions: [...profile.prompt?.instructions ?? [], resourceInstructions]
+      }
+    }
+  };
+}
+function materializationOnlyProfile(profile) {
+  const {
+    prompt: _prompt,
+    model: _model,
+    resources: profileResources,
+    ...structuralProfile
+  } = profile;
+  let resources;
+  if (profileResources) {
+    const { instructions: _instructions, ...fileBackedResources } = profileResources;
+    resources = fileBackedResources;
+  }
+  return {
+    ...structuralProfile,
+    ...resources ? { resources } : {}
+  };
+}
+function assertSupportedWorktreeProfile(profile, harness) {
+  const unsupportedAxes = [
+    hasEntries(profile.tools) ? "tools" : null,
+    hasEntries(profile.permissions) ? "permissions" : null,
+    profile.connections && profile.connections.length > 0 ? "connections" : null,
+    hasEntries(profile.confidential) ? "confidential" : null,
+    hasEntries(profile.modes) ? "modes" : null,
+    hasEntries(profile.extensions) ? "extensions" : null
+  ].filter((axis) => axis !== null);
+  if (profile.model?.reasoningEffort !== void 0 && harness !== "codex") {
+    unsupportedAxes.push("model.reasoningEffort");
+  }
+  for (const [name, server] of Object.entries(profile.mcp ?? {})) {
+    const path2 = `mcp[${JSON.stringify(name)}]`;
+    if (server.enabled === false && harness !== "opencode") {
+      unsupportedAxes.push(`${path2}.enabled`);
+    }
+    if (hasEntries(server.headers) && harness === "codex") {
+      unsupportedAxes.push(`${path2}.headers`);
+    }
+    if (server.cwd !== void 0 && harness === "opencode") {
+      unsupportedAxes.push(`${path2}.cwd`);
+    }
+  }
+  if (harness === "claude") {
+    for (const [event, commands] of Object.entries(profile.hooks ?? {})) {
+      for (const [index, command] of commands.entries()) {
+        const path2 = `hooks[${JSON.stringify(event)}][${index}]`;
+        if (hasEntries(command.env)) unsupportedAxes.push(`${path2}.env`);
+        if (command.blocking !== void 0) unsupportedAxes.push(`${path2}.blocking`);
+      }
+    }
+  }
+  for (const [name, subagent] of Object.entries(profile.subagents ?? {})) {
+    const path2 = `subagents[${JSON.stringify(name)}]`;
+    if (hasEntries(subagent.permissions)) unsupportedAxes.push(`${path2}.permissions`);
+    if (subagent.maxSteps !== void 0) unsupportedAxes.push(`${path2}.maxSteps`);
+    if (hasEntries(subagent.tools) && harness !== "claude") {
+      unsupportedAxes.push(`${path2}.tools`);
+    }
+  }
+  if (unsupportedAxes.length > 0) {
+    throw new Error(
+      `runWorktreeHarness: profile requests unsupported worktree behavior: ${unsupportedAxes.join(", ")}`
+    );
+  }
+}
+function hasEntries(value) {
+  return value !== void 0 && Object.keys(value).length > 0;
+}
+function assertSafeMaterializedPaths(plan) {
+  for (const file of plan.files) {
+    if (file.relPath.split("/").some(isGitMetadataSegment)) {
+      throw new Error(
+        `runWorktreeHarness: profile file cannot target reserved Git metadata: ${file.relPath}`
+      );
+    }
+  }
+}
+function isGitMetadataSegment(segment) {
+  const windowsCanonical = segment.replace(/[ .]+$/u, "").toLowerCase();
+  return windowsCanonical === ".git" || windowsCanonical.startsWith(".git:");
+}
+function profileMaterializationReceipt(applied, resourceInstructions) {
+  const instructionBytes = resourceInstructions === void 0 ? null : Buffer.from(resourceInstructions, "utf8");
+  return {
+    workspacePlanDigest: applied.workspacePlanDigest,
+    writtenPaths: [...applied.written],
+    unsupported: [...applied.unsupported],
+    environmentNames: Object.keys(applied.env).sort(),
+    flags: [...applied.flags],
+    resourceInstructions: instructionBytes ? {
+      delivery: "invocation-prompt",
+      sha256: `sha256:${createHash("sha256").update(instructionBytes).digest("hex")}`,
+      byteLength: instructionBytes.byteLength
+    } : { delivery: "none", sha256: null, byteLength: 0 }
+  };
+}
 async function runWorktreeChecks(opts) {
   if (opts.testCmd === void 0 && opts.typecheckCmd === void 0) return void 0;
   const runCommand = opts.runCommand ?? defaultRunCommand;
@@ -6626,4 +6826,4 @@ export {
   workerFromBackend,
   supervise
 };
-//# sourceMappingURL=chunk-FRXDOBFP.js.map
+//# sourceMappingURL=chunk-C3UKLQ54.js.map