@tangle-network/agent-app 0.44.41 → 0.44.46

package/dist/{chunk-VWOPOLVO.js → chunk-U4BXAZCN.js}

@@ -1,6 +1,6 @@
 import {
   assertMediaUrl
-} from "./chunk-PTUMBMVH.js";
+} from "./chunk-J25RST7G.js";
 
 // src/design-canvas/model.ts
 var SCENE_SCHEMA_VERSION = 1;
@@ -1001,4 +1001,4 @@ export {
   scalePageForChannelPreset,
   bleedAwareExportRect
 };
-//# sourceMappingURL=chunk-VWOPOLVO.js.map
+//# sourceMappingURL=chunk-U4BXAZCN.js.map

package/dist/{chunk-HUBACCOP.js → chunk-VGATER6G.js}

@@ -978,6 +978,24 @@ function transientExecError(err) {
 function deferredProfileWriteFailed(stage, name, cause) {
   return new Error(`deferred file write failed on ${stage} box ${name}: ${cause.message}`, { cause });
 }
+var SandboxEgressPolicyMismatchError = class extends Error {
+  stage;
+  boxName;
+  currentPolicy;
+  currentSource;
+  desiredPolicy;
+  constructor(stage, boxName, currentPolicy, currentSource, desiredPolicy) {
+    super(
+      `egress policy mismatch on ${stage} box ${boxName}: current ${currentPolicy.mode} policy from ${currentSource} does not explicitly match desired ${desiredPolicy.mode} policy; the existing box was preserved and egress was not updated.`
+    );
+    this.name = "SandboxEgressPolicyMismatchError";
+    this.stage = stage;
+    this.boxName = boxName;
+    this.currentPolicy = currentPolicy;
+    this.currentSource = currentSource;
+    this.desiredPolicy = desiredPolicy;
+  }
+};
 var SandboxRuntimeAuthRefreshError = class extends Error {
   constructor(stage, name, detail, cause) {
     super(`${stage} sandbox auth refresh failed for ${name}: ${detail}`, { cause });
@@ -1411,7 +1429,7 @@ async function peekWorkspaceSandbox(shell, options) {
   return { status: "running", box: match };
 }
 async function finalizeExistingBox(shell, client, box, stage, name, workspaceId, userId, harness, scope) {
-  await reconcileExistingBoxEgress(box, shell.egressPolicy, stage, name);
+  await assertExistingBoxEgress(box, shell.egressPolicy, stage, name);
   const written = await materializeDeferredFilesForExistingBox(
     shell,
     client,
@@ -1434,18 +1452,24 @@ async function finalizeExistingBox(shell, client, box, stage, name, workspaceId,
   }
   return finalBox;
 }
+function canonicalizeJson(value) {
+  if (Array.isArray(value)) return value.map(canonicalizeJson);
+  if (value === null || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => [key, canonicalizeJson(entry)])
+  );
+}
 function normalizedEgressPolicy(policy) {
-  if (policy.mode !== "strict") return policy.mode;
-  const allowDomains = [...new Set(
-    (policy.allowDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean)
-  )].sort();
-  return JSON.stringify({
-    mode: policy.mode,
-    allowDomains,
-    includeImplicitDomains: policy.includeImplicitDomains !== false
-  });
+  const normalized = { ...policy };
+  if (policy.mode === "strict") {
+    normalized.allowDomains = [...new Set(
+      (policy.allowDomains ?? []).map((domain) => domain.trim().toLowerCase()).filter(Boolean)
+    )].sort();
+    normalized.includeImplicitDomains = policy.includeImplicitDomains !== false;
+  }
+  return JSON.stringify(canonicalizeJson(normalized));
 }
-async function reconcileExistingBoxEgress(box, desired, stage, name) {
+async function assertExistingBoxEgress(box, desired, stage, name) {
   if (!desired) return;
   let current;
   try {
@@ -1457,16 +1481,15 @@ async function reconcileExistingBoxEgress(box, desired, stage, name) {
     });
   }
   const matchingPolicy = normalizedEgressPolicy(current.policy) === normalizedEgressPolicy(desired);
-  const effectiveSource = desired.mode !== "open" || current.source !== "platform";
-  if (matchingPolicy && effectiveSource) return;
-  try {
-    await box.egress.update(desired);
-  } catch (cause) {
-    const error = cause instanceof Error ? cause : new Error(String(cause));
-    throw new Error(`egress policy update failed on ${stage} box ${name}: ${error.message}`, {
-      cause: error
-    });
-  }
+  const explicitSource = current.source !== "platform";
+  if (matchingPolicy && explicitSource) return;
+  throw new SandboxEgressPolicyMismatchError(
+    stage,
+    name,
+    current.policy,
+    current.source,
+    desired
+  );
 }
 async function ensureWorkspaceSandbox(shell, options) {
   const { workspaceId, userId, harness, forceNew, onProgress, billingOwnerId } = options;
@@ -1983,6 +2006,7 @@ export {
   buildSandboxToolPathSetupScript,
   runSandboxToolPathSetup,
   splitDeferredProfileFiles,
+  SandboxEgressPolicyMismatchError,
   SandboxRuntimeAuthRefreshError,
   SandboxRecoveryFailedError,
   writeProfileFilesToBox,
@@ -2014,4 +2038,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-HUBACCOP.js.map
+//# sourceMappingURL=chunk-VGATER6G.js.map