@tangle-network/agent-provider-tangle 1.1.1 → 1.1.2

package/README.md

@@ -241,6 +241,9 @@ if (checkpoint?.status === "created" || checkpoint?.status === "replayed") {
 ### Confidential forks
 
 Sandbox returns raw TEE evidence, not a verified claim.
+The deployed Tangle job does not carry snapshot restore or sealed-persistence inputs.
+The provider therefore refuses new confidential workspace forks before creation.
+Existing confidential fork records still require a matching TEE report and an external verifier before they become trusted.
 Pass `confidentialAttestationVerifier` to `createTangleProvider` to connect a
 trusted provider-key and measurement verifier.
 The callback receives the raw report, the expected environment binding, and

package/dist/tangle-capabilities.js

@@ -86,6 +86,8 @@ export function defaultTangleSandboxCapabilities(harness) {
         branching: {
             checkpoint: true,
             fork: true,
+            // The deployed Tangle job does not carry snapshot restore inputs.
+            confidential: false,
             retrySafe: true,
             lookup: true,
             cleanup: true,
@@ -361,11 +363,12 @@ export function narrowedTangleCapabilities(declared, support, deployment, option
         // An incomplete Sandbox surface clears every branching flag together. A
         // partial claim would let a caller start an operation it cannot recover.
         branching: support.workspaceBranching
-            ? { ...declaredBranching }
+            ? { ...declaredBranching, confidential: false }
             : {
                 ...declaredBranching,
                 checkpoint: false,
                 fork: false,
+                confidential: false,
                 ...(declaredBranching.retrySafe !== undefined ? { retrySafe: false } : {}),
                 ...(declaredBranching.lookup !== undefined ? { lookup: false } : {}),
                 ...(declaredBranching.cleanup !== undefined ? { cleanup: false } : {}),

package/dist/tangle-workspace-branching.js

@@ -16,6 +16,18 @@ const MAX_MARKER_TAG_LENGTH = 128;
 const MARKER_CHUNK_SIZE = 80;
 const LEGACY_MARKER_CHUNK_SIZE = 240;
 const MAX_MARKER_CHUNKS = 512;
+const TANGLE_ATTESTATION_NONCE_PATTERN = /^(?:0x)?[0-9a-fA-F]{64}(?:[0-9a-fA-F]{64})?$/;
+function confidentialForkRefusal(request) {
+    const confidential = request.confidential;
+    if (confidential?.requested !== true)
+        return undefined;
+    if (confidential.nonce === undefined ||
+        !TANGLE_ATTESTATION_NONCE_PATTERN.test(confidential.nonce))
+        return "Tangle confidential forks require a 32-64 byte hexadecimal attestation nonce";
+    if (confidential.sealed === true)
+        return "Tangle confidential forks cannot prove sealed no-persistence because the deployed job does not carry that requirement";
+    return "Tangle confidential workspace forks are unavailable because the deployed job does not carry snapshot restore inputs";
+}
 /**
  * Carry the verifier only when the caller supplied one. Every option type that
  * accepts it is exact-optional, so an explicit `undefined` is not an absent key.
@@ -293,6 +305,10 @@ export function createTangleWorkspaceBranching(options) {
         if (known.state === "known") {
             return forkSuccess(request, known.record.environment, "replayed");
         }
+        const confidentialRefusal = confidentialForkRefusal(request);
+        if (confidentialRefusal !== undefined) {
+            return forkUnknown(request, confidentialRefusal, false);
+        }
         const checkpoint = [...checkpoints.values()].some((record) => canonicalCandidateDigest(record.checkpoint) ===
             canonicalCandidateDigest(request.checkpoint))
             ? true
@@ -624,6 +640,7 @@ async function confidentialAttestationForChild(request, child, provider, verifie
     const material = {
         provider,
         requested: true,
+        tee: response.attestation.tee_type,
         nonce: confidential.nonce,
         measurement,
         environmentId: child.id,
@@ -681,7 +698,7 @@ async function confidentialAttestationForChild(request, child, provider, verifie
 }
 function validTeeReport(report) {
     return (!!report &&
-        safeString(report.tee_type) !== undefined &&
+        safeIdentifier(report.tee_type) !== undefined &&
         Array.isArray(report.evidence) &&
         report.evidence.length <= MAX_TEE_EVIDENCE_BYTES &&
         report.evidence.every((value) => Number.isInteger(value) && value >= 0 && value <= 255) &&

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@tangle-network/agent-provider-tangle",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "AgentEnvironmentProvider adapter for Tangle sandboxes",
   "type": "module",
   "license": "MIT",
-  "main": "dist/index.js",
-  "types": "src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
       "import": "./dist/index.js",
-      "types": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
   "repository": {
@@ -19,16 +20,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org",
-    "main": "./dist/index.js",
-    "types": "./dist/index.d.ts",
-    "exports": {
-      ".": {
-        "import": "./dist/index.js",
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      }
-    }
+    "registry": "https://registry.npmjs.org"
   },
   "files": [
     "dist/index.d.ts",
@@ -98,15 +90,8 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "check-types": "tsc --noEmit",
-    "clean": "rm -rf dist",
-    "prepublishOnly": "pnpm run build",
-    "test": "vitest run src"
-  },
   "dependencies": {
-    "@tangle-network/agent-interface": "^2.2.0"
+    "@tangle-network/agent-interface": "^2.3.0"
   },
   "peerDependencies": {
     "@tangle-network/sandbox": ">=0.34.6 <1.0.0"
@@ -118,11 +103,17 @@
   },
   "devDependencies": {
     "@tangle-network/agent-eval": "0.170.0",
-    "@tangle-network/agent-provider-testkit": "workspace:*",
     "@tangle-network/agent-runtime": "0.184.0",
     "@tangle-network/sandbox": "0.34.6",
-    "@types/node": "catalog:",
+    "@types/node": "26.4.0",
     "typescript": "7.0.2",
-    "vitest": "catalog:"
+    "vitest": "4.1.11",
+    "@tangle-network/agent-provider-testkit": "0.9.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check-types": "tsc --noEmit",
+    "clean": "rm -rf dist",
+    "test": "vitest run src"
   }
-}
+}