@tangle-network/sandbox 0.60.41-develop.20261012074530.e978912 → 0.60.41-develop.20261012103849.9009d74

package/dist/agent/index.js

@@ -1,8 +1,8 @@
 import { a as TOOL_SPECS, i as ALL_TOOL_SPECS, o as serializeToolResult, r as bindToolSpecs, t as createMcpServer } from "../mcp-local-DjryqUiY.js";
 import { E as assertCurrentBackendType } from "../interactive-controller-Dxt5sW2N.js";
 import { h as StateError, l as NotFoundError, v as ValidationError } from "../errors-Cq4hMysQ.js";
-import { n as Sandbox } from "../client-CGbGnrBO.js";
-import { t as SandboxInstance } from "../sandbox-uwsfBoYj.js";
+import { n as Sandbox } from "../client-BA_a3iST.js";
+import { t as SandboxInstance } from "../sandbox-Bg7l8Swk.js";
 import { z } from "zod";
 //#region src/agent/instances.ts
 const managers = /* @__PURE__ */ new WeakMap();

package/dist/{client-CGbGnrBO.js → client-BA_a3iST.js}

@@ -2,7 +2,7 @@ import { r as backendTypeSchema } from "./backend-types-C7b_Gpa0.js";
 import { D as foldModelRoutingFields, E as assertCurrentBackendType, M as withProfileHarness, S as encodePromptForWire, T as applyRequestedModel, k as normalizeRuntimeBackendConfig, s as requestInteractiveSessionToken, w as parseSSEStream } from "./interactive-controller-Dxt5sW2N.js";
 import { _ as TimeoutError, b as parseResponseError, c as NetworkError, d as QuotaError, l as NotFoundError, m as ServerError, p as SandboxError, s as NON_RETRYABLE_CREATE_QUOTA_REASONS, t as AuthError, u as PartialFailureError, v as ValidationError, x as readResponseJson, y as parseErrorResponse } from "./errors-Cq4hMysQ.js";
 import { f as combineAbortSignals } from "./browser-interactive-control-controller-BJf0P_J4.js";
-import { A as exportTraceBundle, C as splitInlineProfileFileMounts, D as normalizeSandboxShape, E as normalizeConnection, O as rewrapResponse, T as validateDeferredProfileFileMounts, a as normalizeStartupDiagnostics, i as normalizeSandboxCreateReceipt, n as createSandboxInstanceFromResponse, r as normalizeCaptureProof, w as splitInlineProfileSkills } from "./sandbox-uwsfBoYj.js";
+import { A as exportTraceBundle, C as splitInlineProfileFileMounts, D as normalizeSandboxShape, E as normalizeConnection, O as rewrapResponse, T as validateDeferredProfileFileMounts, a as normalizeStartupDiagnostics, i as normalizeSandboxCreateReceipt, n as createSandboxInstanceFromResponse, r as normalizeCaptureProof, w as splitInlineProfileSkills } from "./sandbox-Bg7l8Swk.js";
 import { LinesClient } from "./lines.js";
 import { agentProfileSchema } from "@tangle-network/agent-interface";
 import { z } from "zod";

package/dist/core.js

@@ -1,6 +1,6 @@
 import { _ as TimeoutError, a as FileWriteConflictError, c as NetworkError, d as QuotaError, h as StateError, l as NotFoundError, m as ServerError, n as CapabilityError, p as SandboxError, t as AuthError, u as PartialFailureError, v as ValidationError } from "./errors-Cq4hMysQ.js";
-import { _ as parseBackendRegistryResponse, a as InstanceRestartingError, f as backendRegistryCapabilitiesSchema, g as isBackendRegistryInteractionKind, h as backendRegistryResponseSchema, i as HostedInstance, m as backendRegistryInteractionKindSchema, n as Sandbox, o as InstancesClient, p as backendRegistryEntrySchema, v as parseBackendRegistryResponseBody } from "./client-CGbGnrBO.js";
-import { o as WorkspaceImages, t as SandboxInstance, x as ManagedProcessClient } from "./sandbox-uwsfBoYj.js";
+import { _ as parseBackendRegistryResponse, a as InstanceRestartingError, f as backendRegistryCapabilitiesSchema, g as isBackendRegistryInteractionKind, h as backendRegistryResponseSchema, i as HostedInstance, m as backendRegistryInteractionKindSchema, n as Sandbox, o as InstancesClient, p as backendRegistryEntrySchema, v as parseBackendRegistryResponseBody } from "./client-BA_a3iST.js";
+import { o as WorkspaceImages, t as SandboxInstance, x as ManagedProcessClient } from "./sandbox-Bg7l8Swk.js";
 import { LinesClient, lineInstanceKey, profileChannelReference } from "./lines.js";
 import { i as parseLineApplicationResult, n as LINE_APPLICATION_REQUEST_MAX_BYTES, r as parseLineApplicationRequest, t as LINE_APPLICATION_REPLY_MAX_CHARS } from "./line-application-Cq6dJLBD.js";
 //#region src/core.ts

package/dist/index.js

@@ -1,13 +1,13 @@
 import { i as parseBackendType, r as backendTypeSchema, t as ALL_BACKEND_TYPES } from "./backend-types-C7b_Gpa0.js";
 import { A as requestedPublicProfileDigest, F as deriveAgentResultOutcome, I as deriveAgentRunOutcome, L as projectAgentTerminalRecord, P as createAgentRunOutcomeTracker, a as TERMINAL_WS_ECHO_SUBPROTOCOL, i as TerminalStreamError, k as normalizeRuntimeBackendConfig, n as InteractiveSessionController, r as TerminalStream, t as BrowserInteractiveSessionController, w as parseSSEStream } from "./interactive-controller-Dxt5sW2N.js";
 import { _ as TimeoutError, a as FileWriteConflictError, c as NetworkError, d as QuotaError, f as ResumeEnvRequiredError, g as StreamInterruptedError, h as StateError, i as EgressProxyRecoveryError, l as NotFoundError, m as ServerError, n as CapabilityError, o as KeyBudgetExhaustedError, p as SandboxError, r as EdgeNotReadyError, t as AuthError, u as PartialFailureError, v as ValidationError } from "./errors-Cq4hMysQ.js";
-import { _ as parseBackendRegistryResponse, a as InstanceRestartingError, c as SandboxFleetClient, d as validateBatchRunRequest, f as backendRegistryCapabilitiesSchema, g as isBackendRegistryInteractionKind, h as backendRegistryResponseSchema, i as HostedInstance, l as runtimeWorkspaceCwdSchema, m as backendRegistryInteractionKindSchema, n as Sandbox, o as InstancesClient, p as backendRegistryEntrySchema, r as RunsClient, s as SandboxFleet, t as IntelligenceClient, u as createBatchResultAccumulator, v as parseBackendRegistryResponseBody } from "./client-CGbGnrBO.js";
+import { _ as parseBackendRegistryResponse, a as InstanceRestartingError, c as SandboxFleetClient, d as validateBatchRunRequest, f as backendRegistryCapabilitiesSchema, g as isBackendRegistryInteractionKind, h as backendRegistryResponseSchema, i as HostedInstance, l as runtimeWorkspaceCwdSchema, m as backendRegistryInteractionKindSchema, n as Sandbox, o as InstancesClient, p as backendRegistryEntrySchema, r as RunsClient, s as SandboxFleet, t as IntelligenceClient, u as createBatchResultAccumulator, v as parseBackendRegistryResponseBody } from "./client-BA_a3iST.js";
 import { a as INTERACTIVE_CONTROL_CLEANUP_TIMEOUT_MS, l as createInteractiveControlHolderId, n as browserInteractiveControlHolderId, o as InteractiveSessionControlController, s as InteractiveSessionNotRunningError, t as BrowserInteractiveSessionControlController, u as interactiveSessionIdentityDigest } from "./browser-interactive-control-controller-BJf0P_J4.js";
-import { A as exportTraceBundle, C as splitInlineProfileFileMounts, M as toOtelJson, S as materializeProfileFileMounts, T as validateDeferredProfileFileMounts, _ as collectAgentFinalMessageText, b as isToolBearingEvent, c as MAX_EGRESS_DENIALS_LIMIT, d as InteractiveSessionHandle, f as agentInteractiveSessionPromptRequestDigest, g as applySandboxEventText, h as createInteractiveTerminalSession, j as otelTraceIdForTangleTrace, k as buildTraceExportPayload, l as SandboxTaskSession, m as createInteractiveTerminalCapture, o as WorkspaceImages, p as InteractiveTerminalFrameLog, s as GPU_LEASE_PROVIDER_NAMES, t as SandboxInstance, u as SandboxSession, v as collectAgentResponseText, w as splitInlineProfileSkills, x as ManagedProcessClient, y as getSandboxEventText } from "./sandbox-uwsfBoYj.js";
+import { A as exportTraceBundle, C as splitInlineProfileFileMounts, M as toOtelJson, S as materializeProfileFileMounts, T as validateDeferredProfileFileMounts, _ as collectAgentFinalMessageText, b as isToolBearingEvent, c as MAX_EGRESS_DENIALS_LIMIT, d as InteractiveSessionHandle, f as agentInteractiveSessionPromptRequestDigest, g as applySandboxEventText, h as createInteractiveTerminalSession, j as otelTraceIdForTangleTrace, k as buildTraceExportPayload, l as SandboxTaskSession, m as createInteractiveTerminalCapture, o as WorkspaceImages, p as InteractiveTerminalFrameLog, s as GPU_LEASE_PROVIDER_NAMES, t as SandboxInstance, u as SandboxSession, v as collectAgentResponseText, w as splitInlineProfileSkills, x as ManagedProcessClient, y as getSandboxEventText } from "./sandbox-Bg7l8Swk.js";
 import { LinesClient, SandboxLines, lineInstanceKey, profileChannelReference } from "./lines.js";
 import { a as CollaborationClient, i as parseCollaborationDocumentId, n as buildCollaborationDocumentId, r as normalizeCollaborationPath, t as CollaborationFileBridge } from "./collaboration-DaWEv29D.js";
 import { i as parseLineApplicationResult, n as LINE_APPLICATION_REQUEST_MAX_BYTES, r as parseLineApplicationRequest, t as LINE_APPLICATION_REPLY_MAX_CHARS } from "./line-application-Cq6dJLBD.js";
-import { s as TangleSandboxClient } from "./tangle-B06VSOdG.js";
+import { s as TangleSandboxClient } from "./tangle-Ili8hE8y.js";
 import { SANDBOX_SIZE_PRESET_NAMES, agentProfileConfidentialSchema, agentProfileSchema } from "@tangle-network/agent-interface";
 import { z } from "zod";
 //#region src/confidential.ts

package/dist/{sandbox-uwsfBoYj.js → sandbox-Bg7l8Swk.js}

@@ -9229,13 +9229,14 @@ var DirectRuntimeHttpClient = class {
 		const directTimeoutMs = fetchOptions?.timeoutMs;
 		if (!init.signal && typeof directTimeoutMs === "number" && directTimeoutMs > 0) init.signal = AbortSignal.timeout(directTimeoutMs);
 		let response = await fetch(targetUrl, init);
-		if (response.status === 401 && this.onUnauthorized && !headers.has("x-no-retry")) {
+		if ((response.status === 401 || response.status === 403 && await isRefusedBearer(response)) && this.onUnauthorized && !headers.has("x-no-retry")) {
+			const refusedStatus = response.status;
 			await response.arrayBuffer().catch(() => void 0);
 			try {
 				await this.onUnauthorized();
 			} catch {
 				return new Response("", {
-					status: 401,
+					status: refusedStatus,
 					statusText: response.statusText
 				});
 			}
@@ -9254,6 +9255,18 @@ var DirectRuntimeHttpClient = class {
 		return rewrapResponse(response, responseHeaders);
 	}
 };
+/**
+* True when a 403 is the sidecar refusing the bearer itself, not a bearer
+* that lacks a capability. Reads a clone, so the caller keeps the body.
+*/
+async function isRefusedBearer(response) {
+	try {
+		const body = await response.clone().json();
+		return body.error?.code === "FORBIDDEN" && body.error.message === "Invalid authentication token";
+	} catch {
+		return false;
+	}
+}
 function quoteForShell(value) {
 	if (value.includes("\0")) throw new Error("Shell argument contains NUL byte");
 	return `'${value.replace(/'/g, "'\\''")}'`;

package/dist/tangle/index.js

@@ -1,2 +1,2 @@
-import { _ as SandboxCreateParamTypes, a as parseQuoteResponse, c as OperatorSession, d as JOB_SANDBOX_DELETE, f as TANGLE_CHAIN_ID, g as JsonResponseParamTypes, h as ITangleJobsAbi, i as jobQuoteDigest, l as OperatorSessionError, m as AgentSandboxBlueprintAbi, n as fetchQuote, o as validateQuote, p as TANGLE_JOBS_CONTRACT, r as inputsHashOf, s as TangleSandboxClient, t as QuoteError, u as JOB_SANDBOX_CREATE, v as SandboxCreateResponseParamTypes, y as SandboxIdParamTypes } from "../tangle-B06VSOdG.js";
+import { _ as SandboxCreateParamTypes, a as parseQuoteResponse, c as OperatorSession, d as JOB_SANDBOX_DELETE, f as TANGLE_CHAIN_ID, g as JsonResponseParamTypes, h as ITangleJobsAbi, i as jobQuoteDigest, l as OperatorSessionError, m as AgentSandboxBlueprintAbi, n as fetchQuote, o as validateQuote, p as TANGLE_JOBS_CONTRACT, r as inputsHashOf, s as TangleSandboxClient, t as QuoteError, u as JOB_SANDBOX_CREATE, v as SandboxCreateResponseParamTypes, y as SandboxIdParamTypes } from "../tangle-Ili8hE8y.js";
 export { AgentSandboxBlueprintAbi, ITangleJobsAbi, JOB_SANDBOX_CREATE, JOB_SANDBOX_DELETE, JsonResponseParamTypes, OperatorSession, OperatorSessionError, QuoteError, SandboxCreateParamTypes, SandboxCreateResponseParamTypes, SandboxIdParamTypes, TANGLE_CHAIN_ID, TANGLE_JOBS_CONTRACT, TangleSandboxClient, fetchQuote, inputsHashOf, jobQuoteDigest, parseQuoteResponse, validateQuote };

package/dist/{tangle-B06VSOdG.js → tangle-Ili8hE8y.js}

@@ -1,5 +1,5 @@
 import { x as readResponseJson } from "./errors-Cq4hMysQ.js";
-import { n as createSandboxInstanceFromResponse } from "./sandbox-uwsfBoYj.js";
+import { n as createSandboxInstanceFromResponse } from "./sandbox-Bg7l8Swk.js";
 import { _ as rotlBH, a as anumber, b as rotlSL, d as createXOFer, g as u32, h as toBytes$1, l as createHasher, m as swap32IfBE, n as abytes, o as aoutput, r as aexists, s as clean, t as Hash, v as rotlBL, x as split, y as rotlSH } from "./utils-B7_9Hl_z.js";
 //#region src/tangle/abi.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/sandbox",
-  "version": "0.60.41-develop.20261012074530.e978912",
+  "version": "0.60.41-develop.20261012103849.9009d74",
   "description": "Client SDK for the Tangle Sandbox platform - build AI agent applications with dev containers",
   "type": "module",
   "sideEffects": [
@@ -150,12 +150,12 @@
     "ws": "^8.20.0",
     "yjs": "13.6.30",
     "@products/sandbox-test-utils": "0.0.0",
-    "@tangle-network/agent-profile-materialize": "0.23.1",
-    "@repo/shared": "0.0.0",
+    "@tangle-network/runtime-contracts": "0.16.0",
     "@tangle-network/sdk": "4.0.3",
     "@tangle-network/cli-agent-registry": "0.6.2",
-    "@tangle-network/runtime-contracts": "0.16.0",
-    "@tangle-network/sse-core": "0.0.0"
+    "@tangle-network/sse-core": "0.0.0",
+    "@repo/shared": "0.0.0",
+    "@tangle-network/agent-profile-materialize": "0.23.1"
   },
   "scripts": {
     "build": "node scripts/build-dist.mjs",