@tokamak-private-dapps/private-state-cli 2.3.3 → 2.3.4

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 2.3.4 - 2026-05-29
+
+- Removed the implicit wallet proof context recovery path so proof-backed wallet commands require
+  their channel context to be prepared before proof generation.
+- Added a post-proof, pre-submit channel root check for proof-backed channel state updates so stale
+  proofs are rejected before submitting transactions whenever the root changed during proof generation.
+
 ## 2.3.3 - 2026-05-27
 
 - Changed `help observer` and monitoring references to use the public observer URL

package/lib/runtime.mjs

@@ -4909,6 +4909,7 @@ async function handleGrothVaultMove({ args, provider, direction }) {
   });
 
   const methodName = direction === "deposit" ? "depositToChannelVault" : "withdrawFromChannelVault";
+  await assertWorkspaceAlignedWithChain(context);
   emitProgress(operationName, "submitting");
   const receipt = await waitForReceipt(
     await bridgeTokenVault[methodName](ethers.toBigInt(context.workspace.channelId), transition.proof, transition.update),
@@ -7639,7 +7640,7 @@ async function executeWalletDirectTemplateCommand({
   provider,
   operationName,
   templatePayload,
-  preparedContextResult = null,
+  preparedContextResult,
 }) {
   emitProgress(operationName, "loading");
   const { signer, l2Identity } = restoreWalletParticipant(wallet, provider);
@@ -7653,11 +7654,8 @@ async function executeWalletDirectTemplateCommand({
     ownerSigner: signer,
     provider,
   });
-  const contextResult = preparedContextResult ?? await loadFreshWalletChannelContext({
-    walletContext: wallet,
-    provider,
-    progressAction: operationName,
-  });
+  expect(preparedContextResult?.context, "Internal error: prepared channel context is required before proof generation.");
+  const contextResult = preparedContextResult;
   const execution = await executeWalletTemplateSend({
     wallet,
     signer,
@@ -7755,6 +7753,7 @@ async function executeWalletTemplateSend({
     "Generated Tokamak proof does not match the channel aPubBlockHash. Check the workspace block_info.json context.",
   );
 
+  await assertWorkspaceAlignedWithChain(context);
   emitProgress(operationName, "submitting");
   const receipt =
     await waitForReceipt(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokamak-private-dapps/private-state-cli",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "description": "Command-line client for the Tokamak private-state DApp.",
   "license": "MIT OR Apache-2.0",
   "author": "Tokamak Network",