@prismnetwork/agent-sdk - npm Package Compare versions

Comparing version 0.7.0 to 0.7.1

attest.mjs

@@ -722,7 +722,9 @@ // Agent-side verification of a confidential generation: the checks an agent
   // whose quote carried our nonce. The plaintext key-set field the same
-  // response supplies is a label, not a binding.
-  if (report.workload_keyset_digest !== digest) {
-    const named = report.workload_keyset_digest;
-    return t.fail("gpu-binding", `the GPU evidence names key set ${named}, not the one that served us`);
-  }
+  // response supplies is a label, not a binding, so a label that disagrees is
+  // reported and then ignored: the evidence endpoint is served by one replica
+  // and completions by another, so the label routinely names a sibling even
+  // when the quotes below prove the evidence came from the TD that served us.
+  // Failing on it here would reject evidence that binds cryptographically.
+  const labelled = report.workload_keyset_digest;
+  const mislabelled = labelled !== digest;
   if (typeof report.intel_quote !== "string") {
@@ -748,6 +750,7 @@ return t.fail("gpu-binding", "the GPU evidence carries no CPU quote to bind against");
   });
+  const aside = mislabelled ? `; the evidence labels itself key set ${labelled}, which the quotes above override` : "";
   t.add(
     "gpu-binding",
     gate.ok ? "pass" : "fail",
-    gate.ok ? `${gate.detail}, quoted by the TD that carried our nonce` : gate.detail,
+    gate.ok ? `${gate.detail}, quoted by the TD that carried our nonce${aside}` : gate.detail,
   );
@@ -754,0 +757,0 @@ }

package.json

 {
   "name": "@prismnetwork/agent-sdk",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Headless GPU leasing and renter-encrypted storage on Prism Network for wallet-holding agents.",
@@ -72,7 +72,7 @@ "type": "module",
     "type": "git",
-    "url": "git+https://github.com/prismnetwork-tech/prism.git",
+    "url": "git+https://github.com/winter0x/prism.git",
     "directory": "sdk"
   },
   "bugs": {
-    "url": "https://github.com/prismnetwork-tech/prism/issues"
+    "url": "https://github.com/winter0x/prism/issues"
   },
@@ -79,0 +79,0 @@ "license": "Apache-2.0",

README.md

@@ -153,2 +153,2 @@ # @prismnetwork/agent-sdk
 
-See [example.mjs](https://github.com/prismnetwork-tech/prism/blob/main/sdk/example.mjs) for a full run.
+See [example.mjs](https://github.com/winter0x/prism/blob/main/sdk/example.mjs) for a full run.

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

No bug tracker

Maintenance

Package does not have a linked bug tracker in package.json.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

No bug tracker

Maintenance

Package does not have a linked bug tracker in package.json.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

198847

0.16%

Lines of code

3648

0.08%

No dependency changes