@decidio/sdk 0.1.2 → 0.1.3

package/README.md

@@ -29,6 +29,16 @@ is sent), registers the agent, mints its **floor-limited API token** (it can req
 and nothing else — your workspace session never touches the agent's disk), and writes `.env`.
 Every later command reads `.env` from this directory automatically.
 
+What `.env` contains after a successful init: `DECIDIO_API_URL`, `DECIDIO_AGENT_ID`,
+`DECIDIO_AGENT_DID` + `DECIDIO_AGENT_KEY` (the local keypair — the key is what earns
+`application_confirmed` evidence later), `DECIDIO_API_TOKEN` (the floor-limited agent token),
+`DECIDIO_WORKSPACE_ID`, and `DECIDIO_WEBHOOK_SECRET` (operator deployments only). Pick any
+agent name — if it's already taken in your workspace, `init` stops cleanly and suggests a
+fresh one. Headless terminal (no prompts possible)? Export `DECIDIO_SESSION_TOKEN` first:
+request a sign-in link, then exchange its `?login=` value at `POST /demo/login-consume` — the
+response's `token` is your session token (the CLI prints these exact instructions when it
+can't prompt).
+
 **3. Protect one function** — save this as `quickstart.mjs`:
 
 ```js
@@ -77,7 +87,7 @@ becomes the record's execution evidence.
 
 ```bash
 npx @decidio/sdk receipt <decisionId>
-npx @decidio/verify decidio-receipt-<decisionId>.json
+npx --yes @decidio/verify decidio-receipt-<decisionId>.json
 ```
 
 The receipt is a W3C Verifiable Credential: the signature and content binding verify with no
@@ -88,12 +98,15 @@ record verify panel). One receipt proves itself; chain order across receipts is
 you pass several files at once.
 
 What the credential contains, honestly: the sealed **authority decision** — who decided, what
-was authorized, when, under which policy. It seals at decision time and is immutable, so
-execution evidence that arrives *after* the seal (your function's captured result) lives on the
-**record**, not inside the credential bytes: your Decidio record page shows the evidence tier
-(`application_confirmed` once the wrapper's signed report lands). Immutable seal + accruing
-evidence is the design, not an omission — corrections and later facts supersede, they never
-rewrite.
+was authorized, when, under which policy. It seals at decision time and is immutable — which is
+why the credential's own `confirmation.status` field reads `"pending"` forever. Execution
+evidence that arrives *after* the seal (your function's captured result) lives on the
+**record**, not inside the credential bytes: the `receipt` command prints the record's current
+tier next to the file, and with the signing key `init` wrote you'll see `application_confirmed`
+— the wrapper's report was cryptographically bound to your agent. (No signing key configured?
+The server caps the evidence at the weaker `agent_asserted`, and the SDK warns at confirm
+time.) Immutable seal + accruing evidence is the design, not an omission — corrections and
+later facts supersede, they never rewrite.
 
 **7. Prove a replay is rejected:**
 

package/dist/adapters/_gate.js

@@ -32,6 +32,9 @@ export async function gateConfirm(config, decisionId, result) {
         // Sign the confirm too (bound to {action:"confirm", scope:decisionId}) so the adapter path
         // earns application_confirmed; without a key the server caps it at agent_asserted.
         const requesterIdentity = signConfirm(decisionId, config);
+        // Same no-silent-downgrade rule as the inline wrap (guard equivalent-path catch).
+        if (!requesterIdentity)
+            console.warn(`[decidio] execution evidence for ${decisionId} recorded as agent_asserted — no signing key configured, so the report can't be proven to come from this agent. Set DECIDIO_AGENT_KEY/DID to earn application_confirmed.`);
         const res = await f(config.apiUrl.replace(/\/$/, "") + "/agent/confirm", {
             method: "POST",
             headers: { "content-type": "application/json", ...(config.apiToken ? { authorization: `Bearer ${config.apiToken}` } : {}) },

package/dist/cli.js

@@ -56,12 +56,15 @@ for (const [k, v] of Object.entries(readEnvFile())) {
         process.env[k] = v;
 }
 const API = (process.env.DECIDIO_API_URL ?? "http://localhost:4000").replace(/\/$/, "");
-const TOKEN = process.env.DECIDIO_API_TOKEN;
+// Token is read AT CALL TIME, not captured at import: init mints a fresh agent token mid-run and
+// its closing doctor must probe with THAT, not the pre-init env (round-3 Codex catch — the stale
+// capture made init's own doctor print "token: REJECTED" seconds after a successful mint).
+const TOKEN = () => process.env.DECIDIO_API_TOKEN;
 const ENV_PATH = ".env";
 const log = (...a) => console.log(...a);
 /** Fetch wrapper that turns transport failures into guidance instead of a stack trace. */
 async function api(path, init = {}, bearer) {
-    const auth = bearer ?? TOKEN;
+    const auth = bearer ?? TOKEN();
     let res;
     try {
         res = await fetch(API + path, { ...init, headers: { "content-type": "application/json", ...(auth ? { authorization: `Bearer ${auth}` } : {}), ...(init.headers ?? {}) } });
@@ -189,18 +192,24 @@ async function cmdInit(agentId) {
     }
     let did, privateKey;
     if (r.status === 409) {
-        // Already registered to a different (server-held) did. Reuse it; the local key we just
-        // minted does NOT match, so don't write it — the operator must supply the existing key.
+        // Already registered to a server-held did. WITHOUT the original private key on this machine
+        // this is a HARD STOP, not a degraded continue (round-3 Codex catch: init used to write a
+        // keyless .env and print happy-path next steps — every request then routed unproven and
+        // execution evidence silently capped at agent_asserted).
         did = r.body?.did;
-        log(`• "${agentId}" is already registered in this workspace (did ${did}) — reusing it.`);
-        if (sourceSystem)
-            log(`  Note: sourceSystem can't change on an existing agent — the registered lane stands. To use the "${sourceSystem}" lane, register a NEW name: npx @decidio/sdk init ${agentId}-${sourceSystem}`);
-        if (existingKey)
-            log(`  Your .env already carries a DECIDIO_AGENT_KEY; if it's this agent's original key, signing keeps working.`);
+        if (existingKey) {
+            log(`• "${agentId}" is already registered in this workspace (did ${did}) — reusing it with the DECIDIO_AGENT_KEY already in .env.`);
+            if (sourceSystem)
+                log(`  Note: sourceSystem can't change on an existing agent — the registered lane stands. To use the "${sourceSystem}" lane, register a NEW name.`);
+        }
         else {
-            log(`  ⚠ Its private key lives wherever this agent was FIRST initialized — keys never leave the machine that made them.`);
-            log(`  Either restore that DECIDIO_AGENT_KEY into .env, or start fresh under a new name:`);
-            log(`    npx @decidio/sdk init ${agentId}-2`);
+            const suggestion = `${agentId}-${randomBytes(2).toString("hex")}`;
+            log(`✘ "${agentId}" is already registered in this workspace, and its private key is not on this machine`);
+            log(`  (keys never leave the machine that generated them — likely a previous run, or another directory).`);
+            log(`  Nothing was written. Two ways forward:`);
+            log(`    1. Fresh agent (most common): npx @decidio/sdk init ${suggestion}`);
+            log(`    2. Reuse "${agentId}": restore its original DECIDIO_AGENT_KEY into .env here, then re-run init.`);
+            return 1;
         }
     }
     else if (r.status >= 200 && r.status < 300) {
@@ -218,7 +227,7 @@ async function cmdInit(agentId) {
     // without the tester-lab fence (plain local dev) the mint endpoint refuses; that's fine —
     // local dev auths with its existing env and we say so instead of failing the init.
     let agentToken, workspaceId;
-    const mintBearer = session ?? TOKEN;
+    const mintBearer = session ?? TOKEN();
     if (mintBearer) {
         const mint = await api("/api/workspace/agent-token", { method: "POST", body: JSON.stringify({ agentId, label: "sdk-cli" }) }, mintBearer);
         if (mint.status >= 200 && mint.status < 300 && mint.body?.token) {
@@ -248,6 +257,11 @@ async function cmdInit(agentId) {
     if (workspaceId)
         envOut.DECIDIO_WORKSPACE_ID = workspaceId;
     upsertEnv(envOut);
+    // The closing doctor (and anything else this process does) must see what init just wrote —
+    // OVERWRITE process.env with the fresh values (round-3 Codex catch: doctor probed with the
+    // stale pre-init token and reported the mint it just watched as REJECTED).
+    for (const [k, v] of Object.entries(envOut))
+        process.env[k] = v;
     log(`✔ wrote ${ENV_PATH} — every decidio command reads it from this directory (your script loads it with node --env-file=.env)`);
     ensureGitignore();
     if (privateKey)
@@ -274,7 +288,7 @@ async function cmdInit(agentId) {
     log("");
     log(`     node --env-file=.env quickstart.mjs      # routes to a human, prints the decision id, waits`);
     log(`     npx @decidio/sdk approvals               # (second terminal) see it pending`);
-    log(`     npx @decidio/sdk approvals approve <id>  # approve -> your function runs -> sealed`);
+    log(`     npx @decidio/sdk approvals approve <id>  # approve -> your function runs -> evidence recorded`);
     log("");
     return cmdDoctor();
 }
@@ -305,12 +319,13 @@ async function cmdDoctor() {
     else if (rec.status === 401) {
         // A 401 off the agent floor could also mean an INVALID token (Codex catch: don't
         // false-green expiry). Disambiguate with a floor probe: a valid agent token gets 404 for an
-        // unknown decision (authorized, not found); an invalid one gets 401 again.
+        // unknown decision (authorized, not found); an invalid one gets 401 again. A rejection here
+        // flips the overall verdict — "all green" after a red line was round 3's other doctor bug.
         const probe = await api("/agent/status/doctor-scope-probe");
         if (probe.status === 404)
             log("✔ token scope: agent floor — correct for the runtime SDK (approvals/receipt will ask you to sign in)");
         else if (probe.status === 401)
-            log("✘ token: REJECTED on the agent floor too — it's invalid or expired. Re-run `npx @decidio/sdk init` to mint a fresh one.");
+            line(false, "token: REJECTED on the agent floor too — it's invalid or expired. Re-run `npx @decidio/sdk init` to mint a fresh one.");
         else
             log(`⚠ token scope: agent-floor probe returned ${probe.status} — inconclusive`);
     }
@@ -322,6 +337,9 @@ async function cmdDoctor() {
 async function cmdApprovals(sub, id, reason) {
     // Approvals are a HUMAN act on the workspace — session scope, never the agent token. If the
     // env's token is agent-floor (401 on /api/*), sign in interactively; memory-only as always.
+    const jsonMode = sub === "--json";
+    if (jsonMode)
+        sub = undefined;
     let bearer;
     const probe = await api("/api/decisions/cards");
     if (probe.status === 401 || probe.status === 403) {
@@ -368,6 +386,11 @@ async function cmdApprovals(sub, id, reason) {
     }
     const cards = r.body?.cards ?? [];
     const pending = cards.filter((c) => c.isAgentRequest && c.status !== "sealed");
+    if (jsonMode) {
+        // Stable machine output (round-3 ask): agents scripting the queue parse this, not prose.
+        log(JSON.stringify(pending.map((c) => ({ decisionId: c.id, action: c.agentRequest?.action ?? null, amount: c.agentRequest?.amount ?? null, title: c.title ?? null })), null, 2));
+        return 0;
+    }
     if (!pending.length) {
         log("No pending agent approvals. Trigger one from your protected function, then re-run this.");
         return 0;

package/dist/index.js

@@ -190,6 +190,10 @@ export function withApproval(fn, describe, config) {
                 source: "wrapper", // the SDK captured the genuine response, not an agent self-report
                 ...(confirmIdentity ? { requesterIdentity: confirmIdentity } : {}),
             });
+            // An UNSIGNED confirm is server-capped at the weaker agent_asserted tier. Say so at the
+            // moment it happens — a silent evidence downgrade was round 3's acceptance FAIL.
+            if (!confirmIdentity)
+                console.warn(`[decidio] execution evidence for ${auth.decisionId} recorded as agent_asserted — no signing key configured, so the report can't be proven to come from this agent. Set DECIDIO_AGENT_KEY/DID (npx @decidio/sdk init writes them) to earn application_confirmed.`);
         }
         catch (e) {
             // surface but don't throw — the action already happened

package/dist/resume.js

@@ -110,6 +110,10 @@ async function confirm(cfg, decisionId, capturedResponse) {
     // Sign the confirm so the DURABLE/resume path can earn application_confirmed too (bound to
     // {action:"confirm", scope:decisionId}); without a key the server caps it at agent_asserted.
     const requesterIdentity = signConfirm(decisionId, cfg);
+    // Same no-silent-downgrade rule as the inline wrap (guard equivalent-path catch): the durable
+    // path is what production agents run, so it must disclose an agent_asserted cap too.
+    if (!requesterIdentity)
+        console.warn(`[decidio] execution evidence for ${decisionId} recorded as agent_asserted — no signing key configured, so the report can't be proven to come from this agent. Set DECIDIO_AGENT_KEY/DID to earn application_confirmed.`);
     await f(cfg.apiUrl.replace(/\/$/, "") + "/agent/confirm", {
         method: "POST",
         headers: { "content-type": "application/json", ...(cfg.apiToken ? { authorization: `Bearer ${cfg.apiToken}` } : {}) },

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.1.2
+  version: 0.1.3
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",