@metamynd/agentsafe-signer 0.17.1 → 0.19.1

package/README.md

@@ -197,6 +197,26 @@ as the counterparty that executes for it. Rate limit: 120 per 10 s. Needs `@meta
   (`daemon-log-integrity.smoke.mjs`, above) — though it covers only the local hash-chain half of
   T11, not the external-anchoring half, which remains open per the bullet above.
 
+## Signed jurisdiction (`sign-authorize`, since 0.18.0)
+
+`sign-authorize` accepts an optional `jurisdiction` (two ASCII letters; the client normalises it to upper case and
+sends the same string). With it the daemon signs the v2 message (MAGP §8.3.12: the eight fields, `MAGP-AUTH-v2`, the
+jurisdiction) and **echoes** `jurisdiction` in its result; without it, the v1 message exactly as before and no echo.
+A malformed value is `DAEMON_MALFORMED_REQUEST` and nothing is signed. The echo is how a client tells this daemon
+from an older one, which ignores the field and would sign v1 for a request that is sent with it:
+`@metamynd/agentsafe-guard` ≥ 0.16.0 and `metamynd-client` ≥ 0.6.0 refuse such a daemon
+(`JURISDICTION_SIGNING_UNSUPPORTED`) rather than send a request the gate would reject. At the gate, a registered
+payee's country wins over the signed one (`JURISDICTION_MISMATCH`); the other refusals are `JURISDICTION_REQUIRED`
+and `JURISDICTION_NOT_ALLOWED`.
+
+## Context signature over the request as sent (`sign-envelope`, since 0.19.0)
+
+`sign-envelope` hashes the envelope (MAGP §8.3.13) over the fields **as the request sends them**: an omitted
+`currency` stays omitted (0.18.0 and earlier hashed it as `USD`) and an omitted `amount` is signed (they refused it), so
+the signature matches the gate's `envelopeHashFor` for a non-financial request too. agentsafe-guard ≥ 0.17.0 signs the
+context by default and checks the daemon's signature against the hash it sends: with an older daemon such a request is
+refused `CONTEXT_SIGNING_UNSUPPORTED` before it is sent (upgrade the daemon, or `signContext: false`).
+
 ## Hardening tiers — what a real host actually confirms (T3, T5)
 
 `daemon-hardening.smoke.mjs` checks the tier directives **from outside** the process, against the

package/daemon-client.mjs

@@ -45,17 +45,37 @@ export function daemonRequest(socketPath, op, params, { connectTimeoutMs = 3000
   return new Promise((resolve, reject) => {
     const deadline = Date.now() + connectTimeoutMs;
     let settled = false;
+    let inFlight = null;
     const overallTimer = setTimeout(() => {
       settled = true;
+      // Close the attempt still in flight. Left open, a connect that completes AFTER this timeout
+      // stayed connected, silently, holding the daemon's pipe instance — on the ONE-SHOT admin
+      // socket that is its only connection, so the caller's retry found the admin socket gone.
+      inFlight?.destroy();
       reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: timed out after ${connectTimeoutMs}ms`), { code: 'DAEMON_UNREACHABLE' }));
     }, connectTimeoutMs);
     function attempt() {
       if (settled) return;
       const sock = net.connect(toPlatformSocketPath(socketPath));
+      inFlight = sock;
       const requestId = crypto.randomUUID();
       let buf = '';
       const cleanup = () => sock.destroy();
+      let attemptOver = false; // this attempt already errored — its 'close' is not news
+      // The daemon side closing the connection before a full response line arrived used to go
+      // unnoticed (no 'close' handler), so the call sat until the overall timeout and then blamed
+      // reachability. Fail at once instead, and do NOT retry: a close with no response does not mean
+      // the request was not handled (windows-secure-pipe.mjs's one-shot close once dropped a
+      // generate-key response AFTER the daemon had rekeyed), so re-sending could run it twice.
+      sock.once('close', () => {
+        if (settled || attemptOver) return;
+        attemptOver = true;
+        settled = true;
+        clearTimeout(overallTimer);
+        reject(Object.assign(new Error(`agentsafe-signer daemon at ${socketPath} closed the connection before responding (the request may or may not have been handled)`), { code: 'DAEMON_CONNECTION_CLOSED' }));
+      });
       sock.once('error', (err) => {
+        attemptOver = true;
         cleanup();
         if (settled) return;
         if (err.code === 'ENOENT' && Date.now() < deadline) {
@@ -67,7 +87,10 @@ export function daemonRequest(socketPath, op, params, { connectTimeoutMs = 3000
         reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: ${err.message}`), { code: 'DAEMON_UNREACHABLE' }));
       });
       sock.once('connect', () => {
-        if (settled) return;
+        if (settled) {
+          sock.destroy();
+          return;
+        }
         sock.write(JSON.stringify({ protocolVersion: PROTOCOL_VERSION, requestId, op, params }) + '\n');
       });
       sock.on('data', (chunk) => {

package/daemon.mjs

@@ -300,12 +300,20 @@ export class SignerDaemon {
   #handleSignAuthorize(params = {}) {
     this.#assertRateLimit('sign-authorize');
     this.#validateCoreFields(params);
-    const { agentDid, action, amount, currency = 'USD', merchant, resource, nonce, issuedAt } = params;
+    const { agentDid, action, amount, currency = 'USD', merchant, resource, nonce, issuedAt, jurisdiction } = params;
+    // The signed jurisdiction (spec §8.3.12): present → the v2 message, absent → v1 exactly as before. Signed as the
+    // literal value given (the client normalises it and sends the same string), so it must be two ASCII letters — the
+    // shape the gate accepts. Echoed back so a client can tell this daemon from one that predates the field (which
+    // ignores it and signs v1): signed and sent must never differ.
+    if (jurisdiction !== undefined && (typeof jurisdiction !== 'string' || !/^[A-Za-z]{2}$/.test(jurisdiction))) {
+      throw new DaemonError('DAEMON_MALFORMED_REQUEST', 'jurisdiction must be an ISO 3166-1 alpha-2 code');
+    }
     // `resource` is the 8th canonical field (canonical.ts) — dropping it here (found live: it
     // was) means every request signed via this daemon silently omits it from the signature,
     // so the real gate's 8-field reconstruction never matches for any resource-bearing call.
-    const message = buildAuthMessage({ agentDid, action, amount, currency, merchant, resource, nonce, issuedAt });
-    return { signature: this.#sign(Buffer.from(message, 'utf8')) };
+    const message = buildAuthMessage({ agentDid, action, amount, currency, merchant, resource, nonce, issuedAt, ...(jurisdiction === undefined ? {} : { jurisdiction }) });
+    const signature = this.#sign(Buffer.from(message, 'utf8'));
+    return jurisdiction === undefined ? { signature } : { signature, jurisdiction };
   }
 
   /**
@@ -410,8 +418,11 @@ export class SignerDaemon {
 
   #handleSignEnvelope(params = {}) {
     this.#assertRateLimit('sign-envelope');
-    this.#validateCoreFields(params);
-    const { agentDid, action, amount, currency = 'USD', merchant, itinerary, trace, materiality, nonce, issuedAt } = params;
+    // The envelope hash is over the request AS SENT (MAGP §8.3.13): an omitted amount/currency stays omitted — no 0/'USD'
+    // default here (that default belongs to the authorize message only). Before signer 0.19.0 this refused an omitted
+    // amount and hashed an omitted currency as 'USD', so the gate refused the context signature.
+    this.#validateCoreFields({ ...params, amount: params.amount ?? 0 });
+    const { agentDid, action, amount, currency, merchant, itinerary, trace, materiality, nonce, issuedAt } = params;
     const hash = envelopeHashFor({ agentDid, action, amount, currency, merchant, itinerary, trace, materiality, nonce, issuedAt, signature: '' });
     return { envelopeSignature: this.#sign(Buffer.from(hash, 'utf8')) };
   }

package/migrate.mjs

@@ -30,6 +30,13 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs, daemonRequest } from './daemon-client.mjs';
 
+// The admin socket is ONE-SHOT: its first connection is its only one. On Windows each pipe is
+// built by a relay process (windows-secure-pipe.mjs, with bounded spawn retries), which under load
+// can take longer than daemonRequest's 3s default — and giving up early does not just fail this
+// call, it can spend the single connection, so a rerun finds the admin socket closed. Wait longer
+// here (still bounded) rather than burn the window; the signing socket keeps the default.
+const ADMIN_CONNECT_TIMEOUT_MS = 15_000;
+
 async function apiCall(apiUrl, method, urlPath, authToken, body) {
   const res = await fetch(new URL(urlPath, apiUrl), {
     method,
@@ -53,8 +60,8 @@ async function apiCall(apiUrl, method, urlPath, authToken, body) {
  * than assumed impossible). Returns the new DID and the exact restart command, rather than
  * hot-swapping the running daemon's identity itself — see this file's own header on why.
  */
-export async function runMigrate({ stateDir, socketPath, adminSocketPath, apiUrl, authToken, ref, networkIdentityId }) {
-  const { publicKeyHex } = await daemonRequest(adminSocketPath, 'generate-key', { allowRekey: true });
+export async function runMigrate({ stateDir, socketPath, adminSocketPath, apiUrl, authToken, ref, networkIdentityId, adminConnectTimeoutMs = ADMIN_CONNECT_TIMEOUT_MS }) {
+  const { publicKeyHex } = await daemonRequest(adminSocketPath, 'generate-key', { allowRekey: true }, { connectTimeoutMs: adminConnectTimeoutMs });
 
   const rotated = await apiCall(
     apiUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-signer",
-  "version": "0.17.1",
+  "version": "0.19.1",
   "description": "Local signer daemon for AgentSafe agent/service keys \u2014 the key never enters the calling guard's own process. See docs/design/agent-key-custody-local-signer-daemon-plan.md.",
   "type": "module",
   "main": "./daemon.mjs",
@@ -29,7 +29,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node daemon-protocol.smoke.mjs && node daemon-key-exfiltration.smoke.mjs && node kek-backends.smoke.mjs && node service-installer.smoke.mjs && node daemon-envelope-parity.smoke.mjs && node daemon-admin-socket.smoke.mjs && node daemon-log-integrity.smoke.mjs && node daemon-socket-permissions.smoke.mjs && node daemon-hardening.smoke.mjs && node daemon-hardening-tier2.smoke.mjs && node log-anchor.smoke.mjs && node migrate.smoke.mjs && node secure-memory.smoke.mjs",
+    "test": "node daemon-protocol.smoke.mjs && node daemon-key-exfiltration.smoke.mjs && node kek-backends.smoke.mjs && node service-installer.smoke.mjs && node daemon-envelope-parity.smoke.mjs && node daemon-jurisdiction.smoke.mjs && node daemon-admin-socket.smoke.mjs && node daemon-log-integrity.smoke.mjs && node daemon-socket-permissions.smoke.mjs && node daemon-hardening.smoke.mjs && node daemon-hardening-tier2.smoke.mjs && node log-anchor.smoke.mjs && node migrate.smoke.mjs && node secure-memory.smoke.mjs",
     "start": "node cli.mjs"
   },
   "dependencies": {

package/policy-core.mjs

@@ -411,6 +411,10 @@ function requiredContextFor(predicates) {
 
 // src/policy-core/standards-rules.ts
 var CONTEXT_UNVERIFIABLE = "CONTEXT_UNVERIFIABLE";
+var JURISDICTION_ATOM = "jurisdiction-not-allowed";
+function documentEnforcesJurisdiction(doc) {
+  return (doc?.molecules ?? []).some((m) => m?.decision !== "observe" && (m?.atoms ?? []).some((a) => a?.predicate === JURISDICTION_ATOM));
+}
 var PRECEDENCE = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5, decommission: 6 };
 function atomFires(atom, ctx) {
   const pred = ATOM_REGISTRY[atom.predicate];
@@ -489,7 +493,7 @@ function evaluateBoundStandards(standards, ctx) {
     const r = evaluateStandardRules(s.document?.molecules, ctx, s.standardKey);
     if (PRECEDENCE[r.decision] > PRECEDENCE[best.decision]) best = r;
   }
-  return best;
+  return standards.some((s) => documentEnforcesJurisdiction(s.document)) ? { ...best, jurisdictionRequired: true } : best;
 }
 function configValueValid(field, value) {
   switch (field.type) {
@@ -587,12 +591,17 @@ var REASON_BY_OPERAND = {
   "mm:counterparty": "COUNTERPARTY_NOT_ALLOWED"
 };
 var AMOUNT_OPERANDS = /* @__PURE__ */ new Set(["mm:payAmount", "mm:cumulativeSpend"]);
+var JURISDICTION_OPERANDS = /* @__PURE__ */ new Set(["mm:jurisdiction", "jurisdiction"]);
 function reasonFor(constraint, req) {
   if (!constraint) return "CONSTRAINT_FAILED";
   const { leftOperand } = constraint;
   if (AMOUNT_OPERANDS.has(leftOperand) && !Object.prototype.hasOwnProperty.call(req.values, leftOperand)) {
     return "AMOUNT_NOT_DETERMINABLE";
   }
+  if (JURISDICTION_OPERANDS.has(leftOperand)) {
+    const v = req.values[leftOperand];
+    return v === void 0 || v === null || v === "" ? "JURISDICTION_REQUIRED" : "JURISDICTION_NOT_ALLOWED";
+  }
   return REASON_BY_OPERAND[leftOperand] ?? `CONSTRAINT_FAILED:${leftOperand}`;
 }
 function constraintSatisfied(c, req, strict) {
@@ -703,11 +712,14 @@ function evaluate(input) {
 }
 
 // src/policy-core/canonical.ts
+var AUTH_MESSAGE_V2_TAG = "MAGP-AUTH-v2";
 function escapeField(v) {
   return v.replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
 }
 function buildAuthMessage(f) {
-  return [f.agentDid, f.action, f.amount, f.currency, f.merchant ?? "", f.resource ?? "", f.nonce, f.issuedAt].map((v) => escapeField(String(v))).join("|");
+  const v1 = [f.agentDid, f.action, f.amount, f.currency, f.merchant ?? "", f.resource ?? "", f.nonce, f.issuedAt];
+  const fields = f.jurisdiction === void 0 || f.jurisdiction === null ? v1 : [...v1, AUTH_MESSAGE_V2_TAG, f.jurisdiction];
+  return fields.map((v) => escapeField(String(v))).join("|");
 }
 function buildLegacyAuthMessageV1(f) {
   return [f.agentDid, f.action, f.amount, f.currency, f.merchant ?? "", f.nonce, f.issuedAt].map((v) => escapeField(String(v))).join("|");
@@ -768,8 +780,10 @@ export {
   ATOM_DEFAULT_REQUIRED_CONTEXT,
   ATOM_REGISTRY,
   ATOM_SPECS,
+  AUTH_MESSAGE_V2_TAG,
   CATALOGUED_ATOMS,
   CONTEXT_UNVERIFIABLE,
+  JURISDICTION_ATOM,
   MODES_BY_RANK,
   MODE_RANK,
   PROVENANCE_KEY,
@@ -789,6 +803,7 @@ export {
   buildRuleContext,
   canAuthorize,
   contextFieldProblem,
+  documentEnforcesJurisdiction,
   evaluate,
   evaluateBoundStandards,
   evaluateMandate,

package/windows-secure-pipe.mjs

@@ -36,6 +36,9 @@ const SPAWN_TIMEOUT_MS = 1500;
 // faster from the common case — the observed contention tends to clear within one or two
 // retries — while keeping a similar worst-case total bound.
 const MAX_SPAWN_ATTEMPTS = 8;
+// How long createSecurePipeOnce's close() lets a relay with a connected client drain its stdin to
+// the pipe and exit on its own before killing it anyway.
+const GRACEFUL_CLOSE_MS = 2000;
 
 function relayScript(pipeName, maxInstances) {
   return [
@@ -264,6 +267,7 @@ export function createSecurePipeOnce(pipeName, onConnection, { timeoutMs = 60_00
   let closed = false; // true once emitter.close() has been called, OR a terminal finish/fail happened
   let everReady = false; // true once 'aclVerified' has fired at least once, across any attempt
   let child = null;
+  let connectedChild = null; // the relay whose client connected (see emitter.close)
   let attempts = 0;
   const timer = setTimeout(() => emitter.close(), timeoutMs);
   emitter.closed = false; // readable synchronously by a caller that only gets `emitter` AFTER it
@@ -319,7 +323,10 @@ export function createSecurePipeOnce(pipeName, onConnection, { timeoutMs = 60_00
         clearTimeout(spawnTimer);
         emitter.emit('aclVerified', n);
       },
-      onConnected: () => onConnection(socketAdapter(child)),
+      onConnected: () => {
+        connectedChild = child;
+        onConnection(socketAdapter(child));
+      },
     });
 
     const onExit = () => {
@@ -356,6 +363,29 @@ export function createSecurePipeOnce(pipeName, onConnection, { timeoutMs = 60_00
   emitter.close = () => {
     if (closed) return;
     closed = true;
+    if (connectedChild === child) {
+      // A client is connected, and the caller (daemon.mjs's startAdminServer) closes right after
+      // writing that client's response into the relay's stdin. Killing the relay here raced its
+      // stdin->pipe copy: the response was often lost, so generate-key REKEYED the daemon while the
+      // client saw only a dropped connection (found chasing migrate.smoke's flake: CONNECTED, then
+      // "admin socket closed" 17ms later, no response). End stdin instead — the relay copies what is
+      // left, its CopyToAsync completes, it disposes the pipe and exits on its own, and that exit is
+      // what finish()es. The kill stays as a bounded fallback for a relay that does not exit.
+      try {
+        child.stdin.end();
+      } catch {
+        /* stdin already gone — the fallback below still bounds it */
+      }
+      const fallback = setTimeout(() => {
+        try {
+          child.kill();
+        } catch {
+          /* already exited */
+        }
+      }, GRACEFUL_CLOSE_MS);
+      fallback.unref?.();
+      return;
+    }
     try {
       child.kill();
     } catch {