@metamynd/agentsafe-signer 0.18.0 → 0.19.2

package/README.md

@@ -209,6 +209,14 @@ from an older one, which ignores the field and would sign v1 for a request that
 payee's country wins over the signed one (`JURISDICTION_MISMATCH`); the other refusals are `JURISDICTION_REQUIRED`
 and `JURISDICTION_NOT_ALLOWED`.
 
+## Context signature over the request as sent (`sign-envelope`, since 0.19.0)
+
+`sign-envelope` hashes the envelope (MAGP §8.3.13) over the fields **as the request sends them**: an omitted
+`currency` stays omitted (0.18.0 and earlier hashed it as `USD`) and an omitted `amount` is signed (they refused it), so
+the signature matches the gate's `envelopeHashFor` for a non-financial request too. agentsafe-guard ≥ 0.17.0 signs the
+context by default and checks the daemon's signature against the hash it sends: with an older daemon such a request is
+refused `CONTEXT_SIGNING_UNSUPPORTED` before it is sent (upgrade the daemon, or `signContext: false`).
+
 ## Hardening tiers — what a real host actually confirms (T3, T5)
 
 `daemon-hardening.smoke.mjs` checks the tier directives **from outside** the process, against the

package/daemon-client.mjs

@@ -45,17 +45,37 @@ export function daemonRequest(socketPath, op, params, { connectTimeoutMs = 3000
   return new Promise((resolve, reject) => {
     const deadline = Date.now() + connectTimeoutMs;
     let settled = false;
+    let inFlight = null;
     const overallTimer = setTimeout(() => {
       settled = true;
+      // Close the attempt still in flight. Left open, a connect that completes AFTER this timeout
+      // stayed connected, silently, holding the daemon's pipe instance — on the ONE-SHOT admin
+      // socket that is its only connection, so the caller's retry found the admin socket gone.
+      inFlight?.destroy();
       reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: timed out after ${connectTimeoutMs}ms`), { code: 'DAEMON_UNREACHABLE' }));
     }, connectTimeoutMs);
     function attempt() {
       if (settled) return;
       const sock = net.connect(toPlatformSocketPath(socketPath));
+      inFlight = sock;
       const requestId = crypto.randomUUID();
       let buf = '';
       const cleanup = () => sock.destroy();
+      let attemptOver = false; // this attempt already errored — its 'close' is not news
+      // The daemon side closing the connection before a full response line arrived used to go
+      // unnoticed (no 'close' handler), so the call sat until the overall timeout and then blamed
+      // reachability. Fail at once instead, and do NOT retry: a close with no response does not mean
+      // the request was not handled (windows-secure-pipe.mjs's one-shot close once dropped a
+      // generate-key response AFTER the daemon had rekeyed), so re-sending could run it twice.
+      sock.once('close', () => {
+        if (settled || attemptOver) return;
+        attemptOver = true;
+        settled = true;
+        clearTimeout(overallTimer);
+        reject(Object.assign(new Error(`agentsafe-signer daemon at ${socketPath} closed the connection before responding (the request may or may not have been handled)`), { code: 'DAEMON_CONNECTION_CLOSED' }));
+      });
       sock.once('error', (err) => {
+        attemptOver = true;
         cleanup();
         if (settled) return;
         if (err.code === 'ENOENT' && Date.now() < deadline) {
@@ -67,7 +87,10 @@ export function daemonRequest(socketPath, op, params, { connectTimeoutMs = 3000
         reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: ${err.message}`), { code: 'DAEMON_UNREACHABLE' }));
       });
       sock.once('connect', () => {
-        if (settled) return;
+        if (settled) {
+          sock.destroy();
+          return;
+        }
         sock.write(JSON.stringify({ protocolVersion: PROTOCOL_VERSION, requestId, op, params }) + '\n');
       });
       sock.on('data', (chunk) => {

package/daemon.mjs

@@ -418,8 +418,11 @@ export class SignerDaemon {
 
   #handleSignEnvelope(params = {}) {
     this.#assertRateLimit('sign-envelope');
-    this.#validateCoreFields(params);
-    const { agentDid, action, amount, currency = 'USD', merchant, itinerary, trace, materiality, nonce, issuedAt } = params;
+    // The envelope hash is over the request AS SENT (MAGP §8.3.13): an omitted amount/currency stays omitted — no 0/'USD'
+    // default here (that default belongs to the authorize message only). Before signer 0.19.0 this refused an omitted
+    // amount and hashed an omitted currency as 'USD', so the gate refused the context signature.
+    this.#validateCoreFields({ ...params, amount: params.amount ?? 0 });
+    const { agentDid, action, amount, currency, merchant, itinerary, trace, materiality, nonce, issuedAt } = params;
     const hash = envelopeHashFor({ agentDid, action, amount, currency, merchant, itinerary, trace, materiality, nonce, issuedAt, signature: '' });
     return { envelopeSignature: this.#sign(Buffer.from(hash, 'utf8')) };
   }

package/migrate.mjs

@@ -30,6 +30,13 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs, daemonRequest } from './daemon-client.mjs';
 
+// The admin socket is ONE-SHOT: its first connection is its only one. On Windows each pipe is
+// built by a relay process (windows-secure-pipe.mjs, with bounded spawn retries), which under load
+// can take longer than daemonRequest's 3s default — and giving up early does not just fail this
+// call, it can spend the single connection, so a rerun finds the admin socket closed. Wait longer
+// here (still bounded) rather than burn the window; the signing socket keeps the default.
+const ADMIN_CONNECT_TIMEOUT_MS = 15_000;
+
 async function apiCall(apiUrl, method, urlPath, authToken, body) {
   const res = await fetch(new URL(urlPath, apiUrl), {
     method,
@@ -53,8 +60,8 @@ async function apiCall(apiUrl, method, urlPath, authToken, body) {
  * than assumed impossible). Returns the new DID and the exact restart command, rather than
  * hot-swapping the running daemon's identity itself — see this file's own header on why.
  */
-export async function runMigrate({ stateDir, socketPath, adminSocketPath, apiUrl, authToken, ref, networkIdentityId }) {
-  const { publicKeyHex } = await daemonRequest(adminSocketPath, 'generate-key', { allowRekey: true });
+export async function runMigrate({ stateDir, socketPath, adminSocketPath, apiUrl, authToken, ref, networkIdentityId, adminConnectTimeoutMs = ADMIN_CONNECT_TIMEOUT_MS }) {
+  const { publicKeyHex } = await daemonRequest(adminSocketPath, 'generate-key', { allowRekey: true }, { connectTimeoutMs: adminConnectTimeoutMs });
 
   const rotated = await apiCall(
     apiUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-signer",
-  "version": "0.18.0",
+  "version": "0.19.2",
   "description": "Local signer daemon for AgentSafe agent/service keys \u2014 the key never enters the calling guard's own process. See docs/design/agent-key-custody-local-signer-daemon-plan.md.",
   "type": "module",
   "main": "./daemon.mjs",

package/policy-core.mjs

@@ -409,6 +409,11 @@ function requiredContextFor(predicates) {
   return [...fields].sort();
 }
 
+// src/policy-core/own-entry.ts
+function ownEntry(table, key) {
+  return typeof key === "string" && Object.prototype.hasOwnProperty.call(table, key) ? table[key] : void 0;
+}
+
 // src/policy-core/standards-rules.ts
 var CONTEXT_UNVERIFIABLE = "CONTEXT_UNVERIFIABLE";
 var JURISDICTION_ATOM = "jurisdiction-not-allowed";
@@ -417,7 +422,7 @@ function documentEnforcesJurisdiction(doc) {
 }
 var PRECEDENCE = { allow: 0, observe: 1, escalate: 2, block: 3, suspend: 4, quarantine: 5, decommission: 6 };
 function atomFires(atom, ctx) {
-  const pred = ATOM_REGISTRY[atom.predicate];
+  const pred = ownEntry(ATOM_REGISTRY, atom.predicate);
   if (!pred) return false;
   try {
     return !!pred(ctx, atom.config);
@@ -554,7 +559,7 @@ function validateMolecules(molecules) {
       }
     }
     for (const a of m.atoms ?? []) {
-      if (!ATOM_REGISTRY[a.predicate]) {
+      if (!ownEntry(ATOM_REGISTRY, a.predicate)) {
         issues.push({ moleculeId: m.id, message: `unknown atom predicate '${a.predicate}'` });
         continue;
       }
@@ -602,10 +607,10 @@ function reasonFor(constraint, req) {
     const v = req.values[leftOperand];
     return v === void 0 || v === null || v === "" ? "JURISDICTION_REQUIRED" : "JURISDICTION_NOT_ALLOWED";
   }
-  return REASON_BY_OPERAND[leftOperand] ?? `CONSTRAINT_FAILED:${leftOperand}`;
+  return ownEntry(REASON_BY_OPERAND, leftOperand) ?? `CONSTRAINT_FAILED:${leftOperand}`;
 }
 function constraintSatisfied(c, req, strict) {
-  const op = OPERATORS[c.operator];
+  const op = ownEntry(OPERATORS, c.operator);
   if (!op) return false;
   const left = Object.prototype.hasOwnProperty.call(req.values, c.leftOperand) ? req.values[c.leftOperand] : void 0;
   if (!c.unit) return op(left, c.rightOperand);

package/windows-secure-pipe.mjs

@@ -36,6 +36,9 @@ const SPAWN_TIMEOUT_MS = 1500;
 // faster from the common case — the observed contention tends to clear within one or two
 // retries — while keeping a similar worst-case total bound.
 const MAX_SPAWN_ATTEMPTS = 8;
+// How long createSecurePipeOnce's close() lets a relay with a connected client drain its stdin to
+// the pipe and exit on its own before killing it anyway.
+const GRACEFUL_CLOSE_MS = 2000;
 
 function relayScript(pipeName, maxInstances) {
   return [
@@ -264,6 +267,7 @@ export function createSecurePipeOnce(pipeName, onConnection, { timeoutMs = 60_00
   let closed = false; // true once emitter.close() has been called, OR a terminal finish/fail happened
   let everReady = false; // true once 'aclVerified' has fired at least once, across any attempt
   let child = null;
+  let connectedChild = null; // the relay whose client connected (see emitter.close)
   let attempts = 0;
   const timer = setTimeout(() => emitter.close(), timeoutMs);
   emitter.closed = false; // readable synchronously by a caller that only gets `emitter` AFTER it
@@ -319,7 +323,10 @@ export function createSecurePipeOnce(pipeName, onConnection, { timeoutMs = 60_00
         clearTimeout(spawnTimer);
         emitter.emit('aclVerified', n);
       },
-      onConnected: () => onConnection(socketAdapter(child)),
+      onConnected: () => {
+        connectedChild = child;
+        onConnection(socketAdapter(child));
+      },
     });
 
     const onExit = () => {
@@ -356,6 +363,29 @@ export function createSecurePipeOnce(pipeName, onConnection, { timeoutMs = 60_00
   emitter.close = () => {
     if (closed) return;
     closed = true;
+    if (connectedChild === child) {
+      // A client is connected, and the caller (daemon.mjs's startAdminServer) closes right after
+      // writing that client's response into the relay's stdin. Killing the relay here raced its
+      // stdin->pipe copy: the response was often lost, so generate-key REKEYED the daemon while the
+      // client saw only a dropped connection (found chasing migrate.smoke's flake: CONNECTED, then
+      // "admin socket closed" 17ms later, no response). End stdin instead — the relay copies what is
+      // left, its CopyToAsync completes, it disposes the pipe and exits on its own, and that exit is
+      // what finish()es. The kill stays as a bounded fallback for a relay that does not exit.
+      try {
+        child.stdin.end();
+      } catch {
+        /* stdin already gone — the fallback below still bounds it */
+      }
+      const fallback = setTimeout(() => {
+        try {
+          child.kill();
+        } catch {
+          /* already exited */
+        }
+      }, GRACEFUL_CLOSE_MS);
+      fallback.unref?.();
+      return;
+    }
     try {
       child.kill();
     } catch {