@suveren/gateway 0.18.0 → 0.18.2

package/bin/suveren-gateway.js

@@ -15,7 +15,7 @@ import { createConnection } from 'node:net';
 import { existsSync, mkdirSync, openSync, readFileSync, writeFileSync, unlinkSync, statSync } from 'node:fs';
 import { homedir, platform, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { buildLaunchAgentPlist, buildMacLauncher, buildSystemdUnit, buildWindowsTaskXml } from '../lib/autostart-templates.mjs';
 import { DEFAULT_AS_URL, readConfig, writeConfig, validateAsUrl, validateCaFile, validateProxyUrl, validatePinTls, resolveAsUrl, resolvePinTls, resolvePinTlsExpectedFingerprint, resolveSimulation } from '../lib/config.mjs';
 import { createInterface } from 'node:readline/promises';
@@ -1362,6 +1362,27 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
+/**
+ * `suveren-gateway verify-report <file> [--key <hex>] [--online]` — offline
+ * verification of an "Export with proof" report file (work-plan R6).
+ * Delegates entirely to the compiled `dist/mcp-server/report-verify-cli.mjs`
+ * (built from apps/mcp-server's OWN tsup entry, next to dist/mcp-server/
+ * http.mjs) — this script never reimplements the signature-checking logic.
+ * Exit codes are documented there (`--help`): 0 valid+key confirmed,
+ * 1 invalid, 2 valid but key unconfirmed.
+ */
+async function verifyReport(args) {
+  const modPath = join(PKG_ROOT, 'dist', 'mcp-server', 'report-verify-cli.mjs');
+  if (!existsSync(modPath)) {
+    console.error(`verify-report is unavailable: ${modPath} not found.`);
+    console.error('This checkout has no built mcp-server bundle — install the published package, or build one first.');
+    process.exitCode = 1;
+    return;
+  }
+  const mod = await import(pathToFileURL(modPath).href);
+  process.exitCode = await mod.runVerifyReportCli(args);
+}
+
 function printHelp() {
   console.log(`suveren-gateway — Suveren gateway (Human Agency Protocol)
 
@@ -1388,6 +1409,9 @@ Usage:
   suveren-gateway config set pin-tls off      Stop enforcing the TLS certificate pin
   suveren-gateway simulation on|off|status    Block (or unblock) every real system
                                               (see \`suveren-gateway simulation help\`)
+  suveren-gateway verify-report <file> [--key <hex>] [--online]
+                                              Verify an "Export with proof" report file offline
+                                              (see \`suveren-gateway verify-report --help\`)
   suveren-gateway help                        Print this help
 
 Environment:
@@ -1426,6 +1450,7 @@ async function main() {
     case 'service': await service(argv.slice(1)); break;
     case 'config':  await config(argv.slice(1)); break;
     case 'simulation': await simulation(argv.slice(1)); break;
+    case 'verify-report': await verifyReport(argv.slice(1)); break;
     case 'help':
     case '--help':
     case '-h':

package/content/guides/3-mandates.md

@@ -21,6 +21,7 @@ Apply this to whatever systems are connected: the header above lists each system
 - **Limits come from the interview:** amounts, discounts, daily counts, allowed recipients. Do not invent them; ask.
 - **Intent:** write why, goal and watch-outs in the person's words, in the language the team uses. It is signed with the mandate and the working AI follows it.
 - **Teams:** in a team, the person must be an approver for the profile. `create_mandate` refuses at once if not; tell the person who can fix it (a team admin).
+- **Workspace:** without `team`, a mandate goes where the person's Delegation mandate is. If they hold Delegation mandates in several workspaces, ask which one and pass it (`team`: a team's name, or `"personal"`).
 - **Reporting:** never propose a `reporting` mandate for the working AI during a run (see **risks**).
 
 ## Example (only an example)

package/dist/control-plane/index.mjs

@@ -549,6 +549,56 @@ async function getLocalEvidence() {
   if (!res.ok) throw new Error(`Failed to fetch local evidence: ${res.status}`);
   return res.json();
 }
+var McpLockedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpLockedError";
+  }
+};
+async function reportRequest(path, init) {
+  const res = await fetch(`${MCP_BASE}${path}`, { ...init, headers: internalHeaders() });
+  if (res.status === 503) {
+    const err = await res.json().catch(() => ({ error: "Vault locked" }));
+    throw new McpLockedError(err.error ?? "Vault locked");
+  }
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({ error: "Unknown error" }));
+    throw new Error(err.error ?? `Request to ${path} failed: ${res.status}`);
+  }
+  return res.json();
+}
+async function getReport() {
+  return reportRequest("/internal/report");
+}
+async function saveReport(html) {
+  return reportRequest("/internal/report", {
+    method: "POST",
+    body: JSON.stringify({ html })
+  });
+}
+async function recheckReport() {
+  return reportRequest("/internal/report/recheck", { method: "POST" });
+}
+async function exportReport(gatewayVersion) {
+  const res = await fetch(`${MCP_BASE}/internal/report/export?gatewayVersion=${encodeURIComponent(gatewayVersion)}`, {
+    headers: internalHeaders()
+  });
+  if (res.status === 503) {
+    const err = await res.json().catch(() => ({ error: "Vault locked" }));
+    throw new McpLockedError(err.error ?? "Vault locked");
+  }
+  if (res.status === 404) {
+    const err = await res.json().catch(() => ({ error: "No report to export" }));
+    throw new Error(err.error ?? "No report to export");
+  }
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({ error: `Export failed: ${res.status}` }));
+    throw new Error(err.error ?? `Export failed: ${res.status}`);
+  }
+  const html = await res.text();
+  const filename = /filename="([^"]+)"/.exec(res.headers.get("content-disposition") ?? "")?.[1] ?? "suveren-report.html";
+  return { html, filename };
+}
 async function getMcpHealth() {
   const res = await fetch(`${MCP_BASE}/health`);
   if (!res.ok) throw new Error("MCP server unreachable");
@@ -3431,10 +3481,68 @@ function createEvidenceRouter() {
   return router;
 }
 
-// src/routes/decrypt-intent.ts
+// src/routes/report.ts
 import { Router as Router11 } from "express";
-function createDecryptIntentRouter(vault2) {
+function handleError(res, err) {
+  if (err instanceof McpLockedError) {
+    res.status(503).json({ error: err.message });
+    return;
+  }
+  res.status(502).json({
+    error: "Report unavailable",
+    detail: err instanceof Error ? err.message : String(err)
+  });
+}
+function createReportRouter(getGatewayVersion) {
   const router = Router11();
+  router.get("/", async (_req, res) => {
+    try {
+      res.json(await getReport());
+    } catch (err) {
+      handleError(res, err);
+    }
+  });
+  router.post("/", async (req, res) => {
+    const html = req.body?.html;
+    if (typeof html !== "string" || !html.trim()) {
+      res.status(400).json({ error: "Missing required field: html (non-empty string)" });
+      return;
+    }
+    try {
+      res.json(await saveReport(html));
+    } catch (err) {
+      handleError(res, err);
+    }
+  });
+  router.post("/recheck", async (_req, res) => {
+    try {
+      res.json(await recheckReport());
+    } catch (err) {
+      handleError(res, err);
+    }
+  });
+  router.get("/export", async (_req, res) => {
+    try {
+      const { html, filename } = await exportReport(getGatewayVersion());
+      res.setHeader("Content-Type", "text/html; charset=utf-8").setHeader("Content-Disposition", `attachment; filename="${filename}"`).setHeader("Cache-Control", "no-store").send(html);
+    } catch (err) {
+      if (err instanceof McpLockedError) {
+        res.status(503).json({ error: err.message });
+        return;
+      }
+      res.status(502).json({
+        error: "Export failed",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  return router;
+}
+
+// src/routes/decrypt-intent.ts
+import { Router as Router12 } from "express";
+function createDecryptIntentRouter(vault2) {
+  const router = Router12();
   router.post("/", async (req, res) => {
     const { intentCiphertext, encryptedKey, approverId } = req.body;
     if (typeof intentCiphertext !== "string" || intentCiphertext.length === 0) {
@@ -3610,7 +3718,7 @@ data: ${data}
 }
 
 // src/routes/gateway-settings.ts
-import { Router as Router12 } from "express";
+import { Router as Router13 } from "express";
 
 // src/lib/gateway-settings.ts
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6 } from "fs";
@@ -3646,7 +3754,7 @@ function writeSettings(patch, dataDir) {
 
 // src/routes/gateway-settings.ts
 function createGatewaySettingsRouter() {
-  const router = Router12();
+  const router = Router13();
   router.get("/", (_req, res) => {
     res.json(readSettings());
   });
@@ -3669,7 +3777,7 @@ function createGatewaySettingsRouter() {
 }
 
 // src/routes/archived-mandates.ts
-import { Router as Router13 } from "express";
+import { Router as Router14 } from "express";
 
 // src/lib/archived-mandates-store.ts
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync } from "fs";
@@ -3712,7 +3820,7 @@ function unarchiveMandate(id, dataDir) {
 
 // src/routes/archived-mandates.ts
 function createArchivedMandatesRouter(dataDir) {
-  const router = Router13();
+  const router = Router14();
   router.get("/", (_req, res) => {
     res.json({ archived: readArchived(dataDir) });
   });
@@ -3734,7 +3842,7 @@ function createArchivedMandatesRouter(dataDir) {
 }
 
 // src/routes/internal-events.ts
-import { Router as Router14 } from "express";
+import { Router as Router15 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 var SESSION_EXPIRED = "session-expired";
@@ -3749,7 +3857,7 @@ function secretMatches(provided, expected) {
   return timingSafeEqual2(a, b);
 }
 function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch, onAsTlsMismatch) {
-  const router = Router14();
+  const router = Router15();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
@@ -3783,7 +3891,7 @@ function createInternalEventsRouter(getSecret, onSessionExpired, onAsKeyMismatch
 }
 
 // src/routes/internal-mandate.ts
-import { Router as Router15 } from "express";
+import { Router as Router16 } from "express";
 import { timingSafeEqual as timingSafeEqual3, randomUUID } from "crypto";
 
 // src/lib/mandate-ceremony.ts
@@ -3832,13 +3940,24 @@ function approverPubkeys(body) {
   if (!map || typeof map !== "object" || Array.isArray(map)) return [];
   return Object.entries(map).filter((e) => typeof e[1] === "string" && e[1].length > 0).map(([userId, publicKey]) => ({ userId, publicKey }));
 }
+async function delegationWorkspace(deps, groups) {
+  const personal = groups.find((g) => g.isPersonal);
+  const mine = await deps.as("GET", "/api/attestations/mine?status=active");
+  const rows = mine.status === 200 ? mine.body?.attestations ?? [] : [];
+  const ids = new Set(rows.filter((r) => r.profileId && shortOf(r.profileId) === "delegation" && r.groupId).map((r) => r.groupId));
+  const found = groups.filter((g) => ids.has(g.id));
+  if (found.length === 0) return personal;
+  if (found.length === 1) return found[0];
+  const names = found.map((g) => g.isPersonal ? "the personal workspace" : `"${g.name}"`).join(", ");
+  refuse(`Delegation mandates exist in several workspaces (${names}): say which in \`team\` \u2014 a team's name, or "personal".`);
+}
 async function planMandate(req, deps) {
   const user = deps.user;
   if (!user) refuse("The gateway is not signed in.");
   const groupsRes = await deps.as("GET", "/api/groups");
   const groups = groupsRes.body?.groups ?? [];
-  const group = req.team ? groups.find((g) => !g.isPersonal && (g.id === req.team || g.name === req.team)) : groups.find((g) => g.isPersonal);
-  if (!group) refuse(req.team ? `You are not a member of a team "${req.team}".` : "No personal workspace found.");
+  const group = req.team === "personal" ? groups.find((g) => g.isPersonal) : req.team ? groups.find((g) => !g.isPersonal && (g.id === req.team || g.name === req.team)) : await delegationWorkspace(deps, groups);
+  if (!group) refuse(req.team && req.team !== "personal" ? `You are not a member of a team "${req.team}".` : "No personal workspace found.");
   const isPersonal = !!group.isPersonal;
   const profile = await resolveProfile(deps.as, req.profile);
   const name = profile.name ?? shortOf(profile.id);
@@ -3945,7 +4064,7 @@ function secretMatches2(provided, expected) {
   return a.length === b.length && timingSafeEqual3(a, b);
 }
 function createInternalMandateRouter(getSecret, deps) {
-  const router = Router15();
+  const router = Router16();
   router.post("/mandate", async (req, res) => {
     if (!secretMatches2(req.header("X-Internal-Secret") ?? void 0, getSecret())) {
       res.status(401).json({ error: "unauthorized" });
@@ -4530,6 +4649,7 @@ app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesR
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
 app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL, vault, DATA_DIR, lockAsTlsMismatch));
 app.use("/api/evidence", authGuard, createEvidenceRouter());
+app.use("/api/report", jsonParser, authGuard, createReportRouter(() => RUNNING_VERSION));
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
 app.put("/integrations/:id/read-policy", jsonParser, authGuard, async (req, res) => {