@suveren/gateway 0.19.1 → 0.19.3

package/dist/mcp-server/http.mjs

@@ -4158,6 +4158,13 @@ function buildMandateBrief(opts) {
     }
     lines.push("");
   }
+  if (isSimulationMode()) {
+    const canSetUp = active.some((a) => shortProfileName(a.profileId) === "delegation");
+    lines.push("=== GETTING STARTED ===");
+    lines.push("");
+    lines.push(canSetUp ? "If the person asks how to start with Suveren or how to set up their work with it: call setup__get_guide first and follow its steps in order." : `If the person asks how to start with Suveren: they first create a "Delegation" mandate in the Suveren Gateway at ${uiUrl()}. With it you can read the setup guide and lead them through the setup.`);
+    lines.push("");
+  }
   lines.push("When you receive a task, call list-authorizations(domain) to load full details for the relevant domain.");
   return lines.join("\n");
 }
@@ -4947,6 +4954,54 @@ function createMcpServer(state2, integrationManager2) {
   return { server, gatekeeper: state2.gatekeeper, refreshTools, registerProxiedTools };
 }
 
+// src/lib/agent-contact.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync13, renameSync as renameSync4, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname10, join as join12 } from "path";
+var FILE = "agent-contact.json";
+var REWRITE_AFTER_MS = 6e4;
+var AgentContactStore = class {
+  path;
+  current;
+  constructor(dataDir2) {
+    this.path = join12(dataDir2, FILE);
+    this.current = this.load();
+  }
+  load() {
+    if (!existsSync12(this.path)) return null;
+    try {
+      const v = JSON.parse(readFileSync13(this.path, "utf8"));
+      if (typeof v.clientName !== "string" || typeof v.firstSeenAt !== "string" || typeof v.lastSeenAt !== "string") return null;
+      return { clientName: v.clientName, clientVersion: v.clientVersion, firstSeenAt: v.firstSeenAt, lastSeenAt: v.lastSeenAt };
+    } catch {
+      return null;
+    }
+  }
+  read() {
+    return this.current;
+  }
+  /** Record a completed MCP initialize. `now` is injectable for tests. */
+  record(client, now = /* @__PURE__ */ new Date()) {
+    const clientName = client?.name?.trim() || "Unknown AI client";
+    const prev = this.current;
+    const due = !prev || prev.clientName !== clientName || now.getTime() - Date.parse(prev.lastSeenAt) >= REWRITE_AFTER_MS;
+    this.current = {
+      clientName,
+      clientVersion: client?.version,
+      firstSeenAt: prev?.firstSeenAt ?? now.toISOString(),
+      lastSeenAt: now.toISOString()
+    };
+    if (!due) return;
+    try {
+      mkdirSync10(dirname10(this.path), { recursive: true });
+      const tmp = `${this.path}.tmp`;
+      writeFileSync10(tmp, JSON.stringify(this.current, null, 2));
+      renameSync4(tmp, this.path);
+    } catch (err) {
+      console.error("[Suveren MCP] Could not save agent contact:", err);
+    }
+  }
+};
+
 // src/lib/gate-content.ts
 import { computeIntentHash } from "@hap/core";
 import { decodeAttestationBlob as decodeAttestationBlob2 } from "@hap/core";
@@ -4974,16 +5029,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync12 } from "fs";
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11, existsSync as existsSync13 } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname10, join as join12 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
+import { dirname as dirname11, join as join13 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir2) {
     const dir = dataDir2 ?? DEFAULT_DATA_DIR;
-    this.filePath = join12(dir, "integrations.json");
+    this.filePath = join13(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -5014,12 +5069,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync12(this.filePath)) {
-      mkdirSync10(dirname10(this.filePath), { recursive: true });
+    if (!existsSync13(this.filePath)) {
+      mkdirSync11(dirname11(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync13(this.filePath, "utf-8");
+      const raw = readFileSync14(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -5048,23 +5103,23 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync10(dirname10(this.filePath), { recursive: true });
-    writeFileSync10(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync11(dirname11(this.filePath), { recursive: true });
+    writeFileSync11(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
 import { homedir as homedir10 } from "os";
-import { join as join14, delimiter } from "path";
-import { existsSync as existsSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync15, rmSync } from "fs";
+import { join as join15, delimiter } from "path";
+import { existsSync as existsSync15, writeFileSync as writeFileSync12, mkdirSync as mkdirSync12, readFileSync as readFileSync16, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync14, existsSync as existsSync13 } from "fs";
-import { join as join13, resolve } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join14, resolve } from "path";
 var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 function isExactSemver(value) {
   return typeof value === "string" && EXACT_SEMVER_RE.test(value);
@@ -5082,25 +5137,25 @@ function invalidNpmPinReason(manifest) {
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join13(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join13(dir, "index.json");
-  if (!existsSync13(indexPath)) {
+  const indexPath = join14(dir, "index.json");
+  if (!existsSync14(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync14(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join13(dir, relativePath);
+    const manifestPath = join14(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync14(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
       const pinReason = invalidNpmPinReason(manifest);
       if (pinReason) {
         console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${pinReason}`);
@@ -5192,9 +5247,63 @@ function safeHost(url) {
   }
 }
 
+// src/lib/connector-env.ts
+var RUNTIME_VARS = [
+  // POSIX
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_RUNTIME_DIR",
+  // Windows (names are case-insensitive there; matched case-insensitively below)
+  "APPDATA",
+  "LOCALAPPDATA",
+  "USERPROFILE",
+  "USERNAME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "TEMP",
+  "TMP",
+  "PROGRAMFILES",
+  "PROGRAMFILES(X86)",
+  "PROGRAMDATA",
+  "PROCESSOR_ARCHITECTURE",
+  "NUMBER_OF_PROCESSORS"
+];
+var NETWORK_VARS = [
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE"
+];
+function inheritedConnectorEnv(parent, passEnv = []) {
+  const allowed = new Set([...RUNTIME_VARS, ...NETWORK_VARS, ...passEnv].map((n) => n.toUpperCase()));
+  const out = {};
+  for (const [name, value] of Object.entries(parent)) {
+    if (value === void 0) continue;
+    if (allowed.has(name.toUpperCase())) out[name] = value;
+  }
+  return out;
+}
+
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir10(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join14(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join15(homedir10(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join15(DEFAULT_DATA_DIR2, "integrations");
 var OFFLINE_MODE = process.env.SUVEREN_OFFLINE === "1";
 var installLock = Promise.resolve();
 function withInstallLock(task) {
@@ -5202,7 +5311,7 @@ function withInstallLock(task) {
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join14(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join15(INTEGRATIONS_DIR, "node_modules", ".bin");
 function getIntegrationsBinDir() {
   return INTEGRATIONS_BIN;
 }
@@ -5211,12 +5320,12 @@ function buildPath() {
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync14(INTEGRATIONS_DIR)) {
-    mkdirSync11(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync15(INTEGRATIONS_DIR)) {
+    mkdirSync12(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join14(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync14(pkgPath)) {
-    writeFileSync11(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join15(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync15(pkgPath)) {
+    writeFileSync12(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -5305,19 +5414,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join14(pkgDir, "package.json");
-    if (!existsSync14(pkgDir) || !existsSync14(pkgJson)) return false;
+    const pkgDir = join15(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join15(pkgDir, "package.json");
+    if (!existsSync15(pkgDir) || !existsSync15(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync16(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync14(join14(pkgDir, target))) return false;
+        if (!existsSync15(join15(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync14(join14(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync15(join15(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -5332,9 +5441,9 @@ var IntegrationManager = class {
    */
   readInstalledVersion(npmPackage) {
     if (!this.isUsableInstall(npmPackage)) return null;
-    const pkgJson = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
+    const pkgJson = join15(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
     try {
-      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync16(pkgJson, "utf8"));
       return typeof pkg.version === "string" ? pkg.version : null;
     } catch {
       return null;
@@ -5348,7 +5457,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync14(join14(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync15(join15(INTEGRATIONS_BIN, c)));
   }
   /**
    * The exact version THIS gateway's CURRENTLY LOADED manifest pins
@@ -5438,8 +5547,8 @@ var IntegrationManager = class {
    * nothing at all.
    */
   async installNow(npmPackage, exactVersion, cleanFirst = true) {
-    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (cleanFirst && existsSync14(pkgDir)) {
+    const pkgDir = join15(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (cleanFirst && existsSync15(pkgDir)) {
       console.error(`[IntegrationManager] Removing ${exactVersion ? "outdated" : "unusable"} install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -5585,7 +5694,8 @@ var IntegrationManager = class {
         if (envVar) env[envVar] = "simulation";
       }
     }
-    const interpolate = (s) => s.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? process.env[name] ?? "");
+    const inherited = inheritedConnectorEnv(process.env, getManifest(config.id)?.mcp.passEnv);
+    const interpolate = (s) => s.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? inherited[name] ?? "");
     const args = config.args.map(interpolate);
     const remote = remotePreflightTarget(config.command, args);
     if (remote) {
@@ -5595,13 +5705,13 @@ var IntegrationManager = class {
     const transport = new StdioClientTransport({
       command: config.command,
       args,
-      // `...process.env` is also how a saved `--ca-file` reaches an
-      // integration: NODE_EXTRA_CA_CERTS (read by Node only at process
-      // start) is already set on THIS process by bundle/server.js before
-      // the MCP server ever starts, so every integration this manager spawns
-      // inherits it here for free — no separate handling needed.
+      // Only an allowlist of the gateway's environment — never its own
+      // secrets (connector-env.ts). The allowlist includes
+      // NODE_EXTRA_CA_CERTS, which is how a saved `--ca-file` reaches an
+      // integration: bundle/server.js sets it on THIS process before the MCP
+      // server starts, and Node reads it only at process start.
       env: {
-        ...process.env,
+        ...inherited,
         PATH: buildPath(),
         HAP_DATA_DIR: DEFAULT_DATA_DIR2,
         ...config.env,
@@ -6275,29 +6385,96 @@ async function scopeReportSourcesToStoredWindow(base, stored, opts) {
   return { ok: true, window, sources: scopedSources(base, window, loadedAt) };
 }
 
+// src/lib/agent-access.ts
+import { timingSafeEqual } from "crypto";
+var DEFAULT_BIND_HOST = "127.0.0.1";
+function resolveBindHost(env = process.env) {
+  const raw = env.SUVEREN_BIND_HOST?.trim();
+  return raw ? raw : DEFAULT_BIND_HOST;
+}
+function isLoopbackBind(host) {
+  const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  return h === "localhost" || h === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+function resolveAgentToken(env = process.env) {
+  return env.SUVEREN_MCP_TOKEN?.trim() ?? "";
+}
+function bindRefusal(env = process.env) {
+  const host = resolveBindHost(env);
+  if (isLoopbackBind(host)) return null;
+  if (resolveAgentToken(env)) return null;
+  if (env.SUVEREN_CONTAINER === "1") return null;
+  return `SUVEREN_BIND_HOST=${host} would let other machines connect as this person's agent, but SUVEREN_MCP_TOKEN is not set. Set a token (long and random), or remove SUVEREN_BIND_HOST to listen on this machine only.`;
+}
+function hostnameOf(hostHeader) {
+  const trimmed = hostHeader.trim().toLowerCase();
+  const bracketed = trimmed.match(/^\[([^\]]+)\](?::\d+)?$/);
+  if (bracketed) return bracketed[1];
+  return trimmed.replace(/:\d+$/, "");
+}
+function isLocalHost(hostHeader) {
+  if (!hostHeader) return false;
+  const name = hostnameOf(hostHeader);
+  if (name === "localhost" || name.endsWith(".localhost")) return true;
+  if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(name)) return true;
+  if (name.includes(":")) return true;
+  return false;
+}
+function presentedToken(req) {
+  const auth = req.headers.authorization;
+  if (typeof auth === "string") {
+    const m = auth.match(/^Bearer\s+(.+)$/i);
+    if (m) return m[1].trim();
+  }
+  const q = req.query.token;
+  return typeof q === "string" ? q : "";
+}
+function sameToken(a, b) {
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+function agentAccess(token, opensSession) {
+  return (req, res, next) => {
+    if (!token) {
+      if (!isLocalHost(req.headers.host)) {
+        res.status(403).json({ error: "Forbidden host" });
+        return;
+      }
+      next();
+      return;
+    }
+    if (opensSession(req) && !sameToken(presentedToken(req), token)) {
+      res.status(401).json({ error: "Missing or wrong gateway token" });
+      return;
+    }
+    next();
+  };
+}
+
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
-import { join as join15, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync16 } from "fs";
+import { join as join16, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join15(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join15(dir, "index.json");
-  if (!existsSync15(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join16(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join16(dir, "index.json");
+  if (!existsSync16(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync16(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync17(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join15(dir, relativePath);
+    const profilePath = join16(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync16(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync17(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -6635,20 +6812,20 @@ async function controlPlaneMandate(dryRun, request) {
 }
 
 // src/lib/guides.ts
-import { existsSync as existsSync16, readdirSync, readFileSync as readFileSync17 } from "fs";
-import { dirname as dirname11, join as join16 } from "path";
+import { existsSync as existsSync17, readdirSync, readFileSync as readFileSync18 } from "fs";
+import { dirname as dirname12, join as join17 } from "path";
 var FILE_RE = /^(?:(\d+)-)?([a-z0-9][a-z0-9-]*)\.md$/;
 function builtinGuidesDir() {
   if (process.env.SUVEREN_BUILTIN_GUIDES_DIR) return process.env.SUVEREN_BUILTIN_GUIDES_DIR;
   let dir = import.meta.dirname ?? __dirname;
   for (let i = 0; i < 8; i++) {
-    const candidate = join16(dir, "content", "guides");
-    if (existsSync16(candidate)) return candidate;
-    const parent = dirname11(dir);
+    const candidate = join17(dir, "content", "guides");
+    if (existsSync17(candidate)) return candidate;
+    const parent = dirname12(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return join16(import.meta.dirname ?? __dirname, "content", "guides");
+  return join17(import.meta.dirname ?? __dirname, "content", "guides");
 }
 function parse(body) {
   const lines = body.split(/\r?\n/);
@@ -6659,14 +6836,14 @@ function parse(body) {
   return { title, summary };
 }
 function readDir(dir, source) {
-  if (!dir || !existsSync16(dir)) return [];
+  if (!dir || !existsSync17(dir)) return [];
   const out = [];
   for (const file of readdirSync(dir)) {
     const m = FILE_RE.exec(file);
     if (!m) continue;
     let body;
     try {
-      body = readFileSync17(join16(dir, file), "utf8");
+      body = readFileSync18(join17(dir, file), "utf8");
     } catch {
       continue;
     }
@@ -6702,6 +6879,8 @@ function guideHeader(systems) {
       lines.push(`- **${s.id}** \u2014 ${parts.join("; ")}`);
     }
   }
+  lines.push("");
+  lines.push(`**Approvals:** every mandate and brief you propose waits until the person approves it in the Suveren Gateway at ${uiUrl()}/approvals. Tell them each time you propose one.`);
   return lines.join("\n");
 }
 
@@ -6732,7 +6911,11 @@ function connectedSystems(im) {
 function setupBuiltin(deps) {
   return {
     id: "setup",
-    name: "Test setup",
+    // Shown as the picker card title (apps/ui AuthorizePicker) — the person
+    // reads this as the mandate they're giving, so it must match the profile
+    // name they'll see everywhere else (Mandates page, dashboard first-run
+    // card), not the internal "test setup" framing. Description is unchanged.
+    name: "Delegation",
     description: "Your AI sets up a test of itself: it reads the setup guides and proposes its agent brief and its mandates. Every proposal waits for your approval. Simulation mode only.",
     profile: DELEGATION_PROFILE,
     simulation: true,
@@ -6771,7 +6954,7 @@ function setupBuiltin(deps) {
     tools: [
       {
         name: "get_guide",
-        description: "Simulation mode only: the setup guides \u2014 how to interview the person, build the test data, propose mandates and the agent brief, set up the working AI's process, and what can make a test misleading. Call without `topic` for the list and the order to follow; then read each topic before doing that step.",
+        description: "Start here when the person asks how to begin with Suveren or how to set up their work with it. Simulation mode only: the setup guides \u2014 how to interview the person, build the test data, propose mandates and the agent brief, set up the working AI's process, and what can make a test misleading. Call without `topic` for the list and the order to follow; then read each topic before doing that step.",
         inputSchema: {
           type: "object",
           properties: {
@@ -6898,8 +7081,8 @@ function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync18, unlinkSync as unlinkSync6, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname12, join as join17 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync13, readFileSync as readFileSync19, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname13, join as join18 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -6927,7 +7110,7 @@ var ExecutorLock = class {
   path;
   held = false;
   constructor(dataDir2) {
-    this.path = join17(dataDir2, "executor.lock");
+    this.path = join18(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -6935,9 +7118,9 @@ var ExecutorLock = class {
     if (current && current.pid !== process.pid && isAlive(current.pid)) {
       return { held: false, holderPid: current.pid };
     }
-    mkdirSync12(dirname12(this.path), { recursive: true, mode: 448 });
+    mkdirSync13(dirname13(this.path), { recursive: true, mode: 448 });
     const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
-    writeFileSync12(this.path, JSON.stringify(lock), { mode: 384 });
+    writeFileSync13(this.path, JSON.stringify(lock), { mode: 384 });
     this.held = true;
     return { held: true };
   }
@@ -6959,9 +7142,9 @@ var ExecutorLock = class {
     }
   }
   read() {
-    if (!existsSync17(this.path)) return null;
+    if (!existsSync18(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync18(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync19(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -6979,19 +7162,19 @@ function isAlive(pid) {
 
 // bin/http.ts
 import { homedir as homedir11 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // src/lib/mcp-as-tracker.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname13, join as join18 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname14, join as join19 } from "path";
 function trackerPath(dataDir2) {
-  return join18(dataDir2, "mcp-as-pairing.json");
+  return join19(dataDir2, "mcp-as-pairing.json");
 }
 function readMcpPairedAsUrl(dataDir2) {
   const path = trackerPath(dataDir2);
-  if (!existsSync18(path)) return null;
+  if (!existsSync19(path)) return null;
   try {
-    const data = JSON.parse(readFileSync19(path, "utf-8"));
+    const data = JSON.parse(readFileSync20(path, "utf-8"));
     return typeof data.asUrl === "string" ? data.asUrl : null;
   } catch {
     return null;
@@ -6999,17 +7182,25 @@ function readMcpPairedAsUrl(dataDir2) {
 }
 function writeMcpPairedAsUrl(dataDir2, asUrl) {
   const path = trackerPath(dataDir2);
-  mkdirSync13(dirname13(path), { recursive: true, mode: 448 });
-  writeFileSync13(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
+  mkdirSync14(dirname14(path), { recursive: true, mode: 448 });
+  writeFileSync14(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
 }
 
 // bin/http.ts
-var dataDir = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join20(homedir11(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
+var bindHost = resolveBindHost();
+var agentToken = resolveAgentToken();
+var bindProblem = bindRefusal();
+if (bindProblem) {
+  console.error(`[Suveren MCP] Refusing to start: ${bindProblem}`);
+  process.exit(1);
+}
 setAsBaseUrl(spUrl);
 var state = new SharedState(spUrl, void 0, dataDir);
+var agentContact = new AgentContactStore(dataDir);
 var reportSources = {
   archive: state.receiptArchive,
   runExport: createConnectorExportRunner({ integrationsBinDir: getIntegrationsBinDir(), dataDir })
@@ -7051,16 +7242,6 @@ integrationManager.setOnConfigMigrated((id, updates) => {
 });
 var app = express();
 app.use(express.json());
-app.use((_req, res, next) => {
-  res.header("Access-Control-Allow-Origin", "http://localhost:3000");
-  res.header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-  res.header("Access-Control-Allow-Headers", "Content-Type, mcp-session-id");
-  if (_req.method === "OPTIONS") {
-    res.sendStatus(204);
-    return;
-  }
-  next();
-});
 var INTERNAL_SECRET = process.env.SUVEREN_INTERNAL_SECRET ?? "";
 function internalOnly(req, res, next) {
   const ip = req.ip ?? req.socket.remoteAddress ?? "";
@@ -7296,9 +7477,14 @@ app.post("/internal/stop-all-running", internalOnly, async (_req, res) => {
   }
 });
 var sseSessions = /* @__PURE__ */ new Map();
-app.get("/sse", async (_req, res) => {
+var guardAgent = agentAccess(
+  agentToken,
+  (req) => req.path === "/sse" && req.method === "GET" || req.path === "/mcp" && req.method === "POST" && !req.headers["mcp-session-id"]
+);
+app.get("/sse", guardAgent, async (_req, res) => {
   const transport = new SSEServerTransport("/messages", res);
   const { server, refreshTools, registerProxiedTools } = createMcpServer(state, integrationManager);
+  server.server.oninitialized = () => agentContact.record(server.server.getClientVersion());
   const sessionId = transport.sessionId;
   sseSessions.set(sessionId, transport);
   activeSessions.set(sessionId, { refreshTools, registerProxiedTools });
@@ -7308,12 +7494,9 @@ app.get("/sse", async (_req, res) => {
     activeSessions.delete(sessionId);
     console.error(`[Suveren MCP] SSE session ${sessionId} closed`);
   });
-  server.registerTool("debug_test_tool", { description: "Debug test" }, async () => ({
-    content: [{ type: "text", text: "debug" }]
-  }));
   await server.connect(transport);
 });
-app.post("/messages", async (req, res) => {
+app.post("/messages", guardAgent, async (req, res) => {
   const sessionId = req.query.sessionId;
   const transport = sseSessions.get(sessionId);
   if (!transport) {
@@ -7323,7 +7506,7 @@ app.post("/messages", async (req, res) => {
   await transport.handlePostMessage(req, res, req.body);
 });
 var streamableSessions = /* @__PURE__ */ new Map();
-app.all("/mcp", async (req, res) => {
+app.all("/mcp", guardAgent, async (req, res) => {
   const sessionId = req.headers["mcp-session-id"];
   if (req.method === "GET" || req.method === "POST" || req.method === "DELETE") {
     if (sessionId && streamableSessions.has(sessionId)) {
@@ -7343,6 +7526,7 @@ app.all("/mcp", async (req, res) => {
         }
       };
       const { server, refreshTools, registerProxiedTools } = createMcpServer(state, integrationManager);
+      server.server.oninitialized = () => agentContact.record(server.server.getClientVersion());
       await server.connect(transport);
       await transport.handleRequest(req, res, req.body);
       if (transport.sessionId && !streamableSessions.has(transport.sessionId)) {
@@ -7373,6 +7557,9 @@ app.get("/health", (_req, res) => {
     builtins: integrationManager.getBuiltins()
   });
 });
+app.get("/internal/agent-contact", internalOnly, (_req, res) => {
+  res.json({ contact: agentContact.read() });
+});
 app.get("/internal/tool-display", internalOnly, (_req, res) => {
   res.json({ tools: integrationManager.getToolDisplay() });
 });
@@ -7642,10 +7829,11 @@ process.on("SIGINT", async () => {
   await integrationManager.shutdown();
   process.exit(0);
 });
-app.listen(port, "0.0.0.0", () => {
-  console.error(`[Suveren MCP] HTTP server listening on http://0.0.0.0:${port}`);
-  console.error(`[Suveren MCP]   SSE:        http://0.0.0.0:${port}/sse`);
-  console.error(`[Suveren MCP]   Streamable: http://0.0.0.0:${port}/mcp`);
+app.listen(port, bindHost, () => {
+  console.error(`[Suveren MCP] HTTP server listening on http://${bindHost}:${port}`);
+  console.error(`[Suveren MCP]   SSE:        http://${bindHost}:${port}/sse`);
+  console.error(`[Suveren MCP]   Streamable: http://${bindHost}:${port}/mcp`);
+  console.error(`[Suveren MCP]   Agent token: ${agentToken ? "required" : "not set (this machine only)"}`);
   console.error(`[Suveren MCP]   SP server:  ${spUrl}`);
   profilesLoaded = loadProfiles();
   loadManifests();
@@ -7692,7 +7880,7 @@ app.listen(port, "0.0.0.0", () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join20(homedir11(), ".suveren");
   const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {