@suveren/gateway 0.19.2 → 0.19.4

package/dist/control-plane/index.mjs

@@ -599,6 +599,13 @@ async function exportReport(gatewayVersion) {
   const filename = /filename="([^"]+)"/.exec(res.headers.get("content-disposition") ?? "")?.[1] ?? "suveren-report.html";
   return { html, filename };
 }
+async function getAgentContact() {
+  const res = await fetch(`${MCP_BASE}/internal/agent-contact`, {
+    headers: internalHeaders()
+  });
+  if (!res.ok) throw new Error("Failed to fetch agent contact");
+  return res.json();
+}
 async function getMcpHealth() {
   const res = await fetch(`${MCP_BASE}/health`);
   if (!res.ok) throw new Error("MCP server unreachable");
@@ -2870,6 +2877,13 @@ function createMCPRouter() {
       res.status(502).json({ error: "MCP server unreachable" });
     }
   });
+  router.get("/agent-contact", async (_req, res) => {
+    try {
+      res.json(await getAgentContact());
+    } catch {
+      res.status(502).json({ error: "MCP server unreachable" });
+    }
+  });
   router.get("/integrations", async (_req, res) => {
     try {
       const data = await getIntegrations();

package/dist/mcp-server/http.mjs

@@ -4158,6 +4158,13 @@ function buildMandateBrief(opts) {
     }
     lines.push("");
   }
+  if (isSimulationMode()) {
+    const canSetUp = active.some((a) => shortProfileName(a.profileId) === "delegation");
+    lines.push("=== GETTING STARTED ===");
+    lines.push("");
+    lines.push(canSetUp ? "If the person asks how to start with Suveren or how to set up their work with it: call setup__get_guide first and follow its steps in order." : `If the person asks how to start with Suveren: they first create a "Delegation" mandate in the Suveren Gateway at ${uiUrl()}. With it you can read the setup guide and lead them through the setup.`);
+    lines.push("");
+  }
   lines.push("When you receive a task, call list-authorizations(domain) to load full details for the relevant domain.");
   return lines.join("\n");
 }
@@ -4947,6 +4954,54 @@ function createMcpServer(state2, integrationManager2) {
   return { server, gatekeeper: state2.gatekeeper, refreshTools, registerProxiedTools };
 }
 
+// src/lib/agent-contact.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync13, renameSync as renameSync4, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname10, join as join12 } from "path";
+var FILE = "agent-contact.json";
+var REWRITE_AFTER_MS = 6e4;
+var AgentContactStore = class {
+  path;
+  current;
+  constructor(dataDir2) {
+    this.path = join12(dataDir2, FILE);
+    this.current = this.load();
+  }
+  load() {
+    if (!existsSync12(this.path)) return null;
+    try {
+      const v = JSON.parse(readFileSync13(this.path, "utf8"));
+      if (typeof v.clientName !== "string" || typeof v.firstSeenAt !== "string" || typeof v.lastSeenAt !== "string") return null;
+      return { clientName: v.clientName, clientVersion: v.clientVersion, firstSeenAt: v.firstSeenAt, lastSeenAt: v.lastSeenAt };
+    } catch {
+      return null;
+    }
+  }
+  read() {
+    return this.current;
+  }
+  /** Record a completed MCP initialize. `now` is injectable for tests. */
+  record(client, now = /* @__PURE__ */ new Date()) {
+    const clientName = client?.name?.trim() || "Unknown AI client";
+    const prev = this.current;
+    const due = !prev || prev.clientName !== clientName || now.getTime() - Date.parse(prev.lastSeenAt) >= REWRITE_AFTER_MS;
+    this.current = {
+      clientName,
+      clientVersion: client?.version,
+      firstSeenAt: prev?.firstSeenAt ?? now.toISOString(),
+      lastSeenAt: now.toISOString()
+    };
+    if (!due) return;
+    try {
+      mkdirSync10(dirname10(this.path), { recursive: true });
+      const tmp = `${this.path}.tmp`;
+      writeFileSync10(tmp, JSON.stringify(this.current, null, 2));
+      renameSync4(tmp, this.path);
+    } catch (err) {
+      console.error("[Suveren MCP] Could not save agent contact:", err);
+    }
+  }
+};
+
 // src/lib/gate-content.ts
 import { computeIntentHash } from "@hap/core";
 import { decodeAttestationBlob as decodeAttestationBlob2 } from "@hap/core";
@@ -4974,16 +5029,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync12 } from "fs";
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11, existsSync as existsSync13 } from "fs";
 import { homedir as homedir9 } from "os";
-import { dirname as dirname10, join as join12 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
+import { dirname as dirname11, join as join13 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir2) {
     const dir = dataDir2 ?? DEFAULT_DATA_DIR;
-    this.filePath = join12(dir, "integrations.json");
+    this.filePath = join13(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -5014,12 +5069,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync12(this.filePath)) {
-      mkdirSync10(dirname10(this.filePath), { recursive: true });
+    if (!existsSync13(this.filePath)) {
+      mkdirSync11(dirname11(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync13(this.filePath, "utf-8");
+      const raw = readFileSync14(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -5048,23 +5103,23 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync10(dirname10(this.filePath), { recursive: true });
-    writeFileSync10(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync11(dirname11(this.filePath), { recursive: true });
+    writeFileSync11(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
 import { homedir as homedir10 } from "os";
-import { join as join14, delimiter } from "path";
-import { existsSync as existsSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync15, rmSync } from "fs";
+import { join as join15, delimiter } from "path";
+import { existsSync as existsSync15, writeFileSync as writeFileSync12, mkdirSync as mkdirSync12, readFileSync as readFileSync16, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync14, existsSync as existsSync13 } from "fs";
-import { join as join13, resolve } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join14, resolve } from "path";
 var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 function isExactSemver(value) {
   return typeof value === "string" && EXACT_SEMVER_RE.test(value);
@@ -5082,25 +5137,25 @@ function invalidNpmPinReason(manifest) {
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join13(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join13(dir, "index.json");
-  if (!existsSync13(indexPath)) {
+  const indexPath = join14(dir, "index.json");
+  if (!existsSync14(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync14(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join13(dir, relativePath);
+    const manifestPath = join14(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync14(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
       const pinReason = invalidNpmPinReason(manifest);
       if (pinReason) {
         console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${pinReason}`);
@@ -5247,8 +5302,8 @@ function inheritedConnectorEnv(parent, passEnv = []) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join14(homedir10(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join14(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join15(homedir10(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join15(DEFAULT_DATA_DIR2, "integrations");
 var OFFLINE_MODE = process.env.SUVEREN_OFFLINE === "1";
 var installLock = Promise.resolve();
 function withInstallLock(task) {
@@ -5256,7 +5311,7 @@ function withInstallLock(task) {
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join14(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join15(INTEGRATIONS_DIR, "node_modules", ".bin");
 function getIntegrationsBinDir() {
   return INTEGRATIONS_BIN;
 }
@@ -5265,12 +5320,12 @@ function buildPath() {
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync14(INTEGRATIONS_DIR)) {
-    mkdirSync11(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync15(INTEGRATIONS_DIR)) {
+    mkdirSync12(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join14(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync14(pkgPath)) {
-    writeFileSync11(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join15(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync15(pkgPath)) {
+    writeFileSync12(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -5359,19 +5414,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join14(pkgDir, "package.json");
-    if (!existsSync14(pkgDir) || !existsSync14(pkgJson)) return false;
+    const pkgDir = join15(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join15(pkgDir, "package.json");
+    if (!existsSync15(pkgDir) || !existsSync15(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync16(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync14(join14(pkgDir, target))) return false;
+        if (!existsSync15(join15(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync14(join14(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync15(join15(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -5386,9 +5441,9 @@ var IntegrationManager = class {
    */
   readInstalledVersion(npmPackage) {
     if (!this.isUsableInstall(npmPackage)) return null;
-    const pkgJson = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
+    const pkgJson = join15(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
     try {
-      const pkg = JSON.parse(readFileSync15(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync16(pkgJson, "utf8"));
       return typeof pkg.version === "string" ? pkg.version : null;
     } catch {
       return null;
@@ -5402,7 +5457,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync14(join14(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync15(join15(INTEGRATIONS_BIN, c)));
   }
   /**
    * The exact version THIS gateway's CURRENTLY LOADED manifest pins
@@ -5492,8 +5547,8 @@ var IntegrationManager = class {
    * nothing at all.
    */
   async installNow(npmPackage, exactVersion, cleanFirst = true) {
-    const pkgDir = join14(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (cleanFirst && existsSync14(pkgDir)) {
+    const pkgDir = join15(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (cleanFirst && existsSync15(pkgDir)) {
       console.error(`[IntegrationManager] Removing ${exactVersion ? "outdated" : "unusable"} install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -5766,6 +5821,7 @@ var IntegrationManager = class {
       name: def.name,
       description: def.description ?? "",
       profile: def.profile,
+      ...def.intentHint ? { intentHint: def.intentHint } : {},
       available: !def.simulationOnly || isSimulationMode()
     }));
   }
@@ -6398,28 +6454,28 @@ function agentAccess(token, opensSession) {
 }
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
-import { join as join15, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync16 } from "fs";
+import { join as join16, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join15(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join15(dir, "index.json");
-  if (!existsSync15(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join16(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join16(dir, "index.json");
+  if (!existsSync16(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync16(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync17(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join15(dir, relativePath);
+    const profilePath = join16(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync16(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync17(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -6757,20 +6813,20 @@ async function controlPlaneMandate(dryRun, request) {
 }
 
 // src/lib/guides.ts
-import { existsSync as existsSync16, readdirSync, readFileSync as readFileSync17 } from "fs";
-import { dirname as dirname11, join as join16 } from "path";
+import { existsSync as existsSync17, readdirSync, readFileSync as readFileSync18 } from "fs";
+import { dirname as dirname12, join as join17 } from "path";
 var FILE_RE = /^(?:(\d+)-)?([a-z0-9][a-z0-9-]*)\.md$/;
 function builtinGuidesDir() {
   if (process.env.SUVEREN_BUILTIN_GUIDES_DIR) return process.env.SUVEREN_BUILTIN_GUIDES_DIR;
   let dir = import.meta.dirname ?? __dirname;
   for (let i = 0; i < 8; i++) {
-    const candidate = join16(dir, "content", "guides");
-    if (existsSync16(candidate)) return candidate;
-    const parent = dirname11(dir);
+    const candidate = join17(dir, "content", "guides");
+    if (existsSync17(candidate)) return candidate;
+    const parent = dirname12(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return join16(import.meta.dirname ?? __dirname, "content", "guides");
+  return join17(import.meta.dirname ?? __dirname, "content", "guides");
 }
 function parse(body) {
   const lines = body.split(/\r?\n/);
@@ -6781,14 +6837,14 @@ function parse(body) {
   return { title, summary };
 }
 function readDir(dir, source) {
-  if (!dir || !existsSync16(dir)) return [];
+  if (!dir || !existsSync17(dir)) return [];
   const out = [];
   for (const file of readdirSync(dir)) {
     const m = FILE_RE.exec(file);
     if (!m) continue;
     let body;
     try {
-      body = readFileSync17(join16(dir, file), "utf8");
+      body = readFileSync18(join17(dir, file), "utf8");
     } catch {
       continue;
     }
@@ -6824,11 +6880,20 @@ function guideHeader(systems) {
       lines.push(`- **${s.id}** \u2014 ${parts.join("; ")}`);
     }
   }
+  lines.push("");
+  lines.push(`**Approvals:** every mandate and brief you propose waits until the person approves it in the Suveren Gateway at ${uiUrl()}/approvals. Tell them each time you propose one.`);
   return lines.join("\n");
 }
 
 // src/lib/builtins/setup.ts
-var DELEGATION_PROFILE = "github.com/humanagencyprotocol/hap-profiles/delegation@0.1";
+var DELEGATION_PROFILE = "delegation";
+var DELEGATION_INTENT_HINT = [
+  "Why \u2014 With test data only, I want to find out which routine parts of my work an AI could take over, so people gain time \u2014 before anything touches real systems.",
+  "",
+  "Goal \u2014 Follow the setup guide: interview me about the company, the team and the work; prepare test data from real cases, renamed to .example names; propose the mandates and the working instructions (agent brief) that the AI doing the work will need.",
+  "",
+  "Watch out \u2014 You only propose; nothing happens until I approve it in the Suveren Gateway. Ask, don't guess: never invent a rule, a limit or a step. One proposal at a time. Steps customers would see start with my review. Never use real names or customer data \u2014 proposals are stored readable on the Suveren server. Never give the working AI a reporting mandate during a test run. Keep the setup and the working AI in separate conversations."
+].join("\n");
 function briefRefusal(args) {
   if (typeof args.content !== "string" || args.content.trim() === "") return "`content` must be the complete new brief (markdown text).";
   const bytes = Buffer.byteLength(args.content, "utf-8");
@@ -6854,8 +6919,13 @@ function connectedSystems(im) {
 function setupBuiltin(deps) {
   return {
     id: "setup",
-    name: "Test setup",
+    // Shown as the picker card title (apps/ui AuthorizePicker) — the person
+    // reads this as the mandate they're giving, so it must match the profile
+    // name they'll see everywhere else (Mandates page, dashboard first-run
+    // card), not the internal "test setup" framing. Description is unchanged.
+    name: "Delegation",
     description: "Your AI sets up a test of itself: it reads the setup guides and proposes its agent brief and its mandates. Every proposal waits for your approval. Simulation mode only.",
+    intentHint: DELEGATION_INTENT_HINT,
     profile: DELEGATION_PROFILE,
     simulation: true,
     simulationOnly: true,
@@ -6893,7 +6963,7 @@ function setupBuiltin(deps) {
     tools: [
       {
         name: "get_guide",
-        description: "Simulation mode only: the setup guides \u2014 how to interview the person, build the test data, propose mandates and the agent brief, set up the working AI's process, and what can make a test misleading. Call without `topic` for the list and the order to follow; then read each topic before doing that step.",
+        description: "Start here when the person asks how to begin with Suveren or how to set up their work with it. Simulation mode only: the setup guides \u2014 how to interview the person, build the test data, propose mandates and the agent brief, set up the working AI's process, and what can make a test misleading. Call without `topic` for the list and the order to follow; then read each topic before doing that step.",
         inputSchema: {
           type: "object",
           properties: {
@@ -7020,8 +7090,8 @@ function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, readFileSync as readFileSync18, unlinkSync as unlinkSync6, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname12, join as join17 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync13, readFileSync as readFileSync19, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname13, join as join18 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -7049,7 +7119,7 @@ var ExecutorLock = class {
   path;
   held = false;
   constructor(dataDir2) {
-    this.path = join17(dataDir2, "executor.lock");
+    this.path = join18(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -7057,9 +7127,9 @@ var ExecutorLock = class {
     if (current && current.pid !== process.pid && isAlive(current.pid)) {
       return { held: false, holderPid: current.pid };
     }
-    mkdirSync12(dirname12(this.path), { recursive: true, mode: 448 });
+    mkdirSync13(dirname13(this.path), { recursive: true, mode: 448 });
     const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
-    writeFileSync12(this.path, JSON.stringify(lock), { mode: 384 });
+    writeFileSync13(this.path, JSON.stringify(lock), { mode: 384 });
     this.held = true;
     return { held: true };
   }
@@ -7081,9 +7151,9 @@ var ExecutorLock = class {
     }
   }
   read() {
-    if (!existsSync17(this.path)) return null;
+    if (!existsSync18(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync18(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync19(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -7101,19 +7171,19 @@ function isAlive(pid) {
 
 // bin/http.ts
 import { homedir as homedir11 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // src/lib/mcp-as-tracker.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname13, join as join18 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync14, readFileSync as readFileSync20, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname14, join as join19 } from "path";
 function trackerPath(dataDir2) {
-  return join18(dataDir2, "mcp-as-pairing.json");
+  return join19(dataDir2, "mcp-as-pairing.json");
 }
 function readMcpPairedAsUrl(dataDir2) {
   const path = trackerPath(dataDir2);
-  if (!existsSync18(path)) return null;
+  if (!existsSync19(path)) return null;
   try {
-    const data = JSON.parse(readFileSync19(path, "utf-8"));
+    const data = JSON.parse(readFileSync20(path, "utf-8"));
     return typeof data.asUrl === "string" ? data.asUrl : null;
   } catch {
     return null;
@@ -7121,12 +7191,12 @@ function readMcpPairedAsUrl(dataDir2) {
 }
 function writeMcpPairedAsUrl(dataDir2, asUrl) {
   const path = trackerPath(dataDir2);
-  mkdirSync13(dirname13(path), { recursive: true, mode: 448 });
-  writeFileSync13(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
+  mkdirSync14(dirname14(path), { recursive: true, mode: 448 });
+  writeFileSync14(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
 }
 
 // bin/http.ts
-var dataDir = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join20(homedir11(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
@@ -7139,6 +7209,7 @@ if (bindProblem) {
 }
 setAsBaseUrl(spUrl);
 var state = new SharedState(spUrl, void 0, dataDir);
+var agentContact = new AgentContactStore(dataDir);
 var reportSources = {
   archive: state.receiptArchive,
   runExport: createConnectorExportRunner({ integrationsBinDir: getIntegrationsBinDir(), dataDir })
@@ -7422,6 +7493,7 @@ var guardAgent = agentAccess(
 app.get("/sse", guardAgent, async (_req, res) => {
   const transport = new SSEServerTransport("/messages", res);
   const { server, refreshTools, registerProxiedTools } = createMcpServer(state, integrationManager);
+  server.server.oninitialized = () => agentContact.record(server.server.getClientVersion());
   const sessionId = transport.sessionId;
   sseSessions.set(sessionId, transport);
   activeSessions.set(sessionId, { refreshTools, registerProxiedTools });
@@ -7463,6 +7535,7 @@ app.all("/mcp", guardAgent, async (req, res) => {
         }
       };
       const { server, refreshTools, registerProxiedTools } = createMcpServer(state, integrationManager);
+      server.server.oninitialized = () => agentContact.record(server.server.getClientVersion());
       await server.connect(transport);
       await transport.handleRequest(req, res, req.body);
       if (transport.sessionId && !streamableSessions.has(transport.sessionId)) {
@@ -7493,6 +7566,9 @@ app.get("/health", (_req, res) => {
     builtins: integrationManager.getBuiltins()
   });
 });
+app.get("/internal/agent-contact", internalOnly, (_req, res) => {
+  res.json({ contact: agentContact.read() });
+});
 app.get("/internal/tool-display", internalOnly, (_req, res) => {
   res.json({ tools: integrationManager.getToolDisplay() });
 });
@@ -7813,7 +7889,7 @@ app.listen(port, bindHost, () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join19(homedir11(), ".suveren");
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join20(homedir11(), ".suveren");
   const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {