@suveren/gateway 0.24.0 → 0.25.0

package/dist/mcp-server/http.mjs

@@ -3858,6 +3858,11 @@ function zeroCappedBound(profileId, bounds, actionType) {
   }
   return null;
 }
+function toolAlwaysListed(tool, isBuiltin) {
+  if (tool.internal || !tool.gating?.profile) return false;
+  if (tool.gating.hideUnlessAuthorized || tool.gating.category === "disabled") return false;
+  return !isBuiltin(tool.integrationId);
+}
 function toolIsAuthorizedForDisplay(tool, matchingAuths) {
   if (!tool.gating?.hideUnlessAuthorized) return true;
   if (matchingAuths.length === 0) return false;
@@ -4033,7 +4038,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
     return {
       content: [{
         type: "text",
-        text: refusals.length > 0 ? `Refused: ${reasons.charAt(0).toUpperCase() + reasons.slice(1)} No ticket was requested.` : `No active authorization matching profile "${profile}". A decision owner must grant authority via the Authority UI before this tool can be used.`
+        text: refusals.length > 0 ? `Refused: ${reasons.charAt(0).toUpperCase() + reasons.slice(1)} No ticket was requested.` : noMandateRefusal(tool.namespacedName, profile)
       }],
       isError: true
     };
@@ -4645,20 +4650,21 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
     }
   });
 }
-function buildProxiedToolDescription(tool, state2) {
+function noMandateRefusal(toolName, profile) {
+  return `Refused: no mandate covers ${toolName} (${shortProfile(profile)}). Nothing was done. Ask the person to grant a ${shortProfile(profile)} mandate in the gateway, then try again. No ticket was requested.`;
+}
+function shortProfile(profileId) {
+  const parts = profileId.replace(/@.*$/, "").split("/");
+  return parts[parts.length - 1];
+}
+function buildProxiedToolDescription(tool) {
   if (!tool.gating || !tool.gating.profile) {
     return `[Suveren: no gating config] ${tool.description}`;
   }
   const profile = tool.gating.profile;
-  const auths = state2.getEnrichedAuthorizations();
-  const hasAuth = auths.some(
-    (a) => a.complete && profileMatches(a.profileId, profile)
-  );
-  if (!hasAuth) {
-    return `[Suveren: ${profile} \u2014 no active authorization] ${tool.description}`;
-  }
+  const condition = `works only under a ${shortProfile(profile)} mandate, check list-authorizations`;
   if (tool.gating.category === "read") {
-    return `[Suveren: ${profile} \u2014 read] ${tool.description}`;
+    return `[Suveren: ${profile} \u2014 read; ${condition}] ${tool.description}`;
   }
   const parts = [];
   if (tool.gating.staticExecution?.action_type) {
@@ -4671,7 +4677,7 @@ function buildProxiedToolDescription(tool, state2) {
     parts.push(`${mappedFields.join(", ")} checked`);
   }
   const tag = parts.length > 0 ? parts.join(", ") : "gated";
-  return `[Suveren: ${profile} \u2014 ${tag}] ${tool.description}`;
+  return `[Suveren: ${profile} \u2014 ${tag}; ${condition}] ${tool.description}`;
 }
 
 // src/lib/agent-visibility.ts
@@ -4727,7 +4733,8 @@ function buildMandateBrief(opts) {
     "You are connected to Suveren \u2014 the gateway that gates every privileged tool call you make.",
     "Suveren implements the bounded-authority model from the open Human Agency Protocol (HAP).",
     "You have bounded authorities granted by human decision owners.",
-    "You MUST stay within these bounds \u2014 the Gatekeeper will reject actions that exceed them."
+    "You MUST stay within these bounds \u2014 the Gatekeeper will reject actions that exceed them.",
+    "Tools are listed even where no mandate covers them yet. If a call is refused because no mandate covers it, tell the person and ask them to grant one \u2014 do not retry it or work around it with another tool."
   ];
   if (opts.asVersionRefusal) {
     lines.push("");
@@ -4823,7 +4830,7 @@ function buildCapabilityMap(profileId, integrationManager2) {
   const readOnly = [];
   const undescribed = [];
   for (const tool of allTools) {
-    if (!tool.gating || !tool.gating.profile) {
+    if (tool.internal || !tool.gating || !tool.gating.profile) {
       continue;
     }
     if (!profileMatches(tool.gating.profile, shortName2) && tool.gating.profile !== profileId) {
@@ -4864,6 +4871,20 @@ function buildCapabilityMap(profileId, integrationManager2) {
   }
   return lines.join("\n");
 }
+function listedWithoutMandate(authorizations, integrationManager2) {
+  if (!integrationManager2) return [];
+  const isBuiltin = (id) => integrationManager2.isBuiltin?.(id) ?? false;
+  const byProfile = /* @__PURE__ */ new Map();
+  for (const tool of integrationManager2.getAllTools()) {
+    if (!toolAlwaysListed(tool, isBuiltin)) continue;
+    const profile = tool.gating.profile;
+    if (authorizations.some((a) => a.complete && profileMatches(a.profileId, profile))) continue;
+    const short = shortProfileName2(profile);
+    byProfile.set(short, [...byProfile.get(short) ?? [], tool.namespacedName]);
+  }
+  return [...byProfile.entries()].map(([profile, tools]) => `  ${profile}: ${tools.join(", ")}`);
+}
+var LISTED_WITHOUT_MANDATE_HEADING = "Listed but not usable yet \u2014 no mandate covers these; every call is refused until the person grants one:";
 function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
   return async (args) => {
     if (!state2.spClient.isUnlocked()) {
@@ -4872,13 +4893,11 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
     const authorizations = agentVisibleAuthorizations(state2.getEnrichedAuthorizations(), integrationManager2);
     const now = Math.floor(Date.now() / 1e3);
     const domain = args?.domain;
+    const notYet = listedWithoutMandate(authorizations, integrationManager2);
     if (authorizations.length === 0) {
-      return {
-        content: [{
-          type: "text",
-          text: "No active authorizations. A decision owner must grant authority via the Authority UI."
-        }]
-      };
+      const text = ["No active authorizations \u2014 no tool is usable yet. Ask the person to grant a mandate in the gateway."];
+      if (notYet.length > 0) text.push("", LISTED_WITHOUT_MANDATE_HEADING, ...notYet);
+      return { content: [{ type: "text", text: text.join("\n") }] };
     }
     if (domain) {
       const matching = authorizations.filter((auth) => {
@@ -4999,7 +5018,7 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
       output.push("");
     }
     if (active.length > 0) {
-      output.push("Active authorizations:");
+      output.push("Active authorizations (usable now):");
       output.push(...active);
     }
     if (pending.length > 0) {
@@ -5007,6 +5026,11 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
       output.push("Pending (missing owners):");
       output.push(...pending);
     }
+    if (notYet.length > 0) {
+      if (output.length > 0) output.push("");
+      output.push(LISTED_WITHOUT_MANDATE_HEADING);
+      output.push(...notYet);
+    }
     return {
       content: [{
         type: "text",
@@ -5623,7 +5647,7 @@ function createMcpServer(state2, integrationManager2) {
       }
       const handler = createGatedToolHandler(tool, integrationManager2, state2);
       const zodShape = jsonSchemaToZodShape(tool.inputSchema);
-      const description = buildProxiedToolDescription(tool, state2);
+      const description = buildProxiedToolDescription(tool);
       try {
         const registered = server.registerTool(
           tool.namespacedName,
@@ -5641,10 +5665,11 @@ function createMcpServer(state2, integrationManager2) {
   }
   function refreshTools() {
     const auths = state2.getEnrichedAuthorizations();
+    const isBuiltin = (id) => integrationManager2?.isBuiltin?.(id) ?? false;
     for (const [, { tool, registered }] of proxiedTools) {
-      const description = buildProxiedToolDescription(tool, state2);
-      registered.update({ description });
-      if (tool.gating?.profile) {
+      if (toolAlwaysListed(tool, isBuiltin)) {
+        registered.enable();
+      } else if (tool.gating?.profile) {
         const matchingAuths = auths.filter(
           (a) => a.complete && profileMatches(a.profileId, tool.gating.profile)
         );