@suveren/gateway 0.26.0 → 0.27.1

package/dist/mcp-server/http.mjs

@@ -717,6 +717,42 @@ function describeFetchError(err) {
   return String(err);
 }
 
+// src/lib/cp-content-client.ts
+var CP_PORT2 = process.env.SUVEREN_CP_PORT ?? "3402";
+var CP_BASE2 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT2}`;
+var TIMEOUT_MS2 = 1e4;
+async function postInternal(path, body) {
+  const secret = process.env.SUVEREN_INTERNAL_SECRET ?? "";
+  if (!secret) {
+    throw new Error("No internal secret configured between the MCP server and the control plane.");
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    const res = await fetch(`${CP_BASE2}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Secret": secret },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(data.error ?? `${path} failed: ${res.status}`);
+    }
+    return data;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function cpEncryptContent(toolArgs, recipientUserIds) {
+  const data = await postInternal("/internal/encrypt-content", { toolArgs, recipientUserIds });
+  return data;
+}
+async function cpDecryptContent(wire) {
+  const data = await postInternal("/internal/decrypt-content", { ciphertext: wire.ciphertext, keys: wire.keys });
+  return data.plaintext;
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -944,7 +980,11 @@ var SPClient = class {
    * Errors throw SPReceiptError with the structured `errors` array in `body`.
    */
   async postReceipt(data) {
-    const body = JSON.stringify(data);
+    const { proposalContentHash, ...rest } = data;
+    const body = JSON.stringify({
+      ...rest,
+      ...proposalContentHash ? { proposal_content_hash: proposalContentHash } : {}
+    });
     const maxAttempts = data.idempotencyKey || data.proposalId ? this.receiptRetry.maxAttempts : 1;
     let lastError;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -984,8 +1024,20 @@ var SPClient = class {
   /**
    * Submit a proposal for deferred commitment review.
    * Phase 6: accepts optional pendingApprovers and createdBy for above-cap routing.
+   *
+   * PE1: toolArgs is encrypted (via the control plane's vault + the AS's
+   * registered public keys — cp-content-client.ts) before it ever reaches
+   * this method's request body; only the sealed `content` is sent, never
+   * `tool_args`. `recipientUserIds` are who besides the submitter (added by
+   * the control plane itself) must be able to read it back: the mandate
+   * owner, every pending approver (above-cap path), or every active member
+   * holding a pending domain (deferred-domain path) — decision 3 of the
+   * PE1 brief. `unreadableFor` is G4: anyone in that set with no registered
+   * end-to-end key — the proposal is still created for everyone who CAN
+   * read it; the caller reports who cannot.
    */
   async submitProposal(data) {
+    const { content, unreadableFor } = await cpEncryptContent(data.toolArgs, data.recipientUserIds);
     const res = await this.fetch("/api/proposals", {
       method: "POST",
       body: JSON.stringify({
@@ -994,7 +1046,7 @@ var SPClient = class {
         path: data.path,
         pending_domains: data.pendingDomains,
         tool: data.tool,
-        tool_args: data.toolArgs,
+        content,
         execution_context: data.executionContext,
         // Phase 6
         ...data.pendingApprovers && data.pendingApprovers.length > 0 ? { pending_approvers: data.pendingApprovers } : {},
@@ -1002,11 +1054,12 @@ var SPClient = class {
       })
     });
     if (!res.ok) {
-      const body = await res.json().catch(() => ({}));
-      throw new Error(body.error ?? `SP proposal submission failed: ${res.status}`);
+      const body2 = await res.json().catch(() => ({}));
+      throw new Error(body2.error ?? `SP proposal submission failed: ${res.status}`);
     }
     void notifyControlPlane("proposal-added");
-    return res.json();
+    const body = await res.json();
+    return { proposal: body.proposal, unreadableFor };
   }
   /**
    * Phase 6: Fetch the authorization summary by its per-ceremony id.
@@ -3747,6 +3800,20 @@ async function verifyTicket(cache, receipt, expected) {
   }
 }
 
+// src/lib/who-label.ts
+var UNKNOWN_DECIDER = "the person";
+async function resolveWhoLabel(archive, domainKey, userId) {
+  if (!archive) return UNKNOWN_DECIDER;
+  try {
+    const dir = await getIdentityDirectory(archive);
+    const did = dir.domainDids.get(domainKey) ?? dir.domainDids.get(userId);
+    const name = did ? dir.names.get(did) : void 0;
+    return name ?? UNKNOWN_DECIDER;
+  } catch {
+    return UNKNOWN_DECIDER;
+  }
+}
+
 // src/lib/arg-encoding.ts
 function rfc2047Encode(value) {
   if (!/[^\x00-\x7F]/.test(value)) return value;
@@ -4066,6 +4133,14 @@ async function attachImagePreview(args) {
     return args;
   }
 }
+async function unreadableForNote(unreadableFor, state2) {
+  if (unreadableFor.length === 0) return "";
+  const labels = await Promise.all(
+    unreadableFor.map((id) => resolveWhoLabel(state2.receiptArchive, id, id))
+  );
+  return `
+Note: ${labels.join(", ")} cannot read this proposal's content yet \u2014 no device of theirs has registered an end-to-end key.`;
+}
 function applyMapping(m, value, execution) {
   if (m.divisor) {
     const numValue = typeof value === "number" ? value : Number(value);
@@ -4640,14 +4715,22 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         try {
           const enrichedArgs = await attachImagePreview(args);
           const wireExecCtx = wireExecutionContext(auth.profileId, execution);
-          const { proposal } = await state2.spClient.submitProposal({
+          let recipientUserIds = auth.deferredCommitmentDomains.filter((d) => d !== "owner");
+          try {
+            const summary = await state2.spClient.getAuthorizationSummary(authzId);
+            if (summary?.created_by) recipientUserIds = [summary.created_by, ...recipientUserIds];
+          } catch {
+          }
+          recipientUserIds = [...new Set(recipientUserIds)];
+          const { proposal, unreadableFor } = await state2.spClient.submitProposal({
             authorizationId: authzId,
             profileId: auth.profileId,
             path: auth.path,
             pendingDomains: auth.deferredCommitmentDomains,
             tool: tool.namespacedName,
             toolArgs: enrichedArgs,
-            executionContext: wireExecCtx
+            executionContext: wireExecCtx,
+            recipientUserIds
           });
           const previewHash = await computeSubmissionPreviewHash(
             integrationManager2,
@@ -4668,7 +4751,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             content: [{
               type: "text",
               text: `Awaiting commitment from domain${auth.deferredCommitmentDomains.length > 1 ? "s" : ""} "${auth.deferredCommitmentDomains.join('", "')}" for tool ${tool.originalName}.
-Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposal_id: "${proposal.id}").`
+Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposal_id: "${proposal.id}").` + await unreadableForNote(unreadableFor ?? [], state2)
             }]
           };
         } catch (err) {
@@ -4818,7 +4901,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           try {
             const enrichedArgs = await attachImagePreview(args);
             const wireExecCtx = wireExecutionContext(auth.profileId, execution);
-            const { proposal } = await state2.spClient.submitProposal({
+            const { proposal, unreadableFor } = await state2.spClient.submitProposal({
               authorizationId: authzId,
               profileId: auth.profileId,
               path: auth.path,
@@ -4826,7 +4909,8 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               tool: tool.namespacedName,
               toolArgs: enrichedArgs,
               executionContext: wireExecCtx,
-              pendingApprovers: uniqueApprovers
+              pendingApprovers: uniqueApprovers,
+              recipientUserIds: uniqueApprovers
             });
             const previewHash = await computeSubmissionPreviewHash(
               integrationManager2,
@@ -4847,7 +4931,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               content: [{
                 type: "text",
                 text: `Action exceeds team cap. Approval required from ${uniqueApprovers.length} reviewer(s).
-Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
+Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + await unreadableForNote(unreadableFor ?? [], state2)
               }]
             };
           } catch (proposalErr) {
@@ -5414,17 +5498,54 @@ function listIntegrationsHandler(state2, integrationManager2) {
 // src/tools/commitments.ts
 import { ContentBindingError as ContentBindingError2 } from "@hap/core";
 
-// src/lib/who-label.ts
-var UNKNOWN_DECIDER = "the person";
-async function resolveWhoLabel(archive, domainKey, userId) {
-  if (!archive) return UNKNOWN_DECIDER;
+// src/lib/proposal-content.ts
+import { createHash as createHash3 } from "crypto";
+import { canonicalize } from "@hap/core";
+var ProposalContentError = class extends Error {
+};
+function computeProposalContentHash(toolArgs) {
+  return `sha256:${createHash3("sha256").update(canonicalize(toolArgs)).digest("hex")}`;
+}
+async function resolveProposalToolArgs(proposal) {
+  if (proposal.toolArgs) return proposal.toolArgs;
+  if (!proposal.content) {
+    throw new ProposalContentError(`Proposal ${proposal.id} carries neither tool_args nor content \u2014 cannot execute.`);
+  }
+  let plaintext;
   try {
-    const dir = await getIdentityDirectory(archive);
-    const did = dir.domainDids.get(domainKey) ?? dir.domainDids.get(userId);
-    const name = did ? dir.names.get(did) : void 0;
-    return name ?? UNKNOWN_DECIDER;
+    plaintext = await cpDecryptContent(proposal.content);
+  } catch (err) {
+    throw new ProposalContentError(`Could not decrypt the approved content on this device: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(plaintext);
   } catch {
-    return UNKNOWN_DECIDER;
+    throw new ProposalContentError(`Proposal ${proposal.id}: decrypted content is not valid JSON.`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ProposalContentError(`Proposal ${proposal.id}: decrypted content is not a JSON object.`);
+  }
+  const toolArgs = parsed;
+  if (proposal.content.hash) {
+    const actual = computeProposalContentHash(toolArgs);
+    if (actual !== proposal.content.hash) {
+      throw new ProposalContentError(
+        `Proposal ${proposal.id}: decrypted content does not match its own fingerprint \u2014 refusing to execute.`
+      );
+    }
+  }
+  return toolArgs;
+}
+async function decryptRejectionNote(by) {
+  if (!by) return void 0;
+  if (typeof by.note === "string") return by.note;
+  if (!by.noteEncrypted) return void 0;
+  try {
+    return await cpDecryptContent(by.noteEncrypted);
+  } catch (err) {
+    console.error("[Suveren MCP] Failed to decrypt a change-needed note:", err);
+    return "(could not decrypt this note on this device)";
   }
 }
 
@@ -5436,6 +5557,7 @@ var installedExecutor = null;
 function installCommittedExecutor(executor) {
   installedExecutor = executor;
 }
+var warnedSkippedProposalIds = /* @__PURE__ */ new Set();
 function runCommitted(proposal, state2, integrationManager2) {
   return installedExecutor ? installedExecutor.execute(proposal) : executeCommitted(proposal, state2, integrationManager2);
 }
@@ -5459,15 +5581,28 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
   const submitted = state2.proposalSubmissions.get(proposal.id);
   if (!submitted) {
-    console.error(
-      `[Suveren MCP] Proposal ${proposal.id} is committed but has no local submission record on this gateway \u2014 leaving it for whichever gateway submitted it (this is normal for a different device of the same operator, or the AS lists a proposal we never submitted).`
-    );
-    return { text: buildSkippedProposalNote(proposal.id) };
+    if (!warnedSkippedProposalIds.has(proposal.id)) {
+      warnedSkippedProposalIds.add(proposal.id);
+      console.error(
+        `[Suveren MCP] Proposal ${proposal.id} is committed but has no local submission record on this gateway \u2014 leaving it for whichever gateway submitted it (this is normal for a different device of the same operator, or the AS lists a proposal we never submitted).`
+      );
+    }
+    return { text: buildSkippedProposalNote(proposal.id), skipped: true };
+  }
+  let toolArgs;
+  try {
+    toolArgs = await resolveProposalToolArgs(proposal);
+  } catch (err) {
+    const msg = err instanceof ProposalContentError ? err.message : `Could not resolve the approved content on this device: ${err instanceof Error ? err.message : String(err)}`;
+    return {
+      text: `Proposal ${proposal.id}: blocked \u2014 ${msg} The action was not executed.`,
+      isError: true
+    };
   }
   {
     const mismatches = [];
     if (submitted.tool !== proposal.tool) mismatches.push("tool");
-    if (submitted.toolArgsHash !== hashToolArgs(proposal.toolArgs)) mismatches.push("arguments");
+    if (submitted.toolArgsHash !== hashToolArgs(toolArgs)) mismatches.push("arguments");
     if (submitted.executionContextHash !== hashToolArgs(proposal.executionContext)) mismatches.push("executionContext");
     if (submitted.authorizationId !== proposal.authorizationId) mismatches.push("authorizationId");
     if (submitted.profileId !== proposal.profileId) mismatches.push("profileId");
@@ -5485,7 +5620,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     const binding = computeContentBinding(
       proposal.profileId,
       discovered,
-      proposal.toolArgs,
+      toolArgs,
       proposalActionType
     );
     const { receipt, idempotent } = await state2.spClient.postReceipt({
@@ -5499,7 +5634,12 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       executionContext: proposal.executionContext,
       amount: typeof proposal.executionContext.amount === "number" ? proposal.executionContext.amount : void 0,
       proposalId: proposal.id,
-      toolArgs: proposal.toolArgs,
+      toolArgs,
+      // PE1 — the fingerprint of what THIS gateway resolved (decrypted, or
+      // read plain on a legacy row) and is about to execute. The AS compares
+      // it against its own stored content_hash and refuses without echoing
+      // content on a mismatch.
+      proposalContentHash: computeProposalContentHash(toolArgs),
       // Deliberately NO idempotencyKey: the spec has review-mode commits carry
       // a proposalId INSTEAD of a key — the proposal's committed→executed
       // transition is their replay protection, and the AS replays the ORIGINAL
@@ -5533,7 +5673,11 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       attestations: cachedAuth?.attestations,
       // What the human actually approved, kept next to the receipt that cites
       // it — otherwise `proposalId` is a pointer to a server we may not have.
-      proposal,
+      // PE1: the archived copy carries the RESOLVED (decrypted on an
+      // encrypted row) toolArgs, never the sealed `content` — this archive
+      // is this gateway's own local evidence and has always stored it
+      // readable, same as every legacy row.
+      proposal: { ...proposal, toolArgs },
       boundContent: binding?.boundContent
     });
   } catch (err) {
@@ -5592,7 +5736,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     ticketId: receiptId,
     proposalId: proposal.id,
     tool: proposal.tool,
-    argsHash: hashToolArgs(proposal.toolArgs)
+    argsHash: hashToolArgs(toolArgs)
   });
   if (!begun.ok) {
     const prior = begun.existing;
@@ -5617,7 +5761,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       integrationManager2,
       integrationId,
       toolName,
-      proposal.toolArgs,
+      toolArgs,
       submitted.previewHash
     );
     if (changed) {
@@ -5629,7 +5773,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     }
   }
   try {
-    let outgoingArgs = proposal.toolArgs;
+    let outgoingArgs = toolArgs;
     if (discovered && receiptId) {
       if (shouldAttachFooter()) {
         outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId, cachedAuth?.subjects?.[0]);
@@ -5735,10 +5879,11 @@ Result: ${JSON.stringify(match.executionResult, null, 2)}` : " The action ran; t
             by.userId
           ) : "a person";
           if (outcome === "change_needed") {
+            const note = await decryptRejectionNote(by);
             return {
               content: [{
                 type: "text",
-                text: `Proposal ${match.id} was SENT BACK FOR A CHANGE by ${who}: "${by?.note ?? ""}". The action did not run. You may adjust it and propose again \u2014 a new proposal the person approves again. Do not resend the same values.`
+                text: `Proposal ${match.id} was SENT BACK FOR A CHANGE by ${who}: "${note ?? ""}". The action did not run. You may adjust it and propose again \u2014 a new proposal the person approves again. Do not resend the same values.`
               }]
             };
           }
@@ -7823,13 +7968,13 @@ var reportBuiltin = (deps) => ({
 });
 
 // src/lib/cp-mandate.ts
-var CP_PORT2 = process.env.SUVEREN_CP_PORT ?? "3402";
-var CP_BASE2 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT2}`;
+var CP_PORT3 = process.env.SUVEREN_CP_PORT ?? "3402";
+var CP_BASE3 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT3}`;
 async function controlPlaneMandate(dryRun, request) {
   const secret = process.env.SUVEREN_INTERNAL_SECRET ?? "";
   if (!secret) return { ok: false, message: "the gateway is not fully started (no control plane connection)." };
   try {
-    const res = await fetch(`${CP_BASE2}/internal/mandate`, {
+    const res = await fetch(`${CP_BASE3}/internal/mandate`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Internal-Secret": secret },
       body: JSON.stringify({ dryRun, request }),
@@ -8017,7 +8162,7 @@ var DELEGATION_INTENT_HINT = [
   "",
   "Goal \u2014 Follow the setup guide: interview me about the company, the team and the work; prepare test data from real cases, renamed to .example names; propose the mandates and the working instructions (agent brief) that the AI doing the work will need.",
   "",
-  "Watch out \u2014 You only propose; nothing happens until I approve it in the Suveren Gateway. Ask, don't guess: never invent a rule, a limit or a step. One proposal at a time. Steps customers would see start with my review. Never use real names or customer data \u2014 proposals are stored readable on the Suveren server. Never give the working AI a reporting mandate during a test run. Keep the setup and the working AI in separate conversations.",
+  "Watch out \u2014 You only propose; nothing happens until I approve it in the Suveren Gateway. Ask, don't guess: never invent a rule, a limit or a step. One proposal at a time. Steps customers would see start with my review. Never use real names or customer data in a test run \u2014 test data only. Never give the working AI a reporting mandate during a test run. Keep the setup and the working AI in separate conversations.",
   "",
   // DL1 — outside simulation, the same mandate also covers ongoing, real-system
   // use: the Scope above (which profiles, which mode) is what actually bounds
@@ -8425,6 +8570,10 @@ import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 // src/lib/committed-executor.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync21, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname15, join as join20 } from "path";
+function describeAutoExecutionLog(proposalId, tool, result) {
+  if (result.skipped) return null;
+  return result.isError ? `[Suveren MCP] Auto-exec proposal ${proposalId}: ${result.text}` : `[Suveren MCP] Auto-executed proposal ${proposalId}: ${tool}`;
+}
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -9281,7 +9430,13 @@ app.listen(port, bindHost, () => {
           "domain" in by ? by.domain : by.userId,
           by.userId
         );
-        const entry = outcomeEntryFor(proposal, submittedHere, who, Date.now());
+        const note = await decryptRejectionNote(by);
+        const proposalWithDecryptedNote = {
+          ...proposal,
+          rejectedBy: proposal.rejectedBy ? { ...proposal.rejectedBy, note } : null,
+          approverRejectedBy: proposal.approverRejectedBy ? { ...proposal.approverRejectedBy, note } : void 0
+        };
+        const entry = outcomeEntryFor(proposalWithDecryptedNote, submittedHere, who, Date.now());
         if (entry) state.outcomeOutbox.recordIfNew(entry);
       }
     } catch {
@@ -9297,10 +9452,9 @@ app.listen(port, bindHost, () => {
       const committed = await state.spClient.getCommittedProposals();
       for (const proposal of committed) {
         try {
-          const { text, isError } = await committedExecutor.execute(proposal);
-          console.error(
-            isError ? `[Suveren MCP] Auto-exec proposal ${proposal.id}: ${text}` : `[Suveren MCP] Auto-executed proposal ${proposal.id}: ${proposal.tool}`
-          );
+          const result = await committedExecutor.execute(proposal);
+          const line = describeAutoExecutionLog(proposal.id, proposal.tool, result);
+          if (line) console.error(line);
         } catch (err) {
           console.error(`[Suveren MCP] Failed to execute proposal ${proposal.id}:`, err);
         }