@suveren/gateway 0.32.0 → 0.33.0

package/dist/control-plane/index.mjs

@@ -657,6 +657,20 @@ async function getLocalEvidence() {
   if (!res.ok) throw new Error(`Failed to fetch local evidence: ${res.status}`);
   return res.json();
 }
+async function getTicketContent(ticketId) {
+  const res = await fetch(`${MCP_BASE}/internal/evidence/ticket/${encodeURIComponent(ticketId)}`, {
+    headers: internalHeaders()
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) throw new Error(`Failed to fetch ticket content: ${res.status}`);
+  return res.json();
+}
+async function getTicketHeadlines() {
+  const res = await fetch(`${MCP_BASE}/internal/evidence/headlines`, { headers: internalHeaders() });
+  if (!res.ok) throw new Error(`Failed to fetch ticket headlines: ${res.status}`);
+  const data = await res.json();
+  return data.headlines ?? {};
+}
 var McpLockedError = class extends Error {
   constructor(message) {
     super(message);
@@ -4104,7 +4118,29 @@ function createEvidenceRouter() {
       const authorizationId = entry.authorizationId;
       const authorization = authorizationId ? mergeAuthorizations(evidence)[authorizationId] ?? null : null;
       const signature = (await verifyAll([entry]))[id] ?? "unverifiable";
-      res.json({ entry, authorization, signature });
+      let content = null;
+      try {
+        content = await getTicketContent(id);
+      } catch {
+        content = null;
+      }
+      res.json({
+        entry,
+        authorization,
+        signature,
+        sentArgsCheck: content?.sentArgsCheck ?? "unchecked",
+        result: content?.result ?? null
+      });
+    } catch (err) {
+      res.status(503).json({
+        error: "Local evidence unavailable",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  router.get("/headlines", async (_req, res) => {
+    try {
+      res.json({ headlines: await getTicketHeadlines() });
     } catch (err) {
       res.status(503).json({
         error: "Local evidence unavailable",

package/dist/mcp-server/http.mjs

@@ -1917,6 +1917,13 @@ var ArchiveWriteError = class extends Error {
   }
 };
 var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
+var SENT_ARGS_MAX_BYTES = 64 * 1024;
+function sentArgsFields(args) {
+  if (args === void 0) return {};
+  const json = JSON.stringify(args);
+  if (Buffer.byteLength(json, "utf8") > SENT_ARGS_MAX_BYTES) return { sentArgsOmitted: "too_large" };
+  return { sentArgs: JSON.parse(json) };
+}
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -1977,7 +1984,8 @@ var ReceiptArchive = class {
         asPublicKey: entry.asPublicKey,
         receipt: entry.receipt,
         ...entry.proposal ? { proposal: stripPreviews(entry.proposal) } : {},
-        ...entry.boundContent !== void 0 ? { boundContent: entry.boundContent } : {}
+        ...entry.boundContent !== void 0 ? { boundContent: entry.boundContent } : {},
+        ...sentArgsFields(entry.sentArgs)
       });
       changed = true;
     }
@@ -2289,12 +2297,16 @@ var ExecutionResultStore = class {
   isLocked() {
     return this.vaultKey === null && existsSync9(this.encryptedFilePath);
   }
-  /** Record the outcome of one execution. Replaces any prior entry for the same proposal. */
+  /**
+   * Record the outcome of one execution. Replaces any prior entry for the
+   * same proposal — or, for an automatic execution (no proposalId), for the
+   * same ticket.
+   */
   record(input, now = nowSec2()) {
     const capped = capResult(input.text, input.structuredContent);
-    this.entries = this.entries.filter((e) => e.proposalId !== input.proposalId);
+    this.entries = input.proposalId !== void 0 ? this.entries.filter((e) => e.proposalId !== input.proposalId) : this.entries.filter((e) => e.proposalId !== void 0 || e.ticketId !== input.ticketId);
     this.entries.push({
-      proposalId: input.proposalId,
+      ...input.proposalId !== void 0 ? { proposalId: input.proposalId } : {},
       ticketId: input.ticketId,
       ok: input.ok,
       text: capped.text,
@@ -2309,6 +2321,13 @@ var ExecutionResultStore = class {
   get(proposalId) {
     return this.entries.find((e) => e.proposalId === proposalId);
   }
+  /** The retained outcome of the execution under a ticket (either path), newest first. */
+  getByTicket(ticketId) {
+    for (let i = this.entries.length - 1; i >= 0; i--) {
+      if (this.entries[i].ticketId === ticketId) return this.entries[i];
+    }
+    return void 0;
+  }
   /** Diagnostic / tests. */
   get size() {
     return this.entries.length;
@@ -3334,6 +3353,7 @@ var SharedState = class {
         asPublicKey,
         proposal: opts.proposal,
         boundContent: opts.boundContent,
+        sentArgs: opts.sentArgs,
         authorization: opts.profileId ? {
           profileId: opts.profileId,
           boundsHash: opts.boundsHash,
@@ -6016,7 +6036,12 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           attestations: auth.attestations,
           // Automatic path has no proposal, so without this the archive
           // would hold a hash of content it cannot reproduce.
-          boundContent: binding?.boundContent
+          boundContent: binding?.boundContent,
+          // UI spec §14 — what this call sends, exactly the object the
+          // journal's argsHash is computed from below (`hashToolArgs(args)`),
+          // so the ticket view can show it and check it. Same write, so it
+          // is as fail-closed and as encrypted as the rest of the entry.
+          sentArgs: args
         });
       } catch (err) {
         if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
@@ -6214,9 +6239,11 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + a
         try {
           const result = await integrationManager2.callTool(tool.integrationId, tool.originalName, outgoingArgs);
           state2.executionJournal.complete(receiptId, "done");
+          recordAutomaticOutcome(state2, receiptId, result);
           return result;
         } catch (err) {
           state2.executionJournal.complete(receiptId, "failed");
+          recordAutomaticOutcome(state2, receiptId, void 0, err);
           throw err;
         }
       }
@@ -6224,6 +6251,20 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + a
     }
   });
 }
+function recordAutomaticOutcome(state2, ticketId, result, thrown) {
+  try {
+    if (!result) {
+      const msg = thrown instanceof Error ? thrown.message : String(thrown);
+      state2.executionResults?.record({ ticketId, ok: false, text: `The tool call threw: ${msg}` });
+      return;
+    }
+    const text = result.content?.[0]?.text ?? JSON.stringify(result);
+    const structured = result.structuredContent && typeof result.structuredContent === "object" && !Array.isArray(result.structuredContent) ? result.structuredContent : void 0;
+    state2.executionResults?.record({ ticketId, ok: result.isError !== true, text, structuredContent: structured });
+  } catch (err) {
+    console.error(`[Suveren MCP] Could not record the execution result for ticket ${ticketId}:`, err);
+  }
+}
 function noMandateRefusal(toolName, profile) {
   return `Refused: no mandate covers ${toolName} (${shortProfile(profile)}). Nothing was done. Ask the person to grant a ${shortProfile(profile)} mandate in the gateway, then try again. No ticket was requested.`;
 }
@@ -8274,7 +8315,14 @@ var IntegrationManager = class {
   getToolDisplay() {
     const out = {};
     for (const t of this.getAllTools()) {
-      out[t.namespacedName] = { inputSchema: t.inputSchema, ...t.gating?.approvalView ? { approvalView: t.gating.approvalView } : {} };
+      const mapping = t.gating?.executionMapping;
+      out[t.namespacedName] = {
+        inputSchema: t.inputSchema,
+        ...t.gating?.approvalView ? { approvalView: t.gating.approvalView } : {},
+        // UI spec §14.1 — which sent values the signed ticket also carries
+        // (arg → executionContext field), for the "in the ticket" tag.
+        ...mapping && Object.keys(mapping).length > 0 ? { executionMapping: mapping } : {}
+      };
     }
     return out;
   }
@@ -9999,6 +10047,52 @@ function isAlive(pid) {
   }
 }
 
+// src/lib/ticket-content.ts
+function archivedArgs(entry) {
+  if (entry.sentArgs && typeof entry.sentArgs === "object") return { args: entry.sentArgs, source: "sent" };
+  const toolArgs = entry.proposal?.toolArgs;
+  if (toolArgs && typeof toolArgs === "object" && !Array.isArray(toolArgs)) {
+    return { args: toolArgs, source: "proposal" };
+  }
+  return void 0;
+}
+function checkSentArgs(entry, journalRow) {
+  const found = archivedArgs(entry);
+  if (!found || !journalRow?.argsHash) return "unchecked";
+  if (hashToolArgs(found.args) === journalRow.argsHash) return "match";
+  if (found.source === "proposal" && typeof found.args.imagePath === "string") return "unchecked";
+  return "mismatch";
+}
+function resultView(entry) {
+  if (!entry) return null;
+  return {
+    ok: entry.ok,
+    text: entry.text,
+    ...entry.structuredContent ? { structuredContent: entry.structuredContent } : {},
+    ...entry.truncated ? { truncated: true } : {}
+  };
+}
+function trimForHeadline(value, max = 200) {
+  if (typeof value === "string") return value.length > max ? value.slice(0, max) : value;
+  if (Array.isArray(value)) return value.map((v) => trimForHeadline(v, max));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = trimForHeadline(v, max);
+    return out;
+  }
+  return value;
+}
+function headlineArgs(entries) {
+  const out = {};
+  for (const e of entries) {
+    const id = e.receipt?.id;
+    if (typeof id !== "string" || e.proposal) continue;
+    const src = e.sentArgs ?? (e.boundContent && typeof e.boundContent === "object" ? e.boundContent : void 0);
+    if (src) out[id] = trimForHeadline(src);
+  }
+  return out;
+}
+
 // bin/http.ts
 import { homedir as homedir14 } from "os";
 import { join as join23 } from "path";
@@ -10535,6 +10629,35 @@ app.get("/internal/evidence", internalOnly, (_req, res) => {
     gates: state.gateStore.getAll()
   });
 });
+app.get("/internal/evidence/ticket/:id", internalOnly, (req, res) => {
+  if (state.receiptArchive.isLocked() || state.executionResults.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 the evidence archive is encrypted until sign-in." });
+    return;
+  }
+  const id = String(req.params.id);
+  const entry = state.receiptArchive.getReceipts().find((r) => r.receipt.id === id);
+  if (!entry) {
+    res.status(404).json({ error: "No local copy of this ticket" });
+    return;
+  }
+  let journalRow;
+  try {
+    journalRow = state.executionJournal.get(id);
+  } catch {
+    journalRow = void 0;
+  }
+  res.json({
+    sentArgsCheck: checkSentArgs(entry, journalRow),
+    result: resultView(state.executionResults.getByTicket(id))
+  });
+});
+app.get("/internal/evidence/headlines", internalOnly, (_req, res) => {
+  if (state.receiptArchive.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 the evidence archive is encrypted until sign-in." });
+    return;
+  }
+  res.json({ headlines: headlineArgs(state.receiptArchive.getReceipts()) });
+});
 function reportScope() {
   return scopeReportSources(reportSources, {
     authorizations: state.getEnrichedAuthorizations(),