@suveren/gateway 0.4.0 → 0.5.0

package/bin/suveren-gateway.js

@@ -11,6 +11,7 @@
  */
 
 import { spawn, spawnSync } from 'node:child_process';
+import { createConnection } from 'node:net';
 import { existsSync, mkdirSync, openSync, readFileSync, writeFileSync, unlinkSync, statSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
@@ -60,6 +61,24 @@ async function start(args) {
     process.exit(1);
   }
 
+  // The PID file only knows about instances THIS CLI started. A gateway
+  // started by the login service — or from another shell — leaves none, so the
+  // check above passes, we spawn, the child dies instantly with EADDRINUSE,
+  // and its error goes only to the log. The user gets "started (pid N)" for a
+  // process that is already dead. Ask the port, not just the file.
+  if (await isPortListening(SUVEREN_PORT)) {
+    console.error(`Port ${SUVEREN_PORT} is already in use.`);
+    console.error(``);
+    console.error(`Something is already serving there — most likely a gateway started by the`);
+    console.error(`login service or from another terminal, which leaves no PID file for this`);
+    console.error(`CLI to find.`);
+    console.error(``);
+    console.error(`  Check what it is:      suveren-gateway status`);
+    console.error(`  Stop a login service:  suveren-gateway service uninstall`);
+    console.error(`  Or use another port:   SUVEREN_CP_PORT=3410 suveren-gateway start`);
+    process.exit(1);
+  }
+
   ensureDataDir();
 
   if (detach) {
@@ -71,6 +90,24 @@ async function start(args) {
     });
     writeFileSync(PID_FILE, String(child.pid), 'utf8');
     child.unref();
+
+    // "started" must mean SERVING. A detached child that dies on startup takes
+    // its error to the log, so reporting success on spawn alone hands the user
+    // a pid that no longer exists and a browser tab that will not connect.
+    const serving = await waitForListening(SUVEREN_PORT, 20_000);
+    if (!serving) {
+      safeUnlink(PID_FILE);
+      console.error(`suveren-gateway failed to start — nothing is listening on ${SUVEREN_PORT}.`);
+      console.error(``);
+      console.error(`  Log:  ${LOG_FILE}`);
+      console.error(`  Last lines:`);
+      try {
+        const tail = readFileSync(LOG_FILE, 'utf8').trimEnd().split('\n').slice(-8);
+        for (const line of tail) console.error(`    ${line}`);
+      } catch { /* no log yet */ }
+      process.exit(1);
+    }
+
     console.log(`suveren-gateway started (pid ${child.pid})`);
     console.log(``);
     console.log(`  → Open in your browser:  http://localhost:${SUVEREN_PORT}`);
@@ -532,6 +569,28 @@ function serviceImplFor(os) {
   }
 }
 
+/** Is something accepting TCP connections on this port? */
+function isPortListening(port, timeoutMs = 1_000) {
+  return new Promise(resolve => {
+    const socket = createConnection({ host: '127.0.0.1', port: Number(port) });
+    const done = (result) => { socket.destroy(); resolve(result); };
+    socket.setTimeout(timeoutMs);
+    socket.once('connect', () => done(true));
+    socket.once('timeout', () => done(false));
+    socket.once('error', () => done(false));
+  });
+}
+
+/** Poll until the port accepts connections, or give up. */
+async function waitForListening(port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await isPortListening(port, 500)) return true;
+    await sleep(300);
+  }
+  return false;
+}
+
 /** Run a command capturing output, never throwing. */
 function runQuiet(bin, args) {
   const r = spawnSync(bin, args, { encoding: 'utf8' });

package/content/integrations/calendar.json

@@ -5,6 +5,9 @@
   "description": "List, create, update, and delete events in Google Calendar",
   "icon": "calendar",
   "profile": "calendar",
+  "readPolicy": {
+    "defaultAgeDays": 30
+  },
   "npmPackage": "@humanagencyp/google-calendar-mcp",
   "mcp": {
     "command": "google-calendar-mcp",
@@ -12,8 +15,18 @@
   },
   "credentials": {
     "fields": [
-      { "key": "clientId", "label": "Client ID", "type": "text", "placeholder": "From Google Cloud Console" },
-      { "key": "clientSecret", "label": "Client Secret", "type": "password", "placeholder": "OAuth2 client secret" }
+      {
+        "key": "clientId",
+        "label": "Client ID",
+        "type": "text",
+        "placeholder": "From Google Cloud Console"
+      },
+      {
+        "key": "clientSecret",
+        "label": "Client Secret",
+        "type": "password",
+        "placeholder": "OAuth2 client secret"
+      }
     ],
     "envMapping": {
       "GOOGLE_CLIENT_ID": "clientId",
@@ -30,9 +43,15 @@
       "https://www.googleapis.com/auth/calendar.events",
       "https://www.googleapis.com/auth/calendar.readonly"
     ],
-    "credentialKeys": { "clientId": "clientId", "clientSecret": "clientSecret" },
+    "credentialKeys": {
+      "clientId": "clientId",
+      "clientSecret": "clientSecret"
+    },
     "tokenStorage": "refreshToken",
-    "extraParams": { "access_type": "offline", "prompt": "consent" }
+    "extraParams": {
+      "access_type": "offline",
+      "prompt": "consent"
+    }
   },
   "contextDiscovery": {
     "allowed_calendars": {
@@ -53,52 +72,103 @@
   "toolGating": {
     "default": {
       "executionMapping": {},
-      "staticExecution": { "duration": 0, "lookahead": 0 }
+      "staticExecution": {
+        "duration": 0,
+        "lookahead": 0
+      }
     },
     "overrides": {
       "list_calendars": {
         "category": "read",
-        "read": { "resourceBound": "allowed_calendars", "resultResourcePath": "id" }
+        "read": {
+          "resourceBound": "allowed_calendars",
+          "resultResourcePath": "id"
+        }
       },
       "list_events": {
         "category": "read",
-        "read": { "resourceBound": "allowed_calendars", "resourceArg": "calendarId", "resourceDefault": "primary" }
+        "read": {
+          "resourceBound": "allowed_calendars",
+          "resourceArg": "calendarId",
+          "resourceDefault": "primary",
+          "ageField": "read_age_days",
+          "ageFloorArg": "timeMin",
+          "ageFloorFormat": "iso"
+        }
       },
       "get_event": {
         "category": "read",
-        "read": { "resourceBound": "allowed_calendars", "resourceArg": "calendarId", "resourceDefault": "primary" }
+        "read": {
+          "resourceBound": "allowed_calendars",
+          "resourceArg": "calendarId",
+          "resourceDefault": "primary",
+          "ageField": "read_age_days",
+          "resultDatePath": [
+            "start.dateTime",
+            "start.date"
+          ]
+        }
       },
       "free_busy": {
         "category": "read",
-        "read": { "resourceBound": "allowed_calendars", "resourceArrayArg": "calendarIds", "resourceDefault": "primary" }
+        "read": {
+          "resourceBound": "allowed_calendars",
+          "resourceArrayArg": "calendarIds",
+          "resourceDefault": "primary",
+          "ageField": "read_age_days",
+          "ageFloorArg": "timeMin",
+          "ageFloorFormat": "iso"
+        }
       },
       "create_event": {
         "executionMapping": {
           "duration_minutes": "duration",
           "lookahead_days": "lookahead",
           "attendees": [
-            { "field": "allowed_attendees", "transform": "join" },
-            { "field": "allowed_domains", "transform": "join_domains" }
+            {
+              "field": "allowed_attendees",
+              "transform": "join"
+            },
+            {
+              "field": "allowed_domains",
+              "transform": "join_domains"
+            }
           ],
           "calendarId": "allowed_calendars"
         },
-        "staticExecution": { "action_type": "booking" }
+        "staticExecution": {
+          "action_type": "booking"
+        }
       },
       "update_event": {
         "executionMapping": {
           "attendees": [
-            { "field": "allowed_attendees", "transform": "join" },
-            { "field": "allowed_domains", "transform": "join_domains" }
+            {
+              "field": "allowed_attendees",
+              "transform": "join"
+            },
+            {
+              "field": "allowed_domains",
+              "transform": "join_domains"
+            }
           ],
           "calendarId": "allowed_calendars"
         },
-        "staticExecution": { "action_type": "booking", "duration": 0, "lookahead": 0 }
+        "staticExecution": {
+          "action_type": "booking",
+          "duration": 0,
+          "lookahead": 0
+        }
       },
       "delete_event": {
         "executionMapping": {
           "calendarId": "allowed_calendars"
         },
-        "staticExecution": { "action_type": "delete", "duration": 0, "lookahead": 0 }
+        "staticExecution": {
+          "action_type": "delete",
+          "duration": 0,
+          "lookahead": 0
+        }
       }
     }
   },
@@ -108,22 +178,46 @@
       "description": "List and read events, check free/busy. No create, update, or delete.",
       "risk": "low",
       "mode": "automatic",
-      "bounds": { "booking_daily_max": "0", "booking_duration_max": "0", "lookahead_days_max": "0" },
-      "context": { "allowed_calendars": "primary", "allowed_attendees": "", "allowed_domains": "" },
+      "bounds": {
+        "booking_daily_max": "0",
+        "booking_duration_max": "0",
+        "lookahead_days_max": "0"
+      },
+      "context": {
+        "allowed_calendars": "primary",
+        "allowed_attendees": "",
+        "allowed_domains": ""
+      },
       "intent": "Allow the agent to read the primary calendar (only) to help with scheduling suggestions. No create or modify. To read other calendars, add them to allowed_calendars.",
       "ttl": 2592000,
-      "tags": ["read-only", "30 days"]
+      "tags": [
+        "read-only",
+        "30 days"
+      ]
     },
     {
       "name": "Book with Review",
       "description": "Read events and propose new bookings. Every create/update/delete requires your approval.",
       "risk": "high",
       "mode": "review",
-      "bounds": { "booking_daily_max": "3", "booking_duration_max": "120", "lookahead_days_max": "30" },
-      "context": { "allowed_calendars": "primary", "allowed_attendees": "", "allowed_domains": "" },
+      "bounds": {
+        "booking_daily_max": "3",
+        "booking_duration_max": "120",
+        "lookahead_days_max": "30"
+      },
+      "context": {
+        "allowed_calendars": "primary",
+        "allowed_attendees": "",
+        "allowed_domains": ""
+      },
       "intent": "Read my calendar and propose bookings. Every create, update, or delete requires my review — I see the title, time, duration, and attendees before it goes through.",
       "ttl": 2592000,
-      "tags": ["3 bookings/day", "2h max", "30d lookahead", "review mode"]
+      "tags": [
+        "3 bookings/day",
+        "2h max",
+        "30d lookahead",
+        "review mode"
+      ]
     }
   ],
   "setupHint": "Create OAuth credentials at Google Cloud Console and enable the Google Calendar API.",

package/content/integrations/gmail.json

@@ -6,6 +6,9 @@
   "icon": "mail",
   "profile": "email",
   "npmPackage": "@shinzolabs/gmail-mcp",
+  "readPolicy": {
+    "defaultAgeDays": 30
+  },
   "mcp": {
     "command": "gmail-mcp",
     "args": [],

package/dist/control-plane/index.mjs

@@ -6,7 +6,7 @@ import {
 // src/index.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import { existsSync as existsSync5, readFileSync as readFileSync4, renameSync } from "fs";
-import { join as join4 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { homedir as homedir3 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
@@ -356,6 +356,7 @@ async function activateIntegration(manifest) {
     profile: manifest.profile,
     toolGating: manifest.toolGating,
     npmPackage: manifest.npmPackage,
+    ...typeof manifest.readPolicy?.defaultAgeDays === "number" ? { readAgeDays: manifest.readPolicy.defaultAgeDays } : {},
     enabled: true
   });
 }
@@ -391,6 +392,18 @@ async function removeIntegration(id) {
   }
   return res.json();
 }
+async function setReadPolicy(id, readAgeDays) {
+  const res = await fetch(`${MCP_BASE}/internal/integration/${encodeURIComponent(id)}/read-policy`, {
+    method: "PATCH",
+    headers: { ...internalHeaders(), "Content-Type": "application/json" },
+    body: JSON.stringify({ readAgeDays })
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({ error: "Unknown error" }));
+    throw new Error(err.error);
+  }
+  return res.json();
+}
 async function getGateContent(path) {
   const qs = path ? `?path=${encodeURIComponent(path)}` : "";
   const res = await fetch(`${MCP_BASE}/internal/gate-content${qs}`, {
@@ -1364,6 +1377,30 @@ function requireAuthQueryOrHeader(vault2) {
   };
 }
 
+// src/lib/read-policy-defaults.ts
+async function backfillReadPolicyDefaults(data) {
+  const defaults = /* @__PURE__ */ new Map();
+  for (const m of data.manifests ?? []) {
+    const days = m.readPolicy?.defaultAgeDays;
+    if (typeof m.id === "string" && typeof days === "number" && Number.isInteger(days) && days >= 0) {
+      defaults.set(m.id, days);
+    }
+  }
+  if (defaults.size === 0) return;
+  try {
+    const current = await getIntegrations();
+    for (const integration of current.integrations ?? []) {
+      const fallback = defaults.get(integration.id);
+      if (fallback === void 0) continue;
+      if (integration.readAgeDays != null) continue;
+      await setReadPolicy(integration.id, fallback);
+      console.error(`[Control Plane]   Read policy default applied: ${integration.id} \u2192 ${fallback}d`);
+    }
+  } catch (err) {
+    console.error(`[Control Plane] \u26A0 Could not apply read-policy defaults: ${err instanceof Error ? err.message : err}`);
+  }
+}
+
 // src/routes/mcp.ts
 import { Router as Router5 } from "express";
 
@@ -1471,15 +1508,15 @@ import { promisify } from "util";
 var run = promisify(execFile);
 var SUPPORTED = /* @__PURE__ */ new Set(["darwin", "win32", "linux"]);
 var MODULE_DIR = pathDirname(fileURLToPath(import.meta.url));
-function findCli(dirname3 = MODULE_DIR) {
+function findCli(dirname4 = MODULE_DIR) {
   const candidates = [
     // Bundled (the shipped layout): dist/control-plane → dist → root → bin
-    resolve(dirname3, "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname4, "..", "..", "bin", "suveren-gateway.js"),
     // Bundled, were the routes/ directory ever preserved.
-    resolve(dirname3, "..", "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname4, "..", "..", "..", "bin", "suveren-gateway.js"),
     // Dev, running from source: the repo's own bundle directory.
-    resolve(dirname3, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
-    resolve(dirname3, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
+    resolve(dirname4, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
+    resolve(dirname4, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
     // Deliberately NO process.cwd() fallback: it makes the result depend on
     // where the process happened to be launched from, so the same install
     // resolves differently between a shell and a login service — and it would
@@ -2195,6 +2232,21 @@ app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
+app.put("/integrations/:id/read-policy", jsonParser, authGuard, async (req, res) => {
+  const id = req.params.id;
+  const { readAgeDays } = req.body ?? {};
+  if (readAgeDays !== null && !(typeof readAgeDays === "number" && Number.isInteger(readAgeDays) && readAgeDays >= 0)) {
+    res.status(400).json({ error: "readAgeDays must be a non-negative integer, or null to clear it" });
+    return;
+  }
+  try {
+    const result = await setReadPolicy(id, readAgeDays);
+    res.json(result);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    res.status(502).json({ error: `Could not set read policy: ${message}` });
+  }
+});
 app.get("/integrations/:id/discover/:field", authGuard, async (req, res) => {
   const integrationId = req.params.id;
   const fieldName = req.params.field;
@@ -2425,7 +2477,14 @@ function detectInstallMethod() {
   if (existsSync5("/.dockerenv")) return "docker";
   const dir = import.meta.dirname ?? __dirname;
   if (dir.includes("/node_modules/@suveren/gateway/")) return "npm";
-  return "dev";
+  let cursor = dir;
+  for (let i = 0; i < 8; i++) {
+    if (existsSync5(join4(cursor, ".git"))) return "dev";
+    const parent = dirname3(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return "npm";
 }
 var INSTALL_METHOD = detectInstallMethod();
 function detectRunningVersion() {
@@ -2500,6 +2559,7 @@ app.listen(port, "0.0.0.0", () => {
       console.error(`[Control Plane] \u26A0 MCP server at ${MCP_BASE} returned 0 integration manifests \u2014 wrong SUVEREN_MCP_INTERNAL_URL? (dev MCP is :3431, npm is :3430)`);
     } else {
       console.error(`[Control Plane]   Integrations: ${n} manifests loaded from ${MCP_BASE}`);
+      void backfillReadPolicyDefaults(d);
     }
   }).catch((err) => {
     console.error(`[Control Plane] \u26A0 Could not reach MCP server at ${MCP_BASE} for manifests \u2014 wrong SUVEREN_MCP_INTERNAL_URL? (dev=:3431, npm=:3430). ${err instanceof Error ? err.message : err}`);

package/dist/mcp-server/http.mjs

@@ -1332,6 +1332,29 @@ function getByDottedPath(obj, path) {
     obj
   );
 }
+function firstParsableDate(obj, paths) {
+  for (const path of Array.isArray(paths) ? paths : [paths]) {
+    const parsed = parseMessageTimestamp(getByDottedPath(obj, path));
+    if (parsed !== null) return parsed;
+  }
+  return null;
+}
+function renderAgeConstraint(template, maxAgeDays, nowMs) {
+  const floorIso = new Date(nowMs - maxAgeDays * MS_PER_DAY).toISOString();
+  return template.replace(/\{days\}/g, String(maxAgeDays)).replace(/\{date\}/g, floorIso.slice(0, 10));
+}
+function ageFloorValue(maxAgeDays, nowMs, format = "iso") {
+  const floorMs = nowMs - maxAgeDays * MS_PER_DAY;
+  if (format === "epoch_ms") return floorMs;
+  if (format === "epoch_s") return String(Math.floor(floorMs / 1e3));
+  return new Date(floorMs).toISOString();
+}
+function clampAgeFloor(requested, maxAgeDays, nowMs, format = "iso") {
+  const floorMs = nowMs - maxAgeDays * MS_PER_DAY;
+  const asked = parseMessageTimestamp(requested);
+  if (asked !== null && asked >= floorMs) return requested;
+  return ageFloorValue(maxAgeDays, nowMs, format);
+}
 
 // src/lib/tool-proxy.ts
 import { getProfile as getProfile3 } from "@hap/core";
@@ -1494,18 +1517,20 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
       const readProfile = readAdapter ? getProfile3(matchingAuths[0].profileId) : void 0;
       const boundsSchema = readProfile?.boundsSchema;
       const ageBoundField = readAdapter?.ageField ? resolveAgeBoundField(boundsSchema, readAdapter.ageField) : null;
+      const hasAgeDimension = Boolean(readAdapter?.ageField);
       let readMaxAge = null;
-      if (ageBoundField) {
-        readMaxAge = maxReadAgeDays(
+      if (hasAgeDimension) {
+        const localAge = integrationManager2.getReadAgeDays(tool.integrationId);
+        readMaxAge = localAge ?? (ageBoundField ? maxReadAgeDays(
           matchingAuths.map((a) => a.bounds ?? a.frame),
           ageBoundField
-        );
+        ) : null);
         if (readMaxAge === null) {
           return denyRead(
             state2,
             tool,
             "unset_age",
-            `no read-age window is set on your authorization (${ageBoundField}). Reads are not permitted with an unbounded window \u2014 set how far back the agent may read, then try again. Nothing was read.`
+            `no read-age window is set for this integration${ageBoundField ? ` (or on your authorization's ${ageBoundField})` : ""}. Reads are not permitted with an unbounded window \u2014 set how far back the agent may read under the integration's Read policy, then try again. Nothing was read.`
           );
         }
       }
@@ -1540,10 +1565,21 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
       if (readAdapter?.pinnedArgs) {
         outgoing = { ...outgoing, ...readAdapter.pinnedArgs };
       }
+      if (readAdapter?.ageFloorArg && hasAgeDimension && readMaxAge !== null) {
+        outgoing = {
+          ...outgoing,
+          [readAdapter.ageFloorArg]: clampAgeFloor(
+            outgoing[readAdapter.ageFloorArg],
+            readMaxAge,
+            Date.now(),
+            readAdapter.ageFloorFormat
+          )
+        };
+      }
       if (readAdapter?.queryArg) {
         const clauses = [];
-        if (ageBoundField && readAdapter.ageConstraint && readMaxAge !== null) {
-          clauses.push(readAdapter.ageConstraint.replace("{days}", String(readMaxAge)));
+        if (hasAgeDimension && readAdapter.ageConstraint && readMaxAge !== null) {
+          clauses.push(renderAgeConstraint(readAdapter.ageConstraint, readMaxAge, Date.now()));
         }
         if (clauses.length > 0) {
           const base = typeof args[readAdapter.queryArg] === "string" ? args[readAdapter.queryArg] : "";
@@ -1581,10 +1617,10 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
           );
         }
       }
-      if (readAdapter && ageBoundField && readAdapter.resultDatePath && readMaxAge !== null) {
+      if (readAdapter && hasAgeDimension && readAdapter.resultDatePath && readMaxAge !== null) {
         const parsed = parseFirstJson(result);
-        const rawDate = parsed === void 0 ? void 0 : getByDottedPath(parsed, readAdapter.resultDatePath);
-        if (isOlderThanMaxAge(parseMessageTimestamp(rawDate), readMaxAge, Date.now())) {
+        const itemDate = parsed === void 0 ? null : firstParsableDate(parsed, readAdapter.resultDatePath);
+        if (isOlderThanMaxAge(itemDate, readMaxAge, Date.now())) {
           return denyRead(
             state2,
             tool,
@@ -2571,6 +2607,10 @@ function ensureIntegrationsDir() {
     writeFileSync5(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
+function readAgeOf(config) {
+  const days = config.readAgeDays;
+  return typeof days === "number" && Number.isFinite(days) && days >= 0 ? days : null;
+}
 var RESPAWN_DELAYS = [2e3, 4e3, 6e3];
 var MAX_RESPAWN_ATTEMPTS = 3;
 var CONNECT_TIMEOUT_MS = 3e4;
@@ -2838,14 +2878,32 @@ var IntegrationManager = class {
     return tools;
   }
   /**
-   * RESERVED / NOT YET WIRED (see IntegrationConfig.readAgeDays). The local
-   * read-age window (days) for a running integration, for a deferred feature
-   * that moves the read age off the signed grant. The read path does NOT call
-   * this yet — it still enforces the signed `read_max_age_days` bound.
+   * The LOCAL read-age window (days) for a running integration, or null when
+   * none is set here (the read path then falls back to the signed grant bound
+   * — see `IntegrationConfig.readAgeDays`).
+   *
+   * 0 is a real value ("read nothing") and MUST survive this call, so the
+   * guard tests the type, never truthiness.
    */
   getReadAgeDays(integrationId) {
-    const days = this.running.get(integrationId)?.config.readAgeDays;
-    return typeof days === "number" && Number.isFinite(days) ? days : null;
+    const config = this.running.get(integrationId)?.config;
+    return config ? readAgeOf(config) : null;
+  }
+  /**
+   * Apply a new local read-age window to the RUNNING snapshot, so the change
+   * takes effect on the next read without restarting the subprocess. Read
+   * policy is enforced gateway-side and never reaches the downstream MCP
+   * server, so nothing has to be re-spawned.
+   *
+   * Persistence is the registry's job — callers update both. Returns false if
+   * the integration is not running (registry-only update still applies).
+   */
+  setReadAgeDays(integrationId, days) {
+    const entry = this.running.get(integrationId);
+    if (!entry) return false;
+    if (days === null) delete entry.config.readAgeDays;
+    else entry.config.readAgeDays = days;
+    return true;
   }
   /**
    * Get status info for all known integrations.
@@ -2857,7 +2915,8 @@ var IntegrationManager = class {
         id: entry.config.id,
         name: entry.config.name,
         running: true,
-        toolCount: entry.tools.length
+        toolCount: entry.tools.length,
+        readAgeDays: readAgeOf(entry.config)
       });
     }
     if (allConfigs) {
@@ -2867,7 +2926,8 @@ var IntegrationManager = class {
             id: config.id,
             name: config.name,
             running: false,
-            toolCount: 0
+            toolCount: 0,
+            readAgeDays: readAgeOf(config)
           });
         }
       }
@@ -3325,6 +3385,27 @@ app.delete("/internal/remove-integration/:id", internalOnly, async (req, res) =>
   console.error(`[Suveren MCP] Integration ${id} removed`);
   res.json({ ok: true, id });
 });
+app.patch("/internal/integration/:id/read-policy", internalOnly, (req, res) => {
+  const id = req.params.id;
+  const raw = req.body.readAgeDays;
+  let readAgeDays;
+  if (raw === null) {
+    readAgeDays = null;
+  } else if (typeof raw === "number" && Number.isInteger(raw) && raw >= 0) {
+    readAgeDays = raw;
+  } else {
+    res.status(400).json({ error: "readAgeDays must be a non-negative integer, or null to clear it" });
+    return;
+  }
+  const updated = integrationRegistry.update(id, { readAgeDays: readAgeDays ?? void 0 });
+  if (!updated) {
+    res.status(404).json({ error: `Integration "${id}" not found` });
+    return;
+  }
+  integrationManager.setReadAgeDays(id, readAgeDays);
+  console.error(`[Suveren MCP] Read policy for ${id}: ${readAgeDays === null ? "cleared" : `${readAgeDays}d`}`);
+  res.json({ ok: true, id, readAgeDays });
+});
 app.get("/internal/integrations", internalOnly, (_req, res) => {
   const configs = integrationRegistry.getAll();
   const statuses = integrationManager.getStatus(configs);