@suveren/gateway 0.7.3 → 0.7.6

package/content/integrations/gmail.json

@@ -216,8 +216,7 @@
       "bounds": {
         "recipient_max": "0",
         "send_daily_max": "0",
-        "read_max_age_days": "30",
-        "read_daily_max": "100"
+        "read_max_age_days": "30"
       },
       "context": {
         "allowed_recipients": "",
@@ -227,8 +226,7 @@
       "ttl": 2592000,
       "tags": [
         "read-only",
-        "30 days",
-        "100 reads/day"
+        "30 days"
       ]
     },
     {
@@ -239,8 +237,7 @@
       "bounds": {
         "recipient_max": "5",
         "send_daily_max": "20",
-        "read_max_age_days": "90",
-        "read_daily_max": "200"
+        "read_max_age_days": "90"
       },
       "context": {
         "allowed_recipients": "",

package/dist/control-plane/index.mjs

@@ -419,6 +419,13 @@ async function getEnrichedAuthorizations() {
   if (!res.ok) throw new Error("Failed to fetch authorizations");
   return res.json();
 }
+async function getLocalEvidence() {
+  const res = await fetch(`${MCP_BASE}/internal/evidence`, {
+    headers: internalHeaders()
+  });
+  if (!res.ok) throw new Error(`Failed to fetch local evidence: ${res.status}`);
+  return res.json();
+}
 async function getMcpHealth() {
   const res = await fetch(`${MCP_BASE}/health`);
   if (!res.ok) throw new Error("MCP server unreachable");
@@ -865,6 +872,7 @@ function createVaultRouter(vault2) {
 import { Router as Router3 } from "express";
 
 // src/lib/ai-client.ts
+var CHAT_TOKEN_BUDGET = 4e3;
 var PROVIDER_PRESETS = {
   ollama: {
     provider: "ollama",
@@ -892,6 +900,30 @@ var PROVIDER_PRESETS = {
     model: "meta-llama/Llama-3-8b-chat-hf"
   }
 };
+function explainEmptyReply(choice, usage, budget) {
+  const reasoningTokens = usage?.completion_tokens_details?.reasoning_tokens ?? 0;
+  const finish = choice?.finish_reason;
+  const hadReasoning = reasoningTokens > 0 || Boolean(choice?.message?.reasoning_content || choice?.message?.reasoning);
+  if (finish === "length" && hadReasoning) {
+    return `The model is a reasoning model and spent its whole ${budget}-token budget` + (reasoningTokens ? ` (${reasoningTokens} tokens)` : "") + " thinking, leaving nothing for the answer. Raise the token limit or choose a non-reasoning model in Settings.";
+  }
+  if (finish === "length") {
+    return `The model hit the ${budget}-token limit before writing any answer.`;
+  }
+  if (hadReasoning) {
+    return "The model returned only internal reasoning and no answer \u2014 it may not be compatible with this endpoint. Try a different model in Settings.";
+  }
+  if (finish === "content_filter") {
+    return "The provider's content filter blocked the response.";
+  }
+  if (choice?.message?.tool_calls?.length) {
+    return "The model tried to call a tool instead of answering. Choose a model without forced tool use.";
+  }
+  if (!choice) {
+    return "The provider returned no choices. Check the model name in Settings.";
+  }
+  return `The model returned an empty answer${finish ? ` (finish_reason: ${finish})` : ""}.`;
+}
 var SYSTEM_PROMPTS = {
   intent: `You are a reviewing assistant helping a human articulate their intent for an AI agent authorization.
 
@@ -1062,13 +1094,20 @@ ${request.currentText}
           model: config.model,
           messages,
           stream: false,
-          options: { temperature: 0.3, num_predict: 600 }
+          options: { temperature: 0.3, num_predict: CHAT_TOKEN_BUDGET }
         }),
         signal: AbortSignal.timeout(6e4)
       });
       if (!response.ok) throw new Error(`Ollama: ${response.status}`);
       const data = await response.json();
-      reply = data.message?.content?.trim() || "No response generated.";
+      const content = data.message?.content?.trim();
+      if (!content) {
+        return {
+          success: false,
+          error: data.message?.thinking ? "The model returned only internal reasoning and no answer. Try a non-thinking model." : `The model returned an empty answer. Check that "${config.model}" is pulled and running in Ollama.`
+        };
+      }
+      reply = content;
     } else {
       const headers = { "Content-Type": "application/json" };
       if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
@@ -1079,7 +1118,10 @@ ${request.currentText}
           model: config.model,
           messages,
           temperature: 0.3,
-          max_tokens: 600
+          // Reasoning models charge their thinking against this same budget,
+          // so a small number here produces an empty answer rather than a
+          // short one. 4000 leaves room to think AND reply.
+          max_tokens: CHAT_TOKEN_BUDGET
         }),
         signal: AbortSignal.timeout(6e4)
       });
@@ -1088,7 +1130,14 @@ ${request.currentText}
         throw new Error(`AI provider: ${response.status} - ${errorText}`);
       }
       const data = await response.json();
-      reply = data.choices?.[0]?.message?.content?.trim() || "No response generated.";
+      const content = data.choices?.[0]?.message?.content?.trim();
+      if (!content) {
+        return {
+          success: false,
+          error: explainEmptyReply(data.choices?.[0], data.usage, CHAT_TOKEN_BUDGET)
+        };
+      }
+      reply = content;
     }
     return { success: true, reply };
   } catch (error) {
@@ -1893,49 +1942,11 @@ function createEncryptIntentRouter() {
   return router;
 }
 
-// src/routes/decrypt-intent.ts
-import { Router as Router8 } from "express";
-function createDecryptIntentRouter(vault2) {
-  const router = Router8();
-  router.post("/", async (req, res) => {
-    const { intentCiphertext, encryptedKey, approverId } = req.body;
-    if (typeof intentCiphertext !== "string" || intentCiphertext.length === 0) {
-      res.status(400).json({ error: "Missing or invalid field: intentCiphertext (base64 string)" });
-      return;
-    }
-    if (typeof encryptedKey !== "object" || encryptedKey === null || typeof encryptedKey.ct !== "string" || typeof encryptedKey.enc !== "string") {
-      res.status(400).json({ error: "Missing or invalid field: encryptedKey ({ ct: string; enc: string })" });
-      return;
-    }
-    if (typeof approverId !== "string" || approverId.length === 0) {
-      res.status(400).json({ error: "Missing or invalid field: approverId (string)" });
-      return;
-    }
-    try {
-      const kp = await loadOrGenerateKeyPair(vault2);
-      const { ct, enc } = encryptedKey;
-      const encrypted = {
-        intentCiphertext: new Uint8Array(Buffer.from(intentCiphertext, "base64")),
-        encryptedKeys: {
-          [approverId]: {
-            ct: new Uint8Array(Buffer.from(ct, "base64")),
-            enc: new Uint8Array(Buffer.from(enc, "base64"))
-          }
-        }
-      };
-      const intent = await decryptIntent(encrypted, approverId, kp.privateKey);
-      res.json({ intent });
-    } catch (err) {
-      console.error("[Control Plane] decrypt-intent error:", err);
-      const msg = err instanceof Error ? err.message : "Decryption failed";
-      res.status(500).json({ error: msg });
-    }
-  });
-  return router;
-}
+// src/routes/evidence-export.ts
+import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
-import { Router as Router9 } from "express";
+import { Router as Router8 } from "express";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join3 } from "path";
@@ -1955,19 +1966,22 @@ function writeFile(data) {
   mkdirSync3(SUVEREN_DATA_DIR, { recursive: true });
   writeFileSync3(FILE_PATH, JSON.stringify(data, null, 2), "utf-8");
 }
+function readApprovedIntents(vault2) {
+  const file = readFile();
+  const result = {};
+  for (const [authorityId, blob] of Object.entries(file.entries)) {
+    try {
+      result[authorityId] = vault2.decrypt(blob);
+    } catch {
+    }
+  }
+  return result;
+}
 function createApprovedIntentsRouter(vault2) {
-  const router = Router9();
+  const router = Router8();
   router.get("/", (req, res) => {
     try {
-      const file = readFile();
-      const result = {};
-      for (const [authorityId, blob] of Object.entries(file.entries)) {
-        try {
-          result[authorityId] = vault2.decrypt(blob);
-        } catch {
-        }
-      }
-      res.json({ intents: result });
+      res.json({ intents: readApprovedIntents(vault2) });
     } catch (err) {
       console.error("[Control Plane] approved-intents GET error:", err);
       res.status(500).json({ error: "Failed to read approved intents" });
@@ -1997,6 +2011,222 @@ function createApprovedIntentsRouter(vault2) {
   return router;
 }
 
+// src/routes/evidence-export.ts
+var AS_FETCH_TIMEOUT_MS = 2e4;
+function createEvidenceExportRouter(spUrl, vault2) {
+  const router = Router9();
+  const getSpCookie = () => vault2.getSpCookie();
+  router.get("/", async (_req, res) => {
+    let local = null;
+    let localError;
+    try {
+      local = await getLocalEvidence();
+    } catch (err) {
+      localError = err instanceof Error ? err.message : String(err);
+    }
+    let authorityServer = null;
+    let asError;
+    const cookie = getSpCookie();
+    if (!cookie) {
+      asError = "No Authority Server session \u2014 sign in to include the full account history.";
+    } else {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), AS_FETCH_TIMEOUT_MS);
+      try {
+        const asRes = await fetch(`${spUrl}/api/receipts/export`, {
+          headers: { Cookie: cookie },
+          signal: controller.signal
+        });
+        if (asRes.ok) {
+          authorityServer = await asRes.json();
+        } else {
+          asError = `Authority Server export failed: ${asRes.status}`;
+        }
+      } catch (err) {
+        asError = `Authority Server unreachable: ${err instanceof Error ? err.message : String(err)}`;
+      } finally {
+        clearTimeout(timeout);
+      }
+    }
+    if (!local && !authorityServer) {
+      res.status(502).json({
+        error: "No evidence source available.",
+        localError,
+        asError
+      });
+      return;
+    }
+    let approvedIntents = {};
+    try {
+      approvedIntents = readApprovedIntents(vault2);
+    } catch {
+    }
+    const exportedAt = Math.floor(Date.now() / 1e3);
+    const date = new Date(exportedAt * 1e3).toISOString().slice(0, 10);
+    res.setHeader("Content-Disposition", `attachment; filename="suveren-evidence-${date}.json"`).setHeader("Cache-Control", "no-store").json({
+      format: "suveren-evidence-bundle/1",
+      exportedAt,
+      sources: {
+        local: local !== null,
+        authorityServer: authorityServer !== null,
+        ...localError ? { localError } : {},
+        ...asError ? { asError } : {}
+      },
+      local,
+      approvedIntents,
+      authorityServer
+    });
+  });
+  return router;
+}
+
+// src/routes/evidence.ts
+import { Router as Router10 } from "express";
+import { verifyReceiptSignature } from "@hap/core";
+async function verifyAll(receipts) {
+  const out = {};
+  for (const raw of receipts) {
+    const e = raw;
+    const id = typeof e.receipt?.id === "string" ? e.receipt.id : void 0;
+    if (!id) continue;
+    if (!e.asPublicKey) {
+      out[id] = "unverifiable";
+      continue;
+    }
+    try {
+      await verifyReceiptSignature(e.receipt, e.asPublicKey);
+      out[id] = "valid";
+    } catch {
+      out[id] = "invalid";
+    }
+  }
+  return out;
+}
+function mergeAuthorizations(evidence) {
+  const out = {};
+  for (const raw of evidence.authorizations ?? []) {
+    const a = raw;
+    const id = a.authorizationId;
+    if (!id) continue;
+    out[id] = {
+      authorizationId: id,
+      profileId: a.profileId,
+      boundsHash: a.boundsHash,
+      contextHash: a.contextHash,
+      bounds: a.bounds,
+      context: a.context,
+      intent: a.intent,
+      archived: true
+    };
+  }
+  for (const raw of evidence.gates ?? []) {
+    const g = raw;
+    const id = g.authorizationId;
+    if (!id) continue;
+    const gateContent = g.gateContent ?? {};
+    const existing = out[id];
+    if (!existing) {
+      out[id] = {
+        authorizationId: id,
+        profileId: g.profileId,
+        boundsHash: g.boundsHash,
+        contextHash: g.contextHash,
+        context: g.context,
+        intent: gateContent.intent,
+        archived: false
+      };
+      continue;
+    }
+    existing.intent ??= gateContent.intent;
+    existing.context ??= g.context;
+    existing.contextHash ??= g.contextHash;
+  }
+  return out;
+}
+function createEvidenceRouter() {
+  const router = Router10();
+  router.get("/authorizations", async (_req, res) => {
+    try {
+      const evidence = await getLocalEvidence();
+      res.json({
+        authorizations: mergeAuthorizations(evidence),
+        // Verified here, on this machine, so the card's badge reports a check
+        // that actually ran rather than the issuer vouching for itself.
+        signatures: await verifyAll(evidence.receipts ?? [])
+      });
+    } catch (err) {
+      res.status(503).json({
+        error: "Local evidence unavailable",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  router.get("/receipt/:id", async (req, res) => {
+    const id = String(req.params.id);
+    try {
+      const evidence = await getLocalEvidence();
+      const entry = (evidence.receipts ?? []).find(
+        (r) => r.receipt?.id === id
+      );
+      if (!entry) {
+        res.status(404).json({ error: "No local copy of this receipt" });
+        return;
+      }
+      const authorizationId = entry.authorizationId;
+      const authorization = authorizationId ? mergeAuthorizations(evidence)[authorizationId] ?? null : null;
+      const signature = (await verifyAll([entry]))[id] ?? "unverifiable";
+      res.json({ entry, authorization, signature });
+    } catch (err) {
+      res.status(503).json({
+        error: "Local evidence unavailable",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  return router;
+}
+
+// src/routes/decrypt-intent.ts
+import { Router as Router11 } from "express";
+function createDecryptIntentRouter(vault2) {
+  const router = Router11();
+  router.post("/", async (req, res) => {
+    const { intentCiphertext, encryptedKey, approverId } = req.body;
+    if (typeof intentCiphertext !== "string" || intentCiphertext.length === 0) {
+      res.status(400).json({ error: "Missing or invalid field: intentCiphertext (base64 string)" });
+      return;
+    }
+    if (typeof encryptedKey !== "object" || encryptedKey === null || typeof encryptedKey.ct !== "string" || typeof encryptedKey.enc !== "string") {
+      res.status(400).json({ error: "Missing or invalid field: encryptedKey ({ ct: string; enc: string })" });
+      return;
+    }
+    if (typeof approverId !== "string" || approverId.length === 0) {
+      res.status(400).json({ error: "Missing or invalid field: approverId (string)" });
+      return;
+    }
+    try {
+      const kp = await loadOrGenerateKeyPair(vault2);
+      const { ct, enc } = encryptedKey;
+      const encrypted = {
+        intentCiphertext: new Uint8Array(Buffer.from(intentCiphertext, "base64")),
+        encryptedKeys: {
+          [approverId]: {
+            ct: new Uint8Array(Buffer.from(ct, "base64")),
+            enc: new Uint8Array(Buffer.from(enc, "base64"))
+          }
+        }
+      };
+      const intent = await decryptIntent(encrypted, approverId, kp.privateKey);
+      res.json({ intent });
+    } catch (err) {
+      console.error("[Control Plane] decrypt-intent error:", err);
+      const msg = err instanceof Error ? err.message : "Decryption failed";
+      res.status(500).json({ error: msg });
+    }
+  });
+  return router;
+}
+
 // src/lib/update-checker.ts
 import { execSync } from "child_process";
 import { dirname as dirname3 } from "path";
@@ -2133,7 +2363,7 @@ data: null
 }
 
 // src/routes/gateway-settings.ts
-import { Router as Router10 } from "express";
+import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
@@ -2169,7 +2399,7 @@ function writeSettings(patch, dataDir) {
 
 // src/routes/gateway-settings.ts
 function createGatewaySettingsRouter() {
-  const router = Router10();
+  const router = Router12();
   router.get("/", (_req, res) => {
     res.json(readSettings());
   });
@@ -2192,7 +2422,7 @@ function createGatewaySettingsRouter() {
 }
 
 // src/routes/internal-events.ts
-import { Router as Router11 } from "express";
+import { Router as Router13 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 function secretMatches(provided, expected) {
@@ -2204,7 +2434,7 @@ function secretMatches(provided, expected) {
   return timingSafeEqual2(a, b);
 }
 function createInternalEventsRouter(getSecret) {
-  const router = Router11();
+  const router = Router13();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
@@ -2586,6 +2816,8 @@ app.use("/mcp", jsonParser, authGuard, createMCPRouter());
 app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
+app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL2, vault));
+app.use("/api/evidence", authGuard, createEvidenceRouter());
 app.use("/api/decrypt-intent", jsonParser, authGuard, createDecryptIntentRouter(vault));
 app.use("/api/approved-intents", jsonParser, authGuard, createApprovedIntentsRouter(vault));
 app.put("/integrations/:id/read-policy", jsonParser, authGuard, async (req, res) => {
@@ -2808,10 +3040,10 @@ app.use(
         const url = req.url ?? "";
         if (method !== "POST" && method !== "DELETE") return;
         const path = url.split("?")[0];
-        if (method === "POST" && path === "/api/as/attest") {
-          eventBus.emit("attestation-changed");
-        } else if (method === "POST" && /^\/api\/attestations\/[^/]+\/revoke$/.test(path)) {
+        if (method === "POST" && path === "/api/as/attest" || method === "POST" && /^\/api\/attestations\/[^/]+\/revoke$/.test(path) || method === "POST" && /^\/api\/authorizations\/[^/]+\/delete$/.test(path)) {
           eventBus.emit("attestation-changed");
+          void resyncGates().catch(() => {
+          });
         } else if (method === "POST" && path === "/api/proposals") {
           eventBus.emit("proposal-added");
         } else if (method === "POST" && /^\/api\/proposals\/[^/]+\/resolve$/.test(path)) {