@suveren/gateway 0.8.4 → 0.8.6

package/dist/control-plane/index.mjs

@@ -5,9 +5,9 @@ import {
 
 // src/index.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync5, renameSync } from "fs";
-import { dirname as dirname5, join as join6 } from "path";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync7, readFileSync as readFileSync7, renameSync as renameSync2 } from "fs";
+import { dirname as dirname6, join as join8 } from "path";
+import { homedir as homedir7 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
 
@@ -1042,6 +1042,8 @@ A good Intent can describe:
 - What the agent should try to achieve (the goal).
 - Soft rules or watch-outs the agent must honor even inside bounds (e.g. "never publish on weekends", "only reply in German").
 
+If an Agent Brief is provided, it is the user's standing orders that every agent already receives before any Intent. Use it to answer the user's questions and to keep the Intent consistent with it; do not repeat rules the brief already states \u2014 the Intent should add what is specific to this authorization.
+
 Your role is to coach: ask clarifying questions, reflect the user's words back, surface edge cases they haven't thought about. You may propose concrete phrasings on request.
 
 CRITICAL \u2014 ask before you draft.
@@ -1062,23 +1064,34 @@ Once they have answered, produce the draft inside a single fenced block:
 
 Only use the fence for full-document drafts the user can click "Apply". For partial suggestions, questions, comments, or reflections, write prose without the fence.`
 };
+function buildChatGrounding(target, currentText, agentBrief) {
+  const parts = [];
+  if (target.kind === "intent") {
+    if (target.profileId) parts.push(`Profile: ${target.profileId}`);
+    if (target.path) parts.push(`Path: ${target.path}`);
+    if (target.bounds) parts.push(`Bounds: ${target.bounds}`);
+    if (agentBrief?.trim()) {
+      parts.push(
+        `Agent Brief (standing orders every agent already receives; the Intent builds on this, it does not repeat it):
+"""
+${agentBrief.trim()}
+"""`
+      );
+    }
+  }
+  parts.push(
+    currentText.trim() ? `Current draft:
+"""
+${currentText}
+"""` : "Current draft is empty."
+  );
+  return parts.join("\n");
+}
 async function getAIChatResponse(config, request) {
   const { getPromptOverride } = await import("./ai-prompts-store-5JISFV4Z.mjs");
   const override = await getPromptOverride(request.target.kind);
   const systemPrompt = override ?? CHAT_SYSTEM_PROMPTS[request.target.kind];
-  const groundingParts = [];
-  if (request.target.kind === "intent") {
-    if (request.target.profileId) groundingParts.push(`Profile: ${request.target.profileId}`);
-    if (request.target.path) groundingParts.push(`Path: ${request.target.path}`);
-    if (request.target.bounds) groundingParts.push(`Bounds: ${request.target.bounds}`);
-  }
-  groundingParts.push(
-    request.currentText.trim() ? `Current draft:
-"""
-${request.currentText}
-"""` : "Current draft is empty."
-  );
-  const grounding = groundingParts.join("\n");
+  const grounding = buildChatGrounding(request.target, request.currentText, request.agentBrief);
   const messages = [
     { role: "system", content: systemPrompt },
     { role: "user", content: grounding },
@@ -1280,6 +1293,21 @@ async function testAIConnectivity(config) {
   }
 }
 
+// src/lib/agent-brief-store.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
+function agentBriefPath() {
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join2(homedir2(), ".suveren");
+  return join2(dataDir, "context.md");
+}
+function readAgentBrief() {
+  const filePath = agentBriefPath();
+  if (!existsSync2(filePath)) return "";
+  return readFileSync2(filePath, "utf-8");
+}
+
 // src/routes/ai.ts
 var describeScope = (c = {}) => {
   const vals = Object.values(c).map((v) => String(v).trim()).filter(Boolean);
@@ -1326,7 +1354,7 @@ function createAIRouter(vault2) {
       res.status(400).json({ error: "Missing messages array" });
       return;
     }
-    const result = await getAIChatResponse(config, request);
+    const result = await getAIChatResponse(config, { ...request, agentBrief: readAgentBrief() });
     res.json(result);
   });
   router.post("/intent-review", async (req, res) => {
@@ -1641,28 +1669,28 @@ function createMCPRouter() {
 // src/routes/autostart.ts
 import { Router as Router6 } from "express";
 import { execFile } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { dirname as pathDirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 var run = promisify(execFile);
 var SUPPORTED = /* @__PURE__ */ new Set(["darwin", "win32", "linux"]);
 var MODULE_DIR = pathDirname(fileURLToPath(import.meta.url));
-function findCli(dirname6 = MODULE_DIR) {
+function findCli(dirname7 = MODULE_DIR) {
   const candidates = [
     // Bundled (the shipped layout): dist/control-plane → dist → root → bin
-    resolve(dirname6, "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname7, "..", "..", "bin", "suveren-gateway.js"),
     // Bundled, were the routes/ directory ever preserved.
-    resolve(dirname6, "..", "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname7, "..", "..", "..", "bin", "suveren-gateway.js"),
     // Dev, running from source: the repo's own bundle directory.
-    resolve(dirname6, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
-    resolve(dirname6, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
+    resolve(dirname7, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
+    resolve(dirname7, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
     // Deliberately NO process.cwd() fallback: it makes the result depend on
     // where the process happened to be launched from, so the same install
     // resolves differently between a shell and a login service — and it would
     // mask a genuinely missing CLI whenever the cwd happened to be the repo.
   ];
-  return candidates.find(existsSync2) ?? null;
+  return candidates.find(existsSync3) ?? null;
 }
 async function cli(args) {
   const bin = findCli();
@@ -1743,15 +1771,15 @@ function createAutostartRouter() {
 import { spawn, spawnSync } from "child_process";
 
 // src/lib/notifier-icon.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, dirname as dirname2 } from "path";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3, dirname as dirname2 } from "path";
 var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
 function ensureNotifierIcon(dataDir) {
   try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join2(homedir2(), ".suveren");
-    const path = join2(dir, "notifier-icon.png");
-    if (!existsSync3(path)) {
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join3(homedir3(), ".suveren");
+    const path = join3(dir, "notifier-icon.png");
+    if (!existsSync4(path)) {
       mkdirSync2(dirname2(path), { recursive: true });
       writeFileSync2(path, Buffer.from(ICON_BASE64, "base64"));
     }
@@ -1947,17 +1975,17 @@ import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
 import { Router as Router8 } from "express";
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join3(homedir3(), ".suveren");
-var FILE_PATH = join3(SUVEREN_DATA_DIR, "approved-intents.enc.json");
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
+var FILE_PATH = join4(SUVEREN_DATA_DIR, "approved-intents.enc.json");
 function readFile() {
-  if (!existsSync4(FILE_PATH)) {
+  if (!existsSync5(FILE_PATH)) {
     return { version: 1, entries: {} };
   }
   try {
-    return JSON.parse(readFileSync2(FILE_PATH, "utf-8"));
+    return JSON.parse(readFileSync3(FILE_PATH, "utf-8"));
   } catch {
     return { version: 1, entries: {} };
   }
@@ -2366,19 +2394,19 @@ data: null
 import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5, dirname as dirname4 } from "path";
 var DEFAULT_SETTINGS = {
   desktopNotifications: true
 };
 function settingsPath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
-  return join4(dir, "settings.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
+  return join5(dir, "settings.json");
 }
 function readSettings(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync3(settingsPath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync4(settingsPath(dataDir), "utf8"));
     return {
       desktopNotifications: typeof raw.desktopNotifications === "boolean" ? raw.desktopNotifications : DEFAULT_SETTINGS.desktopNotifications
     };
@@ -2421,8 +2449,73 @@ function createGatewaySettingsRouter() {
   return router;
 }
 
-// src/routes/internal-events.ts
+// src/routes/archived-mandates.ts
 import { Router as Router13 } from "express";
+
+// src/lib/archived-mandates-store.ts
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, renameSync } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join6, dirname as dirname5 } from "path";
+var ID_PATTERN = /^[A-Za-z0-9_.:-]{1,200}$/;
+function isValidMandateId(id) {
+  return typeof id === "string" && ID_PATTERN.test(id);
+}
+function storePath(dataDir) {
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join6(homedir6(), ".suveren");
+  return join6(dir, "archived-mandates.json");
+}
+function readArchived(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync5(storePath(dataDir), "utf8"));
+    if (!Array.isArray(raw.archived)) return [];
+    return [...new Set(raw.archived.filter(isValidMandateId))];
+  } catch {
+    return [];
+  }
+}
+function writeArchived(ids, dataDir) {
+  const next = [...new Set(ids.filter(isValidMandateId))].sort();
+  const path = storePath(dataDir);
+  mkdirSync5(dirname5(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  writeFileSync5(tmp, JSON.stringify({ archived: next }, null, 2) + "\n", "utf8");
+  renameSync(tmp, path);
+  return next;
+}
+function archiveMandate(id, dataDir) {
+  if (!isValidMandateId(id)) throw new Error("invalid mandate id");
+  return writeArchived([...readArchived(dataDir), id], dataDir);
+}
+function unarchiveMandate(id, dataDir) {
+  if (!isValidMandateId(id)) throw new Error("invalid mandate id");
+  return writeArchived(readArchived(dataDir).filter((x) => x !== id), dataDir);
+}
+
+// src/routes/archived-mandates.ts
+function createArchivedMandatesRouter(dataDir) {
+  const router = Router13();
+  router.get("/", (_req, res) => {
+    res.json({ archived: readArchived(dataDir) });
+  });
+  const change = (fn) => (req, res) => {
+    const id = req.params.id;
+    if (!isValidMandateId(id)) {
+      res.status(400).json({ error: "invalid mandate id" });
+      return;
+    }
+    try {
+      res.json({ archived: fn(id, dataDir) });
+    } catch (err) {
+      res.status(500).json({ error: `Could not save: ${err.message}` });
+    }
+  };
+  router.put("/:id", change(archiveMandate));
+  router.delete("/:id", change(unarchiveMandate));
+  return router;
+}
+
+// src/routes/internal-events.ts
+import { Router as Router14 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
 function secretMatches(provided, expected) {
@@ -2434,7 +2527,7 @@ function secretMatches(provided, expected) {
   return timingSafeEqual2(a, b);
 }
 function createInternalEventsRouter(getSecret) {
-  const router = Router13();
+  const router = Router14();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
@@ -2538,22 +2631,24 @@ function startNotificationDispatcher(opts = {}) {
 }
 
 // src/lib/denials-reader.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join5(dataDir, "denials.enc.json");
-  const plainPath = join5(dataDir, "denials.json");
-  if (existsSync5(encPath)) {
-    const { blob } = JSON.parse(readFileSync4(encPath, "utf-8"));
+  const encPath = join7(dataDir, "denials.enc.json");
+  const plainPath = join7(dataDir, "denials.json");
+  if (existsSync6(encPath)) {
+    const { blob } = JSON.parse(readFileSync6(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
-  if (existsSync5(plainPath)) {
-    return JSON.parse(readFileSync4(plainPath, "utf-8")).records ?? [];
+  if (existsSync6(plainPath)) {
+    return JSON.parse(readFileSync6(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
+var DENIAL_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 function selectDenials(records, opts = {}) {
-  let out = [...records].sort((a, b) => b.ts - a.ts);
+  const cutoff = (opts.now ?? Date.now()) - DENIAL_MAX_AGE_MS;
+  let out = records.filter((r) => r.ts >= cutoff).sort((a, b) => b.ts - a.ts);
   if (opts.since !== void 0 && Number.isFinite(opts.since)) out = out.filter((r) => r.ts >= opts.since);
   const count = out.length;
   if (opts.limit !== void 0 && Number.isFinite(opts.limit) && opts.limit > 0) out = out.slice(0, opts.limit);
@@ -2563,11 +2658,11 @@ function selectDenials(records, opts = {}) {
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
-  const oldDir = join6(homedir5(), ".hap");
-  const newDir = join6(homedir5(), ".suveren");
-  if (!existsSync6(newDir) && existsSync6(oldDir)) {
+  const oldDir = join8(homedir7(), ".hap");
+  const newDir = join8(homedir7(), ".suveren");
+  if (!existsSync7(newDir) && existsSync7(oldDir)) {
     try {
-      renameSync(oldDir, newDir);
+      renameSync2(oldDir, newDir);
       console.error(`[Control Plane] Migrated data directory: ${oldDir} \u2192 ${newDir}`);
     } catch (err) {
       console.error(`[Control Plane] FATAL: could not migrate data directory ${oldDir} \u2192 ${newDir}:`, err);
@@ -2578,7 +2673,7 @@ function selectDenials(records, opts = {}) {
 var SP_URL2 = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
-var UI_DIST = process.env.HAP_UI_DIST ?? join6(import.meta.dirname ?? __dirname, "../../ui/dist");
+var UI_DIST = process.env.HAP_UI_DIST ?? join8(import.meta.dirname ?? __dirname, "../../ui/dist");
 var vault = new Vault();
 var internalSecret2 = process.env.SUVEREN_INTERNAL_SECRET ?? randomBytes2(32).toString("hex");
 setInternalSecret(internalSecret2);
@@ -2815,6 +2910,7 @@ app.use("/ai-prompts", jsonParser, authGuard, createAIPromptsRouter());
 app.use("/mcp", jsonParser, authGuard, createMCPRouter());
 app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
+app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
 app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL2, vault));
 app.use("/api/evidence", authGuard, createEvidenceRouter());
@@ -2948,7 +3044,7 @@ app.get("/active-authorizations", authGuard, async (_req, res) => {
 });
 app.get("/denials", authGuard, (req, res) => {
   try {
-    const dataDir = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
+    const dataDir = process.env.SUVEREN_DATA_DIR ?? join8(homedir7(), ".suveren");
     const all = loadDenials(dataDir, (blob) => vault.decrypt(blob));
     const since = Number(req.query.since);
     const limit = Number(req.query.limit);
@@ -2980,18 +3076,9 @@ app.post("/resync-gates", authGuard, async (_req, res) => {
     res.status(500).json({ error: "Failed to resync gates with MCP server" });
   }
 });
-var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
-var SUVEREN_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
 app.get("/agent-brief/context", authGuard, async (_req, res) => {
   try {
-    const { readFileSync: readFileSync6, existsSync: fileExists } = await import("fs");
-    const filePath = join6(SUVEREN_DATA_DIR2, "context.md");
-    if (!fileExists(filePath)) {
-      res.json({ content: "" });
-      return;
-    }
-    const content = readFileSync6(filePath, "utf-8");
-    res.json({ content });
+    res.json({ content: readAgentBrief() });
   } catch (err) {
     console.error("[Control Plane] agent-brief/context GET failed:", err);
     res.status(500).json({ error: err instanceof Error ? err.message : "Failed to read context" });
@@ -3008,12 +3095,12 @@ app.put("/agent-brief/context", jsonParser, authGuard, async (req, res) => {
       res.status(413).json({ error: `Context exceeds ${AGENT_CONTEXT_MAX_BYTES}-byte cap` });
       return;
     }
-    const { mkdirSync: mkdirSync5, writeFileSync: writeFileSync5, renameSync: renameSync2 } = await import("fs");
-    mkdirSync5(SUVEREN_DATA_DIR2, { recursive: true });
-    const filePath = join6(SUVEREN_DATA_DIR2, "context.md");
+    const { mkdirSync: mkdirSync6, writeFileSync: writeFileSync6, renameSync: renameSync3 } = await import("fs");
+    const filePath = agentBriefPath();
+    mkdirSync6(dirname6(filePath), { recursive: true });
     const tmpPath = `${filePath}.tmp`;
-    writeFileSync5(tmpPath, content, "utf-8");
-    renameSync2(tmpPath, filePath);
+    writeFileSync6(tmpPath, content, "utf-8");
+    renameSync3(tmpPath, filePath);
     res.json({ ok: true });
   } catch (err) {
     console.error("[Control Plane] agent-brief/context PUT failed:", err);
@@ -3062,13 +3149,13 @@ app.use(
   })
 );
 function detectInstallMethod() {
-  if (existsSync6("/.dockerenv")) return "docker";
+  if (existsSync7("/.dockerenv")) return "docker";
   const dir = import.meta.dirname ?? __dirname;
   if (dir.includes("/node_modules/@suveren/gateway/")) return "npm";
   let cursor = dir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync6(join6(cursor, ".git"))) return "dev";
-    const parent = dirname5(cursor);
+    if (existsSync7(join8(cursor, ".git"))) return "dev";
+    const parent = dirname6(cursor);
     if (parent === cursor) break;
     cursor = parent;
   }
@@ -3080,10 +3167,10 @@ function detectRunningVersion() {
     return process.env.HAP_BUILD_SHA ?? "dev";
   }
   const dir = import.meta.dirname ?? __dirname;
-  const bundlePkg = join6(dir, "..", "..", "package.json");
-  if (existsSync6(bundlePkg)) {
+  const bundlePkg = join8(dir, "..", "..", "package.json");
+  if (existsSync7(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync5(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync7(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -3111,7 +3198,7 @@ app.get("/health", async (req, res) => {
     }
   });
 });
-if (existsSync6(UI_DIST)) {
+if (existsSync7(UI_DIST)) {
   app.use(express.static(UI_DIST, {
     setHeaders: (res, filePath) => {
       if (filePath.endsWith("index.html")) {
@@ -3121,7 +3208,7 @@ if (existsSync6(UI_DIST)) {
   }));
   app.get("*", (_req, res) => {
     res.setHeader("Cache-Control", "no-store, must-revalidate");
-    res.sendFile(join6(UI_DIST, "index.html"));
+    res.sendFile(join8(UI_DIST, "index.html"));
   });
 } else {
   app.get("/", (_req, res) => {

package/dist/mcp-server/http.mjs

@@ -3464,6 +3464,76 @@ function getAllManifests() {
   return Array.from(manifests.values());
 }
 
+// src/lib/remote-auth-preflight.ts
+var AUTH_HEADER_RE = /^authorization:\s*(.+)$/i;
+function remotePreflightTarget(command, args) {
+  const bin = command.split(/[\\/]/).pop() ?? command;
+  if (bin !== "mcp-remote") return null;
+  const url = args.find((a) => /^https?:\/\//i.test(a));
+  if (!url) return null;
+  for (let i = 0; i < args.length - 1; i++) {
+    if (args[i] !== "--header") continue;
+    const m = AUTH_HEADER_RE.exec(args[i + 1]);
+    if (m) return { url, authorization: m[1].trim() };
+  }
+  return null;
+}
+function isBlankCredential(authorization) {
+  return authorization.split(/\s+/).filter(Boolean).length < 2;
+}
+async function preflightRemoteAuth(target, fetchImpl = fetch, timeoutMs = 8e3) {
+  const host = safeHost(target.url);
+  if (isBlankCredential(target.authorization)) {
+    return {
+      ok: false,
+      reason: `no credential configured for ${host} \u2014 the saved token is empty. Not started: the remote would open a browser login instead.`
+    };
+  }
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(target.url, {
+      method: "POST",
+      headers: {
+        Authorization: target.authorization,
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream"
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 0,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-03-26",
+          capabilities: {},
+          clientInfo: { name: "suveren-gateway-preflight", version: "0" }
+        }
+      }),
+      signal: ctrl.signal
+    });
+    res.body?.cancel().catch(() => {
+    });
+    if (res.status === 401 || res.status === 403) {
+      return {
+        ok: false,
+        reason: `${host} rejected the configured credential (HTTP ${res.status}). Not started: the remote would open a browser login instead. Re-enter the token under Integrations.`
+      };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: true };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function safeHost(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+
 // src/lib/integration-manager.ts
 var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join10(homedir8(), ".suveren");
 var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join10(DEFAULT_DATA_DIR2, "integrations");
@@ -3707,6 +3777,11 @@ var IntegrationManager = class {
     const env = this.resolveEnvKeys(config);
     const interpolate = (s) => s.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? process.env[name] ?? "");
     const args = config.args.map(interpolate);
+    const remote = remotePreflightTarget(config.command, args);
+    if (remote) {
+      const verdict = await preflightRemoteAuth(remote);
+      if (!verdict.ok) throw new Error(`${config.id}: ${verdict.reason}`);
+    }
     const transport = new StdioClientTransport({
       command: config.command,
       args,