create-metamynd-agent 0.10.10 → 0.11.2

package/README.md

@@ -10,9 +10,9 @@ default, a second `gateway/` process** built on
 The agent's own `guardTool()` call is a fast, local, client-side check; the gateway is the real
 enforcement boundary — see [Separate tool gateway](#separate-tool-gateway-default) below.
 
-> **Prerequisite:** an agent is always owned by a **KYB-verified owner** — a person/org with a
-> MetaMynd account. If that's you and you're verified, you're ready. Verify once in the dashboard if
-> not; it's the only gate.
+> **Prerequisite:** an agent is always owned by a person/org with a **MetaMynd account**. Verification
+> is *reported*, not required, to get started: an unverified owner works on Testnet within the
+> free-tier limits, and verifying once in the dashboard (KYC/KYB) is what unlocks mainnet.
 
 ## Free local harness (no account, no network, `--harness`)
 
@@ -170,6 +170,15 @@ the whole protocol.
 Named precisely, not left implicit:
 
 - **Direct call.** `bookFlight()` doesn't exist in the agent's process.
+- **Payload binding is ON by default (0.11.0, MAGP §8.3.9).** The generated agent signs the COMPLETE body it sends as a payload, the
+  authorization it gets from the gate is bound to that same body, and the generated gateway sets `requirePayloadBinding: true`: it
+  digests the body it is about to run and the issuer refuses the claim unless that is the digest the agent signed. The eight
+  signed fields only ever covered amount and merchant; this covers the value of every field the route allows (a payee, a passenger
+  list you add). A request that bound no payload is refused (`PAYLOAD_BINDING_REQUIRED`) rather than run unbound. If you add a body
+  field, add it to `allowedFields` **and** to the `payload` the agent signs (both sit next to each other in the generated files).
+  A scaffold that signs through the signer daemon (`--byok --daemon-socket`) needs `@metamynd/agentsafe-signer` 0.15.0 or later. The
+  hosted non-financial scaffold reads nothing from its body, so there is nothing for it to bind, and a scaffold with no gateway
+  (`--no-gateway`, or `--sandbox`'s in-process demo) has no separate executor to hold to the digest, so it stays as it was.
 - **Confused deputy (payload).** Signing a cheap request while executing an expensive one (a
   different amount/merchant in the body than what was signed) is refused before the tool runs —
   payload binding (`@metamynd/agentsafe-http-gateway` ≥ 0.4.0). The default binder requires
@@ -388,6 +397,16 @@ polls until the owner approves, then scaffolds the project (the same default two
 the full flow above — `--no-gateway`/`--gateway-port` work here too). With `--byok` the keypair is
 generated locally and control is proven on claim — MetaMynd never sees the private key.
 
+## Risk: say it, or have your owner set it
+
+The starter rules include a high-risk review. A request that sends **no** `riskLevel` (or an unrecognised one)
+is no longer waved through: it is **escalated** (`CONTEXT_UNVERIFIABLE`) for a human, because an agent that omits
+its risk is indistinguishable from one hiding it. The scaffolded financial examples send `riskLevel` (`'low'`
+unless you say otherwise) — that default is a placeholder, not an assessment — and the neutral template passes
+your own `args` as the context, so include it there. A real integration should send an honest one — or, better, not depend on the agent at all: a mandate
+permission can carry an owner-set `riskTier` that no claim can lower, and a gateway route can derive the risk
+itself with `route.trustedContext` (`@metamynd/agentsafe-http-gateway` 0.10.0). See MAGP §6.3.
+
 ## Security
 
 `agent.metamynd.json` contains the agent's **secret key** (a managed key, or — with `--byok` — the one

package/index.mjs

@@ -53,7 +53,7 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // requires request inputs blocks a bare baseline request).
 // 0.12.4 makes `verify` probe in the currency the mandate's caps name (it assumed USD), which a scaffolded
 // non-USD agent's `npm test` needs.
-const GUARD_VERSION = '^0.12.4';
+const GUARD_VERSION = '^0.15.0';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -102,7 +102,7 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.6.0 brings buildAuthMessage's `resource` field and buildLocalDecisionMessage into this
 // package's own bundled policy-core.mjs (alongside the guard's own 0.10.0) — no scaffolded
 // template code changes, but the floor must still cover the real current version.
-const MCP_GUARD_VERSION = '^0.6.0';
+const MCP_GUARD_VERSION = '^0.11.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
@@ -114,7 +114,7 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.5.0 adds the OPTIONAL Credential Vault `resolveCredential` hook on createHttpGateway (Module
 // G) — additive and backward-compatible (every existing consumer sees zero behavior change), but
 // the floor must still cover the real current version per this repo's own package-version check.
-const GATEWAY_VERSION = '^0.5.0';
+const GATEWAY_VERSION = '^0.11.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -987,18 +987,23 @@ const GATEWAY = process.env.GATEWAY_URL || 'http://localhost:${gatewayPort}';
 // --- the gateway atomically claim single-use execution, closing replay + cumulative spend, not
 // --- just re-checking policy. See ./gateway/README.md.
 async function bookFlightViaGateway(args, decision) {
+  // The COMPLETE body the tool receives. It is signed as a payload (MAGP 8.3.9): the eight signed fields cover amount and
+  // merchant, not anything else a real tool takes (a payee, a passenger list). The digest covers ALL of it, and the gateway
+  // refuses to run the tool on a body that is not exactly this one.
+  const payload = { amount: args.amount, merchant: args.merchant, currency: args.currency ?? '${currency}' };
   const signed = await guard.buildSignedRequest({
     action: '${scope}',
     amount: args.amount,
     currency: args.currency ?? '${currency}',
     merchant: args.merchant,
     context: { tool: 'book-flight', riskLevel: args.riskLevel ?? 'low' },
+    payload,
   });
   signed.authorizationId = decision?.authorizationId;
   const res = await fetch(GATEWAY + '/book-flight', {
     method: 'POST',
     headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) },
-    body: JSON.stringify(args),
+    body: JSON.stringify(payload),
   });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
@@ -1020,6 +1025,9 @@ const gatedBookFlight = guard.guardTool(
     currency: a.currency ?? '${currency}',
     merchant: a.merchant,
     context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
+    // The authorization is bound to the SAME body bookFlightViaGateway() sends, so the gate records what this agent
+    // signed and the gateway can prove it is running exactly that. Keep the two in step if you add a field.
+    payload: { amount: a.amount, merchant: a.merchant, currency: a.currency ?? '${currency}' },
   }),
 );
 
@@ -1207,7 +1215,7 @@ async function performViaGateway(args, decision) {
   const res = await fetch(GATEWAY + '/perform', {
     method: 'POST',
     headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) },
-    body: JSON.stringify(args),
+    body: '{}', // this tool reads nothing from the body; the request's fields travel in the SIGNED context
   });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
@@ -1330,7 +1338,7 @@ console.log('');
  * allowed value-less request would be refused AUTHORIZATION_REQUIRED. The README states what that
  * leaves open (replay) rather than implying the financial scaffold's guarantees.
  */
-function gatewayServerFileNeutral(scope, port, apiBase) {
+function gatewayServerFileNeutral(scope, port, apiBase, policyKey) {
   return `#!/usr/bin/env node
 // gateway/server.mjs — the enforcement boundary for this agent's tool(s).
 //
@@ -1357,7 +1365,11 @@ async function performAction(args) {
 //
 // valueFields: [] because this action carries no amount or merchant to bind the body to — say so
 // explicitly rather than lean on the library default, which would demand both.
-const routes = [{ method: 'POST', path: '/perform', action: '${scope}', valueFields: [] }];
+//
+// allowedFields: [] because performAction() reads nothing from the body, so any key the agent adds is
+// refused (PAYLOAD_UNBINDABLE): nothing signed covers it. When your real tool reads body fields, list
+// exactly those keys here — the gateway refuses every top-level key you do not name.
+const routes = [{ method: 'POST', path: '/perform', action: '${scope}', valueFields: [], allowedFields: [] }];
 
 // requireAuthorization is OFF on purpose. It makes the gateway claim a single-use, stateful
 // authorization before running the tool — but the agent's guard only seals one for a value-bearing
@@ -1365,7 +1377,12 @@ const routes = [{ method: 'POST', path: '/perform', action: '${scope}', valueFie
 // would be refused AUTHORIZATION_REQUIRED. What that leaves open (a signed request is reusable for
 // the guard's 5-minute freshness window; the issuer's stateful rate/circuit-breaker floors; and the
 // rule inputs, which are not covered by the signature) is spelled out in README.md.
-const guard = createMcpGuard({ serviceDid: 'did:local:${scope}-gateway', issuerApi: MAGP_API, requireAuthorization: false });
+// policyPublicKey pins the bundle to MetaMynd's OWN signing key (from your provisioning response,
+// baked in here — never fetched at runtime, so a compromised network can't swap it out alongside a
+// forged bundle). Without it, verifyBundle() never runs at all: an attacker who can intercept the
+// fetch to \`\${MAGP_API}/policy/bundle/...\` — a MITM, a compromised DNS/proxy — can hand this gateway
+// a bundle with a higher cap or no rules, and it would be trusted the same as the real one.
+const guard = createMcpGuard({ serviceDid: 'did:local:${scope}-gateway', issuerApi: MAGP_API, requireAuthorization: false${policyKey ? `, policyPublicKey: '${policyKey}'` : ''} });
 
 const gateway = createHttpGateway({
   guard,
@@ -1446,7 +1463,10 @@ This is narrower than it sounds, so read it before relying on it.
 **Closed:** no tool call without a validly signed request from THIS agent for an action in its
 mandate. The agent's Ed25519 signature is checked against its DID, the action must be granted, and a
 suspended or quarantined agent is refused. Code that skips the agent's own guard and cannot sign as
-the agent gets nothing, and there is no local function to call directly.
+the agent gets nothing, and there is no local function to call directly. The policy bundle itself is
+pinned to MetaMynd's own signing key (\`policyPublicKey\`, baked in from your provisioning response) —
+a party that can intercept the bundle fetch (a MITM, a compromised DNS/proxy) cannot hand this gateway
+a forged bundle with a higher cap or no rules; \`server.mjs\` refuses an unsigned or tampered one outright.
 
 **NOT closed — be precise about this:**
 
@@ -1604,7 +1624,7 @@ function exampleReadme(slug, scope, withGateway, gatewayPort, daemonKey = false)
   const configFileLine = daemonKey
     ? `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
   **Holds no secret key.** Signing goes through your already-running agentsafe-signer daemon
-  (\`daemonSocketPath\`) instead — see \`docs/integration/INSTALL-AGENTSAFE-SIGNER.md\`.`
+  (\`daemonSocketPath\`) instead — see \`docs/integration/INSTALL-AGENTSAFE-SIGNER.md\`.${withGateway ? ' Payload binding is on by default and signs through the daemon too, which needs agentsafe-signer 0.15.0 or later.' : ''}`
     : `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
   **Contains the agent's secret key — never commit it.** It is already in \`.gitignore\`.`;
   const gatewaySection = withGateway
@@ -1710,7 +1730,7 @@ function gitignore() {
 // in the AgentSafe repo for the full pattern (mutual handshake, x402 payment, capability
 // binding) this is a minimal slice of.
 
-function gatewayServerFile(scope, port, apiBase) {
+function gatewayServerFile(scope, port, apiBase, policyKey) {
   return `#!/usr/bin/env node
 // gateway/server.mjs — the REAL enforcement boundary for this agent's tool(s).
 //
@@ -1739,7 +1759,13 @@ async function bookFlight(args) {
 // this exact list anyway): a route with a real amount/merchant should always say so itself,
 // rather than relying on a library default to guess right. A route with NO value concept at
 // all (a read, a status check) should set valueFields: [] instead — see the gateway's README.
-const routes = [{ method: 'POST', path: '/book-flight', action: '${scope}', valueFields: ['amount', 'merchant'] }];
+//
+// allowedFields is the COMPLETE list of top-level body keys bookFlight() reads. The gateway refuses
+// every other key (PAYLOAD_UNBINDABLE) because nothing the agent signed covers it — that is what
+// stops a request signed for $250 from carrying \`surcharge: 4750\` through to your tool. Add a key
+// here only when your real tool reads it; things policy needs to see (a risk level) travel in the
+// signed context, not the tool body.
+const routes = [{ method: 'POST', path: '/book-flight', action: '${scope}', valueFields: ['amount', 'merchant'], allowedFields: ['amount', 'currency', 'merchant'] }];
 
 // No serviceKey: this minimal gateway only calls verifyRequest() (re-check a signed request),
 // not the mutual-handshake methods, which are the only thing that needs it.
@@ -1747,11 +1773,22 @@ const routes = [{ method: 'POST', path: '/book-flight', action: '${scope}', valu
 // requireAuthorization: true is what closes replay and cumulative spend, not just per-request
 // policy — it requires the agent's authorizationId (from a REAL guard.authorize() call) to
 // atomically claim single-use execution against the issuer before this gateway runs the tool.
-const guard = createMcpGuard({ serviceDid: 'did:local:${scope}-gateway', issuerApi: MAGP_API, requireAuthorization: true });
+//
+// policyPublicKey pins the bundle to MetaMynd's OWN signing key (from your provisioning response,
+// baked in here — never fetched at runtime, so a compromised network can't swap it out alongside a
+// forged bundle). Without it, verifyBundle() never runs at all: an attacker who can intercept the
+// fetch to \`\${MAGP_API}/policy/bundle/...\` — a MITM, a compromised DNS/proxy — can hand this gateway
+// a bundle with a higher cap or no rules, and it would be trusted the same as the real one.
+const guard = createMcpGuard({ serviceDid: 'did:local:${scope}-gateway', issuerApi: MAGP_API, requireAuthorization: true${policyKey ? `, policyPublicKey: '${policyKey}'` : ''} });
 
 const gateway = createHttpGateway({
   guard,
   routes,
+  // Payload binding (MAGP 8.3.9): the agent signs a digest of the WHOLE body, this gateway digests the body it is about to
+  // run, and the issuer refuses the claim unless the two are the digest the agent signed at authorize time. allowedFields
+  // above lists which keys may appear; this makes the VALUES of every one of them (a payee, a passenger list) the agent's too.
+  // A request whose authorization bound no payload is refused (PAYLOAD_BINDING_REQUIRED) rather than run unbound.
+  requirePayloadBinding: true,
   forward: async (req) => {
     let args = {};
     try { args = JSON.parse(req.rawBody?.toString('utf8') || '{}'); } catch { /* empty body */ }
@@ -1877,6 +1914,10 @@ Four independent checks, each closing a different bypass an agent (or anything a
 own code, or a network attacker) might attempt:
 
 - **Direct call.** \`bookFlight()\` doesn't exist in the agent's process. There's nothing to call.
+- **Forged policy bundle.** \`server.mjs\` bakes in \`policyPublicKey\` (from your provisioning
+  response) and refuses an unsigned or tampered bundle outright — a party that can intercept the
+  fetch (a MITM, a compromised DNS/proxy) cannot hand this gateway a bundle with a higher cap or
+  no rules and have it trusted the same as the real one.
 - **Confused deputy (payload).** The gateway re-verifies the signed request against this agent's
   own policy AND binds it to the actual request body (payload binding,
   \`@metamynd/agentsafe-http-gateway\` ≥ 0.4.5) — signing a cheap request while executing an
@@ -1899,6 +1940,15 @@ own code, or a network attacker) might attempt:
   already checked it against the mandate's TOTAL budget when it was minted — not just this one
   request's amount. Many small legal-looking calls can't add up past the mandate cap this way,
   because each needed its own real authorization first.
+- **Settlement (\`@metamynd/agentsafe-http-gateway\` ≥ 0.6.0).** A claimed hold stays against the
+  mandate's cap until it is settled — it does NOT lapse after 15 minutes. So this gateway closes the
+  hold it claimed once the upstream answers: a 2xx is captured at the authorized amount, and anything
+  else (a rejection, a 5xx, a dropped connection) is parked as UNKNOWN so the spend stays committed.
+  A rejected call therefore keeps its budget until it is reconciled; if a given upstream status
+  guarantees nothing was executed, list it in \`releaseOnStatus\` on the route (e.g. \`[400, 422]\`) and
+  the gateway will release that hold. Only the gateway that claimed the hold can do either — the agent
+  cannot capture it lower or void it, which is what stopped it recovering the budget of a purchase it
+  had just had executed.
 - **Amount unknown.** \`amount-unknown\` (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.3.0) blocks a
   platform tool by default when its raw bytes or a nested payload hide the amount from a naive
   spend cap — AND this agent's OWN starter SOP (see \`agent.metamynd.json\` /
@@ -2002,9 +2052,15 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'U
 
   if (withGateway) {
     const apiBase = config.apiBase ?? config.api ?? DEFAULT_API;
+    // The key that signs every policy bundle (magp.policy-signer.ts) — present on every provisioning
+    // response that talks to a real backend (full account, sandbox, delegated-claim). Baked into the
+    // generated gateway so it pins the bundle rather than trusting whatever the fetch returns; absent
+    // only for a config predating this field (an older scaffold's saved agent.metamynd.json), where
+    // the generated gateway is unchanged from before rather than baking in nothing and crashing.
+    const policyKey = config.issuer?.policyKey ?? null;
     const gwDir = join(outDir, 'gateway');
     if (!existsSync(gwDir)) mkdirSync(gwDir, { recursive: true });
-    writeFileSafe(gwDir, 'server.mjs', neutral ? gatewayServerFileNeutral(scope, gatewayPort, apiBase) : gatewayServerFile(scope, gatewayPort, apiBase), force);
+    writeFileSafe(gwDir, 'server.mjs', neutral ? gatewayServerFileNeutral(scope, gatewayPort, apiBase, policyKey) : gatewayServerFile(scope, gatewayPort, apiBase, policyKey), force);
     writeFileSafe(gwDir, 'package.json', gatewayPackageJson(slug), force);
     writeFileSafe(gwDir, '.env.example', neutral ? gatewayEnvExampleNeutral() : gatewayEnvExample(), force);
     writeFileSafe(gwDir, '.gitignore', gatewayGitignore(), force);
@@ -2211,11 +2267,18 @@ function harnessGatewayServerFile(scope, gatewayPort, agentDid, neutral = false)
 // harness-gateway.mjs — a SEPARATE process from your agent. It holds the tool (${neutral ? 'the action below' : 'bookFlight below'}
 // never runs anywhere else) and independently re-verifies every request against
 // ../metamynd-rules.json using the REAL @metamynd/agentsafe-mcp-guard — the same package a
-// production Service uses, just pointed at a local file instead of a hosted issuer. See
-// ../README.md#--gateway for exactly what this does and does not close.
+// production Service uses, just pointed at a local file instead of a hosted issuer.
+//
+// There is NO enforcement logic of your own in this file. Routing, payload binding and the
+// deny-by-default posture come from @metamynd/agentsafe-http-gateway — the same component the
+// hosted scaffold uses — so what it refuses is what production refuses: a body that does not match
+// what the agent signed (PAYLOAD_NOT_BOUND), a value it cannot find (PAYLOAD_UNBINDABLE), and any
+// top-level key you did not list in allowedFields. See ../README.md#--gateway for what this closes.
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
 import { createMcpGuard } from '${MCP_GUARD_PKG}';
+import { createHttpGateway } from '${GATEWAY_PKG}';
+import { matchRoute } from '${GATEWAY_PKG}/route-match';
 
 const PORT = Number(process.env.PORT || ${gatewayPort});
 // The agent's did:key, fixed at scaffold time — a request claiming to be any OTHER agentDid
@@ -2249,12 +2312,35 @@ const guard = createMcpGuard({
   },
 });
 
-// One protected route per gated action in index.mjs. A path with no route below is refused —
-// there is nothing to fall through TO; this gateway IS the tool, not a proxy in front of one.
-const ROUTES = {
-  ${neutral ? `'/perform': { action: '${scope}', run: async (args) => ({ done: true, action: '${scope}' }) },` : `'/book-flight': { action: '${scope}', run: async (args) => ({ pnr: 'PNR-DEMO', ...args }) },`}
-  '/raise-limit': { action: 'permissions.update', run: async (args) => ({ updated: true, ...args }) },
-};
+// One protected route per gated action in index.mjs. This gateway IS the tool, not a proxy in
+// front of one, so a path with no route below is refused (denyByDefault) — nothing to fall through TO.
+//
+//   valueFields   the fields the SIGNATURE covers that this route's body must carry and match
+//   allowedFields the COMPLETE list of top-level body keys the tool reads. Anything else is refused,
+//                 because nothing signed covers it. Add a key here only when your tool reads it.
+const ROUTES = [
+  ${neutral
+    ? `{ method: 'POST', path: '/perform', action: '${scope}', valueFields: [], allowedFields: [], run: async () => ({ done: true, action: '${scope}' }) },`
+    : `{ method: 'POST', path: '/book-flight', action: '${scope}', valueFields: ['amount', 'merchant'], allowedFields: ['amount', 'currency', 'merchant'], run: async (args) => ({ pnr: 'PNR-DEMO', ...args }) },`}
+  { method: 'POST', path: '/raise-limit', action: 'permissions.update', valueFields: [], allowedFields: ['amount', 'currency', 'merchant'], run: async (args) => ({ updated: true, ...args }) },
+];
+
+const gateway = createHttpGateway({
+  guard,
+  routes: ROUTES,
+  denyByDefault: true,
+  // Payload binding (MAGP 8.3.9): the agent signs a digest of the WHOLE body and this gateway refuses to run a tool on a
+  // body that is not exactly that one — the values of every allowed field, not only amount and merchant. A request that
+  // bound no payload is refused (PAYLOAD_BINDING_REQUIRED) instead of run unbound.
+  requirePayloadBinding: true,
+  // Reached ONLY after the guard allowed the request AND the body was bound to what was signed.
+  forward: async (req) => {
+    const route = matchRoute(ROUTES, req.method, req.path);
+    let args = {};
+    try { args = JSON.parse(req.rawBody?.toString('utf8') || '{}'); } catch { /* empty body */ }
+    return { status: 200, body: await route.run(args) };
+  },
+});
 
 function readBody(req) {
   return new Promise((resolve, reject) => {
@@ -2266,26 +2352,19 @@ function readBody(req) {
 }
 
 const server = http.createServer(async (req, res) => {
-  const route = ROUTES[req.url];
-  const send = (status, body, decision) => {
+  try {
+    const rawBody = await readBody(req);
+    const result = await gateway({ method: req.method, path: req.url, headers: req.headers, rawBody });
     const headers = { 'content-type': 'application/json' };
+    const decision = result.governance?.decision;
     if (decision) headers['x-agentsafe-decision'] = decision;
-    res.writeHead(status, headers);
-    res.end(JSON.stringify(body));
-  };
-  if (req.method !== 'POST' || !route) return send(404, { decision: 'block', reasonCode: 'NO_SUCH_ROUTE' });
-  try {
-    const raw = await readBody(req);
-    const { signed, args } = JSON.parse(raw.toString('utf8') || '{}');
-    const verdict = await guard.verifyRequest({ ...signed, action: route.action });
-    if (verdict.decision !== 'allow' && verdict.decision !== 'observe') {
-      console.log('[harness-gateway] ' + verdict.decision.toUpperCase() + ' ' + req.url + ' — ' + verdict.reasonCode + ' (re-evaluated independently, did not trust the agent)');
-      return send(403, verdict, verdict.decision);
-    }
-    console.log('[harness-gateway] ALLOW ' + req.url + ' — running the real tool here, not in the agent process');
-    return send(200, await route.run(args ?? {}), verdict.decision);
+    if (result.status === 200) console.log('[harness-gateway] ALLOW ' + req.url + ' — running the real tool here, not in the agent process');
+    else console.log('[harness-gateway] ' + String(result.body?.decision ?? 'block').toUpperCase() + ' ' + req.url + ' — ' + (result.body?.reasonCode ?? 'refused') + ' (re-evaluated independently, did not trust the agent)');
+    res.writeHead(result.status, headers);
+    res.end(JSON.stringify(result.body ?? {}));
   } catch (err) {
-    return send(502, { decision: 'block', reasonCode: 'GATEWAY_ERROR', error: String(err?.message ?? err) });
+    res.writeHead(502, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ decision: 'block', reasonCode: 'GATEWAY_ERROR', error: String(err?.message ?? err) }));
   }
 });
 
@@ -2298,7 +2377,7 @@ server.listen(PORT, () => {
 
 function harnessGatewayPackageJson(slug) {
   return JSON.stringify(
-    { name: slug + '-harness-gateway', version: '0.1.0', private: true, type: 'module', scripts: { start: 'node harness-gateway.mjs' }, dependencies: { [MCP_GUARD_PKG]: MCP_GUARD_VERSION } },
+    { name: slug + '-harness-gateway', version: '0.1.0', private: true, type: 'module', scripts: { start: 'node harness-gateway.mjs' }, dependencies: { [MCP_GUARD_PKG]: MCP_GUARD_VERSION, [GATEWAY_PKG]: GATEWAY_VERSION } },
     null,
     2,
   ) + '\n';
@@ -2713,8 +2792,11 @@ const GATEWAY = process.env.HARNESS_GATEWAY_URL || 'http://localhost:${gatewayPo
 // issuer): it builds and signs the same canonical message a real gate would verify, entirely
 // offline, using this agent's own did:key — the gateway verifies that signature for itself.
 async function callGateway(path, action, args) {
-  const signed = await guard.buildSignedRequest({ action, amount: args.amount, currency: args.currency ?? '${currency}', merchant: args.merchant, context: { tool: '${scope}', riskLevel: args.riskLevel ?? 'low' } });
-  const res = await fetch(GATEWAY + path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ signed, args }) });
+  // The COMPLETE body the tool receives, signed as a payload (MAGP 8.3.9): the eight signed fields cover amount and merchant
+  // only, and this gateway refuses to run the tool on a body that is not exactly the one signed here.
+  const payload = { amount: args.amount, merchant: args.merchant, currency: args.currency ?? '${currency}' };
+  const signed = await guard.buildSignedRequest({ action, amount: args.amount, currency: args.currency ?? '${currency}', merchant: args.merchant, context: { tool: '${scope}', riskLevel: args.riskLevel ?? 'low' }, payload });
+  const res = await fetch(GATEWAY + path, { method: 'POST', headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) }, body: JSON.stringify(payload) });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
     const err = new Error('gateway ' + res.status + ': ' + (body?.reasonCode ?? 'refused'));
@@ -2915,8 +2997,10 @@ ${withGateway ? `const GATEWAY = process.env.HARNESS_GATEWAY_URL || 'http://loca
 // file to call directly. buildSignedRequest() is pure (no network, no issuer): it signs the request
 // offline with this agent's own did:key, and the gateway verifies that signature for itself.
 async function callGateway(path, action, args) {
-  const signed = await guard.buildSignedRequest({ action, merchant: MERCHANT, context: args });
-  const res = await fetch(GATEWAY + path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ signed, args }) });
+  // The body is empty on purpose (this tool reads nothing from it), and it is signed as the payload so the gateway can
+  // require binding on every route: a body with anything in it is not the one signed (MAGP 8.3.9).
+  const signed = await guard.buildSignedRequest({ action, merchant: MERCHANT, context: args, payload: {} });
+  const res = await fetch(GATEWAY + path, { method: 'POST', headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) }, body: '{}' });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
     const err = new Error('gateway ' + res.status + ': ' + (body?.reasonCode ?? 'refused'));
@@ -3132,7 +3216,15 @@ directly (or skip \`index.mjs\` and hand a forged/altered request straight to
 \`harness-gateway.mjs\`) — either way, the gateway independently re-verifies the Ed25519
 signature and re-evaluates the SAME rules file for itself. There is no raw \`${tool}()\` left
 in \`index.mjs\` to call for a shortcut, and a signature over an altered request fails
-verification regardless of which process sent it.${neutral ? `
+verification regardless of which process sent it.
+
+**Also closed — the executed arguments are bound to what was signed.** \`harness-gateway.mjs\` contains
+no enforcement logic of its own: routing, payload binding and deny-by-default come from
+\`@metamynd/agentsafe-http-gateway\`, the same component the hosted scaffold uses. A request signed for
+one amount and merchant but carrying another in the body is refused (\`PAYLOAD_NOT_BOUND\`) before your tool
+runs, and so is any top-level body key you did not list in that route's \`allowedFields\`
+(\`PAYLOAD_UNBINDABLE\`) — nothing signed covers it. When your real tool reads more body fields, list exactly
+those keys; the gateway refuses the rest.${neutral ? `
 
 **Also NOT closed — rule inputs are not signed.** The request fields your rules read (\`consent\`,
 \`piiPresent\`, \`jurisdiction\`, …) travel in the signed request's context, which the signature does
@@ -3643,6 +3735,6 @@ async function main() {
 export {
   buildPolicyCases, resolveFinancial, policyMolecules, ruleToMolecule,
   generateAgentKeypair, harnessAgentDid, harnessMandate, harnessRulesFile, harnessDefaultSopNeutral,
-  scaffoldProject, exampleIndexNeutral, exampleReadmeNeutral, gatewayServerFileNeutral, gatewayReadmeNeutral,
+  scaffoldProject, defaultNeutralDemo, exampleIndexNeutral, exampleReadmeNeutral, gatewayServerFileNeutral, gatewayReadmeNeutral,
 };
 if (!process.env.CREATE_METAMYND_AGENT_NO_MAIN) main().catch((e) => fail(e?.stack || e?.message || String(e)));

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.10.10",
+  "version": "0.11.2",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {
     "create-metamynd-agent": "index.mjs"
   },
   "scripts": {
-    "test": "node harness-gateway.smoke.mjs && node policy-demo.smoke.mjs && node hosted-nonfinancial.smoke.mjs && node modes-nonfinancial.smoke.mjs && node byok-daemon.smoke.mjs"
+    "test": "node generated-code-parses.smoke.mjs && node harness-gateway.smoke.mjs && node harness-gateway-bind.smoke.mjs && node policy-demo.smoke.mjs && node hosted-nonfinancial.smoke.mjs && node modes-nonfinancial.smoke.mjs && node byok-daemon.smoke.mjs"
   },
   "files": [
     "index.mjs",