create-metamynd-agent 0.13.0 → 0.13.2

package/index.mjs

@@ -56,7 +56,9 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // non-USD agent's `npm test` needs.
 // 0.16.0 signs an optional top-level `jurisdiction` (MAGP 8.3.12, the v2 message) — the scaffolded non-financial agent
 // passes a request's jurisdiction that way, since the gate no longer reads one from the unsigned context.
-const GUARD_VERSION = '^0.16.0';
+// 0.17.0 signs the agent's context (envelopeSignature, MAGP 8.3.13) by default; the scaffolded agent gets it with no template
+// change (signContext: false opts out). A daemon-custody agent needs agentsafe-signer >= 0.19.0 for its no-amount requests.
+const GUARD_VERSION = '^0.17.0';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -113,7 +115,9 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // change (the scaffolded gateways don't refund), but the floor must cover the real current version.
 // 0.16.0: verifies a v2 (signed-jurisdiction) request and judges jurisdiction rules on the signed value only. Required:
 // the scaffolded agent now signs jurisdiction, which an older gateway would refuse SIGNATURE_INVALID.
-const MCP_GUARD_VERSION = '^0.16.0';
+// 0.17.0: verifies the agent's context signature (envelopeSignature) before judging its itinerary, and a
+// requireContextSignature option. No template change (the scaffolded agent does not sign its context by default).
+const MCP_GUARD_VERSION = '^0.17.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
@@ -129,7 +133,23 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.13.0: a configured resolveCredential that refuses now FAILS CLOSED (502 CREDENTIAL_UNAVAILABLE) instead of forwarding
 // without a credential. No template change (the scaffolded gateway does not use the Credential Vault).
 // 0.14.0: depends on agentsafe-mcp-guard ^0.16.0 (verifies a signed-jurisdiction request). No template change.
-const GATEWAY_VERSION = '^0.14.0';
+// 0.15.0: depends on agentsafe-mcp-guard ^0.17.0 (context signature verified) and a requireContextSignature option.
+// No template change.
+// 0.16.0: the caller is answered first and the claimed hold is settled after (settleInBackground), retried on a
+// transient failure. Template change: each scaffolded gateway drains settlements on SIGTERM/SIGINT (DRAIN_ON_SHUTDOWN).
+const GATEWAY_VERSION = '^0.16.0';
+
+/** Appended to every scaffolded gateway server: give hold settlements still running a bounded moment on shutdown. */
+const DRAIN_ON_SHUTDOWN = `
+// The gateway answers first and settles the hold it claimed after (agentsafe-http-gateway 0.16.0). On shutdown, stop
+// taking requests and let the settlements still running land (up to 5 s); one that does not stays committed to the cap.
+for (const signal of ['SIGTERM', 'SIGINT']) {
+  process.once(signal, () => {
+    server.close();
+    gateway.drainSettlements(5000).then(() => process.exit(0));
+  });
+}
+`;
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -1502,7 +1522,7 @@ server.listen(PORT, () => {
   console.log('[gateway] listening on :' + PORT + ' -> the only place performAction() runs.');
   console.log('[gateway] every request is independently re-verified against this agent\\'s own policy.');
 });
-`;
+${DRAIN_ON_SHUTDOWN}`;
 }
 
 function gatewayEnvExampleNeutral() {
@@ -1701,7 +1721,7 @@ function exampleReadme(slug, scope, withGateway, gatewayPort, daemonKey = false)
   const configFileLine = daemonKey
     ? `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
   **Holds no secret key.** Signing goes through your already-running agentsafe-signer daemon
-  (\`daemonSocketPath\`) instead — see \`docs/integration/INSTALL-AGENTSAFE-SIGNER.md\`.${withGateway ? ' Payload binding is on by default and signs through the daemon too, which needs agentsafe-signer 0.15.0 or later.' : ''}`
+  (\`daemonSocketPath\`) instead — see \`docs/integration/INSTALL-AGENTSAFE-SIGNER.md\`. Context signing (on by default) signs through the daemon too; use agentsafe-signer 0.19.0 or later (an older one refuses this agent's no-amount requests with CONTEXT_SIGNING_UNSUPPORTED).${withGateway ? ' Payload binding is on by default and signs through the daemon too, which needs agentsafe-signer 0.15.0 or later.' : ''}`
     : `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
   **Contains the agent's secret key — never commit it.** It is already in \`.gitignore\`.`;
   const gatewaySection = withGateway
@@ -1912,7 +1932,7 @@ server.listen(PORT, () => {
   console.log('[gateway] listening on :' + PORT + ' -> the only place bookFlight() runs.');
   console.log('[gateway] every request is independently re-verified against this agent\\'s own policy.');
 });
-`;
+${DRAIN_ON_SHUTDOWN}`;
 }
 
 function gatewayPackageJson(slug) {
@@ -2517,7 +2537,7 @@ server.listen(PORT, () => {
   console.log('[harness-gateway] listening on :' + PORT + ' — the only place your tools run.');
   console.log('[harness-gateway] re-verifying against ../metamynd-rules.json, independently of index.mjs.');
 });
-`;
+${DRAIN_ON_SHUTDOWN}`;
 }
 
 function harnessGatewayPackageJson(slug) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {