create-metamynd-agent 0.14.18 → 0.14.24

package/index.mjs

@@ -65,7 +65,14 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // authorize request of its choosing, MAGP §8.2). Required for every scaffolded agent.
 // 0.20.0: guard.capture() signs as the agent (MAGP-SETTLE-v1) — a hold nobody claimed is settled only by its agent, a
 // counterparty the owner registered, or (an open testnet owner) anyone (MAGP §8.7.4).
-const GUARD_VERSION = '^0.20.0';
+// 0.21.0: guardTool() settles the hold an allowed call was granted (captured when the tool runs, released when it cannot
+// have), guard.void() releases one signed, and a gated tool's .resume(escalationId, args) runs an approved escalation once.
+// Required: the scaffold's npm run resume uses .resume().
+// 0.22.0: a concurrent resume of one escalation in a process is refused AUTHORIZATION_IN_USE, and a hold minted for an
+// authorize whose answer never arrived is found by nonce and released. Required: npm run resume relies on the lock.
+// 0.23.0: the guard derives the same risk floor as the gate (owner tier + a payment at or above the owner's share of the
+// per-transaction cap is HIGH), so a local check and the gate agree on a large payment's review. No template change.
+const GUARD_VERSION = '^0.23.0';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -143,7 +150,10 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.23.0: acceptCounterpartyChallenge() — a Service signs its acceptance of an owner's registration (MAGP §8.7.6). No
 // template change; required with GATEWAY_VERSION below so the gateway never resolves a second guard of its own.
 // 0.24.0: reportOutcome() signs a reportId and an occurrence count (aggregated refusals, a durable spool).
-const MCP_GUARD_VERSION = '^0.24.0';
+// 0.25.0: honourApprovals — a Service without requireAuthorization (the value-less gateway) still runs an owner-approved
+// escalation, exactly once (MAGP §8.7.18). Required: the non-financial gateway sets it and asserts guard.honoursApprovals.
+// 0.26.0: a gateway judges the same derived risk floor as the gate (owner tier + amount share of the cap).
+const MCP_GUARD_VERSION = '^0.26.0';
 /** A DID as it may appear inside a generated string literal (the gateway's allowedAgents pin): no quote, backslash or space. */
 const SAFE_DID = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
@@ -174,7 +184,9 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.21.0: per-route allowedAgents; depends on agentsafe-mcp-guard ^0.22.0.
 // 0.22.0: depends on agentsafe-mcp-guard ^0.23.0.
 // 0.23.0: refusals aggregated with their count, and `reportSpool` (both hosted templates set it); depends on agentsafe-mcp-guard ^0.24.0.
-const GATEWAY_VERSION = '^0.23.0';
+// 0.24.0: depends on agentsafe-mcp-guard ^0.25.0 (one guard in the tree with MCP_GUARD_VERSION above). No template change.
+// 0.25.0: depends on agentsafe-mcp-guard ^0.26.0 (one guard in the tree). No template change.
+const GATEWAY_VERSION = '^0.25.0';
 
 /** Appended to every scaffolded gateway server: give hold settlements still running a bounded moment on shutdown. */
 const DRAIN_ON_SHUTDOWN = `
@@ -261,6 +273,11 @@ ${c.b('Options')}
   --max-amount <n>     Total mandate budget (default 10000)
   --currency <cur>     Currency (default USD)
   --merchants <a,b>    Allowed merchants, comma-separated (optional)
+  --risk-tier <level>  The owner's risk floor for the action: low | medium | high | critical. The agent's own
+                       riskLevel can raise it, never lower it (high = every call is reviewed by a person).
+  --amount-review <f>  A single payment at or above this share of the per-transaction cap is high risk (reviewed),
+                       whatever the agent claims. A fraction in (0, 1] (default 0.7), or "off". Without --merchants,
+                       the first payment to each merchant is reviewed too.
   --byok               Bring-your-own-key: generate the keypair locally, provision + prove control
                        (MetaMynd never sees the private key). Overridden by --public-key.
   --public-key <hex>   BYOK with a key you already hold (SPKI/raw hex); you prove control yourself
@@ -1018,7 +1035,7 @@ async function resolveHostedRulePack(base, key, { financial, perTxnMax, maxAmoun
  * dashboard registration shows its own dialog before setting the flag); see the printed message
  * either way.
  */
-async function registerGatewayCounterparty(base, token, did, label, purpose = 'claim', privateKeyHex = null) {
+async function registerGatewayCounterparty(base, token, did, label, purpose = 'claim', privateKeyHex = null, agents = null) {
   try {
     // The gateway accepts its own registration (MAGP §8.7.6): ask for a challenge naming this owner, sign it with the gateway's
     // key (generated here, so this process holds it), and register with that proof. A DID is never registered on its text.
@@ -1038,7 +1055,9 @@ async function registerGatewayCounterparty(base, token, did, label, purpose = 'c
       headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
       // `report` (a non-financial gateway, which never claims): it may only report to this owner, and it changes nothing about
       // who may claim their holds, so it needs no enforcement confirmation (MAGP §8.7.6, §16.4).
-      body: JSON.stringify({ did, label, purpose, ...(proof ? { proof } : {}), ...(purpose === 'claim' ? { confirmEnforcementChange: true } : {}) }),
+      // `agents` (report only): the agents this gateway serves — the issuer lets it claim an approved value-less hold of THOSE
+      // agents only, never another agent of the same owner (MAGP §8.7.6).
+      body: JSON.stringify({ did, label, purpose, ...(proof ? { proof } : {}), ...(agents ? { agents } : {}), ...(purpose === 'claim' ? { confirmEnforcementChange: true } : {}) }),
     });
     const json = await res.json().catch(() => null);
     if (!res.ok || json?.success === false) return { ok: false, message: json?.message ?? `HTTP ${res.status}` };
@@ -1134,12 +1153,74 @@ function keepConfigAndFail(outDir, config, why) {
  * guard.escalationStatus(id) for the authorization and presents it to run the action (MAGP §8.7.18). Generated code: it
  * reads `g`, the refusal's governance verdict, and `dim`, both in scope at every call site.
  */
-function escalateNote(sandbox) {
-  return sandbox
-    ? `console.log(dim('     nobody can approve it here: the shared sandbox has no owner you can sign in as.'));
-      console.log(dim('     Provision your own agent to approve one in your dashboard.'));`
-    : `console.log(dim('     not a failure: it waits in your dashboard, under Escalations' + (g.escalationId ? ' (' + g.escalationId + ')' : '') + '.'));
+function escalateNote(sandbox, argsExpr = null) {
+  if (sandbox) {
+    return `console.log(dim('     nobody can approve it here: the shared sandbox has no owner you can sign in as.'));
+      console.log(dim('     Provision your own agent to approve one in your dashboard.'));`;
+  }
+  if (!argsExpr) {
+    return `console.log(dim('     not a failure: it waits in your dashboard, under Escalations' + (g.escalationId ? ' (' + g.escalationId + ')' : '') + '.'));
       console.log(dim('     Once you approve it, guard.escalationStatus(id) gives the agent the authorization to run it.'));`;
+  }
+  // Resumable (0.14.21; pre-beta rerun 3, E-1): the call is saved so `npm run resume -- <id>` can run it, once approved.
+  return `console.log(dim('     not a failure: it waits in your dashboard, under Escalations' + (g.escalationId ? ' (' + g.escalationId + ')' : '') + '.'));
+      if (g.escalationId) {
+        saveEscalation(g.escalationId, ${argsExpr});
+        console.log(dim('     Approve it there, then run it - exactly once - with:  npm run resume -- ' + g.escalationId));
+      }`;
+}
+
+/**
+ * The resume path a resumable scaffold carries (0.14.21; pre-beta rerun 3, E-1 — resuming used to mean writing ~15 lines
+ * by hand). `npm start` saves an escalated call's arguments to ./escalations/<id>.json; `npm run resume -- <id>` hands them
+ * to the gated tool's `.resume()` (agentsafe-guard >= 0.21.0), which waits for the owner's decision and then runs the tool
+ * exactly once under the authorization the approval minted. Generated code; `tool` is the gated tool's variable name.
+ */
+function resumeBlock(tool) {
+  return `// --- Escalations: \`npm run resume -- <escalationId>\` runs a call your owner APPROVED, exactly once. ---
+// npm start saves an escalated call's arguments to ./escalations/<id>.json. Approve it in the dashboard (AgentSafe ->
+// Escalations), then resume it: ${tool}.resume() waits for the decision and runs the tool once, under the authorization
+// the approval minted. Your own agent does the same with the escalationId from the refusal (e.governance.escalationId).
+import { mkdirSync as __mkdir, writeFileSync as __write, readFileSync as __read, rmSync as __rm, renameSync as __rename } from 'node:fs';
+const ESCALATIONS = new URL('./escalations/', import.meta.url);
+const escalationFile = (id) => {
+  if (!/^[A-Za-z0-9_-]{1,80}$/.test(String(id ?? ''))) throw new Error('not an escalation id: ' + id);
+  return new URL(id + '.json', ESCALATIONS);
+};
+function saveEscalation(id, args) {
+  __mkdir(ESCALATIONS, { recursive: true });
+  __write(escalationFile(id), JSON.stringify(args, null, 2));
+}
+if (process.argv[2] === '--resume') {
+  const id = process.argv[3];
+  // Take the saved call ATOMICALLY (a rename): a second npm run resume of the same escalation started meanwhile finds
+  // nothing to take, so two processes cannot both run it. Put back if it is still undecided; removed once it is final.
+  let saved, taken;
+  try {
+    const file = escalationFile(id);
+    taken = new URL(file.href + '.resuming');
+    __rename(file, taken);
+    saved = JSON.parse(__read(taken, 'utf8'));
+  } catch {
+    console.error('  No saved escalation "' + (id ?? '') + '" to resume (or another npm run resume is running it). Run npm start first, then: npm run resume -- <escalationId>');
+    process.exit(1);
+  }
+  console.log('  waiting for your decision on ' + id + ' (approve it in the dashboard: AgentSafe -> Escalations) ...');
+  try {
+    const result = await ${tool}.resume(id, saved);
+    __rm(taken, { force: true }); // used: a second resume has nothing to run
+    console.log('\\x1b[32m  RAN\\x1b[0m  approved, and run exactly once: ' + JSON.stringify(result));
+  } catch (e) {
+    const g = e.governance ?? {};
+    // A final answer (rejected, already used, expired) retires the saved call; still pending or unreachable keeps it.
+    if (g.decision === 'block' && g.reasonCode !== 'GATE_UNREACHABLE') __rm(taken, { force: true });
+    else __rename(taken, escalationFile(id)); // still undecided, or the gate was unreachable: keep it for the next try
+    console.log('\\x1b[31m  NOT RUN\\x1b[0m  ' + (g.reasonCode ?? e.message) + (g.status ? ' (' + g.status + ')' : ''));
+    process.exitCode = 1;
+  }
+  process.exit();
+}
+`;
 }
 
 function exampleIndexNoGateway(scope, perTxnMax, currency, merchant, sandbox = false) {
@@ -1195,6 +1276,7 @@ const gatedRaiseOwnLimit = guard.guardTool(
   }),
 );
 
+${sandbox ? '' : resumeBlock('gatedBookFlight')}
 const dim = (t) => '\\x1b[2m' + t + '\\x1b[0m';
 const bold = (t) => '\\x1b[1m' + t + '\\x1b[0m';
 const rule = (n) => '  ' + '-'.repeat(n);
@@ -1253,7 +1335,7 @@ async function attempt(n, intent, args, tool = gatedBookFlight) {
     if (g.decision === 'escalate') {
       console.log('\\x1b[33m     ESCALATED\\x1b[0m  held for a human - ' + g.reasonCode);
       console.log(dim('     ' + why));
-      ${escalateNote(sandbox)}
+      ${escalateNote(sandbox, sandbox ? null : 'args')}
     } else {
       console.log('\\x1b[31m     BLOCKED\\x1b[0m  ' + (g.reasonCode ?? 'refused'));
       console.log(dim('     ' + why));
@@ -1400,6 +1482,7 @@ const gatedRaiseOwnLimit = guard.guardTool(
   }),
 );
 
+${resumeBlock('gatedBookFlight')}
 const dim = (t) => '\\x1b[2m' + t + '\\x1b[0m';
 const bold = (t) => '\\x1b[1m' + t + '\\x1b[0m';
 const rule = (n) => '  ' + '-'.repeat(n);
@@ -1461,7 +1544,7 @@ async function attempt(n, intent, args, tool = gatedBookFlight) {
     if (g.decision === 'escalate') {
       console.log('\\x1b[33m     ESCALATED\\x1b[0m  held for a human - ' + g.reasonCode);
       console.log(dim('     ' + why));
-      ${escalateNote(false)}
+      ${escalateNote(false, 'args')}
     } else {
       console.log('\\x1b[31m     BLOCKED\\x1b[0m  ' + (g.reasonCode ?? 'refused'));
       console.log(dim('     ' + why));
@@ -1615,7 +1698,7 @@ const gatedChangeOwnPermissions = guard.guardTool(
   changeOwnPermissions,
   (a) => ({ context: a }),
 );
-
+${!sandbox ? '\n' + resumeBlock('gatedAction') : ''}
 const STEPS = ${JSON.stringify(steps, null, 2)};
 const INPUTS = ${JSON.stringify(demo.inputs)};
 const NOT_STAGED = ${JSON.stringify(demo.notDemonstrated)};
@@ -1636,7 +1719,7 @@ async function attempt(n, total, step) {
     got = g.decision ?? 'error';
     if (g.decision === 'escalate') {
       console.log('\\x1b[33m     ESCALATED\\x1b[0m  held for a human - ' + g.reasonCode);
-      ${escalateNote(sandbox)}
+      ${escalateNote(sandbox, !sandbox ? 'step.context' : null)}
     } else {
       console.log('\\x1b[31m     BLOCKED\\x1b[0m  ' + (g.reasonCode ?? e.message));
       console.log(dim(g.eventId ? '     decided by the MetaMynd gate - your tool never ran.' : '     decided right here from your signed rules (no network call), and reported for audit - your tool never ran.'));
@@ -1759,15 +1842,20 @@ const identity = JSON.parse(readFileSync(new URL('./service.metamynd.json', impo
 // whose owner granted it this same action would run your tool with your credentials (refused AGENT_NOT_ADMITTED instead).
 // Add a DID here only for another agent you mean this gateway to act for. gatewayOwnerPrincipal binds it to YOU, the owner of
 // its credentials: an agent listed here that another principal owns is refused anyway (GATEWAY_OWNER_MISMATCH).
-const guard = createMcpGuard({ serviceDid: identity.serviceDid, serviceKey: identity.serviceKey ?? undefined, issuerApi: MAGP_API, requireAuthorization: false, policyPublicKey: '${policyKey}', allowedAgents: ['${agentDid}'], gatewayOwnerPrincipal: '${ownerPrincipal}' });
-// A guard below 0.20.0 ignores allowedAgents and serves every agent: refuse to start on one (a stale lockfile, say).
+// honourApprovals: with requireAuthorization off this gateway claims nothing — except an escalated call that presents the
+// authorization your APPROVAL minted (Dashboard -> Escalations). That one it claims as an approval: the issuer grants it
+// once, only for a hold a person approved, for this agent and these values, so the approved call runs here exactly once.
+const guard = createMcpGuard({ serviceDid: identity.serviceDid, serviceKey: identity.serviceKey ?? undefined, issuerApi: MAGP_API, requireAuthorization: false, policyPublicKey: '${policyKey}', allowedAgents: ['${agentDid}'], gatewayOwnerPrincipal: '${ownerPrincipal}', honourApprovals: true });
+// A guard below 0.22.0 cannot enforce both pins (below 0.20.0 it ignores allowedAgents and serves every agent; 0.22.0 added gatewayOwnerPrincipal): refuse to start on one (a stale lockfile, say).
 if (!Array.isArray(guard.allowedAgents) || !guard.gatewayOwnerPrincipal) throw new Error('this gateway needs @metamynd/agentsafe-mcp-guard >= 0.22.0 to enforce allowedAgents and gatewayOwnerPrincipal - run npm install');
+// A guard below 0.25.0 ignores honourApprovals, and an approved escalation would stay escalated here: refuse to start on one.
+if (guard.honoursApprovals !== true) throw new Error('this gateway needs @metamynd/agentsafe-mcp-guard >= 0.25.0 to run approved escalations - run npm install');
 
 const gateway = createHttpGateway({
   guard,
   routes,
   // Every request this gateway runs or refuses is reported, signed with the identity above, to your Activity Log (MAGP
-  // 16.4). It claims nothing, so without this the issuer would never see what it executed - or that another agent tried.
+  // 16.4). It claims only an approved escalation, so without this the issuer would never see what it executed - or that another agent tried.
   reportOutcomes: true,
   // A report the issuer could not take (it was down, say) is kept here and re-sent, so nothing it saw is lost. Gitignored.
   reportSpool: './reports.spool.jsonl',
@@ -1895,10 +1983,18 @@ Replace \`performAction()\` in \`server.mjs\` with your implementation and put a
 
 /** The README for a non-financial hosted scaffold. `withGateway` selects the two-process shape. */
 /** The generated README's "Change the rules" body: the dashboard path, or — for the shared sandbox agent — how to get an agent whose rules you can change. */
-function changeRulesSection(sandbox) {
+function changeRulesSection(sandbox, resumable = false) {
   return sandbox
     ? `${SANDBOX_RULES_FIXED} An \`escalate\` verdict is held for an owner to approve; poll \`guard.escalationStatus(id)\`.`
-    : `Edit the agent's SOPs in the dashboard (${SOPS_PATH}). The agent's behaviour changes live —
+    : resumable
+      ? `Edit the agent's SOPs in the dashboard (${SOPS_PATH}). The agent's behaviour changes live —
+no redeploy.
+
+An \`escalate\` verdict is held for an owner to approve. \`npm start\` saves an escalated call and prints its id; approve it
+in the dashboard (AgentSafe → Escalations), then \`npm run resume -- <escalationId>\` runs it exactly once under the
+authorization the approval minted. In your own agent that is one call: \`await gatedTool.resume(escalationId, sameArgs)\`
+(\`@metamynd/agentsafe-guard\` ≥ 0.21.0) — pass the SAME arguments; the approval is bound to that request.`
+      : `Edit the agent's SOPs in the dashboard (${SOPS_PATH}). The agent's behaviour changes live —
 no redeploy. An \`escalate\` verdict is held for an owner to approve; poll \`guard.escalationStatus(id)\`.`;
 }
 
@@ -1981,7 +2077,7 @@ ${clonedFreshSection(daemonKey)}
 
 ## Change the rules
 
-${changeRulesSection(sandbox)}
+${changeRulesSection(sandbox, !sandbox)}
 
 ## What this is not
 
@@ -2000,7 +2096,7 @@ Full integration guide: \`docs/integration/INTEGRATE-WITH-METAMYND.md\`.
 `;
 }
 
-function examplePackageJson(slug, neutral = false) {
+function examplePackageJson(slug, neutral = false, resumable = false) {
   return JSON.stringify(
     {
       name: slug,
@@ -2010,7 +2106,7 @@ function examplePackageJson(slug, neutral = false) {
       // `verify` is scaffolded in because governance that lives only in a dashboard is a
       // thing someone has to remember to look at. As a build step it is a control: a change
       // that widens this agent's authority fails `npm test`.
-      scripts: { start: 'node index.mjs', test: neutral ? 'agentsafe-guard verify --context ./verify-context.json' : 'agentsafe-guard verify' },
+      scripts: { start: 'node index.mjs', ...(resumable ? { resume: 'node index.mjs --resume' } : {}), test: neutral ? 'agentsafe-guard verify --context ./verify-context.json' : 'agentsafe-guard verify' },
       dependencies: { [GUARD_PKG]: GUARD_VERSION },
     },
     null,
@@ -2112,14 +2208,14 @@ ${clonedFreshSection(daemonKey)}
 
 ## Change the rules
 
-${changeRulesSection(sandbox)}
+${changeRulesSection(sandbox, !sandbox)}
 
 Full integration guide: \`docs/integration/INTEGRATE-WITH-METAMYND.md\`.
 `;
 }
 
 function gitignore() {
-  return `node_modules/\nagent.metamynd.json\n.env\n`;
+  return `node_modules/\nagent.metamynd.json\n.env\nescalations/\n`;
 }
 
 // ---------- the default hosted scaffold's second process: a separate tool gateway ----------
@@ -2194,7 +2290,7 @@ const identity = JSON.parse(readFileSync(new URL('./service.metamynd.json', impo
 // The claim below does not stop that on its own: the hold belongs to the CALLER, and the caller's owner decides which
 // services may claim it — including registering this gateway's DID as one of theirs.
 const guard = createMcpGuard({ serviceDid: identity.serviceDid, serviceKey: identity.serviceKey ?? undefined, issuerApi: MAGP_API, requireAuthorization: true, policyPublicKey: '${policyKey}', allowedAgents: ['${agentDid}'], gatewayOwnerPrincipal: '${ownerPrincipal}' });
-// A guard below 0.20.0 ignores allowedAgents and serves every agent: refuse to start on one (a stale lockfile, say).
+// A guard below 0.22.0 cannot enforce both pins (below 0.20.0 it ignores allowedAgents and serves every agent; 0.22.0 added gatewayOwnerPrincipal): refuse to start on one (a stale lockfile, say).
 if (!Array.isArray(guard.allowedAgents) || !guard.gatewayOwnerPrincipal) throw new Error('this gateway needs @metamynd/agentsafe-mcp-guard >= 0.22.0 to enforce allowedAgents and gatewayOwnerPrincipal - run npm install');
 
 const gateway = createHttpGateway({
@@ -2388,17 +2484,33 @@ on purpose: an agent must never be able to release or lower-settle a hold it aut
 provisioning, \`npx create-metamynd-agent\` registered that DID as a trusted counterparty for you
 (\`POST /policy/counterparties\`). A **MAINNET** hold is *always* registered-only, regardless of your
 registry (MAGP §8.7.10) — a testnet hold stays open unless you have registered anything at all.
-Manage the registry at \`/dashboard/counterparties\`, or:
+Manage the registry at \`/dashboard/counterparties\` (it walks you through the proof below), or
+re-register this gateway yourself — after removing it from the registry, say.
+
+Registration needs **proof of control** (MAGP §8.7.6): you ask for a challenge naming you, this
+gateway signs it with its own key from \`service.metamynd.json\`, and you register with that
+signature. A DID is never registered on its text alone, so nobody can register a gateway they do
+not hold the key for. Run this from this directory (bash; \`TOKEN\` is your owner access token):
 
 \`\`\`bash
-curl -X POST $MAGP_API/policy/counterparties \\
-  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \\
-  -d '{ "did": "'"$(node -e "console.log(JSON.parse(require('fs').readFileSync('./service.metamynd.json')).serviceDid)")"'", "confirmEnforcementChange": true }'
+MAGP_API=https://metamynd.ai/api/v1 TOKEN=<owner access token> node --input-type=module -e "
+import { readFileSync } from 'node:fs'; import crypto from 'node:crypto';
+const { serviceDid, serviceKey } = JSON.parse(readFileSync('./service.metamynd.json', 'utf8'));
+const api = process.env.MAGP_API, headers = { 'Content-Type': 'application/json', Authorization: 'Bearer ' + process.env.TOKEN };
+const post = (path, body) => fetch(api + path, { method: 'POST', headers, body: JSON.stringify(body) });
+const ch = (await (await post('/policy/counterparties/challenge', { did: serviceDid, purpose: 'claim' })).json()).data;
+const key = crypto.createPrivateKey({ key: Buffer.from(serviceKey, 'hex'), format: 'der', type: 'pkcs8' });
+const signature = crypto.sign(null, Buffer.from(ch.message, 'utf8'), key).toString('hex');
+const r = await post('/policy/counterparties', { did: serviceDid, purpose: 'claim', proof: { challengeToken: ch.challengeToken, signature }, confirmEnforcementChange: true });
+console.log(r.status, await r.text());
+"
 \`\`\`
 
-\`confirmEnforcementChange: true\` is required only for your account's FIRST-EVER registration —
-it switches EVERY one of your holds (not just this agent's) from open to registered-only, so the
-API refuses a first registration without it.
+The gateway's own \`guard.acceptCounterpartyChallenge(message)\` (\`@metamynd/agentsafe-mcp-guard\`
+≥ 0.23.0) signs the same thing, if you would rather expose it from \`server.mjs\`.
+\`confirmEnforcementChange: true\` matters only for your account's FIRST-EVER registration — it
+switches EVERY one of your holds (not just this agent's) from open to registered-only, so the API
+refuses a first registration without it.
 - **Amount unknown.** \`amount-unknown\` (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.3.0) blocks a
   platform tool by default when its raw bytes or a nested payload hide the amount from a naive
   spend cap — AND this agent's OWN starter SOP (see \`agent.metamynd.json\` /
@@ -2479,7 +2591,8 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'U
         : exampleIndexNoGateway(scope, perTxnMax, currency, paymentMerchant, !!sandbox),
     force,
   );
-  writeFileSafe(outDir, 'package.json', examplePackageJson(slug, neutral), force);
+  // Resumable = the index carries the resume path (resumeBlock): every agent but the shared sandbox, where nobody can approve.
+  writeFileSafe(outDir, 'package.json', examplePackageJson(slug, neutral, !sandbox), force);
   writeFileSafe(outDir, '.gitignore', gitignore(), force);
   writeFileSafe(
     outDir,
@@ -2792,7 +2905,7 @@ const guard = createMcpGuard({
     return { subject: AGENT_DID, ownerPrincipal: HARNESS_OWNER, ...bundleFromRules(rules) };
   },
 });
-// A guard below 0.20.0 ignores allowedAgents and serves every agent: refuse to start on one (a stale lockfile, say).
+// A guard below 0.22.0 cannot enforce both pins (below 0.20.0 it ignores allowedAgents and serves every agent; 0.22.0 added gatewayOwnerPrincipal): refuse to start on one (a stale lockfile, say).
 if (!Array.isArray(guard.allowedAgents) || !guard.gatewayOwnerPrincipal) throw new Error('this gateway needs @metamynd/agentsafe-mcp-guard >= 0.22.0 to enforce allowedAgents and gatewayOwnerPrincipal - run npm install');
 
 // One protected route per gated action in index.mjs. This gateway IS the tool, not a proxy in
@@ -4152,6 +4265,13 @@ async function main() {
     Array.isArray(fileConfig?.merchants) ? fileConfig.merchants.join(',') : '',
   );
   const merchants = String(merchantsRaw).split(',').map((s) => s.trim()).filter(Boolean);
+  // Risk the agent cannot lower (MAGP 6.4.3): the owner's floor, and the amount share of the cap that is reviewed.
+  const riskTier = typeof args['risk-tier'] === 'string' ? args['risk-tier'].trim().toLowerCase() : undefined;
+  if (riskTier !== undefined && !['low', 'medium', 'high', 'critical'].includes(riskTier)) fail('--risk-tier must be low, medium, high or critical');
+  const amountReviewRaw = typeof args['amount-review'] === 'string' ? args['amount-review'].trim().toLowerCase() : undefined;
+  const amountShare = amountReviewRaw === undefined ? undefined : amountReviewRaw === 'off' ? false : Number(amountReviewRaw);
+  if (typeof amountShare === 'number' && !(amountShare > 0 && amountShare <= 1)) fail('--amount-review must be a fraction in (0, 1], or "off"');
+  const riskFields = { ...(riskTier ? { riskTier } : {}), ...(amountShare !== undefined && financial ? { riskSignals: { amountShare } } : {}) };
 
   // BYOK: --byok generates a keypair on THIS machine (MetaMynd never sees the private key) —
   // either locally in this process (default) or, opt-in, via an already-running agentsafe-signer
@@ -4222,6 +4342,7 @@ async function main() {
     network: 'testnet',
     ...(financial ? { currency, maxAmount, perTxnMax } : {}),
     merchants,
+    ...riskFields,
     ...(publicKey ? { publicKey } : {}),
     ...sopFields,
   };
@@ -4230,6 +4351,11 @@ async function main() {
   if (!config?.agentDid) fail('Provisioning did not return a config with an agentDid.');
   console.log(`  ${c.green('✓')} agent DID ${c.b(config.agentDid)}`);
   if (config.standards?.length) console.log(`  ${c.green('✓')} enforced Standards: ${config.standards.join(', ')}`);
+  if (financial && merchants.length === 0) {
+    console.log(c.dim('     no --merchants list: the FIRST payment to each merchant is held for your review (a risk the agent cannot'));
+    console.log(c.dim('     lower). Pass --merchants a,b to pre-approve them, or register them as payees in the dashboard.'));
+  }
+  if (riskTier) console.log(`  ${c.green('✓')} risk floor: ${riskTier} (the agent's own claim can raise it, never lower it)`);
 
   // 3b. BYOK: prove control of the key (verify-key), else the gate blocks with AGENT_KEY_UNVERIFIED.
   if (daemonPublicKeyHex) {
@@ -4276,13 +4402,18 @@ async function main() {
     const gatewayDid = buildDidKey(rawPublicKeyFromSpkiHex(gwKeypair.publicKeyHex));
     gatewayIdentity = { did: gatewayDid, keyHex: gwKeypair.privateKeyHex };
     console.log(c.dim(`\n  → registering the gateway's identity as a trusted counterparty (${financial ? "so it can claim this agent's holds and report to you" : 'so its reports reach your Activity Log'}) …`));
-    const reg = await registerGatewayCounterparty(base, token, gatewayDid, `${scope}-gateway`, financial ? 'claim' : 'report', gwKeypair.privateKeyHex);
+    const reg = await registerGatewayCounterparty(base, token, gatewayDid, `${scope}-gateway`, financial ? 'claim' : 'report', gwKeypair.privateKeyHex, financial ? null : [config.agentDid]);
     if (reg.ok) {
       console.log(`  ${c.green('✓')} gateway DID ${c.b(gatewayDid)} — ${reg.message}`);
     } else {
       console.log(`  ${c.yellow('!')} could not register the gateway as a trusted counterparty: ${reg.message}`);
-      console.log(c.dim(`     it still works on testnet (open by default with no registry entries); a MAINNET hold cannot be`));
-      console.log(c.dim(`     claimed until it is registered — POST ${base}/policy/counterparties { "did": "${gatewayDid}", "confirmEnforcementChange": true }`));
+      console.log(c.dim(financial
+        ? `     it still works on testnet (open by default with no registry entries); a MAINNET hold cannot be`
+        : `     it still enforces; only its refusal reports cannot reach your Activity Log until it is`));
+      console.log(c.dim(financial
+        ? `     claimed until it is registered — gateway/README.md ("Who may claim this agent's holds") shows how, with the`
+        : `     registered — at /dashboard/counterparties, with the`));
+      console.log(c.dim(`     proof-of-control step registration requires, for ${gatewayDid}`));
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.14.18",
+  "version": "0.14.24",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {