create-metamynd-agent 0.14.22 → 0.14.24

package/index.mjs

@@ -68,7 +68,11 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // 0.21.0: guardTool() settles the hold an allowed call was granted (captured when the tool runs, released when it cannot
 // have), guard.void() releases one signed, and a gated tool's .resume(escalationId, args) runs an approved escalation once.
 // Required: the scaffold's npm run resume uses .resume().
-const GUARD_VERSION = '^0.21.0';
+// 0.22.0: a concurrent resume of one escalation in a process is refused AUTHORIZATION_IN_USE, and a hold minted for an
+// authorize whose answer never arrived is found by nonce and released. Required: npm run resume relies on the lock.
+// 0.23.0: the guard derives the same risk floor as the gate (owner tier + a payment at or above the owner's share of the
+// per-transaction cap is HIGH), so a local check and the gate agree on a large payment's review. No template change.
+const GUARD_VERSION = '^0.23.0';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -148,7 +152,8 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.24.0: reportOutcome() signs a reportId and an occurrence count (aggregated refusals, a durable spool).
 // 0.25.0: honourApprovals — a Service without requireAuthorization (the value-less gateway) still runs an owner-approved
 // escalation, exactly once (MAGP §8.7.18). Required: the non-financial gateway sets it and asserts guard.honoursApprovals.
-const MCP_GUARD_VERSION = '^0.25.0';
+// 0.26.0: a gateway judges the same derived risk floor as the gate (owner tier + amount share of the cap).
+const MCP_GUARD_VERSION = '^0.26.0';
 /** A DID as it may appear inside a generated string literal (the gateway's allowedAgents pin): no quote, backslash or space. */
 const SAFE_DID = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
@@ -180,7 +185,8 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.22.0: depends on agentsafe-mcp-guard ^0.23.0.
 // 0.23.0: refusals aggregated with their count, and `reportSpool` (both hosted templates set it); depends on agentsafe-mcp-guard ^0.24.0.
 // 0.24.0: depends on agentsafe-mcp-guard ^0.25.0 (one guard in the tree with MCP_GUARD_VERSION above). No template change.
-const GATEWAY_VERSION = '^0.24.0';
+// 0.25.0: depends on agentsafe-mcp-guard ^0.26.0 (one guard in the tree). No template change.
+const GATEWAY_VERSION = '^0.25.0';
 
 /** Appended to every scaffolded gateway server: give hold settlements still running a bounded moment on shutdown. */
 const DRAIN_ON_SHUTDOWN = `
@@ -267,6 +273,11 @@ ${c.b('Options')}
   --max-amount <n>     Total mandate budget (default 10000)
   --currency <cur>     Currency (default USD)
   --merchants <a,b>    Allowed merchants, comma-separated (optional)
+  --risk-tier <level>  The owner's risk floor for the action: low | medium | high | critical. The agent's own
+                       riskLevel can raise it, never lower it (high = every call is reviewed by a person).
+  --amount-review <f>  A single payment at or above this share of the per-transaction cap is high risk (reviewed),
+                       whatever the agent claims. A fraction in (0, 1] (default 0.7), or "off". Without --merchants,
+                       the first payment to each merchant is reviewed too.
   --byok               Bring-your-own-key: generate the keypair locally, provision + prove control
                        (MetaMynd never sees the private key). Overridden by --public-key.
   --public-key <hex>   BYOK with a key you already hold (SPKI/raw hex); you prove control yourself
@@ -1024,7 +1035,7 @@ async function resolveHostedRulePack(base, key, { financial, perTxnMax, maxAmoun
  * dashboard registration shows its own dialog before setting the flag); see the printed message
  * either way.
  */
-async function registerGatewayCounterparty(base, token, did, label, purpose = 'claim', privateKeyHex = null) {
+async function registerGatewayCounterparty(base, token, did, label, purpose = 'claim', privateKeyHex = null, agents = null) {
   try {
     // The gateway accepts its own registration (MAGP §8.7.6): ask for a challenge naming this owner, sign it with the gateway's
     // key (generated here, so this process holds it), and register with that proof. A DID is never registered on its text.
@@ -1044,7 +1055,9 @@ async function registerGatewayCounterparty(base, token, did, label, purpose = 'c
       headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
       // `report` (a non-financial gateway, which never claims): it may only report to this owner, and it changes nothing about
       // who may claim their holds, so it needs no enforcement confirmation (MAGP §8.7.6, §16.4).
-      body: JSON.stringify({ did, label, purpose, ...(proof ? { proof } : {}), ...(purpose === 'claim' ? { confirmEnforcementChange: true } : {}) }),
+      // `agents` (report only): the agents this gateway serves — the issuer lets it claim an approved value-less hold of THOSE
+      // agents only, never another agent of the same owner (MAGP §8.7.6).
+      body: JSON.stringify({ did, label, purpose, ...(proof ? { proof } : {}), ...(agents ? { agents } : {}), ...(purpose === 'claim' ? { confirmEnforcementChange: true } : {}) }),
     });
     const json = await res.json().catch(() => null);
     if (!res.ok || json?.success === false) return { ok: false, message: json?.message ?? `HTTP ${res.status}` };
@@ -1168,7 +1181,7 @@ function resumeBlock(tool) {
 // npm start saves an escalated call's arguments to ./escalations/<id>.json. Approve it in the dashboard (AgentSafe ->
 // Escalations), then resume it: ${tool}.resume() waits for the decision and runs the tool once, under the authorization
 // the approval minted. Your own agent does the same with the escalationId from the refusal (e.governance.escalationId).
-import { mkdirSync as __mkdir, writeFileSync as __write, readFileSync as __read, rmSync as __rm } from 'node:fs';
+import { mkdirSync as __mkdir, writeFileSync as __write, readFileSync as __read, rmSync as __rm, renameSync as __rename } from 'node:fs';
 const ESCALATIONS = new URL('./escalations/', import.meta.url);
 const escalationFile = (id) => {
   if (!/^[A-Za-z0-9_-]{1,80}$/.test(String(id ?? ''))) throw new Error('not an escalation id: ' + id);
@@ -1180,20 +1193,28 @@ function saveEscalation(id, args) {
 }
 if (process.argv[2] === '--resume') {
   const id = process.argv[3];
-  let saved;
-  try { saved = JSON.parse(__read(escalationFile(id), 'utf8')); } catch {
-    console.error('  No saved escalation "' + (id ?? '') + '". Run npm start first, then: npm run resume -- <escalationId>');
+  // Take the saved call ATOMICALLY (a rename): a second npm run resume of the same escalation started meanwhile finds
+  // nothing to take, so two processes cannot both run it. Put back if it is still undecided; removed once it is final.
+  let saved, taken;
+  try {
+    const file = escalationFile(id);
+    taken = new URL(file.href + '.resuming');
+    __rename(file, taken);
+    saved = JSON.parse(__read(taken, 'utf8'));
+  } catch {
+    console.error('  No saved escalation "' + (id ?? '') + '" to resume (or another npm run resume is running it). Run npm start first, then: npm run resume -- <escalationId>');
     process.exit(1);
   }
   console.log('  waiting for your decision on ' + id + ' (approve it in the dashboard: AgentSafe -> Escalations) ...');
   try {
     const result = await ${tool}.resume(id, saved);
-    __rm(escalationFile(id), { force: true }); // used: a second resume has nothing to run
+    __rm(taken, { force: true }); // used: a second resume has nothing to run
     console.log('\\x1b[32m  RAN\\x1b[0m  approved, and run exactly once: ' + JSON.stringify(result));
   } catch (e) {
     const g = e.governance ?? {};
     // A final answer (rejected, already used, expired) retires the saved call; still pending or unreachable keeps it.
-    if (g.decision === 'block' && g.reasonCode !== 'GATE_UNREACHABLE') __rm(escalationFile(id), { force: true });
+    if (g.decision === 'block' && g.reasonCode !== 'GATE_UNREACHABLE') __rm(taken, { force: true });
+    else __rename(taken, escalationFile(id)); // still undecided, or the gate was unreachable: keep it for the next try
     console.log('\\x1b[31m  NOT RUN\\x1b[0m  ' + (g.reasonCode ?? e.message) + (g.status ? ' (' + g.status + ')' : ''));
     process.exitCode = 1;
   }
@@ -4244,6 +4265,13 @@ async function main() {
     Array.isArray(fileConfig?.merchants) ? fileConfig.merchants.join(',') : '',
   );
   const merchants = String(merchantsRaw).split(',').map((s) => s.trim()).filter(Boolean);
+  // Risk the agent cannot lower (MAGP 6.4.3): the owner's floor, and the amount share of the cap that is reviewed.
+  const riskTier = typeof args['risk-tier'] === 'string' ? args['risk-tier'].trim().toLowerCase() : undefined;
+  if (riskTier !== undefined && !['low', 'medium', 'high', 'critical'].includes(riskTier)) fail('--risk-tier must be low, medium, high or critical');
+  const amountReviewRaw = typeof args['amount-review'] === 'string' ? args['amount-review'].trim().toLowerCase() : undefined;
+  const amountShare = amountReviewRaw === undefined ? undefined : amountReviewRaw === 'off' ? false : Number(amountReviewRaw);
+  if (typeof amountShare === 'number' && !(amountShare > 0 && amountShare <= 1)) fail('--amount-review must be a fraction in (0, 1], or "off"');
+  const riskFields = { ...(riskTier ? { riskTier } : {}), ...(amountShare !== undefined && financial ? { riskSignals: { amountShare } } : {}) };
 
   // BYOK: --byok generates a keypair on THIS machine (MetaMynd never sees the private key) —
   // either locally in this process (default) or, opt-in, via an already-running agentsafe-signer
@@ -4314,6 +4342,7 @@ async function main() {
     network: 'testnet',
     ...(financial ? { currency, maxAmount, perTxnMax } : {}),
     merchants,
+    ...riskFields,
     ...(publicKey ? { publicKey } : {}),
     ...sopFields,
   };
@@ -4322,6 +4351,11 @@ async function main() {
   if (!config?.agentDid) fail('Provisioning did not return a config with an agentDid.');
   console.log(`  ${c.green('✓')} agent DID ${c.b(config.agentDid)}`);
   if (config.standards?.length) console.log(`  ${c.green('✓')} enforced Standards: ${config.standards.join(', ')}`);
+  if (financial && merchants.length === 0) {
+    console.log(c.dim('     no --merchants list: the FIRST payment to each merchant is held for your review (a risk the agent cannot'));
+    console.log(c.dim('     lower). Pass --merchants a,b to pre-approve them, or register them as payees in the dashboard.'));
+  }
+  if (riskTier) console.log(`  ${c.green('✓')} risk floor: ${riskTier} (the agent's own claim can raise it, never lower it)`);
 
   // 3b. BYOK: prove control of the key (verify-key), else the gate blocks with AGENT_KEY_UNVERIFIED.
   if (daemonPublicKeyHex) {
@@ -4368,7 +4402,7 @@ async function main() {
     const gatewayDid = buildDidKey(rawPublicKeyFromSpkiHex(gwKeypair.publicKeyHex));
     gatewayIdentity = { did: gatewayDid, keyHex: gwKeypair.privateKeyHex };
     console.log(c.dim(`\n  → registering the gateway's identity as a trusted counterparty (${financial ? "so it can claim this agent's holds and report to you" : 'so its reports reach your Activity Log'}) …`));
-    const reg = await registerGatewayCounterparty(base, token, gatewayDid, `${scope}-gateway`, financial ? 'claim' : 'report', gwKeypair.privateKeyHex);
+    const reg = await registerGatewayCounterparty(base, token, gatewayDid, `${scope}-gateway`, financial ? 'claim' : 'report', gwKeypair.privateKeyHex, financial ? null : [config.agentDid]);
     if (reg.ok) {
       console.log(`  ${c.green('✓')} gateway DID ${c.b(gatewayDid)} — ${reg.message}`);
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.14.22",
+  "version": "0.14.24",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {