create-metamynd-agent 0.14.31 → 0.14.40

package/index.mjs

@@ -82,7 +82,20 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // it with a full-amount capture. Required: every scaffolded agent calls its gateway, which claims and settles.
 // 0.28.0: .resume() takes the approval's one resume at the issuer, so two processes resuming it cannot both run the tool.
 // Required: npm run resume relies on it (its file rename only covers one machine's working directory).
-const GUARD_VERSION = '^0.28.0';
+// 0.29.0: .resume() runs only the CONTEXT the owner approved too (the escalation's contextDigest), so an approval of one
+// operation cannot be resumed as another. Required: with an issuer that binds it, the gateway claim needs the same context.
+// 0.30.0: a local permit or containment refusal is only given on a bundle at most lifecycleMaxAgeMs (5 s) old, so a
+// suspension or reinstatement reaches a running agent within seconds, not within the bundle's 10-minute maxStaleness.
+// 0.31.0: a guarded tool's decision carries governanceHeaders() — the signed request and its authorization, ready for a
+// gateway — so a tool no longer rebuilds and re-signs it. Required: the scaffold's gateway calls (bookFlightViaGateway,
+// performViaGateway, and npm run resume through them) send decision.governanceHeaders() (pre-beta rerun 6, FW6-2).
+// 0.32.0: resume() signs the in-process resume claim as MAGP-RESUME-CLAIM-v2, binding the approved request and context at the
+// issuer (pre-beta rerun 6 F-1-NF-R); an issuer that requires it refuses the v1 claim older guards sign.
+// 0.33.0: the bundled policy-core judges owner-keyed operation rules (context-value-in / -not-in, NF-RISK-SELF) like the
+// gate, so a local check escalates an owner-marked op (e.g. delete-all) whatever riskLevel the agent declares.
+// 0.34.0: a tool whose gateway predates the approved-context binding (AUTHORIZATION_CONTEXT_REQUIRED) no longer voids the approval;
+// resume() works again once the gateway is upgraded, and a voided approval is reported AUTHORIZATION_VOIDED (pre-beta rerun 6 FW6-1).
+const GUARD_VERSION = '^0.34.0';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -163,7 +176,14 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.25.0: honourApprovals — a Service without requireAuthorization (the value-less gateway) still runs an owner-approved
 // escalation, exactly once (MAGP §8.7.18). Required: the non-financial gateway sets it and asserts guard.honoursApprovals.
 // 0.26.0: a gateway judges the same derived risk floor as the gate (owner tier + amount share of the cap).
-const MCP_GUARD_VERSION = '^0.26.0';
+// 0.27.0: a claim of a person-approved hold states the digest of the context it executes (MAGP §9a.5), and a grant naming
+// another (or none) is released and refused. Required: the issuer refuses AUTHORIZATION_CONTEXT_REQUIRED to a claimer that
+// states none, so an older gateway could no longer run an approved escalation.
+// 0.27.1: reportOutcome() reports an authorization a request only NAMED as presented, never as the one it ran under (FW6-3).
+// 0.28.0: a gateway judges owner-keyed operation rules (context-value-in / -not-in) from its bundle like the gate
+// (NF-RISK-SELF). Required: a gateway on an older guard would read an operation rule's atom as unknown and let it run.
+// 0.29.0: a claim the issuer refuses is logged in one line and its block carries the issuer's detail (FW6-1).
+const MCP_GUARD_VERSION = '^0.29.0';
 /** A DID as it may appear inside a generated string literal (the gateway's allowedAgents pin): no quote, backslash or space. */
 const SAFE_DID = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
@@ -196,7 +216,11 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.23.0: refusals aggregated with their count, and `reportSpool` (both hosted templates set it); depends on agentsafe-mcp-guard ^0.24.0.
 // 0.24.0: depends on agentsafe-mcp-guard ^0.25.0 (one guard in the tree with MCP_GUARD_VERSION above). No template change.
 // 0.25.0: depends on agentsafe-mcp-guard ^0.26.0 (one guard in the tree). No template change.
-const GATEWAY_VERSION = '^0.25.0';
+// 0.26.0: depends on agentsafe-mcp-guard ^0.27.0 (the approved-context binding). Required with MCP_GUARD_VERSION above.
+// 0.26.1: a report names an authorization as claimed only when this gateway claimed it (FW6-3); depends on agentsafe-mcp-guard ^0.27.1.
+// 0.27.0: depends on agentsafe-mcp-guard ^0.28.0 (operation rules). Required with MCP_GUARD_VERSION above.
+// 0.28.0: a 403 for a refused claim carries the issuer's detail (FW6-1); depends on agentsafe-mcp-guard ^0.29.0.
+const GATEWAY_VERSION = '^0.28.0';
 
 /** Appended to every scaffolded gateway server: give hold settlements still running a bounded moment on shutdown. */
 const DRAIN_ON_SHUTDOWN = `
@@ -931,7 +955,9 @@ function daemonRequest(socketPath, op, params, { connectTimeoutMs = 5000 } = {})
       sock.once('error', (err) => {
         cleanup();
         if (settled) return;
-        if (err.code === 'ENOENT' && Date.now() < deadline) { setTimeout(attempt, 20); return; }
+        // ECONNREFUSED too: the one-shot admin socket is called right as `start --admin` builds it,
+        // and a Unix socket refuses between bind() and listen(). A refused connect sent nothing.
+        if ((err.code === 'ENOENT' || err.code === 'ECONNREFUSED') && Date.now() < deadline) { setTimeout(attempt, 20); return; }
         settled = true;
         clearTimeout(overallTimer);
         reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: ${err.message}`), { code: 'DAEMON_UNREACHABLE' }));
@@ -971,6 +997,10 @@ async function apiPost(base, path, body, token) {
   } catch (e) {
     fail(`Cannot reach ${base}${path} — is the API up? (${e.message})`);
   }
+  return readApiJson(res, path);
+}
+
+async function readApiJson(res, path) {
   const text = await res.text();
   let json = null;
   try { json = text ? JSON.parse(text) : null; } catch { /* non-JSON */ }
@@ -981,6 +1011,70 @@ async function apiPost(base, path, body, token) {
   return json;
 }
 
+// ---------- owner session ----------
+// An owner access token lives 15 minutes (pre-beta rerun 6, OBS session TTL, #926); the refresh token from the same
+// sign-in renews it (POST /auth/refresh-token, which rotates both). Every owner-authenticated call this CLI makes goes
+// through ownerFetch: on a 401 it renews the session ONCE — the refresh token first, else a fresh sign-in with the
+// credentials already given to this run — and retries the call once. The password stays in this process's memory
+// for that purpose only; it is never written anywhere (pre-beta rerun 6, CLI login expiry).
+async function ownerLogin(base, email, password) {
+  const login = await apiPost(base, '/auth/login', { username: email, password }, null);
+  const token = login?.data?.accessToken;
+  if (!token) fail('Login succeeded but no access token was returned.');
+  return { base, email, password, token, refreshToken: login?.data?.refreshToken ?? null };
+}
+
+/** Renew an expired owner session in place; true when a new access token was obtained. Never fatal. */
+async function renewOwnerSession(session) {
+  const post = (path, body) => fetch(`${session.base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  if (session.refreshToken) {
+    try {
+      const res = await post('/auth/refresh-token', { refreshToken: session.refreshToken });
+      const json = res.ok ? await res.json().catch(() => null) : null;
+      // The refresh endpoint answers at the top level ({ accessToken, refreshToken }); accept a `data` envelope too.
+      const token = json?.accessToken ?? json?.data?.accessToken;
+      if (token) {
+        session.token = token;
+        session.refreshToken = json?.refreshToken ?? json?.data?.refreshToken ?? session.refreshToken;
+        return true;
+      }
+    } catch { /* fall through to a fresh sign-in */ }
+  }
+  if (typeof session.password === 'string') {
+    try {
+      const res = await post('/auth/login', { username: session.email, password: session.password });
+      const json = res.ok ? await res.json().catch(() => null) : null;
+      if (json?.data?.accessToken) {
+        session.token = json.data.accessToken;
+        session.refreshToken = json.data.refreshToken ?? null;
+        return true;
+      }
+    } catch { /* reported by the caller's retry */ }
+  }
+  return false;
+}
+
+/** fetch() with the owner's bearer token; a 401 renews the session once and retries once. */
+async function ownerFetch(session, path, init = {}) {
+  const send = () => fetch(`${session.base}${path}`, { ...init, headers: { 'Content-Type': 'application/json', ...(init.headers ?? {}), Authorization: `Bearer ${session.token}` } });
+  const res = await send();
+  if (res.status !== 401) return res;
+  if (!(await renewOwnerSession(session))) return res;
+  console.log(c.dim('  → your owner session had expired; renewed it and retried'));
+  return send();
+}
+
+/** apiPost for an owner-authenticated call: fatal on failure, renewed once on an expired token. */
+async function ownerPost(session, path, body) {
+  let res;
+  try {
+    res = await ownerFetch(session, path, { method: 'POST', body: JSON.stringify(body) });
+  } catch (e) {
+    fail(`Cannot reach ${session.base}${path} — is the API up? (${e.message})`);
+  }
+  return readApiJson(res, path);
+}
+
 /** GET a public, read-only endpoint; null on ANY failure (unreachable, non-2xx, non-JSON) — never fatal. */
 async function softGet(base, path) {
   try {
@@ -1049,24 +1143,22 @@ async function resolveHostedRulePack(base, key, { financial, perTxnMax, maxAmoun
  * dashboard registration shows its own dialog before setting the flag); see the printed message
  * either way.
  */
-async function registerGatewayCounterparty(base, token, did, label, purpose = 'claim', privateKeyHex = null, agents = null) {
+async function registerGatewayCounterparty(session, did, label, purpose = 'claim', privateKeyHex = null, agents = null) {
   try {
     // The gateway accepts its own registration (MAGP §8.7.6): ask for a challenge naming this owner, sign it with the gateway's
     // key (generated here, so this process holds it), and register with that proof. A DID is never registered on its text.
     let proof;
     if (privateKeyHex) {
-      const ch = await fetch(`${base}/policy/counterparties/challenge`, {
+      const ch = await ownerFetch(session, '/policy/counterparties/challenge', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
         body: JSON.stringify({ did, purpose }),
       });
       const chJson = await ch.json().catch(() => null);
       if (!ch.ok || !chJson?.data?.message) return { ok: false, message: chJson?.message ?? `challenge HTTP ${ch.status}` };
       proof = { challengeToken: chJson.data.challengeToken, signature: signChallengeHex(privateKeyHex, chJson.data.message) };
     }
-    const res = await fetch(`${base}/policy/counterparties`, {
+    const res = await ownerFetch(session, '/policy/counterparties', {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
       // `report` (a non-financial gateway, which never claims): it may only report to this owner, and it changes nothing about
       // who may claim their holds, so it needs no enforcement confirmation (MAGP §8.7.6, §16.4).
       // `agents` (report only): the agents this gateway serves — the issuer lets it claim an approved value-less hold of THOSE
@@ -1442,31 +1534,24 @@ const GATEWAY = process.env.GATEWAY_URL || 'http://localhost:${gatewayPort}';
 // --- value-bearing action (sealValueActions, on by default) — its authorizationId is what lets
 // --- the gateway atomically claim single-use execution, closing replay + cumulative spend, not
 // --- just re-checking policy. See ./gateway/README.md.
+// --- decision.governanceHeaders() is that verdict as headers: the SAME request the gate checked (the
+// --- gatedBookFlight mapping below, payload included), freshly signed, carrying its authorizationId.
+// --- So this file never rebuilds or re-signs the request, and an approved escalation resumed with
+// --- gatedBookFlight.resume() reaches the gateway with the approval's authorization the same way.
 async function bookFlightViaGateway(args, decision) {
-  // The COMPLETE body the tool receives. It is signed as a payload (MAGP 8.3.9): the eight signed fields cover amount and
-  // merchant, not anything else a real tool takes (a payee, a passenger list). The digest covers ALL of it, and the gateway
-  // refuses to run the tool on a body that is not exactly this one.
+  // The COMPLETE body the tool receives — the payload gatedBookFlight signs (MAGP 8.3.9). The gateway refuses to run the
+  // tool on a body that is not exactly the one signed, so keep this in step with the mapping below if you add a field.
   const payload = { amount: args.amount, merchant: args.merchant, currency: args.currency ?? '${currency}' };
-  const signed = await guard.buildSignedRequest({
-    action: '${scope}',
-    amount: args.amount,
-    currency: args.currency ?? '${currency}',
-    merchant: args.merchant,
-    // Passed through as-is (never defaulted): a missing riskLevel must reach the gateway as missing.
-    context: { tool: 'book-flight', riskLevel: args.riskLevel },
-    payload,
-  });
-  signed.authorizationId = decision?.authorizationId;
   const res = await fetch(GATEWAY + '/book-flight', {
     method: 'POST',
-    headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) },
+    headers: { 'content-type': 'application/json', ...(await decision.governanceHeaders()) },
     body: JSON.stringify(payload),
   });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
     const err = new Error('gateway ' + res.status + ': ' + (body?.reasonCode ?? 'refused'));
     err.name = 'GovernanceBlocked';
-    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR' };
+    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR', ...(typeof body?.detail === 'string' ? { detail: body.detail } : {}) };
     throw err;
   }
   return body;
@@ -1486,7 +1571,9 @@ const gatedBookFlight = guard.guardTool(
     // the action for review — never 'low'.
     context: { tool: 'book-flight', riskLevel: a.riskLevel },
     // The authorization is bound to the SAME body bookFlightViaGateway() sends, so the gate records what this agent
-    // signed and the gateway can prove it is running exactly that. Keep the two in step if you add a field.
+    // signed and the gateway can prove it is running exactly that. This mapping is also what governanceHeaders() signs
+    // for the gateway (riskLevel passed through as-is: a missing one reaches the gateway as missing). Keep the two in
+    // step if you add a field.
     payload: { amount: a.amount, merchant: a.merchant, currency: a.currency ?? '${currency}' },
   }),
 );
@@ -1680,20 +1767,21 @@ ${withGateway ? `const GATEWAY = process.env.GATEWAY_URL || 'http://localhost:${
 // --- Calls the gateway process instead of a local function. There is no raw performAction() in
 // --- this file to call directly — the tool, and any real credentials it needs, live only in
 // --- ./gateway, which independently re-verifies this signed request itself.
+// --- decision.governanceHeaders() is the request gatedAction checked (its jurisdiction SIGNED, a top-level
+// --- field, never context), freshly signed, with the authorization it was granted (none for a value-less
+// --- action — see ./gateway/README.md). So this file never rebuilds or re-signs it, and npm run resume
+// --- reaches the gateway through here the same way.
 async function performViaGateway(args, decision) {
-  const { jurisdiction, ...context } = args; // the jurisdiction is SIGNED (a top-level field), never context
-  const signed = await guard.buildSignedRequest({ action: '${scope}', merchant: MERCHANT, jurisdiction, context });
-  signed.authorizationId = decision?.authorizationId; // none for a value-less action — see ./gateway/README.md
   const res = await fetch(GATEWAY + '/perform', {
     method: 'POST',
-    headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) },
+    headers: { 'content-type': 'application/json', ...(await decision.governanceHeaders()) },
     body: '{}', // this tool reads nothing from the body; the request's fields travel in the SIGNED context
   });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
     const err = new Error('gateway ' + res.status + ': ' + (body?.reasonCode ?? 'refused'));
     err.name = 'GovernanceBlocked';
-    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR' };
+    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR', ...(typeof body?.detail === 'string' ? { detail: body.detail } : {}) };
     throw err;
   }
   return body;
@@ -2518,7 +2606,11 @@ re-register this gateway yourself — after removing it from the registry, say.
 Registration needs **proof of control** (MAGP §8.7.6): you ask for a challenge naming you, this
 gateway signs it with its own key from \`service.metamynd.json\`, and you register with that
 signature. A DID is never registered on its text alone, so nobody can register a gateway they do
-not hold the key for. Run this from this directory (bash; \`TOKEN\` is your owner access token):
+not hold the key for. Run this from this directory (bash; \`TOKEN\` is your owner access token).
+An owner access token lasts **15 minutes**, so get a fresh one just before you run this:
+\`POST /auth/login\` with \`{ "username": "<your email>", "password": "<your password>" }\` returns it
+as \`data.accessToken\` (that sign-in also signs your account out of the dashboard — one session at a
+time). A \`401\` from the snippet means the token expired: sign in again and re-run it.
 
 \`\`\`bash
 MAGP_API=https://metamynd.ai/api/v1 TOKEN=<owner access token> node --input-type=module -e "
@@ -3452,7 +3544,7 @@ async function callGateway(path, action, args) {
   if (!res.ok) {
     const err = new Error('gateway ' + res.status + ': ' + (body?.reasonCode ?? 'refused'));
     err.name = 'GovernanceBlocked';
-    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR' };
+    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR', ...(typeof body?.detail === 'string' ? { detail: body.detail } : {}) };
     throw err;
   }
   return body;
@@ -3664,7 +3756,7 @@ async function callGateway(path, action, args) {
   if (!res.ok) {
     const err = new Error('gateway ' + res.status + ': ' + (body?.reasonCode ?? 'refused'));
     err.name = 'GovernanceBlocked';
-    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR' };
+    err.governance = { decision: body?.decision ?? 'block', reasonCode: body?.reasonCode ?? 'GATEWAY_ERROR', ...(typeof body?.detail === 'string' ? { detail: body.detail } : {}) };
     throw err;
   }
   return body;
@@ -4060,11 +4152,9 @@ async function authFlow(args) {
     rl?.resume();
   }
   rl?.close();
-  const login = await apiPost(base, '/auth/login', { username: email, password }, null);
-  const token = login?.data?.accessToken;
-  if (!token) fail('Login succeeded but no access token was returned.');
+  const session = await ownerLogin(base, email, password);
   console.log(c.dim(`  ${SESSION_REPLACED_NOTE}`));
-  return { base, token, email };
+  return { base, session, email };
 }
 
 // One session per account: a CLI login replaces the account's dashboard session (the dashboard then answers
@@ -4080,7 +4170,7 @@ const REQUEST_STATE_FILE = 'metamynd-request.json';
 async function runRequest(args) {
   const owner = (typeof args.owner === 'string' ? args.owner : undefined) ?? process.env.METAMYND_OWNER;
   if (!owner) fail('--owner <ownerEmail> is required for a delegated request.');
-  const { base, token } = await authFlow(args);
+  const { base, session } = await authFlow(args);
 
   // The same decision --harness and the hosted flow make (see announceFinancial): a non-financial request asks the
   // OWNER to approve no spending authority at all, and says so explicitly - an omitted amount means "use the
@@ -4108,7 +4198,7 @@ async function runRequest(args) {
   }
 
   console.log(c.dim(`  → requesting "${name}" for ${owner} …`));
-  const res = await apiPost(base, '/onboarding/requests', { ownerEmail: owner, name, scope, ...(financial ? { perTxnMax, ...(maxAmountReq !== undefined && Number.isFinite(maxAmountReq) ? { maxAmount: maxAmountReq } : {}), ...(currencyReq ? { currency: currencyReq } : {}) } : { financial: false }), ...(merchantsReq.length ? { merchants: merchantsReq } : {}), ...(publicKey ? { publicKey } : {}) }, token);
+  const res = await ownerPost(session, '/onboarding/requests', { ownerEmail: owner, name, scope, ...(financial ? { perTxnMax, ...(maxAmountReq !== undefined && Number.isFinite(maxAmountReq) ? { maxAmount: maxAmountReq } : {}), ...(currencyReq ? { currency: currencyReq } : {}) } : { financial: false }), ...(merchantsReq.length ? { merchants: merchantsReq } : {}), ...(publicKey ? { publicKey } : {}) });
   const d = res.data;
   // A server that predates non-financial requests ignores the field and files the request WITH default spend
   // limits. The developer cannot withdraw it, so say exactly what now exists and who can deny it; do not save a
@@ -4258,7 +4348,9 @@ async function main() {
     return ask(rl, prompt, def);
   };
 
-  // 1. Connection + login
+  // 1. Connection + credentials. The sign-in itself waits until every prompt is answered (step 3): an owner access
+  // token lives 15 minutes, and an owner who took longer over the prompts used to reach provisioning with an expired
+  // one (pre-beta rerun 6, CLI login expiry follow-up to #926).
   const apiRaw = await pick('api', 'METAMYND_API', 'API base URL', DEFAULT_API);
   const base = String(apiRaw).replace(/\/+$/, '');
   const email = await pick('email', 'METAMYND_EMAIL', 'Owner email', '');
@@ -4272,13 +4364,6 @@ async function main() {
     rl?.resume();
   }
 
-  console.log(c.dim(`\n  → logging in to ${base} …`));
-  const login = await apiPost(base, '/auth/login', { username: email, password }, null);
-  const token = login?.data?.accessToken;
-  if (!token) { rl?.close(); fail('Login succeeded but no access token was returned.'); }
-  console.log(`  ${c.green('✓')} authenticated as ${email}`);
-  console.log(c.dim(`    ${SESSION_REPLACED_NOTE}`));
-
   // 2. Agent details — a --config file's fields are the default at every prompt/flag below.
   const name = await pick('name', null, 'Agent name', fileConfig?.name ?? 'Support Bot');
   const scope = await pick('scope', null, 'Mandate scope (governed action)', fileConfig?.scope ?? (financial ? 'flight-purchase' : 'perform-action'));
@@ -4323,19 +4408,6 @@ async function main() {
     rl?.close();
     fail('--daemon-socket generates its own key — pass --byok alone, not --public-key.');
   }
-  let generatedKey = null;
-  let daemonPublicKeyHex = null;
-  if (args.byok && !publicKey && daemonSocket) {
-    console.log(c.dim('  → asking the agentsafe-signer daemon to generate a key …'));
-    const { publicKeyHex } = await daemonRequest(daemonAdminSocket, 'generate-key', { allowRekey: false });
-    daemonPublicKeyHex = publicKeyHex;
-    publicKey = publicKeyHex;
-    console.log(`  ${c.green('✓')} generated an Ed25519 keypair via the signer daemon ${c.dim('(the private key never left it)')}`);
-  } else if (args.byok && !publicKey) {
-    generatedKey = generateAgentKeypair();
-    publicKey = generatedKey.publicKeyHex;
-    console.log(`  ${c.green('✓')} generated an Ed25519 keypair locally ${c.dim('(private key stays on this machine)')}`);
-  }
 
   const slug = slugify(name);
   const outDir = resolve(String(args.out || (interactive ? await ask(rl, 'Output directory', `./${slug}`) : `./${slug}`)));
@@ -4358,6 +4430,30 @@ async function main() {
       if (pack.reviewedMoleculeIds) sopFields.reviewedMoleculeIds = pack.reviewedMoleculeIds;
     }
   }
+
+  // Sign in only now, with every answer in hand (see step 1). Should the token still expire before the last
+  // owner call, ownerFetch renews it once and retries.
+  console.log(c.dim(`\n  → logging in to ${base} …`));
+  const session = await ownerLogin(base, email, password);
+  console.log(`  ${c.green('✓')} authenticated as ${email}`);
+  console.log(c.dim(`    ${SESSION_REPLACED_NOTE}`));
+
+  // The key is generated after the sign-in succeeds, as it always was: a daemon refuses to re-key (allowRekey: false),
+  // so a key minted for a run that then failed to sign in would block the next attempt.
+  let generatedKey = null;
+  let daemonPublicKeyHex = null;
+  if (args.byok && !publicKey && daemonSocket) {
+    console.log(c.dim('  → asking the agentsafe-signer daemon to generate a key …'));
+    const { publicKeyHex } = await daemonRequest(daemonAdminSocket, 'generate-key', { allowRekey: false });
+    daemonPublicKeyHex = publicKeyHex;
+    publicKey = publicKeyHex;
+    console.log(`  ${c.green('✓')} generated an Ed25519 keypair via the signer daemon ${c.dim('(the private key never left it)')}`);
+  } else if (args.byok && !publicKey) {
+    generatedKey = generateAgentKeypair();
+    publicKey = generatedKey.publicKeyHex;
+    console.log(`  ${c.green('✓')} generated an Ed25519 keypair locally ${c.dim('(private key stays on this machine)')}`);
+  }
+
   console.log(c.dim(`\n  → provisioning "${name}" (identity + mandate + SOP + Standards) …`));
   const body = {
     name, scope,
@@ -4376,7 +4472,7 @@ async function main() {
     ...(publicKey ? { publicKey } : {}),
     ...sopFields,
   };
-  const provisioned = await apiPost(base, '/onboarding/agent', body, token);
+  const provisioned = await ownerPost(session, '/onboarding/agent', body);
   const config = provisioned?.data;
   if (!config?.agentDid) fail('Provisioning did not return a config with an agentDid.');
   console.log(`  ${c.green('✓')} agent DID ${c.b(config.agentDid)}`);
@@ -4397,7 +4493,7 @@ async function main() {
     if (config.challenge) {
       console.log(c.dim('  → proving key control via the daemon (verify-key) …'));
       const { signature } = await daemonRequest(daemonSocket, 'sign-key-control-challenge', { challenge: config.challenge });
-      await apiPost(base, `/agent-identity/${encodeURIComponent(config.identityId)}/verify-key`, { signature }, token);
+      await ownerPost(session, `/agent-identity/${encodeURIComponent(config.identityId)}/verify-key`, { signature });
       config.keyVerified = true;
       delete config.challenge; // one-time; consumed
       console.log(`  ${c.green('✓')} key verified — MetaMynd never saw your private key, and neither did this CLI`);
@@ -4409,7 +4505,7 @@ async function main() {
     if (config.challenge) {
       console.log(c.dim('  → proving key control (verify-key) …'));
       const signature = signChallengeHex(generatedKey.privateKeyHex, config.challenge);
-      await apiPost(base, `/agent-identity/${encodeURIComponent(config.identityId)}/verify-key`, { signature }, token);
+      await ownerPost(session, `/agent-identity/${encodeURIComponent(config.identityId)}/verify-key`, { signature });
       config.keyVerified = true;
       delete config.challenge; // one-time; consumed
       console.log(`  ${c.green('✓')} key verified — MetaMynd never saw your private key`);
@@ -4420,6 +4516,7 @@ async function main() {
     console.log(c.dim(`      sign this challenge with your private key (Ed25519 over its UTF-8 bytes, hex):`));
     console.log(c.dim(`      challenge: ${config.challenge ?? '(none returned)'}`));
     console.log(c.dim(`      POST ${base}/agent-identity/${config.identityId}/verify-key  { "signature": "<hex>" }  (owner token)`));
+    console.log(c.dim(`      (an owner access token lasts 15 minutes — sign in again with POST ${base}/auth/login for a fresh one)`));
   }
 
   // 3c. The gateway's OWN identity — a real did:key, separate from the agent's own (an agent must
@@ -4432,7 +4529,7 @@ async function main() {
     const gatewayDid = buildDidKey(rawPublicKeyFromSpkiHex(gwKeypair.publicKeyHex));
     gatewayIdentity = { did: gatewayDid, keyHex: gwKeypair.privateKeyHex };
     console.log(c.dim(`\n  → registering the gateway's identity as a trusted counterparty (${financial ? "so it can claim this agent's holds and report to you" : 'so its reports reach your Activity Log'}) …`));
-    const reg = await registerGatewayCounterparty(base, token, gatewayDid, `${scope}-gateway`, financial ? 'claim' : 'report', gwKeypair.privateKeyHex, financial ? null : [config.agentDid]);
+    const reg = await registerGatewayCounterparty(session, gatewayDid, `${scope}-gateway`, financial ? 'claim' : 'report', gwKeypair.privateKeyHex, financial ? null : [config.agentDid]);
     if (reg.ok) {
       console.log(`  ${c.green('✓')} gateway DID ${c.b(gatewayDid)} — ${reg.message}`);
     } else {
@@ -4467,6 +4564,7 @@ export {
   generateAgentKeypair, harnessAgentDid, harnessMandate, harnessRulesFile, harnessDefaultSopNeutral,
   scaffoldProject, defaultNeutralDemo, exampleIndexNeutral, exampleReadmeNeutral, gatewayServerFileNeutral, gatewayReadmeNeutral,
   ensurePolicyKey,
+  ownerLogin, ownerFetch, ownerPost,
 };
 if (!process.env.CREATE_METAMYND_AGENT_NO_MAIN) {
   // fail() can also be reached from a callback outside main()'s promise chain (readline, child process).

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.14.31",
+  "version": "0.14.40",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {
     "create-metamynd-agent": "index.mjs"
   },
   "scripts": {
-    "test": "node generated-code-parses.smoke.mjs && node harness-gateway.smoke.mjs && node harness-gateway-bind.smoke.mjs && node policy-demo.smoke.mjs && node hosted-nonfinancial.smoke.mjs && node modes-nonfinancial.smoke.mjs && node byok-daemon.smoke.mjs"
+    "test": "node generated-code-parses.smoke.mjs && node harness-gateway.smoke.mjs && node harness-gateway-bind.smoke.mjs && node policy-demo.smoke.mjs && node hosted-nonfinancial.smoke.mjs && node modes-nonfinancial.smoke.mjs && node byok-daemon.smoke.mjs && node owner-session.smoke.mjs"
   },
   "files": [
     "index.mjs",