create-metamynd-agent 0.14.44 → 0.14.47

package/index.mjs

@@ -97,7 +97,9 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // resume() works again once the gateway is upgraded, and a voided approval is reported AUTHORIZATION_VOIDED (pre-beta rerun 6 FW6-1).
 // 0.35.0: a payment in another currency than a currency-scoped cap is refused CURRENCY_NOT_ALLOWED, not SOP_SPEND_CAP (M2).
 // 0.36.0: ships TypeScript declarations (agentsafe-guard.d.mts), so a TypeScript agent gets types with no @types package (L5).
-const GUARD_VERSION = '^0.36.0';
+// 0.37.0: a tool that hands its call to a gateway that then refuses it (the hold stays unclaimed) has its hold released, not
+// captured, so a refused payment is no longer booked as spend (pre-beta rerun 2026-10-12, D-5).
+const GUARD_VERSION = '^0.37.0';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -105,7 +107,7 @@ function harnessConfigLoad() {
 // Say so, with the way forward, instead of letting readFileSync throw a bare ENOENT.
 let config;
 try {
-  config = JSON.parse(readFileSync('./agent.metamynd.json', 'utf8'));
+  config = JSON.parse(readFileSync('./agent.metamynd.json', 'utf8').replace(/^\\uFEFF/, '')); // a UTF-8 BOM is not JSON
 } catch (e) {
   console.error(e && e.code === 'ENOENT'
     ? ['No ./agent.metamynd.json. It holds the local key for this agent and is gitignored, so a fresh clone never has it.',
@@ -228,7 +230,9 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // depends on agentsafe-mcp-guard ^0.30.0.
 // 0.30.0: `agentsafe-gateway service-id` / `accept-challenge` / `serve`, SERVICE_IDENTITY_FILE and AGENTSAFE_UPSTREAM_CREDENTIAL (M4).
 // 0.31.0: ships TypeScript declarations (gateway, route-match, service-identity); depends on agentsafe-mcp-guard ^0.31.0.
-const GATEWAY_VERSION = '^0.31.0';
+// 0.32.0: `reportOutcomes` defaults to true. The hosted templates already set it; the --harness gateway (no issuer, no
+// network) now sets `reportOutcomes: false`, so it does not log NO_ISSUER on its first refusal.
+const GATEWAY_VERSION = '^0.32.0';
 
 /** Appended to every scaffolded gateway server: give hold settlements still running a bounded moment on shutdown. */
 const DRAIN_ON_SHUTDOWN = `
@@ -451,7 +455,8 @@ function onCliError(e) {
 // directly instead — `rules` is ignored when `molecules` is present.
 function loadConfigFile(path) {
   let raw;
-  try { raw = readFileSync(resolve(path), 'utf8'); }
+  // A UTF-8 BOM (Notepad and other Windows tools add one on save) is not JSON whitespace — strip it before parsing.
+  try { raw = readFileSync(resolve(path), 'utf8').replace(/^\uFEFF/, ''); }
   catch (e) { fail(`Could not read config file ${path} (${e.message})`); }
   let json;
   try { json = JSON.parse(raw); }
@@ -3057,6 +3062,8 @@ const gateway = createHttpGateway({
   // body that is not exactly that one — the values of every allowed field, not only amount and merchant. A request that
   // bound no payload is refused (PAYLOAD_BINDING_REQUIRED) instead of run unbound.
   requirePayloadBinding: true,
+  // No issuer to report to: --harness never touches the network (the gateway reports by default since 0.32.0).
+  reportOutcomes: false,
   // Reached ONLY after the guard allowed the request AND the body was bound to what was signed.
   forward: async (req) => {
     const route = matchRoute(ROUTES, req.method, req.path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.14.44",
+  "version": "0.14.47",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {