create-metamynd-agent 0.3.2 → 0.3.6

package/index.mjs

@@ -18,7 +18,10 @@ import readline from 'node:readline';
 import crypto from 'node:crypto';
 
 const GUARD_PKG = '@metamynd/agentsafe-guard';
-const GUARD_VERSION = '^0.4.0';
+// Must track the guard's MINOR line, not just its major. On a 0.x package `^0.4.0` means
+// >=0.4.0 <0.5.0, so leaving this at ^0.4.0 would scaffold an agent whose `npm test` runs
+// `agentsafe-guard verify` against a guard that has no such command.
+const GUARD_VERSION = '^0.5.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 
 // ---------- tiny ANSI ----------
@@ -209,6 +212,23 @@ const gatedBookFlight = guard.guardTool(
   }),
 );
 
+// --- A tool the agent was NEVER granted. Wrapping it is the demonstration: there is no
+// --- rule anywhere forbidding this. The mandate simply never mentioned the action.
+async function raiseOwnLimit(args) {
+  return { updated: true, ...args };          // never runs, and that is the point
+}
+
+const gatedRaiseOwnLimit = guard.guardTool(
+  'permissions.update',                       // an action NOT in the mandate
+  raiseOwnLimit,
+  (a) => ({
+    amount: a.amount,
+    currency: 'USD',
+    merchant: a.merchant,
+    context: { tool: 'permissions-update' },
+  }),
+);
+
 const dim = (t) => '\\x1b[2m' + t + '\\x1b[0m';
 const bold = (t) => '\\x1b[1m' + t + '\\x1b[0m';
 const rule = (n) => '  ' + '-'.repeat(n);
@@ -219,6 +239,11 @@ const WHY = {
   SOP_SPEND_CAP: 'your SOP caps a single transaction at $${perTxnMax}',
   RISK_REVIEW: 'your SOP sends high-risk actions to a human first',
   MERCHANT_NOT_ALLOWED: 'the mandate lists which merchants this agent may pay',
+  // Both say the same thing from where you are standing: the mandate does not cover that
+  // action. Which one you see depends on whether the verdict was reached here or at the
+  // gate, and neither of them depends on the amount.
+  NO_PERMISSION_FOR_ACTION: 'the mandate never granted this action - at any amount',
+  NO_MANDATE: 'there is no mandate for this action at all',
 };
 
 // ---------------------------------------------------------------- 1. CONTEXT
@@ -226,9 +251,10 @@ console.log('');
 console.log(bold('  What this simulation shows'));
 console.log('');
 console.log('  An agent should not be the thing that decides what it is allowed to do.');
-console.log('  This run makes that concrete: the SAME code path is attempted three times');
-console.log('  and produces three different outcomes, because the decision is made');
-console.log('  outside your program - and cannot be argued with from inside it.');
+console.log('  This run makes that concrete. Three attempts take the SAME code path and');
+console.log('  produce three different outcomes. The fourth asks for something the agent');
+console.log('  was never granted at all - and that is the one a prompt could not have');
+console.log('  stopped, because the decision is not made inside your program.');
 
 // ---------------------------------------------------------------- 2. MECHANISM
 console.log('');
@@ -244,13 +270,13 @@ console.log(dim('  scope  ${scope}'));
 console.log(dim('  cap    $${perTxnMax} per transaction, set by your SOP'));
 
 // ---------------------------------------------------------------- 3. THE STEPS
-async function attempt(n, intent, args) {
+async function attempt(n, intent, args, tool = gatedBookFlight) {
   console.log('');
-  console.log(bold('  Step ' + n + ' of 3') + ' - ' + intent);
+  console.log(bold('  Step ' + n + ' of 4') + ' - ' + intent);
   console.log(dim('     signing the request locally, then asking the gate to decide...'));
   try {
-    const r = await gatedBookFlight(args);
-    console.log('\\x1b[32m     ALLOWED\\x1b[0m  your tool ran and returned ' + r.pnr);
+    const r = await tool(args);
+    console.log('\\x1b[32m     ALLOWED\\x1b[0m  your tool ran and returned ' + (r.pnr ?? 'ok'));
     console.log(dim('     ' + WHY.AUTHORIZED));
   } catch (e) {
     const g = e.governance ?? {};
@@ -272,6 +298,12 @@ console.log(rule(66));
 await attempt(1, 'a $${under} booking, low risk. Expected to pass.', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'low' });
 await attempt(2, 'a $${over} booking, deliberately over the cap.', { amount: ${over}, merchant: 'skyward-air', riskLevel: 'low' });
 await attempt(3, 'a $${under} booking, but flagged high risk.', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'high' });
+await attempt(
+  4,
+  'the agent stops booking flights and asks to raise its OWN limit.',
+  { amount: 100000, merchant: 'skyward-air' },
+  gatedRaiseOwnLimit,
+);
 console.log('');
 console.log(rule(66));
 
@@ -281,6 +313,8 @@ console.log(bold('  What this proved'));
 console.log('');
 console.log(dim('   - one code path, three outcomes. The rules decided, not this file'));
 console.log(dim('     and not the model driving it.'));
+console.log(dim('   - step 4 needed no rule to stop it. The agent could not widen its own'));
+console.log(dim('     authority, because it cannot name an action nobody delegated to it.'));
 console.log(dim('   - the blocked call never reached your tool at all.'));
 console.log(dim('   - every decision was recorded as tamper-evident evidence.'));
 console.log(dim('   - if the gate were unreachable the guard fails CLOSED: it blocks.'));
@@ -298,7 +332,10 @@ function examplePackageJson(slug) {
       version: '0.1.0',
       private: true,
       type: 'module',
-      scripts: { start: 'node index.mjs' },
+      // `verify` is scaffolded in because governance that lives only in a dashboard is a
+      // thing someone has to remember to look at. As a build step it is a control: a change
+      // that widens this agent's authority fails `npm test`.
+      scripts: { start: 'node index.mjs', test: 'agentsafe-guard verify' },
       dependencies: { [GUARD_PKG]: GUARD_VERSION },
     },
     null,
@@ -392,7 +429,11 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, sandbox, forc
   console.log(`  Next:`);
   console.log(c.cyan(`    cd ${rel}`));
   console.log(c.cyan(`    npm install`));
-  console.log(c.cyan(`    npm start`) + c.dim('   → ALLOW · BLOCK (over cap) · ESCALATE (high risk)\n'));
+  // The example runs FOUR attempts. This summary promised three, so the one carrying the
+  // whole argument — the agent asking to raise its own limit — arrived unannounced.
+  console.log(c.cyan(`    npm start`) + c.dim('   → ALLOW · BLOCK (over cap) · ESCALATE (high risk)'));
+  console.log(c.dim('                 · BLOCK (the agent asking to raise its OWN limit)\n'));
+  console.log(c.cyan(`    npm test`) + c.dim('    → assert it CANNOT exceed its mandate. Put this in CI.\n'));
   console.log(c.dim(`  Change the rules any time in the dashboard (Legal Entity → SOPs) — no redeploy.\n`));
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.3.2",
-  "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command \u2014 logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json, and drops a runnable example.",
+  "version": "0.3.6",
+  "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json, and drops a runnable example.",
   "type": "module",
   "bin": {
     "create-metamynd-agent": "index.mjs"
@@ -28,8 +28,13 @@
   "author": "MetaMynd",
   "license": "MIT",
   "homepage": "https://metamynd.ai/developers/quickstart",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Metamynd/agentsafe-guard.git",
+    "directory": "packages/create-metamynd-agent"
+  },
   "bugs": {
-    "url": "https://metamynd.ai/en/support/contact"
+    "url": "https://github.com/Metamynd/agentsafe-guard/issues"
   },
   "publishConfig": {
     "access": "public"