create-metamynd-agent 0.7.1 → 0.7.2

package/README.md

@@ -135,23 +135,43 @@ npm start
 ### Separate tool gateway (default)
 
 This is the other half of **without MetaMynd, you can be bypassed**: WITH it — specifically, with
-`gateway/`, the second process this scaffolds by default — you can't be, the same way the hosted
-platform's own MCP counterparty can't be talked around by a compromised agent.
+`gateway/`, the second process this scaffolds by default — calling the tool directly instead of
+through the check no longer works, the same way the hosted platform's own MCP counterparty can't
+be talked around by a compromised agent. See [Not solved by the gateway](#not-solved-by-the-gateway)
+below for the two things this specifically does **not** cover.
 
 `guard.guardTool()` in `index.mjs` still runs — it's a fast, local, client-side pre-check that gives
 good UX (fail fast on an obviously-blocked call, no round trip) — but it is **not** what stops a
 bypass. It still calls its handler in the SAME process regardless of where the decision came from,
 so anything able to call that handler directly gets the same result the gate would have given it.
 
-What actually stops a bypass is that `bookFlight()` doesn't exist in the agent's process at all.
+What actually stops that bypass is that `bookFlight()` doesn't exist in the agent's process at all.
 It exists only in `gateway/server.mjs` — a separate process, started separately, holding any real
 tool credentials the agent process never sees — which independently re-verifies every request
-against the agent's own published policy bundle before running it (same shape as the mutual
-counterparty check in [`@metamynd/agentsafe-mcp-guard`](https://www.npmjs.com/package/@metamynd/agentsafe-mcp-guard),
-built with [`@metamynd/agentsafe-http-gateway`](https://www.npmjs.com/package/@metamynd/agentsafe-http-gateway)).
-It's a minimal slice of the same pattern proven end to end in `demo/duffel-mcp-gateway` in the
+against the agent's own published policy bundle before running it, and **binds that request to the
+actual body being executed** (`@metamynd/agentsafe-http-gateway` ≥ 0.2.0) — closing a confused-deputy
+gap found during testing, where a signed cheap request could be governed while a different, expensive
+body was the one that actually ran. Same shape as the mutual counterparty check in
+[`@metamynd/agentsafe-mcp-guard`](https://www.npmjs.com/package/@metamynd/agentsafe-mcp-guard), built
+with [`@metamynd/agentsafe-http-gateway`](https://www.npmjs.com/package/@metamynd/agentsafe-http-gateway).
+It's a minimal slice of the fuller pattern proven end to end in `demo/duffel-mcp-gateway` in the
 AgentSafe repo (mutual handshake, x402 payment binding, capability tokens) — this scaffold gives you
-just the part that closes the bypass, not the whole protocol.
+just the part that closes the direct-call bypass, not the whole protocol.
+
+#### Not solved by the gateway
+
+Named precisely, not left implicit:
+
+- **Replay.** The gateway checks a signed request is fresh, not that it hasn't been used before —
+  a captured valid request can be resent within the freshness window. Single-use nonce consumption
+  is the stateful issuer gate's job (`POST /policy/mandate/authorize`); this scaffold never calls it.
+- **Cumulative spend.** Each call is checked against the per-transaction cap correctly, but the
+  mandate's TOTAL budget isn't tracked at the gateway — many separately-legal calls can still add
+  up past it. The real total is only enforced where a hold is actually reserved: the issuer gate.
+
+Both require wiring the full authorize-before-execute flow (agent calls the stateful gate first,
+gateway checks a decision bound to that specific authorization) rather than per-request policy
+re-evaluation alone — see `gateway/README.md`'s own "Beyond this minimal slice" section.
 
 Pass `--no-gateway` to opt out and get the old single-process scaffold instead — e.g. if you're
 already running your own separate gateway and don't need this one. **You are back to being

package/index.mjs

@@ -28,7 +28,9 @@ const GUARD_VERSION = '^0.5.0';
 const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 const MCP_GUARD_VERSION = '^0.1.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
-const GATEWAY_VERSION = '^0.1.0';
+// 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
+// never scaffold a range that could resolve below it.
+const GATEWAY_VERSION = '^0.2.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -689,15 +691,17 @@ A MetaMynd/AgentSafe-governed agent, scaffolded with \`create-metamynd-agent\`.
 
 ${gatewaySection}${
     withGateway
-      ? `**With MetaMynd's gateway, you can't be bypassed** — that's what this section is about.
-This scaffold's default shape (agent + separate gateway process, port ${gatewayPort} by
-default) is the actual enforcement boundary: \`guard.guardTool()\` in \`index.mjs\` is a
-client-side convenience, not a boundary — it still runs its handler in-process regardless of
-where the decision came from. What actually stops a bypass is that \`bookFlight()\` itself only
-exists in \`./gateway\`, a process this one cannot reach into, which independently re-verifies
-every request against this agent's own policy bundle. Re-scaffold with \`--no-gateway\` for the
-old single-process shape — it is NOT a separate enforcement boundary; see its own generated
-README for why.`
+      ? `**With MetaMynd's gateway, calling the tool directly and skipping the check no longer
+works** — that's what this section is about. This scaffold's default shape (agent + separate
+gateway process, port ${gatewayPort} by default) is the actual enforcement boundary for that
+specific bypass: \`guard.guardTool()\` in \`index.mjs\` is a client-side convenience, not a
+boundary — it still runs its handler in-process regardless of where the decision came from. What
+actually stops it is that \`bookFlight()\` itself only exists in \`./gateway\`, a process this one
+cannot reach into, which independently re-verifies every request against this agent's own policy
+bundle AND binds it to the actual body being executed. It does NOT track replay or cumulative
+spend across calls — see \`./gateway/README.md\`'s "Beyond this minimal slice" section. Re-scaffold
+with \`--no-gateway\` for the old single-process shape — it is NOT a separate enforcement boundary
+at all; see its own generated README for why.`
       : `**Without MetaMynd, you can be bypassed** — this is that case. This scaffold has no
 separate gateway process (either \`--sandbox\`, which never provisions real credentials, or
 \`--no-gateway\` was passed): \`guard.guardTool()\` wraps a tool in the SAME process as the check
@@ -837,8 +841,11 @@ function gatewayGitignore() {
 function gatewayReadme(slug, scope, port) {
   return `# ${slug}-gateway
 
-**With MetaMynd, you can't be bypassed.** This process is why. It is the **real enforcement
-boundary** for \`${slug}\`'s tool(s) — not \`../index.mjs\`.
+**With MetaMynd, you can't call the tool directly and skip the check.** This process is why. It
+is the **real enforcement boundary** for \`${slug}\`'s tool(s) — not \`../index.mjs\` — for that
+specific bypass. See [Beyond this minimal slice](#beyond-this-minimal-slice) below for the two
+things it does NOT yet close on its own: replaying a captured request, and spend adding up
+across many separately-legal calls.
 
 ## Why this exists
 
@@ -883,10 +890,26 @@ add another protected route here rather than adding a local function back in \`i
 
 ## Beyond this minimal slice
 
-This gateway only re-verifies a signed request (§9.3/§9.6 of the MAGP spec). It does not do the
-mutual DID handshake, x402 payment binding, or commitment-bound capability tokens that a
-production Service integration would add — see \`@metamynd/agentsafe-mcp-guard\`'s own README for
-those, and \`demo/duffel-mcp-gateway\` in the AgentSafe repo for a full worked example.
+This gateway independently re-verifies a signed request AND binds it to the actual request body
+(§9.3/§9.6 of the MAGP spec, plus payload binding — \`@metamynd/agentsafe-http-gateway\` ≥ 0.2.0).
+That closes the specific bypass this scaffold exists to close: an agent (or anything able to call
+its code) presenting one set of values while a different set actually executes.
+
+Two things it deliberately does NOT close, named precisely rather than left implicit:
+
+- **Replay.** \`verifyRequest()\` checks the signed request is fresh, not that it hasn't been used
+  before — a captured valid request can be resent within the freshness window. Single-use nonce
+  consumption is the stateful issuer gate's job, not this gateway's; this scaffold never calls it.
+- **Cumulative spend.** Each call is checked against the per-transaction cap correctly, but the
+  mandate's TOTAL budget isn't tracked here — many separately-legal calls can still add up past
+  it. The real total is only enforced where holds are actually reserved: \`POST
+  /policy/mandate/authorize\` on the issuer.
+
+Closing both means wiring the full authorize-before-execute flow — the agent calling that
+stateful endpoint first, this gateway checking a decision bound to that specific authorization —
+not just re-evaluating policy per request. See \`@metamynd/agentsafe-mcp-guard\`'s own README
+(mutual DID handshake, x402 payment binding, commitment-bound capability tokens) and
+\`demo/duffel-mcp-gateway\` in the AgentSafe repo for what that full pattern looks like.
 `;
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.7.1",
-  "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process (the real enforcement boundary). --harness scaffolds a free, local, zero-network governance harness instead.",
+  "version": "0.7.2",
+  "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes the direct-call bypass. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {
     "create-metamynd-agent": "index.mjs"