create-metamynd-agent 0.7.3 → 0.7.4

package/README.md

@@ -175,13 +175,11 @@ Named precisely, not left implicit:
   already checked it against the mandate's TOTAL budget when minted, not just this one request's
   amount — so many small legal-looking calls can't add up past the cap this way.
 
-**One narrower gap, found while building this and disclosed rather than left implicit:** the claim
-above verifies the claimed authorization's own `agentDid`/`amount`/`currency` match the request —
-not `merchant`, because the backend's hold record doesn't currently store it. A same-amount,
-same-currency authorization legitimately obtained for one merchant could in principle unlock a
-booking with a different merchant. Closing this needs a small backend change (storing `merchant`
-on the hold); it isn't done here. `gateway/README.md`'s own "What this closes, precisely" section
-has the same disclosure.
+The claim above also checks `agentDid`/`amount`/`currency`/`merchant` together against the
+request being executed (`@metamynd/agentsafe-mcp-guard` ≥ 0.2.1) — a same-amount, same-currency
+authorization legitimately obtained for one merchant cannot unlock a booking with a different
+one. That gap was found while building this and closed, not left open; `gateway/README.md`'s own
+"What this closes, precisely" section names it the same way.
 
 Pass `--no-gateway` to opt out and get the old single-process scaffold instead — e.g. if you're
 already running your own separate gateway and don't need this one. **You are back to being

package/index.mjs

@@ -919,17 +919,13 @@ own code, or a network attacker) might attempt:
   request's amount. Many small legal-looking calls can't add up past the mandate cap this way,
   because each needed its own real authorization first.
 
-**One narrower gap, found while building this and disclosed rather than left implicit:** the
-claim above verifies the claimed authorization's own \`agentDid\`/\`amount\`/\`currency\` match the
-request being executed — but not \`merchant\`, because the backend's hold record doesn't currently
-store it. A same-amount, same-currency authorization legitimately obtained for one merchant could
-in principle be presented to unlock a booking with a different merchant. Closing this needs a
-small backend change (storing \`merchant\` on the hold so it can be compared too); it isn't done
-here. See \`@metamynd/agentsafe-mcp-guard\`'s own README (\`requireAuthorization\`) for the full
-mechanism, and \`demo/duffel-mcp-gateway\` in the AgentSafe repo for the fuller pattern this is a
-slice of (mutual DID handshake, x402 payment binding, commitment-bound capability tokens — which
-WOULD close the merchant gap too, by binding the whole transaction to a cryptographic commitment
-rather than comparing individual stored fields).
+The claim above also checks the claimed authorization's own \`agentDid\`/\`amount\`/\`currency\`/
+\`merchant\` against the request actually being executed (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.2.1)
+— a same-amount, same-currency authorization legitimately obtained for one merchant cannot unlock
+a booking with a different one; that gap was found while building this and closed, not left open.
+See \`@metamynd/agentsafe-mcp-guard\`'s own README (\`requireAuthorization\`) for the full mechanism,
+and \`demo/duffel-mcp-gateway\` in the AgentSafe repo for the fuller pattern this is a slice of
+(mutual DID handshake, x402 payment binding, commitment-bound capability tokens).
 `;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {