create-metamynd-agent 0.7.4 → 0.7.6

package/README.md

@@ -150,9 +150,9 @@ What actually stops that bypass is that `bookFlight()` doesn't exist in the agen
 It exists only in `gateway/server.mjs` — a separate process, started separately, holding any real
 tool credentials the agent process never sees — which independently re-verifies every request
 against the agent's own published policy bundle before running it, **binds that request to the
-actual body being executed** (`@metamynd/agentsafe-http-gateway` ≥ 0.2.0), and requires the
+actual body being executed** (`@metamynd/agentsafe-http-gateway` ≥ 0.3.0), and requires the
 agent's `authorizationId` to atomically claim single-use execution against the real stateful gate
-(`requireAuthorization`, `@metamynd/agentsafe-mcp-guard` ≥ 0.2.0) — closing a confused-deputy gap
+(`requireAuthorization`, `@metamynd/agentsafe-mcp-guard` ≥ 0.3.0) — closing a confused-deputy gap
 and a replay/cumulative-spend gap, both found during independent testing. Same shape as the mutual
 counterparty check in [`@metamynd/agentsafe-mcp-guard`](https://www.npmjs.com/package/@metamynd/agentsafe-mcp-guard),
 built with [`@metamynd/agentsafe-http-gateway`](https://www.npmjs.com/package/@metamynd/agentsafe-http-gateway).
@@ -168,12 +168,21 @@ Named precisely, not left implicit:
 - **Direct call.** `bookFlight()` doesn't exist in the agent's process.
 - **Confused deputy (payload).** Signing a cheap request while executing an expensive one (a
   different amount/currency/merchant in the body than what was signed) is refused before the tool
-  runs — payload binding.
+  runs — payload binding (`@metamynd/agentsafe-http-gateway` ≥ 0.3.0). The default binder fails
+  the request CLOSED, not just when it finds a mismatched flat field, but also when it can't find
+  the governed fields at all — nested JSON, an array, a renamed or differently-cased key. That
+  gap was found and closed the same way: a signed $250/skyward-air request had previously been
+  able to execute $5000/evil-corp via `{ booking: { amount, merchant } }`, because the flat
+  matcher found nothing to compare and treated "nothing found" as "nothing to check."
 - **Replay.** A captured, resent request fails to atomically claim single-use execution the second
   time — `requireAuthorization`.
 - **Cumulative spend.** The claimed authorization only exists because the real stateful gate
   already checked it against the mandate's TOTAL budget when minted, not just this one request's
   amount — so many small legal-looking calls can't add up past the cap this way.
+- **Amount unknown.** A signed-transaction tool (raw bytes) or a nested x402 payload carries its
+  amount somewhere a naive spend cap never looks — `amount-unknown` (`@metamynd/agentsafe-guard`
+  ≥ 0.6.0, `@metamynd/agentsafe-mcp-guard` ≥ 0.3.0) blocks by default when the gate can't
+  determine the value, instead of letting it slip past the cap untested.
 
 The claim above also checks `agentDid`/`amount`/`currency`/`merchant` together against the
 request being executed (`@metamynd/agentsafe-mcp-guard` ≥ 0.2.1) — a same-amount, same-currency

package/index.mjs

@@ -23,16 +23,24 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // Must track the guard's MINOR line, not just its major. On a 0.x package `^0.4.0` means
 // >=0.4.0 <0.5.0, so leaving this at ^0.4.0 would scaffold an agent whose `npm test` runs
 // `agentsafe-guard verify` against a guard that has no such command.
-const GUARD_VERSION = '^0.5.0';
+// 0.6.0 adds the amount-unknown atom (deny-by-default when a value-moving action's amount
+// can't be determined) — this was already missed once (this constant sat at ^0.5.0 through the
+// whole 0.6.0 release), silently scaffolding every new project without that protection.
+const GUARD_VERSION = '^0.6.0';
 // The default hosted scaffold's SECOND process — the tool gateway (see scaffoldProject).
 const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.2.0 adds requireAuthorization (closes replay + cumulative spend) — this scaffold sets that
 // option, so a range that could resolve below 0.2.0 would silently scaffold a no-op.
-const MCP_GUARD_VERSION = '^0.2.0';
+// 0.3.0 adds the same amount-unknown atom as the guard, above — same reasoning, same miss.
+const MCP_GUARD_VERSION = '^0.3.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
-const GATEWAY_VERSION = '^0.2.0';
+// 0.3.0 fixes the follow-on gap: the DEFAULT binder only sees flat, top-level, exactly-named
+// fields, and silently skipped binding (not blocked) for anything else — nested JSON, an array,
+// a renamed or differently-cased key. Verified live: a signed $250/skyward-air request executed
+// $5000/evil-corp via `{ booking: { amount, merchant } }`. 0.3.0 fails that CLOSED instead.
+const GATEWAY_VERSION = '^0.3.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -908,8 +916,13 @@ own code, or a network attacker) might attempt:
 - **Direct call.** \`bookFlight()\` doesn't exist in the agent's process. There's nothing to call.
 - **Confused deputy (payload).** The gateway re-verifies the signed request against this agent's
   own policy AND binds it to the actual request body (payload binding,
-  \`@metamynd/agentsafe-http-gateway\` ≥ 0.2.0) — signing a cheap request while executing an
-  expensive one is refused before the tool ever runs.
+  \`@metamynd/agentsafe-http-gateway\` ≥ 0.3.0) — signing a cheap request while executing an
+  expensive one is refused before the tool ever runs. The default binder fails CLOSED not just
+  on a mismatched flat field but whenever it can't find the governed fields at all — nested
+  JSON, an array, a renamed or differently-cased key. A signed \$250 request had previously been
+  able to execute \$5000 via \`{ booking: { amount, merchant } }\`, because the flat matcher found
+  nothing to compare and treated "nothing found" as "nothing to check" — fixed the same way this
+  list gets fixed: found, closed, named here.
 - **Replay.** \`requireAuthorization: true\` (set in \`server.mjs\`) requires the agent's
   \`authorizationId\` — from a REAL \`guard.authorize()\` call, which \`index.mjs\` already makes for
   any value-bearing action by default — to atomically claim single-use execution against the
@@ -918,6 +931,10 @@ own code, or a network attacker) might attempt:
   already checked it against the mandate's TOTAL budget when it was minted — not just this one
   request's amount. Many small legal-looking calls can't add up past the mandate cap this way,
   because each needed its own real authorization first.
+- **Amount unknown.** A signed-transaction tool or a nested payload can carry its amount
+  somewhere a naive spend cap never looks — \`amount-unknown\`
+  (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.3.0) blocks by default when the gate can't determine the
+  value, instead of letting it slip past the cap untested.
 
 The claim above also checks the claimed authorization's own \`agentDid\`/\`amount\`/\`currency\`/
 \`merchant\` against the request actually being executed (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.2.1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {