create-metamynd-agent 0.7.4 → 0.7.7

package/README.md

@@ -150,9 +150,9 @@ What actually stops that bypass is that `bookFlight()` doesn't exist in the agen
 It exists only in `gateway/server.mjs` — a separate process, started separately, holding any real
 tool credentials the agent process never sees — which independently re-verifies every request
 against the agent's own published policy bundle before running it, **binds that request to the
-actual body being executed** (`@metamynd/agentsafe-http-gateway` ≥ 0.2.0), and requires the
+actual body being executed** (`@metamynd/agentsafe-http-gateway` ≥ 0.4.0), and requires the
 agent's `authorizationId` to atomically claim single-use execution against the real stateful gate
-(`requireAuthorization`, `@metamynd/agentsafe-mcp-guard` ≥ 0.2.0) — closing a confused-deputy gap
+(`requireAuthorization`, `@metamynd/agentsafe-mcp-guard` ≥ 0.3.0) — closing a confused-deputy gap
 and a replay/cumulative-spend gap, both found during independent testing. Same shape as the mutual
 counterparty check in [`@metamynd/agentsafe-mcp-guard`](https://www.npmjs.com/package/@metamynd/agentsafe-mcp-guard),
 built with [`@metamynd/agentsafe-http-gateway`](https://www.npmjs.com/package/@metamynd/agentsafe-http-gateway).
@@ -167,13 +167,27 @@ Named precisely, not left implicit:
 
 - **Direct call.** `bookFlight()` doesn't exist in the agent's process.
 - **Confused deputy (payload).** Signing a cheap request while executing an expensive one (a
-  different amount/currency/merchant in the body than what was signed) is refused before the tool
-  runs — payload binding.
+  different amount/merchant in the body than what was signed) is refused before the tool runs —
+  payload binding (`@metamynd/agentsafe-http-gateway` ≥ 0.4.0). The default binder requires
+  `amount`/`merchant` to actually be found in the body whenever the signed request names a real
+  value for them — not just "did the body offer at least one correct-looking field." A first
+  attempt at this (0.3.0) checked the weaker version and was re-tested and closed the same day: a
+  correct decoy in one field (e.g. a matching `merchant`) let the OTHER field hide anywhere —
+  nested, renamed, an array, or an entirely empty/non-JSON body.
 - **Replay.** A captured, resent request fails to atomically claim single-use execution the second
   time — `requireAuthorization`.
 - **Cumulative spend.** The claimed authorization only exists because the real stateful gate
   already checked it against the mandate's TOTAL budget when minted, not just this one request's
   amount — so many small legal-looking calls can't add up past the cap this way.
+- **Amount unknown.** Two separate places this matters, both actually authored, not just
+  available: the platform's own custodial-signing tools (`@metamynd/agentsafe-guard` ≥ 0.6.0,
+  `@metamynd/agentsafe-mcp-guard` ≥ 0.3.0) block by default when a signed-transaction tool's raw
+  bytes or a nested x402 payload hide the amount from a naive spend cap — AND this agent's own
+  starter SOP puts the same `amount-unknown` check ahead of its per-transaction cap (both the
+  hosted default and `--harness`'s local one). The atom existing was not the gap: for a while
+  this SOP still only ever authored `amount-over`, which silently does not fire on a missing or
+  string amount (`typeof c.amount === 'number'` is false either way) — a real, live-confirmed way
+  to slip a booking's cap untested. Fixed at the template, not just the atom registry.
 
 The claim above also checks `agentDid`/`amount`/`currency`/`merchant` together against the
 request being executed (`@metamynd/agentsafe-mcp-guard` ≥ 0.2.1) — a same-amount, same-currency

package/index.mjs

@@ -23,16 +23,25 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // Must track the guard's MINOR line, not just its major. On a 0.x package `^0.4.0` means
 // >=0.4.0 <0.5.0, so leaving this at ^0.4.0 would scaffold an agent whose `npm test` runs
 // `agentsafe-guard verify` against a guard that has no such command.
-const GUARD_VERSION = '^0.5.0';
+// 0.6.0 adds the amount-unknown atom (deny-by-default when a value-moving action's amount
+// can't be determined) — this was already missed once (this constant sat at ^0.5.0 through the
+// whole 0.6.0 release), silently scaffolding every new project without that protection.
+const GUARD_VERSION = '^0.6.0';
 // The default hosted scaffold's SECOND process — the tool gateway (see scaffoldProject).
 const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.2.0 adds requireAuthorization (closes replay + cumulative spend) — this scaffold sets that
 // option, so a range that could resolve below 0.2.0 would silently scaffold a no-op.
-const MCP_GUARD_VERSION = '^0.2.0';
+// 0.3.0 adds the same amount-unknown atom as the guard, above — same reasoning, same miss.
+const MCP_GUARD_VERSION = '^0.3.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
-const GATEWAY_VERSION = '^0.2.0';
+// 0.3.0 was a first, INCOMPLETE attempt at the follow-on gap (checked only "did the body offer
+// NONE of the three fields" — a correct decoy in one field let the other hide anywhere). 0.4.0
+// is the actual fix: requires amount/merchant specifically, whenever the signature names a real
+// value for them. Re-tested live and closed same day; ^0.3.0 here would still resolve to the
+// broken version.
+const GATEWAY_VERSION = '^0.4.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -908,8 +917,13 @@ own code, or a network attacker) might attempt:
 - **Direct call.** \`bookFlight()\` doesn't exist in the agent's process. There's nothing to call.
 - **Confused deputy (payload).** The gateway re-verifies the signed request against this agent's
   own policy AND binds it to the actual request body (payload binding,
-  \`@metamynd/agentsafe-http-gateway\` ≥ 0.2.0) — signing a cheap request while executing an
-  expensive one is refused before the tool ever runs.
+  \`@metamynd/agentsafe-http-gateway\` ≥ 0.4.0) — signing a cheap request while executing an
+  expensive one is refused before the tool ever runs. The default binder requires \`amount\`/
+  \`merchant\` to actually be found in the body whenever the signature names a real value for
+  them — not just "did the body offer at least one correct-looking field." A first attempt at
+  this (0.3.0) checked the weaker version and was re-tested and closed the same day: a correct
+  decoy in one field let the OTHER field hide anywhere — nested, renamed, an array, or an
+  entirely empty/non-JSON body.
 - **Replay.** \`requireAuthorization: true\` (set in \`server.mjs\`) requires the agent's
   \`authorizationId\` — from a REAL \`guard.authorize()\` call, which \`index.mjs\` already makes for
   any value-bearing action by default — to atomically claim single-use execution against the
@@ -918,6 +932,13 @@ own code, or a network attacker) might attempt:
   already checked it against the mandate's TOTAL budget when it was minted — not just this one
   request's amount. Many small legal-looking calls can't add up past the mandate cap this way,
   because each needed its own real authorization first.
+- **Amount unknown.** \`amount-unknown\` (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.3.0) blocks a
+  platform tool by default when its raw bytes or a nested payload hide the amount from a naive
+  spend cap — AND this agent's OWN starter SOP (see \`agent.metamynd.json\` /
+  \`harness-rules.json\`) puts the same check ahead of its per-transaction cap. That second part
+  didn't used to be true: the SOP only ever authored \`amount-over\`, which silently does not fire
+  on a missing or string amount, so either one slipped the cap untested — the atom existing
+  wasn't the gap, this template never authoring it was.
 
 The claim above also checks the claimed authorization's own \`agentDid\`/\`amount\`/\`currency\`/
 \`merchant\` against the request actually being executed (\`@metamynd/agentsafe-mcp-guard\` ≥ 0.2.1)
@@ -1047,10 +1068,17 @@ async function runSandbox(args) {
 
 /** Mirrors defaultSopDocument() in backend/src/features/onboarding/onboarding.provision.ts —
  *  same starter rules the hosted platform issues, so a harness project behaves identically
- *  to a freshly-provisioned one before anyone edits either. */
+ *  to a freshly-provisioned one before anyone edits either.
+ *
+ *  `amount-unknown` first matters MORE here than on the hosted path: evaluateLocally() runs
+ *  entirely client-side with no schema boundary in front of it, so nothing stops a caller from
+ *  passing amount: "5000" (a string) or omitting amount entirely — `amount-over` silently does
+ *  not fire on either (`typeof c.amount === 'number'` is false), so the cap passes untested,
+ *  not safe. Ordering amount-unknown first blocks that instead of letting it through. */
 function harnessDefaultSop(perTxnMax) {
   return {
     molecules: [
+      { id: 'amount-known', name: 'Amount must be determinable', combinator: 'any', atoms: [{ id: 'a0', predicate: 'amount-unknown' }], decision: 'block', reasonCode: 'AMOUNT_NOT_DETERMINABLE' },
       { id: 'cap', name: 'Per-transaction cap', combinator: 'any', atoms: [{ id: 'a1', predicate: 'amount-over', config: { limit: perTxnMax } }], decision: 'block', reasonCode: 'SOP_SPEND_CAP' },
       { id: 'review', name: 'High-risk review', combinator: 'any', atoms: [{ id: 'a2', predicate: 'risk-at-or-above', config: { level: 'high' } }], decision: 'escalate', reasonCode: 'RISK_REVIEW' },
     ],
@@ -1122,6 +1150,7 @@ function renderConstraint(c) {
 function renderAtom(a) {
   const c = a.config || {};
   switch (a.predicate) {
+    case 'amount-unknown': return \`transaction amount must be a real, determinable number\`;
     case 'amount-over': return \`transaction amount must not exceed \${c.limit}\`;
     case 'cumulative-over': return \`cumulative spend must not exceed \${c.limit}\`;
     case 'jurisdiction-not-allowed': return \`jurisdiction must be one of [\${(c.allowed || []).join(', ')}]\`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.7.4",
+  "version": "0.7.7",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {