create-metamynd-agent 0.9.1 → 0.10.5

package/README.md

@@ -104,7 +104,11 @@ Answer a few prompts (API, owner email/password, agent name, scope, per-transact
 
 ```
 my-agent/
-├─ agent.metamynd.json   # portable guard config — HOLDS THE AGENT SECRET KEY (gitignored)
+├─ agent.metamynd.json   # portable guard config — HOLDS THE AGENT SECRET KEY (gitignored). This
+│                         # is the freshly-minted key from THIS scaffold, not a re-download — the
+│                         # dashboard's own "Redownload config" for an EXISTING agent never re-issues
+│                         # the key into a downloaded file (it's excluded there by design). --byok /
+│                         # --daemon-socket instead keep the key off this CLI's process entirely.
 ├─ index.mjs             # runnable example: signs + calls ./gateway; guardTool() here is a
 │                         # fast local pre-check, NOT the enforcement boundary
 ├─ package.json          # depends on @metamynd/agentsafe-guard
@@ -220,10 +224,12 @@ METAMYND_PASSWORD='…' npx create-metamynd-agent --yes …
 | Flag | Env | Default |
 |---|---|---|
 | `--harness` | — | off (no login/KYB/network at all; free local governance — see above) |
+| `--gateway` | — | off — `--harness` only; ALSO scaffold a second local process (still zero network, zero account) that independently re-verifies every request via the real `@metamynd/agentsafe-mcp-guard`. Does not close nonce replay/cumulative spend — see the generated `harness-gateway/README.md#--gateway`. |
 | `--sandbox` | — | off (skips login/KYB; shared sandbox agent, still hosted) |
 | `--config <file>` | — | a JSON policy file — see [Policy config file](#policy-config-file---config) |
 | `--no-gateway` | — | off — hosted flow only; skips the default separate tool gateway (see above) |
-| `--gateway-port <n>` | — | `4401` — hosted flow only, the gateway process's port |
+| `--gateway-port <n>` | — | `4401` — hosted flow or `--harness --gateway`, the gateway process's port |
+| `--force`, `-f` | — | off — scaffold into a non-empty directory, overwriting existing files |
 | `--port <n>` | — | `4400` — `--harness` only, the local dashboard's port |
 | `--api <url>` | `METAMYND_API` | `https://metamynd.ai/api/v1` |
 | `--email <email>` | `METAMYND_EMAIL` | — (required) |
@@ -236,6 +242,8 @@ METAMYND_PASSWORD='…' npx create-metamynd-agent --yes …
 | `--merchants <a,b>` | — | any |
 | `--byok` | — | generate the keypair locally, provision + prove control |
 | `--public-key <hex>` | — | BYOK with a key you already hold (you prove control yourself) |
+| `--daemon-socket <p>` | — | `--byok` via an already-running agentsafe-signer daemon instead of locally (needs `--daemon-admin-socket` too) |
+| `--daemon-admin-socket <p>` | — | that daemon's admin socket, for `generate-key` |
 | `--out <dir>` | — | `./<agent-slug>` |
 | `--yes`, `-y` | — | non-interactive |
 
@@ -284,10 +292,28 @@ npx create-metamynd-agent --byok --email you@example.com --name "Support Bot"
 ```
 
 Generates an Ed25519 keypair **on your machine**, provisions the agent with only the public key, then
-proves control (signs the one-time challenge → `verify-key`). MetaMynd never sees the private key. The
-generated private key is written into `agent.metamynd.json` (gitignored). Pass `--public-key <hex>`
-instead to register a key you already hold elsewhere — then you complete `verify-key` yourself (the CLI
-prints the challenge + endpoint).
+proves control (signs the one-time challenge → `verify-key`). MetaMynd never sees the private key. By
+default the generated private key is written into `agent.metamynd.json` (gitignored) — the same
+process this CLI runs in holds it, at least briefly. Pass `--public-key <hex>` instead to register a
+key you already hold elsewhere — then you complete `verify-key` yourself (the CLI prints the challenge
++ endpoint).
+
+### Keeping the key out of this process entirely (`--daemon-socket`)
+
+If you already have an [agentsafe-signer](../agentsafe-signer/README.md) daemon running for this
+agent (`agentsafe-signer start --admin`, per its own install guide), point `--byok` at it instead:
+
+```bash
+npx create-metamynd-agent --byok --daemon-socket ./.agentsafe-signer/signer.sock \
+  --daemon-admin-socket ./.agentsafe-signer/signer-admin.sock \
+  --email you@example.com --name "Support Bot"
+```
+
+The daemon generates the key and signs the `verify-key` challenge itself — the private key never
+enters this CLI's process at all, not even briefly. `agent.metamynd.json` gets `keyProvider: 'daemon'`
++ `daemonSocketPath` instead of a plaintext key (see `@metamynd/agentsafe-guard`'s `key-providers.mjs`
+for how the scaffolded guard resolves that). Requires both flags together, and only applies when no
+`--public-key` is given (an external key has nothing for the daemon to generate).
 
 ## Delegated issuance (`--request` / `--claim`)
 

package/index.mjs

@@ -14,10 +14,11 @@
 //   npx create-metamynd-agent
 //   npx create-metamynd-agent --api http://localhost:9926/api/v1 --email you@x.com \
 //       --name "Support Bot" --scope flight-purchase --per-txn-max 500 --out ./support-bot --yes
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, chmodSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import readline from 'node:readline';
 import crypto from 'node:crypto';
+import net from 'node:net';
 
 const GUARD_PKG = '@metamynd/agentsafe-guard';
 // Must track the guard's MINOR line, not just its major. On a 0.x package `^0.4.0` means
@@ -32,7 +33,21 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // 0.8.0 adds an optional `currency` scope to the amount-over/cumulative-over atoms
 // (harnessDefaultSop, below, now sets it) — a guard below this version can't evaluate that
 // field, so a scaffolded currency-scoped cap would silently never fire on a currency mismatch.
-const GUARD_VERSION = '^0.8.0';
+// 0.9.0 makes buildSignedRequest() async (the keyProvider seam, docs/design/
+// agent-key-custody-local-signer-daemon-plan.md) — this scaffold's own bookFlightViaGateway/
+// callGateway templates now `await` it, so a guard below this version would hand back a
+// Promise object where a signed request is expected instead of failing loudly.
+// 0.10.0 adds `resource` as a genuinely signed field (mirrors the mandate's own
+// ResourceService.scopeConstraint()) — no scaffolded template passes it yet, but the floor
+// must still cover the real current version regardless, per this repo's standing
+// internal-pin invariant.
+// 0.11.0 adds `signLocalDecision` support to `createDaemonKeyProvider` — this scaffold's
+// `--byok --daemon-socket` path can now get local-decision audit reporting too, but no
+// template code changes yet; the floor must still cover the real current version.
+// 0.12.0 adds passphrase-encrypted managed key delivery (createGuardFromConfig's
+// `{ passphrase }`) — no scaffolded template passes one yet, but the floor must still cover
+// the real current version regardless, per this repo's standing internal-pin invariant.
+const GUARD_VERSION = '^0.12.0';
 // The default hosted scaffold's SECOND process — the tool gateway (see scaffoldProject).
 const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.2.0 adds requireAuthorization (closes replay + cumulative spend) — this scaffold sets that
@@ -40,7 +55,14 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // 0.3.0 adds the same amount-unknown atom as the guard, above — same reasoning, same miss.
 // 0.4.0 adds the same amount-over/cumulative-over `currency` scope as the guard, above —
 // same reasoning, same miss.
-const MCP_GUARD_VERSION = '^0.4.0';
+// 0.5.0 adds the keyProvider seam alongside the guard's own 0.9.0 (same design doc) — this
+// scaffold's createMcpGuard() calls never use a handshake here, so no template code changes,
+// but the floor must still cover the real current version regardless, per this repo's
+// standing internal-pin invariant.
+// 0.6.0 brings buildAuthMessage's `resource` field and buildLocalDecisionMessage into this
+// package's own bundled policy-core.mjs (alongside the guard's own 0.10.0) — no scaffolded
+// template code changes, but the floor must still cover the real current version.
+const MCP_GUARD_VERSION = '^0.6.0';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
@@ -49,7 +71,10 @@ const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // is the actual fix: requires amount/merchant specifically, whenever the signature names a real
 // value for them. Re-tested live and closed same day; ^0.3.0 here would still resolve to the
 // broken version.
-const GATEWAY_VERSION = '^0.4.0';
+// 0.5.0 adds the OPTIONAL Credential Vault `resolveCredential` hook on createHttpGateway (Module
+// G) — additive and backward-compatible (every existing consumer sees zero behavior change), but
+// the floor must still cover the real current version per this repo's own package-version check.
+const GATEWAY_VERSION = '^0.5.0';
 const DEFAULT_API = 'https://metamynd.ai/api/v1';
 const DEFAULT_GATEWAY_PORT = 4401; // distinct from --harness's dashboard (4400)
 
@@ -118,6 +143,13 @@ ${c.b('Options')}
   --byok               Bring-your-own-key: generate the keypair locally, provision + prove control
                        (MetaMynd never sees the private key). Overridden by --public-key.
   --public-key <hex>   BYOK with a key you already hold (SPKI/raw hex); you prove control yourself
+  --daemon-socket <p>  --byok only: use an already-running agentsafe-signer daemon (started
+                       separately, e.g. \`agentsafe-signer start --admin\`) to generate the key and
+                       prove control instead — the private key never enters this CLI's process at
+                       all, and agent.metamynd.json gets keyProvider:'daemon' instead of a
+                       plaintext key. Requires --daemon-admin-socket too. See README#byok.
+  --daemon-admin-socket <p>  The same daemon's admin socket (for generate-key) — required with
+                       --daemon-socket.
   --out <dir>          Output project directory (default ./<agent-slug>)
   --no-gateway         Hosted flow only: skip the separate tool-gateway process (see
                        README#separate-tool-gateway-default) and scaffold the old
@@ -310,6 +342,72 @@ function signChallengeHex(privateKeyHex, challenge) {
   return crypto.sign(null, Buffer.from(challenge, 'utf8'), key).toString('hex');
 }
 
+// ---------- BYOK via an already-running agentsafe-signer daemon (--daemon-socket) ----------
+// Opt-in alternative to generateAgentKeypair() above: instead of generating the keypair in THIS
+// process and writing it in plaintext into agent.metamynd.json, ask an already-running
+// agentsafe-signer daemon (docs/design/agent-key-custody-local-signer-daemon-plan.md — started
+// separately, e.g. `agentsafe-signer start --admin`) to generate the key and sign the
+// proof-of-possession challenge. The private key never enters this process at all, and the
+// scaffolded config gets `keyProvider: 'daemon'` instead of a plaintext `agentKey` — see
+// agentsafe-guard/key-providers.mjs's resolveKeyProvider(), which reads that field exactly.
+//
+// Vendored rather than depending on @metamynd/agentsafe-signer or @metamynd/agentsafe-guard for
+// it — this CLI is intentionally zero-dependency, and this is the SAME small, self-contained
+// reimplementation of the daemon's local JSON-over-socket protocol that agentsafe-guard/
+// key-providers.mjs and agentsafe-mcp-guard/key-providers.mjs already each carry their own copy
+// of, rather than a fourth package depending on a signer package built for a persistent service,
+// not a one-shot scaffolding command.
+function toPlatformSocketPath(logicalPath) {
+  if (process.platform !== 'win32') return logicalPath;
+  const name = crypto.createHash('sha256').update(resolve(logicalPath)).digest('hex').slice(0, 32);
+  return `\\\\.\\pipe\\agentsafe-signer-${name}`;
+}
+
+function daemonRequest(socketPath, op, params, { connectTimeoutMs = 5000 } = {}) {
+  return new Promise((resolve_, reject) => {
+    const deadline = Date.now() + connectTimeoutMs;
+    let settled = false;
+    const overallTimer = setTimeout(() => {
+      settled = true;
+      reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: timed out after ${connectTimeoutMs}ms`), { code: 'DAEMON_UNREACHABLE' }));
+    }, connectTimeoutMs);
+    function attempt() {
+      if (settled) return;
+      const sock = net.connect(toPlatformSocketPath(socketPath));
+      const requestId = crypto.randomUUID();
+      let buf = '';
+      const cleanup = () => sock.destroy();
+      sock.once('error', (err) => {
+        cleanup();
+        if (settled) return;
+        if (err.code === 'ENOENT' && Date.now() < deadline) { setTimeout(attempt, 20); return; }
+        settled = true;
+        clearTimeout(overallTimer);
+        reject(Object.assign(new Error(`agentsafe-signer daemon unreachable at ${socketPath}: ${err.message}`), { code: 'DAEMON_UNREACHABLE' }));
+      });
+      sock.once('connect', () => {
+        if (settled) return;
+        sock.write(JSON.stringify({ protocolVersion: 1, requestId, op, params }) + '\n');
+      });
+      sock.on('data', (chunk) => {
+        if (settled) return;
+        buf += chunk.toString('utf8');
+        const idx = buf.indexOf('\n');
+        if (idx === -1) return;
+        let res;
+        try { res = JSON.parse(buf.slice(0, idx)); }
+        catch (err) { cleanup(); settled = true; clearTimeout(overallTimer); reject(err); return; }
+        cleanup();
+        settled = true;
+        clearTimeout(overallTimer);
+        if (res.ok) resolve_(res.result);
+        else reject(Object.assign(new Error(res.error?.message || res.error?.code || 'daemon rejected request'), { code: res.error?.code }));
+      });
+    }
+    attempt();
+  });
+}
+
 // ---------- API ----------
 async function apiPost(base, path, body, token) {
   let res;
@@ -343,7 +441,7 @@ async function apiPost(base, path, body, token) {
  * it — the same shape of gap --harness's README documents. See exampleIndex() below, which is
  * what the real (non-sandbox) flow scaffolds by default instead.
  */
-function exampleIndexNoGateway(scope, perTxnMax) {
+function exampleIndexNoGateway(scope, perTxnMax, currency, merchant) {
   const under = Math.max(1, Math.round(perTxnMax * 0.5));
   const over = Math.round(perTxnMax + 100);
   return `// index.mjs — your agent, governed by MetaMynd/AgentSafe.
@@ -369,7 +467,7 @@ const gatedBookFlight = guard.guardTool(
   bookFlight,
   (a) => ({                                     // map tool args → gate inputs
     amount: a.amount,
-    currency: 'USD',
+    currency: '${currency}',
     merchant: a.merchant,
     context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
   }),
@@ -386,7 +484,7 @@ const gatedRaiseOwnLimit = guard.guardTool(
   raiseOwnLimit,
   (a) => ({
     amount: a.amount,
-    currency: 'USD',
+    currency: '${currency}',
     merchant: a.merchant,
     context: { tool: 'permissions-update' },
   }),
@@ -399,7 +497,7 @@ const rule = (n) => '  ' + '-'.repeat(n);
 // Plain-English meaning for the reason codes this demo can produce.
 const WHY = {
   AUTHORIZED: 'inside the mandate and under the SOP spend cap',
-  SOP_SPEND_CAP: 'your SOP caps a single transaction at $${perTxnMax}',
+  SOP_SPEND_CAP: 'your SOP caps a single transaction at ${currency} ${perTxnMax}',
   RISK_REVIEW: 'your SOP sends high-risk actions to a human first',
   MERCHANT_NOT_ALLOWED: 'the mandate lists which merchants this agent may pay',
   // Both say the same thing from where you are standing: the mandate does not cover that
@@ -430,7 +528,7 @@ console.log(dim('   4. each attempt is signed here, then decided by MetaMynd rem
 console.log(dim('   5. your tool runs ONLY if that decision is ALLOW'));
 console.log('');
 console.log(dim('  scope  ${scope}'));
-console.log(dim('  cap    $${perTxnMax} per transaction, set by your SOP'));
+console.log(dim('  cap    ${currency} ${perTxnMax} per transaction, set by your SOP'));
 
 // ---------------------------------------------------------------- 3. THE STEPS
 async function attempt(n, intent, args, tool = gatedBookFlight) {
@@ -458,13 +556,13 @@ async function attempt(n, intent, args, tool = gatedBookFlight) {
 
 console.log('');
 console.log(rule(66));
-await attempt(1, 'a $${under} booking, low risk. Expected to pass.', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'low' });
-await attempt(2, 'a $${over} booking, deliberately over the cap.', { amount: ${over}, merchant: 'skyward-air', riskLevel: 'low' });
-await attempt(3, 'a $${under} booking, but flagged high risk.', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'high' });
+await attempt(1, 'a ${currency} ${under} booking, low risk. Expected to pass.', { amount: ${under}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'low' });
+await attempt(2, 'a ${currency} ${over} booking, deliberately over the cap.', { amount: ${over}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'low' });
+await attempt(3, 'a ${currency} ${under} booking, but flagged high risk.', { amount: ${under}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'high' });
 await attempt(
   4,
   'the agent stops booking flights and asks to raise its OWN limit.',
-  { amount: 100000, merchant: 'skyward-air' },
+  { amount: 100000, currency: '${currency}', merchant: '${merchant}' },
   gatedRaiseOwnLimit,
 );
 console.log('');
@@ -500,7 +598,7 @@ console.log('');
  * directly: it only exists in ./gateway, which independently re-verifies every request against
  * this agent's own policy bundle before it runs, and holds any real credentials the tool needs.
  */
-function exampleIndex(scope, perTxnMax, gatewayPort) {
+function exampleIndex(scope, perTxnMax, gatewayPort, currency, merchant) {
   const under = Math.max(1, Math.round(perTxnMax * 0.5));
   const over = Math.round(perTxnMax + 100);
   return `// index.mjs — your agent, governed by MetaMynd/AgentSafe.
@@ -522,10 +620,10 @@ const GATEWAY = process.env.GATEWAY_URL || 'http://localhost:${gatewayPort}';
 // --- the gateway atomically claim single-use execution, closing replay + cumulative spend, not
 // --- just re-checking policy. See ./gateway/README.md.
 async function bookFlightViaGateway(args, decision) {
-  const signed = guard.buildSignedRequest({
+  const signed = await guard.buildSignedRequest({
     action: '${scope}',
     amount: args.amount,
-    currency: 'USD',
+    currency: args.currency ?? '${currency}',
     merchant: args.merchant,
     context: { tool: 'book-flight', riskLevel: args.riskLevel ?? 'low' },
   });
@@ -552,7 +650,7 @@ const gatedBookFlight = guard.guardTool(
   bookFlightViaGateway,
   (a) => ({                                     // map tool args → gate inputs
     amount: a.amount,
-    currency: 'USD',
+    currency: a.currency ?? '${currency}',
     merchant: a.merchant,
     context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
   }),
@@ -569,7 +667,7 @@ const gatedRaiseOwnLimit = guard.guardTool(
   raiseOwnLimit,
   (a) => ({
     amount: a.amount,
-    currency: 'USD',
+    currency: a.currency ?? '${currency}',
     merchant: a.merchant,
     context: { tool: 'permissions-update' },
   }),
@@ -616,7 +714,7 @@ console.log(dim('   5. the gateway independently re-verifies before your tool ru
 console.log(dim('   6. there is no local bookFlight() to call directly - only the gateway has it'));
 console.log('');
 console.log(dim('  scope    ${scope}'));
-console.log(dim('  cap      $${perTxnMax} per transaction, set by your SOP'));
+console.log(dim('  cap      ${currency} ${perTxnMax} per transaction, set by your SOP'));
 console.log(dim('  gateway  ' + GATEWAY + '  (run it in a separate terminal - see ./gateway)'));
 
 // ---------------------------------------------------------------- 3. THE STEPS
@@ -645,13 +743,13 @@ async function attempt(n, intent, args, tool = gatedBookFlight) {
 
 console.log('');
 console.log(rule(66));
-await attempt(1, 'a $${under} booking, low risk. Expected to pass.', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'low' });
-await attempt(2, 'a $${over} booking, deliberately over the cap.', { amount: ${over}, merchant: 'skyward-air', riskLevel: 'low' });
-await attempt(3, 'a $${under} booking, but flagged high risk.', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'high' });
+await attempt(1, 'a ${currency} ${under} booking, low risk. Expected to pass.', { amount: ${under}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'low' });
+await attempt(2, 'a ${currency} ${over} booking, deliberately over the cap.', { amount: ${over}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'low' });
+await attempt(3, 'a ${currency} ${under} booking, but flagged high risk.', { amount: ${under}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'high' });
 await attempt(
   4,
   'the agent stops booking flights and asks to raise its OWN limit.',
-  { amount: 100000, merchant: 'skyward-air' },
+  { amount: 100000, currency: '${currency}', merchant: '${merchant}' },
   gatedRaiseOwnLimit,
 );
 console.log('');
@@ -698,7 +796,13 @@ function examplePackageJson(slug) {
   ) + '\n';
 }
 
-function exampleReadme(slug, scope, withGateway, gatewayPort) {
+function exampleReadme(slug, scope, withGateway, gatewayPort, daemonKey = false) {
+  const configFileLine = daemonKey
+    ? `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
+  **Holds no secret key.** Signing goes through your already-running agentsafe-signer daemon
+  (\`daemonSocketPath\`) instead — see \`docs/integration/INSTALL-AGENTSAFE-SIGNER.md\`.`
+    : `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
+  **Contains the agent's secret key — never commit it.** It is already in \`.gitignore\`.`;
   const gatewaySection = withGateway
     ? `## Run
 
@@ -721,8 +825,7 @@ an ESCALATE (high risk). The BLOCK and ESCALATE never reach the gateway at all
 
 ## Files
 
-- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
-  **Contains the agent's secret key — never commit it.** It is already in \`.gitignore\`.
+${configFileLine}
 - \`index.mjs\` — signs each request and calls \`./gateway\` for it; \`guard.guardTool()\` here is a
   fast local pre-check, not the enforcement boundary.
 - \`gateway/\` — a **separate process**. It holds the real tool and independently re-verifies every
@@ -743,8 +846,7 @@ You should see an ALLOW, a BLOCK (over the per-transaction cap), and an ESCALATE
 
 ## Files
 
-- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
-  **Contains the agent's secret key — never commit it.** It is already in \`.gitignore\`.
+${configFileLine}
 - \`index.mjs\` — wraps a tool with \`guard.guardTool(...)\`; the tool only runs when the gate allows.
 
 ## What this is not
@@ -1009,11 +1111,16 @@ and \`demo/duffel-mcp-gateway\` in the AgentSafe repo for the fuller pattern thi
 `;
 }
 
-function writeFileSafe(dir, name, content, force = false) {
+function writeFileSafe(dir, name, content, force = false, mode) {
   const p = join(dir, name);
   const exists = existsSync(p);
   if (exists && !force) { console.log(`  ${c.yellow('skip')}  ${name} ${c.dim('(exists)')}`); return; }
-  writeFileSync(p, content);
+  // `mode` (e.g. 0o600 for a private-key-bearing file) only narrows perms at CREATE time —
+  // writeFileSync ignores its own `mode` option on an existing file, so an --force overwrite
+  // needs an explicit chmod or a stale world-readable mode from the file's first creation
+  // would otherwise survive untouched.
+  writeFileSync(p, content, mode !== undefined ? { mode } : undefined);
+  if (mode !== undefined) chmodSync(p, mode);
   console.log(`  ${exists ? c.yellow('overwrite') : c.green('create')} ${name}`);
 }
 
@@ -1047,15 +1154,15 @@ function assertScaffoldTarget(outDir, force) {
  * enforcement boundary. Off for --sandbox (shared demo identity, never real credentials
  * anyway) and --no-gateway (opt out, e.g. you're already running your own separate gateway).
  */
-function scaffoldProject({ outDir, config, slug, scope, perTxnMax, sandbox, withGateway, gatewayPort = DEFAULT_GATEWAY_PORT, force = false }) {
+function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'USD', merchant = 'skyward-air', sandbox, withGateway, gatewayPort = DEFAULT_GATEWAY_PORT, force = false }) {
   assertScaffoldTarget(outDir, force);
   console.log(`\n  ${c.b('Scaffolding')} ${c.dim(outDir)}`);
   if (!existsSync(outDir)) mkdirSync(outDir, { recursive: true });
-  writeFileSafe(outDir, 'agent.metamynd.json', JSON.stringify(config, null, 2) + '\n', force);
-  writeFileSafe(outDir, 'index.mjs', withGateway ? exampleIndex(scope, perTxnMax, gatewayPort) : exampleIndexNoGateway(scope, perTxnMax), force);
+  writeFileSafe(outDir, 'agent.metamynd.json', JSON.stringify(config, null, 2) + '\n', force, 0o600);
+  writeFileSafe(outDir, 'index.mjs', withGateway ? exampleIndex(scope, perTxnMax, gatewayPort, currency, merchant) : exampleIndexNoGateway(scope, perTxnMax, currency, merchant), force);
   writeFileSafe(outDir, 'package.json', examplePackageJson(slug), force);
   writeFileSafe(outDir, '.gitignore', gitignore(), force);
-  writeFileSafe(outDir, 'README.md', exampleReadme(slug, scope, withGateway, gatewayPort), force);
+  writeFileSafe(outDir, 'README.md', exampleReadme(slug, scope, withGateway, gatewayPort, config.keyProvider === 'daemon'), force);
 
   if (withGateway) {
     const apiBase = config.apiBase ?? config.api ?? DEFAULT_API;
@@ -1072,6 +1179,8 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, sandbox, with
   console.log(`\n${c.green(c.b('  ✓ Done.'))} Your governed agent is ready.\n`);
   if (sandbox) {
     console.log(`  ${c.dim('Shared sandbox agent — for trying MetaMynd only. Provision your own (drop --sandbox) for anything real.')}\n`);
+  } else if (config.keyProvider === 'daemon') {
+    console.log(`  ${c.dim('agent.metamynd.json holds no secret key — signing goes through your agentsafe-signer daemon at')} ${c.b(config.daemonSocketPath)}${c.dim('.')}\n`);
   } else if (config.agentKey) {
     console.log(`  ${c.yellow('⚠ agent.metamynd.json holds the agent secret key')} — it is gitignored; never commit it.\n`);
   }
@@ -1691,7 +1800,7 @@ setInterval(refresh, 3000);
 `;
 }
 
-function harnessIndexFile(scope, perTxnMax, port, withGateway, gatewayPort) {
+function harnessIndexFile(scope, perTxnMax, port, withGateway, gatewayPort, currency, merchant) {
   const under = Math.max(1, Math.round(perTxnMax * 0.5));
   const over = Math.round(perTxnMax + 100);
   return `// index.mjs — your agent, governed entirely on this machine. No account, no network call
@@ -1730,7 +1839,7 @@ const GATEWAY = process.env.HARNESS_GATEWAY_URL || 'http://localhost:${gatewayPo
 // issuer): it builds and signs the same canonical message a real gate would verify, entirely
 // offline, using this agent's own did:key — the gateway verifies that signature for itself.
 async function callGateway(path, action, args) {
-  const signed = guard.buildSignedRequest({ action, amount: args.amount, currency: 'USD', merchant: args.merchant, context: { tool: '${scope}', riskLevel: args.riskLevel ?? 'low' } });
+  const signed = await guard.buildSignedRequest({ action, amount: args.amount, currency: args.currency ?? '${currency}', merchant: args.merchant, context: { tool: '${scope}', riskLevel: args.riskLevel ?? 'low' } });
   const res = await fetch(GATEWAY + path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ signed, args }) });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
@@ -1753,6 +1862,7 @@ const gatedBookFlight = guard.guardToolLocal(
   ${withGateway ? `(args) => callGateway('/book-flight', '${scope}', args)` : 'bookFlight'},
   (a) => ({                                     // map tool args → gate inputs
     amount: a.amount,
+    currency: a.currency ?? '${currency}',
     merchant: a.merchant,
     context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
   }),
@@ -1768,7 +1878,7 @@ async function raiseOwnLimit(args) {
 const gatedRaiseOwnLimit = guard.guardToolLocal(
   'permissions.update',                       // an action NOT in the mandate
   ${withGateway ? `(args) => callGateway('/raise-limit', 'permissions.update', args)` : 'raiseOwnLimit'},
-  (a) => ({ amount: a.amount, merchant: a.merchant, context: { tool: 'permissions-update' } }),
+  (a) => ({ amount: a.amount, currency: a.currency ?? '${currency}', merchant: a.merchant, context: { tool: 'permissions-update' } }),
   getBundle,
 );
 
@@ -1778,7 +1888,7 @@ const rule = (n) => '  ' + '-'.repeat(n);
 
 const WHY = {
   AUTHORIZED: 'inside the mandate and under the SOP spend cap',
-  SOP_SPEND_CAP: 'your SOP caps a single transaction at $${perTxnMax}',
+  SOP_SPEND_CAP: 'your SOP caps a single transaction at ${currency} ${perTxnMax}',
   RISK_REVIEW: 'your SOP sends high-risk actions to a human first',
   MERCHANT_NOT_ALLOWED: 'the mandate lists which merchants this agent may pay',
   NO_PERMISSION_FOR_ACTION: 'the mandate never granted this action - at any amount',
@@ -1824,14 +1934,14 @@ console.log('  for something never granted at all - the one a prompt could not h
 console.log('  because the decision is not made inside your program, and not on a server either.');
 console.log('');
 console.log(dim('  scope  ${scope}'));
-console.log(dim('  cap    $${perTxnMax} per transaction, from ./metamynd-rules.json'));
+console.log(dim('  cap    ${currency} ${perTxnMax} per transaction, from ./metamynd-rules.json'));
 
 console.log('');
 console.log(rule(66));
-await attempt(1, 'a $${under} booking, low risk. Expected to pass.', '${scope}', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'low' });
-await attempt(2, 'a $${over} booking, deliberately over the cap.', '${scope}', { amount: ${over}, merchant: 'skyward-air', riskLevel: 'low' });
-await attempt(3, 'a $${under} booking, but flagged high risk.', '${scope}', { amount: ${under}, merchant: 'skyward-air', riskLevel: 'high' });
-await attempt(4, 'the agent stops booking flights and asks to raise its OWN limit.', 'permissions.update', { amount: 100000, merchant: 'skyward-air' }, gatedRaiseOwnLimit);
+await attempt(1, 'a ${currency} ${under} booking, low risk. Expected to pass.', '${scope}', { amount: ${under}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'low' });
+await attempt(2, 'a ${currency} ${over} booking, deliberately over the cap.', '${scope}', { amount: ${over}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'low' });
+await attempt(3, 'a ${currency} ${under} booking, but flagged high risk.', '${scope}', { amount: ${under}, currency: '${currency}', merchant: '${merchant}', riskLevel: 'high' });
+await attempt(4, 'the agent stops booking flights and asks to raise its OWN limit.', 'permissions.update', { amount: 100000, currency: '${currency}', merchant: '${merchant}' }, gatedRaiseOwnLimit);
 console.log('');
 console.log(rule(66));
 
@@ -2008,10 +2118,10 @@ async function runHarness(args) {
 
   console.log(`\n  ${c.b('Scaffolding')} ${c.dim(outDir)}`);
   if (!existsSync(outDir)) mkdirSync(outDir, { recursive: true });
-  writeFileSafe(outDir, 'agent.metamynd.json', JSON.stringify({ agentDid, agentKey: privateKeyHex, mode: 'harness' }, null, 2) + '\n', !!args.force);
+  writeFileSafe(outDir, 'agent.metamynd.json', JSON.stringify({ agentDid, agentKey: privateKeyHex, mode: 'harness' }, null, 2) + '\n', !!args.force, 0o600);
   writeFileSafe(outDir, 'metamynd-rules.json', harnessRulesFile(mandate, sopDocument), !!args.force);
   writeFileSafe(outDir, 'harness-server.mjs', harnessServerFile(), !!args.force);
-  writeFileSafe(outDir, 'index.mjs', harnessIndexFile(scope, perTxnMax, port, withGateway, gatewayPort), !!args.force);
+  writeFileSafe(outDir, 'index.mjs', harnessIndexFile(scope, perTxnMax, port, withGateway, gatewayPort, currency, merchants[0] || 'demo-merchant'), !!args.force);
   writeFileSafe(outDir, 'package.json', harnessPackageJson(slug), !!args.force);
   writeFileSafe(outDir, '.gitignore', gitignore(), !!args.force);
   writeFileSafe(outDir, 'README.md', harnessReadme(slug, scope, port, withGateway, gatewayPort), !!args.force);
@@ -2103,7 +2213,9 @@ async function runRequest(args) {
   const d = res.data;
   const state = { api: base, requestId: d.requestId, claimToken: d.claimToken, byok: !!generated, privateKey: generated?.privateKeyHex ?? null, name, scope, perTxnMax };
   const file = resolve(String(args.out || '.'), REQUEST_STATE_FILE);
-  writeFileSync(file, JSON.stringify(state, null, 2) + '\n');
+  // May carry a BYOK private key (state.privateKey) — same 0600 treatment as agent.metamynd.json.
+  writeFileSync(file, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+  if (existsSync(file)) chmodSync(file, 0o600);
 
   console.log(`  ${c.green('✓')} request ${c.b(d.requestId)} submitted — awaiting ${owner}'s approval`);
   console.log(`  ${c.yellow('⚠ saved the one-time claim token to')} ${file.replace(resolve('.'), '.').replace(/\\/g, '/')} ${c.dim('(secret — do not commit)')}\n`);
@@ -2224,11 +2336,35 @@ async function main() {
   );
   const merchants = String(merchantsRaw).split(',').map((s) => s.trim()).filter(Boolean);
 
-  // BYOK: --byok generates a keypair on THIS machine (MetaMynd never sees the private key). An
-  // explicit --public-key means the caller holds the key elsewhere and will prove it themselves.
+  // BYOK: --byok generates a keypair on THIS machine (MetaMynd never sees the private key) —
+  // either locally in this process (default) or, opt-in, via an already-running agentsafe-signer
+  // daemon (--daemon-socket + --daemon-admin-socket, see their own help text) so the private key
+  // never enters this process at all. An explicit --public-key means the caller holds the key
+  // elsewhere and will prove it themselves — daemon flags are meaningless with it.
   let publicKey = typeof args['public-key'] === 'string' ? args['public-key'] : undefined;
+  const daemonSocket = typeof args['daemon-socket'] === 'string' ? args['daemon-socket'] : undefined;
+  const daemonAdminSocket = typeof args['daemon-admin-socket'] === 'string' ? args['daemon-admin-socket'] : undefined;
+  if (Boolean(daemonSocket) !== Boolean(daemonAdminSocket)) {
+    rl?.close();
+    fail('--daemon-socket and --daemon-admin-socket must be used together.');
+  }
+  if (daemonSocket && !args.byok) {
+    rl?.close();
+    fail('--daemon-socket requires --byok.');
+  }
+  if (daemonSocket && publicKey) {
+    rl?.close();
+    fail('--daemon-socket generates its own key — pass --byok alone, not --public-key.');
+  }
   let generatedKey = null;
-  if (args.byok && !publicKey) {
+  let daemonPublicKeyHex = null;
+  if (args.byok && !publicKey && daemonSocket) {
+    console.log(c.dim('  → asking the agentsafe-signer daemon to generate a key …'));
+    const { publicKeyHex } = await daemonRequest(daemonAdminSocket, 'generate-key', { allowRekey: false });
+    daemonPublicKeyHex = publicKeyHex;
+    publicKey = publicKeyHex;
+    console.log(`  ${c.green('✓')} generated an Ed25519 keypair via the signer daemon ${c.dim('(the private key never left it)')}`);
+  } else if (args.byok && !publicKey) {
     generatedKey = generateAgentKeypair();
     publicKey = generatedKey.publicKeyHex;
     console.log(`  ${c.green('✓')} generated an Ed25519 keypair locally ${c.dim('(private key stays on this machine)')}`);
@@ -2253,7 +2389,21 @@ async function main() {
   if (config.standards?.length) console.log(`  ${c.green('✓')} enforced Standards: ${config.standards.join(', ')}`);
 
   // 3b. BYOK: prove control of the key (verify-key), else the gate blocks with AGENT_KEY_UNVERIFIED.
-  if (generatedKey) {
+  if (daemonPublicKeyHex) {
+    // The daemon holds the private key — it never entered this process. Point the scaffolded
+    // guard at the daemon instead of embedding a plaintext key (agentsafe-guard/key-providers.mjs's
+    // resolveKeyProvider() reads these two fields and never looks for `agentKey` when present).
+    config.keyProvider = 'daemon';
+    config.daemonSocketPath = daemonSocket;
+    if (config.challenge) {
+      console.log(c.dim('  → proving key control via the daemon (verify-key) …'));
+      const { signature } = await daemonRequest(daemonSocket, 'sign-key-control-challenge', { challenge: config.challenge });
+      await apiPost(base, `/agent-identity/${encodeURIComponent(config.identityId)}/verify-key`, { signature }, token);
+      config.keyVerified = true;
+      delete config.challenge; // one-time; consumed
+      console.log(`  ${c.green('✓')} key verified — MetaMynd never saw your private key, and neither did this CLI`);
+    }
+  } else if (generatedKey) {
     // We hold the private key — inject it into the config so the scaffolded guard can sign, and
     // prove possession by signing the issued challenge.
     config.agentKey = generatedKey.privateKeyHex;
@@ -2274,7 +2424,7 @@ async function main() {
   }
 
   // 4. Scaffold + next steps
-  scaffoldProject({ outDir, config, slug, scope, perTxnMax, sandbox: false, withGateway: !args['no-gateway'], gatewayPort: Number(args['gateway-port']) || DEFAULT_GATEWAY_PORT, force: !!args.force });
+  scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency, merchant: merchants[0] || 'demo-merchant', sandbox: false, withGateway: !args['no-gateway'], gatewayPort: Number(args['gateway-port']) || DEFAULT_GATEWAY_PORT, force: !!args.force });
 }
 
 main().catch((e) => fail(e?.stack || e?.message || String(e)));

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.9.1",
+  "version": "0.10.5",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {
     "create-metamynd-agent": "index.mjs"
   },
   "scripts": {
-    "test": "node harness-gateway.smoke.mjs"
+    "test": "node harness-gateway.smoke.mjs && node byok-daemon.smoke.mjs"
   },
   "files": [
     "index.mjs",