@blockrun/clawrouter 0.12.268 → 0.12.269

package/README.md

@@ -40,6 +40,23 @@ Or neither — <!-- br:models.free -->7<!-- /br:models.free --> models are free,
 
 ---
 
+## What BlockRun is
+
+> **BlockRun lets agents pay for the outcome — every LLM, tool and data source, best value per dollar.**
+
+Not a seat, not a subscription, not a monthly minimum you keep paying while the agent idles. An agent asks for one thing — an answer, an image, a transcript, a price, a call placed — and pays for that one thing at the moment it happens. Nothing to sign up for, nothing to cancel.
+
+|                           |                                                                                                                                                                                                                                                                                                                                                               |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Every LLM**             | <!-- br:models.chatVisible -->76<!-- /br:models.chatVisible --> chat models across 9 providers, behind one endpoint and one balance                                                                                                                                                                                                                           |
+| **Every tool**            | <!-- br:models.image -->9<!-- /br:models.image --> image models, <!-- br:models.video -->8<!-- /br:models.video --> video models, music, <!-- br:models.speech -->5<!-- /br:models.speech --> voices, img2img editing, and outbound phone calls that come back as transcripts                                                                                 |
+| **Every data source**     | web, news and neural search; prediction markets; live crypto and equity quotes; on-chain SQL over 100M+ labeled wallets; DEX routing; RPC across <!-- br:chains.rpc -->40<!-- /br:chains.rpc --> chains                                                                                                                                                       |
+| **Best value per dollar** | <!-- br:clawrouter.dimensions -->15<!-- /br:clawrouter.dimensions -->-dimension local routing sends each request to the cheapest model that can actually do it — <!-- br:savings.autoVsBaselinePct -->84<!-- /br:savings.autoVsBaselinePct -->% below pinning Claude Opus 5 on the same traffic, computed from a published workload mix rather than estimated |
+
+**ClawRouter is how an agent reaches it.** BlockRun is the gateway and the billing; ClawRouter is the MIT-licensed router that runs on your machine, decides which model each request deserves, and settles the bill — a wallet signature in USDC, or a credit-card-funded API key. The rest of this README is about ClawRouter.
+
+---
+
 ## Why ClawRouter exists
 
 Every other LLM router was built for **human developers** — create an account, get an API key, pick a model from a dashboard, pay with a credit card.
@@ -868,6 +885,10 @@ Python plugin that wraps the ClawRouter proxy for `hermes-agent`. Same <!-- br:m
 
 ## Frequently Asked Questions
 
+### What is BlockRun?
+
+BlockRun lets agents pay for the outcome — every LLM, tool and data source, best value per dollar. One endpoint and one balance covering <!-- br:models.chatVisible -->76<!-- /br:models.chatVisible --> chat models plus image, video, music and speech generation, search, market data and multi-chain RPC, billed per call with USDC over [x402](https://x402.org) or a credit-card-funded API key — no seat, no subscription, no minimum. ClawRouter is the open-source local router agents use to reach it.
+
 ### What is ClawRouter?
 
 ClawRouter is an open-source (MIT licensed) smart LLM router built for autonomous AI agents. It analyzes each request across <!-- br:clawrouter.dimensions -->15<!-- /br:clawrouter.dimensions --> dimensions and routes to the cheapest capable model in under 1ms, entirely locally — no external API calls needed for routing decisions.

package/dist/cli.js

@@ -32310,6 +32310,11 @@ function canonicalLimits(limits) {
     Object.fromEntries(Object.entries(limits).sort(([a], [b]) => a < b ? -1 : 1))
   );
 }
+function getSharedSpendControl() {
+  const host = sharedControlHost();
+  host.__clawrouterSharedSpendControl ??= new SpendControl();
+  return host.__clawrouterSharedSpendControl;
+}
 function parseQuotedAmountUsd(selected) {
   const raw = selected.amount ?? selected.maxAmountRequired;
   if (typeof raw !== "string" || !CANONICAL_AMOUNT.test(raw)) {
@@ -32385,7 +32390,7 @@ function formatDuration(seconds) {
     return mins > 0 ? `${hours}h ${mins}m` : `${hours}h`;
   }
 }
-var WALLET_DIR, HOUR_MS, DAY_MS, CAIP2_BASE, CAIP2_SOLANA_MAINNET, PAYABLE_NETWORKS, POLICY_LISTS, ADDRESS_LISTS, EVM_ADDRESS, MalformedSpendPolicyError, SpendPolicyConflictError, FileSpendControlStorage, InMemorySpendControlStorage, RESERVATION_TTL_MS, SpendControl, SpendPolicyError, CANONICAL_AMOUNT;
+var WALLET_DIR, HOUR_MS, DAY_MS, CAIP2_BASE, CAIP2_SOLANA_MAINNET, PAYABLE_NETWORKS, POLICY_LISTS, ADDRESS_LISTS, EVM_ADDRESS, UnreadableSpendPolicyError, MalformedSpendPolicyError, SpendPolicyConflictError, FileSpendControlStorage, InMemorySpendControlStorage, RESERVATION_TTL_MS, SpendControl, sharedControlHost, SpendPolicyError, CANONICAL_AMOUNT;
 var init_spend_control = __esm({
   "src/spend-control.ts"() {
     "use strict";
@@ -32404,6 +32409,12 @@ var init_spend_control = __esm({
     ];
     ADDRESS_LISTS = ["allowedPayees", "blockedPayees", "allowedAssets"];
     EVM_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+    UnreadableSpendPolicyError = class extends Error {
+      constructor(cause) {
+        super(`[ClawRouter] Failed to load spending data: ${cause}`);
+        this.name = "UnreadableSpendPolicyError";
+      }
+    };
     MalformedSpendPolicyError = class extends Error {
       constructor(key2) {
         super(
@@ -32464,9 +32475,7 @@ var init_spend_control = __esm({
           if (err instanceof MalformedSpendPolicyError) {
             throw err;
           }
-          console.error(
-            `[ClawRouter] Failed to load spending data, starting fresh (any configured spend policy is NOT in effect until this file is repaired): ${err}`
-          );
+          throw new UnreadableSpendPolicyError(err);
         }
         return null;
       }
@@ -32607,6 +32616,33 @@ var init_spend_control = __esm({
       getPolicyFileError() {
         return this.policyFileBroken;
       }
+      /**
+       * Re-read limits from storage, keeping this instance's history and open
+       * reservations. Used on an in-process proxy restart so a hand-edit to
+       * spending.json made while the process was running still applies, without
+       * resetting the rolling windows. Fails closed exactly like the constructor:
+       * a malformed file refuses every payment until repaired, and a repaired
+       * file clears that refusal.
+       */
+      reloadLimits() {
+        let data;
+        try {
+          data = this.storage.load();
+        } catch (err) {
+          if (err instanceof UnreadableSpendPolicyError) {
+            console.error(`${err.message} \u2014 keeping the limits already in effect`);
+            return;
+          }
+          if (!(err instanceof MalformedSpendPolicyError)) throw err;
+          this.policyFileBroken = err.message;
+          console.error(`[ClawRouter] ${err.message}`);
+          return;
+        }
+        this.policyFileBroken = void 0;
+        this.limits = data ? cloneLimits(data.limits) : {};
+        this.diskLimits = cloneLimits(this.limits);
+        this.limitsDirty = false;
+      }
       check(estimatedCost2, counterparty) {
         if (this.policyFileBroken !== void 0) {
           return {
@@ -32851,6 +32887,16 @@ var init_spend_control = __esm({
         const records = [...this.history].reverse();
         return limit ? records.slice(0, limit) : records;
       }
+      /**
+       * Reset the session window. `sessionSpent`/`sessionCalls` are instance state
+       * that is never persisted, so this used to happen implicitly: every
+       * startProxy() built a fresh SpendControl. The process-wide ledger outlives
+       * an in-process proxy restart, which would silently redefine `session` as
+       * "since the gateway booted" — docs/configuration.md and the /policy help
+       * both promise "session resets on restart". The restart path in index.ts
+       * calls this to keep that promise. History and the rolling hourly/daily
+       * windows are deliberately untouched.
+       */
       resetSession() {
         this.sessionSpent = 0;
         this.sessionCalls = 0;
@@ -32872,10 +32918,13 @@ var init_spend_control = __esm({
             this.storage.saveLimits(cloneLimits(this.limits), cloneLimits(this.diskLimits));
           } catch (err) {
             if (err instanceof SpendPolicyConflictError) {
-              const current = this.storage.load();
-              this.limits = cloneLimits(current?.limits ?? {});
-              this.diskLimits = cloneLimits(this.limits);
-              this.limitsDirty = false;
+              try {
+                const current = this.storage.load();
+                this.limits = cloneLimits(current?.limits ?? {});
+                this.diskLimits = cloneLimits(this.limits);
+                this.limitsDirty = false;
+              } catch {
+              }
             }
             throw err;
           }
@@ -32893,6 +32942,12 @@ var init_spend_control = __esm({
         try {
           data = this.storage.load();
         } catch (err) {
+          if (err instanceof UnreadableSpendPolicyError) {
+            console.error(
+              `${err.message} \u2014 starting fresh (any configured spend policy is NOT in effect until this file is repaired)`
+            );
+            return;
+          }
           if (!(err instanceof MalformedSpendPolicyError)) throw err;
           this.policyFileBroken = err.message;
           console.error(`[ClawRouter] ${err.message}`);
@@ -32909,6 +32964,7 @@ var init_spend_control = __esm({
         }
       }
     };
+    sharedControlHost = () => process;
     SpendPolicyError = class extends Error {
       blockedBy;
       blockedByPolicy;
@@ -32946,6 +33002,21 @@ function createPayFetchWithPreAuth(baseFetch, client, ttlMs = DEFAULT_TTL_MS, op
       }
     }
     const cacheKey2 = `${urlPath}:${requestModel}`;
+    const notifyAcceptedPayment = (response2, payload2) => {
+      const settled = response2.headers.has("payment-response") || response2.headers.has("x-payment-response");
+      if (!settled || !options?.onPayment) return;
+      try {
+        options.onPayment({
+          model: requestModel,
+          amount: payload2.accepted.amount,
+          network: payload2.accepted.network
+        });
+      } catch (error) {
+        console.error(
+          `[ClawRouter] onPayment callback failed: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    };
     const estimateMicros = () => {
       if (!options?.estimateAmount || !requestModel) return void 0;
       const est = options.estimateAmount(requestModel, bodyLength, maxTokens);
@@ -32966,6 +33037,7 @@ function createPayFetchWithPreAuth(baseFetch, client, ttlMs = DEFAULT_TTL_MS, op
         paymentInFlight = true;
         const response2 = await baseFetch(preAuthRequest);
         if (response2.status !== 402) {
+          notifyAcceptedPayment(response2, payload2);
           return response2;
         }
         paymentInFlight = false;
@@ -33012,7 +33084,9 @@ function createPayFetchWithPreAuth(baseFetch, client, ttlMs = DEFAULT_TTL_MS, op
     for (const [key2, value] of Object.entries(paymentHeaders)) {
       clonedRequest.headers.set(key2, value);
     }
-    return baseFetch(clonedRequest);
+    const paidResponse = await baseFetch(clonedRequest);
+    notifyAcceptedPayment(paidResponse, payload);
+    return paidResponse;
   };
 }
 var DEFAULT_TTL_MS;
@@ -91588,7 +91662,7 @@ async function startProxy(options) {
   if (x402 && account) {
     const evmPublicClient = createPublicClient({ chain: base, transport: http() });
     const evmSigner = toClientEvmSigner(account, evmPublicClient);
-    const spendControl = options.spendControl ?? new SpendControl();
+    const spendControl = options.spendControl ?? getSharedSpendControl();
     registerSpendPolicyHook(x402, spendControl);
     registerExactEvmScheme(x402, { signer: evmSigner });
   }
@@ -91620,7 +91694,11 @@ async function startProxy(options) {
     // Per-request cost estimate so pre-auth is only reused when the cached
     // payment still covers the (possibly larger) request — BlockRun prices per
     // token, so one model can cost different amounts across requests.
-    estimateAmount
+    estimateAmount,
+    // Only the wallet rail settles per call. The API-key rail is billed
+    // server-side against account credit, so there is no per-request
+    // settlement for an observer to report.
+    onPayment: options.onPayment
   });
   let balanceMonitor;
   if (options._balanceMonitorOverride) {
@@ -117892,9 +117970,7 @@ var init_client5 = __esm({
 
 // src/polymarket/spend-policy.ts
 function resolveSpendControl(deps) {
-  if (deps?.spendControl) return deps.spendControl;
-  defaultControl ??= new SpendControl();
-  return defaultControl;
+  return deps?.spendControl ?? getSharedSpendControl();
 }
 function usdToMicros(usd) {
   return String(Math.ceil(usd * 1e6));
@@ -117911,7 +117987,6 @@ async function signUnderSpendPolicy(deps, quote, action, sign4) {
     throw err;
   }
 }
-var defaultControl;
 var init_spend_policy = __esm({
   "src/polymarket/spend-policy.ts"() {
     "use strict";
@@ -227276,7 +227351,7 @@ var init_fund = __esm({
 });
 
 // src/polymarket/tool.ts
-function buildPolymarketTool() {
+function buildPolymarketTool(deps) {
   return {
     name: "blockrun_polymarket",
     description: DESCRIPTION,
@@ -227361,26 +227436,32 @@ function buildPolymarketTool() {
           result = await runSetup({ confirm });
           break;
         case "fund":
-          result = await fundVault({
-            amount_usd: params.amount_usd,
-            confirm
-          });
+          result = await fundVault(
+            {
+              amount_usd: params.amount_usd,
+              confirm
+            },
+            deps
+          );
           break;
         case "buy":
         case "sell":
-          result = await executeTrade({
-            action,
-            token_id: params.token_id,
-            condition_id: params.condition_id,
-            outcome: params.outcome,
-            price: params.price,
-            size: params.size,
-            amount_usd: params.amount_usd,
-            order_type: params.order_type,
-            expires_at: params.expires_at,
-            post_only: params.post_only,
-            confirm
-          });
+          result = await executeTrade(
+            {
+              action,
+              token_id: params.token_id,
+              condition_id: params.condition_id,
+              outcome: params.outcome,
+              price: params.price,
+              size: params.size,
+              amount_usd: params.amount_usd,
+              order_type: params.order_type,
+              expires_at: params.expires_at,
+              post_only: params.post_only,
+              confirm
+            },
+            deps
+          );
           break;
         case "orders":
           result = await listOpenOrders({
@@ -227397,17 +227478,23 @@ function buildPolymarketTool() {
           result = await listPositions();
           break;
         case "redeem":
-          result = await redeemPosition({
-            condition_id: params.condition_id,
-            confirm
-          });
+          result = await redeemPosition(
+            {
+              condition_id: params.condition_id,
+              confirm
+            },
+            deps
+          );
           break;
         case "withdraw":
-          result = await withdrawFunds({
-            amount_usd: params.amount_usd,
-            to_address: params.to_address,
-            confirm
-          });
+          result = await withdrawFunds(
+            {
+              amount_usd: params.amount_usd,
+              to_address: params.to_address,
+              confirm
+            },
+            deps
+          );
           break;
         default:
           throw new Error(`Unknown blockrun_polymarket action: ${action}`);
@@ -227823,6 +227910,7 @@ __export(index_exports, {
   SolanaBalanceMonitor: () => SolanaBalanceMonitor,
   SpendControl: () => SpendControl,
   SpendPolicyError: () => SpendPolicyError,
+  UnreadableSpendPolicyError: () => UnreadableSpendPolicyError,
   VISIBLE_OPENCLAW_MODELS: () => VISIBLE_OPENCLAW_MODELS,
   blockrunProvider: () => blockrunProvider,
   buildImageGenerationProvider: () => buildImageGenerationProvider,
@@ -228403,12 +228491,18 @@ async function startProxyInBackground(api, startupGeneration) {
       `Cost cap: $${maxCostPerRunUsd.toFixed(2)} per session (mode: ${maxCostPerRunMode})`
     );
   }
+  const sharedControl = getSharedSpendControl();
+  sharedControl.reloadLimits();
+  sharedControl.resetSession();
   const proxy = await startProxy({
     ...apiKey ? { apiKey } : { wallet },
     routingConfig,
     maxCostPerRunUsd,
     maxCostPerRunMode,
-    spendControl: liveSpendControl = new SpendControl(),
+    // The process-wide ledger: the polymarket tool and the /policy command
+    // registered below use the same instance, so hourly/daily/session windows
+    // cover every surface and a /policy write reaches the live signer.
+    spendControl: sharedControl,
     onReady: (port) => {
       api.logger.info(`BlockRun ${apiKey ? "API-key" : "x402"} proxy listening on port ${port}`);
     },
@@ -229151,7 +229245,7 @@ function createWalletCommand(api) {
     }
   };
 }
-var activeProxyHandle, liveSpendControl, pendingConfiguredStartupApi, IMAGE_DIR2, AUDIO_DIR2, VIDEO_DIR2, plugin, index_default2;
+var activeProxyHandle, pendingConfiguredStartupApi, IMAGE_DIR2, AUDIO_DIR2, VIDEO_DIR2, plugin, index_default2;
 var init_index = __esm({
   "src/index.ts"() {
     "use strict";
@@ -229170,10 +229264,10 @@ var init_index = __esm({
     init_stats();
     init_partners();
     init_tool();
+    init_spend_control();
     init_stats2();
     init_exclude();
     init_policy();
-    init_spend_control();
     init_mcp_config();
     init_openclaw_plugin_config();
     init_openclaw_plugin_config();
@@ -229195,7 +229289,6 @@ var init_index = __esm({
     init_response_cache();
     init_partners();
     activeProxyHandle = null;
-    liveSpendControl = null;
     pendingConfiguredStartupApi = null;
     IMAGE_DIR2 = join17(homedir14(), ".openclaw", "blockrun", "images");
     AUDIO_DIR2 = join17(homedir14(), ".openclaw", "blockrun", "audio");
@@ -229511,7 +229604,7 @@ ${errText}`
         api.registerCommand(createExcludeCommand());
         api.registerCommand(
           createPolicyCommand({
-            liveControl: () => activeProxyHandle ? liveSpendControl ?? void 0 : void 0
+            liveControl: () => process.__clawrouterProxyStarted ? getSharedSpendControl() : void 0
           })
         );
         if (shouldLogRegistration) {
@@ -230089,7 +230182,7 @@ function createDoctorX402Client(opts) {
   const publicClient = createPublicClient({ chain: base, transport: http() });
   const evmSigner = toClientEvmSigner(account, publicClient);
   const x402 = new x402Client();
-  registerSpendPolicyHook(x402, opts.spendControl ?? new SpendControl());
+  registerSpendPolicyHook(x402, opts.spendControl ?? getSharedSpendControl());
   registerExactEvmScheme(x402, { signer: evmSigner });
   return x402;
 }

package/dist/index.d.ts

@@ -665,6 +665,14 @@ declare const PAYABLE_NETWORKS: readonly string[];
  * pay, which is the one direction this file must never fail in. Callers
  * classify on `instanceof`, not on the message text.
  */
+/**
+ * spending.json exists but could not be read or parsed. Distinct from "no file
+ * yet" (load() returns null) so a reload can tell a failed read from an empty
+ * store and refuse to widen what the agent may pay.
+ */
+declare class UnreadableSpendPolicyError extends Error {
+    constructor(cause: unknown);
+}
 declare class MalformedSpendPolicyError extends Error {
     constructor(key: string);
 }
@@ -816,6 +824,15 @@ declare class SpendControl {
      * reporting a change as applied.
      */
     getPolicyFileError(): string | undefined;
+    /**
+     * Re-read limits from storage, keeping this instance's history and open
+     * reservations. Used on an in-process proxy restart so a hand-edit to
+     * spending.json made while the process was running still applies, without
+     * resetting the rolling windows. Fails closed exactly like the constructor:
+     * a malformed file refuses every payment until repaired, and a repaired
+     * file clears that refusal.
+     */
+    reloadLimits(): void;
     check(estimatedCost: number, counterparty?: CounterpartyInfo): CheckResult;
     record(amount: number, metadata?: {
         model?: string;
@@ -850,6 +867,16 @@ declare class SpendControl {
     getRemaining(window: "hourly" | "daily" | "session"): number | null;
     getStatus(): SpendingStatus;
     getHistory(limit?: number): SpendRecord[];
+    /**
+     * Reset the session window. `sessionSpent`/`sessionCalls` are instance state
+     * that is never persisted, so this used to happen implicitly: every
+     * startProxy() built a fresh SpendControl. The process-wide ledger outlives
+     * an in-process proxy restart, which would silently redefine `session` as
+     * "since the gateway booted" — docs/configuration.md and the /policy help
+     * both promise "session resets on restart". The restart path in index.ts
+     * calls this to keep that promise. History and the rolling hourly/daily
+     * windows are deliberately untouched.
+     */
     resetSession(): void;
     private cleanup;
     private save;
@@ -1814,4 +1841,4 @@ declare function buildImageGenerationProvider(): ImageGenerationProviderPlugin;
 
 declare const plugin: OpenClawPluginDefinition;
 
-export { type AggregatedStats, BALANCE_THRESHOLDS, BLOCKRUN_MODELS, BLOCKRUN_PLUGIN_ID, type BalanceInfo, BalanceMonitor, CAIP2_BASE, CAIP2_SOLANA_MAINNET, type CachedLLMResponse, type CachedResponse, type CheckResult, type CounterpartyInfo, DEFAULT_RETRY_CONFIG, DEFAULT_SESSION_CONFIG, type DailyStats, type DerivedKeys, EmptyWalletError, FileSpendControlStorage, InMemorySpendControlStorage, InsufficientFundsError, type InsufficientFundsInfo, type LowBalanceInfo, MODEL_ALIASES, MalformedSpendPolicyError, OPENCLAW_MODELS, PARTNER_SERVICES, PAYABLE_NETWORKS, type PartnerServiceDefinition, type PartnerToolDefinition, type PaymentChain, type PolicyList, type ProxyHandle, type ProxyOptions, RequestDeduplicator, ResponseCache, type ResponseCacheConfig, type RetryConfig, RpcError, type SessionConfig, type SessionEntry, SessionStore, type SolanaBalanceInfo, SolanaBalanceMonitor, SpendControl, type SpendControlOptions, type SpendControlStorage, type SpendLimits, SpendPolicyError, type SpendRecord, type SpendWindow, type SpendingStatus, type SufficiencyResult, type UsageEntry, VISIBLE_OPENCLAW_MODELS, type WalletConfig, type WalletResolution, blockrunProvider, buildImageGenerationProvider, buildPartnerTools, buildProviderModels, clearStats, plugin as default, deriveAllKeys, deriveEvmKey, deriveSolanaKeyBytes, fetchWithRetry, formatDuration, formatStatsAscii, generateWalletMnemonic, getAgenticModels, getModelContextWindow, getPartnerService, getProxyPort, getSessionId, getStats, hashRequestContent, injectAuthProfile, injectModelsConfig, isAgenticModel, isBalanceError, isBlockrunWebSearchDisabled, isEmptyWalletError, isInsufficientFundsError, isRetryable, isRpcError, isValidMnemonic, loadPaymentChain, logUsage, parseCallArgs, registerSpendPolicyHook, resolveModelAlias, resolvePaymentChain, savePaymentChain, setupSolana, startProxy, syncAgentModelCache };
+export { type AggregatedStats, BALANCE_THRESHOLDS, BLOCKRUN_MODELS, BLOCKRUN_PLUGIN_ID, type BalanceInfo, BalanceMonitor, CAIP2_BASE, CAIP2_SOLANA_MAINNET, type CachedLLMResponse, type CachedResponse, type CheckResult, type CounterpartyInfo, DEFAULT_RETRY_CONFIG, DEFAULT_SESSION_CONFIG, type DailyStats, type DerivedKeys, EmptyWalletError, FileSpendControlStorage, InMemorySpendControlStorage, InsufficientFundsError, type InsufficientFundsInfo, type LowBalanceInfo, MODEL_ALIASES, MalformedSpendPolicyError, OPENCLAW_MODELS, PARTNER_SERVICES, PAYABLE_NETWORKS, type PartnerServiceDefinition, type PartnerToolDefinition, type PaymentChain, type PolicyList, type ProxyHandle, type ProxyOptions, RequestDeduplicator, ResponseCache, type ResponseCacheConfig, type RetryConfig, RpcError, type SessionConfig, type SessionEntry, SessionStore, type SolanaBalanceInfo, SolanaBalanceMonitor, SpendControl, type SpendControlOptions, type SpendControlStorage, type SpendLimits, SpendPolicyError, type SpendRecord, type SpendWindow, type SpendingStatus, type SufficiencyResult, UnreadableSpendPolicyError, type UsageEntry, VISIBLE_OPENCLAW_MODELS, type WalletConfig, type WalletResolution, blockrunProvider, buildImageGenerationProvider, buildPartnerTools, buildProviderModels, clearStats, plugin as default, deriveAllKeys, deriveEvmKey, deriveSolanaKeyBytes, fetchWithRetry, formatDuration, formatStatsAscii, generateWalletMnemonic, getAgenticModels, getModelContextWindow, getPartnerService, getProxyPort, getSessionId, getStats, hashRequestContent, injectAuthProfile, injectModelsConfig, isAgenticModel, isBalanceError, isBlockrunWebSearchDisabled, isEmptyWalletError, isInsufficientFundsError, isRetryable, isRpcError, isValidMnemonic, loadPaymentChain, logUsage, parseCallArgs, registerSpendPolicyHook, resolveModelAlias, resolvePaymentChain, savePaymentChain, setupSolana, startProxy, syncAgentModelCache };

package/dist/index.js

@@ -34446,6 +34446,11 @@ function canonicalLimits(limits) {
     Object.fromEntries(Object.entries(limits).sort(([a], [b]) => a < b ? -1 : 1))
   );
 }
+function getSharedSpendControl() {
+  const host = sharedControlHost();
+  host.__clawrouterSharedSpendControl ??= new SpendControl();
+  return host.__clawrouterSharedSpendControl;
+}
 function parseQuotedAmountUsd(selected) {
   const raw = selected.amount ?? selected.maxAmountRequired;
   if (typeof raw !== "string" || !CANONICAL_AMOUNT.test(raw)) {
@@ -34521,7 +34526,7 @@ function formatDuration(seconds) {
     return mins > 0 ? `${hours}h ${mins}m` : `${hours}h`;
   }
 }
-var WALLET_DIR, HOUR_MS, DAY_MS, CAIP2_BASE, CAIP2_SOLANA_MAINNET, PAYABLE_NETWORKS, POLICY_LISTS, ADDRESS_LISTS, EVM_ADDRESS, MalformedSpendPolicyError, SpendPolicyConflictError, FileSpendControlStorage, InMemorySpendControlStorage, RESERVATION_TTL_MS, SpendControl, SpendPolicyError, CANONICAL_AMOUNT;
+var WALLET_DIR, HOUR_MS, DAY_MS, CAIP2_BASE, CAIP2_SOLANA_MAINNET, PAYABLE_NETWORKS, POLICY_LISTS, ADDRESS_LISTS, EVM_ADDRESS, UnreadableSpendPolicyError, MalformedSpendPolicyError, SpendPolicyConflictError, FileSpendControlStorage, InMemorySpendControlStorage, RESERVATION_TTL_MS, SpendControl, sharedControlHost, SpendPolicyError, CANONICAL_AMOUNT;
 var init_spend_control = __esm({
   "src/spend-control.ts"() {
     "use strict";
@@ -34540,6 +34545,12 @@ var init_spend_control = __esm({
     ];
     ADDRESS_LISTS = ["allowedPayees", "blockedPayees", "allowedAssets"];
     EVM_ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+    UnreadableSpendPolicyError = class extends Error {
+      constructor(cause) {
+        super(`[ClawRouter] Failed to load spending data: ${cause}`);
+        this.name = "UnreadableSpendPolicyError";
+      }
+    };
     MalformedSpendPolicyError = class extends Error {
       constructor(key2) {
         super(
@@ -34600,9 +34611,7 @@ var init_spend_control = __esm({
           if (err instanceof MalformedSpendPolicyError) {
             throw err;
           }
-          console.error(
-            `[ClawRouter] Failed to load spending data, starting fresh (any configured spend policy is NOT in effect until this file is repaired): ${err}`
-          );
+          throw new UnreadableSpendPolicyError(err);
         }
         return null;
       }
@@ -34743,6 +34752,33 @@ var init_spend_control = __esm({
       getPolicyFileError() {
         return this.policyFileBroken;
       }
+      /**
+       * Re-read limits from storage, keeping this instance's history and open
+       * reservations. Used on an in-process proxy restart so a hand-edit to
+       * spending.json made while the process was running still applies, without
+       * resetting the rolling windows. Fails closed exactly like the constructor:
+       * a malformed file refuses every payment until repaired, and a repaired
+       * file clears that refusal.
+       */
+      reloadLimits() {
+        let data;
+        try {
+          data = this.storage.load();
+        } catch (err) {
+          if (err instanceof UnreadableSpendPolicyError) {
+            console.error(`${err.message} \u2014 keeping the limits already in effect`);
+            return;
+          }
+          if (!(err instanceof MalformedSpendPolicyError)) throw err;
+          this.policyFileBroken = err.message;
+          console.error(`[ClawRouter] ${err.message}`);
+          return;
+        }
+        this.policyFileBroken = void 0;
+        this.limits = data ? cloneLimits(data.limits) : {};
+        this.diskLimits = cloneLimits(this.limits);
+        this.limitsDirty = false;
+      }
       check(estimatedCost2, counterparty) {
         if (this.policyFileBroken !== void 0) {
           return {
@@ -34987,6 +35023,16 @@ var init_spend_control = __esm({
         const records = [...this.history].reverse();
         return limit ? records.slice(0, limit) : records;
       }
+      /**
+       * Reset the session window. `sessionSpent`/`sessionCalls` are instance state
+       * that is never persisted, so this used to happen implicitly: every
+       * startProxy() built a fresh SpendControl. The process-wide ledger outlives
+       * an in-process proxy restart, which would silently redefine `session` as
+       * "since the gateway booted" — docs/configuration.md and the /policy help
+       * both promise "session resets on restart". The restart path in index.ts
+       * calls this to keep that promise. History and the rolling hourly/daily
+       * windows are deliberately untouched.
+       */
       resetSession() {
         this.sessionSpent = 0;
         this.sessionCalls = 0;
@@ -35008,10 +35054,13 @@ var init_spend_control = __esm({
             this.storage.saveLimits(cloneLimits(this.limits), cloneLimits(this.diskLimits));
           } catch (err) {
             if (err instanceof SpendPolicyConflictError) {
-              const current = this.storage.load();
-              this.limits = cloneLimits(current?.limits ?? {});
-              this.diskLimits = cloneLimits(this.limits);
-              this.limitsDirty = false;
+              try {
+                const current = this.storage.load();
+                this.limits = cloneLimits(current?.limits ?? {});
+                this.diskLimits = cloneLimits(this.limits);
+                this.limitsDirty = false;
+              } catch {
+              }
             }
             throw err;
           }
@@ -35029,6 +35078,12 @@ var init_spend_control = __esm({
         try {
           data = this.storage.load();
         } catch (err) {
+          if (err instanceof UnreadableSpendPolicyError) {
+            console.error(
+              `${err.message} \u2014 starting fresh (any configured spend policy is NOT in effect until this file is repaired)`
+            );
+            return;
+          }
           if (!(err instanceof MalformedSpendPolicyError)) throw err;
           this.policyFileBroken = err.message;
           console.error(`[ClawRouter] ${err.message}`);
@@ -35045,6 +35100,7 @@ var init_spend_control = __esm({
         }
       }
     };
+    sharedControlHost = () => process;
     SpendPolicyError = class extends Error {
       blockedBy;
       blockedByPolicy;
@@ -35082,6 +35138,21 @@ function createPayFetchWithPreAuth(baseFetch, client, ttlMs = DEFAULT_TTL_MS, op
       }
     }
     const cacheKey2 = `${urlPath}:${requestModel}`;
+    const notifyAcceptedPayment = (response2, payload2) => {
+      const settled = response2.headers.has("payment-response") || response2.headers.has("x-payment-response");
+      if (!settled || !options?.onPayment) return;
+      try {
+        options.onPayment({
+          model: requestModel,
+          amount: payload2.accepted.amount,
+          network: payload2.accepted.network
+        });
+      } catch (error) {
+        console.error(
+          `[ClawRouter] onPayment callback failed: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    };
     const estimateMicros = () => {
       if (!options?.estimateAmount || !requestModel) return void 0;
       const est = options.estimateAmount(requestModel, bodyLength, maxTokens);
@@ -35102,6 +35173,7 @@ function createPayFetchWithPreAuth(baseFetch, client, ttlMs = DEFAULT_TTL_MS, op
         paymentInFlight = true;
         const response2 = await baseFetch(preAuthRequest);
         if (response2.status !== 402) {
+          notifyAcceptedPayment(response2, payload2);
           return response2;
         }
         paymentInFlight = false;
@@ -35148,7 +35220,9 @@ function createPayFetchWithPreAuth(baseFetch, client, ttlMs = DEFAULT_TTL_MS, op
     for (const [key2, value] of Object.entries(paymentHeaders)) {
       clonedRequest.headers.set(key2, value);
     }
-    return baseFetch(clonedRequest);
+    const paidResponse = await baseFetch(clonedRequest);
+    notifyAcceptedPayment(paidResponse, payload);
+    return paidResponse;
   };
 }
 var DEFAULT_TTL_MS;
@@ -91375,7 +91449,7 @@ async function startProxy(options) {
   if (x402 && account) {
     const evmPublicClient = createPublicClient({ chain: base, transport: http() });
     const evmSigner = toClientEvmSigner(account, evmPublicClient);
-    const spendControl = options.spendControl ?? new SpendControl();
+    const spendControl = options.spendControl ?? getSharedSpendControl();
     registerSpendPolicyHook(x402, spendControl);
     registerExactEvmScheme(x402, { signer: evmSigner });
   }
@@ -91407,7 +91481,11 @@ async function startProxy(options) {
     // Per-request cost estimate so pre-auth is only reused when the cached
     // payment still covers the (possibly larger) request — BlockRun prices per
     // token, so one model can cost different amounts across requests.
-    estimateAmount
+    estimateAmount,
+    // Only the wallet rail settles per call. The API-key rail is billed
+    // server-side against account credit, so there is no per-request
+    // settlement for an observer to report.
+    onPayment: options.onPayment
   });
   let balanceMonitor;
   if (options._balanceMonitorOverride) {
@@ -117475,9 +117553,7 @@ var init_client5 = __esm({
 
 // src/polymarket/spend-policy.ts
 function resolveSpendControl(deps) {
-  if (deps?.spendControl) return deps.spendControl;
-  defaultControl ??= new SpendControl();
-  return defaultControl;
+  return deps?.spendControl ?? getSharedSpendControl();
 }
 function usdToMicros(usd) {
   return String(Math.ceil(usd * 1e6));
@@ -117494,7 +117570,6 @@ async function signUnderSpendPolicy(deps, quote, action, sign4) {
     throw err;
   }
 }
-var defaultControl;
 var init_spend_policy = __esm({
   "src/polymarket/spend-policy.ts"() {
     "use strict";
@@ -226859,7 +226934,7 @@ var init_fund = __esm({
 });
 
 // src/polymarket/tool.ts
-function buildPolymarketTool() {
+function buildPolymarketTool(deps) {
   return {
     name: "blockrun_polymarket",
     description: DESCRIPTION,
@@ -226944,26 +227019,32 @@ function buildPolymarketTool() {
           result = await runSetup({ confirm });
           break;
         case "fund":
-          result = await fundVault({
-            amount_usd: params.amount_usd,
-            confirm
-          });
+          result = await fundVault(
+            {
+              amount_usd: params.amount_usd,
+              confirm
+            },
+            deps
+          );
           break;
         case "buy":
         case "sell":
-          result = await executeTrade({
-            action,
-            token_id: params.token_id,
-            condition_id: params.condition_id,
-            outcome: params.outcome,
-            price: params.price,
-            size: params.size,
-            amount_usd: params.amount_usd,
-            order_type: params.order_type,
-            expires_at: params.expires_at,
-            post_only: params.post_only,
-            confirm
-          });
+          result = await executeTrade(
+            {
+              action,
+              token_id: params.token_id,
+              condition_id: params.condition_id,
+              outcome: params.outcome,
+              price: params.price,
+              size: params.size,
+              amount_usd: params.amount_usd,
+              order_type: params.order_type,
+              expires_at: params.expires_at,
+              post_only: params.post_only,
+              confirm
+            },
+            deps
+          );
           break;
         case "orders":
           result = await listOpenOrders({
@@ -226980,17 +227061,23 @@ function buildPolymarketTool() {
           result = await listPositions();
           break;
         case "redeem":
-          result = await redeemPosition({
-            condition_id: params.condition_id,
-            confirm
-          });
+          result = await redeemPosition(
+            {
+              condition_id: params.condition_id,
+              confirm
+            },
+            deps
+          );
           break;
         case "withdraw":
-          result = await withdrawFunds({
-            amount_usd: params.amount_usd,
-            to_address: params.to_address,
-            confirm
-          });
+          result = await withdrawFunds(
+            {
+              amount_usd: params.amount_usd,
+              to_address: params.to_address,
+              confirm
+            },
+            deps
+          );
           break;
         default:
           throw new Error(`Unknown blockrun_polymarket action: ${action}`);
@@ -228110,12 +228197,18 @@ async function startProxyInBackground(api, startupGeneration) {
       `Cost cap: $${maxCostPerRunUsd.toFixed(2)} per session (mode: ${maxCostPerRunMode})`
     );
   }
+  const sharedControl = getSharedSpendControl();
+  sharedControl.reloadLimits();
+  sharedControl.resetSession();
   const proxy = await startProxy({
     ...apiKey ? { apiKey } : { wallet },
     routingConfig,
     maxCostPerRunUsd,
     maxCostPerRunMode,
-    spendControl: liveSpendControl = new SpendControl(),
+    // The process-wide ledger: the polymarket tool and the /policy command
+    // registered below use the same instance, so hourly/daily/session windows
+    // cover every surface and a /policy write reaches the live signer.
+    spendControl: sharedControl,
     onReady: (port) => {
       api.logger.info(`BlockRun ${apiKey ? "API-key" : "x402"} proxy listening on port ${port}`);
     },
@@ -228858,7 +228951,7 @@ function createWalletCommand(api) {
     }
   };
 }
-var activeProxyHandle, liveSpendControl, pendingConfiguredStartupApi, IMAGE_DIR2, AUDIO_DIR2, VIDEO_DIR2, plugin, index_default2;
+var activeProxyHandle, pendingConfiguredStartupApi, IMAGE_DIR2, AUDIO_DIR2, VIDEO_DIR2, plugin, index_default2;
 var init_index = __esm({
   "src/index.ts"() {
     init_provider();
@@ -228876,10 +228969,10 @@ var init_index = __esm({
     init_stats();
     init_partners();
     init_tool();
+    init_spend_control();
     init_stats2();
     init_exclude();
     init_policy();
-    init_spend_control();
     init_mcp_config();
     init_openclaw_plugin_config();
     init_openclaw_plugin_config();
@@ -228901,7 +228994,6 @@ var init_index = __esm({
     init_response_cache();
     init_partners();
     activeProxyHandle = null;
-    liveSpendControl = null;
     pendingConfiguredStartupApi = null;
     IMAGE_DIR2 = join17(homedir14(), ".openclaw", "blockrun", "images");
     AUDIO_DIR2 = join17(homedir14(), ".openclaw", "blockrun", "audio");
@@ -229217,7 +229309,7 @@ ${errText}`
         api.registerCommand(createExcludeCommand());
         api.registerCommand(
           createPolicyCommand({
-            liveControl: () => activeProxyHandle ? liveSpendControl ?? void 0 : void 0
+            liveControl: () => process.__clawrouterProxyStarted ? getSharedSpendControl() : void 0
           })
         );
         if (shouldLogRegistration) {
@@ -229415,6 +229507,7 @@ export {
   SolanaBalanceMonitor,
   SpendControl,
   SpendPolicyError,
+  UnreadableSpendPolicyError,
   VISIBLE_OPENCLAW_MODELS,
   blockrunProvider,
   buildImageGenerationProvider,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/clawrouter",
-  "version": "0.12.268",
+  "version": "0.12.269",
   "description": "Smart LLM router — save 84% on inference costs. 76 models (7 free). Pay by credit card (API key) or USDC (x402 wallet).",
   "type": "module",
   "main": "dist/index.js",