@blockrun/franklin 3.15.100 → 3.15.102

package/dist/agent/permissions.d.ts

@@ -30,6 +30,21 @@ export declare class PermissionManager {
      * Returns true if allowed, false if denied.
      */
     promptUser(toolName: string, input: Record<string, unknown>, pendingCount?: number): Promise<boolean>;
+    /**
+     * Persist a tool name to the user's allow rules so future sessions
+     * skip the prompt. Idempotent: appends to the existing
+     * `allow: []` array only if not already present.
+     *
+     * Why this exists: pre-2026-05-12, "always" in the UI prompt was a
+     * misnomer — it only added the tool to the in-memory `sessionAllowed`
+     * Set, which evaporated on every `franklin start`. Users reported
+     * being prompted repeatedly across sessions despite hitting [a] each
+     * time. Persistence here makes "always" actually mean always.
+     *
+     * Best-effort writes (try/catch around fs) — a logging failure should
+     * never block the paid call that just got approved.
+     */
+    private persistAllowRule;
     private loadRules;
     private matchesRule;
     private getPrimaryInputValue;

package/dist/agent/permissions.js

@@ -122,7 +122,15 @@ export class PermissionManager {
         if (this.promptFn) {
             const result = await this.promptFn(toolName, hint);
             if (result === 'always') {
+                // "Always" must mean ALWAYS — including after the user restarts
+                // franklin. Pre-fix it was only in-memory: every `franklin start`
+                // re-asked the same prompts even after the user had pressed [a]
+                // explicitly. Verified 2026-05-12: ~/.blockrun/franklin-permissions.json
+                // was non-existent despite the user reporting repeated prompts.
+                // Persist to disk and update in-memory rules so subsequent
+                // checks short-circuit at the allow-rule stage (line 124).
                 this.sessionAllowed.add(toolName);
+                this.persistAllowRule(toolName);
                 return true;
             }
             return result === 'yes';
@@ -140,7 +148,8 @@ export class PermissionManager {
         const normalized = answer.trim().toLowerCase();
         if (normalized === 'a' || normalized === 'always') {
             this.sessionAllowed.add(toolName);
-            console.error(chalk.green(`  ✓ ${toolName} allowed for this session`));
+            this.persistAllowRule(toolName);
+            console.error(chalk.green(`  ✓ ${toolName} allowed (saved to ~/.blockrun/franklin-permissions.json)`));
             return true;
         }
         if (normalized === 'y' || normalized === 'yes' || normalized === '') {
@@ -150,6 +159,50 @@ export class PermissionManager {
         return false;
     }
     // ─── Internal ──────────────────────────────────────────────────────────
+    /**
+     * Persist a tool name to the user's allow rules so future sessions
+     * skip the prompt. Idempotent: appends to the existing
+     * `allow: []` array only if not already present.
+     *
+     * Why this exists: pre-2026-05-12, "always" in the UI prompt was a
+     * misnomer — it only added the tool to the in-memory `sessionAllowed`
+     * Set, which evaporated on every `franklin start`. Users reported
+     * being prompted repeatedly across sessions despite hitting [a] each
+     * time. Persistence here makes "always" actually mean always.
+     *
+     * Best-effort writes (try/catch around fs) — a logging failure should
+     * never block the paid call that just got approved.
+     */
+    persistAllowRule(toolName) {
+        const configPath = path.join(BLOCKRUN_DIR, 'franklin-permissions.json');
+        try {
+            // Read current state (may not exist). Treat missing/malformed as
+            // empty rules — never throw on the user's tool execution path.
+            let current = { allow: [], deny: [], ask: [] };
+            if (fs.existsSync(configPath)) {
+                try {
+                    const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+                    current = {
+                        allow: Array.isArray(raw.allow) ? raw.allow : [],
+                        deny: Array.isArray(raw.deny) ? raw.deny : [],
+                        ask: Array.isArray(raw.ask) ? raw.ask : [],
+                    };
+                }
+                catch { /* malformed — reset */ }
+            }
+            if (current.allow.includes(toolName))
+                return; // already saved
+            current.allow.push(toolName);
+            // Update in-memory rules too so subsequent checks short-circuit
+            // at line 124 (matchesRule against allow) without re-prompting.
+            if (!this.rules.allow.includes(toolName)) {
+                this.rules.allow.push(toolName);
+            }
+            fs.mkdirSync(path.dirname(configPath), { recursive: true });
+            fs.writeFileSync(configPath, JSON.stringify(current, null, 2));
+        }
+        catch { /* best-effort */ }
+    }
     loadRules() {
         const configPath = path.join(BLOCKRUN_DIR, 'franklin-permissions.json');
         const legacyPath = path.join(BLOCKRUN_DIR, 'runcode-permissions.json');

package/dist/stats/cost-log.d.ts

@@ -29,6 +29,12 @@ export interface SettlementRow {
     costUsd: number;
     /** Unix milliseconds (normalized — SDK writes seconds). */
     ts: number;
+    /** Wallet that signed (lowercased). Used for test-wallet filtering. */
+    wallet?: string;
+    /** Model that was charged (e.g. `openai/gpt-5.5`). */
+    model?: string;
+    /** Which client wrote the row (LLMClient / AgentClient / ProxyClient / AsyncLLMClient). */
+    clientKind?: string;
 }
 export interface SettlementSummary {
     /** Path to cost_log.jsonl (or the fallback location). */

package/dist/stats/cost-log.js

@@ -25,6 +25,27 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { BLOCKRUN_DIR } from '../config.js';
+/**
+ * Anvil/Hardhat deterministic test accounts. The first one
+ * (0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266) leaked into a real
+ * cost_log on 2026-05-13 — some SDK path signed with a hardcoded test
+ * key in production. These addresses are public knowledge (the private
+ * keys are in the Anvil source), so a settlement signed by them is
+ * definitionally not a real user spend. Filter them out at read time
+ * so dashboards / stats don't surface phantom rows.
+ */
+const KNOWN_TEST_WALLETS = new Set([
+    '0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266', // Anvil #0
+    '0x70997970c51812dc3a010c7d01b50e0d17dc79c8', // Anvil #1
+    '0x3c44cdddb6a900fa2b585dd299e03d12fa4293bc', // Anvil #2
+    '0x90f79bf6eb2c4f870365e785982e1f101e93b906', // Anvil #3
+    '0x15d34aaf54267db7d7c367839aaf71a00a2c6a65', // Anvil #4
+    '0x9965507d1a55bcc2695c58ba16fb37d819b0a4dc', // Anvil #5
+    '0x976ea74026e726554db657fa54763abd0c3a0aa9', // Anvil #6
+    '0x14dc79964da2c08b23698b3d3cc7ca32193d9955', // Anvil #7
+    '0x23618e81e3f5cdf7f54c3d65f7fbc0abf5b21e8f', // Anvil #8
+    '0xa0ee7a142d267c1f36714e4a8f75612f20a79720', // Anvil #9
+]);
 function getCostLogPath() {
     return path.join(BLOCKRUN_DIR, 'cost_log.jsonl');
 }
@@ -77,9 +98,49 @@ export function loadSdkSettlements(opts) {
         const ts = tsRaw < 1e12 ? Math.round(tsRaw * 1000) : Math.round(tsRaw);
         if (ts < sinceMs || ts > untilMs)
             continue;
-        rows.push({ endpoint, costUsd, ts });
+        // Filter out known test-wallet leaks. Verified 2026-05-13: a real
+        // cost_log had a $1 entry written under Anvil account #0
+        // (0xf39Fd6...) — public test key. Any settlement under those
+        // addresses is by definition not real user spend; drop.
+        const walletRaw = typeof obj.wallet === 'string' ? obj.wallet : undefined;
+        const wallet = walletRaw?.toLowerCase();
+        if (wallet && KNOWN_TEST_WALLETS.has(wallet))
+            continue;
+        const model = typeof obj.model === 'string' ? obj.model : undefined;
+        const clientKindRaw = obj.client_kind ?? obj.clientKind;
+        const clientKind = typeof clientKindRaw === 'string' ? clientKindRaw : undefined;
+        rows.push({ endpoint, costUsd, ts, wallet, model, clientKind });
+    }
+    return dedupeRows(rows);
+}
+/**
+ * Collapse SDK double-writes. Verified 2026-05-13: a single
+ * `gpt-5.5 / /v1/chat/completions / $1.00` call generated THREE
+ * cost_log rows in the same physical second (two `LLMClient`, one
+ * `AsyncLLMClient`) because the SDK wraps the same fetch through two
+ * client classes, both of which call `appendCostLog`. Bucket by
+ * `(second, endpoint, model, cost-in-micro-USDC)` and keep the first;
+ * the others were always duplicates.
+ *
+ * Edge case: two legitimate same-second / same-model / same-price
+ * calls would also dedupe to one. Accepting that trade-off — the SDK
+ * bug currently inflates by 200-300%; a worst-case 1-row undercount
+ * on rapid-fire identical calls is a much smaller error and the user's
+ * dashboards round to cents anyway.
+ */
+function dedupeRows(rows) {
+    const seen = new Map();
+    for (const r of rows) {
+        const bucket = Math.round(r.ts / 1000);
+        const microUsd = Math.round(r.costUsd * 1e6);
+        const key = `${bucket}|${r.endpoint}|${r.model ?? ''}|${microUsd}`;
+        // Keep the FIRST row in each bucket (chronologically earliest by ts).
+        // If the existing row in the map already has earlier ts, leave it.
+        const existing = seen.get(key);
+        if (!existing || r.ts < existing.ts)
+            seen.set(key, r);
     }
-    return rows;
+    return [...seen.values()].sort((a, b) => a.ts - b.ts);
 }
 /**
  * Append one settlement row to ~/.blockrun/cost_log.jsonl in the same

package/dist/ui/app.js

@@ -1060,7 +1060,7 @@ function RunCodeApp({ initialModel, workDir, walletAddress, walletBalance, chain
                                             : `${formatTokens(r.tokens.input)} in / ${formatTokens(r.tokens.output)} out`, r.cost > 0 ? `  ·  $${r.cost.toFixed(4)}` : '', r.savings !== undefined && r.savings > 0 ? _jsxs(Text, { color: "green", children: ["  saved ", Math.round(r.savings * 100), "%"] }) : '', r.ctxPct !== undefined && r.ctxPct >= 5
                                             ? _jsxs(Text, { color: r.ctxPct >= 80 ? 'red' : r.ctxPct >= 50 ? 'yellow' : undefined, dimColor: r.ctxPct < 50, children: ["  \u00B7  ctx ", r.ctxPct, "%"] })
                                             : ''] }) }))] }, r.key));
-                } }), permissionRequest && (_jsxs(Box, { flexDirection: "column", marginTop: 1, marginLeft: 2, children: [_jsx(Text, { color: "red", bold: true, children: "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 \u26A0  ACTION REQUIRED  \u26A0 \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501" }), _jsx(Text, { color: "yellow", children: "\u256D\u2500 Permission required \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Text, { color: "yellow", children: ["\u2502 ", _jsx(Text, { bold: true, children: permissionRequest.toolName })] }), permissionRequest.description.split('\n').map((line, i) => (_jsxs(Text, { dimColor: true, children: ["\u2502 ", line] }, i))), _jsx(Text, { color: "yellow", children: "\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsx(Box, { marginLeft: 2, children: _jsxs(Text, { children: [_jsx(Text, { bold: true, color: "green", children: "[y]" }), _jsx(Text, { dimColor: true, children: " yes  " }), _jsx(Text, { bold: true, color: "cyan", children: "[a]" }), _jsx(Text, { dimColor: true, children: " always  " }), _jsx(Text, { bold: true, color: "red", children: "[n]" }), _jsx(Text, { dimColor: true, children: " no" })] }) })] })), askUserRequest && (_jsxs(Box, { flexDirection: "column", marginTop: 1, marginLeft: 2, children: [_jsx(Text, { color: "magenta", bold: true, children: "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 \u26A0  ANSWER REQUIRED  \u26A0 \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501" }), _jsx(Text, { color: "cyan", children: "\u256D\u2500 Question \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Text, { color: "cyan", children: ["\u2502 ", _jsx(Text, { bold: true, children: askUserRequest.question })] }), askUserRequest.options && askUserRequest.options.length > 0 && (askUserRequest.options.map((opt, i) => (_jsxs(Text, { dimColor: true, children: ["\u2502 ", i + 1, ". ", opt] }, i)))), _jsx(Text, { color: "cyan", children: "\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginLeft: 2, children: [_jsx(Text, { bold: true, children: "answer> " }), _jsx(TextInput, { value: askUserInput, onChange: setAskUserInput, onSubmit: (val) => {
+                } }), permissionRequest && (_jsxs(Box, { flexDirection: "column", marginTop: 1, marginLeft: 2, children: [_jsx(Text, { color: "red", bold: true, children: "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 \u26A0  ACTION REQUIRED  \u26A0 \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501" }), _jsx(Text, { color: "yellow", children: "\u256D\u2500 Permission required \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Text, { color: "yellow", children: ["\u2502 ", _jsx(Text, { bold: true, children: permissionRequest.toolName })] }), permissionRequest.description.split('\n').map((line, i) => (_jsxs(Text, { dimColor: true, children: ["\u2502 ", line] }, i))), _jsx(Text, { color: "yellow", children: "\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsx(Box, { marginLeft: 2, children: _jsxs(Text, { children: [_jsx(Text, { bold: true, color: "green", children: "[y]" }), _jsx(Text, { dimColor: true, children: " yes  " }), _jsx(Text, { bold: true, color: "cyan", children: "[a]" }), _jsx(Text, { dimColor: true, children: " always " }), _jsx(Text, { dimColor: true, italic: true, children: "(saved across sessions)" }), _jsx(Text, { dimColor: true, children: "  " }), _jsx(Text, { bold: true, color: "red", children: "[n]" }), _jsx(Text, { dimColor: true, children: " no" })] }) })] })), askUserRequest && (_jsxs(Box, { flexDirection: "column", marginTop: 1, marginLeft: 2, children: [_jsx(Text, { color: "magenta", bold: true, children: "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 \u26A0  ANSWER REQUIRED  \u26A0 \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501" }), _jsx(Text, { color: "cyan", children: "\u256D\u2500 Question \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Text, { color: "cyan", children: ["\u2502 ", _jsx(Text, { bold: true, children: askUserRequest.question })] }), askUserRequest.options && askUserRequest.options.length > 0 && (askUserRequest.options.map((opt, i) => (_jsxs(Text, { dimColor: true, children: ["\u2502 ", i + 1, ". ", opt] }, i)))), _jsx(Text, { color: "cyan", children: "\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginLeft: 2, children: [_jsx(Text, { bold: true, children: "answer> " }), _jsx(TextInput, { value: askUserInput, onChange: setAskUserInput, onSubmit: (val) => {
                                     // resolveAskUserAnswer translates "1" / "2" / ... into the
                                     // matching label string when the dialog showed a numbered
                                     // option list. Without it, every onAskUser caller's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/franklin",
-  "version": "3.15.100",
+  "version": "3.15.102",
   "description": "Franklin Agent — The AI agent with a wallet. Spends USDC autonomously to get real work done. Pay per action, no subscriptions.",
   "type": "module",
   "exports": {