@elisym/mcp 0.12.1 → 0.14.0

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
 import { listAgents, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, resolveAgent, loadAgent, globalConfigPath, writeYaml, writeFileAtomic as writeFileAtomic$1 } from '@elisym/sdk/agent-store';
 import { loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
 import { getBase58Encoder, getBase58Decoder, generateKeyPairSigner, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, isAddress } from '@solana/kit';
@@ -7,7 +7,7 @@ import { Command } from 'commander';
 import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
 import { stat, readFile, writeFile, rename, unlink } from 'node:fs/promises';
 import { homedir, platform } from 'node:os';
-import { dirname, join, isAbsolute, resolve } from 'node:path';
+import { dirname, join, resolve, isAbsolute, relative } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -725,7 +725,7 @@ async function buildEffectiveLimits() {
       throw new Error(`Duplicate session_spend_limit entry in ${globalConfigPath()}: ${key}`);
     }
     seen.add(key);
-    map.set(key, parseAssetAmount(asset, entry.amount.toString()));
+    map.set(key, parseAssetAmount(asset, entry.amount));
   }
   return map;
 }
@@ -817,6 +817,14 @@ async function buildAgentInstance(name, config) {
     agentDir: resolved?.dir
   };
 }
+function scrubAgent(ctx, agent) {
+  agent.client.close();
+  if (agent.solanaKeypair) {
+    agent.solanaKeypair.secretKey.fill(0);
+  }
+  agent.identity.scrub();
+  ctx.registry.delete(agent.name);
+}
 var agentTools = [
   defineTool({
     name: "create_agent",
@@ -905,34 +913,34 @@ Solana: ${solanaSigner.address}
         }
       } catch {
       }
+      let old;
       try {
-        const old = ctx.active();
-        if (old.name !== input.name) {
-          old.client.close();
-          if (old.solanaKeypair) {
-            old.solanaKeypair.secretKey.fill(0);
-          }
-          old.identity.scrub();
-          ctx.registry.delete(old.name);
-        }
+        old = ctx.active();
       } catch {
       }
       if (ctx.registry.has(input.name)) {
+        if (old && old.name !== input.name) {
+          scrubAgent(ctx, old);
+        }
         ctx.activeAgentName = input.name;
         const agent = ctx.active();
-        const npub = agent.identity.npub;
-        return textResult(`Switched to agent "${input.name}" (${npub}).`);
+        const npub2 = agent.identity.npub;
+        return textResult(`Switched to agent "${input.name}" (${npub2}).`);
       }
+      let instance;
       try {
         const config = await loadAgentConfig(input.name);
-        const instance = await buildAgentInstance(input.name, config);
-        ctx.register(instance, true);
-        const npub = instance.identity.npub;
-        return textResult(`Loaded and switched to agent "${input.name}" (${npub}).`);
+        instance = await buildAgentInstance(input.name, config);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         return errorResult(`Failed to load agent "${input.name}": ${msg}`);
       }
+      if (old && old.name !== input.name) {
+        scrubAgent(ctx, old);
+      }
+      ctx.register(instance, true);
+      const npub = instance.identity.npub;
+      return textResult(`Loaded and switched to agent "${input.name}" (${npub}).`);
     }
   }),
   defineTool({
@@ -994,25 +1002,64 @@ Solana: ${solanaSigner.address}
       if (!agent) {
         return errorResult(`Agent "${input.name}" is not loaded.`);
       }
-      agent.client.close();
-      if (agent.solanaKeypair) {
-        agent.solanaKeypair.secretKey.fill(0);
-      }
-      agent.identity.scrub();
-      ctx.registry.delete(input.name);
+      scrubAgent(ctx, agent);
       return textResult(`Agent "${input.name}" stopped and removed.`);
     }
   })
 ];
 var execFileP = promisify(execFile);
 var MAX_INPUT_PATH_LEN = 4096;
+var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key)$/i;
+var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([".elisym", ".ssh", ".aws", ".gnupg"]);
+function isSensitiveInputPath(absPath) {
+  if (SENSITIVE_NAME_RE.test(absPath)) {
+    return true;
+  }
+  if (absPath === "/proc" || absPath.startsWith("/proc/")) {
+    return true;
+  }
+  const segments = absPath.split(/[/\\]+/);
+  return segments.some((segment) => SENSITIVE_DIR_SEGMENTS.has(segment.toLowerCase()));
+}
 var GIT_TIMEOUT_MS = 3e4;
 var GIT_MAX_BUFFER = MAX_INPUT_LEN * 2;
-async function readJobInputFile(inputPath) {
+var GIT_SAFETY_ARGS = [
+  "-c",
+  "core.fsmonitor=",
+  "-c",
+  "diff.external=",
+  "-c",
+  "core.hooksPath=/dev/null"
+];
+function isValidGitRef(ref) {
+  if (ref.length === 0 || ref.length > 256) {
+    return false;
+  }
+  if (ref.startsWith("-") || ref.includes("..")) {
+    return false;
+  }
+  return /^[A-Za-z0-9._/@~^-]+$/.test(ref);
+}
+async function readJobInputFile(inputPath, options) {
   if (inputPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`input_path too long: ${inputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
-  const absPath = isAbsolute(inputPath) ? inputPath : resolve(process.cwd(), inputPath);
+  const cwd = resolve(process.cwd());
+  const absPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
+  if (isSensitiveInputPath(absPath)) {
+    throw new Error(
+      `Refusing to read a sensitive file as job input: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const rel = relative(cwd, absPath);
+    const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `input_path "${absPath}" resolves outside the working directory (${cwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
   let stats;
   try {
     stats = await stat(absPath);
@@ -1041,11 +1088,11 @@ async function readJobInputFile(inputPath) {
 }
 async function execGit(repoPath, args) {
   try {
-    const { stdout } = await execFileP("git", args, {
+    const { stdout } = await execFileP("git", [...GIT_SAFETY_ARGS, ...args], {
       cwd: repoPath,
       timeout: GIT_TIMEOUT_MS,
       maxBuffer: GIT_MAX_BUFFER,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1" }
     });
     return stdout;
   } catch (e) {
@@ -1099,18 +1146,23 @@ async function computeGitDiff(repoPath, base) {
   let args;
   let describedRange;
   if (base) {
-    args = ["diff", `${base}...HEAD`];
+    if (!isValidGitRef(base)) {
+      throw new Error(
+        `Invalid "base": ${base}. Use a branch/tag/commit ref (letters, digits, ". _ / @ ~ ^ -", no leading "-", no "..").`
+      );
+    }
+    args = ["diff", "--no-ext-diff", "--end-of-options", `${base}...HEAD`];
     describedRange = `${base}...HEAD`;
   } else if (await isDirty(absRepo)) {
-    args = ["diff", "HEAD"];
+    args = ["diff", "--no-ext-diff", "HEAD"];
     describedRange = "HEAD (working tree, uncommitted changes)";
   } else {
     const detected = await detectDefaultBase(absRepo);
     if (detected) {
-      args = ["diff", `${detected}...HEAD`];
+      args = ["diff", "--no-ext-diff", "--end-of-options", `${detected}...HEAD`];
       describedRange = `${detected}...HEAD`;
     } else {
-      args = ["diff", "HEAD"];
+      args = ["diff", "--no-ext-diff", "HEAD"];
       describedRange = "HEAD (no main/master detected)";
     }
   }
@@ -1277,8 +1329,11 @@ var INJECTION_PATTERNS = [
 var STRICT_INJECTION_PATTERNS = INJECTION_PATTERNS.filter((p) => !p.noisy);
 function stripDangerousUnicode(text) {
   return text.replace(
+    // C0 (minus \n,\t) + C1 controls; bidi marks/overrides/isolates (061C, 200E-200F,
+    // 202A-202E, 2066-2069); zero-width + word-joiner + invisible-operator format chars
+    // (200B-200D, 2060-2064, 180E, FEFF); tag chars; replacement char.
     // eslint-disable-next-line no-control-regex
-    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\u202A-\u202E\u2066-\u2069\u200B-\u200D\uFEFF\uFFFD]|[\uDB40][\uDC01-\uDC7F]/g,
+    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\u061C\u180E\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF\uFFFD]|[\uDB40][\uDC01-\uDC7F]/g,
     ""
   );
 }
@@ -1294,9 +1349,15 @@ function detectInjections(text, includeNoisy) {
   if (normalized.length <= INJECTION_SCAN_BUDGET) {
     return patterns.some((p) => p.pattern.test(normalized));
   }
-  const head = normalized.slice(0, INJECTION_SCAN_BUDGET);
-  const tail = normalized.slice(-INJECTION_SCAN_BUDGET);
-  return patterns.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+  const OVERLAP = 256;
+  const step = INJECTION_SCAN_BUDGET - OVERLAP;
+  for (let start = 0; start < normalized.length; start += step) {
+    const window = normalized.slice(start, start + INJECTION_SCAN_BUDGET);
+    if (patterns.some((p) => p.pattern.test(window))) {
+      return true;
+    }
+  }
+  return false;
 }
 function scanForInjections(text, mode = "full") {
   return detectInjections(text, mode === "full");
@@ -1305,8 +1366,11 @@ function isLikelyBase64(s) {
   if (s.length < 64) {
     return false;
   }
-  const base64Chars = s.replace(/[A-Za-z0-9+/=\s]/g, "");
-  return base64Chars.length / s.length < 0.05;
+  if (/\s/.test(s)) {
+    return false;
+  }
+  const nonBase64Chars = s.replace(/[A-Za-z0-9+/=]/g, "");
+  return nonBase64Chars.length / s.length < 0.02;
 }
 function sanitizeUntrusted(input, kind = "text", options) {
   let text = stripDangerousUnicode(input);
@@ -1363,14 +1427,12 @@ var writeLocks = /* @__PURE__ */ new Map();
 function withLock(path, fn) {
   const previous = writeLocks.get(path) ?? Promise.resolve();
   const next = previous.then(fn, fn);
-  writeLocks.set(
-    path,
-    next.finally(() => {
-      if (writeLocks.get(path) === next) {
-        writeLocks.delete(path);
-      }
-    })
-  );
+  const wrapped = next.finally(() => {
+    if (writeLocks.get(path) === wrapped) {
+      writeLocks.delete(path);
+    }
+  });
+  writeLocks.set(path, wrapped);
   return next;
 }
 function pathFor(agentDir) {
@@ -1483,7 +1545,10 @@ var SubmitAndPayJobFromFileSchema = z.object({
   capability: z.string().min(1).max(64).default("general"),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
   timeout_secs: z.number().int().min(1).max(600).default(300),
-  max_price_lamports: z.number().int().optional()
+  max_price_lamports: z.number().int().optional(),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow reading a file outside the MCP server working directory. Off by default - the file content is forwarded to the provider before payment and is invisible in the transcript, so reads are confined to the working dir unless this is set. Sensitive files (secret keys, .env, SSH/keypair, ~/.elisym, /proc) are always refused."
+  )
 });
 var SubmitDiffReviewSchema = z.object({
   provider_npub: z.string(),
@@ -1536,9 +1601,6 @@ function buildJobCompletionTip(jobId, providerNpub) {
 
 Tip: rate this provider with submit_feedback (job_event_id="${jobId}", rating="positive"|"negative"), or save them with add_contact (npub="${providerNpub}").`;
 }
-function classifyJobFailure(message) {
-  return /timed out/i.test(message) ? "timeout" : "failed";
-}
 function pendingJobResult(jobId, paymentSig, submittedAt, warningBlock) {
   const elapsedSecs = Math.round((Date.now() - submittedAt) / 1e3);
   return textResult(
@@ -1803,6 +1865,9 @@ ${sanitized.text}`);
             onFeedback: payHandler.onFeedback,
             onError(error) {
               reject(new Error(`Job error: ${error}`));
+            },
+            onTimeout(timeoutMs) {
+              reject(new JobWaitTimeoutError(timeoutMs));
             }
           },
           timeoutMs: params.timeoutMs,
@@ -1831,8 +1896,9 @@ ${sanitized.text}`);
 ${result}${tip}`);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    const failure = classifyJobFailure(msg);
-    const pending = failure === "timeout" && paymentSig !== void 0;
+    const isTimeout = e instanceof JobWaitTimeoutError;
+    const failure = isTimeout ? "timeout" : "failed";
+    const pending = isTimeout && paymentSig !== void 0;
     await recordJobOutcome(agent, {
       jobEventId: jobId,
       capability: params.dTag,
@@ -1893,10 +1959,7 @@ function awaitJobResult(agent, options, fn, safetyTimeoutMs) {
     const resolvedOptions = fn({ resolve: safeResolve, reject: safeReject });
     closeFn = agent.client.marketplace.subscribeToJobUpdates(resolvedOptions);
     if (safetyTimeoutMs) {
-      safetyTimer = setTimeout(
-        () => safeReject(new Error("Subscription timed out (safety fallback).")),
-        safetyTimeoutMs
-      );
+      safetyTimer = setTimeout(() => safeReject(new JobWaitTimeoutError()), safetyTimeoutMs);
     }
   });
 }
@@ -1967,6 +2030,9 @@ var customerTools = [
               },
               onError(error) {
                 reject(new Error(`Job error: ${error}`));
+              },
+              onTimeout(timeoutMs) {
+                reject(new JobWaitTimeoutError(timeoutMs));
               }
             },
             timeoutMs: timeout,
@@ -1978,7 +2044,7 @@ var customerTools = [
         );
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        if (classifyJobFailure(msg) === "timeout") {
+        if (e instanceof JobWaitTimeoutError) {
           return textResult(
             `event_id="${input.job_event_id}": result not ready yet (nothing within ${timeout / 1e3}s). This is NOT an error - the provider may still be working. Retry get_job_result later (optionally widen lookback_secs); results persist on the relays.`
           );
@@ -2131,7 +2197,9 @@ ${wrapped}`);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
       let payload;
       try {
-        payload = await readJobInputFile(input.input_path);
+        payload = await readJobInputFile(input.input_path, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
@@ -2213,10 +2281,14 @@ ${diffResult.diff}`;
         card = provider.cards[0];
       }
       if (!card) {
-        const available = provider.cards.map((c) => `${c.name} (${c.capabilities?.join(", ")})`).join("; ");
-        return errorResult(
-          `No capability "${input.capability}" found for provider. Available: ${available}`
+        const available = provider.cards.map(
+          (providerCard) => `${sanitizeField(providerCard.name ?? "", 64)} (${(providerCard.capabilities ?? []).map((capability) => sanitizeField(capability, 64)).join(", ")})`
+        ).join("; ");
+        const { text } = sanitizeUntrusted(
+          `No capability "${input.capability}" found for provider. Available: ${available}`,
+          "text"
         );
+        return errorResult(text);
       }
       const price = card.payment?.job_price ?? 0;
       const cardAsset = assetFromCardPayment(card.payment);
@@ -2227,13 +2299,18 @@ ${diffResult.diff}`;
       }
       if (price > 0 && input.max_price_lamports === void 0) {
         const gasLine = await gasHintForCardAsset(agent, cardAsset);
+        const safeProviderName = sanitizeField(provider.name || input.provider_npub, 64);
+        const { text } = sanitizeUntrusted(
+          `Capability "${input.capability}" from "${safeProviderName}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
+
+To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`,
+          "text"
+        );
         return {
           content: [
             {
               type: "text",
-              text: `Capability "${input.capability}" from "${provider.name || input.provider_npub}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
-
-To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`
+              text
             }
           ]
         };
@@ -2302,6 +2379,9 @@ ${sanitized.text}`
                 onFeedback: payHandler.onFeedback,
                 onError(error) {
                   reject(new Error(`Job error: ${error}`));
+                },
+                onTimeout(timeoutMs) {
+                  reject(new JobWaitTimeoutError(timeoutMs));
                 }
               },
               timeoutMs: timeout,
@@ -2330,8 +2410,9 @@ ${sanitized.text}`
 ${result}${tip}`);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        const failure = classifyJobFailure(msg);
-        const pending = failure === "timeout" && paymentSig !== void 0;
+        const isTimeout = e instanceof JobWaitTimeoutError;
+        const failure = isTimeout ? "timeout" : "failed";
+        const pending = isTimeout && paymentSig !== void 0;
         await recordJobOutcome(agent, {
           jobEventId: jobId,
           capability: dTag,
@@ -2355,6 +2436,16 @@ ${result}${tip}`);
     }
   })
 ];
+var MAX_CAPABILITY_TAG_LEN = 64;
+function withTimeout(work, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`dashboard query timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));
+}
 var GetDashboardSchema = z.object({
   top_n: z.number().int().min(1).max(100).default(10),
   chain: z.enum(["solana"]).default("solana"),
@@ -2369,27 +2460,38 @@ var dashboardTools = [
     async handler(ctx, input) {
       const agent = ctx.active();
       const network = input.network ?? agent.network;
-      const agents = await agent.client.discovery.fetchAgents(network);
+      let agents;
+      try {
+        agents = await withTimeout(
+          agent.client.discovery.fetchAgents(network),
+          input.timeout_secs * 1e3
+        );
+      } catch (e) {
+        return textResult(e instanceof Error ? e.message : String(e));
+      }
       const filtered = agents.filter(
-        (a) => a.cards.some((c) => (c.payment?.chain ?? "solana") === input.chain)
+        (candidate) => candidate.cards.some((card) => (card.payment?.chain ?? "solana") === input.chain)
       );
-      const rows = filtered.map((a) => {
-        const mainCard = a.cards[0];
+      const rows = filtered.map((candidate) => {
+        const mainCard = candidate.cards[0];
         const mainAsset = assetFromCardPayment(mainCard?.payment);
         const mainPrice = mainCard?.payment?.job_price;
+        const capabilities = (mainCard?.capabilities ?? []).map((capability) => sanitizeField(capability, MAX_CAPABILITY_TAG_LEN)).join(", ");
         return {
-          name: sanitizeField(a.name || mainCard?.name || "unknown", 30),
-          npub: a.npub,
-          capabilities: (mainCard?.capabilities ?? []).join(", "),
+          name: sanitizeField(candidate.name || mainCard?.name || "unknown", 30),
+          npub: candidate.npub,
+          capabilities,
           price: mainPrice ? formatAssetAmount(mainAsset, BigInt(mainPrice)) : "free",
-          cards_count: a.cards.length
+          cards_count: candidate.cards.length
         };
       }).slice(0, input.top_n);
       if (rows.length === 0) {
         return textResult(`No agents found on ${network} (${input.chain}).`);
       }
       const header = `elisym Network Dashboard (${network}, ${input.chain})`;
-      const table = rows.map((r, i) => `${i + 1}. ${r.name} | ${r.capabilities} | ${r.price} | ${r.npub}`).join("\n");
+      const table = rows.map(
+        (row, index) => `${index + 1}. ${row.name} | ${row.capabilities} | ${row.price} | ${row.npub}`
+      ).join("\n");
       const { text } = sanitizeUntrusted(table, "structured");
       return textResult(`${header}
 ${"=".repeat(header.length)}
@@ -2966,7 +3068,8 @@ var feedbackContactsTools = [
         contact.name ? `  name: ${contact.name}` : null,
         contact.lastCapability ? `  last capability: ${contact.lastCapability}` : null
       ].filter((line) => line !== null);
-      return textResult(lines.join("\n"));
+      const { text } = sanitizeUntrusted(lines.join("\n"), "text");
+      return textResult(text);
     }
   }),
   defineTool({
@@ -3039,18 +3142,26 @@ var policiesTools = [
       }
       const agent = ctx.active();
       const policies = await agent.client.policies.fetchPolicies(pubkey);
-      const limited = policies.map((policy) => ({
-        type: policy.type,
-        version: policy.version,
-        title: sanitizeField(policy.title, LIMITS.MAX_POLICY_TITLE_LENGTH),
-        summary: policy.summary ? sanitizeField(policy.summary, LIMITS.MAX_POLICY_SUMMARY_LENGTH) : void 0,
-        content: sanitizeInner(policy.content),
-        naddr: policy.naddr,
-        published_at: policy.publishedAt
-      }));
+      let freetextSuspicious = false;
+      const limited = policies.map((policy) => {
+        const cleanedContent = sanitizeInner(policy.content);
+        if (scanForInjections(cleanedContent, "full") || scanForInjections(policy.title ?? "", "full") || (policy.summary ? scanForInjections(policy.summary, "full") : false)) {
+          freetextSuspicious = true;
+        }
+        return {
+          type: policy.type,
+          version: policy.version,
+          title: sanitizeField(policy.title, LIMITS.MAX_POLICY_TITLE_LENGTH),
+          summary: policy.summary ? sanitizeField(policy.summary, LIMITS.MAX_POLICY_SUMMARY_LENGTH) : void 0,
+          content: cleanedContent,
+          naddr: policy.naddr,
+          published_at: policy.publishedAt
+        };
+      });
       const { text } = sanitizeUntrusted(
         JSON.stringify({ count: limited.length, policies: limited }, null, 2),
-        "structured"
+        "structured",
+        { extraInjectionSignal: freetextSuspicious }
       );
       return textResult(text);
     }
@@ -3153,7 +3264,6 @@ var walletTools = [
       const rpc = rpcFor(agent);
       const walletAddress = address(agent.solanaKeypair.publicKey);
       const { value: balanceLamports } = await rpc.getBalance(walletAddress).send();
-      const balance = Number(balanceLamports);
       const usdcBalanceRaw = await fetchUsdcBalance(rpc, walletAddress);
       const usdcLine = `USDC balance: ${formatAssetAmount(USDC_SOLANA_DEVNET, usdcBalanceRaw)}`;
       const sessionLines = formatSessionSpendLines(ctx);
@@ -3162,7 +3272,7 @@ ${sessionLines.join("\n")}` : "";
       return textResult(
         `Address: ${agent.solanaKeypair.publicKey}
 Network: ${agent.network}
-Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
+Balance: ${formatSol(balanceLamports)} (${balanceLamports.toString()} lamports)
 ` + usdcLine + sessionBlock
       );
     }
@@ -3261,7 +3371,17 @@ Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
         releaseSpend(ctx, sendAsset, sendAmount);
         throw e;
       }
-      const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
+      let remainingBalanceLine = "";
+      try {
+        const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
+        remainingBalanceLine = `  Remaining SOL balance: ${formatSol(balanceLamports)}
+`;
+      } catch (e) {
+        logger.warn(
+          { event: "post_payment_balance_fetch_failed", agent: agent.name },
+          `Payment succeeded but the post-confirmation balance fetch failed: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
       const warnings = takeSpendWarnings(ctx, sendAsset);
       for (const line of warnings) {
         logger.warn({ event: "session_spend_threshold", agent: agent.name }, line);
@@ -3274,8 +3394,7 @@ Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
   Signature: ${signature}
   Amount: ${formatAssetAmount(paidAsset, BigInt(requestData.amount))}
   Recipient: ${requestData.recipient}
-  Remaining SOL balance: ${formatSol(balanceLamports)}
-  Explorer: ${explorerUrl(agent, signature)}`
+` + remainingBalanceLine + `  Explorer: ${explorerUrl(agent, signature)}`
       );
     }
   }),
@@ -3581,6 +3700,9 @@ if (toolMap.size !== allTools.length) {
     `Tool registry invariant violated: ${allTools.length} tools registered, ${toolMap.size} unique names`
   );
 }
+function redactSecrets(text) {
+  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]");
+}
 function safeError(context, e) {
   const message = e instanceof Error ? e.message : String(e);
   const stack = e instanceof Error ? e.stack : void 0;
@@ -3598,7 +3720,10 @@ function safeError(context, e) {
     msg = String(e).slice(0, 300);
   }
   return {
-    content: [{ type: "text", text: msg }],
+    // pino redact does not cover error-message string contents, so scrub key/secret
+    // shapes from the LLM-facing message itself (e.g. a JSON parse error that echoes
+    // a secrets file, or an RPC error embedding a key).
+    content: [{ type: "text", text: redactSecrets(msg) }],
     isError: true
   };
 }
@@ -3692,7 +3817,6 @@ async function startServer(ctx) {
       }
       const rpc = createSolanaRpc(rpcUrlFor(agent.network));
       const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
-      const balance = Number(balanceLamports);
       return {
         contents: [
           {
@@ -3702,8 +3826,8 @@ async function startServer(ctx) {
               {
                 address: agent.solanaKeypair.publicKey,
                 network: agent.network,
-                balance_lamports: balance,
-                balance_sol: formatSolNumeric(BigInt(balance)),
+                balance_lamports: balanceLamports.toString(),
+                balance_sol: formatSolNumeric(balanceLamports),
                 chain: "solana"
               },
               null,
@@ -3980,11 +4104,8 @@ function resolveAssetOrThrow(chain, token, mint) {
 }
 async function setSessionLimit(amount, chain, token, mint) {
   const asset = resolveAssetOrThrow(chain, token, mint);
-  parseAssetAmount(asset, amount);
-  const parsedAmount = Number(amount);
-  if (!Number.isFinite(parsedAmount) || parsedAmount <= 0) {
-    throw new Error(`amount "${amount}" must be a positive decimal`);
-  }
+  const trimmedAmount = amount.trim();
+  parseAssetAmount(asset, trimmedAmount);
   const path = globalConfigPath();
   const cfg = await loadGlobalConfig(path);
   const entries = cfg.session_spend_limits ? [...cfg.session_spend_limits] : [];
@@ -3996,7 +4117,7 @@ async function setSessionLimit(amount, chain, token, mint) {
     chain: asset.chain,
     token: asset.token,
     mint: asset.mint,
-    amount: parsedAmount
+    amount: trimmedAmount
   };
   if (idx >= 0) {
     entries[idx] = newEntry;
@@ -4005,7 +4126,7 @@ async function setSessionLimit(amount, chain, token, mint) {
   }
   await writeGlobalConfig(path, { session_spend_limits: entries });
   console.log(
-    `Session spend limit set to ${amount} ${asset.symbol} (process-wide). Restart the MCP server to apply.`
+    `Session spend limit set to ${trimmedAmount} ${asset.symbol} (process-wide). Restart the MCP server to apply.`
   );
 }
 async function clearSessionLimit(chain, token, mint, all) {