@elisym/mcp 0.13.0 → 0.14.0

package/dist/index.js

@@ -7,7 +7,7 @@ import { Command } from 'commander';
 import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
 import { stat, readFile, writeFile, rename, unlink } from 'node:fs/promises';
 import { homedir, platform } from 'node:os';
-import { dirname, join, isAbsolute, resolve } from 'node:path';
+import { dirname, join, resolve, isAbsolute, relative } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -725,7 +725,7 @@ async function buildEffectiveLimits() {
       throw new Error(`Duplicate session_spend_limit entry in ${globalConfigPath()}: ${key}`);
     }
     seen.add(key);
-    map.set(key, parseAssetAmount(asset, entry.amount.toString()));
+    map.set(key, parseAssetAmount(asset, entry.amount));
   }
   return map;
 }
@@ -817,6 +817,14 @@ async function buildAgentInstance(name, config) {
     agentDir: resolved?.dir
   };
 }
+function scrubAgent(ctx, agent) {
+  agent.client.close();
+  if (agent.solanaKeypair) {
+    agent.solanaKeypair.secretKey.fill(0);
+  }
+  agent.identity.scrub();
+  ctx.registry.delete(agent.name);
+}
 var agentTools = [
   defineTool({
     name: "create_agent",
@@ -905,34 +913,34 @@ Solana: ${solanaSigner.address}
         }
       } catch {
       }
+      let old;
       try {
-        const old = ctx.active();
-        if (old.name !== input.name) {
-          old.client.close();
-          if (old.solanaKeypair) {
-            old.solanaKeypair.secretKey.fill(0);
-          }
-          old.identity.scrub();
-          ctx.registry.delete(old.name);
-        }
+        old = ctx.active();
       } catch {
       }
       if (ctx.registry.has(input.name)) {
+        if (old && old.name !== input.name) {
+          scrubAgent(ctx, old);
+        }
         ctx.activeAgentName = input.name;
         const agent = ctx.active();
-        const npub = agent.identity.npub;
-        return textResult(`Switched to agent "${input.name}" (${npub}).`);
+        const npub2 = agent.identity.npub;
+        return textResult(`Switched to agent "${input.name}" (${npub2}).`);
       }
+      let instance;
       try {
         const config = await loadAgentConfig(input.name);
-        const instance = await buildAgentInstance(input.name, config);
-        ctx.register(instance, true);
-        const npub = instance.identity.npub;
-        return textResult(`Loaded and switched to agent "${input.name}" (${npub}).`);
+        instance = await buildAgentInstance(input.name, config);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         return errorResult(`Failed to load agent "${input.name}": ${msg}`);
       }
+      if (old && old.name !== input.name) {
+        scrubAgent(ctx, old);
+      }
+      ctx.register(instance, true);
+      const npub = instance.identity.npub;
+      return textResult(`Loaded and switched to agent "${input.name}" (${npub}).`);
     }
   }),
   defineTool({
@@ -994,25 +1002,64 @@ Solana: ${solanaSigner.address}
       if (!agent) {
         return errorResult(`Agent "${input.name}" is not loaded.`);
       }
-      agent.client.close();
-      if (agent.solanaKeypair) {
-        agent.solanaKeypair.secretKey.fill(0);
-      }
-      agent.identity.scrub();
-      ctx.registry.delete(input.name);
+      scrubAgent(ctx, agent);
       return textResult(`Agent "${input.name}" stopped and removed.`);
     }
   })
 ];
 var execFileP = promisify(execFile);
 var MAX_INPUT_PATH_LEN = 4096;
+var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key)$/i;
+var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([".elisym", ".ssh", ".aws", ".gnupg"]);
+function isSensitiveInputPath(absPath) {
+  if (SENSITIVE_NAME_RE.test(absPath)) {
+    return true;
+  }
+  if (absPath === "/proc" || absPath.startsWith("/proc/")) {
+    return true;
+  }
+  const segments = absPath.split(/[/\\]+/);
+  return segments.some((segment) => SENSITIVE_DIR_SEGMENTS.has(segment.toLowerCase()));
+}
 var GIT_TIMEOUT_MS = 3e4;
 var GIT_MAX_BUFFER = MAX_INPUT_LEN * 2;
-async function readJobInputFile(inputPath) {
+var GIT_SAFETY_ARGS = [
+  "-c",
+  "core.fsmonitor=",
+  "-c",
+  "diff.external=",
+  "-c",
+  "core.hooksPath=/dev/null"
+];
+function isValidGitRef(ref) {
+  if (ref.length === 0 || ref.length > 256) {
+    return false;
+  }
+  if (ref.startsWith("-") || ref.includes("..")) {
+    return false;
+  }
+  return /^[A-Za-z0-9._/@~^-]+$/.test(ref);
+}
+async function readJobInputFile(inputPath, options) {
   if (inputPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`input_path too long: ${inputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
-  const absPath = isAbsolute(inputPath) ? inputPath : resolve(process.cwd(), inputPath);
+  const cwd = resolve(process.cwd());
+  const absPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
+  if (isSensitiveInputPath(absPath)) {
+    throw new Error(
+      `Refusing to read a sensitive file as job input: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const rel = relative(cwd, absPath);
+    const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `input_path "${absPath}" resolves outside the working directory (${cwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
   let stats;
   try {
     stats = await stat(absPath);
@@ -1041,11 +1088,11 @@ async function readJobInputFile(inputPath) {
 }
 async function execGit(repoPath, args) {
   try {
-    const { stdout } = await execFileP("git", args, {
+    const { stdout } = await execFileP("git", [...GIT_SAFETY_ARGS, ...args], {
       cwd: repoPath,
       timeout: GIT_TIMEOUT_MS,
       maxBuffer: GIT_MAX_BUFFER,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1" }
     });
     return stdout;
   } catch (e) {
@@ -1099,18 +1146,23 @@ async function computeGitDiff(repoPath, base) {
   let args;
   let describedRange;
   if (base) {
-    args = ["diff", `${base}...HEAD`];
+    if (!isValidGitRef(base)) {
+      throw new Error(
+        `Invalid "base": ${base}. Use a branch/tag/commit ref (letters, digits, ". _ / @ ~ ^ -", no leading "-", no "..").`
+      );
+    }
+    args = ["diff", "--no-ext-diff", "--end-of-options", `${base}...HEAD`];
     describedRange = `${base}...HEAD`;
   } else if (await isDirty(absRepo)) {
-    args = ["diff", "HEAD"];
+    args = ["diff", "--no-ext-diff", "HEAD"];
     describedRange = "HEAD (working tree, uncommitted changes)";
   } else {
     const detected = await detectDefaultBase(absRepo);
     if (detected) {
-      args = ["diff", `${detected}...HEAD`];
+      args = ["diff", "--no-ext-diff", "--end-of-options", `${detected}...HEAD`];
       describedRange = `${detected}...HEAD`;
     } else {
-      args = ["diff", "HEAD"];
+      args = ["diff", "--no-ext-diff", "HEAD"];
       describedRange = "HEAD (no main/master detected)";
     }
   }
@@ -1277,8 +1329,11 @@ var INJECTION_PATTERNS = [
 var STRICT_INJECTION_PATTERNS = INJECTION_PATTERNS.filter((p) => !p.noisy);
 function stripDangerousUnicode(text) {
   return text.replace(
+    // C0 (minus \n,\t) + C1 controls; bidi marks/overrides/isolates (061C, 200E-200F,
+    // 202A-202E, 2066-2069); zero-width + word-joiner + invisible-operator format chars
+    // (200B-200D, 2060-2064, 180E, FEFF); tag chars; replacement char.
     // eslint-disable-next-line no-control-regex
-    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\u202A-\u202E\u2066-\u2069\u200B-\u200D\uFEFF\uFFFD]|[\uDB40][\uDC01-\uDC7F]/g,
+    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\u061C\u180E\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF\uFFFD]|[\uDB40][\uDC01-\uDC7F]/g,
     ""
   );
 }
@@ -1294,9 +1349,15 @@ function detectInjections(text, includeNoisy) {
   if (normalized.length <= INJECTION_SCAN_BUDGET) {
     return patterns.some((p) => p.pattern.test(normalized));
   }
-  const head = normalized.slice(0, INJECTION_SCAN_BUDGET);
-  const tail = normalized.slice(-INJECTION_SCAN_BUDGET);
-  return patterns.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+  const OVERLAP = 256;
+  const step = INJECTION_SCAN_BUDGET - OVERLAP;
+  for (let start = 0; start < normalized.length; start += step) {
+    const window = normalized.slice(start, start + INJECTION_SCAN_BUDGET);
+    if (patterns.some((p) => p.pattern.test(window))) {
+      return true;
+    }
+  }
+  return false;
 }
 function scanForInjections(text, mode = "full") {
   return detectInjections(text, mode === "full");
@@ -1305,8 +1366,11 @@ function isLikelyBase64(s) {
   if (s.length < 64) {
     return false;
   }
-  const base64Chars = s.replace(/[A-Za-z0-9+/=\s]/g, "");
-  return base64Chars.length / s.length < 0.05;
+  if (/\s/.test(s)) {
+    return false;
+  }
+  const nonBase64Chars = s.replace(/[A-Za-z0-9+/=]/g, "");
+  return nonBase64Chars.length / s.length < 0.02;
 }
 function sanitizeUntrusted(input, kind = "text", options) {
   let text = stripDangerousUnicode(input);
@@ -1363,14 +1427,12 @@ var writeLocks = /* @__PURE__ */ new Map();
 function withLock(path, fn) {
   const previous = writeLocks.get(path) ?? Promise.resolve();
   const next = previous.then(fn, fn);
-  writeLocks.set(
-    path,
-    next.finally(() => {
-      if (writeLocks.get(path) === next) {
-        writeLocks.delete(path);
-      }
-    })
-  );
+  const wrapped = next.finally(() => {
+    if (writeLocks.get(path) === wrapped) {
+      writeLocks.delete(path);
+    }
+  });
+  writeLocks.set(path, wrapped);
   return next;
 }
 function pathFor(agentDir) {
@@ -1483,7 +1545,10 @@ var SubmitAndPayJobFromFileSchema = z.object({
   capability: z.string().min(1).max(64).default("general"),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
   timeout_secs: z.number().int().min(1).max(600).default(300),
-  max_price_lamports: z.number().int().optional()
+  max_price_lamports: z.number().int().optional(),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow reading a file outside the MCP server working directory. Off by default - the file content is forwarded to the provider before payment and is invisible in the transcript, so reads are confined to the working dir unless this is set. Sensitive files (secret keys, .env, SSH/keypair, ~/.elisym, /proc) are always refused."
+  )
 });
 var SubmitDiffReviewSchema = z.object({
   provider_npub: z.string(),
@@ -2132,7 +2197,9 @@ ${wrapped}`);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
       let payload;
       try {
-        payload = await readJobInputFile(input.input_path);
+        payload = await readJobInputFile(input.input_path, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
@@ -2214,10 +2281,14 @@ ${diffResult.diff}`;
         card = provider.cards[0];
       }
       if (!card) {
-        const available = provider.cards.map((c) => `${c.name} (${c.capabilities?.join(", ")})`).join("; ");
-        return errorResult(
-          `No capability "${input.capability}" found for provider. Available: ${available}`
+        const available = provider.cards.map(
+          (providerCard) => `${sanitizeField(providerCard.name ?? "", 64)} (${(providerCard.capabilities ?? []).map((capability) => sanitizeField(capability, 64)).join(", ")})`
+        ).join("; ");
+        const { text } = sanitizeUntrusted(
+          `No capability "${input.capability}" found for provider. Available: ${available}`,
+          "text"
         );
+        return errorResult(text);
       }
       const price = card.payment?.job_price ?? 0;
       const cardAsset = assetFromCardPayment(card.payment);
@@ -2228,13 +2299,18 @@ ${diffResult.diff}`;
       }
       if (price > 0 && input.max_price_lamports === void 0) {
         const gasLine = await gasHintForCardAsset(agent, cardAsset);
+        const safeProviderName = sanitizeField(provider.name || input.provider_npub, 64);
+        const { text } = sanitizeUntrusted(
+          `Capability "${input.capability}" from "${safeProviderName}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
+
+To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`,
+          "text"
+        );
         return {
           content: [
             {
               type: "text",
-              text: `Capability "${input.capability}" from "${provider.name || input.provider_npub}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
-
-To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`
+              text
             }
           ]
         };
@@ -2360,6 +2436,16 @@ ${result}${tip}`);
     }
   })
 ];
+var MAX_CAPABILITY_TAG_LEN = 64;
+function withTimeout(work, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`dashboard query timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));
+}
 var GetDashboardSchema = z.object({
   top_n: z.number().int().min(1).max(100).default(10),
   chain: z.enum(["solana"]).default("solana"),
@@ -2374,27 +2460,38 @@ var dashboardTools = [
     async handler(ctx, input) {
       const agent = ctx.active();
       const network = input.network ?? agent.network;
-      const agents = await agent.client.discovery.fetchAgents(network);
+      let agents;
+      try {
+        agents = await withTimeout(
+          agent.client.discovery.fetchAgents(network),
+          input.timeout_secs * 1e3
+        );
+      } catch (e) {
+        return textResult(e instanceof Error ? e.message : String(e));
+      }
       const filtered = agents.filter(
-        (a) => a.cards.some((c) => (c.payment?.chain ?? "solana") === input.chain)
+        (candidate) => candidate.cards.some((card) => (card.payment?.chain ?? "solana") === input.chain)
       );
-      const rows = filtered.map((a) => {
-        const mainCard = a.cards[0];
+      const rows = filtered.map((candidate) => {
+        const mainCard = candidate.cards[0];
         const mainAsset = assetFromCardPayment(mainCard?.payment);
         const mainPrice = mainCard?.payment?.job_price;
+        const capabilities = (mainCard?.capabilities ?? []).map((capability) => sanitizeField(capability, MAX_CAPABILITY_TAG_LEN)).join(", ");
         return {
-          name: sanitizeField(a.name || mainCard?.name || "unknown", 30),
-          npub: a.npub,
-          capabilities: (mainCard?.capabilities ?? []).join(", "),
+          name: sanitizeField(candidate.name || mainCard?.name || "unknown", 30),
+          npub: candidate.npub,
+          capabilities,
           price: mainPrice ? formatAssetAmount(mainAsset, BigInt(mainPrice)) : "free",
-          cards_count: a.cards.length
+          cards_count: candidate.cards.length
         };
       }).slice(0, input.top_n);
       if (rows.length === 0) {
         return textResult(`No agents found on ${network} (${input.chain}).`);
       }
       const header = `elisym Network Dashboard (${network}, ${input.chain})`;
-      const table = rows.map((r, i) => `${i + 1}. ${r.name} | ${r.capabilities} | ${r.price} | ${r.npub}`).join("\n");
+      const table = rows.map(
+        (row, index) => `${index + 1}. ${row.name} | ${row.capabilities} | ${row.price} | ${row.npub}`
+      ).join("\n");
       const { text } = sanitizeUntrusted(table, "structured");
       return textResult(`${header}
 ${"=".repeat(header.length)}
@@ -2971,7 +3068,8 @@ var feedbackContactsTools = [
         contact.name ? `  name: ${contact.name}` : null,
         contact.lastCapability ? `  last capability: ${contact.lastCapability}` : null
       ].filter((line) => line !== null);
-      return textResult(lines.join("\n"));
+      const { text } = sanitizeUntrusted(lines.join("\n"), "text");
+      return textResult(text);
     }
   }),
   defineTool({
@@ -3044,18 +3142,26 @@ var policiesTools = [
       }
       const agent = ctx.active();
       const policies = await agent.client.policies.fetchPolicies(pubkey);
-      const limited = policies.map((policy) => ({
-        type: policy.type,
-        version: policy.version,
-        title: sanitizeField(policy.title, LIMITS.MAX_POLICY_TITLE_LENGTH),
-        summary: policy.summary ? sanitizeField(policy.summary, LIMITS.MAX_POLICY_SUMMARY_LENGTH) : void 0,
-        content: sanitizeInner(policy.content),
-        naddr: policy.naddr,
-        published_at: policy.publishedAt
-      }));
+      let freetextSuspicious = false;
+      const limited = policies.map((policy) => {
+        const cleanedContent = sanitizeInner(policy.content);
+        if (scanForInjections(cleanedContent, "full") || scanForInjections(policy.title ?? "", "full") || (policy.summary ? scanForInjections(policy.summary, "full") : false)) {
+          freetextSuspicious = true;
+        }
+        return {
+          type: policy.type,
+          version: policy.version,
+          title: sanitizeField(policy.title, LIMITS.MAX_POLICY_TITLE_LENGTH),
+          summary: policy.summary ? sanitizeField(policy.summary, LIMITS.MAX_POLICY_SUMMARY_LENGTH) : void 0,
+          content: cleanedContent,
+          naddr: policy.naddr,
+          published_at: policy.publishedAt
+        };
+      });
       const { text } = sanitizeUntrusted(
         JSON.stringify({ count: limited.length, policies: limited }, null, 2),
-        "structured"
+        "structured",
+        { extraInjectionSignal: freetextSuspicious }
       );
       return textResult(text);
     }
@@ -3158,7 +3264,6 @@ var walletTools = [
       const rpc = rpcFor(agent);
       const walletAddress = address(agent.solanaKeypair.publicKey);
       const { value: balanceLamports } = await rpc.getBalance(walletAddress).send();
-      const balance = Number(balanceLamports);
       const usdcBalanceRaw = await fetchUsdcBalance(rpc, walletAddress);
       const usdcLine = `USDC balance: ${formatAssetAmount(USDC_SOLANA_DEVNET, usdcBalanceRaw)}`;
       const sessionLines = formatSessionSpendLines(ctx);
@@ -3167,7 +3272,7 @@ ${sessionLines.join("\n")}` : "";
       return textResult(
         `Address: ${agent.solanaKeypair.publicKey}
 Network: ${agent.network}
-Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
+Balance: ${formatSol(balanceLamports)} (${balanceLamports.toString()} lamports)
 ` + usdcLine + sessionBlock
       );
     }
@@ -3266,7 +3371,17 @@ Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
         releaseSpend(ctx, sendAsset, sendAmount);
         throw e;
       }
-      const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
+      let remainingBalanceLine = "";
+      try {
+        const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
+        remainingBalanceLine = `  Remaining SOL balance: ${formatSol(balanceLamports)}
+`;
+      } catch (e) {
+        logger.warn(
+          { event: "post_payment_balance_fetch_failed", agent: agent.name },
+          `Payment succeeded but the post-confirmation balance fetch failed: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
       const warnings = takeSpendWarnings(ctx, sendAsset);
       for (const line of warnings) {
         logger.warn({ event: "session_spend_threshold", agent: agent.name }, line);
@@ -3279,8 +3394,7 @@ Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
   Signature: ${signature}
   Amount: ${formatAssetAmount(paidAsset, BigInt(requestData.amount))}
   Recipient: ${requestData.recipient}
-  Remaining SOL balance: ${formatSol(balanceLamports)}
-  Explorer: ${explorerUrl(agent, signature)}`
+` + remainingBalanceLine + `  Explorer: ${explorerUrl(agent, signature)}`
       );
     }
   }),
@@ -3586,6 +3700,9 @@ if (toolMap.size !== allTools.length) {
     `Tool registry invariant violated: ${allTools.length} tools registered, ${toolMap.size} unique names`
   );
 }
+function redactSecrets(text) {
+  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]");
+}
 function safeError(context, e) {
   const message = e instanceof Error ? e.message : String(e);
   const stack = e instanceof Error ? e.stack : void 0;
@@ -3603,7 +3720,10 @@ function safeError(context, e) {
     msg = String(e).slice(0, 300);
   }
   return {
-    content: [{ type: "text", text: msg }],
+    // pino redact does not cover error-message string contents, so scrub key/secret
+    // shapes from the LLM-facing message itself (e.g. a JSON parse error that echoes
+    // a secrets file, or an RPC error embedding a key).
+    content: [{ type: "text", text: redactSecrets(msg) }],
     isError: true
   };
 }
@@ -3697,7 +3817,6 @@ async function startServer(ctx) {
       }
       const rpc = createSolanaRpc(rpcUrlFor(agent.network));
       const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
-      const balance = Number(balanceLamports);
       return {
         contents: [
           {
@@ -3707,8 +3826,8 @@ async function startServer(ctx) {
               {
                 address: agent.solanaKeypair.publicKey,
                 network: agent.network,
-                balance_lamports: balance,
-                balance_sol: formatSolNumeric(BigInt(balance)),
+                balance_lamports: balanceLamports.toString(),
+                balance_sol: formatSolNumeric(balanceLamports),
                 chain: "solana"
               },
               null,
@@ -3985,11 +4104,8 @@ function resolveAssetOrThrow(chain, token, mint) {
 }
 async function setSessionLimit(amount, chain, token, mint) {
   const asset = resolveAssetOrThrow(chain, token, mint);
-  parseAssetAmount(asset, amount);
-  const parsedAmount = Number(amount);
-  if (!Number.isFinite(parsedAmount) || parsedAmount <= 0) {
-    throw new Error(`amount "${amount}" must be a positive decimal`);
-  }
+  const trimmedAmount = amount.trim();
+  parseAssetAmount(asset, trimmedAmount);
   const path = globalConfigPath();
   const cfg = await loadGlobalConfig(path);
   const entries = cfg.session_spend_limits ? [...cfg.session_spend_limits] : [];
@@ -4001,7 +4117,7 @@ async function setSessionLimit(amount, chain, token, mint) {
     chain: asset.chain,
     token: asset.token,
     mint: asset.mint,
-    amount: parsedAmount
+    amount: trimmedAmount
   };
   if (idx >= 0) {
     entries[idx] = newEntry;
@@ -4010,7 +4126,7 @@ async function setSessionLimit(amount, chain, token, mint) {
   }
   await writeGlobalConfig(path, { session_spend_limits: entries });
   console.log(
-    `Session spend limit set to ${amount} ${asset.symbol} (process-wide). Restart the MCP server to apply.`
+    `Session spend limit set to ${trimmedAmount} ${asset.symbol} (process-wide). Restart the MCP server to apply.`
   );
 }
 async function clearSessionLimit(chain, token, mint, all) {