@elisym/mcp 0.13.0 → 0.15.0

package/dist/index.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
+import { LIMITS, DEFAULT_KIND_OFFSET, SolanaPaymentStrategy, makeCensor, DEFAULT_REDACT_PATHS, validateAgentName, RELAYS, toDTag, JobWaitTimeoutError, decodeJobPayload, utf8ByteLength, formatAssetAmount, estimateNetworkBaseline, formatSol as formatSol$1, USDC_SOLANA_DEVNET, estimateSolFeeLamports, formatFeeBreakdown, resolveAssetFromPaymentRequest as resolveAssetFromPaymentRequest$1, parseAssetAmount, ElisymIdentity, ElisymClient, NATIVE_SOL, resolveKnownAsset, formatNetworkBaseline, getProtocolProgramId, getProtocolConfig, assetKey, assetByKey, KNOWN_ASSETS } from '@elisym/sdk';
 import { listAgents, createAgentDir, writeYamlInitial, writeExampleSkillTemplate, writeSecrets, resolveAgent, loadAgent, globalConfigPath, writeYaml, writeFileAtomic as writeFileAtomic$1 } from '@elisym/sdk/agent-store';
-import { loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
+import { createIrohTransport, loadGlobalConfig, writeGlobalConfig } from '@elisym/sdk/node';
 import { getBase58Encoder, getBase58Decoder, generateKeyPairSigner, createSolanaRpc, address, createSolanaRpcSubscriptions, sendAndConfirmTransactionFactory, getSignatureFromTransaction, pipe, createTransactionMessage, setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash, appendTransactionMessageInstructions, signTransactionMessageWithSigners, createKeyPairSignerFromBytes, isAddress } from '@solana/kit';
 import { Command } from 'commander';
 import { generateSecretKey, nip19, getPublicKey } from 'nostr-tools';
-import { stat, readFile, writeFile, rename, unlink } from 'node:fs/promises';
-import { homedir, platform } from 'node:os';
-import { dirname, join, isAbsolute, resolve } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { realpath, readFile, stat, rm, writeFile, rename, unlink } from 'node:fs/promises';
+import { tmpdir, homedir, platform } from 'node:os';
+import { dirname, join, resolve, isAbsolute, basename, relative } from 'node:path';
+import { readFileSync, mkdtempSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
@@ -346,6 +346,9 @@ function checkLen(field, value, max) {
 var MAX_INPUT_LEN = LIMITS.MAX_INPUT_LENGTH;
 var MAX_CAPABILITIES = LIMITS.MAX_CAPABILITIES;
 var MAX_TIMEOUT_SECS = LIMITS.MAX_TIMEOUT_SECS;
+LIMITS.NIP44_MAX_PLAINTEXT_BYTES;
+LIMITS.MAX_ENCRYPTED_INLINE_BYTES;
+LIMITS.MAX_REINLINE_TEXT_BYTES;
 var MAX_NPUB_LEN = 128;
 var MAX_EVENT_ID_LEN = 128;
 var MAX_PAYMENT_REQ_LEN = 1e4;
@@ -684,6 +687,32 @@ async function installToConfig(path, entry, agentRebind) {
   await safeRewriteJson(path, raw, config);
   return "installed";
 }
+function ensureIrohTransport(agent) {
+  if (agent.irohTransport) {
+    return agent.irohTransport;
+  }
+  let storePath;
+  if (agent.agentDir !== void 0) {
+    storePath = join(agent.agentDir, ".iroh");
+  } else {
+    storePath = mkdtempSync(join(tmpdir(), "elisym-iroh-"));
+    agent.irohStoreDir = storePath;
+  }
+  agent.irohTransport = createIrohTransport({ storePath });
+  return agent.irohTransport;
+}
+async function shutdownIrohTransport(agent) {
+  if (agent.irohTransport) {
+    await agent.irohTransport.shutdown().catch(() => {
+    });
+    agent.irohTransport = void 0;
+  }
+  if (agent.irohStoreDir !== void 0) {
+    await rm(agent.irohStoreDir, { recursive: true, force: true }).catch(() => {
+    });
+    agent.irohStoreDir = void 0;
+  }
+}
 function createLogger(destination) {
   const opts = {
     name: "elisym-mcp",
@@ -725,7 +754,7 @@ async function buildEffectiveLimits() {
       throw new Error(`Duplicate session_spend_limit entry in ${globalConfigPath()}: ${key}`);
     }
     seen.add(key);
-    map.set(key, parseAssetAmount(asset, entry.amount.toString()));
+    map.set(key, parseAssetAmount(asset, entry.amount));
   }
   return map;
 }
@@ -817,6 +846,14 @@ async function buildAgentInstance(name, config) {
     agentDir: resolved?.dir
   };
 }
+function scrubAgent(ctx, agent) {
+  agent.client.close();
+  if (agent.solanaKeypair) {
+    agent.solanaKeypair.secretKey.fill(0);
+  }
+  agent.identity.scrub();
+  ctx.registry.delete(agent.name);
+}
 var agentTools = [
   defineTool({
     name: "create_agent",
@@ -905,34 +942,34 @@ Solana: ${solanaSigner.address}
         }
       } catch {
       }
+      let old;
       try {
-        const old = ctx.active();
-        if (old.name !== input.name) {
-          old.client.close();
-          if (old.solanaKeypair) {
-            old.solanaKeypair.secretKey.fill(0);
-          }
-          old.identity.scrub();
-          ctx.registry.delete(old.name);
-        }
+        old = ctx.active();
       } catch {
       }
       if (ctx.registry.has(input.name)) {
+        if (old && old.name !== input.name) {
+          scrubAgent(ctx, old);
+        }
         ctx.activeAgentName = input.name;
         const agent = ctx.active();
-        const npub = agent.identity.npub;
-        return textResult(`Switched to agent "${input.name}" (${npub}).`);
+        const npub2 = agent.identity.npub;
+        return textResult(`Switched to agent "${input.name}" (${npub2}).`);
       }
+      let instance;
       try {
         const config = await loadAgentConfig(input.name);
-        const instance = await buildAgentInstance(input.name, config);
-        ctx.register(instance, true);
-        const npub = instance.identity.npub;
-        return textResult(`Loaded and switched to agent "${input.name}" (${npub}).`);
+        instance = await buildAgentInstance(input.name, config);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         return errorResult(`Failed to load agent "${input.name}": ${msg}`);
       }
+      if (old && old.name !== input.name) {
+        scrubAgent(ctx, old);
+      }
+      ctx.register(instance, true);
+      const npub = instance.identity.npub;
+      return textResult(`Loaded and switched to agent "${input.name}" (${npub}).`);
     }
   }),
   defineTool({
@@ -994,25 +1031,124 @@ Solana: ${solanaSigner.address}
       if (!agent) {
         return errorResult(`Agent "${input.name}" is not loaded.`);
       }
-      agent.client.close();
-      if (agent.solanaKeypair) {
-        agent.solanaKeypair.secretKey.fill(0);
-      }
-      agent.identity.scrub();
-      ctx.registry.delete(input.name);
+      scrubAgent(ctx, agent);
       return textResult(`Agent "${input.name}" stopped and removed.`);
     }
   })
 ];
 var execFileP = promisify(execFile);
 var MAX_INPUT_PATH_LEN = 4096;
+var SENSITIVE_NAME_RE = /(^|[/\\])(\.secrets\.json|\.env(\..+)?|id_rsa|id_dsa|id_ecdsa|id_ed25519|.*-keypair\.json|.*\.pem|.*\.key|\.bashrc|\.bash_profile|\.bash_login|\.bash_logout|\.bash_aliases|\.profile|\.zshrc|\.zprofile|\.zshenv|\.zlogin|\.zlogout|config\.fish|\.gitconfig|\.npmrc|\.netrc|crontab|sudoers|bash\.bashrc|.*\.service|.*\.desktop)$/i;
+var SENSITIVE_DIR_SEGMENTS = /* @__PURE__ */ new Set([
+  ".elisym",
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".git",
+  "launchagents",
+  "launchdaemons",
+  "autostart",
+  "systemd",
+  "sudoers.d",
+  "cron.d",
+  "cron.daily",
+  "cron.hourly",
+  "cron.weekly",
+  "cron.monthly",
+  "crontabs",
+  "profile.d",
+  "init.d"
+]);
+function isSensitiveInputPath(absPath) {
+  if (SENSITIVE_NAME_RE.test(absPath)) {
+    return true;
+  }
+  if (absPath === "/proc" || absPath.startsWith("/proc/")) {
+    return true;
+  }
+  const segments = absPath.split(/[/\\]+/);
+  return segments.some((segment) => SENSITIVE_DIR_SEGMENTS.has(segment.toLowerCase()));
+}
+async function resolveOutputPath(outputPath, options) {
+  if (outputPath.length > MAX_INPUT_PATH_LEN) {
+    throw new Error(
+      `output_path too long: ${outputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`
+    );
+  }
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(outputPath) ? resolve(outputPath) : resolve(cwd, outputPath);
+  const realParent = await realpath(dirname(logicalPath)).catch(() => dirname(logicalPath));
+  const absPath = resolve(realParent, basename(logicalPath));
+  const realDest = await realpath(logicalPath).catch(() => void 0);
+  const writeTarget = realDest ?? absPath;
+  const sensitiveCandidates = realDest !== void 0 ? [absPath, logicalPath, realDest] : [absPath, logicalPath];
+  if (sensitiveCandidates.some((candidate) => isSensitiveInputPath(candidate))) {
+    throw new Error(
+      `Refusing to write a job result to a sensitive path: ${writeTarget}. Choose a destination outside secret/config/auto-run locations.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, writeTarget);
+    const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `output_path "${writeTarget}" resolves outside the working directory (${realCwd}). Choose a destination under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
+  return writeTarget;
+}
 var GIT_TIMEOUT_MS = 3e4;
-var GIT_MAX_BUFFER = MAX_INPUT_LEN * 2;
-async function readJobInputFile(inputPath) {
+var GIT_MAX_BUFFER = LIMITS.MAX_REINLINE_TEXT_BYTES + MAX_INPUT_LEN;
+var GIT_SAFETY_ARGS = [
+  "-c",
+  "core.fsmonitor=",
+  "-c",
+  "diff.external=",
+  "-c",
+  "core.hooksPath=/dev/null"
+];
+function isValidGitRef(ref) {
+  if (ref.length === 0 || ref.length > 256) {
+    return false;
+  }
+  if (ref.startsWith("-") || ref.includes("..")) {
+    return false;
+  }
+  return /^[A-Za-z0-9._/@~^-]+$/.test(ref);
+}
+async function validateInputPath(inputPath, options) {
   if (inputPath.length > MAX_INPUT_PATH_LEN) {
     throw new Error(`input_path too long: ${inputPath.length} chars (max ${MAX_INPUT_PATH_LEN}).`);
   }
-  const absPath = isAbsolute(inputPath) ? inputPath : resolve(process.cwd(), inputPath);
+  const cwd = resolve(process.cwd());
+  const logicalPath = isAbsolute(inputPath) ? resolve(inputPath) : resolve(cwd, inputPath);
+  let absPath;
+  try {
+    absPath = await realpath(logicalPath);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ENOENT") {
+      throw new Error(`input_path does not exist: ${logicalPath}`);
+    }
+    throw new Error(`Cannot resolve input_path "${logicalPath}": ${e.message}`);
+  }
+  if (isSensitiveInputPath(absPath) || isSensitiveInputPath(logicalPath)) {
+    throw new Error(
+      `Refusing to read a sensitive file as job input: ${absPath}. Secret keys, .env, SSH/keypair files, ~/.elisym and /proc are blocked.`
+    );
+  }
+  if (!options?.allowOutsideCwd) {
+    const realCwd = await realpath(cwd).catch(() => cwd);
+    const rel = relative(realCwd, absPath);
+    const insideCwd = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    if (!insideCwd) {
+      throw new Error(
+        `input_path "${absPath}" resolves outside the working directory (${realCwd}). Move the file under the working directory or pass allow_outside_cwd: true.`
+      );
+    }
+  }
   let stats;
   try {
     stats = await stat(absPath);
@@ -1026,26 +1162,44 @@ async function readJobInputFile(inputPath) {
   if (!stats.isFile()) {
     throw new Error(`input_path is not a regular file: ${absPath}`);
   }
-  if (stats.size > MAX_INPUT_LEN) {
-    throw new Error(
-      `input_path too large: ${stats.size} bytes (max ${MAX_INPUT_LEN}). Trim the file or split the job.`
-    );
+  return { absPath, size: stats.size };
+}
+async function isProbablyText(absPath, size) {
+  if (size > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+    return false;
+  }
+  const bytes = await readFile(absPath);
+  if (bytes.includes(0)) {
+    return false;
   }
-  const content = await readFile(absPath, "utf-8");
-  if (content.length > MAX_INPUT_LEN) {
+  try {
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    decoder.decode(bytes);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function prepareFileInput(inputPath, options) {
+  const { absPath, size } = await validateInputPath(inputPath, options);
+  if (size === 0) {
+    throw new Error("input_path is an empty file - nothing to send.");
+  }
+  if (size > LIMITS.MAX_FILE_SIZE) {
     throw new Error(
-      `input_path content too long after decoding: ${content.length} chars (max ${MAX_INPUT_LEN}).`
+      `input_path too large: ${size} bytes (max ${LIMITS.MAX_FILE_SIZE} for a file transfer).`
     );
   }
-  return content;
+  const mime = await isProbablyText(absPath, size) ? "text/plain" : "application/octet-stream";
+  return { absPath, size, name: basename(absPath), mime };
 }
 async function execGit(repoPath, args) {
   try {
-    const { stdout } = await execFileP("git", args, {
+    const { stdout } = await execFileP("git", [...GIT_SAFETY_ARGS, ...args], {
       cwd: repoPath,
       timeout: GIT_TIMEOUT_MS,
       maxBuffer: GIT_MAX_BUFFER,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1" }
     });
     return stdout;
   } catch (e) {
@@ -1099,18 +1253,23 @@ async function computeGitDiff(repoPath, base) {
   let args;
   let describedRange;
   if (base) {
-    args = ["diff", `${base}...HEAD`];
+    if (!isValidGitRef(base)) {
+      throw new Error(
+        `Invalid "base": ${base}. Use a branch/tag/commit ref (letters, digits, ". _ / @ ~ ^ -", no leading "-", no "..").`
+      );
+    }
+    args = ["diff", "--no-ext-diff", "--no-textconv", "--end-of-options", `${base}...HEAD`];
     describedRange = `${base}...HEAD`;
   } else if (await isDirty(absRepo)) {
-    args = ["diff", "HEAD"];
+    args = ["diff", "--no-ext-diff", "--no-textconv", "HEAD"];
     describedRange = "HEAD (working tree, uncommitted changes)";
   } else {
     const detected = await detectDefaultBase(absRepo);
     if (detected) {
-      args = ["diff", `${detected}...HEAD`];
+      args = ["diff", "--no-ext-diff", "--no-textconv", "--end-of-options", `${detected}...HEAD`];
       describedRange = `${detected}...HEAD`;
     } else {
-      args = ["diff", "HEAD"];
+      args = ["diff", "--no-ext-diff", "--no-textconv", "HEAD"];
       describedRange = "HEAD (no main/master detected)";
     }
   }
@@ -1120,9 +1279,10 @@ async function computeGitDiff(repoPath, base) {
       `No changes in range ${describedRange}. Nothing to review - commit work, pass an explicit "base", or check the repo path.`
     );
   }
-  if (diff.length > MAX_INPUT_LEN) {
+  const diffBytes = utf8ByteLength(diff);
+  if (diffBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
     throw new Error(
-      `Diff for range ${describedRange} is ${diff.length} chars (max ${MAX_INPUT_LEN}). Pass a narrower "base" or split the review.`
+      `Diff for range ${describedRange} is ${diffBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES}). Pass a narrower "base" or split the review.`
     );
   }
   return { diff, describedRange };
@@ -1277,8 +1437,11 @@ var INJECTION_PATTERNS = [
 var STRICT_INJECTION_PATTERNS = INJECTION_PATTERNS.filter((p) => !p.noisy);
 function stripDangerousUnicode(text) {
   return text.replace(
+    // C0 (minus \n,\t) + C1 controls; bidi marks/overrides/isolates (061C, 200E-200F,
+    // 202A-202E, 2066-2069); zero-width + word-joiner + invisible-operator format chars
+    // (200B-200D, 2060-2064, 180E, FEFF); tag chars; replacement char.
     // eslint-disable-next-line no-control-regex
-    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\u202A-\u202E\u2066-\u2069\u200B-\u200D\uFEFF\uFFFD]|[\uDB40][\uDC01-\uDC7F]/g,
+    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\u061C\u180E\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF\uFFFD]|[\uDB40][\uDC01-\uDC7F]/g,
     ""
   );
 }
@@ -1294,9 +1457,15 @@ function detectInjections(text, includeNoisy) {
   if (normalized.length <= INJECTION_SCAN_BUDGET) {
     return patterns.some((p) => p.pattern.test(normalized));
   }
-  const head = normalized.slice(0, INJECTION_SCAN_BUDGET);
-  const tail = normalized.slice(-INJECTION_SCAN_BUDGET);
-  return patterns.some((p) => p.pattern.test(head) || p.pattern.test(tail));
+  const OVERLAP = 256;
+  const step = INJECTION_SCAN_BUDGET - OVERLAP;
+  for (let start = 0; start < normalized.length; start += step) {
+    const window = normalized.slice(start, start + INJECTION_SCAN_BUDGET);
+    if (patterns.some((p) => p.pattern.test(window))) {
+      return true;
+    }
+  }
+  return false;
 }
 function scanForInjections(text, mode = "full") {
   return detectInjections(text, mode === "full");
@@ -1305,8 +1474,11 @@ function isLikelyBase64(s) {
   if (s.length < 64) {
     return false;
   }
-  const base64Chars = s.replace(/[A-Za-z0-9+/=\s]/g, "");
-  return base64Chars.length / s.length < 0.05;
+  if (/\s/.test(s)) {
+    return false;
+  }
+  const nonBase64Chars = s.replace(/[A-Za-z0-9+/=]/g, "");
+  return nonBase64Chars.length / s.length < 0.02;
 }
 function sanitizeUntrusted(input, kind = "text", options) {
   let text = stripDangerousUnicode(input);
@@ -1352,7 +1524,13 @@ var CustomerJobEntrySchema = z.object({
   completedAt: z.number().int().nonnegative(),
   resultPreview: z.string().max(RESULT_PREVIEW_MAX_LEN).optional(),
   paymentSig: z.string().max(128).optional(),
-  customerFeedback: FeedbackSchema.optional()
+  customerFeedback: FeedbackSchema.optional(),
+  /** JSON-serialized FileAttachment when the result is a file (fetched via fetch_job_file). */
+  attachmentJson: z.string().max(8192).optional(),
+  /** Local path the result file was downloaded to (set by fetch_job_file). */
+  resultFilePath: z.string().max(4096).optional(),
+  /** Unix ms when the result file was downloaded. */
+  fetchedAt: z.number().int().nonnegative().optional()
 }).strict();
 var CustomerHistorySchema = z.object({
   version: z.literal(1),
@@ -1363,14 +1541,12 @@ var writeLocks = /* @__PURE__ */ new Map();
 function withLock(path, fn) {
   const previous = writeLocks.get(path) ?? Promise.resolve();
   const next = previous.then(fn, fn);
-  writeLocks.set(
-    path,
-    next.finally(() => {
-      if (writeLocks.get(path) === next) {
-        writeLocks.delete(path);
-      }
-    })
-  );
+  const wrapped = next.finally(() => {
+    if (writeLocks.get(path) === wrapped) {
+      writeLocks.delete(path);
+    }
+  });
+  writeLocks.set(path, wrapped);
   return next;
 }
 function pathFor(agentDir) {
@@ -1453,6 +1629,16 @@ var GetJobResultSchema = z.object({
   timeout_secs: z.number().int().min(1).max(600).default(60),
   lookback_secs: z.number().int().min(60).max(7 * 24 * 3600).default(24 * 3600).describe("How far back to search for the result. Defaults to 24h.")
 });
+var FetchJobFileSchema = z.object({
+  job_event_id: z.string(),
+  output_path: z.string().min(1).max(4096).describe("Local path to write the downloaded result file to."),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow writing outside the MCP server working directory. Off by default: the bytes come from an untrusted provider, so writes are confined to the working directory subtree (and never to a secret/auto-run path) unless this is set."
+  ),
+  provider_npub: z.string().optional(),
+  kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
+  timeout_secs: z.number().int().min(1).max(600).default(300)
+});
 var ListMyJobsSchema = z.object({
   limit: z.number().int().min(1).max(50).default(20),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
@@ -1483,7 +1669,10 @@ var SubmitAndPayJobFromFileSchema = z.object({
   capability: z.string().min(1).max(64).default("general"),
   kind_offset: z.number().int().min(0).max(999).default(DEFAULT_KIND_OFFSET),
   timeout_secs: z.number().int().min(1).max(600).default(300),
-  max_price_lamports: z.number().int().optional()
+  max_price_lamports: z.number().int().optional(),
+  allow_outside_cwd: z.boolean().default(false).describe(
+    "Allow reading a file outside the MCP server working directory. Off by default - the file content is forwarded to the provider before payment and is invisible in the transcript, so reads are confined to the working dir unless this is set. Sensitive files (secret keys, .env, SSH/keypair, ~/.elisym, /proc) are always refused."
+  )
 });
 var SubmitDiffReviewSchema = z.object({
   provider_npub: z.string(),
@@ -1684,7 +1873,7 @@ function makePaymentFeedbackHandler(opts) {
       opts.resolveNoWallet(
         `Payment required but no Solana wallet configured.
 Amount: ${signedAmount !== void 0 ? formatAssetAmount(asset, BigInt(signedAmount)) : "unknown"}
-Payment request: ${paymentRequest}`
+Payment request: ${sanitizeUntrusted(paymentRequest, "structured").text}`
       );
       return;
     }
@@ -1723,6 +1912,57 @@ Payment request: ${paymentRequest}`
   };
   return { onFeedback, onResultReceived };
 }
+function formatFileResultMetadata(jobId, attachment) {
+  const name = sanitizeField(attachment.name, 200);
+  const mime = sanitizeField(attachment.mime, 100);
+  const details = sanitizeUntrusted(
+    `name: ${name}
+size: ${attachment.size} bytes
+type: ${mime}`,
+    "text"
+  ).text;
+  return `Job completed. The result is a FILE (not inlined here):
+${details}
+Download it with fetch_job_file(job_event_id="${jobId}", output_path="<local path>").`;
+}
+function decodeResultPreview(rawContent) {
+  try {
+    const decoded = decodeJobPayload(rawContent);
+    if (decoded.attachment) {
+      return `[file result: ${decoded.attachment.name} (${decoded.attachment.size} bytes). Download with fetch_job_file.]`;
+    }
+    return decoded.text ?? rawContent;
+  } catch {
+    return rawContent;
+  }
+}
+async function prepareTextInput(agent, text) {
+  if (utf8ByteLength(text) <= LIMITS.MAX_ENCRYPTED_INLINE_BYTES) {
+    return { input: text };
+  }
+  const byteLength = utf8ByteLength(text);
+  if (agent.agentDir === void 0) {
+    return {
+      error: `Input is ${byteLength} bytes, over the ${LIMITS.MAX_ENCRYPTED_INLINE_BYTES}-byte inline limit, so it must be sent via P2P transfer - which requires a persistent agent (this is an ephemeral session).`
+    };
+  }
+  try {
+    const seeded = await ensureIrohTransport(agent).seedBytes(Buffer.from(text, "utf8"));
+    return {
+      input: "",
+      attachment: {
+        name: "input.txt",
+        size: seeded.size,
+        mime: "text/plain",
+        transports: [{ kind: "iroh", ticket: seeded.ticket }]
+      }
+    };
+  } catch (e) {
+    return {
+      error: `Failed to seed input for transfer: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
 async function executeSubmitAndPay(ctx, agent, params) {
   const ping = await agent.client.ping.pingAgent(params.providerPubkey, PRE_PING_TIMEOUT_MS);
   if (!ping.online) {
@@ -1754,12 +1994,14 @@ async function executeSubmitAndPay(ctx, agent, params) {
     input: params.input,
     capability: params.dTag,
     providerPubkey: params.providerPubkey,
-    kindOffset: params.kindOffset
+    kindOffset: params.kindOffset,
+    attachment: params.attachment
   });
   let paymentSig;
   let paidAmountSubunits;
   let paidAssetKey;
   let paymentWarnings = [];
+  let resultAttachment;
   try {
     const result = await awaitJobResult(
       agent,
@@ -1790,7 +2032,12 @@ async function executeSubmitAndPay(ctx, agent, params) {
           providerPubkey: params.providerPubkey,
           customerPublicKey: agent.identity.publicKey,
           callbacks: {
-            onResult(content) {
+            onResult(content, _eventId, attachment) {
+              if (attachment) {
+                resultAttachment = attachment;
+                payHandler.onResultReceived(formatFileResultMetadata(jobId, attachment));
+                return;
+              }
               const kind = isLikelyBase64(content) ? "binary" : "text";
               const sanitized = sanitizeUntrusted(content, kind);
               payHandler.onResultReceived(`Job completed.
@@ -1799,7 +2046,7 @@ ${sanitized.text}`);
             },
             onFeedback: payHandler.onFeedback,
             onError(error) {
-              reject(new Error(`Job error: ${error}`));
+              reject(new Error(`Job error: ${sanitizeUntrusted(error, "text").text}`));
             },
             onTimeout(timeoutMs) {
               reject(new JobWaitTimeoutError(timeoutMs));
@@ -1822,7 +2069,8 @@ ${sanitized.text}`);
       submittedAt,
       completedAt: Date.now(),
       resultPreview: result.slice(0, RESULT_PREVIEW_MAX_LEN),
-      paymentSig
+      paymentSig,
+      attachmentJson: resultAttachment ? JSON.stringify(resultAttachment) : void 0
     });
     const warningBlock = paymentWarnings.length > 0 ? `${paymentWarnings.join("\n")}
 ` : "";
@@ -1953,7 +2201,11 @@ var customerTools = [
             providerPubkey,
             customerPublicKey: agent.identity.publicKey,
             callbacks: {
-              onResult(content, _eventId) {
+              onResult(content, _eventId, attachment) {
+                if (attachment) {
+                  resolve(formatFileResultMetadata(input.job_event_id, attachment));
+                  return;
+                }
                 const kind = isLikelyBase64(content) ? "binary" : "text";
                 const sanitized = sanitizeUntrusted(content, kind);
                 resolve(sanitized.text);
@@ -1989,6 +2241,79 @@ var customerTools = [
       return textResult(result);
     }
   }),
+  defineTool({
+    name: "fetch_job_file",
+    description: "Download a job result that was delivered as a FILE (transferred P2P via iroh) to a local path. Use this after submit_and_pay_job or get_job_result reports a file result. Resumable and bounded by a max file size; the bytes are written to disk, never returned to you inline.",
+    schema: FetchJobFileSchema,
+    async handler(ctx, input) {
+      checkLen("job_event_id", input.job_event_id, MAX_EVENT_ID_LEN);
+      let outputPath;
+      try {
+        outputPath = await resolveOutputPath(input.output_path, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
+      } catch (error) {
+        return errorResult(error instanceof Error ? error.message : String(error));
+      }
+      const agent = ctx.active();
+      let attachment;
+      if (agent.agentDir !== void 0) {
+        const entry = await findCustomerJob(agent.agentDir, input.job_event_id);
+        if (entry?.attachmentJson !== void 0) {
+          try {
+            attachment = JSON.parse(entry.attachmentJson);
+          } catch {
+          }
+        }
+      }
+      if (attachment === void 0) {
+        try {
+          const results = await agent.client.marketplace.queryJobResults(
+            agent.identity,
+            [input.job_event_id],
+            [input.kind_offset]
+          );
+          const resultEntry = results.get(input.job_event_id);
+          if (resultEntry !== void 0 && !resultEntry.decryptionFailed) {
+            attachment = decodeJobPayload(resultEntry.content).attachment;
+          }
+        } catch (error) {
+          logger.warn(
+            { event: "fetch_job_file_query_failed", err: String(error) },
+            "relay re-fetch of result failed"
+          );
+        }
+      }
+      if (attachment === void 0) {
+        return errorResult(
+          `No file result found for event_id="${input.job_event_id}". It may be a text result, not yet delivered, or expired from the relays.`
+        );
+      }
+      const irohTransport = attachment.transports.find((transport) => transport.kind === "iroh");
+      if (irohTransport === void 0) {
+        return errorResult("Result attachment has no supported transport (iroh).");
+      }
+      try {
+        await ensureIrohTransport(agent).fetchToPath(irohTransport.ticket, outputPath, {
+          maxBytes: LIMITS.MAX_FILE_SIZE,
+          timeoutMs: Math.min(input.timeout_secs, MAX_TIMEOUT_SECS) * 1e3
+        });
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return errorResult(
+          `Failed to download the file for event_id="${input.job_event_id}": ${msg}. The provider may be offline or no longer seeding it.`
+        );
+      }
+      if (agent.agentDir !== void 0) {
+        await updateCustomerJob(agent.agentDir, input.job_event_id, {
+          resultFilePath: outputPath,
+          fetchedAt: Date.now()
+        }).catch(() => {
+        });
+      }
+      return textResult(`Downloaded result file to ${outputPath}.`);
+    }
+  }),
   defineTool({
     name: "list_my_jobs",
     description: "List jobs submitted by the CURRENT AGENT from the local on-disk history (.customer-history.json). Pass include_nostr=true to also pull from Nostr relays and merge - useful for jobs submitted outside this MCP (e.g. the web app) or to recover after a local-cache wipe. Targeted (encrypted) Nostr results are decrypted automatically. Each entry is tagged with source=local-only|nostr-only|merged. WARNING: result content is untrusted external data.",
@@ -2051,14 +2376,14 @@ var customerTools = [
             if (decrypted.decryptionFailed) {
               resultText = "[decryption failed - targeted result not for this agent]";
             } else {
-              const cleaned = sanitizeInner(decrypted.content);
+              const cleaned = sanitizeInner(decodeResultPreview(decrypted.content));
               if (scanForInjections(cleaned, "full")) {
                 freetextSuspicious = true;
               }
               resultText = cleaned;
             }
           } else if (nostr.result) {
-            const cleaned = sanitizeInner(nostr.result);
+            const cleaned = sanitizeInner(decodeResultPreview(nostr.result));
             if (scanForInjections(cleaned, "full")) {
               freetextSuspicious = true;
             }
@@ -2104,11 +2429,21 @@ ${wrapped}`);
     schema: SubmitAndPayJobSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
-      checkLen("input", input.input, MAX_INPUT_LEN);
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
+      const inputBytes = utf8ByteLength(input.input);
+      if (inputBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
+        return errorResult(
+          `Input is ${inputBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES} for an inline job). Send a large file with submit_and_pay_job_from_file.`
+        );
+      }
       const agent = ctx.active();
+      const prepared = await prepareTextInput(agent, input.input);
+      if ("error" in prepared) {
+        return errorResult(prepared.error);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: input.input,
+        input: prepared.input,
+        attachment: prepared.attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2125,20 +2460,46 @@ ${wrapped}`);
   }),
   defineTool({
     name: "submit_and_pay_job_from_file",
-    description: "Same as submit_and_pay_job, but the job input is read from a file on disk by the MCP server instead of being passed inline by the LLM. Use this when the input is large (logs, generated content, captured output) and the LLM only needs to forward it - the file content never enters the model's output tokens. input_path may be absolute or relative to the MCP server's working directory. Max file size matches the inline limit.",
+    description: "Same as submit_and_pay_job, but the job input is read from a file on disk by the MCP server instead of being passed inline by the LLM. Use this when the input is large or binary (images, logs, captured output) and the LLM only needs to forward it - the file content never enters the model's output tokens. input_path may be absolute or relative to the MCP server's working directory. The file is ALWAYS transferred peer-to-peer via iroh, so this needs: a persistent agent, a PAID provider skill (free skills reject file inputs), and the iroh addon. Text files reach the skill on stdin; binary files via ELISYM_INPUT_FILE.",
     schema: SubmitAndPayJobFromFileSchema,
     async handler(ctx, input) {
       ctx.toolRateLimiter.check();
       checkLen("provider_npub", input.provider_npub, MAX_NPUB_LEN);
-      let payload;
+      let prepared;
       try {
-        payload = await readJobInputFile(input.input_path);
+        prepared = await prepareFileInput(input.input_path, {
+          allowOutsideCwd: input.allow_outside_cwd
+        });
       } catch (e) {
         return errorResult(e instanceof Error ? e.message : String(e));
       }
       const agent = ctx.active();
+      if (agent.agentDir === void 0) {
+        return errorResult(
+          `Sending a file requires a persistent agent (this is an ephemeral session). Files are always transferred P2P via iroh, never inline.`
+        );
+      }
+      let attachment;
+      try {
+        const seeded = await ensureIrohTransport(agent).seedPath(prepared.absPath);
+        attachment = {
+          name: prepared.name,
+          size: seeded.size,
+          mime: prepared.mime,
+          transports: [{ kind: "iroh", ticket: seeded.ticket }]
+        };
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (/@number0\/iroh|iroh file transfer is unavailable/i.test(msg)) {
+          return errorResult(
+            `File transfer is unavailable: the optional @number0/iroh addon is not installed. Install it (e.g. \`bun add @number0/iroh\`) to send files.`
+          );
+        }
+        return errorResult(`Failed to seed file for transfer: ${msg}`);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: payload,
+        input: "",
+        attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2167,14 +2528,20 @@ ${wrapped}`);
 ` : "";
       const payload = `${promptBlock}--- git diff (${diffResult.describedRange}) ---
 ${diffResult.diff}`;
-      if (payload.length > MAX_INPUT_LEN) {
+      const payloadBytes = utf8ByteLength(payload);
+      if (payloadBytes > LIMITS.MAX_REINLINE_TEXT_BYTES) {
         return errorResult(
-          `Combined prompt + diff is ${payload.length} chars (max ${MAX_INPUT_LEN}). Shorten the prompt or pass a narrower base.`
+          `Combined prompt + diff is ${payloadBytes} bytes (max ${LIMITS.MAX_REINLINE_TEXT_BYTES}). Pass a narrower "base" or shorten the prompt.`
         );
       }
       const agent = ctx.active();
+      const prepared = await prepareTextInput(agent, payload);
+      if ("error" in prepared) {
+        return errorResult(prepared.error);
+      }
       return executeSubmitAndPay(ctx, agent, {
-        input: payload,
+        input: prepared.input,
+        attachment: prepared.attachment,
         providerNpub: input.provider_npub,
         providerPubkey: decodeNpub(input.provider_npub),
         capability: input.capability,
@@ -2214,10 +2581,14 @@ ${diffResult.diff}`;
         card = provider.cards[0];
       }
       if (!card) {
-        const available = provider.cards.map((c) => `${c.name} (${c.capabilities?.join(", ")})`).join("; ");
-        return errorResult(
-          `No capability "${input.capability}" found for provider. Available: ${available}`
+        const available = provider.cards.map(
+          (providerCard) => `${sanitizeField(providerCard.name ?? "", 64)} (${(providerCard.capabilities ?? []).map((capability) => sanitizeField(capability, 64)).join(", ")})`
+        ).join("; ");
+        const { text } = sanitizeUntrusted(
+          `No capability "${input.capability}" found for provider. Available: ${available}`,
+          "text"
         );
+        return errorResult(text);
       }
       const price = card.payment?.job_price ?? 0;
       const cardAsset = assetFromCardPayment(card.payment);
@@ -2228,13 +2599,18 @@ ${diffResult.diff}`;
       }
       if (price > 0 && input.max_price_lamports === void 0) {
         const gasLine = await gasHintForCardAsset(agent, cardAsset);
+        const safeProviderName = sanitizeField(provider.name || input.provider_npub, 64);
+        const { text } = sanitizeUntrusted(
+          `Capability "${input.capability}" from "${safeProviderName}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
+
+To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`,
+          "text"
+        );
         return {
           content: [
             {
               type: "text",
-              text: `Capability "${input.capability}" from "${provider.name || input.provider_npub}" costs ${formatAssetAmount(cardAsset, BigInt(price))}.${gasLine}
-
-To confirm, call buy_capability again with max_price_lamports set (e.g. ${price} or higher).`
+              text
             }
           ]
         };
@@ -2291,7 +2667,11 @@ To confirm, call buy_capability again with max_price_lamports set (e.g. ${price}
               providerPubkey,
               customerPublicKey: agent.identity.publicKey,
               callbacks: {
-                onResult(content) {
+                onResult(content, _eventId, attachment) {
+                  if (attachment) {
+                    payHandler.onResultReceived(formatFileResultMetadata(jobId, attachment));
+                    return;
+                  }
                   const kind = isLikelyBase64(content) ? "binary" : "text";
                   const sanitized = sanitizeUntrusted(content, kind);
                   payHandler.onResultReceived(
@@ -2360,6 +2740,16 @@ ${result}${tip}`);
     }
   })
 ];
+var MAX_CAPABILITY_TAG_LEN = 64;
+function withTimeout(work, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`dashboard query timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));
+}
 var GetDashboardSchema = z.object({
   top_n: z.number().int().min(1).max(100).default(10),
   chain: z.enum(["solana"]).default("solana"),
@@ -2374,27 +2764,38 @@ var dashboardTools = [
     async handler(ctx, input) {
       const agent = ctx.active();
       const network = input.network ?? agent.network;
-      const agents = await agent.client.discovery.fetchAgents(network);
+      let agents;
+      try {
+        agents = await withTimeout(
+          agent.client.discovery.fetchAgents(network),
+          input.timeout_secs * 1e3
+        );
+      } catch (e) {
+        return textResult(e instanceof Error ? e.message : String(e));
+      }
       const filtered = agents.filter(
-        (a) => a.cards.some((c) => (c.payment?.chain ?? "solana") === input.chain)
+        (candidate) => candidate.cards.some((card) => (card.payment?.chain ?? "solana") === input.chain)
       );
-      const rows = filtered.map((a) => {
-        const mainCard = a.cards[0];
+      const rows = filtered.map((candidate) => {
+        const mainCard = candidate.cards[0];
         const mainAsset = assetFromCardPayment(mainCard?.payment);
         const mainPrice = mainCard?.payment?.job_price;
+        const capabilities = (mainCard?.capabilities ?? []).map((capability) => sanitizeField(capability, MAX_CAPABILITY_TAG_LEN)).join(", ");
         return {
-          name: sanitizeField(a.name || mainCard?.name || "unknown", 30),
-          npub: a.npub,
-          capabilities: (mainCard?.capabilities ?? []).join(", "),
+          name: sanitizeField(candidate.name || mainCard?.name || "unknown", 30),
+          npub: candidate.npub,
+          capabilities,
           price: mainPrice ? formatAssetAmount(mainAsset, BigInt(mainPrice)) : "free",
-          cards_count: a.cards.length
+          cards_count: candidate.cards.length
         };
       }).slice(0, input.top_n);
       if (rows.length === 0) {
         return textResult(`No agents found on ${network} (${input.chain}).`);
       }
       const header = `elisym Network Dashboard (${network}, ${input.chain})`;
-      const table = rows.map((r, i) => `${i + 1}. ${r.name} | ${r.capabilities} | ${r.price} | ${r.npub}`).join("\n");
+      const table = rows.map(
+        (row, index) => `${index + 1}. ${row.name} | ${row.capabilities} | ${row.price} | ${row.npub}`
+      ).join("\n");
       const { text } = sanitizeUntrusted(table, "structured");
       return textResult(`${header}
 ${"=".repeat(header.length)}
@@ -2795,7 +3196,13 @@ var discoveryTools = [
               asset_mint: asset.mint,
               chain: card.payment?.chain,
               network: card.payment?.network,
-              network_fee_estimate_sol: gasEstimate
+              network_fee_estimate_sol: gasEstimate,
+              // File-exchange hints (dynamic-script). Informational: the MCP/CLI
+              // CAN send files via submit_and_pay_job_from_file, so this does not
+              // gate anything - it just tells the caller a file input is expected.
+              // Already length-bounded by parseCapabilityEvent.
+              ...card.inputMime ? { input_mime: card.inputMime } : {},
+              ...card.outputMime ? { output_mime: card.outputMime } : {}
             };
           }),
           supported_kinds: a.supportedKinds,
@@ -2971,7 +3378,8 @@ var feedbackContactsTools = [
         contact.name ? `  name: ${contact.name}` : null,
         contact.lastCapability ? `  last capability: ${contact.lastCapability}` : null
       ].filter((line) => line !== null);
-      return textResult(lines.join("\n"));
+      const { text } = sanitizeUntrusted(lines.join("\n"), "text");
+      return textResult(text);
     }
   }),
   defineTool({
@@ -3044,18 +3452,26 @@ var policiesTools = [
       }
       const agent = ctx.active();
       const policies = await agent.client.policies.fetchPolicies(pubkey);
-      const limited = policies.map((policy) => ({
-        type: policy.type,
-        version: policy.version,
-        title: sanitizeField(policy.title, LIMITS.MAX_POLICY_TITLE_LENGTH),
-        summary: policy.summary ? sanitizeField(policy.summary, LIMITS.MAX_POLICY_SUMMARY_LENGTH) : void 0,
-        content: sanitizeInner(policy.content),
-        naddr: policy.naddr,
-        published_at: policy.publishedAt
-      }));
+      let freetextSuspicious = false;
+      const limited = policies.map((policy) => {
+        const cleanedContent = sanitizeInner(policy.content);
+        if (scanForInjections(cleanedContent, "full") || scanForInjections(policy.title ?? "", "full") || (policy.summary ? scanForInjections(policy.summary, "full") : false)) {
+          freetextSuspicious = true;
+        }
+        return {
+          type: policy.type,
+          version: policy.version,
+          title: sanitizeField(policy.title, LIMITS.MAX_POLICY_TITLE_LENGTH),
+          summary: policy.summary ? sanitizeField(policy.summary, LIMITS.MAX_POLICY_SUMMARY_LENGTH) : void 0,
+          content: cleanedContent,
+          naddr: policy.naddr,
+          published_at: policy.publishedAt
+        };
+      });
       const { text } = sanitizeUntrusted(
         JSON.stringify({ count: limited.length, policies: limited }, null, 2),
-        "structured"
+        "structured",
+        { extraInjectionSignal: freetextSuspicious }
       );
       return textResult(text);
     }
@@ -3158,7 +3574,6 @@ var walletTools = [
       const rpc = rpcFor(agent);
       const walletAddress = address(agent.solanaKeypair.publicKey);
       const { value: balanceLamports } = await rpc.getBalance(walletAddress).send();
-      const balance = Number(balanceLamports);
       const usdcBalanceRaw = await fetchUsdcBalance(rpc, walletAddress);
       const usdcLine = `USDC balance: ${formatAssetAmount(USDC_SOLANA_DEVNET, usdcBalanceRaw)}`;
       const sessionLines = formatSessionSpendLines(ctx);
@@ -3167,7 +3582,7 @@ ${sessionLines.join("\n")}` : "";
       return textResult(
         `Address: ${agent.solanaKeypair.publicKey}
 Network: ${agent.network}
-Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
+Balance: ${formatSol(balanceLamports)} (${balanceLamports.toString()} lamports)
 ` + usdcLine + sessionBlock
       );
     }
@@ -3266,7 +3681,17 @@ Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
         releaseSpend(ctx, sendAsset, sendAmount);
         throw e;
       }
-      const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
+      let remainingBalanceLine = "";
+      try {
+        const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
+        remainingBalanceLine = `  Remaining SOL balance: ${formatSol(balanceLamports)}
+`;
+      } catch (e) {
+        logger.warn(
+          { event: "post_payment_balance_fetch_failed", agent: agent.name },
+          `Payment succeeded but the post-confirmation balance fetch failed: ${e instanceof Error ? e.message : String(e)}`
+        );
+      }
       const warnings = takeSpendWarnings(ctx, sendAsset);
       for (const line of warnings) {
         logger.warn({ event: "session_spend_threshold", agent: agent.name }, line);
@@ -3279,8 +3704,7 @@ Balance: ${formatSol(BigInt(balance))} (${balance} lamports)
   Signature: ${signature}
   Amount: ${formatAssetAmount(paidAsset, BigInt(requestData.amount))}
   Recipient: ${requestData.recipient}
-  Remaining SOL balance: ${formatSol(balanceLamports)}
-  Explorer: ${explorerUrl(agent, signature)}`
+` + remainingBalanceLine + `  Explorer: ${explorerUrl(agent, signature)}`
       );
     }
   }),
@@ -3586,10 +4010,21 @@ if (toolMap.size !== allTools.length) {
     `Tool registry invariant violated: ${allTools.length} tools registered, ${toolMap.size} unique names`
   );
 }
+function redactSecrets(text) {
+  return text.replace(/\bnsec1[02-9ac-hj-np-z]{20,}\b/gi, "[REDACTED]").replace(/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]").replace(/\b[0-9a-fA-F]{64}\b/g, "[REDACTED]").replace(/\b[1-9A-HJ-NP-Za-km-z]{80,}\b/g, "[REDACTED]").replace(/\[\s*(?:\d{1,3}\s*,\s*){31,}\d{1,3}\s*\]/g, "[REDACTED]");
+}
 function safeError(context, e) {
   const message = e instanceof Error ? e.message : String(e);
   const stack = e instanceof Error ? e.stack : void 0;
-  logger.error({ event: "tool_error", context, err: message, stack }, "tool call failed");
+  logger.error(
+    {
+      event: "tool_error",
+      context,
+      err: redactSecrets(message),
+      stack: stack !== void 0 ? redactSecrets(stack) : void 0
+    },
+    "tool call failed"
+  );
   let msg;
   if (e instanceof ZodError) {
     const parts = e.issues.map((i) => {
@@ -3598,12 +4033,15 @@ function safeError(context, e) {
     });
     msg = `Invalid arguments: ${parts.join("; ")}`;
   } else if (e instanceof Error) {
-    msg = e.message.split("\n")[0].slice(0, 300);
+    msg = redactSecrets(e.message).split("\n")[0].slice(0, 300);
   } else {
-    msg = String(e).slice(0, 300);
+    msg = redactSecrets(String(e)).split("\n")[0].slice(0, 300);
   }
   return {
-    content: [{ type: "text", text: msg }],
+    // pino redact does not cover error-message string contents, so scrub key/secret
+    // shapes from the LLM-facing message itself (e.g. a JSON parse error that echoes
+    // a secrets file, or an RPC error embedding a key).
+    content: [{ type: "text", text: redactSecrets(msg) }],
     isError: true
   };
 }
@@ -3697,7 +4135,6 @@ async function startServer(ctx) {
       }
       const rpc = createSolanaRpc(rpcUrlFor(agent.network));
       const { value: balanceLamports } = await rpc.getBalance(address(agent.solanaKeypair.publicKey)).send();
-      const balance = Number(balanceLamports);
       return {
         contents: [
           {
@@ -3707,8 +4144,8 @@ async function startServer(ctx) {
               {
                 address: agent.solanaKeypair.publicKey,
                 network: agent.network,
-                balance_lamports: balance,
-                balance_sol: formatSolNumeric(BigInt(balance)),
+                balance_lamports: balanceLamports.toString(),
+                balance_sol: formatSolNumeric(balanceLamports),
                 chain: "solana"
               },
               null,
@@ -3728,6 +4165,7 @@ async function startServer(ctx) {
     shuttingDown = true;
     logger.info({ event: "shutdown", reason }, "shutting down");
     for (const agent of ctx.registry.values()) {
+      await shutdownIrohTransport(agent);
       try {
         agent.client.close();
       } catch (e) {
@@ -3985,11 +4423,8 @@ function resolveAssetOrThrow(chain, token, mint) {
 }
 async function setSessionLimit(amount, chain, token, mint) {
   const asset = resolveAssetOrThrow(chain, token, mint);
-  parseAssetAmount(asset, amount);
-  const parsedAmount = Number(amount);
-  if (!Number.isFinite(parsedAmount) || parsedAmount <= 0) {
-    throw new Error(`amount "${amount}" must be a positive decimal`);
-  }
+  const trimmedAmount = amount.trim();
+  parseAssetAmount(asset, trimmedAmount);
   const path = globalConfigPath();
   const cfg = await loadGlobalConfig(path);
   const entries = cfg.session_spend_limits ? [...cfg.session_spend_limits] : [];
@@ -4001,7 +4436,7 @@ async function setSessionLimit(amount, chain, token, mint) {
     chain: asset.chain,
     token: asset.token,
     mint: asset.mint,
-    amount: parsedAmount
+    amount: trimmedAmount
   };
   if (idx >= 0) {
     entries[idx] = newEntry;
@@ -4010,7 +4445,7 @@ async function setSessionLimit(amount, chain, token, mint) {
   }
   await writeGlobalConfig(path, { session_spend_limits: entries });
   console.log(
-    `Session spend limit set to ${amount} ${asset.symbol} (process-wide). Restart the MCP server to apply.`
+    `Session spend limit set to ${trimmedAmount} ${asset.symbol} (process-wide). Restart the MCP server to apply.`
   );
 }
 async function clearSessionLimit(chain, token, mint, all) {