@kroxy/kroxy 1.0.18 → 1.0.20

package/dist/index.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { demoDerivedAddress } from './src/utils/wallet.js';
 import { hireParams, executeHire } from './src/tools/hire.js';
 import { offerParams, executeOffer } from './src/tools/offer.js';
 import { reputationParams, executeReputation } from './src/tools/reputation.js';
@@ -10,10 +10,6 @@ import { disputeParams, executeDispute } from './src/tools/dispute.js';
 import { historyParams, executeHistory } from './src/tools/history.js';
 import { autoagentParams, executeAutoagent } from './src/tools/autoagent.js';
 const DEFAULT_API_URL = 'https://api-production-1b45.up.railway.app';
-function demoDerivedAddress() {
-    const hash = createHash('sha256').update('kroxy-demo-wallet').digest('hex');
-    return `0x${hash.slice(0, 40)}`;
-}
 export default {
     id: 'kroxy',
     name: 'Kroxy',

package/dist/src/client.d.ts

@@ -38,11 +38,11 @@ export interface ConditionsDefinition {
     requiredPassRate: number;
 }
 export interface Condition {
-    type: 'http_status' | 'json_field' | 'latency_ms' | 'uptime_percent';
+    type: 'http_status' | 'json_field' | 'latency_ms' | 'uptime_percent' | 'deliverable_quality';
     endpoint: string;
     field?: string;
-    operator: 'eq' | 'gte' | 'lte' | 'contains';
-    expected: string | number | boolean;
+    operator: 'eq' | 'gte' | 'lte' | 'gt' | 'lt' | 'contains';
+    expected: string | number | boolean | Record<string, unknown>;
 }
 export interface ReputationResult {
     walletAddress: string;
@@ -82,7 +82,7 @@ export declare function getAgents(filters?: {
     limit?: number;
 }): Promise<AgentProfile[]>;
 export declare function postJob(jobId: string, description: string, capability: string, budgetUsdc: number, conditionsJson: ConditionsDefinition, posterWallet: string): Promise<Job>;
-export declare function acceptBid(jobId: string, bidId: string, payerPrivateKey: string): Promise<{
+export declare function acceptBid(jobId: string, bidId: string): Promise<{
     jobId: string;
     bidId: string;
     escrowId: string;
@@ -108,4 +108,4 @@ export declare function registerProvider(opts: {
     modelName?: string;
 }): Promise<AgentProfile>;
 export declare function pingApi(): Promise<boolean>;
-//# sourceMappingURL=client.d.ts.map
+//# sourceMappingURL=client.d.ts.map

package/dist/src/client.js

@@ -90,8 +90,11 @@ export function postJob(jobId, description, capability, budgetUsdc, conditionsJs
         conditionsJson,
     });
 }
-export function acceptBid(jobId, bidId, payerPrivateKey) {
-    return apiPost(`/api/jobs/${jobId}/accept/${bidId}`, { payerPrivateKey });
+export function acceptBid(jobId, bidId) {
+    // Security hardening: private keys are never sent over HTTP request bodies.
+    // Bid acceptance now uses server-side demo-mode flow only until client-side
+    // signing + registration is wired end-to-end.
+    return apiPost(`/api/jobs/${jobId}/accept/${bidId}`, {});
 }
 export function getJob(jobId) {
     return apiGet(`/api/jobs/${jobId}`);

package/dist/src/tools/autoagent.d.ts

@@ -2,8 +2,9 @@
  * kroxy_autoagent — Autonomous multi-step orchestrator.
  *
  * Takes a natural-language goal, decomposes it into 2–4 subtasks via Claude
- * (or a rule-based fallback if ANTHROPIC_API_KEY is unset), fires kroxy_hire
- * for each subtask sequentially, and returns a unified deliverable.
+ * through Lava's gateway (or a rule-based fallback if keys are unset), fires
+ * kroxy_hire for all subtasks in parallel, then synthesizes outputs into a
+ * unified deliverable via Lava.
  */
 export declare const autoagentParams: import("@sinclair/typebox").TObject<{
     goal: import("@sinclair/typebox").TString;
@@ -19,4 +20,4 @@ export declare function executeAutoagent(params: {
     }];
     details: unknown;
 }>;
-//# sourceMappingURL=autoagent.d.ts.map
+//# sourceMappingURL=autoagent.d.ts.map

package/dist/src/tools/hire.js

@@ -1,6 +1,7 @@
-import { createHash, randomBytes } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { Type } from '@sinclair/typebox';
 import { findAgents, postJob, acceptBid, pollJob, } from '../client.js';
+import { demoDerivedAddress } from '../utils/wallet.js';
 const DEFAULT_API_URL = 'https://api-production-1b45.up.railway.app';
 export const hireParams = Type.Object({
     task: Type.String({ description: 'What you want the hired agent to do, e.g. "Research the top AI payment startups"' }),
@@ -21,24 +22,39 @@ function detectCapability(task) {
     return 'research';
 }
 function buildConditions(nexusUrl, jobId) {
+    const apiBase = process.env.KROXY_API_URL ?? 'https://api-production-1b45.up.railway.app';
     return {
         version: '1.0',
         escrowId: '',
         conditions: [
+            // Provider liveness: agent endpoint must be healthy
             { type: 'http_status', endpoint: `${nexusUrl}/health`, operator: 'eq', expected: 200 },
+            // Delivery gate: job must reach COMPLETED status before escrow releases
             {
                 type: 'json_field',
-                endpoint: `${nexusUrl}/quality-check?jobId=${encodeURIComponent(jobId)}`,
-                field: 'wordCount',
-                operator: 'gte',
-                expected: 100,
+                endpoint: `${apiBase}/api/jobs/${encodeURIComponent(jobId)}`,
+                field: 'status',
+                operator: 'eq',
+                expected: 'COMPLETED',
             },
+            // Quality gate: enforce structured, sourced, non-placeholder deliverable.
             {
-                type: 'json_field',
-                endpoint: `${nexusUrl}/quality-check?jobId=${encodeURIComponent(jobId)}`,
-                field: 'confidence',
+                type: 'deliverable_quality',
+                endpoint: `${apiBase}/api/jobs/${encodeURIComponent(jobId)}`,
+                field: 'deliverable',
                 operator: 'gte',
-                expected: 0.7,
+                expected: {
+                    minSummaryWords: 120,
+                    minSummaryChars: 600,
+                    minSentences: 3,
+                    minKeyFindings: 3,
+                    minFindingChars: 20,
+                    minSources: 2,
+                    minSourceDomains: 2,
+                    minLexicalDiversity: 0.45,
+                    requireCompletedStatus: true,
+                    forbidPlaceholderPhrases: true,
+                },
             },
         ],
         windowSeconds: 120,
@@ -53,10 +69,6 @@ function formatDuration(startMs) {
     const mins = Math.floor(secs / 60);
     return `${mins}m ${secs % 60}s`;
 }
-function demoDerivedAddress() {
-    const hash = createHash('sha256').update('kroxy-demo-wallet').digest('hex');
-    return `0x${hash.slice(0, 40)}`;
-}
 function buildReceipt(opts) {
     const lines = [
         `✅ Job Complete — ${opts.task.slice(0, 60)}${opts.task.length > 60 ? '…' : ''}`,
@@ -86,13 +98,13 @@ export async function executeHire(params) {
     const nexusUrl = process.env.NEXUS_URL ?? (demoMode ? `${apiBase}/demo-agent` : 'http://localhost:3003');
     if (!wallet)
         throw new Error('KROXY_AGENT_WALLET is not configured. Run kroxy_setup to diagnose.');
-    if (!demoMode && !privateKey)
-        throw new Error('KROXY_AGENT_PRIVATE_KEY is not configured. Set KROXY_DEMO_MODE=1 to use demo mode without a real private key.');
+    if (!demoMode) {
+        throw new Error('Live-mode bid acceptance is disabled for security. Private keys are never sent over API calls. Set KROXY_DEMO_MODE=1.');
+    }
     const task = params.task;
     const maxPrice = params.maxPrice ?? 5.0;
     const minRep = params.minRep ?? 0;
     const capability = params.capability ?? detectCapability(task);
-    const payerPrivateKey = privateKey ?? 'demo-private-key';
     const jobId = `job_${Date.now()}_${randomBytes(3).toString('hex')}`;
     const startMs = Date.now();
     // 1. Find matching agents
@@ -127,7 +139,7 @@ export async function executeHire(params) {
             `Increase maxPrice to $${bidPrice} or higher to accept this bid.`);
     }
     // 6. Accept bid — locks USDC in escrow on Base
-    const escrowResult = await acceptBid(job.id, bid.id, payerPrivateKey);
+    const escrowResult = await acceptBid(job.id, bid.id);
     // 7. Poll for completion (up to 5 minutes)
     const completed = await pollJob(job.id, (j) => j.status === 'COMPLETED', 300_000);
     if (!completed) {

package/dist/src/tools/offer.d.ts

@@ -3,12 +3,14 @@ export declare const offerParams: import("@sinclair/typebox").TObject<{
     price: import("@sinclair/typebox").TNumber;
     endpoint: import("@sinclair/typebox").TString;
     name: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    modelName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
 export declare function executeOffer(params: {
     capability: string;
     price: number;
     endpoint: string;
     name?: string;
+    modelName?: string;
 }): Promise<{
     content: [{
         type: 'text';
@@ -16,4 +18,4 @@ export declare function executeOffer(params: {
     }];
     details: unknown;
 }>;
-//# sourceMappingURL=offer.d.ts.map
+//# sourceMappingURL=offer.d.ts.map

package/dist/src/tools/offer.js

@@ -1,15 +1,29 @@
 import { Type } from '@sinclair/typebox';
-import { createHash } from 'node:crypto';
 import { registerProvider } from '../client.js';
+import { demoDerivedAddress } from '../utils/wallet.js';
 export const offerParams = Type.Object({
-    capability: Type.String({ description: 'Capability to offer: research, writing, coding, analysis, etc.' }),
+    capability: Type.String({ description: 'Capability to offer: research, writing, coding, planning, analysis, etc.' }),
     price: Type.Number({ minimum: 0.01, description: 'Price per job in USDC, e.g. 2.50' }),
     endpoint: Type.String({ description: 'Public URL where your agent receives job webhooks, e.g. https://myagent.example.com' }),
     name: Type.Optional(Type.String({ description: 'Display name for your agent on the Kroxy job board' })),
+    modelName: Type.Optional(Type.String({ description: 'Model your agent runs, e.g. claude-sonnet-4-6, gpt-4o. Shown on the job board.' })),
 });
-function demoDerivedAddress() {
-    const hash = createHash('sha256').update('kroxy-demo-wallet').digest('hex');
-    return `0x${hash.slice(0, 40)}`;
+/** Verify the endpoint is reachable before committing the registration. */
+async function pingEndpoint(url) {
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        let resp = await fetch(url, { method: 'HEAD', signal: controller.signal });
+        // Some webhook servers reject HEAD even when POST/GET are valid.
+        if (resp.status === 405 || resp.status === 501) {
+            resp = await fetch(url, { method: 'GET', signal: controller.signal });
+        }
+        clearTimeout(timeout);
+        return resp.status < 500;
+    }
+    catch {
+        return false;
+    }
 }
 export async function executeOffer(params) {
     const privateKey = process.env.KROXY_AGENT_PRIVATE_KEY;
@@ -17,26 +31,43 @@ export async function executeOffer(params) {
     const wallet = process.env.KROXY_AGENT_WALLET ?? (demoMode ? demoDerivedAddress() : undefined);
     if (!wallet)
         throw new Error('KROXY_AGENT_WALLET is not configured');
+    // Validate endpoint reachability before registering
+    const reachable = await pingEndpoint(params.endpoint);
+    if (!reachable) {
+        throw new Error(`Endpoint not reachable: ${params.endpoint}\nMake sure your agent is running and publicly accessible before registering.`);
+    }
     const agent = await registerProvider({
         walletAddress: wallet,
         name: params.name ?? 'MyAgent',
         endpoint: params.endpoint,
+        modelName: params.modelName,
         capabilities: [params.capability],
         pricingUsdc: params.price,
     });
+    const lines = [
+        `✅ Agent Registered on Kroxy`,
+        ``,
+        `Wallet:      ${agent.walletAddress ?? wallet}`,
+        `Name:        ${agent.name ?? params.name ?? 'MyAgent'}`,
+        `Capability:  ${(agent.capabilities ?? [params.capability]).join(', ')}`,
+        `Price:       $${agent.pricingUsdc ?? params.price} USDC / job`,
+        `Endpoint:    ${params.endpoint}`,
+    ];
+    if (params.modelName) {
+        lines.push(`Model:       ${params.modelName}`);
+    }
+    lines.push(``, `You are now listed on the Kroxy job board. Incoming jobs will be sent as POST webhooks to your endpoint.`);
     const result = {
         registered: true,
         walletAddress: agent.walletAddress ?? wallet,
         name: agent.name ?? params.name,
         capabilities: agent.capabilities ?? [params.capability],
         pricingUsdc: agent.pricingUsdc ?? params.price,
+        modelName: params.modelName,
         endpoint: params.endpoint,
     };
     return {
-        content: [{
-                type: 'text',
-                text: JSON.stringify(result, null, 2),
-            }],
+        content: [{ type: 'text', text: lines.join('\n') }],
         details: result,
     };
 }

package/dist/src/tools/reputation.js

@@ -16,19 +16,27 @@ export async function executeReputation(params) {
         score >= 60 ? 'Good — established track record' :
             score >= 20 ? 'New — building reputation' :
                 'Low — exercise caution';
+    const successCount = rep.successCount ?? 0;
+    const disputeCount = rep.disputeCount ?? 0;
+    const totalEarned = rep.totalEarned ?? '0';
+    const lines = [
+        `Reputation: ${walletAddress}`,
+        ``,
+        `Score:       ${score}/100  — ${interpretation}`,
+        `Jobs won:    ${successCount}`,
+        `Disputes:    ${disputeCount}`,
+        `Total earned: $${totalEarned} USDC`,
+    ];
     const result = {
         address: walletAddress,
         score,
-        successCount: rep.successCount ?? 0,
-        disputeCount: rep.disputeCount ?? 0,
-        totalEarned: rep.totalEarned ?? '0',
+        successCount,
+        disputeCount,
+        totalEarned,
         interpretation,
     };
     return {
-        content: [{
-                type: 'text',
-                text: JSON.stringify(result, null, 2),
-            }],
+        content: [{ type: 'text', text: lines.join('\n') }],
         details: result,
     };
 }

package/dist/src/utils/wallet.js

@@ -0,0 +1,10 @@
+import { createHash } from 'node:crypto';
+/**
+ * Deterministic demo wallet address derived from a fixed seed.
+ * Used in demo mode when no real wallet is configured.
+ */
+export function demoDerivedAddress() {
+    const hash = createHash('sha256').update('kroxy-demo-wallet').digest('hex');
+    return `0x${hash.slice(0, 40)}`;
+}
+//# sourceMappingURL=wallet.js.map

package/index.ts

@@ -1,5 +1,5 @@
 import type { OpenClawPluginApi } from 'openclaw/plugin-sdk';
-import { createHash } from 'node:crypto';
+import { demoDerivedAddress } from './src/utils/wallet.js';
 import { hireParams, executeHire } from './src/tools/hire.js';
 import { offerParams, executeOffer } from './src/tools/offer.js';
 import { reputationParams, executeReputation } from './src/tools/reputation.js';
@@ -24,11 +24,6 @@ type AutoagentToolParams = Parameters<typeof executeAutoagent>[0];
 
 const DEFAULT_API_URL = 'https://api-production-1b45.up.railway.app';
 
-function demoDerivedAddress(): string {
-  const hash = createHash('sha256').update('kroxy-demo-wallet').digest('hex');
-  return `0x${hash.slice(0, 40)}`;
-}
-
 export default {
   id: 'kroxy',
   name: 'Kroxy',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kroxy/kroxy",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "type": "module",
   "description": "Trustless agent-to-agent payments via USDC escrow on Base blockchain",
   "license": "MIT",

package/scripts/setup-openclaw.mjs

@@ -1,19 +1,14 @@
 #!/usr/bin/env node
 
-import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import readline from 'node:readline/promises';
+import { demoDerivedAddress } from '../dist/src/utils/wallet.js';
 
 const DEFAULT_API_URL = 'https://api-production-1b45.up.railway.app';
 
-function demoDerivedAddress() {
-  const hash = createHash('sha256').update('kroxy-demo-wallet').digest('hex');
-  return `0x${hash.slice(0, 40)}`;
-}
-
 function resolveConfigPath() {
   const explicit = process.env.OPENCLAW_CONFIG_PATH?.trim();
   if (explicit) return explicit;