@quackai/q402-mcp 0.6.2 → 0.6.3

package/dist/index.js

@@ -211,7 +211,7 @@ var isValidPrivateKey = (s) => typeof s === "string" && PRIVATE_KEY_RE.test(s);
 
 // src/version.ts
 var PACKAGE_NAME = "@quackai/q402-mcp";
-var PACKAGE_VERSION = "0.6.2";
+var PACKAGE_VERSION = "0.6.3";
 
 // src/tools/quote.ts
 import { z } from "zod";
@@ -2049,7 +2049,7 @@ function envSlot(name, purpose) {
 }
 function mask2(key) {
   if (!key || key.length < 12) return key ?? "";
-  return `${key.slice(0, 12)}\u2026${key.slice(-4)}`;
+  return `${key.slice(0, 12)}...${key.slice(-4)}`;
 }
 function detectPhase() {
   const anyKey = !!(CONFIG.trialApiKey || CONFIG.multichainApiKey || CONFIG.legacyApiKey);
@@ -2435,10 +2435,10 @@ async function runDoctor() {
     nextStep: ready ? "Show userInstructions verbatim. Then offer to make a small test quote (q402_quote) to confirm everything works end-to-end." : "Walk the user through each warning in order. Show userInstructions verbatim for the cleanup steps.",
     agentInstructions: ready ? "[AI-ONLY \u2014 do not show this paragraph to the user verbatim] Live mode is fully configured. Summarize the wallet address (mask middle), plan tier(s), remaining quota, and any non-zero delegation counts to the user as a checklist. Offer a tiny test (q402_quote, not q402_pay) to confirm. Don't echo the full keys array verbatim \u2014 pick the most useful 2-3 fields per scope." : "[AI-ONLY \u2014 do not show this paragraph to the user verbatim] Walk the user through each warning IN ORDER, plain language. For slot-mismatch warnings, the fix is editing ~/.q402/mcp.env and restarting the client (Cursor / Cline: reload window; Claude / Codex: quit + relaunch). Surface body.error strings from any verify failure as the user-visible reason (e.g. 'your Trial expired 3 days ago', 'API key has been rotated') \u2014 don't generic-out to 'check the key value'.",
     userInstructions: ready ? [
-      `Your wallet: ${walletAddress ? walletAddress.slice(0, 6) + "\u2026" + walletAddress.slice(-4) : "(derive failed \u2014 check Q402_PRIVATE_KEY)"}`,
+      walletAddress ? `Your wallet: ${walletAddress.slice(0, 6)}...${walletAddress.slice(-4)}` : modes.modeC && !modes.modeA && !modes.modeB ? "Wallet: server-managed (Mode C) \u2014 Q402 holds your Agent Wallet key. No local wallet to show." : "(wallet derive failed \u2014 check Q402_PRIVATE_KEY or Q402_AGENTIC_PRIVATE_KEY in ~/.q402/mcp.env)",
       "Q402 is live. You can now ask me to quote, pay, batch-pay, or check Trust Receipts.",
       "Want me to run a quick gas comparison across all 9 chains as a smoke test?",
-      "Need to chain-test against sandbox without changing keys? Set Q402_ENABLE_REAL_PAYMENTS=0 in ~/.q402/mcp.env and restart \u2014 every q402_pay returns a fake hash until you flip it back to 1."
+      "Need to chain-test against sandbox without changing keys? Set Q402_ENABLE_REAL_PAYMENTS=0 in ~/.q402/mcp.env and restart - every q402_pay returns a fake hash until you flip it back to 1."
     ] : [
       `Q402 has ${warnings.length} issue${warnings.length === 1 ? "" : "s"} to fix:`,
       ...warnings.map((w) => `\u2022 ${w}`),
@@ -2650,6 +2650,9 @@ import { z as z11 } from "zod";
 var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 var AMOUNT_RE = /^\d+(\.\d{1,18})?$/;
 var RecurringCreateInputSchema = z11.object({
+  confirm: z11.literal(true).describe(
+    'REQUIRED. Must be literally `true`. Authoring a recurring rule schedules future on-chain payments that the user does not click through one-by-one \u2014 the user has to explicitly say yes BEFORE this is called. Echo back the frequency + recipient + amount + chain + token + cancelWindow you intend to create, get a plain-language confirmation from the user (e.g. "yes, create the schedule"), and ONLY then call this with confirm: true. Mirrors the same guard q402_pay / q402_batch_pay use on one-shot sends.'
+  ),
   frequency: z11.string().min(1).describe(
     'Cadence string. One of: "hourly:N" (N=1..23), "daily", "weekly:{mon|tue|wed|thu|fri|sat|sun}", "monthly:N" (N=1..31), "monthly:last". Examples: "hourly:1" fires every hour, "weekly:fri" fires every Friday, "monthly:1" fires on the 1st of each month.'
   ),
@@ -2675,6 +2678,11 @@ var RECURRING_CREATE_TOOL = {
   inputSchema: {
     type: "object",
     properties: {
+      confirm: {
+        type: "boolean",
+        const: true,
+        description: "REQUIRED. Must be literally `true`. Recurring rules schedule future on-chain payments without per-fire user prompts, so the agent must get an explicit user yes BEFORE setting `confirm: true` and calling this. Same guard q402_pay / q402_batch_pay use on one-shot sends."
+      },
       frequency: {
         type: "string",
         description: 'Required. "hourly:N" (N=1..23), "daily", "weekly:{day}", "monthly:N", or "monthly:last".'
@@ -2714,7 +2722,7 @@ var RECURRING_CREATE_TOOL = {
         description: "Optional. Defaults to default wallet on server."
       }
     },
-    required: ["frequency", "recipient", "amount"],
+    required: ["confirm", "frequency", "recipient", "amount"],
     additionalProperties: false
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quackai/q402-mcp",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "MCP server for Q402 — gasless USDC, USDT, and RLUSD payments across 9 EVM chains, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   "mcpName": "io.github.bitgett/q402-mcp",
   "keywords": [
@@ -68,6 +68,7 @@
     "access": "public"
   },
   "overrides": {
-    "ws": "^8.20.1"
+    "ws": "^8.20.1",
+    "qs": "^6.15.2"
   }
 }