@totalreclaw/totalreclaw 3.3.12-rc.21 → 3.3.12-rc.22

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: totalreclaw
 description: "End-to-end encrypted, decentralized memory for OpenClaw. A native kind:memory provider — recall is automatic via memory_search/memory_get, and facts are captured in the background. Trigger on 'install TotalReclaw', 'set up TotalReclaw', 'restore my recovery phrase', any recall request ('what do you remember about me', 'what's my X'), AND any explicit remember request ('remember X', 'save X')."
-version: 3.3.12-rc.21
+version: 3.3.12-rc.22
 author: TotalReclaw Team
 license: MIT
 homepage: https://totalreclaw.xyz

package/billing-cache.ts

@@ -14,6 +14,9 @@
  *   - keeps the chain-id override in sync with the relay's authoritative
  *     `chain_id` (after ops-1 both tiers are on Gnosis 100; the client consumes
  *     the relay value verbatim — see `syncChainIdFromBilling`)
+ *   - keeps the DataEdge-address override in sync with the relay's
+ *     authoritative `data_edge_address` (staging vs prod contract; consumed
+ *     verbatim — see `syncDataEdgeAddressFromBilling`, #460)
  *   - does NOT import anything that performs outbound I/O
  *
  * Do NOT add any outbound-request call to this file — a single match for
@@ -24,7 +27,10 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { CONFIG, setChainIdOverride } from './config.js';
+import { CONFIG, setChainIdOverride, setDataEdgeAddressOverride } from './config.js';
+
+/** A plausible EVM address — anything else from billing is ignored (#460). */
+const DATA_EDGE_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -57,6 +63,13 @@ export interface BillingCache {
    * source of truth, so the client consumes this verbatim (#402).
    */
   chain_id?: number;
+  /**
+   * Authoritative DataEdge contract address from the relay
+   * `/v1/billing/status` response. Staging returns the isolated staging
+   * DataEdge, production the prod DataEdge; the client consumes this verbatim
+   * so writes and reads land on the same contract (#460).
+   */
+  data_edge_address?: string;
   checked_at: number;
 }
 
@@ -82,6 +95,34 @@ export function syncChainIdFromBilling(chainId: number | undefined): void {
   setChainIdOverride(typeof chainId === 'number' && Number.isFinite(chainId) ? chainId : 100);
 }
 
+// ---------------------------------------------------------------------------
+// DataEdge-address sync
+// ---------------------------------------------------------------------------
+
+/**
+ * Apply the relay's authoritative `data_edge_address` to the runtime DataEdge
+ * override. Mirrors `syncChainIdFromBilling`.
+ *
+ * The relay routes each environment to its own DataEdge (staging is on-chain
+ * isolated). If the client ignores this and uses the WASM-baked default (the
+ * PROD DataEdge), writes against the staging relay mine on the prod contract
+ * while reads come from the staging subgraph → empty recall + phantom
+ * "stored=N" success (#460).
+ *
+ * A missing / malformed `data_edge_address` (older relay, partial payload,
+ * junk) clears the override (`null`) so resolution falls through to the WASM
+ * default — never a stale value. Only a plausible address
+ * (`0x` + 40 hex) is honored. Called from `readBillingCache` and
+ * `writeBillingCache` so every cache read or write keeps the override in sync.
+ * Idempotent. The explicit env override (`TOTALRECLAW_DATA_EDGE_ADDRESS`)
+ * still wins — it is the first term in `getSubgraphConfig`.
+ */
+export function syncDataEdgeAddressFromBilling(address: string | undefined): void {
+  setDataEdgeAddressOverride(
+    typeof address === 'string' && DATA_EDGE_ADDRESS_RE.test(address) ? address : null,
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Read / write
 // ---------------------------------------------------------------------------
@@ -99,9 +140,10 @@ export function readBillingCache(): BillingCache | null {
     if (!fs.existsSync(BILLING_CACHE_PATH)) return null;
     const raw = JSON.parse(fs.readFileSync(BILLING_CACHE_PATH, 'utf-8')) as BillingCache;
     if (!raw.checked_at || Date.now() - raw.checked_at > BILLING_CACHE_TTL) return null;
-    // Keep chain override in sync with the persisted authoritative chain_id
-    // across process restarts.
+    // Keep chain + DataEdge overrides in sync with the persisted authoritative
+    // values across process restarts.
     syncChainIdFromBilling(raw.chain_id);
+    syncDataEdgeAddressFromBilling(raw.data_edge_address);
     return raw;
   } catch {
     return null;
@@ -121,7 +163,9 @@ export function writeBillingCache(cache: BillingCache): void {
   } catch {
     // Best-effort — don't block on cache write failure.
   }
-  // Sync chain override AFTER the write so in-process UserOp signing picks
-  // up the correct chain immediately, even if the disk write failed.
+  // Sync chain + DataEdge overrides AFTER the write so in-process UserOp
+  // signing + subgraph reads pick up the correct chain and contract
+  // immediately, even if the disk write failed.
   syncChainIdFromBilling(cache.chain_id);
+  syncDataEdgeAddressFromBilling(cache.data_edge_address);
 }

package/config.ts

@@ -122,6 +122,39 @@ export function __resetChainIdOverrideForTests(): void {
   _chainIdOverride = null;
 }
 
+/**
+ * Runtime override for the DataEdge contract address, set after the relay
+ * billing response is read. The relay returns an authoritative
+ * `data_edge_address` in `/v1/billing/status` (staging routes to the isolated
+ * staging DataEdge, production to the prod DataEdge). Chain-aware clients MUST
+ * consume it verbatim — otherwise writes mine on the WASM-baked prod DataEdge
+ * while reads hit the relay's subgraph, so recall silently returns empty
+ * against staging (#460). Mirrors `_chainIdOverride`.
+ *
+ * `null` means "no billing override" → fall through to the WASM default. The
+ * explicit operator env override (`TOTALRECLAW_DATA_EDGE_ADDRESS`, exposed as
+ * `CONFIG.dataEdgeAddress`) always wins over this.
+ */
+let _dataEdgeAddressOverride: string | null = null;
+
+export function setDataEdgeAddressOverride(address: string | null): void {
+  _dataEdgeAddressOverride = address;
+}
+
+/**
+ * Read the billing-sourced DataEdge override (or `''` when unset). Used by
+ * `getSubgraphConfig` as the middle term of the env → billing → WASM-default
+ * resolution order (#460).
+ */
+export function getDataEdgeAddressOverride(): string {
+  return _dataEdgeAddressOverride ?? '';
+}
+
+/** Reset the DataEdge override — used by tests. */
+export function __resetDataEdgeAddressOverrideForTests(): void {
+  _dataEdgeAddressOverride = null;
+}
+
 export const CONFIG = {
   // Core — recoveryPhrase reads from override first, then env var.
   // Use getRecoveryPhrase() for dynamic access; this property is for
@@ -235,7 +268,14 @@ export const CONFIG = {
   get chainId(): number {
     return _chainIdOverride ?? 100;
   },
-  dataEdgeAddress: process.env.TOTALRECLAW_DATA_EDGE_ADDRESS || '',
+  // Explicit operator env override for the DataEdge contract. Stays env-only:
+  // it is the FIRST term of `getSubgraphConfig`'s env → billing → WASM-default
+  // resolution order, so it wins over the relay's authoritative
+  // `data_edge_address` (see `getDataEdgeAddressOverride` / #460). Getter, not
+  // a literal, so it reflects the live env rather than freezing at module load.
+  get dataEdgeAddress(): string {
+    return process.env.TOTALRECLAW_DATA_EDGE_ADDRESS || '';
+  },
   entryPointAddress: process.env.TOTALRECLAW_ENTRYPOINT_ADDRESS || '',
   rpcUrl: process.env.TOTALRECLAW_RPC_URL || '',
 

package/dist/billing-cache.js

@@ -14,6 +14,9 @@
  *   - keeps the chain-id override in sync with the relay's authoritative
  *     `chain_id` (after ops-1 both tiers are on Gnosis 100; the client consumes
  *     the relay value verbatim — see `syncChainIdFromBilling`)
+ *   - keeps the DataEdge-address override in sync with the relay's
+ *     authoritative `data_edge_address` (staging vs prod contract; consumed
+ *     verbatim — see `syncDataEdgeAddressFromBilling`, #460)
  *   - does NOT import anything that performs outbound I/O
  *
  * Do NOT add any outbound-request call to this file — a single match for
@@ -23,7 +26,9 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { CONFIG, setChainIdOverride } from './config.js';
+import { CONFIG, setChainIdOverride, setDataEdgeAddressOverride } from './config.js';
+/** A plausible EVM address — anything else from billing is ignored (#460). */
+const DATA_EDGE_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -51,6 +56,30 @@ export function syncChainIdFromBilling(chainId) {
     setChainIdOverride(typeof chainId === 'number' && Number.isFinite(chainId) ? chainId : 100);
 }
 // ---------------------------------------------------------------------------
+// DataEdge-address sync
+// ---------------------------------------------------------------------------
+/**
+ * Apply the relay's authoritative `data_edge_address` to the runtime DataEdge
+ * override. Mirrors `syncChainIdFromBilling`.
+ *
+ * The relay routes each environment to its own DataEdge (staging is on-chain
+ * isolated). If the client ignores this and uses the WASM-baked default (the
+ * PROD DataEdge), writes against the staging relay mine on the prod contract
+ * while reads come from the staging subgraph → empty recall + phantom
+ * "stored=N" success (#460).
+ *
+ * A missing / malformed `data_edge_address` (older relay, partial payload,
+ * junk) clears the override (`null`) so resolution falls through to the WASM
+ * default — never a stale value. Only a plausible address
+ * (`0x` + 40 hex) is honored. Called from `readBillingCache` and
+ * `writeBillingCache` so every cache read or write keeps the override in sync.
+ * Idempotent. The explicit env override (`TOTALRECLAW_DATA_EDGE_ADDRESS`)
+ * still wins — it is the first term in `getSubgraphConfig`.
+ */
+export function syncDataEdgeAddressFromBilling(address) {
+    setDataEdgeAddressOverride(typeof address === 'string' && DATA_EDGE_ADDRESS_RE.test(address) ? address : null);
+}
+// ---------------------------------------------------------------------------
 // Read / write
 // ---------------------------------------------------------------------------
 /**
@@ -68,9 +97,10 @@ export function readBillingCache() {
         const raw = JSON.parse(fs.readFileSync(BILLING_CACHE_PATH, 'utf-8'));
         if (!raw.checked_at || Date.now() - raw.checked_at > BILLING_CACHE_TTL)
             return null;
-        // Keep chain override in sync with the persisted authoritative chain_id
-        // across process restarts.
+        // Keep chain + DataEdge overrides in sync with the persisted authoritative
+        // values across process restarts.
         syncChainIdFromBilling(raw.chain_id);
+        syncDataEdgeAddressFromBilling(raw.data_edge_address);
         return raw;
     }
     catch {
@@ -92,7 +122,9 @@ export function writeBillingCache(cache) {
     catch {
         // Best-effort — don't block on cache write failure.
     }
-    // Sync chain override AFTER the write so in-process UserOp signing picks
-    // up the correct chain immediately, even if the disk write failed.
+    // Sync chain + DataEdge overrides AFTER the write so in-process UserOp
+    // signing + subgraph reads pick up the correct chain and contract
+    // immediately, even if the disk write failed.
     syncChainIdFromBilling(cache.chain_id);
+    syncDataEdgeAddressFromBilling(cache.data_edge_address);
 }

package/dist/config.js

@@ -107,6 +107,35 @@ export function setChainIdOverride(chainId) {
 export function __resetChainIdOverrideForTests() {
     _chainIdOverride = null;
 }
+/**
+ * Runtime override for the DataEdge contract address, set after the relay
+ * billing response is read. The relay returns an authoritative
+ * `data_edge_address` in `/v1/billing/status` (staging routes to the isolated
+ * staging DataEdge, production to the prod DataEdge). Chain-aware clients MUST
+ * consume it verbatim — otherwise writes mine on the WASM-baked prod DataEdge
+ * while reads hit the relay's subgraph, so recall silently returns empty
+ * against staging (#460). Mirrors `_chainIdOverride`.
+ *
+ * `null` means "no billing override" → fall through to the WASM default. The
+ * explicit operator env override (`TOTALRECLAW_DATA_EDGE_ADDRESS`, exposed as
+ * `CONFIG.dataEdgeAddress`) always wins over this.
+ */
+let _dataEdgeAddressOverride = null;
+export function setDataEdgeAddressOverride(address) {
+    _dataEdgeAddressOverride = address;
+}
+/**
+ * Read the billing-sourced DataEdge override (or `''` when unset). Used by
+ * `getSubgraphConfig` as the middle term of the env → billing → WASM-default
+ * resolution order (#460).
+ */
+export function getDataEdgeAddressOverride() {
+    return _dataEdgeAddressOverride ?? '';
+}
+/** Reset the DataEdge override — used by tests. */
+export function __resetDataEdgeAddressOverrideForTests() {
+    _dataEdgeAddressOverride = null;
+}
 export const CONFIG = {
     // Core — recoveryPhrase reads from override first, then env var.
     // Use getRecoveryPhrase() for dynamic access; this property is for
@@ -216,7 +245,14 @@ export const CONFIG = {
     get chainId() {
         return _chainIdOverride ?? 100;
     },
-    dataEdgeAddress: process.env.TOTALRECLAW_DATA_EDGE_ADDRESS || '',
+    // Explicit operator env override for the DataEdge contract. Stays env-only:
+    // it is the FIRST term of `getSubgraphConfig`'s env → billing → WASM-default
+    // resolution order, so it wins over the relay's authoritative
+    // `data_edge_address` (see `getDataEdgeAddressOverride` / #460). Getter, not
+    // a literal, so it reflects the live env rather than freezing at module load.
+    get dataEdgeAddress() {
+        return process.env.TOTALRECLAW_DATA_EDGE_ADDRESS || '';
+    },
     entryPointAddress: process.env.TOTALRECLAW_ENTRYPOINT_ADDRESS || '',
     rpcUrl: process.env.TOTALRECLAW_RPC_URL || '',
     // 3.3.3-rc.1 (issue #187 — ONNX decouple): kill switch for the

package/dist/index.js

@@ -735,14 +735,15 @@ async function initialize(logger) {
                     const tier = billingData.tier;
                     const expiresAt = billingData.expires_at;
                     // Populate billing cache for future use. Copy the relay's
-                    // authoritative chain_id so it lands on disk and drives the runtime
-                    // chain override verbatim (#402).
+                    // authoritative chain_id + data_edge_address so they land on disk and
+                    // drive the runtime chain + DataEdge overrides verbatim (#402, #460).
                     writeBillingCache({
                         tier: tier || 'free',
                         free_writes_used: billingData.free_writes_used ?? 0,
                         free_writes_limit: billingData.free_writes_limit ?? 0,
                         features: billingData.features,
                         chain_id: billingData.chain_id,
+                        data_edge_address: billingData.data_edge_address,
                         checked_at: Date.now(),
                     });
                     if (tier === 'pro' && expiresAt) {
@@ -4083,6 +4084,8 @@ const plugin = {
                                     features: billingData.features,
                                     // Relay's authoritative chain_id → drives the chain override verbatim (#402).
                                     chain_id: billingData.chain_id,
+                                    // Relay's authoritative data_edge_address → drives the DataEdge override verbatim (#460).
+                                    data_edge_address: billingData.data_edge_address,
                                     checked_at: Date.now(),
                                 };
                                 writeBillingCache(cache);

package/dist/subgraph-store.js

@@ -21,7 +21,7 @@ function getWasm() {
         _wasm = requireWasm('@totalreclaw/core');
     return _wasm;
 }
-import { CONFIG } from './config.js';
+import { CONFIG, getDataEdgeAddressOverride } from './config.js';
 import { buildRelayHeaders } from './relay-headers.js';
 import { rpcRequest, rpcWithRetry } from './relay.js';
 import { signUserOp } from './vault-crypto.js';
@@ -712,7 +712,10 @@ export function isSubgraphMode() {
  *   - TOTALRECLAW_SELF_HOSTED -- set "true" to use self-hosted server (default: managed service)
  *
  * Chain ID is no longer configurable via env — it is auto-detected from the
- * relay billing response (free = Base Sepolia, Pro = Gnosis mainnet).
+ * relay billing response (post-ops-1 both tiers are on Gnosis mainnet, chain
+ * 100). The DataEdge contract address is likewise consumed from the relay's
+ * authoritative `data_edge_address` (env override still wins, WASM default is
+ * the final fallback — see the `dataEdgeAddress` resolution below, #460).
  */
 export function getSubgraphConfig() {
     return {
@@ -721,7 +724,12 @@ export function getSubgraphConfig() {
         mnemonic: CONFIG.recoveryPhrase,
         cachePath: CONFIG.cachePath,
         chainId: CONFIG.chainId,
-        dataEdgeAddress: CONFIG.dataEdgeAddress || getWasm().getDataEdgeAddress(),
+        // Resolution order (#460): explicit operator env override → relay billing
+        // `data_edge_address` (verbatim) → WASM-baked default. The relay routes
+        // each environment to its own DataEdge (staging is on-chain isolated), so
+        // consuming its value keeps writes + reads on the same contract; without
+        // the middle term staging writes mined on the prod default → empty recall.
+        dataEdgeAddress: CONFIG.dataEdgeAddress || getDataEdgeAddressOverride() || getWasm().getDataEdgeAddress(),
         entryPointAddress: CONFIG.entryPointAddress || getWasm().getEntryPointAddress(),
         rpcUrl: CONFIG.rpcUrl || undefined,
     };

package/dist/tr-cli.js

@@ -51,7 +51,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.12-rc.21';
+const PLUGIN_VERSION = '3.3.12-rc.22';
 function die(msg, code = 1) {
     process.stderr.write(`tr: ${msg}\n`);
     process.exit(code);

package/index.ts

@@ -1007,14 +1007,15 @@ async function initialize(logger: OpenClawPluginApi['logger']): Promise<void> {
           const tier = billingData.tier as string;
           const expiresAt = billingData.expires_at as string | undefined;
           // Populate billing cache for future use. Copy the relay's
-          // authoritative chain_id so it lands on disk and drives the runtime
-          // chain override verbatim (#402).
+          // authoritative chain_id + data_edge_address so they land on disk and
+          // drive the runtime chain + DataEdge overrides verbatim (#402, #460).
           writeBillingCache({
             tier: tier || 'free',
             free_writes_used: (billingData.free_writes_used as number) ?? 0,
             free_writes_limit: (billingData.free_writes_limit as number) ?? 0,
             features: billingData.features as BillingCache['features'] | undefined,
             chain_id: billingData.chain_id as number | undefined,
+            data_edge_address: billingData.data_edge_address as string | undefined,
             checked_at: Date.now(),
           });
           if (tier === 'pro' && expiresAt) {
@@ -4785,6 +4786,8 @@ const plugin = {
                   features: billingData.features as BillingCache['features'] | undefined,
                   // Relay's authoritative chain_id → drives the chain override verbatim (#402).
                   chain_id: billingData.chain_id as number | undefined,
+                  // Relay's authoritative data_edge_address → drives the DataEdge override verbatim (#460).
+                  data_edge_address: billingData.data_edge_address as string | undefined,
                   checked_at: Date.now(),
                 };
                 writeBillingCache(cache);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totalreclaw/totalreclaw",
-  "version": "3.3.12-rc.21",
+  "version": "3.3.12-rc.22",
   "description": "End-to-end encrypted, agent-portable memory for OpenClaw and any LLM-agent runtime. XChaCha20-Poly1305 with protobuf v4 + on-chain Memory Taxonomy v1 (claim / preference / directive / commitment / episode / summary).",
   "type": "module",
   "keywords": [

package/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "totalreclaw",
-  "version": "3.3.12-rc.21",
+  "version": "3.3.12-rc.22",
   "description": "End-to-end encrypted memory for AI agents — portable, yours forever. XChaCha20-Poly1305 E2EE: server never sees plaintext.",
   "author": "TotalReclaw Team",
   "license": "MIT",

package/subgraph-store.ts

@@ -21,7 +21,7 @@ function getWasm() {
   if (!_wasm) _wasm = requireWasm('@totalreclaw/core');
   return _wasm;
 }
-import { CONFIG } from './config.js';
+import { CONFIG, getDataEdgeAddressOverride } from './config.js';
 import { buildRelayHeaders } from './relay-headers.js';
 import { rpcRequest, rpcWithRetry } from './relay.js';
 import { signUserOp } from './vault-crypto.js';
@@ -844,7 +844,10 @@ export function isSubgraphMode(): boolean {
  *   - TOTALRECLAW_SELF_HOSTED -- set "true" to use self-hosted server (default: managed service)
  *
  * Chain ID is no longer configurable via env — it is auto-detected from the
- * relay billing response (free = Base Sepolia, Pro = Gnosis mainnet).
+ * relay billing response (post-ops-1 both tiers are on Gnosis mainnet, chain
+ * 100). The DataEdge contract address is likewise consumed from the relay's
+ * authoritative `data_edge_address` (env override still wins, WASM default is
+ * the final fallback — see the `dataEdgeAddress` resolution below, #460).
  */
 export function getSubgraphConfig(): SubgraphStoreConfig {
   return {
@@ -853,7 +856,12 @@ export function getSubgraphConfig(): SubgraphStoreConfig {
     mnemonic: CONFIG.recoveryPhrase,
     cachePath: CONFIG.cachePath,
     chainId: CONFIG.chainId,
-    dataEdgeAddress: CONFIG.dataEdgeAddress || getWasm().getDataEdgeAddress(),
+    // Resolution order (#460): explicit operator env override → relay billing
+    // `data_edge_address` (verbatim) → WASM-baked default. The relay routes
+    // each environment to its own DataEdge (staging is on-chain isolated), so
+    // consuming its value keeps writes + reads on the same contract; without
+    // the middle term staging writes mined on the prod default → empty recall.
+    dataEdgeAddress: CONFIG.dataEdgeAddress || getDataEdgeAddressOverride() || getWasm().getDataEdgeAddress(),
     entryPointAddress: CONFIG.entryPointAddress || getWasm().getEntryPointAddress(),
     rpcUrl: CONFIG.rpcUrl || undefined,
   };

package/tr-cli.ts

@@ -68,7 +68,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.12-rc.21';
+const PLUGIN_VERSION = '3.3.12-rc.22';
 
 function die(msg: string, code = 1): never {
   process.stderr.write(`tr: ${msg}\n`);