@true402.dev/openclaw-swap-guard 1.0.2 → 1.0.3

package/README.md

@@ -36,7 +36,7 @@ export TRUE402_PAYER_PRIVATE_KEY=0x…
 
 Only this dedicated variable is read — never a generic `PAYER_PRIVATE_KEY` another tool may have set. Each check then pays the exact quoted price over [x402](https://x402.org), no account and no API key. The key stays on your machine (it authorizes each USDC payment locally) and is never written to OpenClaw's config.
 
-Spending is bounded twice: **at most $0.02 per check** (`maxAmountUsd`) and **at most 50 paid checks a day** (`maxPaidChecksPerDay`) — so never more than $1.00 a day by default. Past the daily limit, only free checks run, and the guard logs a warning.
+Spending is bounded twice: **at most $0.02 per check** (`maxAmountUsd`) and **at most 50 paid checks per UTC day** (`maxPaidChecksPerDay`) — at most $1.00 a day by default. The day's count is kept in `$OPENCLAW_STATE_DIR/true402-swap-guard/spend.json` (default `~/.openclaw/…`), so restarting OpenClaw does not reset it; if that file cannot be written, no payment is made. Past the limit only free checks run, and the guard logs a warning. The limit is per machine: several OpenClaw installs with their own state directories each have their own.
 
 ## Settings
 
@@ -54,7 +54,9 @@ All optional, under the plugin's config (`true402-swap-guard`):
 
 ## What is sent
 
-Only the token address and its chain, to `true402.dev`. Nothing about your wallet, your prompts or the trade itself.
+A **free check** sends only the token address and its chain to `true402.dev` — nothing about your wallet, your prompts or the trade.
+
+A **paid check** also sends a signed USDC payment authorization. That necessarily reveals the paying wallet's **address** to true402, and the payment is settled on Base, where it is public. That is why the wallet should be a dedicated, low-balance one. The private key itself never leaves your machine.
 
 ## License
 

package/dist/index.js

@@ -267,6 +267,11 @@ function clean(s, max = 160) {
   return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
 }
 
+// src/check.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
 // src/x402.ts
 import { randomBytes } from "crypto";
 import { createPublicClient, http, getAddress } from "viem";
@@ -274,7 +279,7 @@ import { privateKeyToAccount } from "viem/accounts";
 import { base } from "viem/chains";
 
 // src/client.ts
-var CLIENT = { id: "openclaw-guard", version: "1.0.2", package: "@true402.dev/openclaw-swap-guard", install: "openclaw plugins install @true402.dev/openclaw-swap-guard" };
+var CLIENT = { id: "openclaw-guard", version: "1.0.3", package: "@true402.dev/openclaw-swap-guard", install: "openclaw plugins install @true402.dev/openclaw-swap-guard" };
 
 // src/x402.ts
 var USDC_ABI = [
@@ -447,6 +452,22 @@ async function payStall(path, payload, opts) {
 }
 
 // src/check.ts
+function fileSpendStore(path = join(process.env.OPENCLAW_STATE_DIR || join(homedir(), ".openclaw"), "true402-swap-guard", "spend.json")) {
+  return {
+    read() {
+      try {
+        const v = JSON.parse(readFileSync(path, "utf8"));
+        return { day: typeof v.day === "string" ? v.day : "", count: typeof v.count === "number" && v.count >= 0 ? v.count : 0 };
+      } catch {
+        return { day: "", count: 0 };
+      }
+    },
+    write(v) {
+      mkdirSync(dirname(path), { recursive: true });
+      writeFileSync(path, JSON.stringify(v), { mode: 384 });
+    }
+  };
+}
 var DEFAULT_MAX_PER_CHECK_USD = 0.02;
 var DEFAULT_MAX_PAID_CHECKS_PER_DAY = 50;
 var NOT_A_TOKEN = /* @__PURE__ */ new Set(["not_a_contract", "mint_unreadable", "mint_not_initialized"]);
@@ -495,8 +516,7 @@ function createChecker(cfg = {}) {
   const perCheck = cfg.maxAmountUsd ?? DEFAULT_MAX_PER_CHECK_USD;
   const perDay = cfg.maxPaidChecksPerDay ?? DEFAULT_MAX_PAID_CHECKS_PER_DAY;
   const now = cfg.now ?? Date.now;
-  let day = "";
-  let paidToday = 0;
+  const store = cfg.spendStore ?? fileSpendStore();
   async function free(path, token) {
     const res = await fetch(`${baseUrl}${path}`, {
       method: "POST",
@@ -516,9 +536,14 @@ function createChecker(cfg = {}) {
     if (body !== null) return toVerdict(body);
     if (!cfg.payerPrivateKey) throw new Error("the free daily checks are used up \u2014 set TRUE402_PAYER_PRIVATE_KEY to pay per check");
     const today = new Date(now()).toISOString().slice(0, 10);
-    if (today !== day) [day, paidToday] = [today, 0];
+    const saved = store.read();
+    const paidToday = saved.day === today ? saved.count : 0;
     if (paidToday >= perDay) throw new Error(`the daily limit of ${perDay} paid checks is reached (maxPaidChecksPerDay)`);
-    paidToday++;
+    try {
+      store.write({ day: today, count: paidToday + 1 });
+    } catch {
+      throw new Error("could not record the paid-check count, so no payment was made");
+    }
     return toVerdict(await payStall(path, { token: t.token }, { payerPrivateKey: cfg.payerPrivateKey, baseUrl, maxAmountUsd: perCheck }));
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@true402.dev/openclaw-swap-guard",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "OpenClaw plugin: before any tool call that buys a token, check it with true402 (executed buy/sell honeypot simulation) and block honeypots and rugs. Base, Ethereum, BSC, Solana. Free daily checks; pay-per-check over x402.",
   "type": "module",
   "main": "dist/index.js",