@xpr-agents/openclaw 0.2.11 → 0.2.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.ts CHANGED
@@ -1,16 +1,38 @@
1
1
  /**
2
2
  * XPR Agents OpenClaw Plugin
3
3
  *
4
- * Registers 56 tools for interacting with the XPR Network Trustless Agent Registry:
4
+ * Registers 57 tools for interacting with the XPR Network Trustless Agent Registry:
5
5
  * - 11 Agent Core tools (registration, profile, plugins, trust scores, ownership)
6
6
  * - 7 Feedback tools (ratings, disputes, scores)
7
7
  * - 9 Validation tools (validators, validations, challenges)
8
- * - 20 Escrow tools (jobs, milestones, disputes, arbitration, bidding)
8
+ * - 21 Escrow tools (jobs, milestones, disputes, arbitration, bidding)
9
9
  * - 4 Indexer tools (search, events, stats, health)
10
10
  * - 5 A2A tools (discover, message, task status, cancel, delegate)
11
11
  */
12
12
  import type { PluginApi } from './types';
13
13
  export type { SkillManifest, SkillApi, LoadedSkill } from './skill-types';
14
14
  export type { ToolDefinition, PluginApi } from './types';
15
- export default function xprAgentsPlugin(api: PluginApi): void;
15
+ /**
16
+ * OpenClaw plugin API shape (real runtime API).
17
+ * Plugins receive this from the OpenClaw gateway.
18
+ */
19
+ interface OpenClawPluginApi {
20
+ id: string;
21
+ name: string;
22
+ config?: Record<string, unknown>;
23
+ pluginConfig?: Record<string, unknown>;
24
+ registerTool(tool: {
25
+ name: string;
26
+ description: string;
27
+ parameters: unknown;
28
+ execute: (id: string, params: Record<string, unknown>) => Promise<{
29
+ content: Array<{
30
+ type: string;
31
+ text?: string;
32
+ }>;
33
+ }>;
34
+ }, opts?: unknown): void;
35
+ [key: string]: unknown;
36
+ }
37
+ export default function xprAgentsPlugin(realApi: OpenClawPluginApi | PluginApi): void;
16
38
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAGvD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzD,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAoD5D"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,KAAK,EAAE,SAAS,EAAgC,MAAM,SAAS,CAAC;AAGvE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzD;;;GAGG;AACH,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,IAAI,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;YAChE,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SACjD,CAAC,CAAC;KACJ,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AA0BD,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI,CA0DpF"}
package/dist/index.js CHANGED
@@ -2,11 +2,11 @@
2
2
  /**
3
3
  * XPR Agents OpenClaw Plugin
4
4
  *
5
- * Registers 56 tools for interacting with the XPR Network Trustless Agent Registry:
5
+ * Registers 57 tools for interacting with the XPR Network Trustless Agent Registry:
6
6
  * - 11 Agent Core tools (registration, profile, plugins, trust scores, ownership)
7
7
  * - 7 Feedback tools (ratings, disputes, scores)
8
8
  * - 9 Validation tools (validators, validations, challenges)
9
- * - 20 Escrow tools (jobs, milestones, disputes, arbitration, bidding)
9
+ * - 21 Escrow tools (jobs, milestones, disputes, arbitration, bidding)
10
10
  * - 4 Indexer tools (search, events, stats, health)
11
11
  * - 5 A2A tools (discover, message, task status, cancel, delegate)
12
12
  */
@@ -19,12 +19,39 @@ const validation_1 = require("./tools/validation");
19
19
  const escrow_1 = require("./tools/escrow");
20
20
  const indexer_1 = require("./tools/indexer");
21
21
  const a2a_1 = require("./tools/a2a");
22
- function xprAgentsPlugin(api) {
22
+ /**
23
+ * Create an adapter that bridges the real OpenClaw API to our internal PluginApi.
24
+ * This lets all 57 tool registrations work unchanged.
25
+ */
26
+ function createAdapter(realApi) {
27
+ return {
28
+ registerTool(tool) {
29
+ realApi.registerTool({
30
+ name: tool.name,
31
+ description: tool.description,
32
+ parameters: tool.parameters,
33
+ async execute(_id, params) {
34
+ const result = await tool.handler(params);
35
+ const text = typeof result === 'string' ? result : JSON.stringify(result, null, 2);
36
+ return { content: [{ type: 'text', text }] };
37
+ },
38
+ });
39
+ },
40
+ getConfig() {
41
+ return realApi.pluginConfig || {};
42
+ },
43
+ };
44
+ }
45
+ function xprAgentsPlugin(realApi) {
46
+ // Detect whether we're running inside the real OpenClaw runtime or in tests.
47
+ // Real OpenClaw API has pluginConfig property; our test mock has getConfig method.
48
+ const api = typeof realApi.getConfig === 'function'
49
+ ? realApi
50
+ : createAdapter(realApi);
23
51
  const rawConfig = api.getConfig();
24
- const rpcEndpoint = rawConfig.rpcEndpoint;
25
- if (!rpcEndpoint) {
26
- throw new Error('[xpr-agents] rpcEndpoint is required. Set XPR_RPC_ENDPOINT or configure rpcEndpoint in plugin config.');
27
- }
52
+ const network = rawConfig.network || 'testnet';
53
+ const defaultRpc = network === 'mainnet' ? 'https://proton.eosusa.io' : 'https://tn1.protonnz.com';
54
+ const rpcEndpoint = rawConfig.rpcEndpoint || process.env.XPR_RPC_ENDPOINT || defaultRpc;
28
55
  const hasCredentials = !!process.env.XPR_PRIVATE_KEY && !!process.env.XPR_ACCOUNT;
29
56
  // Create RPC connection and optional session
30
57
  let rpc;
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAeH,kCAoDC;AAjED,uCAA6D;AAC7D,yCAAmD;AACnD,+CAAyD;AACzD,mDAA6D;AAC7D,2CAAqD;AACrD,6CAAuD;AACvD,qCAA+C;AAO/C,SAAwB,eAAe,CAAC,GAAc;IACpD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAElC,MAAM,WAAW,GAAG,SAAS,CAAC,WAAqB,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAElF,6CAA6C;IAC7C,IAAI,GAAG,CAAC;IACR,IAAI,OAAO,CAAC;IAEZ,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9C,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAA,2BAAiB,EAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAE3E,MAAM,MAAM,GAAiB;QAC3B,GAAG,EAAE,GAAU;QACf,OAAO;QACP,OAAO,EAAG,SAAS,CAAC,OAAiC,IAAI,SAAS;QAClE,WAAW;QACX,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,uBAAuB;QACvE,SAAS,EAAE;YACT,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,UAAU,EAAE,YAAY,CAAC,UAAU,IAAI,YAAY;YACnD,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,aAAa;SACvD;QACD,eAAe,EAAE,SAAS,CAAC,eAAe,KAAK,KAAK;QACpD,iBAAiB,EAAG,SAAS,CAAC,iBAA4B,IAAI,QAAQ;KACvE,CAAC;IAEF,2BAA2B;IAC3B,IAAA,0BAAkB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAA,oCAAuB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,IAAA,4BAAmB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,IAAA,8BAAoB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAA,sBAAgB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IAC9G,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;AAChF,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AA2DH,kCA0DC;AAnHD,uCAA6D;AAC7D,yCAAmD;AACnD,+CAAyD;AACzD,mDAA6D;AAC7D,2CAAqD;AACrD,6CAAuD;AACvD,qCAA+C;AA2B/C;;;GAGG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO;QACL,YAAY,CAAC,IAAoB;YAC/B,OAAO,CAAC,YAAY,CAAC;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAA+B;oBACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACnF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,SAAS;YACP,OAAO,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAwB,eAAe,CAAC,OAAsC;IAC5E,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,GAAG,GAAc,OAAQ,OAAe,CAAC,SAAS,KAAK,UAAU;QACrE,CAAC,CAAC,OAAoB;QACtB,CAAC,CAAC,aAAa,CAAC,OAA4B,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAElC,MAAM,OAAO,GAAI,SAAS,CAAC,OAAkB,IAAI,SAAS,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACnG,MAAM,WAAW,GAAI,SAAS,CAAC,WAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU,CAAC;IAEpG,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAElF,6CAA6C;IAC7C,IAAI,GAAG,CAAC;IACR,IAAI,OAAO,CAAC;IAEZ,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9C,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAA,2BAAiB,EAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAE3E,MAAM,MAAM,GAAiB;QAC3B,GAAG,EAAE,GAAU;QACf,OAAO;QACP,OAAO,EAAG,SAAS,CAAC,OAAiC,IAAI,SAAS;QAClE,WAAW;QACX,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,uBAAuB;QACvE,SAAS,EAAE;YACT,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,UAAU,EAAE,YAAY,CAAC,UAAU,IAAI,YAAY;YACnD,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,aAAa;SACvD;QACD,eAAe,EAAE,SAAS,CAAC,eAAe,KAAK,KAAK;QACpD,iBAAiB,EAAG,SAAS,CAAC,iBAA4B,IAAI,QAAQ;KACvE,CAAC;IAEF,2BAA2B;IAC3B,IAAA,0BAAkB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAA,oCAAuB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,IAAA,4BAAmB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,IAAA,8BAAoB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAA,sBAAgB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IAC9G,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;AAChF,CAAC"}
@@ -6,6 +6,8 @@ export declare function validateAccountName(name: string, field?: string): void;
6
6
  export declare function validateScore(score: number): void;
7
7
  export declare function validateConfidence(confidence: number): void;
8
8
  export declare function validateUrl(url: string, field?: string): void;
9
+ /** Reset aggregate transfer tracking (for testing) */
10
+ export declare function resetTransferTracking(): void;
9
11
  export declare function validateAmount(amount: number, maxAmount: number): void;
10
12
  export declare function validatePositiveInt(value: number, field: string): void;
11
13
  export declare function validateRequired(value: unknown, field: string): void;
@@ -1 +1 @@
1
- {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/util/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAkB,GAAG,IAAI,CAUjF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOjD;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAO3D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,MAAc,GAAG,IAAI,CASpE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAOtE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAItE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIpE;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAI7D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAO3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD"}
1
+ {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/util/validate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAkB,GAAG,IAAI,CAUjF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOjD;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAO3D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,MAAc,GAAG,IAAI,CA8BpE;AAMD,sDAAsD;AACtD,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAwBtE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAItE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIpE;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAI7D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAO3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD"}
@@ -8,6 +8,7 @@ exports.validateAccountName = validateAccountName;
8
8
  exports.validateScore = validateScore;
9
9
  exports.validateConfidence = validateConfidence;
10
10
  exports.validateUrl = validateUrl;
11
+ exports.resetTransferTracking = resetTransferTracking;
11
12
  exports.validateAmount = validateAmount;
12
13
  exports.validatePositiveInt = validatePositiveInt;
13
14
  exports.validateRequired = validateRequired;
@@ -45,12 +46,36 @@ function validateUrl(url, field = 'url') {
45
46
  if (!url || typeof url !== 'string') {
46
47
  throw new Error(`${field} is required`);
47
48
  }
49
+ let parsed;
48
50
  try {
49
- new URL(url);
51
+ parsed = new URL(url);
50
52
  }
51
53
  catch {
52
54
  throw new Error(`${field} must be a valid URL`);
53
55
  }
56
+ // H5 AUDIT FIX: Block non-HTTP schemes and private/metadata endpoints
57
+ if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
58
+ throw new Error(`${field} must use http or https protocol`);
59
+ }
60
+ const hostname = parsed.hostname.toLowerCase();
61
+ // Block localhost variants
62
+ if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '0.0.0.0') {
63
+ throw new Error(`${field} must not point to localhost`);
64
+ }
65
+ // Block private IP ranges and cloud metadata
66
+ const blocked = [
67
+ /^10\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./, /^169\.254\./,
68
+ ];
69
+ if (blocked.some(p => p.test(hostname))) {
70
+ throw new Error(`${field} must not point to private IP ranges`);
71
+ }
72
+ }
73
+ // H3 AUDIT FIX: Session-level aggregate transfer tracking
74
+ const SESSION_TRANSFER_WINDOW_MS = 60 * 60 * 1000; // 1 hour
75
+ let sessionTransfers = [];
76
+ /** Reset aggregate transfer tracking (for testing) */
77
+ function resetTransferTracking() {
78
+ sessionTransfers = [];
54
79
  }
55
80
  function validateAmount(amount, maxAmount) {
56
81
  if (typeof amount !== 'number' || amount <= 0) {
@@ -59,6 +84,19 @@ function validateAmount(amount, maxAmount) {
59
84
  if (amount > maxAmount) {
60
85
  throw new Error(`amount exceeds maximum allowed (${maxAmount / 10000} XPR)`);
61
86
  }
87
+ // H3 AUDIT FIX: Enforce aggregate session limit (10x per-operation max per hour)
88
+ const now = Date.now();
89
+ const windowStart = now - SESSION_TRANSFER_WINDOW_MS;
90
+ // Prune old entries
91
+ while (sessionTransfers.length > 0 && sessionTransfers[0].timestamp < windowStart) {
92
+ sessionTransfers.shift();
93
+ }
94
+ const aggregateLimit = maxAmount * 10;
95
+ const currentAggregate = sessionTransfers.reduce((sum, t) => sum + t.amount, 0);
96
+ if (currentAggregate + amount > aggregateLimit) {
97
+ throw new Error(`Aggregate transfer limit exceeded (${aggregateLimit / 10000} XPR/hour). Try again later.`);
98
+ }
99
+ sessionTransfers.push({ amount, timestamp: now });
62
100
  }
63
101
  function validatePositiveInt(value, field) {
64
102
  if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
@@ -1 +1 @@
1
- {"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/util/validate.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAEH,kDAUC;AAED,sCAOC;AAED,gDAOC;AAED,kCASC;AAED,wCAOC;AAED,kDAIC;AAED,4CAIC;AAED,4DAIC;AAED,sDAOC;AAMD,gDAKC;AAtFD,SAAgB,mBAAmB,CAAC,IAAY,EAAE,QAAgB,SAAS;IACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAAkB;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,GAAW,EAAE,QAAgB,KAAK;IAC5D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,MAAc,EAAE,SAAiB;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,GAAG,KAAK,OAAO,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc,EAAE,KAAa;IAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CAAC,MAAc;IACrD,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAe;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC"}
1
+ {"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/util/validate.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAEH,kDAUC;AAED,sCAOC;AAED,gDAOC;AAED,kCA8BC;AAOD,sDAEC;AAED,wCAwBC;AAED,kDAIC;AAED,4CAIC;AAED,4DAIC;AAED,sDAOC;AAMD,gDAKC;AArID,SAAgB,mBAAmB,CAAC,IAAY,EAAE,QAAgB,SAAS;IACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB,CAAC,UAAkB;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,GAAW,EAAE,QAAgB,KAAK;IAC5D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IAED,sEAAsE;IACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IAED,6CAA6C;IAC7C,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,aAAa;KACpE,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAC5D,IAAI,gBAAgB,GAA4C,EAAE,CAAC;AAEnE,sDAAsD;AACtD,SAAgB,qBAAqB;IACnC,gBAAgB,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,SAAgB,cAAc,CAAC,MAAc,EAAE,SAAiB;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,GAAG,KAAK,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,iFAAiF;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,GAAG,0BAA0B,CAAC;IAErD,oBAAoB;IACpB,OAAO,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;QAClF,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,GAAG,EAAE,CAAC;IACtC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,gBAAgB,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC9G,CAAC;IAED,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc,EAAE,KAAa;IAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CAAC,MAAc;IACrD,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAe;IACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC"}
@@ -1,9 +1,8 @@
1
1
  {
2
- "id": "xpr-agents",
2
+ "id": "openclaw",
3
3
  "name": "XPR Agents",
4
4
  "configSchema": {
5
5
  "type": "object",
6
- "required": ["rpcEndpoint"],
7
6
  "properties": {
8
7
  "network": {
9
8
  "type": "string",
@@ -12,7 +11,8 @@
12
11
  },
13
12
  "rpcEndpoint": {
14
13
  "type": "string",
15
- "description": "XPR Network RPC endpoint URL (required)"
14
+ "description": "XPR Network RPC endpoint URL",
15
+ "default": "https://tn1.protonnz.com"
16
16
  },
17
17
  "indexerUrl": {
18
18
  "type": "string",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@xpr-agents/openclaw",
3
- "version": "0.2.11",
3
+ "version": "0.2.13",
4
4
  "description": "OpenClaw plugin for XPR Network Trustless Agent Registry - autonomous agent operation, escrow jobs, feedback, and validation",
5
5
  "author": "XPR Network",
6
6
  "repository": {