agent402-client 0.8.5 → 0.8.7

package/index.js

@@ -23,13 +23,12 @@ import { createHash, randomBytes } from "node:crypto";
 // `User-Agent: agent402-client/<version>` - a standard header, no extra
 // network calls - so a seller can attribute traffic (and settled payments)
 // to this SDK. Product token only; nothing about the caller rides along.
-const VERSION = "0.8.5";
+const VERSION = "0.8.7";
 const USER_AGENT = `agent402-client/${VERSION}`;
 // 32MB: about a hundred times any realistic response from this catalog (the
 // largest is a base64 image at a few MB), so it cannot break a legitimate
 // caller, while still stopping the class it exists for. A ceiling that is off
 // by default protects nobody, so this one is on; pass null to disable it.
-const FAILURE_DETAIL_MAX_CHARS = 2_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 32 * 1024 * 1024;
 
 const leadingZeroBits = (buf) => { let n = 0; for (const b of buf) { if (b === 0) { n += 8; continue; } n += Math.clz32(b) - 24; break; } return n; };
@@ -366,7 +365,7 @@ export class Agent402 {
         let settled = false;
         try {
           const r = await send({}, this.payFetch);
-          if (!r.ok) throw new Error(await this._failureDetail(slug, r));
+          if (!r.ok) throw this._fail(slug, r, await this._failureDetail(slug, r));
           this._spendSettle(reservation); // confirm the reservation as settled spend
           settled = true;
           return this._deliverResponse(slug, r, cacheKey, cache, validator, { maxResponseBytes, paid: true });
@@ -389,9 +388,9 @@ export class Agent402 {
           const r = await send({ Authorization: `Bearer ${this.creditsKey}` });
           if (r.status === 402) {
             const body = await r.json().catch(() => ({}));
-            throw new Error(`call "${slug}" refused by credits: ${body.error || "payment required"}${body.balanceUsd != null ? ` (balance $${body.balanceUsd})` : ""} - top up at ${body.topup || `${this.baseUrl}/credits`}`);
+            throw this._fail(slug, r, `call "${slug}" refused by credits: ${body.error || "payment required"}${body.balanceUsd != null ? ` (balance $${body.balanceUsd})` : ""} - top up at ${body.topup || `${this.baseUrl}/credits`}`);
           }
-          if (!r.ok) throw new Error(await this._failureDetail(slug, r));
+          if (!r.ok) throw this._fail(slug, r, await this._failureDetail(slug, r));
           this._spendSettle(reservation);
           settled = true;
           return this._deliverResponse(slug, r, cacheKey, cache, validator, { maxResponseBytes, paid: true });
@@ -399,7 +398,7 @@ export class Agent402 {
       }
       const r = await send(); // no wallet - succeeds only on a FREE_MODE instance
       if (r.ok) return this._deliverResponse(slug, r, cacheKey, cache, validator, { maxResponseBytes, paid: false });
-      throw new Error(`call "${slug}" failed: HTTP ${r.status} - wallet-only tool; construct with { fetch: payFetch } (an @x402/fetch-wrapped fetch) or { creditsKey } (prepaid card credits from ${this.baseUrl}/credits)`);
+      throw this._fail(slug, r, `call "${slug}" failed: HTTP ${r.status} - wallet-only tool; construct with { fetch: payFetch } (an @x402/fetch-wrapped fetch) or { creditsKey } (prepaid card credits from ${this.baseUrl}/credits)`);
     }
 
     // Free (compute-payable) tool: succeeds plainly on a FREE_MODE instance,
@@ -410,7 +409,7 @@ export class Agent402 {
       const chal = await this._powChallenge(slug);
       r = await send({ "X-Pow-Solution": Agent402.solvePow(chal) });
     }
-    if (!r.ok) throw new Error(await this._failureDetail(slug, r, " after proof-of-work"));
+    if (!r.ok) throw this._fail(slug, r, await this._failureDetail(slug, r, " after proof-of-work"));
     return this._deliverResponse(slug, r, cacheKey, cache, validator, { maxResponseBytes, paid: false });
   }
 
@@ -479,8 +478,20 @@ export class Agent402 {
   /** The message for a failed call CARRIES THE SELLER'S OWN DETAIL. Agent402's
    *  4xx bodies are self-explaining ({error, tool, expected}); a message that
    *  said only "HTTP 400" threw that away, and an agent reading it could not
-   *  correct its input (elizaOS registry review, 2026-09-14). Bounded, and a
-   *  body that is not JSON contributes nothing but its status. */
+   *  correct its input (elizaOS registry review, 2026-09-14). WHOLE: 0.8.4
+   *  cut the detail at 2,000 characters and 0.8.5 said so when it cut, and
+   *  the same review measured a 2,517-character seller error reaching the
+   *  model without its end (2026-09-16). The body is already bounded before
+   *  it is parsed (maxResponseBytes, 32 MB default), so a second cut here
+   *  protected nothing and lost the part of the message an agent needs to
+   *  act on. A body that is not JSON contributes nothing but its status. */
+  /** A refusal a caller can branch on: `status` (the HTTP status), `slug` and
+   *  `paid: false` ride on the Error, so a 402 is not something to regex out of
+   *  the message. Nothing was spent on any path that reaches this. */
+  _fail(slug, r, message) {
+    return Object.assign(new Error(message), { status: r?.status, slug, paid: false });
+  }
+
   async _failureDetail(slug, r, when = "") {
     let detail = "";
     try {
@@ -489,11 +500,7 @@ export class Agent402 {
       if (msg != null) detail = ` - ${typeof msg === "string" ? msg : JSON.stringify(msg)}`;
       if (body?.expected != null) detail += ` (expected: ${JSON.stringify(body.expected)})`;
     } catch { /* not JSON: the status is the whole story */ }
-    // A seller-authored body is untrusted, so the detail is bounded - and a
-    // bound that cuts says so, with the length it cut, rather than ending
-    // mid-sentence as if that were the whole message.
-    const cut = detail.length > FAILURE_DETAIL_MAX_CHARS ? `${detail.slice(0, FAILURE_DETAIL_MAX_CHARS)} [${detail.length - FAILURE_DETAIL_MAX_CHARS} more characters not shown]` : detail;
-    return `call "${slug}" failed${when}: HTTP ${r.status}${cut}`;
+    return `call "${slug}" failed${when}: HTTP ${r.status}${detail}`;
   }
 
   /** True if any spending ceiling is configured (worth preflighting the 402). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-client",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Agent402 buyer SDK: resolve a task to a tool across 500+ pay-per-call endpoints and call it with payment handled - free via proof-of-work, or over x402 or MPP (a stock mppx fetch works) with a wallet you keep; the buy side of Agentic Finance. Caching, idempotent retries (Idempotency-Key), non-custodial, zero dependencies.",
   "type": "module",
   "main": "index.js",