agent402-openclaw 0.1.0 → 0.1.2

package/README.md

@@ -11,7 +11,7 @@ Guide: https://agent402.tools/guides/openclaw-model-provider
 
 ```bash
 openclaw plugins install agent402-openclaw
-agent402-openclaw setup --credits-key a402_...   # buy a pack by card at https://agent402.tools/credits
+AGENT402_CREDITS_KEY=a402_... agent402-openclaw setup --write   # key by env (or `--credits-key -` on stdin); buy one by card at https://agent402.tools/credits
 openclaw gateway restart
 ```
 
@@ -38,12 +38,17 @@ wallet. The key never leaves the machine.
 `auto` (routed per prompt) plus every id from `GET https://agent402.tools/v1/models`,
 each routed to its home tier. Prices are per call, not per token, so OpenClaw's
 per-token cost fields are zero. A model sent to the wrong tier is answered with a
-400 naming the right one; nothing is charged. Every forwarded call carries an
-`Idempotency-Key`, so retries replay the paid answer instead of paying twice.
+400 naming the right one; nothing is charged. A client-supplied `Idempotency-Key`
+is passed through (an x402 retry with the same key replays the paid answer);
+without one, each call is its own payment.
+
+The proxy answers native clients on loopback only: requests carrying a browser
+`Origin` header or a non-loopback `Host` are refused, so a web page cannot spend
+the key.
 
 ## Commands
 
-- `agent402-openclaw setup [--credits-key K] [--write] [--port N]`
+- `agent402-openclaw setup [--credits-key K | --credits-key - (stdin) | AGENT402_CREDITS_KEY env] [--write] [--port N]`
 - `agent402-openclaw proxy [--port N] [--upstream URL]`
 - `agent402-openclaw doctor`
 

package/cli.js

@@ -3,7 +3,8 @@
 //   setup [--credits-key a402_...] [--write]   store the key, print (or merge) the openclaw.json block
 //   proxy [--port N] [--upstream URL]          run the local proxy on its own (no OpenClaw needed)
 //   doctor                                     show what is configured and whether the gateway answers
-import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync, statSync, realpathSync, renameSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { STATE_DIR, CREDITS_KEY_FILE, resolveCreditsKey, resolvePayFetch } from "./index.js";
@@ -43,7 +44,11 @@ async function main() {
   const port = Number(opt("--port")) || DEFAULT_PORT;
 
   if (cmd === "setup") {
-    const key = (opt("--credits-key") || "").trim();
+    // The key may arrive on argv (lands in shell history), via AGENT402_CREDITS_KEY,
+    // or on stdin with `--credits-key -` (the form the docs recommend).
+    let key = (opt("--credits-key") || "").trim();
+    if (key === "-") key = readFileSync(0, "utf8").trim();
+    if (!key && process.env.AGENT402_CREDITS_KEY && !has("--no-env")) key = process.env.AGENT402_CREDITS_KEY.trim();
     if (key) {
       if (!/^a402_[A-Za-z0-9_-]{16,80}$/.test(key)) { console.error("that does not look like an Agent402 credits key (a402_...)"); return 2; }
       mkdirSync(STATE_DIR(), { recursive: true });
@@ -64,9 +69,14 @@ async function main() {
         catch { console.error(`${cfgPath} is not plain JSON (JSON5 comments?); not touching it. Merge this block by hand:`); out(JSON.stringify(block, null, 2)); return 2; }
       }
       mkdirSync(join(cfgPath, ".."), { recursive: true });
+      // Preserve the file's mode (openclaw.json holds other providers' keys and
+      // is often 0600); a fresh file is created 0600. Never loosen it.
+      let mode = 0o600;
+      try { if (existsSync(cfgPath)) mode = statSync(cfgPath).mode & 0o777; } catch { /* keep 0600 */ }
       const tmp = `${cfgPath}.${process.pid}.tmp`;
-      writeFileSync(tmp, JSON.stringify(mergeInto(existing, block), null, 2) + "\n");
-      const { renameSync } = await import("node:fs"); renameSync(tmp, cfgPath);
+      writeFileSync(tmp, JSON.stringify(mergeInto(existing, block), null, 2) + "\n", { mode });
+      try { chmodSync(tmp, mode); } catch { /* best effort */ }
+      renameSync(tmp, cfgPath);
       out(`wrote provider "${PROVIDER_ID}" + primary model ${PROVIDER_ID}/auto into ${cfgPath}; run: openclaw gateway restart`);
     } else {
       out(`add to ${cfgPath} (or rerun with --write):`);
@@ -102,6 +112,13 @@ async function main() {
   console.error(`unknown command: ${cmd}`); return 2;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Entry guard that survives npm's bin SYMLINK and paths with spaces: Node
+// resolves import.meta.url to the real path but leaves process.argv[1] as the
+// symlink, so a plain string compare is false for every `npx`/global install
+// and the CLI silently did nothing (0.1.0 and 0.1.1 shipped that way).
+function invokedDirectly() {
+  try { return import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href; } catch { return false; }
+}
+if (invokedDirectly()) {
   main().then((c) => process.exit(c ?? 0), (e) => { console.error(e?.message || e); process.exit(1); });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-openclaw",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "OpenClaw model provider for Agent402: auto-routed and explicit LLM models at a flat per-call price, paid by card (prepaid credits key) or in USDC over x402 through a local proxy. Zero dependencies; x402 wallet payment is an optional peer.",
   "type": "module",
   "main": "index.js",

package/proxy.js

@@ -14,14 +14,24 @@
 // gateway's own GET /v1/models at start (never a hand-typed table). "auto"
 // goes to the routed tier with the model field omitted.
 //
-// Retries are safe: every forwarded request carries a fresh Idempotency-Key,
-// so a client retry of the same request replays the paid response instead of
-// paying twice. Streams pass through byte for byte.
+// Idempotency: a client-supplied Idempotency-Key is passed through so an
+// x402 retry with the same key replays the paid answer server-side; without
+// one each forwarded call gets a fresh key (a safety for the fetch layer's
+// own 402->pay retry), which does NOT make two client calls one payment.
+// Streams pass through byte for byte.
+//
+// Loopback only, and browser-hostile on purpose: any web page can POST to
+// 127.0.0.1 with a "simple" no-cors request, and this proxy spends the
+// user's key, so a request carrying an Origin header (browsers always send
+// one on cross-origin POSTs; native clients send none) or a Host that is
+// not loopback is refused before anything is forwarded.
 import { createServer } from "node:http";
+import { readFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { AUTO_ID, routesFromCatalog, stripTrailingSlashes } from "./models.js";
 
 export const DEFAULT_UPSTREAM = "https://agent402.tools";
+export const PKG_VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;
 const MAX_BODY = 2 * 1024 * 1024;
 
 export async function loadRoutes(upstream, fetchImpl = fetch) {
@@ -67,6 +77,13 @@ export async function startProxy({ upstream = DEFAULT_UPSTREAM, creditsKey = nul
     stats.requests++;
     const url = new URL(req.url, "http://localhost");
     try {
+      if (req.headers.origin !== undefined) {
+        return json(res, 403, { error: { message: "Browser-origin requests are refused: this proxy spends a payment key and answers native clients only.", type: "forbidden" } });
+      }
+      const hostName = String(req.headers.host || "").replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+      if (hostName && !["127.0.0.1", "localhost", "::1"].includes(hostName)) {
+        return json(res, 403, { error: { message: `Host "${hostName.slice(0, 64)}" is not loopback; refused.`, type: "forbidden" } });
+      }
       if (req.method === "GET" && url.pathname === "/health") {
         return json(res, 200, { ok: true, upstream, mode, models: table.size, stats });
       }
@@ -87,7 +104,8 @@ export async function startProxy({ upstream = DEFAULT_UPSTREAM, creditsKey = nul
         }
         const outbound = { ...body };
         if (requested === AUTO_ID) delete outbound.model; else outbound.model = route.id;
-        const headers = { "content-type": "application/json", accept: req.headers.accept || "application/json", "idempotency-key": randomUUID(), "user-agent": "agent402-openclaw/0.1.0" };
+        const clientIdem = typeof req.headers["idempotency-key"] === "string" && /^[\w.:-]{8,128}$/.test(req.headers["idempotency-key"]) ? req.headers["idempotency-key"] : null;
+        const headers = { "content-type": "application/json", accept: req.headers.accept || "application/json", "idempotency-key": clientIdem || randomUUID(), "user-agent": `agent402-openclaw/${PKG_VERSION}` };
         if (key) headers.authorization = `Bearer ${key}`;
         const up = await paid(`${upstream}${route.endpoint}`, { method: "POST", headers, body: JSON.stringify(outbound), signal: AbortSignal.timeout(300_000) });
         stats.forwarded++;