agent402-openclaw 0.4.1 → 0.4.3

package/README.md

@@ -1,5 +1,7 @@
 # agent402-openclaw
 
+Part of [Agent402](https://agent402.tools), the open-source paid door for AI agents.
+
 Agent402 as an [OpenClaw](https://openclaw.ai) model provider: auto-routed and
 explicit frontier models at a **flat per-call price**, paid **by card** (a prepaid
 credits key, no wallet) or in **USDC over x402** from a wallet. The same key and
@@ -46,6 +48,7 @@ client at `http://127.0.0.1:8412/v1` with model `auto`.
 ```bash
 npm i @x402/fetch @x402/evm viem
 export AGENT402_WALLET_KEY=0x...     # an EVM key holding USDC on Base
+export AGENT402_MAX_PER_CALL_USD=2   # per-call ceiling checked before signing (default 2, the gateway's metered cap; 0 disables)
 ```
 
 With no credits key present the proxy signs an x402 payment per call from that

package/index.js

@@ -47,10 +47,44 @@ export const PERMIT2_READY_MIN = 10n ** 12n; // 1,000,000 USDC (6 decimals): a r
 
 /** Which 402 accept to pay: upto on Base when the client can (settle-actual),
  *  else exact on Base, else the first the client supports. Pure. */
-export function selectAccept(accepts, { preferUpto = true } = {}) {
+/** Per-call ceiling in USD, enforced in the accept selector so an over-cap quote
+ *  is refused BEFORE anything is signed. @x402/core 2.23+ ships a $1
+ *  pegged-assets default on every client; this package turns that off (it would
+ *  refuse USDG and gave an opaque vendor error on any metered turn over $1) and
+ *  carries its own ceiling under its own name. The default is $2, the gateway's
+ *  own metered quote cap (GATEWAY_METERED_MAX_QUOTE_USD), so no call the gateway
+ *  would serve is refused here while a runaway quote still stops at the wallet.
+ *  `maxPerCallUsd` in the plugin config or AGENT402_MAX_PER_CALL_USD; `0`/`off`
+ *  disables; a malformed value reads as the default, never as off. */
+export const DEFAULT_MAX_PER_CALL_USD = 2;
+export function maxPerCallUsd(pluginConfig = {}) {
+  const raw = String(pluginConfig.maxPerCallUsd ?? process.env.AGENT402_MAX_PER_CALL_USD ?? "").trim().toLowerCase();
+  if (raw === "0" || raw === "off") return Infinity;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_MAX_PER_CALL_USD;
+}
+/** Dollar value of an accept's quote: `amount` (v2) or `maxAmountRequired` (v1)
+ *  in base units over the asset's `extra.decimals` (USDC on Base: 6). Unknown
+ *  shape reads as null, and null is REFUSED under a finite ceiling: a quote we
+ *  cannot read is not one we sign. */
+export function acceptUsd(accept) {
+  const raw = accept?.amount ?? accept?.maxAmountRequired;
+  if (raw == null || !/^\d+$/.test(String(raw))) return null;
+  const dec = Number(accept?.extra?.decimals ?? 6);
+  if (!Number.isInteger(dec) || dec < 0 || dec > 36) return null;
+  return Number(raw) / 10 ** dec;
+}
+export function selectAccept(accepts, { preferUpto = true, maxUsd = Infinity } = {}) {
   const list = Array.isArray(accepts) ? accepts : [];
-  if (preferUpto) { const u = list.find((a) => a?.scheme === "upto" && a?.network === BASE_CAIP2); if (u) return u; }
-  return list.find((a) => a?.scheme === "exact" && a?.network === BASE_CAIP2) || list[0];
+  const pick = (preferUpto && list.find((a) => a?.scheme === "upto" && a?.network === BASE_CAIP2))
+    || list.find((a) => a?.scheme === "exact" && a?.network === BASE_CAIP2) || list[0];
+  if (pick && Number.isFinite(maxUsd)) {
+    const usd = acceptUsd(pick);
+    if (usd == null || usd > maxUsd) {
+      throw new Error(`agent402-openclaw: quote ${usd == null ? "unreadable" : `$${usd}`} exceeds the per-call ceiling $${maxUsd} (maxPerCallUsd / AGENT402_MAX_PER_CALL_USD; 0 disables)`);
+    }
+  }
+  return pick;
 }
 export const uptoReady = (allowance) => { try { return BigInt(allowance ?? 0) >= PERMIT2_READY_MIN; } catch { return false; } };
 
@@ -70,7 +104,9 @@ export async function resolvePayFetch(pluginConfig = {}, log = () => {}) {
       const pub = createPublicClient({ chain: base, transport: http((pluginConfig.baseRpc || process.env.AGENT402_BASE_RPC || DEFAULT_BASE_RPC).trim()) });
       const allowance = await pub.readContract(getPermit2AllowanceReadParams({ tokenAddress: USDC_BASE, ownerAddress: account.address }));
       upto = uptoReady(allowance);
-      const client = new x402Client((v, accepts) => selectAccept(accepts, { preferUpto: upto }));
+      const maxUsd = maxPerCallUsd(pluginConfig);
+      const client = new x402Client((v, accepts) => selectAccept(accepts, { preferUpto: upto, maxUsd }));
+      client.setSpendControls?.(false); // the vendor default ($1, pegged assets only) would refuse USDG and any quote over $1; selectAccept enforces our own maxPerCallUsd (same $1 default) instead
       registerExactEvmScheme(client, { signer });
       if (upto) client.register(BASE_CAIP2, new UptoEvmScheme(signer));
       log(upto
@@ -80,7 +116,8 @@ export async function resolvePayFetch(pluginConfig = {}, log = () => {}) {
     } catch (e) {
       // The allowance read or the upto scheme failed: exact still works.
       log(`[agent402-openclaw] upto unavailable (${String(e?.message || e).slice(0, 120)}) - paying exact`);
-      const client = new x402Client((v, accepts) => selectAccept(accepts, { preferUpto: false }));
+      const client = new x402Client((v, accepts) => selectAccept(accepts, { preferUpto: false, maxUsd: maxPerCallUsd(pluginConfig) }));
+      client.setSpendControls?.(false); // the vendor default ($1, pegged assets only) would refuse USDG and any quote over $1; selectAccept enforces our own maxPerCallUsd (same $1 default) instead
       registerExactEvmScheme(client, { signer });
       return wrapFetchWithPayment(fetch, client);
     }

package/models.js

@@ -77,7 +77,13 @@ export function routesFromCatalog(catalog, { pricing = "metered" } = {}) {
 
 /** Preferred primaries, in order: capable tool-callers that are cheap when
  *  metered. Only consulted among routes that can hold OpenClaw's prompt. */
-const PRIMARY_PREFERENCE = ["anthropic/claude-haiku-4.5", "openai/gpt-4.1-mini", "google/gemini-2.5-flash", "openai/gpt-4o-mini"];
+// Exported so the gateway's live-catalog guard (scripts/test-gateway-model-ids.js)
+// fails the day any of these ids carries an expiration date upstream: the first
+// pick is haiku-4.5, whose retirement floor is 2026-10-15 with no notice yet.
+// google/gemini-2.5-flash left this list 2026-09-18: the live catalog stamps it
+// expiration_date 2026-10-20, which is exactly what that guard was written to
+// catch on its first run.
+export const PRIMARY_PREFERENCE = ["anthropic/claude-haiku-4.5", "openai/gpt-4.1-mini", "openai/gpt-4o-mini"];
 
 /** The route OpenClaw should make its primary model: the first preferred id
  *  that fits OPENCLAW_MIN_INPUT_CHARS, else the cheapest fitting one, else

package/openclaw.plugin.json

@@ -1,5 +1,5 @@
 {
-  "id": "agent402-openclaw",
+  "id": "agent402",
   "name": "Agent402",
   "description": "Agent402 model provider: auto-routed and explicit frontier models at a flat per-call price, paid by card (prepaid credits key) or in USDC over x402. Same key reaches 500+ pay-per-call tools.",
   "activation": {
@@ -36,6 +36,13 @@
           "flat"
         ],
         "description": "metered (default): explicit models pay a per-request quote; flat: every model on its flat tier."
+      },
+      "maxPerCallUsd": {
+        "type": [
+          "number",
+          "string"
+        ],
+        "description": "Per-call ceiling in USD for wallet (x402) payments, checked before signing (default 2, the gateway's metered quote cap; 0 or \"off\" disables). Also AGENT402_MAX_PER_CALL_USD."
       }
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-openclaw",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "OpenClaw model provider for Agent402: auto-routed and explicit LLM models at a flat per-call price, paid by card (prepaid credits key) or in USDC over x402 through a local proxy. Zero dependencies; x402 wallet payment is an optional peer.",
   "type": "module",
   "main": "index.js",
@@ -26,13 +26,13 @@
       "./index.js"
     ],
     "compat": {
-      "pluginApi": ">=2026.8.1"
+      "pluginApi": ">=2026.7.1"
     },
     "build": {
       "openclawVersion": "2026.8.1"
     },
     "install": {
-      "minHostVersion": ">=2026.8.1",
+      "minHostVersion": ">=2026.7.1",
       "npmSpec": "agent402-openclaw"
     }
   },

package/provider.js

@@ -14,7 +14,7 @@ export const PROVIDER_ID = "agent402";
 // started checking. Writing config under the provider id while the host reads
 // it under the manifest id is the same defect as the 2026-08-26 --port bug,
 // where setup moved the baseUrl and the service kept reading the old key.
-export const PLUGIN_ID = "agent402-openclaw";
+export const PLUGIN_ID = "agent402";
 export const DEFAULT_PORT = 8412;
 
 let activeProxy = null;