agent402-openclaw 0.5.9 → 0.5.11

package/README.md

@@ -87,6 +87,13 @@ signs; an option in any other asset is not signed while a ceiling is set. Once
 the payment is built, the amount it actually signs is read back and checked
 against the same price and ceiling before it is sent.
 
+A signed payment also has a validity ceiling of 24 hours: a payment option
+that asks to stay redeemable for longer (its `maxTimeoutSeconds`) is not
+signed, and a built payment whose expiry (`validBefore` or the Permit2
+`deadline`) lies more than 24 hours out is refused before it is sent. Any
+refusal happens before the payment leaves the machine, and the call's error
+names the reason.
+
 To run with no ceiling, set `maxPerCallUsd` to `0` or `"off"` together with
 `allowUncappedPayments: true` (or `AGENT402_ALLOW_UNCAPPED_PAYMENTS=true`).
 Without that acknowledgment `off` keeps the default ceiling and the proxy
@@ -125,6 +132,11 @@ The proxy answers native clients on loopback only: requests carrying a browser
 `Origin` header or a non-loopback `Host` are refused, so a web page cannot spend
 the key.
 
+The credits key stays out of what the proxy prints: an upstream or network
+error is logged and answered (the 502 body) with the key cut out as
+`[redacted]`, and `agent402-openclaw doctor` reports the key as `present` or
+`none`, never any part of it.
+
 ## Commands
 
 - `agent402-openclaw setup [--credits-key K | --credits-key - (stdin) | AGENT402_CREDITS_KEY env] [--no-wallet] [--write] [--port N] [--flat]`

package/cli.js

@@ -187,7 +187,7 @@ async function main() {
     const key = resolveCreditsKey();
     const walletPk = resolveWalletKey();
     out(`upstream: ${upstream}`);
-    out(`credits key: ${key ? `present (${key.slice(0, 8)}…)` : "none"}`);
+    out(`credits key: ${key ? "present" : "none"}`);
     out(`wallet key: ${walletPk ? "present" : "none"}`);
     if (walletPk) {
       try {

package/index.js

@@ -8,8 +8,8 @@ import { join } from "node:path";
 import { buildProvider, setActiveProxy, setCachedRoutes, DEFAULT_PORT, PLUGIN_ID } from "./provider.js";
 import { startProxy, loadRoutes, DEFAULT_UPSTREAM } from "./proxy.js";
 import { stripTrailingSlashes } from "./models.js";
-import { acceptUsd, guardSignedAmount } from "./known-assets.js";
-export { acceptUsd, acceptAmount, signedPaymentProblem, KNOWN_ASSETS } from "./known-assets.js";
+import { acceptUsd, guardSignedAmount, acceptValidityTooLong, MAX_VALIDITY_SECONDS } from "./known-assets.js";
+export { acceptUsd, acceptAmount, signedPaymentProblem, signedValidityProblem, KNOWN_ASSETS, MAX_VALIDITY_SECONDS } from "./known-assets.js";
 
 export const STATE_DIR = () => join(process.env.AGENT402_OPENCLAW_HOME || join(homedir(), ".openclaw"), "agent402");
 export const CREDITS_KEY_FILE = () => join(STATE_DIR(), "credits.key");
@@ -87,9 +87,13 @@ export function maxPerCallUsd(pluginConfig = {}) {
 // at different values, reads as null, and null is REFUSED under a finite
 // ceiling: a quote we cannot price is not one we sign. After the payload is
 // built, guardSignedAmount checks the amount actually signed against the same
-// figure and the ceiling before anything is sent.
+// figure and the ceiling before anything is sent. An accept that asks to stay
+// valid past MAX_VALIDITY_SECONDS (a day) is never a candidate, ceiling or no
+// ceiling: the signed authorization would be a bearer claim for that long.
 export function selectAccept(accepts, { preferUpto = true, maxUsd = Infinity, x402Version = undefined } = {}) {
-  const list = Array.isArray(accepts) ? accepts : [];
+  const offered = Array.isArray(accepts) ? accepts : [];
+  const list = offered.filter((a) => !acceptValidityTooLong(a));
+  if (offered.length && !list.length) throw new Error(`agent402-openclaw: every payment option asks to stay valid for more than ${MAX_VALIDITY_SECONDS} seconds; nothing was signed`);
   const pick = (preferUpto && list.find((a) => a?.scheme === "upto" && a?.network === BASE_CAIP2))
     || list.find((a) => a?.scheme === "exact" && a?.network === BASE_CAIP2) || list[0];
   if (pick && Number.isFinite(maxUsd)) {

package/known-assets.js

@@ -12,6 +12,12 @@
 // and a buyer with a cap does not sign it. The table is keyed by CAIP-2 ids
 // only: a bare v1 network name (for example "base") is not priced.
 //
+// An entry may also name its token's EIP-712 domain (`name` and `version`,
+// read from the token's own name() and version()). An EVM "exact" signer
+// signs under the domain the accept's `extra` carries, so for such an entry
+// an accept whose `extra.name` or `extra.version` is not exactly the token's
+// cannot be priced either, and a buyer with a cap does not sign it.
+//
 // The same file ships in agent402-client, agent402-mcp and agent402-openclaw;
 // the parent repo's scripts/test-known-assets.js keeps the copies identical and
 // checks the table against the assets the server offers.
@@ -29,6 +35,7 @@ export const KNOWN_ASSETS = Object.freeze({
   "eip155:1329": [{ asset: "0xe15fC38F6D8c56aF07bbCBe3BAf5708A2Bf42392", decimals: 6, symbol: "USDC" }], // Sei
   "eip155:10": [{ asset: "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85", decimals: 6, symbol: "USDC" }], // Optimism
   "eip155:5042": [{ asset: "0x3600000000000000000000000000000000000000", decimals: 6, symbol: "USDC" }], // Arc
+  "eip155:57073": [{ asset: "0x2D270e6886d130D724215A266106e6832161EAEd", decimals: 6, symbol: "USDC", name: "USDC", version: "2" }], // Ink
   "eip155:4663": [{ asset: "0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168", decimals: 6, symbol: "USDG" }], // Robinhood Chain
   // Solana: the USDC mint.
   "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp": [{ asset: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", decimals: 6, symbol: "USDC" }],
@@ -56,6 +63,7 @@ export const NETWORK_NAMES = Object.freeze({
   sei: ["eip155:1329"],
   optimism: ["eip155:10"],
   arc: ["eip155:5042"],
+  ink: ["eip155:57073"],
   robinhood: ["eip155:4663"],
   solana: ["solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],
   "solana-devnet": ["solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1"],
@@ -88,6 +96,15 @@ export function knownAsset(network, asset) {
   return list.find((e) => sameAsset(e.asset, asset)) || null;
 }
 
+/** True when the accept carries the EIP-712 domain the table names for its
+ *  asset (`extra.name` and `extra.version`, exactly), or when the entry names
+ *  none. */
+export function acceptDomainMatches(entry, accept) {
+  if (!entry || (entry.name == null && entry.version == null)) return true;
+  const extra = accept && typeof accept.extra === "object" && accept.extra ? accept.extra : {};
+  return extra.name === entry.name && extra.version === entry.version;
+}
+
 /** The base-unit amount the signer of `x402Version` signs for one accept, as
  *  a string of digits: `maxAmountRequired` under v1, `amount` under v2. With
  *  no version, the one field present (or both, when they agree). null when
@@ -111,12 +128,13 @@ export function acceptAmount(accept, x402Version = undefined) {
 
 /** The USD value of one accept: the base-unit amount its version's signer
  *  signs (acceptAmount) over the KNOWN decimals of its asset. null when the
- *  asset is not known or the amount cannot be read. */
+ *  asset is not known, when the accept names a different EIP-712 domain than
+ *  the table's for that asset, or when the amount cannot be read. */
 export function acceptUsd(accept, x402Version = undefined) {
   const raw = acceptAmount(accept, x402Version);
   if (raw == null) return null;
   const entry = knownAsset(accept.network, accept.asset);
-  if (!entry) return null;
+  if (!entry || !acceptDomainMatches(entry, accept)) return null;
   return Number(raw) / 10 ** entry.decimals;
 }
 
@@ -134,6 +152,51 @@ export function quoteOf(accepts, x402Version = undefined) {
   return { max, min, unknown, total: accepts.length };
 }
 
+// The longest a signed payment may stay redeemable. An EVM "exact" signer
+// sets validBefore (EIP-3009) or deadline (Permit2) to the moment of signing
+// plus the accept's maxTimeoutSeconds, and the signed payload is a bearer
+// claim until then, so a seller that quotes years gets an authorization it
+// could redeem for years and a held amount that never stops counting. Honest
+// accepts ask for minutes (Agent402's own ask 300 s); a day admits every
+// one of them. An accept that asks for longer is dropped before selection,
+// and a payload signed past it is refused before it is sent.
+export const MAX_VALIDITY_SECONDS = 24 * 3600;
+// Signing reads the clock a moment before the check after it does.
+const VALIDITY_CLOCK_SLACK_SECONDS = 60;
+
+/** True when an accept asks for a validity window past MAX_VALIDITY_SECONDS.
+ *  An accept with no readable maxTimeoutSeconds is left to the check of what
+ *  was signed (signedValidityProblem). */
+export function acceptValidityTooLong(accept, maxSeconds = MAX_VALIDITY_SECONDS) {
+  const raw = accept?.maxTimeoutSeconds;
+  if (raw == null || raw === "") return false;
+  const n = Number(raw);
+  return !Number.isFinite(n) || n > maxSeconds;
+}
+
+/** The expiry a signed payload carries, in unix seconds: an EIP-3009
+ *  `authorization.validBefore` or a Permit2 `deadline`. null when the payload
+ *  names none (a Solana transaction, an unknown scheme). NaN when it names
+ *  one that is not a whole number of seconds. */
+export function signedExpirySeconds(paymentPayload) {
+  const p = paymentPayload?.payload;
+  const v = p?.authorization?.validBefore ?? p?.permit2Authorization?.deadline;
+  if (v == null) return null;
+  return /^\d{1,15}$/.test(String(v)) ? Number(v) : NaN;
+}
+
+/** Why a created payment payload stays redeemable for too long, or null: its
+ *  expiry is past `nowMs` plus `maxSeconds` (and a minute of clock slack), or
+ *  it names an expiry that cannot be read. */
+export function signedValidityProblem(paymentPayload, { maxSeconds = MAX_VALIDITY_SECONDS, nowMs = Date.now() } = {}) {
+  const exp = signedExpirySeconds(paymentPayload);
+  if (exp == null) return null;
+  if (!Number.isFinite(exp)) return "the signed authorization's expiry cannot be read";
+  const left = exp - Math.floor(nowMs / 1000);
+  if (left > maxSeconds + VALIDITY_CLOCK_SLACK_SECONDS) return `the signed authorization stays valid for ${left} seconds, past the ${maxSeconds}-second ceiling`;
+  return null;
+}
+
 /** Enforce a USD allowance at signing on an @x402/core x402Client.
  *
  *  `allowance()` is the most this buyer may sign for the payment being built
@@ -141,8 +204,10 @@ export function quoteOf(accepts, x402Version = undefined) {
  *  for none). A registered policy drops every accept that cannot be priced or
  *  is over the allowance, so the client selects among the ones that fit, and a
  *  hook before payload creation checks the selected accept again and passes
- *  its USD value to `onSign`. A refusal throws (from the policy) or aborts
- *  (from the hook) before any signature exists; `onRefuse` hears why first. */
+ *  its USD value to `onSign`. An accept asking for a validity window past
+ *  MAX_VALIDITY_SECONDS is dropped and refused the same way. A refusal throws
+ *  (from the policy) or aborts (from the hook) before any signature exists;
+ *  `onRefuse` hears why first. */
 export function guardSigning(client, { allowance, onSign = null, onRefuse = null }) {
   if (!client || typeof client.registerPolicy !== "function" || typeof client.onBeforePaymentCreation !== "function") {
     throw new TypeError("guardSigning needs an @x402/core x402Client (registerPolicy and onBeforePaymentCreation)");
@@ -151,7 +216,12 @@ export function guardSigning(client, { allowance, onSign = null, onRefuse = null
   const refuse = (detail) => { try { onRefuse?.(detail); } catch { /* the refusal stands */ } return detail; };
   client.registerPolicy((version, accepts) => {
     const cap = allowance();
-    const kept = accepts.filter((a) => { const usd = acceptUsd(a, version); return usd != null && usd <= cap; });
+    const priced = accepts.filter((a) => { const usd = acceptUsd(a, version); return usd != null && usd <= cap; });
+    const kept = priced.filter((a) => !acceptValidityTooLong(a));
+    if (!kept.length && priced.length) {
+      const d = refuse({ reason: "validity", priceUsd: null, allowanceUsd: cap, detail: `every payment option it may sign asks to stay valid for more than ${MAX_VALIDITY_SECONDS} seconds` });
+      throw new Error(`spending guard: ${d.detail}; nothing was signed`);
+    }
     if (!kept.length) {
       const q = quoteOf(accepts, version);
       const d = refuse({ reason: q && q.min != null ? "over-allowance" : "unknown-asset", priceUsd: q ? q.min : null, allowanceUsd: cap });
@@ -172,6 +242,10 @@ export function guardSigning(client, { allowance, onSign = null, onRefuse = null
       refuse({ reason: "over-allowance", priceUsd: usd, allowanceUsd: cap });
       return { abort: true, reason: `spending guard: the selected payment option asks $${usd}, above the $${cap} this buyer may sign; nothing was signed` };
     }
+    if (acceptValidityTooLong(r)) {
+      const d = refuse({ reason: "validity", priceUsd: usd, allowanceUsd: cap, detail: `the selected payment option asks to stay valid for ${r.maxTimeoutSeconds} seconds, past the ${MAX_VALIDITY_SECONDS}-second ceiling` });
+      return { abort: true, reason: `spending guard: ${d.detail}; nothing was signed` };
+    }
     onSign?.(usd, r);
     return undefined;
   });
@@ -252,9 +326,10 @@ export async function signedPaymentProblem(paymentPayload, requirements, x402Ver
 }
 
 /** Refuse to send a payment payload whose signed amount is not the one the
- *  allowance passed: registered after payload creation, so the check reads
- *  what was actually signed, and a throw here stops the payment-aware fetch
- *  before the payload leaves the process. guardSigning registers it; a
+ *  allowance passed, or whose expiry is past MAX_VALIDITY_SECONDS from now
+ *  (signedValidityProblem): registered after payload creation, so the check
+ *  reads what was actually signed, and a throw here stops the payment-aware
+ *  fetch before the payload leaves the process. guardSigning registers it; a
  *  client with its own selector (and no guardSigning) can register it alone. */
 export function guardSignedAmount(client, { allowance = () => Infinity, onRefuse = null } = {}) {
   if (!client || typeof client.onAfterPaymentCreation !== "function") {
@@ -262,9 +337,10 @@ export function guardSignedAmount(client, { allowance = () => Infinity, onRefuse
   }
   client.onAfterPaymentCreation(async ({ paymentRequired, selectedRequirements: r, paymentPayload }) => {
     const cap = allowance();
-    const problem = await signedPaymentProblem(paymentPayload, r, paymentRequired?.x402Version, cap);
+    const amountProblem = await signedPaymentProblem(paymentPayload, r, paymentRequired?.x402Version, cap);
+    const problem = amountProblem || signedValidityProblem(paymentPayload);
     if (!problem) return;
-    try { onRefuse?.({ reason: "signed-amount", priceUsd: null, allowanceUsd: cap, detail: problem }); } catch { /* the refusal stands */ }
+    try { onRefuse?.({ reason: amountProblem ? "signed-amount" : "signed-validity", priceUsd: null, allowanceUsd: cap, detail: problem }); } catch { /* the refusal stands */ }
     throw new Error(`spending guard: ${problem}; the payment was not sent`);
   });
   return client;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-openclaw",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "OpenClaw model provider for Agent402: an auto-routed tier at a flat per-call price and explicit LLM models priced per request, paid in USDC over x402, or with a prepaid credits key, through a local proxy. Zero dependencies; x402 wallet payment is an optional peer.",
   "type": "module",
   "main": "index.js",

package/proxy.js

@@ -270,9 +270,12 @@ export async function startProxy({ upstream = DEFAULT_UPSTREAM, creditsKey = nul
       return json(res, 404, { error: { message: `No route for ${req.method} ${url.pathname}`, type: "invalid_request_error" } });
     } catch (e) {
       stats.errors++;
-      log(`[agent402-openclaw] ${req.method} ${url.pathname}: ${e?.message || e}`);
+      // A thrown message is the payment fetch's or the network's own text,
+      // so the credits key is cut out of it before it is logged or answered.
+      const msg = key ? String(e?.message || e).split(key).join("[redacted]") : String(e?.message || e);
+      log(`[agent402-openclaw] ${req.method} ${url.pathname}: ${msg}`);
       const wire = url.pathname === "/v1/messages" ? ANTHROPIC_WIRE : OPENAI_WIRE;
-      if (!res.headersSent) return json(res, 502, wire.error("upstream_error", `Upstream error: ${String(e?.message || e).slice(0, 200)}`));
+      if (!res.headersSent) return json(res, 502, wire.error("upstream_error", `Upstream error: ${msg.slice(0, 200)}`));
       try { res.end(); } catch { /* ignore */ }
     }
   });