agent402-tollbooth 0.10.0 → 0.10.2

package/README.md

@@ -1,5 +1,7 @@
 # agent402-tollbooth
 
+Part of [Agent402](https://agent402.tools), the open-source paid door for AI agents.
+
 **Open-source, self-hostable pay-per-crawl for x402 and MPP. Put it in front of
 any site or API: humans browse free, AI crawlers and agents pay per request** -
 in USDC over the [x402 protocol](https://x402.org), over

package/index.js

@@ -12,7 +12,8 @@
 // The proof-of-work rail works out of the box with zero configuration. To also
 // accept USDC, set `payTo` and supply `verifyX402` (wire it to the standard
 // x402 server middleware / your facilitator — see README).
-import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { Readable } from "node:stream";
 import { randomBytes } from "node:crypto";
 import { createPow } from "./pow.js";
@@ -910,4 +911,14 @@ async function startCli() {
   });
 }
 
-if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) startCli();
+// THE BIN SYMLINK. npm links the bin as `.bin/agent402-tollbooth`, so argv[1]
+// is the SYMLINK path while import.meta.url is the realpath - they never match,
+// and the documented install path (`npx agent402-tollbooth`) started nothing at
+// all while `node index.js` worked fine. Exactly the defect found and fixed in
+// agent402-openclaw 0.1.2; it survived here because every test invokes
+// index.js by path, which is the one way to call it that cannot see the bug.
+// Compare the REALPATH, the way openclaw/cli.js does.
+function invokedDirectly() {
+  try { return import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href; } catch { return false; }
+}
+if (process.argv[1] && invokedDirectly()) startCli();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-tollbooth",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Agent402 tollbooth: open-source, self-hostable pay-per-crawl for x402 AND MPP (the sell side of Agentic Finance): charge AI bots per request (USDC via x402, or MPP - the Machine Payments Protocol - through the same settlement, or USDG on Robinhood Chain, or free proof-of-work) while humans browse free. Drop-in Express middleware or reverse proxy that settles both wires from env alone - no Cloudflare, no Stripe, no signup.",
   "type": "module",
   "main": "index.js",
@@ -44,7 +44,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node test.js && node edge.test.js && node features.test.js",
+    "test": "node test.js && node edge.test.js && node features.test.js && node tempo.test.js",
     "demo": "node demo.js",
     "example": "node example.js"
   },

package/tempo.js

@@ -323,12 +323,25 @@ export function candidateTxIds(signedTx) {
   return out;
 }
 
-const TRANSFER_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
+// TIP-20 TransferWithMemo(address indexed from, address indexed to, uint256 amount, bytes32 indexed memo)
+const TRANSFER_WITH_MEMO_TOPIC = keccak256Hex(Buffer.from("TransferWithMemo(address,address,uint256,bytes32)"));
+const MPP_TAG = keccak256Hex(Buffer.from("mpp")).slice(2, 10);
+
+/** Is this bytes32 memo an MPP attribution memo bound to `challengeId`?
+ *  Mirrors mppx tempo/Attribution.js verifyChallengeBinding: TAG, version
+ *  0x01, and bytes 25..31 = keccak256(challengeId)[0..6]. */
+export function memoBoundToChallenge(memo, challengeId) {
+  const hex = String(memo || "").toLowerCase().replace(/^0x/, "");
+  if (hex.length !== 64 || typeof challengeId !== "string" || !challengeId) return false;
+  if (hex.slice(0, 8) !== MPP_TAG || hex.slice(8, 10) !== "01") return false;
+  return hex.slice(50, 64) === keccak256Hex(Buffer.from(challengeId)).slice(2, 16);
+}
 
 /** Did this credential's transaction settle despite the relay's verdict?
  *  Returns { txId } when a candidate receipt exists, succeeded (status 0x1),
- *  and carries the challenge's transfer (currency + recipient + >= amount) —
- *  else null. Polls briefly (a just-mined tx may not be indexed when the
+ *  and carries the challenge's transfer (currency + recipient + >= amount) as
+ *  a TransferWithMemo whose MPP memo is bound to THIS challenge's id - else
+ *  null. Polls briefly (a just-mined tx may not be indexed when the
  *  relay answers). Never throws. */
 export async function confirmTempoSettlement(credential, { rpcUrl, fetchImpl = globalThis.fetch, attempts = 4, delayMs = 2000 } = {}) {
   try {
@@ -357,8 +370,9 @@ export async function confirmTempoSettlement(credential, { rpcUrl, fetchImpl = g
         if (!receipt || receipt.status !== "0x1") continue;
         for (const log of receipt.logs || []) {
           if (String(log.address || "").toLowerCase() !== currency) continue;
-          if ((log.topics || [])[0] !== TRANSFER_TOPIC) continue;
+          if ((log.topics || [])[0] !== TRANSFER_WITH_MEMO_TOPIC) continue;
           if (`0x${String(log.topics[2] || "").slice(-40)}`.toLowerCase() !== recipient) continue;
+          if (!memoBoundToChallenge(log.topics[3], credential?.challenge?.id)) continue;
           let value;
           try { value = BigInt(log.data); } catch { continue; }
           if (value >= minAmount) return { txId };