agent402-tollbooth 0.4.0 → 0.4.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Havok Holdings LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -8,11 +8,11 @@ proof-of-work. No Cloudflare, no Stripe, no Merchant-of-Record, no signup.
 The big platforms are converging on the same model: Cloudflare's
 [pay-per-crawl](https://stackoverflow.blog/2026/02/26/how-pay-per-crawl-is-reshaping-data-monetization/)
 and now its [Monetization Gateway](https://blog.cloudflare.com/monetization-gateway/)
-(July 2026 — x402 charging for anything behind Cloudflare, waitlist) confirm that
+(announced 2026 — x402 charging for anything behind Cloudflare, waitlist at the time of writing) confirm that
 pay-per-request is the business model of the agentic web. Tollbooth is the
 **open-source monetization gateway**: the same idea, live today, MIT-licensed,
 running in front of *any* origin (even a Cloudflare Worker), with a proof-of-work
-free tier no platform offers — built on the same hardened 402 + proof-of-work
+free tier the platform gateways don't offer — built on the same hardened 402 + proof-of-work
 machinery as [Agent402](https://github.com/MikeyPetrillo/Agent402).
 
 ## See it work (one command)

package/index.js

@@ -258,8 +258,11 @@ function readBody(req, cap = 10 * 1024 * 1024) {
 async function startCli() {
   const upstream = process.env.TOLLBOOTH_UPSTREAM;
   const port = Number(process.env.PORT) || 4021;
-  if (!process.env.TOLLBOOTH_SECRET) {
+  const _secret = process.env.TOLLBOOTH_SECRET;
+  if (!_secret) {
     console.warn("⚠ TOLLBOOTH_SECRET not set — proof-of-work tokens use a random per-process secret: they won't survive a restart and will be rejected across multiple workers/instances. Set a stable TOLLBOOTH_SECRET in production.");
+  } else if (/^change-me/i.test(_secret) || _secret === "change-me-to-a-long-random-string") {
+    console.warn("⚠ TOLLBOOTH_SECRET is the public placeholder from the deploy template — it's readable by anyone, so proof-of-work tokens can be FORGED to bypass your gate for free. Set a real random secret: `openssl rand -hex 32`.");
   }
   const { default: express } = await import("express");
   const app = express();
@@ -274,6 +277,9 @@ async function startCli() {
   const { timingSafeEqual } = await import("node:crypto");
   const ADMIN_TOKEN = process.env.TOLLBOOTH_ADMIN_TOKEN || "";
   const STATS_TOKEN = process.env.TOLLBOOTH_STATS_TOKEN || "";
+  if (!ADMIN_TOKEN) {
+    console.warn("⚠ TOLLBOOTH_ADMIN_TOKEN not set — the /__tollbooth analytics dashboard is publicly reachable (aggregate counts only, no per-request/payer data). Set TOLLBOOTH_ADMIN_TOKEN to require a token.");
+  }
   const presented = (req) => {
     const auth = req.headers["authorization"];
     if (typeof auth === "string" && auth.startsWith("Bearer ")) return auth.slice(7);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-tollbooth",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Open-source, self-hostable x402 pay-per-crawl tollbooth: charge AI bots per request (USDC via x402 — or USDG on Robinhood Chain — or free proof-of-work) while humans browse free. Drop-in Express middleware or reverse proxy — no Cloudflare, no Stripe, no signup.",
   "type": "module",
   "main": "index.js",
@@ -63,7 +63,7 @@
     "robinhood-chain",
     "usdg"
   ],
-  "author": "Mike Petrillo <mike@agent402.tools> (https://github.com/MikeyPetrillo)",
+  "author": "Havok Holdings LLC <mike@agent402.tools> (https://agent402.tools)",
   "license": "MIT",
   "repository": {
     "type": "git",