agent402-tollbooth 0.9.0 → 0.9.1

package/index.js

@@ -349,7 +349,12 @@ export function createTollbooth(config = {}) {
       if (!claimed) return reject("invalid-challenge", "Challenge is invalid: this credential was already used or is in flight. Request the resource again for a fresh challenge.");
       const input = relayInput(cred);
       const v = await tempoRelayClient.validate(input).catch((e) => ({ ok: false, error: String(e?.message || e) }));
-      if (!v.ok) return reject("verification-failed", `Payment verification failed: ${String(v.error || "the Tempo relay rejected the credential").slice(0, 200)}.`);
+      if (!v.ok) {
+        // Operator log gets the relay's full message (`detail`); the buyer's
+        // 402 problem gets status + code only (`error`) - never an upstream body.
+        console.warn(`[agent402-tollbooth] tempo credential rejected by validate (${req.method} ${req.url}): ${v.detail || v.error}`);
+        return reject("verification-failed", `Payment verification failed: ${String(v.error || "the Tempo relay rejected the credential").slice(0, 160)}.`);
+      }
       // Buffer the handler's response (writeHead/write/end/flushHeaders) -
       // Node's real 'finish' never fires while end is buffered, so the sync
       // primitive is a promise resolved inside the buffered end.
@@ -387,10 +392,10 @@ export function createTollbooth(config = {}) {
         // Broadcast failed AFTER a successful handler: discard the body, 402
         // (mirrors @x402/express's settle-failure path). Loud - this is the
         // one path that can be our latency rather than the relay's verdict.
-        console.warn(`[agent402-tollbooth] tempo broadcast failed after a successful handler (${req.method} ${req.url}) - answered 402, not charged: ${b.error}`);
+        console.warn(`[agent402-tollbooth] tempo broadcast failed after a successful handler (${req.method} ${req.url}) - answered 402, not charged: ${b.detail || b.error}`);
         buffered = [];
         restore();
-        return reject("verification-failed", `Payment verification failed: Tempo settlement was not accepted (${String(b.error || "no relay detail").slice(0, 200)}).`);
+        return reject("verification-failed", `Payment verification failed: Tempo settlement was not accepted (${String(b.error || "no relay detail").slice(0, 160)}).`);
       }
       incr("tempoPaid");
       restore();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent402-tollbooth",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Agent402 tollbooth: open-source, self-hostable pay-per-crawl for x402 AND MPP (the sell side of Agentic Finance): charge AI bots per request (USDC via x402, or MPP - the Machine Payments Protocol - through the same settlement, or USDG on Robinhood Chain, or free proof-of-work) while humans browse free. Drop-in Express middleware or reverse proxy that settles both wires from env alone - no Cloudflare, no Stripe, no signup.",
   "type": "module",
   "main": "index.js",

package/tempo.js

@@ -167,10 +167,18 @@ export function checkTempoBinding(credential, { secretKey, realm, price, tempo,
   return { ok: true, amount };
 }
 
+// Buyer-facing relay failure: status + the relay's error CODE only. The
+// relay's free-text `message` is an upstream body and goes to the operator
+// log (console.warn at the call sites), never into the 402 problem document
+// a buyer reads - a relay that echoes a key or account detail in an error
+// must not hand it to every buyer. (Leak audit 2026-08-19.)
 function relayFailure(res, body) {
   const code = body && typeof body === "object" && body.error && typeof body.error === "object" && typeof body.error.code === "string" ? body.error.code : null;
+  return `relay HTTP ${res?.status ?? "?"}${code ? ` ${code.slice(0, 60)}` : ""}`;
+}
+function relayFailureDetail(res, body) {
   const msg = body && typeof body === "object" && body.error && typeof body.error.message === "string" ? body.error.message : "";
-  return `relay HTTP ${res?.status ?? "?"}${code ? ` ${code}` : ""}${msg ? ` ${msg.slice(0, 160)}` : ""}`;
+  return `${relayFailure(res, body)}${msg ? ` ${msg.slice(0, 160)}` : ""}`;
 }
 
 /** The relay client. Injectable `relay` (tests) takes precedence. */
@@ -190,17 +198,17 @@ export function tempoRelay(tempo) {
     }
     let body = null;
     try { body = await res.json(); } catch { body = null; }
-    if (!res.ok || !body || body.success !== true) return { ok: false, error: relayFailure(res, body), body };
+    if (!res.ok || !body || body.success !== true) return { ok: false, error: relayFailure(res, body), detail: relayFailureDetail(res, body), body };
     return { ok: true, body };
   };
   return {
     async validate(input) {
       const r = await post("validate", input);
-      return r.ok ? { ok: true } : { ok: false, error: r.error };
+      return r.ok ? { ok: true } : { ok: false, error: r.error, detail: r.detail || r.error };
     },
     async broadcast(input, { idempotencyKey }) {
       const r = await post("broadcast", input, { "idempotency-key": idempotencyKey });
-      if (!r.ok) return { ok: false, error: r.error };
+      if (!r.ok) return { ok: false, error: r.error, detail: r.detail || r.error };
       const receipt = r.body.receipt;
       if (!receipt || typeof receipt !== "object" || typeof receipt.reference !== "string" || receipt.method !== "tempo") return { ok: false, error: "relay broadcast answered success without a tempo receipt" };
       return { ok: true, receipt };
@@ -209,7 +217,16 @@ export function tempoRelay(tempo) {
 }
 
 export function relayInput(credential) {
-  return { challenge: credential.challenge, payload: credential.payload, ...(credential.source ? { source: credential.source } : {}) };
+  // The relay's input is mppx's DESERIALIZED credential (Relay.js
+  // toRelayInput): the challenge with `request` as the decoded object, not
+  // the base64url string that rides on the wire. The first live proof
+  // (run 32295980187, 2026-08-19) sent the wire string and the relay refused
+  // every credential while the stub relay in the offline suite accepted
+  // either - the suite now pins the decoded shape.
+  const { request, ...challenge } = credential.challenge;
+  let decoded = request;
+  if (typeof request === "string") { try { decoded = JSON.parse(unb64url(request)); } catch { decoded = request; } }
+  return { challenge: { ...challenge, request: decoded }, payload: credential.payload, ...(credential.source ? { source: credential.source } : {}) };
 }
 export function broadcastIdempotencyKey(input) {
   return `mpp_${createHash("sha256").update(canonicalJson(input), "utf8").digest("hex")}`;