agentwallet-mcp 1.13.14 → 1.13.16

package/build/index.js

@@ -588,6 +588,13 @@ const FORBIDDEN_REQUEST_HEADERS = new Set(['host', 'content-length', 'transfer-e
 /** Authorizations signed in this process, keyed by endpoint and requirement, kept until they expire. */
 const signingInFlight = new Map();
 const signedPayments = new Map();
+/** The requirement and extensions a v2 server sends are echoed inside the payment header; nothing larger than this is signed. */
+const MAX_PAYMENT_ECHO_BYTES = 32 * 1024;
+/** A tools/call the client cancelled must not go on to sign: the SDK drops the result but leaves the handler running. */
+function assertNotCancelled(signal, stage) {
+    if (signal?.aborted)
+        throw new Error(`pay_x402 was cancelled by the client before ${stage}; nothing more was signed or sent.`);
+}
 function looksLikeTxHash(v) {
     return typeof v === 'string' && (/^0x[0-9a-fA-F]{64}$/.test(v) || /^[1-9A-HJ-NP-Za-km-z]{86,88}$/.test(v));
 }
@@ -827,7 +834,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.14',
+    version: '1.13.15',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1515,7 +1522,8 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     approval_id: z.string().optional().describe('An approval id from an earlier over-cap attempt. Once the owner has approved it, pass it here to make that one payment.'),
     fresh_authorization: z.boolean().optional().describe('Sign a new authorization even if one for the same endpoint, amount and recipient is still valid. By default a repeat call ' +
         'within the validity window re-sends the earlier signature (same nonce, so it cannot settle twice) instead of paying again.'),
-}, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain, request_approval, approval_id, fresh_authorization }) => {
+}, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain, request_approval, approval_id, fresh_authorization }, extra) => {
+    const cancel = extra?.signal;
     if (max_payment !== undefined && !/^\d+(\.\d+)?$/.test(String(max_payment).trim())) {
         throw new Error(`max_payment must be a decimal number of stablecoin units, got "${serverText(max_payment)}"; nothing was fetched.`);
     }
@@ -1668,7 +1676,9 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     const METHOD = (method || 'GET').toUpperCase();
     const bodyDigest = createHash('sha256').update(METHOD !== 'GET' && reqBody ? reqBody : '').digest('hex').slice(0, 16);
     const walletKey = anyLocalMode() ? 'local' : String(wallet_id); // the local signer has one key whatever wallet_id says
-    const resourceTag = [walletKey, chainId, authorizationResource(url), METHOD, bodyDigest].join('|');
+    // The chain is not part of the tag: a paywall rotating the chain per answer used
+    // to harvest one cap-sized nonce per chain for a single purchase (round 8).
+    const resourceTag = [walletKey, authorizationResource(url), METHOD, bodyDigest].join('|');
     const cacheKey = [walletKey, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, resourceTag].join('|');
     for (const [k, v] of signedPayments)
         if (v.until <= Date.now())
@@ -1735,6 +1745,17 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     // usage; the payer broadcasts nothing and pays no gas for either. AgentWallet's
     // own paywalls (verified by receipt), native-asset requests and Solana still use
     // a broadcast transfer proved by hash.
+    // What the paid retry echoes back is bounded before anything is signed: a few MB
+    // of junk in outputSchema or extensions used to become a 5 MB header kept in the
+    // cache for the authorization's lifetime (round 8).
+    const echoBytes = Buffer.byteLength(JSON.stringify({ accepted: option, resource: paymentInfo.resource, extensions: paymentInfo.extensions }));
+    if (echoBytes > MAX_PAYMENT_ECHO_BYTES) {
+        return jsonResponse({
+            status: 402, payment_required: true, payment_made: false,
+            error: `The endpoint's payment requirement is ${echoBytes} bytes once echoed into the payment header; nothing above ${MAX_PAYMENT_ECHO_BYTES} bytes is signed (no HTTP server accepts a header that size, so the payment could never be delivered).`,
+            requested_amount: amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
+        });
+    }
     const standardExact = !isUpto && willSign;
     let headerName = 'X-PAYMENT';
     let paymentHeader = '';
@@ -1772,8 +1793,8 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
             const [, live] = other;
             return jsonResponse({
                 status: 402, payment_required: true, payment_made: false,
-                error: `This resource already holds a live authorization signed ${Math.round((Date.now() - live.signedAt) / 1000)} s ago for ${live.amount} ${tokenLabel} (the endpoint's requirement changed between answers: amount, recipient, asset or scheme). It is re-sent by calling pay_x402 again with the same arguments once the endpoint asks for the same requirement. Nothing more is signed for this resource until that authorization expires.`,
-                live_authorization: { amount: live.amount, valid_until: new Date(live.until).toISOString(), payer: live.payer },
+                error: `This resource already holds a live authorization signed ${Math.round((Date.now() - live.signedAt) / 1000)} s ago for ${live.amount} on chain ${live.chainId} (the endpoint's requirement changed between answers: amount, recipient, asset, scheme or chain). It is re-sent by calling pay_x402 again with the same arguments once the endpoint asks for the same requirement. Nothing more is signed for this resource until that authorization expires.`,
+                live_authorization: { amount: live.amount, chain_id: live.chainId, valid_until: new Date(live.until).toISOString(), payer: live.payer },
                 requested_amount: amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
             });
         }
@@ -1781,6 +1802,7 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     let releaseSigning = () => { };
     let mineLock = null;
     if (!(cachedAuth && cachedAuth.until > Date.now())) {
+        assertNotCancelled(cancel, 'signing');
         const mine = new Promise(r => { releaseSigning = r; });
         // Released in the finally below, whatever path this call takes. A timer
         // used to stand in for that and opened the gate under a slow signer, so
@@ -1842,16 +1864,18 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
         else {
             let txResult;
             if (isSolanaChain(chainId)) {
+                // skip: a metered 402 from the API host on this send surfaces as the documented
+                // error instead of an auto-payment hidden inside the pay_x402 result (round 8).
                 txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', tokenAddress
                     ? { to: option.payTo, value: rawAmount, token_mint: tokenAddress, token_decimals: trustedDecimals, chain_id: chainId }
-                    : { to: option.payTo, value: rawAmount, chain_id: chainId }));
+                    : { to: option.payTo, value: rawAmount, chain_id: chainId }, skip));
             }
             else if (tokenAddress) {
                 const calldata = '0xa9059cbb' + padAddress(option.payTo) + encodeUint256(rawAmount);
-                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: calldata, chain_id: chainId }));
+                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: calldata, chain_id: chainId }, skip));
             }
             else {
-                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: option.payTo, value: rawAmount, data: '', chain_id: chainId }));
+                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: option.payTo, value: rawAmount, data: '', chain_id: chainId }, skip));
             }
             txHash = String(txResult.tx_hash || txResult.signature || '');
             if (!txHash)
@@ -1862,7 +1886,7 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
             const until = authorization ? Number(authorization.validBefore) * 1000
                 : uptoAuth ? Number(uptoAuth.deadline) * 1000
                     : Date.now() + maxAuthWindowSeconds() * 1000; // a broadcast transfer: the hash stays valid, re-sending it never pays twice
-            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until, resource: resourceTag, amount, signedAt: Date.now() });
+            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until, resource: resourceTag, amount, signedAt: Date.now(), chainId });
             // A receipt on stderr the moment a signature exists, so a result the transport
             // drops (a client crash, an oversized frame) is still auditable (round 3).
             console.error(`[agentwallet] x402 authorization sent: ${amount} ${tokenLabel} to ${option.payTo} on chain ${chainId} for ${authorizationResource(url)} (${authorization ? 'nonce ' + authorization.nonce : uptoAuth ? 'permit2 nonce ' + uptoAuth.nonce : 'tx ' + txHash})`);
@@ -1875,11 +1899,14 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
             signingInFlight.delete(resourceLock);
     }
     // Step 6: Retry with the payment header and read the settlement receipt.
+    // A cancellation here keeps the signed authorization cached for the next call
+    // (same nonce, so it cannot pay twice) and hands nothing to the endpoint now.
+    assertNotCancelled(cancel, 'the paid request');
     const retryHeaders = { ...reqHeaders, [headerName]: paymentHeader };
     const retryOptions = {
         method,
         headers: retryHeaders,
-        signal: AbortSignal.timeout(30_000),
+        signal: cancel ? AbortSignal.any([AbortSignal.timeout(30_000), cancel]) : AbortSignal.timeout(30_000),
     };
     if (reqBody && method !== 'GET') {
         retryOptions.body = reqBody;

package/build/local-solana.js

@@ -99,13 +99,28 @@ const DEFAULT_SOLANA_RPC = {
     901: 'https://api.devnet.solana.com',
     902: 'https://api.testnet.solana.com',
 };
+/** A Solana RPC over plain http to anything but loopback exposes every query and lets an on-path host answer; refused like an EVM one (round 7). */
+function assertSolanaScheme(url, name) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        throw new Error(`${name} is not a URL: "${url}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`${name} must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    return url;
+}
 export function resolveSolanaRpc(chainId = 900) {
     const perChain = (process.env[`AGENTWALLET_SOLANA_RPC_${chainId}`] || '').trim();
     if (perChain)
-        return perChain;
+        return assertSolanaScheme(perChain, `AGENTWALLET_SOLANA_RPC_${chainId}`);
     const explicit = (process.env.AGENTWALLET_SOLANA_RPC || '').trim();
     if (explicit)
-        return explicit;
+        return assertSolanaScheme(explicit, 'AGENTWALLET_SOLANA_RPC');
     if (Object.keys(process.env).some(k => /^AGENTWALLET_SOLANA_RPC_\d+$/.test(k) && (process.env[k] || '').trim())) {
         throw new Error(`No Solana RPC for chain ${chainId}: AGENTWALLET_SOLANA_RPC_<chainId> is set for another cluster, so the public default is not used. Set AGENTWALLET_SOLANA_RPC_${chainId} or AGENTWALLET_SOLANA_RPC.`);
     }

package/build/x402-eip3009.d.ts

@@ -152,6 +152,8 @@ export declare function generatePaymentId(): string;
  * info.id filled in. Other extensions pass through untouched.
  */
 export declare function withPaymentIdentifier(extensions?: Record<string, unknown>, id?: string): Record<string, unknown> | null;
+/** Hard ceiling on the encoded payment header; pay_x402 refuses before signing well below it. */
+export declare const MAX_PAYMENT_HEADER_BYTES: number;
 export declare function paymentHeaderFor(x402Version: number, payload: Record<string, unknown>): {
     name: string;
     value: string;

package/build/x402-eip3009.js

@@ -166,8 +166,13 @@ export function withPaymentIdentifier(extensions, id) {
     }
     return out;
 }
+/** Hard ceiling on the encoded payment header; pay_x402 refuses before signing well below it. */
+export const MAX_PAYMENT_HEADER_BYTES = 64 * 1024;
 export function paymentHeaderFor(x402Version, payload) {
     const value = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
+    if (value.length > MAX_PAYMENT_HEADER_BYTES) {
+        throw new Error(`x402: the payment header would be ${value.length} bytes; the server's requirement is too large to echo and the payment cannot be delivered.`);
+    }
     return { name: x402Version >= 2 ? 'PAYMENT-SIGNATURE' : 'X-PAYMENT', value };
 }
 function decodeBase64Json(v) {

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.13.14",
+  "version": "1.13.16",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs && node test/audit-11311.test.mjs && node test/audit-11312.test.mjs && node test/audit-11313.test.mjs && node test/audit-11316.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [