agentwallet-mcp 1.13.2 → 1.13.3

package/build/index.js

@@ -561,7 +561,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.2',
+    version: '1.13.3',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/local-solana.d.ts

@@ -23,6 +23,16 @@ export declare function localSolBalance(chainId?: number): Promise<{
     balance: string;
     mode: string;
 }>;
+/**
+ * Bytes the Associated Token Account program allocates for a new token account
+ * of this mint. Classic SPL is always 165. Token-2022 adds an account-type byte
+ * and one TLV entry per account extension: ImmutableOwner on every associated
+ * account, plus whatever the mint's own extensions require.
+ *
+ * The rent charged follows this size, so the SOL cap has to be checked against
+ * it. A flat 165 under-counted every Token-2022 account (2026-10-02 report).
+ */
+export declare function associatedAccountSize(token2022: boolean, mintData: Uint8Array): number;
 export declare function localSplBalance(mintStr: string, chainId?: number): Promise<{
     address: string;
     chain_id: number;

package/build/local-solana.js

@@ -222,14 +222,69 @@ export async function localSolBalance(chainId = 900) {
         mode: 'local',
     };
 }
-/** Which token program owns this mint: classic SPL or Token-2022. */
-async function tokenProgramFor(conn, mint) {
+/** Which token program owns this mint, and how big a token account for it is. */
+async function mintLayout(conn, mint) {
     const info = await conn.getAccountInfo(mint);
     if (!info)
         throw new Error(`Mint ${mint.toBase58()} not found on this cluster.`);
-    if (info.owner.equals(TOKEN_2022_PROGRAM))
-        return TOKEN_2022_PROGRAM;
-    return TOKEN_PROGRAM;
+    const token2022 = info.owner.equals(TOKEN_2022_PROGRAM);
+    return {
+        tokenProgram: token2022 ? TOKEN_2022_PROGRAM : TOKEN_PROGRAM,
+        ataSize: associatedAccountSize(token2022, info.data),
+    };
+}
+/** Which token program owns this mint: classic SPL or Token-2022. */
+async function tokenProgramFor(conn, mint) {
+    return (await mintLayout(conn, mint)).tokenProgram;
+}
+/* Token-2022 mint extensions that make every token account for the mint carry
+   an extension of its own, and the size of that account extension's value.
+   Mirrors required_init_account_extensions in the token-2022 program. */
+const ACCOUNT_EXTENSION_FOR_MINT_EXTENSION = {
+    1: 8, // TransferFeeConfig -> TransferFeeAmount (withheld amount, u64)
+    9: 0, // NonTransferable   -> NonTransferableAccount (plus ImmutableOwner, always present below)
+    14: 1, // TransferHook      -> TransferHookAccount (one flag byte)
+    26: 0, // Pausable          -> PausableAccount
+};
+/** Highest extension type this table was written against (PermissionedBurn). */
+const HIGHEST_KNOWN_EXTENSION = 28;
+/** Charged for a mint extension newer than the table, so the estimate errs high, never low. */
+const UNKNOWN_EXTENSION_ALLOWANCE = 64;
+const TLV_HEADER = 4; // u16 type + u16 length
+const MULTISIG_SIZE = 355; // the program pads an account that would collide with a multisig's size
+/**
+ * Bytes the Associated Token Account program allocates for a new token account
+ * of this mint. Classic SPL is always 165. Token-2022 adds an account-type byte
+ * and one TLV entry per account extension: ImmutableOwner on every associated
+ * account, plus whatever the mint's own extensions require.
+ *
+ * The rent charged follows this size, so the SOL cap has to be checked against
+ * it. A flat 165 under-counted every Token-2022 account (2026-10-02 report).
+ */
+export function associatedAccountSize(token2022, mintData) {
+    if (!token2022)
+        return TOKEN_ACCOUNT_SIZE;
+    let tlvBytes = TLV_HEADER; // ImmutableOwner, zero-length value
+    const seen = new Set();
+    // Mint layout: 82 bytes of base state padded to 165, the account-type byte, then TLV entries.
+    let offset = TOKEN_ACCOUNT_SIZE + 1;
+    while (offset + TLV_HEADER <= mintData.length) {
+        const type = mintData[offset] | (mintData[offset + 1] << 8);
+        const length = mintData[offset + 2] | (mintData[offset + 3] << 8);
+        if (type === 0)
+            break; // uninitialized: the rest is padding
+        if (!seen.has(type)) {
+            seen.add(type);
+            const accountValue = ACCOUNT_EXTENSION_FOR_MINT_EXTENSION[type];
+            if (accountValue !== undefined)
+                tlvBytes += TLV_HEADER + accountValue;
+            else if (type > HIGHEST_KNOWN_EXTENSION)
+                tlvBytes += TLV_HEADER + UNKNOWN_EXTENSION_ALLOWANCE;
+        }
+        offset += TLV_HEADER + length;
+    }
+    const size = TOKEN_ACCOUNT_SIZE + 1 + tlvBytes;
+    return size === MULTISIG_SIZE ? size + 2 : size;
 }
 function associatedTokenAddress(owner, mint, tokenProgram) {
     const [ata] = PublicKey.findProgramAddressSync([owner.toBuffer(), tokenProgram.toBuffer(), mint.toBuffer()], ASSOCIATED_TOKEN_PROGRAM);
@@ -327,7 +382,7 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     const mint = new PublicKey(mintStr);
     const recipient = new PublicKey(to);
     await assertRecipientIsWallet(conn, recipient);
-    const tokenProgram = await tokenProgramFor(conn, mint);
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     // The instruction's decimals byte is the mint's real value, not whatever the
     // caller passed; TransferChecked would reject a wrong one on-chain anyway.
     decimals = await resolveMintDecimals(mintStr, chainId);
@@ -338,7 +393,8 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     if (!destInfo) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
-        const rent = await conn.getMinimumBalanceForRentExemption(TOKEN_ACCOUNT_SIZE);
+        // Rent follows the account's real size, which for Token-2022 is above 165.
+        const rent = await conn.getMinimumBalanceForRentExemption(ataSize);
         assertWithinSolCap(BigInt(rent));
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.2",
+  "version": "1.13.3",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [