agentwallet-mcp 1.13.2 → 1.13.4

package/build/index.js

@@ -12,8 +12,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import { assertPublicUrl, safeFetch, FINAL_URL_HEADER } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, } from './x402-payment.js';
+import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, } from './x402-payment.js';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
@@ -561,7 +561,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.2',
+    version: '1.13.4',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1290,7 +1290,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // A 402 that arrived through a cross-origin redirect cannot be paid here: the
     // payment header would be stripped on the same hop and the money would go
     // to whoever the redirecting server named. The agent should call the final URL.
-    const servedFrom = initialRes.headers.get(FINAL_URL_HEADER) || url;
+    const servedFrom = finalUrlOf(initialRes, url); // recorded by safeFetch itself, never read from a header the server could set
     if (new URL(servedFrom).origin !== new URL(url).origin) {
         return jsonResponse({ status: 402, payment_required: true, payment_made: false,
             error: `The endpoint redirected to another origin (${new URL(servedFrom).origin}) before asking for payment. Call pay_x402 with that URL directly if you trust it.`,
@@ -1420,7 +1420,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     let permit2ApprovalTx = null;
     let payerDelegationInfo = null;
     let authorizationReused = false;
-    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, new URL(url).origin + new URL(url).pathname].join('|');
+    // The resource is the whole URL including its query: /buy?id=1 and /buy?id=2
+    // are different purchases, and reusing the first signature for the second
+    // would report a payment the second resource never received.
+    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, authorizationResource(url)].join('|');
     const cachedAuth = fresh_authorization ? undefined : signedPayments.get(cacheKey);
     for (const [k, v] of signedPayments)
         if (v.until <= Date.now())
@@ -1518,7 +1521,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // A second 402 means the facilitator declined (unfunded payer, expired window, bad domain...). v2 servers
     // put the reason in a fresh PAYMENT-REQUIRED header, v1 servers in the body; surface it instead of {}.
     let retryError = null;
-    const retryServedFrom = retryRes.headers.get(FINAL_URL_HEADER) || url;
+    const retryServedFrom = finalUrlOf(retryRes, url);
     const retryCrossOrigin = new URL(retryServedFrom).origin !== new URL(url).origin;
     if (retryCrossOrigin) {
         retryError = `The paid request was redirected to another origin (${new URL(retryServedFrom).origin}); the payment header is never forwarded across origins, so this response did not see the payment.`;

package/build/local-solana.d.ts

@@ -23,6 +23,16 @@ export declare function localSolBalance(chainId?: number): Promise<{
     balance: string;
     mode: string;
 }>;
+/**
+ * Bytes the Associated Token Account program allocates for a new token account
+ * of this mint. Classic SPL is always 165. Token-2022 adds an account-type byte
+ * and one TLV entry per account extension: ImmutableOwner on every associated
+ * account, plus whatever the mint's own extensions require.
+ *
+ * The rent charged follows this size, so the SOL cap has to be checked against
+ * it. A flat 165 under-counted every Token-2022 account (2026-10-02 report).
+ */
+export declare function associatedAccountSize(token2022: boolean, mintData: Uint8Array): number;
 export declare function localSplBalance(mintStr: string, chainId?: number): Promise<{
     address: string;
     chain_id: number;

package/build/local-solana.js

@@ -222,14 +222,69 @@ export async function localSolBalance(chainId = 900) {
         mode: 'local',
     };
 }
-/** Which token program owns this mint: classic SPL or Token-2022. */
-async function tokenProgramFor(conn, mint) {
+/** Which token program owns this mint, and how big a token account for it is. */
+async function mintLayout(conn, mint) {
     const info = await conn.getAccountInfo(mint);
     if (!info)
         throw new Error(`Mint ${mint.toBase58()} not found on this cluster.`);
-    if (info.owner.equals(TOKEN_2022_PROGRAM))
-        return TOKEN_2022_PROGRAM;
-    return TOKEN_PROGRAM;
+    const token2022 = info.owner.equals(TOKEN_2022_PROGRAM);
+    return {
+        tokenProgram: token2022 ? TOKEN_2022_PROGRAM : TOKEN_PROGRAM,
+        ataSize: associatedAccountSize(token2022, info.data),
+    };
+}
+/** Which token program owns this mint: classic SPL or Token-2022. */
+async function tokenProgramFor(conn, mint) {
+    return (await mintLayout(conn, mint)).tokenProgram;
+}
+/* Token-2022 mint extensions that make every token account for the mint carry
+   an extension of its own, and the size of that account extension's value.
+   Mirrors required_init_account_extensions in the token-2022 program. */
+const ACCOUNT_EXTENSION_FOR_MINT_EXTENSION = {
+    1: 8, // TransferFeeConfig -> TransferFeeAmount (withheld amount, u64)
+    9: 0, // NonTransferable   -> NonTransferableAccount (plus ImmutableOwner, always present below)
+    14: 1, // TransferHook      -> TransferHookAccount (one flag byte)
+    26: 0, // Pausable          -> PausableAccount
+};
+/** Highest extension type this table was written against (PermissionedBurn). */
+const HIGHEST_KNOWN_EXTENSION = 28;
+/** Charged for a mint extension newer than the table, so the estimate errs high, never low. */
+const UNKNOWN_EXTENSION_ALLOWANCE = 64;
+const TLV_HEADER = 4; // u16 type + u16 length
+const MULTISIG_SIZE = 355; // the program pads an account that would collide with a multisig's size
+/**
+ * Bytes the Associated Token Account program allocates for a new token account
+ * of this mint. Classic SPL is always 165. Token-2022 adds an account-type byte
+ * and one TLV entry per account extension: ImmutableOwner on every associated
+ * account, plus whatever the mint's own extensions require.
+ *
+ * The rent charged follows this size, so the SOL cap has to be checked against
+ * it. A flat 165 under-counted every Token-2022 account (2026-10-02 report).
+ */
+export function associatedAccountSize(token2022, mintData) {
+    if (!token2022)
+        return TOKEN_ACCOUNT_SIZE;
+    let tlvBytes = TLV_HEADER; // ImmutableOwner, zero-length value
+    const seen = new Set();
+    // Mint layout: 82 bytes of base state padded to 165, the account-type byte, then TLV entries.
+    let offset = TOKEN_ACCOUNT_SIZE + 1;
+    while (offset + TLV_HEADER <= mintData.length) {
+        const type = mintData[offset] | (mintData[offset + 1] << 8);
+        const length = mintData[offset + 2] | (mintData[offset + 3] << 8);
+        if (type === 0)
+            break; // uninitialized: the rest is padding
+        if (!seen.has(type)) {
+            seen.add(type);
+            const accountValue = ACCOUNT_EXTENSION_FOR_MINT_EXTENSION[type];
+            if (accountValue !== undefined)
+                tlvBytes += TLV_HEADER + accountValue;
+            else if (type > HIGHEST_KNOWN_EXTENSION)
+                tlvBytes += TLV_HEADER + UNKNOWN_EXTENSION_ALLOWANCE;
+        }
+        offset += TLV_HEADER + length;
+    }
+    const size = TOKEN_ACCOUNT_SIZE + 1 + tlvBytes;
+    return size === MULTISIG_SIZE ? size + 2 : size;
 }
 function associatedTokenAddress(owner, mint, tokenProgram) {
     const [ata] = PublicKey.findProgramAddressSync([owner.toBuffer(), tokenProgram.toBuffer(), mint.toBuffer()], ASSOCIATED_TOKEN_PROGRAM);
@@ -327,7 +382,7 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     const mint = new PublicKey(mintStr);
     const recipient = new PublicKey(to);
     await assertRecipientIsWallet(conn, recipient);
-    const tokenProgram = await tokenProgramFor(conn, mint);
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     // The instruction's decimals byte is the mint's real value, not whatever the
     // caller passed; TransferChecked would reject a wrong one on-chain anyway.
     decimals = await resolveMintDecimals(mintStr, chainId);
@@ -338,7 +393,8 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     if (!destInfo) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
-        const rent = await conn.getMinimumBalanceForRentExemption(TOKEN_ACCOUNT_SIZE);
+        // Rent follows the account's real size, which for Token-2022 is above 165.
+        const rent = await conn.getMinimumBalanceForRentExemption(ataSize);
         assertWithinSolCap(BigInt(rent));
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }

package/build/local-wallet.js

@@ -294,7 +294,9 @@ const CAP_LAYOUTS = {
  * checked, and unpriced calldata aimed at a token contract or at Permit2 is
  * refused, because any state change there can move funds. Calls to other
  * contracts (routers, bridges) still pass: they can only pull what an approval
- * already allowed, and approvals are what this guard bounds.
+ * already allows. Approvals granted through this guard are bounded by it; an
+ * allowance that existed before the cap was set, or was granted elsewhere, is
+ * not, and a router call can spend up to that allowance (noted 2026-10-04).
  *
  * Reported privately 2026-09-27: that refusal also caught our own wrap_eth and
  * unwrap_eth, whose WETH deposit() / withdraw(uint256) calldata was unpriced,
@@ -335,7 +337,7 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
                 `or deposit/withdraw on the chain's wrapped-native contract, ` +
                 `or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
         }
-        return; // an ordinary contract call; it can only pull what an approval already allowed
+        return; // an ordinary contract call; it can only pull what an existing approval allows (see the note above)
     }
     const wordAt = (i) => hex.slice(8 + i * 64, 8 + (i + 1) * 64);
     let amount;

package/build/ssrf-guard.d.ts

@@ -98,6 +98,14 @@ export declare function headersForRedirect(headers: HeadersInit | undefined, fro
 export declare const MAX_RESPONSE_BYTES: number;
 /** Header safeFetch adds to every response: the URL the body actually came from, after redirects. */
 export declare const FINAL_URL_HEADER = "x-agw-final-url";
+/** The URL a safeFetch response actually came from, after every redirect. Only safeFetch can set it. */
+export declare function finalUrlOf(res: Response, fallback: string): string;
+/**
+ * The synthetic Response safeFetch hands back: the server's headers minus the
+ * transfer-level ones (the body is already decoded) and minus any header only
+ * this client may set, plus the final URL, which is also recorded out of band.
+ */
+export declare function buildFetchedResponse(status: number, statusText: string, serverHeaders: Iterable<[string, string]>, body: ArrayBuffer | null, finalUrl: string): Response;
 /**
  * fetch() that validates the target, and every redirect hop, against
  * resolvePublicUrl, and connects only to the addresses that validation

package/build/ssrf-guard.js

@@ -330,6 +330,36 @@ export function headersForRedirect(headers, from, to, bodyDropped) {
 export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 /** Header safeFetch adds to every response: the URL the body actually came from, after redirects. */
 export const FINAL_URL_HEADER = 'x-agw-final-url';
+/* The final URL is also recorded here, keyed by the Response object, and
+   finalUrlOf() reads this rather than the header. A server could send a
+   header of the same name (it was copied straight through and read back
+   as the real one, 2026-10-04 report); nothing a server sends can reach
+   this map. */
+const finalUrls = new WeakMap();
+/** The URL a safeFetch response actually came from, after every redirect. Only safeFetch can set it. */
+export function finalUrlOf(res, fallback) {
+    return finalUrls.get(res) ?? fallback;
+}
+/** Response headers that only this client may set on what it hands back. */
+const CLIENT_ONLY_RESPONSE_HEADERS = new Set([FINAL_URL_HEADER]);
+/**
+ * The synthetic Response safeFetch hands back: the server's headers minus the
+ * transfer-level ones (the body is already decoded) and minus any header only
+ * this client may set, plus the final URL, which is also recorded out of band.
+ */
+export function buildFetchedResponse(status, statusText, serverHeaders, body, finalUrl) {
+    const headers = [];
+    for (const [k, v] of serverHeaders) {
+        const name = k.toLowerCase();
+        if (name === 'content-encoding' || name === 'content-length' || CLIENT_ONLY_RESPONSE_HEADERS.has(name))
+            continue;
+        headers.push([k, v]);
+    }
+    headers.push([FINAL_URL_HEADER, finalUrl]);
+    const out = new Response(body, { status, statusText, headers });
+    finalUrls.set(out, finalUrl);
+    return out;
+}
 /** Read a body stream into memory, refusing past `limit` decoded bytes. */
 async function readBounded(stream, limit) {
     if (!stream)
@@ -389,20 +419,14 @@ export async function safeFetch(url, options = {}, maxHops = 3) {
             status = res.status;
             statusText = res.statusText;
             headers = [];
-            for (const [k, v] of res.headers) {
-                // The body below is already decoded, so the transfer-level description
-                // of it would be wrong if carried over.
-                if (k === 'content-encoding' || k === 'content-length')
-                    continue;
+            for (const [k, v] of res.headers)
                 headers.push([k, v]);
-            }
             body = NULL_BODY_STATUS.has(status) ? null : await readBounded(res.body, MAX_RESPONSE_BYTES);
         }
         finally {
             await agent.destroy();
         }
-        headers.push([FINAL_URL_HEADER, current]);
-        const out = new Response(body, { status, statusText, headers });
+        const out = buildFetchedResponse(status, statusText, headers, body, current);
         const isRedirect = status >= 300 && status < 400 && out.headers.has('location');
         if (!isRedirect)
             return out;

package/build/x402-payment.d.ts

@@ -191,6 +191,12 @@ export interface ApprovalWant {
  * outright, before any lookup. For a hosted wallet every bound field is checked
  * here, the wallet included, and the server checks them again when it signs.
  */
+/**
+ * The part of a URL that names the resource an authorization was signed for:
+ * origin, path and query. /buy?id=1 and /buy?id=2 are different purchases
+ * (2026-10-04 report); the fragment is never sent, so it is left out.
+ */
+export declare function authorizationResource(url: string): string;
 export declare function approvalRefusal(approvalId: string, row: ApprovalRow | null | undefined, want: ApprovalWant, localMode: boolean): {
     error: string;
     approval_status?: string | null;

package/build/x402-payment.js

@@ -334,6 +334,15 @@ export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
  * outright, before any lookup. For a hosted wallet every bound field is checked
  * here, the wallet included, and the server checks them again when it signs.
  */
+/**
+ * The part of a URL that names the resource an authorization was signed for:
+ * origin, path and query. /buy?id=1 and /buy?id=2 are different purchases
+ * (2026-10-04 report); the fragment is never sent, so it is left out.
+ */
+export function authorizationResource(url) {
+    const u = new URL(url);
+    return u.origin + u.pathname + u.search;
+}
 export function approvalRefusal(approvalId, row, want, localMode) {
     if (localMode) {
         return {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.2",
+  "version": "1.13.4",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [