agentwallet-mcp 1.13.4 → 1.13.5

package/README.md

@@ -66,7 +66,7 @@ Set either key, or both. They are independent: run EVM locally and Solana hosted
 
 Local signing uses [viem](https://viem.sh) for EVM and `@solana/web3.js` for Solana, plus `bs58` for key parsing. SPL instructions are built by hand rather than with `@solana/spl-token`, because that package pulls in `bigint-buffer`, which carries a high severity buffer overflow advisory. A wallet has no business shipping that to save a dozen lines of instruction encoding.
 
-`npm audit` currently reports issues inside `@modelcontextprotocol/sdk`'s HTTP transport dependencies. This server speaks stdio, so that code never loads, and the SDK is not something this package can patch. Run the audit yourself. Publishing a tree you can inspect is the point.
+`npm audit` reports no advisories as of 1.13.5; the overrides in package.json keep two advisories under `@solana/web3.js`'s jayson closed. Earlier releases carried advisories inside `@modelcontextprotocol/sdk`'s HTTP transport dependencies. This server speaks stdio, so that code never loads, and the SDK is not something this package can patch. Run the audit yourself. Publishing a tree you can inspect is the point.
 
 <p align="center">
   <img src="assets/demo.svg" alt="AgentWallet demo, AI agent pays x402 invoice automatically" width="800">

package/build/index.js

@@ -13,14 +13,15 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, } from './x402-payment.js';
+import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, PERMIT2_ADDRESS, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, } from './x402-eip3009.js';
-import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, } from './local-solana.js';
+import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, } from './local-solana.js';
 /** True when either chain family is running non-custodially. */
 function anyLocalMode() {
     return isLocalMode() || isSolanaLocalMode();
@@ -76,7 +77,7 @@ async function routeLocally(path, method, body) {
     const [rawPath, rawQs = ''] = path.split('?');
     const qs = new URLSearchParams(rawQs);
     // POST /wallets/{id}/send
-    if (method === 'POST' && /^\/wallets\/[^/]*\/send$/.test(rawPath)) {
+    if (method === 'POST' && /^\/wallets\/[^/]+\/send$/.test(rawPath)) {
         const chainId = localChainId(body, qs);
         const solanaOp = SOLANA_CHAIN_IDS.has(chainId) || Boolean(body?.token_mint);
         if (solanaOp) {
@@ -209,7 +210,13 @@ async function api(path, method = 'GET', body, extraHeaders) {
        single choke point every funds operation already passes through means no
        tool can quietly stay custodial because someone forgot to update it. */
     if (anyLocalMode()) {
-        const handled = await routeLocally(path, method, body);
+        let handled;
+        try {
+            handled = await routeLocally(path, method, body);
+        }
+        catch (e) {
+            throw new Error(redactRpcSecrets(e)); // viem puts the RPC URL, key and all, in its messages
+        }
         if (handled !== NOT_HANDLED)
             return handled;
     }
@@ -221,15 +228,39 @@ async function api(path, method = 'GET', body, extraHeaders) {
     if (API_USER && API_PASS) {
         headers['Authorization'] = 'Basic ' + Buffer.from(`${API_USER}:${API_PASS}`).toString('base64');
     }
-    const options = { method, headers };
+    // The API host has no reason to send a wallet operation elsewhere: a
+    // redirect is refused instead of followed, so a request body is never
+    // replayed to another origin and another origin's answer is never returned
+    // as the API's (2026-10-04 audit).
+    const options = { method, headers, redirect: 'manual' };
     if (body && method !== 'GET') {
         options.body = JSON.stringify(body);
     }
     const res = await fetch(url, options);
-    const data = await res.json();
-    // Handle 402 Payment Required — auto-pay if a wallet or a local key is configured
-    if (res.status === 402 && (X402_WALLET_ID || anyLocalMode()) && !extraHeaders?.['X-PAYMENT'] && !extraHeaders?.['X-AGW-SKIP-X402']) {
-        return handleX402Payment(data, path, method, body);
+    if (res.status >= 300 && res.status < 400) {
+        throw new Error(`The AgentWallet API host answered ${path} with a redirect (HTTP ${res.status}); refusing to follow it.`);
+    }
+    const text = await res.text();
+    if (text.length > API_MAX_RESPONSE_CHARS)
+        throw new Error(`The AgentWallet API host returned an oversized response (${text.length} characters); refusing to parse it.`);
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
+    }
+    // A 402 from the API host is paid automatically only for a HOSTED wallet the
+    // operator named with AGENTWALLET_WALLET_ID. In local mode the host is not a
+    // custodian and must never be able to make the local key sign: a 402 is
+    // returned as an error and the agent can call pay_x402 explicitly, which
+    // reports what it does (2026-10-04 audit).
+    if (res.status === 402 && !extraHeaders?.['X-PAYMENT'] && !extraHeaders?.['X-AGW-SKIP-X402']) {
+        if (anyLocalMode()) {
+            throw new Error(`The AgentWallet API host asked for payment on ${path}; nothing is paid automatically in local mode. If you trust it, call pay_x402 with that URL so the payment is explicit and reported.`);
+        }
+        if (X402_WALLET_ID)
+            return handleX402Payment(data, path, method, body);
     }
     if (!res.ok) {
         const error = data.error || `HTTP ${res.status}`;
@@ -397,6 +428,7 @@ function isValidAddress(address) {
 /** Request headers the caller may not set on pay_x402: Host would rename the TLS peer, the rest belong to the client. */
 const FORBIDDEN_REQUEST_HEADERS = new Set(['host', 'content-length', 'transfer-encoding', 'connection', 'upgrade', 'expect', 'te', 'trailer', 'keep-alive']);
 /** Authorizations signed in this process, keyed by endpoint and requirement, kept until they expire. */
+const signingInFlight = new Map();
 const signedPayments = new Map();
 function looksLikeTxHash(v) {
     return typeof v === 'string' && (/^0x[0-9a-fA-F]{64}$/.test(v) || /^[1-9A-HJ-NP-Za-km-z]{86,88}$/.test(v));
@@ -417,6 +449,17 @@ function redactUrl(u) {
         return u;
     }
 }
+const API_MAX_RESPONSE_CHARS = 8 * 1024 * 1024;
+/* Error text from the local signing path with every URL reduced to its origin
+   and viem's "URL:" / "Request body:" lines dropped: an RPC endpoint carries
+   its API key in the path or query, and a tool result is the agent's context
+   and the client's log (2026-10-04 audit). */
+function redactRpcSecrets(err) {
+    const e = err;
+    let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : String(e?.message ?? err);
+    msg = msg.split(/\r?\n/).filter(l => !/^\s*(URL|Request body|Request Arguments|Raw Call Arguments)\s*:/i.test(l)).join('\n').trim();
+    return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)\]]+/gi, (u) => redactUrl(u));
+}
 /**
  * Decimals to scale a human amount by. Always the token's own value (registry,
  * then decimals() on chain); a caller-supplied value must agree or the call
@@ -425,12 +468,12 @@ function redactUrl(u) {
 async function verifiedDecimals(chainId, token, given) {
     let trusted = null;
     if (isSolanaChain(chainId)) {
-        trusted = lookupTrustedDecimals(chainId, token);
-        if (trusted === null) {
-            if (given === undefined)
-                throw new Error(`Decimals for mint ${token} are not in the registry; pass decimals explicitly.`);
-            return given; // the token program verifies it on-chain (TransferChecked)
-        }
+        // The mint itself says how many decimals it has; a caller's value only
+        // ever confirms it (2026-10-04 audit: the substituted byte could not catch
+        // an amount already scaled by a wrong guess).
+        trusted = await mintDecimalsStrict(token, chainId);
+        if (trusted === null)
+            throw new Error(`Could not read the decimals of mint ${token} from the chain; refusing to guess the scale of the amount.`);
     }
     else {
         trusted = await resolveTrustedDecimals(chainId, token);
@@ -444,15 +487,23 @@ async function verifiedDecimals(chainId, token, given) {
 function validateGuardEnv() {
     parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS); // throws on a malformed pin
     for (const name of ['AGENTWALLET_MAX_TX_NATIVE', 'AGENTWALLET_MAX_TX_TOKEN', 'AGENTWALLET_MAX_TX_SOL', 'AGENTWALLET_MAX_AUTOPAY']) {
-        const v = (process.env[name] || '').trim();
+        const raw = process.env[name];
+        const v = (raw || '').trim();
+        // Set but blank is a typo, not "no cap": refuse to start rather than run uncapped.
+        if (raw !== undefined && v === '')
+            throw new Error(`${name} is set but blank. Set it to a number or unset it.`);
         if (v && !/^\d+(\.\d+)?$/.test(v))
             throw new Error(`${name} must be a decimal number, got "${v}".`);
     }
-    for (const e of (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').split(',').map(s => s.trim()).filter(Boolean)) {
-        if (e !== 'native' && !/^0x[0-9a-fA-F]{40}$/.test(e) && !/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(e)) {
-            throw new Error(`AGENTWALLET_AUTOPAY_ASSETS entry "${e}" is not "native", an EVM address or an SPL mint.`);
+    for (const e of parseAutopayAssets(process.env.AGENTWALLET_AUTOPAY_ASSETS)) {
+        if (e.asset !== 'native' && !/^0x[0-9a-f]{40}$/.test(e.asset) && !/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(e.asset)) {
+            throw new Error(`AGENTWALLET_AUTOPAY_ASSETS entry "${e.asset}" is not "native", an EVM address or an SPL mint (optionally prefixed "chainId:").`);
         }
     }
+    const t = (process.env.AGENTWALLET_X402_MAX_TIMEOUT || '').trim();
+    if (t && (!/^\d+$/.test(t) || Number(t) < 60 || Number(t) > 31_536_000)) {
+        throw new Error(`AGENTWALLET_X402_MAX_TIMEOUT must be a whole number of seconds between 60 and 31536000, got "${t}".`);
+    }
 }
 // ─── EVM Helpers ──────────────────────────────────────────────────
 /**
@@ -503,48 +554,13 @@ function encodeUint256(value) {
 }
 // ─── Server ──────────────────────────────────────────────────────
 // ─── x402 Network Mapping ──────────────────────────────────────
-const X402_NETWORKS = {
-    'ethereum': 1,
-    'base': 8453,
-    'base-sepolia': 84532,
-    'polygon': 137,
-    'arbitrum': 42161,
-    'optimism': 10,
-    'bsc': 56,
-    'avalanche': 43114,
-    'zora': 7777777,
-    'pulsechain': 369,
-    'solana': 900,
-    'solana-devnet': 901,
-};
-// Solana genesis hash prefixes for CAIP-2
-const SOLANA_GENESIS = {
-    900: '5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp', // mainnet-beta
-    901: 'EtWTRABZaYq6iMfeYKouRu166VU2xqa1', // devnet
-};
 /**
- * Resolve an x402 network identifier to a chain ID.
- * Supports plain names ("base"), CAIP-2 format ("eip155:8453"), and raw chain IDs ("8453").
+ * Resolve an x402 network identifier to a chain ID: plain names ("base"),
+ * CAIP-2 ("eip155:8453", "solana:<genesis prefix>") and raw ids ("8453").
+ * The table and the parsing live in x402-payment.ts so they can be tested.
  */
 function resolveChainId(network) {
-    const lower = network.toLowerCase();
-    if (X402_NETWORKS[lower])
-        return X402_NETWORKS[lower];
-    const caipMatch = network.match(/^eip155:(\d+)$/);
-    if (caipMatch)
-        return parseInt(caipMatch[1], 10);
-    // Solana CAIP-2: solana:<genesis_prefix>
-    const solanaMatch = network.match(/^solana:(.+)$/);
-    if (solanaMatch) {
-        for (const [chainId, genesis] of Object.entries(SOLANA_GENESIS)) {
-            if (solanaMatch[1] === genesis)
-                return parseInt(chainId, 10);
-        }
-    }
-    const num = parseInt(network, 10);
-    if (!isNaN(num) && num > 0)
-        return num;
-    return null;
+    return resolveNetworkChainId(network);
 }
 // ─── Server ──────────────────────────────────────────────────────
 /**
@@ -561,7 +577,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.4',
+    version: '1.13.5',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1176,6 +1192,13 @@ async function resolveTokenDomain(chainId, asset, extra) {
     }
     return { name, version };
 }
+/** Text an endpoint wrote, bounded so it cannot flood the agent's context. */
+function serverText(s) {
+    if (s === undefined || s === null)
+        return null;
+    const t = String(s);
+    return t.length > 300 ? t.slice(0, 300) + '…' : t;
+}
 /** Sign the authorization with whichever custody mode is active (local key, or the hosted signer). */
 async function signAuthorization(walletId, chainId, asset, domain, auth, approvalId) {
     const r = (await api(`/wallets/${walletId}/x402/authorize`, 'POST', {
@@ -1206,8 +1229,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     'parses the payment requirements (v1 body or v2 PAYMENT-REQUIRED header), signs an EIP-3009 ' +
     'TransferWithAuthorization for the "exact" scheme (no gas, nothing broadcast by the payer), and retries ' +
     'the request with the payment header. AgentWallet paywalls are paid by on-chain transfer instead. ' +
-    'The "upto" scheme is refused, never approximated. Returns the final response and the settlement ' +
-    'receipt. Supports the x402 open payment standard (https://x402.org). Set max_payment to cap spend.', {
+    'The "upto" scheme is settled with a Permit2 authorization bounded by the cap. Returns the final response and the settlement ' +
+    'receipt. Supports the x402 open payment standard (https://x402.org). max_payment can only lower the operator\'s cap for one call.', {
     url: z.string().url().describe('The URL to access (will handle 402 payment if required)'),
     wallet_id: z.number().int().describe('Wallet ID to pay from'),
     method: z.string().default('GET').describe('HTTP method (GET, POST, PUT, DELETE)'),
@@ -1216,10 +1239,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         'endpoint redirects to a different origin they are dropped, not forwarded.'),
     body: z.string().optional().describe('Optional request body for POST/PUT requests'),
     max_payment: z.string().optional().describe('Maximum payment in human-readable format (e.g. "1.00" for 1 USDC). ' +
-        'Rejects payments above this amount. If omitted, a default cap of ' +
-        'AGENTWALLET_MAX_AUTOPAY (default "1") is applied, so an untrusted 402 ' +
-        'endpoint can never authorize an unbounded payment. Set this explicitly ' +
-        'to allow a larger single payment.'),
+        'Lowers the operator\'s AGENTWALLET_MAX_AUTOPAY ceiling (default "1") for this one call; ' +
+        'it can never raise it, and a value above the ceiling is ignored and reported as max_payment_ignored.'),
     prefer_chain: z.number().int().optional().describe('Preferred chain ID if the server accepts payment on multiple chains ' +
         '(e.g. 8453 for Base, 1 for Ethereum)'),
     request_approval: z.boolean().optional().describe('Hosted wallets only. When the payment exceeds the cap, email the wallet owner an approve/deny link ' +
@@ -1325,10 +1346,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     const option = picked.option;
     const chainId = picked.chainId;
     const isUpto = option.scheme === 'upto';
-    const rawAmount = requiredAmount(option);
-    if (!/^\d+$/.test(rawAmount)) {
-        throw new Error(`x402: invalid amount "${rawAmount}" in the payment requirements (expected integer base units).`);
-    }
+    const rawAmount = normalizeRawAmount(requiredAmount(option)); // "0010000" and "10000" are one amount
     // Decimals come from the registry or the token contract, NEVER from the 402
     // body. The endpoint controls what it declares, so trusting it would let a
     // hostile server inflate the cap and misreport the amount shown to the agent.
@@ -1400,8 +1418,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
                 ...overCap,
                 error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap (from ${capSource}).` +
                     (max_payment ? '' : ' No max_payment was provided, so the default cap was applied.') +
-                    (anyLocalMode() ? ' Local mode has no approval channel: raise max_payment, AGENTWALLET_MAX_AUTOPAY or AGENTWALLET_MAX_TX_TOKEN yourself.'
-                        : ' Pass request_approval=true to email the wallet owner for a one-time approval, or raise the cap.'),
+                    (anyLocalMode() ? ' Local mode has no approval channel; the caps are the operator\'s and only the operator can change them. Do not edit the environment or config to raise them.'
+                        : ' Pass request_approval=true to email the wallet owner for a one-time approval; the cap itself is the operator\'s to change.'),
             });
         }
     }
@@ -1423,11 +1441,24 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // The resource is the whole URL including its query: /buy?id=1 and /buy?id=2
     // are different purchases, and reusing the first signature for the second
     // would report a payment the second resource never received.
-    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, authorizationResource(url)].join('|');
+    // The method and body are part of what was bought: POST {item:A} and
+    // POST {item:B} to one URL are two purchases. Concurrent calls for one key
+    // wait for the first signature instead of each signing a nonce.
+    const bodyDigest = createHash('sha256').update(reqBody ?? '').digest('hex').slice(0, 16);
+    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, authorizationResource(url), (method || 'GET').toUpperCase(), bodyDigest].join('|');
+    const inFlight = signingInFlight.get(cacheKey);
+    if (inFlight && !fresh_authorization)
+        await inFlight;
     const cachedAuth = fresh_authorization ? undefined : signedPayments.get(cacheKey);
     for (const [k, v] of signedPayments)
         if (v.until <= Date.now())
             signedPayments.delete(k);
+    let releaseSigning = () => { };
+    if (!(cachedAuth && cachedAuth.until > Date.now())) {
+        const mine = new Promise(r => { releaseSigning = r; });
+        // Released when the signature is cached, or after 30 s if this call throws first, so a failure never wedges the key.
+        signingInFlight.set(cacheKey, Promise.race([mine, new Promise(r => setTimeout(r, 30_000).unref())]));
+    }
     if (cachedAuth && cachedAuth.until > Date.now()) {
         // Same endpoint, same requirement, still inside the window: re-send the
         // earlier signature. Its nonce is single-use, so a server that already
@@ -1441,7 +1472,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         const allowance = decodeUint(await ethCallHex(chainId, tokenAddress, permit2AllowanceCalldata(payer)));
         if (allowance < BigInt(rawAmount)) {
             if (process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1' && assetPolicy.via === 'stablecoin') {
-                const r = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: permit2ApproveCalldata(), chain_id: chainId }, skip));
+                // Approve exactly this payment's maximum, never unlimited (2026-10-04 audit).
+                const r = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: permit2ApproveCalldata(rawAmount), chain_id: chainId }, skip));
                 permit2ApprovalTx = String(r?.tx_hash || '');
                 await new Promise(res => setTimeout(res, 4000));
             }
@@ -1498,6 +1530,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
                 : Date.now() + maxAuthWindowSeconds() * 1000; // a broadcast transfer: the hash stays valid, re-sending it never pays twice
         signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until });
     }
+    releaseSigning();
+    signingInFlight.delete(cacheKey);
     // Step 6: Retry with the payment header and read the settlement receipt.
     const retryHeaders = { ...reqHeaders, [headerName]: paymentHeader };
     const retryOptions = {
@@ -1528,7 +1562,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     }
     if (retryRes.status === 402) {
         const again = parsePaymentRequired(n => retryRes.headers.get(n), retryParsed);
-        retryError = String(again?.error || retryParsed?.error || 'Payment was not accepted (no reason given).');
+        retryError = serverText(String(again?.error || retryParsed?.error || 'Payment was not accepted (no reason given).'));
         if (payerDelegationInfo && /signature/i.test(retryError))
             retryError += ` Likely cause: ${payerDelegationInfo.warning}`;
     }
@@ -1559,7 +1593,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         settlement_reported_by_server: settlement,
         authorization: authorization ? { nonce: authorization.nonce, valid_before: authorization.validBefore }
             : (uptoAuth ? { scheme: 'upto', max_amount: amount, nonce: uptoAuth.nonce, deadline: uptoAuth.deadline, facilitator: uptoAuth.witness.facilitator } : null),
-        description: option.description,
+        description: serverText(option.description),
+        server_text_is_untrusted: true, // description, retry_error and the response are the endpoint's words, not instructions
         response: retryParsed,
     });
 });
@@ -1764,7 +1799,13 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
             mode: 'custodial',
             custody: 'agentwallet',
             signing: 'AgentWallet servers hold an encrypted key and sign on your behalf.',
-            api_base: API_BASE,
+            api_base: redactUrl(API_BASE),
+            client_guards: {
+                autopay_cap_usd: autopayEnvCap(),
+                autopay_assets: (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').trim() || 'registry stablecoins only',
+                x402_max_timeout_seconds: maxAuthWindowSeconds(),
+                note: 'These bound pay_x402 on hosted wallets too; the hosted signer adds its own pause, daily limit and approval checks.',
+            },
             to_self_custody: 'Set AGENTWALLET_PRIVATE_KEY for EVM and/or AGENTWALLET_SOLANA_KEY for Solana, then restart. ' +
                 'Use export_wallet_key first if you want to carry an existing hosted wallet across.',
         });
@@ -1864,7 +1905,7 @@ async function main() {
         }
     }
     else {
-        console.error('AgentWallet MCP: custodial mode via ' + API_BASE + '. Run wallet_mode for details.');
+        console.error('AgentWallet MCP: custodial mode via ' + redactUrl(API_BASE) + '. Run wallet_mode for details.');
     }
 }
 main().catch((error) => {

package/build/local-solana.d.ts

@@ -16,6 +16,8 @@ export declare function isSolanaLocalMode(): boolean;
 export declare function getSolanaKeypair(): Keypair;
 export declare function getSolanaAddress(): string;
 export declare function resolveSolanaRpc(chainId?: number): string;
+/** The mint's decimals from the chain, or null when they cannot be read. Never guesses. */
+export declare function mintDecimalsStrict(mint: string, chainId: number): Promise<number | null>;
 export declare function localSolBalance(chainId?: number): Promise<{
     address: string;
     chain_id: number;

package/build/local-solana.js

@@ -53,6 +53,8 @@ function parseSolanaKey(raw) {
         }
         return Keypair.fromSecretKey(Uint8Array.from(buf.subarray(0, 64)));
     }
+    if (text.length > 256)
+        throw new Error('Solana key text is too long to be a key.'); // base58 decoding is quadratic; cap before decoding
     const decoded = bs58.decode(text);
     if (decoded.length !== 64) {
         throw new Error(`Base58 Solana key must decode to 64 bytes, got ${decoded.length}.`);
@@ -170,6 +172,23 @@ function assertWithinSolCap(lamports) {
  * times too permissive, and SPL mints with 0 to 5 decimals are common.
  */
 const splDecimalsCache = new Map();
+/** The mint's decimals from the chain, or null when they cannot be read. Never guesses. */
+export async function mintDecimalsStrict(mint, chainId) {
+    const known = lookupTrustedDecimals(chainId, mint);
+    if (typeof known === 'number')
+        return known;
+    try {
+        const conn = connection(chainId);
+        await assertCluster(conn, chainId);
+        const info = await conn.getParsedAccountInfo(new PublicKey(mint));
+        const data = info?.value?.data;
+        const d = Number(data?.parsed?.info?.decimals);
+        return Number.isInteger(d) && d >= 0 && d <= 36 ? d : null;
+    }
+    catch {
+        return null;
+    }
+}
 async function resolveMintDecimals(mint, chainId) {
     const known = lookupTrustedDecimals(chainId, mint);
     if (typeof known === 'number')
@@ -373,23 +392,33 @@ function createAtaIdempotentIx(payer, ata, owner, mint, tokenProgram) {
  * not exist, using the idempotent instruction so a race cannot fail the send.
  */
 export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId = 900) {
-    // Checked before any RPC round trip: a blocked transfer should cost nothing
-    // and should not announce itself to the RPC provider first.
-    await assertWithinSplCap(mintStr, BigInt(rawAmount), chainId);
     const conn = connection(chainId);
+    // The cluster is verified before the cap reads decimals from it, so the
+    // decimals cache is never filled from a node serving another chain.
     await assertCluster(conn, chainId);
+    await assertWithinSplCap(mintStr, BigInt(rawAmount), chainId);
     const payer = getSolanaKeypair();
     const mint = new PublicKey(mintStr);
     const recipient = new PublicKey(to);
     await assertRecipientIsWallet(conn, recipient);
     const { tokenProgram, ataSize } = await mintLayout(conn, mint);
-    // The instruction's decimals byte is the mint's real value, not whatever the
-    // caller passed; TransferChecked would reject a wrong one on-chain anyway.
-    decimals = await resolveMintDecimals(mintStr, chainId);
+    // The caller scaled the amount by `decimals`. That value must be the mint's
+    // real one: substituting the real value into the instruction (as 1.13.0
+    // did) let a wrong guess through, because the amount had already been
+    // scaled by the guess and TransferChecked only sees the real byte
+    // (2026-10-04 audit). A mismatch refuses.
+    const real = await mintDecimalsStrict(mintStr, chainId);
+    if (real === null)
+        throw new Error(`Could not read the decimals of mint ${mintStr} from the chain; refusing to guess the scale of the amount.`);
+    if (decimals !== real)
+        throw new Error(`decimals ${decimals} was passed but mint ${mintStr} has ${real} decimals; refusing to scale the amount by the wrong factor.`);
     const sourceAta = associatedTokenAddress(payer.publicKey, mint, tokenProgram);
     const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
     const tx = new Transaction();
     const destInfo = await conn.getAccountInfo(destAta);
+    if (destInfo && !destInfo.owner.equals(tokenProgram)) {
+        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is already occupied by an account the token program does not own, so no token account can be created there.`);
+    }
     if (!destInfo) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
@@ -442,6 +471,14 @@ async function assertRecipientIsWallet(conn, recipient) {
         }
         throw new Error(`Refusing to send to ${recipient.toBase58()}: it is an account owned by the SPL token program, not a wallet.`);
     }
+    // Everything else that exists must be a plain system account: a program's
+    // data or buffer account, an address lookup table, a stake or vote account
+    // is owned by its program and nothing can ever sign for it as a wallet
+    // (2026-10-04 audit). A program-derived vault that holds tokens is still
+    // system-owned, so this costs nothing legitimate.
+    if (!info.owner.equals(SystemProgram.programId)) {
+        throw new Error(`Refusing to send to ${recipient.toBase58()}: it is owned by program ${info.owner.toBase58()}, not a wallet. Pass a wallet address.`);
+    }
 }
 export function solanaWalletRecord() {
     return {

package/build/local-wallet.d.ts

@@ -67,6 +67,28 @@ export interface LocalSendResult {
     mode: 'local';
     signed_locally: true;
 }
+/**
+ * What a decimals() probe learned about an address. The four outcomes are
+ * kept apart on purpose: only `not-a-token` may ever reach an allow branch.
+ *
+ * - a number: the contract answered decimals() with a usable value
+ * - `unusable`: it answered, but with a value no real token has (outside
+ *   0..36) or data that does not decode; it IS a contract that implements
+ *   decimals(), so treat it as a token and price nothing on trust
+ * - `not-a-token`: the call reverted or returned no data, which is how a
+ *   router, bridge or plain account answers
+ * - `unreachable`: the RPC failed, so nothing is known either way
+ *
+ * Reported privately 2026-09-26: the previous shape collapsed `unusable` and
+ * `unreachable` into the same null as `not-a-token`, so a token whose
+ * decimals() returned 77 was classified as "not a token" and unpriced
+ * calldata to it went through the cap unrefused. Byte-identical contracts
+ * differing only in that immutable were blocked (18) and sent (77).
+ */
+type DecimalsProbe = number | 'unusable' | 'not-a-token' | 'unreachable';
+/** An eth_call failure is a revert only when the node says so; every other failure is "could not ask". */
+export declare function classifyDecimalsError(err: unknown): DecimalsProbe;
+export declare function permit2AddressFor(chainId: number): string;
 export declare function localSend(chainId: number, to: Address, valueWei: bigint, data?: Hex): Promise<LocalSendResult>;
 /** ERC-20 transfer, encoded locally. */
 export declare function localTransferToken(chainId: number, token: Address, to: Address, rawAmount: string): Promise<LocalSendResult>;
@@ -119,3 +141,4 @@ export declare function localSignPermit2Upto(chainId: number, auth: UptoPermit2A
     from: Address;
     mode: 'local';
 }>;
+export {};

package/build/local-wallet.js

@@ -15,7 +15,7 @@
  * on the custodial path and say so explicitly rather than silently downgrading.
  */
 import { readFileSync, statSync } from 'node:fs';
-import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, BaseError, ContractFunctionZeroDataError, ContractFunctionRevertedError, ExecutionRevertedError, AbiDecodingDataSizeTooSmallError, AbiDecodingDataSizeInvalidError, } from 'viem';
+import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { lookupTrustedDecimals, maxAuthWindowSeconds } from './x402-payment.js';
 import { wrappedNativeAddress } from './wrapped-native.js';
@@ -49,12 +49,19 @@ function loadKeyMaterial() {
     }
     return null;
 }
+const SECP256K1_N = BigInt('0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141');
 function normalizeKey(raw) {
     const hex = raw.startsWith('0x') ? raw.slice(2) : raw;
     if (!/^[0-9a-fA-F]{64}$/.test(hex)) {
         throw new Error('Invalid private key. Expected 64 hex characters, with or without a 0x prefix. ' +
             'The value itself is never logged.');
     }
+    // Checked here with a fixed message: the curve library's own range error
+    // prints the offending value in decimal (2026-10-04 audit).
+    const n = BigInt('0x' + hex);
+    if (n === 0n || n >= SECP256K1_N) {
+        throw new Error('Invalid private key: the value is outside the secp256k1 range. The value itself is never logged.');
+    }
     return `0x${hex}`;
 }
 /** True when the server is running non-custodially. */
@@ -68,10 +75,10 @@ export function getLocalAccount() {
     if (keyLoadError)
         throw new Error(keyLoadError);
     const raw = loadKeyMaterial();
+    if (keyLoadError)
+        throw new Error(keyLoadError); // the keyfile's own reason, before the generic line
     if (!raw)
         throw new Error('Local signing mode is not configured.');
-    if (keyLoadError)
-        throw new Error(keyLoadError);
     cachedAccount = privateKeyToAccount(normalizeKey(raw));
     return cachedAccount;
 }
@@ -155,8 +162,8 @@ function assertWithinNativeCap(valueWei) {
     const [whole, frac = ''] = cap.split('.');
     const capWei = BigInt(whole + frac.padEnd(18, '0').slice(0, 18));
     if (valueWei > capWei) {
-        throw new Error(`Blocked by local guard: transaction value exceeds AGENTWALLET_MAX_TX_NATIVE (${cap}). ` +
-            `Raise the cap deliberately if this is intended.`);
+        throw new Error(`Blocked by local guard: transaction value exceeds AGENTWALLET_MAX_TX_NATIVE (${cap}), a cap only the operator can change. ` +
+            `Do not edit the environment or config to raise it.`);
     }
 }
 /* ── Read operations ─────────────────────────────────────────────── */
@@ -230,32 +237,26 @@ async function probeTokenDecimals(chainId, token) {
     const cached = decimalsCache.get(key);
     if (typeof cached === 'number')
         return cached;
-    let onChain;
+    // The raw JSON-RPC envelope is classified here rather than through viem's
+    // readContract: viem maps error code -32603 ("Internal error", what an
+    // overloaded node or a proxy answers) and an empty envelope to "the contract
+    // reverted", which is the one answer this guard treats as evidence of a
+    // non-token (2026-10-04 audit). Only an explicit revert counts as that.
+    let result;
     try {
         const { pub } = clients(chainId);
-        onChain = await pub.readContract({
-            address: token,
-            abi: ERC20_ABI,
-            functionName: 'decimals',
-        });
+        result = await pub.request({ method: 'eth_call', params: [{ to: token, data: DECIMALS_SELECTOR }, 'latest'] });
     }
     catch (err) {
-        // viem wraps every readContract failure in ContractFunctionExecutionError;
-        // the cause says whether the contract itself declined (revert, empty
-        // return: not an ERC-20) or the answer never arrived (RPC down, timeout,
-        // malformed response). Only the first is evidence of anything.
-        const declined = err instanceof BaseError && err.walk((e) => e instanceof ContractFunctionZeroDataError
-            || e instanceof ContractFunctionRevertedError
-            || e instanceof ExecutionRevertedError // nodes that report a revert as -32000 rather than 3
-        ) !== null;
-        if (declined)
-            return 'not-a-token';
-        // A decode failure on non-empty data means the contract answered
-        // decimals() with something that is not a uint8: a token, just a broken one.
-        const decodeFailed = err instanceof BaseError && err.walk((e) => e instanceof AbiDecodingDataSizeTooSmallError || e instanceof AbiDecodingDataSizeInvalidError) !== null;
-        return decodeFailed ? 'unusable' : 'unreachable';
+        return classifyDecimalsError(err);
     }
-    const d = Number(onChain);
+    if (result === '0x')
+        return 'not-a-token'; // answered with nothing: no decimals() here
+    if (typeof result !== 'string' || !/^0x([0-9a-fA-F]{2})+$/.test(result))
+        return 'unreachable'; // not an answer at all
+    if (result.length !== 66)
+        return 'unusable'; // answered, but not one uint8 word
+    const d = Number(BigInt(result));
     // Reject nonsense rather than trusting it; an out-of-range value would
     // widen the ceiling exactly like the old assumption did.
     if (Number.isInteger(d) && d >= 0 && d <= 36) {
@@ -264,6 +265,19 @@ async function probeTokenDecimals(chainId, token) {
     }
     return 'unusable';
 }
+const DECIMALS_SELECTOR = '0x313ce567';
+/** An eth_call failure is a revert only when the node says so; every other failure is "could not ask". */
+export function classifyDecimalsError(err) {
+    const e = err;
+    const code = typeof e?.code === 'number' ? e.code : NaN;
+    const text = [e?.message, e?.details, e?.shortMessage].filter(Boolean).join(' ');
+    const hasRevertData = typeof e?.data === 'string' && /^0x[0-9a-fA-F]*$/.test(e.data);
+    if (code === 3)
+        return 'not-a-token'; // the JSON-RPC "execution error" code
+    if ((code === -32000 || code === -32603 || code === -32015) && (/revert/i.test(text) || hasRevertData))
+        return 'not-a-token';
+    return 'unreachable';
+}
 /**
  * Decimals to price a known transfer or approval at. Anything short of a
  * usable answer is evaluated at 0, the only value that cannot fail open.
@@ -272,8 +286,16 @@ async function resolveTokenDecimals(chainId, token) {
     const probe = await probeTokenDecimals(chainId, token);
     return typeof probe === 'number' ? probe : 0;
 }
-/** Canonical Permit2, the same address on every EVM chain it is deployed to. */
+/** Canonical Permit2, plus the chains that run a different deployment. */
 const PERMIT2 = '0x000000000022d473030f116ddee9f6b43ac78ba3';
+const PERMIT2_BY_CHAIN = { 324: '0x0000000000225e31d15943971f47ad3022f714fa' }; // zkSync Era
+export function permit2AddressFor(chainId) { return PERMIT2_BY_CHAIN[chainId] || PERMIT2; }
+/* Permit2's own function selectors. Calldata with one of these aimed at a
+   contract that declines decimals() is a Permit2 call on a deployment this
+   table does not know, and is refused rather than let through as "a router"
+   (2026-10-04 audit). approve, permit (2 shapes), transferFrom (2), lockdown,
+   permitTransferFrom (2), permitWitnessTransferFrom (2), invalidateNonces/UnorderedNonces. */
+const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516', '0d58b1db', 'cc53287f', '30f28b7a', 'edd9444b', '137c29fe', 'fe8ec1a7', '3ff9dcb1', '0d58b1db']);
 const CAP_LAYOUTS = {
     a9059cbb: { amountIndex: 1, what: 'token transfer' }, // transfer(address,uint256)
     '23b872dd': { amountIndex: 2, what: 'token transfer' }, // transferFrom(address,address,uint256)
@@ -314,7 +336,7 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
     }
     const hex = data.slice(2);
     const selector = hex.slice(0, 8).toLowerCase();
-    const isPermit2 = to.toLowerCase() === PERMIT2;
+    const isPermit2 = to.toLowerCase() === PERMIT2 || to.toLowerCase() === permit2AddressFor(chainId);
     const layout = CAP_LAYOUTS[selector];
     const isWrappedNative = to.toLowerCase() === wrappedNativeAddress(chainId);
     const priced = layout
@@ -335,7 +357,11 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
             throw new Error(`Blocked by local guard: calldata selector 0x${selector} refused rather than let through uncapped: ${why}. ` +
                 `Use transfer, transferFrom, approve, increaseAllowance, Permit2 approve, ` +
                 `or deposit/withdraw on the chain's wrapped-native contract, ` +
-                `or set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1 to allow it deliberately.`);
+                `or ask the operator, who alone can set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1.`);
+        }
+        if (PERMIT2_SELECTORS.has(selector)) {
+            throw new Error(`Blocked by local guard: calldata selector 0x${selector} is a Permit2 function aimed at ${to}, which is not the Permit2 deployment this guard knows for chain ${chainId}; ` +
+                `refused rather than let through uncapped. Only the operator can allow it (AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1).`);
         }
         return; // an ordinary contract call; it can only pull what an existing approval allows (see the note above)
     }
@@ -367,8 +393,8 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (amount > capRaw) {
         throw new Error(`Blocked by local guard: ${layout.what} of ${amount} base units exceeds ` +
-            `AGENTWALLET_MAX_TX_TOKEN (${cap}, evaluated at ${decimals} decimals). ` +
-            `Raise the cap deliberately if this is intended.`);
+            `AGENTWALLET_MAX_TX_TOKEN (${cap}, evaluated at ${decimals} decimals), a cap only the operator can change. ` +
+            `Do not edit the environment or config to raise it.`);
     }
     // increaseAllowance ADDS to what a spender may already pull. Checking the
     // increment alone let two individually compliant calls leave a standing
@@ -393,7 +419,7 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
         if (total > capRaw) {
             throw new Error(`Blocked by local guard: ${layout.what} of ${amount} base units would leave a standing allowance of ${total} base units ` +
                 `for ${spender}, above AGENTWALLET_MAX_TX_TOKEN (${cap}, evaluated at ${decimals} decimals). ` +
-                `Use approve with an absolute amount, or raise the cap deliberately.`);
+                `Use approve with an absolute amount; the cap itself is the operator's to change.`);
         }
     }
 }

package/build/ssrf-guard.d.ts

@@ -96,6 +96,8 @@ export declare function headersForRedirect(headers: HeadersInit | undefined, fro
  * take the wallet process down. Wire bytes are capped separately on the Agent.
  */
 export declare const MAX_RESPONSE_BYTES: number;
+/** Deadline applied when the caller passes no AbortSignal. */
+export declare const DEFAULT_FETCH_TIMEOUT_MS = 30000;
 /** Header safeFetch adds to every response: the URL the body actually came from, after redirects. */
 export declare const FINAL_URL_HEADER = "x-agw-final-url";
 /** The URL a safeFetch response actually came from, after every redirect. Only safeFetch can set it. */

package/build/ssrf-guard.js

@@ -215,6 +215,11 @@ export async function resolvePublicUrl(url) {
         throw new Error(`Could not resolve host "${bare}".`);
     const addresses = [];
     for (const a of answers) {
+        // Only a canonical IP string is judged; anything else from a resolver is
+        // refused rather than passed through isPrivateAddress, which cannot
+        // classify a non-canonical spelling and would answer "public".
+        if (isIP(a.address) === 0)
+            throw new Error(`Resolver returned a non-canonical address for "${bare}"; refusing.`);
         if (isPrivateAddress(a.address)) {
             throw new Error('URL resolves to a private/internal address. Only public URLs are allowed.');
         }
@@ -328,6 +333,8 @@ export function headersForRedirect(headers, from, to, bodyDropped) {
  * take the wallet process down. Wire bytes are capped separately on the Agent.
  */
 export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+/** Deadline applied when the caller passes no AbortSignal. */
+export const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
 /** Header safeFetch adds to every response: the URL the body actually came from, after redirects. */
 export const FINAL_URL_HEADER = 'x-agw-final-url';
 /* The final URL is also recorded here, keyed by the Response object, and
@@ -397,7 +404,8 @@ async function readBounded(stream, limit) {
  */
 export async function safeFetch(url, options = {}, maxHops = 3) {
     let current = url;
-    let opts = options;
+    // A caller that forgets a signal still gets a deadline; a silent server must not hold the process.
+    let opts = options.signal ? options : { ...options, signal: AbortSignal.timeout(DEFAULT_FETCH_TIMEOUT_MS) };
     for (let hop = 0; hop <= maxHops; hop++) {
         const { addresses } = await resolvePublicUrl(current);
         // One agent per hop, carrying that hop's pinned addresses. The hostname is

package/build/x402-eip3009.d.ts

@@ -81,6 +81,8 @@ export declare function isLegacyAgentWalletAccept(a: X402Requirement): boolean;
 export declare function requiredAmount(a: X402Requirement): string;
 export declare function createNonce(): `0x${string}`;
 /** Authorization window mirrors the reference client: valid from 10 minutes ago until maxTimeoutSeconds from now. */
+/** Shortest validity window signed, whatever the server asks for. */
+export declare const MIN_WINDOW_SECONDS = 60;
 export declare function buildAuthorization(from: string, req: X402Requirement, nowSeconds?: number, nonce?: `0x${string}`): Eip3009Authorization;
 /** EIP-712 typed data for the authorization. `name`/`version` are the token's own domain values. */
 export declare function typedDataFor(chainId: number, asset: string, name: string, version: string, auth: Eip3009Authorization): {

package/build/x402-eip3009.js

@@ -52,6 +52,8 @@ export function createNonce() {
 }
 const DEFAULT_TIMEOUT_SECONDS = 300;
 /** Authorization window mirrors the reference client: valid from 10 minutes ago until maxTimeoutSeconds from now. */
+/** Shortest validity window signed, whatever the server asks for. */
+export const MIN_WINDOW_SECONDS = 60;
 export function buildAuthorization(from, req, nowSeconds = Math.floor(Date.now() / 1000), nonce = createNonce()) {
     const value = requiredAmount(req);
     if (!/^\d+$/.test(value))
@@ -63,7 +65,9 @@ export function buildAuthorization(from, req, nowSeconds = Math.floor(Date.now()
     // asking for years would otherwise hold one until the wallet is refilled.
     const requested = Number.isFinite(req.maxTimeoutSeconds) && req.maxTimeoutSeconds > 0
         ? Math.floor(req.maxTimeoutSeconds) : DEFAULT_TIMEOUT_SECONDS;
-    const timeout = Math.min(requested, maxAuthWindowSeconds());
+    // Floor as well as cap: a server asking for a 2-second window would make
+    // every retry sign a fresh nonce it can also settle (2026-10-04 audit).
+    const timeout = Math.max(Math.min(requested, maxAuthWindowSeconds()), Math.min(MIN_WINDOW_SECONDS, maxAuthWindowSeconds()));
     return {
         from: from,
         to: req.payTo,

package/build/x402-payment.d.ts

@@ -66,11 +66,20 @@ export declare function assetLabel(chainId: number, asset: string): string;
  * list of token addresses / mints, or the word "native". Listed assets are
  * then capped in their own units, which the operator has opted into knowingly.
  */
+export declare function parseAutopayAssets(raw: string | undefined): Array<{
+    chainId: number | null;
+    asset: string;
+}>;
 export declare function autopayAssetAllowed(chainId: number, asset: string): {
     allowed: boolean;
     via: 'stablecoin' | 'allowlist' | 'none';
     reason?: string;
 };
+export declare const X402_NETWORK_IDS: Record<string, number>;
+/** A positive integer chain id for an x402 network string, or null. Never guesses. */
+export declare function resolveNetworkChainId(network: string): number | null;
+/** An integer base-unit amount in canonical form: "0010000" and "10000" are one amount, not two cache keys. */
+export declare function normalizeRawAmount(raw: string): string;
 /** The operator's per-payment ceiling, as configured. Validated so a typo never reads as "unlimited". */
 export declare function autopayEnvCap(): string;
 /**

package/build/x402-payment.js

@@ -110,21 +110,73 @@ export function assetLabel(chainId, asset) {
  * list of token addresses / mints, or the word "native". Listed assets are
  * then capped in their own units, which the operator has opted into knowingly.
  */
+/* One AGENTWALLET_AUTOPAY_ASSETS entry: "8453:0x..." or "900:native" names one
+   chain; a bare "0x..." / "native" applies on every chain (the original
+   grammar, kept so existing configs keep working, but the same address is a
+   different contract on another chain, so scoped entries are the safer form). */
+export function parseAutopayAssets(raw) {
+    return (raw || '').split(',').map(s => s.trim()).filter(Boolean).map(e => {
+        const m = e.match(/^(\d+):(.+)$/);
+        const chainId = m ? parseInt(m[1], 10) : null;
+        const a = (m ? m[2] : e).trim();
+        return { chainId, asset: a.startsWith('0x') ? a.toLowerCase() : a };
+    });
+}
 export function autopayAssetAllowed(chainId, asset) {
     if (isStableAsset(chainId, asset))
         return { allowed: true, via: 'stablecoin' };
-    const list = (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').split(',').map(s => s.trim()).filter(Boolean);
     const wanted = asset ? (asset.startsWith('0x') ? asset.toLowerCase() : asset) : 'native';
-    if (list.some(e => (e.startsWith('0x') ? e.toLowerCase() : e) === wanted))
+    const hit = parseAutopayAssets(process.env.AGENTWALLET_AUTOPAY_ASSETS).some(e => e.asset === wanted && (e.chainId === null || e.chainId === chainId));
+    if (hit)
         return { allowed: true, via: 'allowlist' };
     const label = assetLabel(chainId, asset);
     return {
         allowed: false, via: 'none',
         reason: `x402 blocked: this endpoint wants payment in ${label}${asset ? ` (${asset})` : ''} on chain ${chainId}, which is not a stablecoin ` +
-            `AGENTWALLET_MAX_AUTOPAY can price. To allow it, add ${asset ? `"${asset}"` : '"native"'} to AGENTWALLET_AUTOPAY_ASSETS; ` +
-            `the cap then applies in ${label} units, not dollars.`,
+            `AGENTWALLET_MAX_AUTOPAY can price and is not on the operator's AGENTWALLET_AUTOPAY_ASSETS list for chain ${chainId}. ` +
+            `Only the operator can change that list; do not edit the environment or config to add it.`,
     };
 }
+/* The x402 network names this client knows. Looked up with Object.hasOwn so a
+   name like "constructor" or "__proto__" (inherited from Object.prototype)
+   is unknown rather than a truthy function (2026-10-04 audit). */
+export const X402_NETWORK_IDS = {
+    'ethereum': 1, 'base': 8453, 'base-sepolia': 84532, 'polygon': 137, 'arbitrum': 42161, 'optimism': 10,
+    'bsc': 56, 'avalanche': 43114, 'zora': 7777777, 'pulsechain': 369, 'solana': 900, 'solana-devnet': 901,
+};
+const SOLANA_GENESIS_PREFIX = { 900: '5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp', 901: 'EtWTRABZaYq6iMfeYKouRu166VU2xqa1' };
+/** A positive integer chain id for an x402 network string, or null. Never guesses. */
+export function resolveNetworkChainId(network) {
+    if (typeof network !== 'string')
+        return null;
+    const lower = network.toLowerCase();
+    if (Object.hasOwn(X402_NETWORK_IDS, lower))
+        return X402_NETWORK_IDS[lower];
+    const caip = network.match(/^eip155:(\d{1,12})$/);
+    if (caip) {
+        const n = Number(caip[1]);
+        return Number.isSafeInteger(n) && n > 0 ? n : null;
+    }
+    const sol = network.match(/^solana:(.+)$/);
+    if (sol) {
+        for (const [id, g] of Object.entries(SOLANA_GENESIS_PREFIX)) {
+            if (sol[1] === g)
+                return Number(id);
+        }
+        return null;
+    }
+    if (/^\d{1,12}$/.test(network)) {
+        const n = Number(network);
+        return n > 0 ? n : null;
+    }
+    return null;
+}
+/** An integer base-unit amount in canonical form: "0010000" and "10000" are one amount, not two cache keys. */
+export function normalizeRawAmount(raw) {
+    if (!/^\d+$/.test(raw))
+        throw new Error(`x402: invalid amount "${raw}" in the payment requirements (expected integer base units).`);
+    return BigInt(raw).toString();
+}
 /** The operator's per-payment ceiling, as configured. Validated so a typo never reads as "unlimited". */
 export function autopayEnvCap() {
     const raw = (process.env.AGENTWALLET_MAX_AUTOPAY || '').trim() || '1';
@@ -287,7 +339,7 @@ export function deriveX402Payment(accept, maxAutopayHuman, trustedDecimals) {
     const capRaw = toBaseUnits(maxAutopayHuman, trustedDecimals);
     if (BigInt(rawAmount) > BigInt(capRaw)) {
         throw new Error(`x402 auto-pay blocked: required amount (${rawAmount} base units) exceeds the ` +
-            `AGENTWALLET_MAX_AUTOPAY cap of ${maxAutopayHuman}. Raise AGENTWALLET_MAX_AUTOPAY to allow it.`);
+            `AGENTWALLET_MAX_AUTOPAY cap of ${maxAutopayHuman}, which only the operator can change.`);
     }
     return { tokenAddress, rawAmount, decimals: trustedDecimals };
 }
@@ -346,12 +398,14 @@ export function authorizationResource(url) {
 export function approvalRefusal(approvalId, row, want, localMode) {
     if (localMode) {
         return {
-            error: `Approval ${approvalId} cannot be used in local mode: approvals are consumed by the hosted signer, and this server signs with your own key, so nothing could mark it used. Local mode has no approval channel: raise AGENTWALLET_MAX_AUTOPAY or AGENTWALLET_MAX_TX_TOKEN yourself.`,
+            error: `Approval ${approvalId} cannot be used in local mode: approvals are consumed by the hosted signer, and this server signs with your own key, so nothing could mark it used. Local mode has no approval channel; the caps are the operator's and only the operator can change them.`,
         };
     }
     const status = row?.status ?? null;
-    // "used" must read as exactly 0. A missing or unparseable field refuses rather than passes.
-    if (status !== 'approved' || Number(row?.used) !== 0) {
+    // "used" must be exactly the number 0 or the string "0" (wpdb rows carry
+    // strings). null, "", false and anything else refuse: Number(null) is 0.
+    const unused = row?.used === 0 || row?.used === '0';
+    if (status !== 'approved' || !unused) {
         const state = status === 'approved' ? 'already used' : `${status ?? 'unknown'}, not approved`;
         return { approval_status: status, error: `Approval ${approvalId} is ${state}.${row?.error ? ' ' + row.error : ''}` };
     }

package/build/x402-permit2.d.ts

@@ -119,6 +119,6 @@ export declare function uptoTypedData(chainId: number, auth: UptoPermit2Authoriz
 export declare function uptoPayload(auth: UptoPermit2Authorization, signature: string): Record<string, unknown>;
 /** allowance(owner, Permit2) calldata. */
 export declare function permit2AllowanceCalldata(owner: string): `0x${string}`;
-/** approve(Permit2, max) calldata: the one-time step upto needs. */
-export declare function permit2ApproveCalldata(): `0x${string}`;
+/** approve(Permit2, amount) calldata; unlimited only when no amount is given. */
+export declare function permit2ApproveCalldata(amountRaw?: string): `0x${string}`;
 export declare function decodeUint(hex: string): bigint;

package/build/x402-permit2.js

@@ -52,7 +52,7 @@ export function buildUptoAuthorization(from, req, nowSeconds = Math.floor(Date.n
     if (!/^0x[0-9a-fA-F]{40}$/.test(req.payTo))
         throw new Error(`x402 upto: payTo is not an EVM address: "${req.payTo}".`);
     const requested = Number.isFinite(req.maxTimeoutSeconds) && req.maxTimeoutSeconds > 0 ? Math.floor(req.maxTimeoutSeconds) : 300;
-    const timeout = Math.min(requested, maxAuthWindowSeconds()); // see buildAuthorization
+    const timeout = Math.max(Math.min(requested, maxAuthWindowSeconds()), Math.min(60, maxAuthWindowSeconds())); // see buildAuthorization
     return {
         from: from,
         permitted: { token: req.asset, amount },
@@ -85,9 +85,10 @@ function pad(addr) { return addr.replace(/^0x/, '').toLowerCase().padStart(64, '
 export function permit2AllowanceCalldata(owner) {
     return ('0xdd62ed3e' + pad(owner) + pad(PERMIT2_ADDRESS));
 }
-/** approve(Permit2, max) calldata: the one-time step upto needs. */
-export function permit2ApproveCalldata() {
-    return ('0x095ea7b3' + pad(PERMIT2_ADDRESS) + 'f'.repeat(64));
+/** approve(Permit2, amount) calldata; unlimited only when no amount is given. */
+export function permit2ApproveCalldata(amountRaw) {
+    const word = amountRaw === undefined ? 'f'.repeat(64) : BigInt(amountRaw).toString(16).padStart(64, '0');
+    return ('0x095ea7b3' + pad(PERMIT2_ADDRESS) + word);
 }
 export function decodeUint(hex) {
     const h = (hex || '').replace(/^0x/, '');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.4",
+  "version": "1.13.5",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [