agentwallet-mcp 1.13.6 → 1.13.8

package/build/index.js

@@ -13,7 +13,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
@@ -223,6 +223,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     const url = `${API_BASE}${path}`;
     const headers = {
         'Content-Type': 'application/json',
+        'Accept-Encoding': 'identity', // a 500 KB gzip body inflated to 500 MB before the size check (round 3)
         ...extraHeaders,
     };
     if (API_USER && API_PASS) {
@@ -240,9 +241,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     if (res.status >= 300 && res.status < 400) {
         throw new Error(`The AgentWallet API host answered ${path} with a redirect (HTTP ${res.status}); refusing to follow it.`);
     }
-    const text = await res.text();
-    if (text.length > API_MAX_RESPONSE_CHARS)
-        throw new Error(`The AgentWallet API host returned an oversized response (${text.length} characters); refusing to parse it.`);
+    const text = await readBounded(res, API_MAX_RESPONSE_CHARS, 'The AgentWallet API host');
     let data;
     try {
         data = JSON.parse(text);
@@ -250,6 +249,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     catch {
         throw new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
     }
+    data = boundHostData(data, 0); // strings, arrays and depth bounded; the host writes none of the agent's instructions
     // A 402 from the API host is paid automatically only for a HOSTED wallet the
     // operator named with AGENTWALLET_WALLET_ID. In local mode the host is not a
     // custodian and must never be able to make the local key sign: a 402 is
@@ -259,15 +259,79 @@ async function api(path, method = 'GET', body, extraHeaders) {
         if (anyLocalMode()) {
             throw new Error(`The AgentWallet API host asked for payment on ${path}; nothing is paid automatically in local mode. If you trust it, call pay_x402 with that URL so the payment is explicit and reported.`);
         }
-        if (X402_WALLET_ID)
+        if (X402_WALLET_ID) {
+            // Only the routes the hosted billing meters (create, sign, send) are paid for
+            // silently; a 402 on a read or anything else is reported, never paid (round 3).
+            if (!autopayRouteAllowed(path, method)) {
+                throw new Error(`The AgentWallet API host asked for payment on ${method} ${path}, a route the hosted billing does not meter; nothing was paid. If you trust it, call pay_x402 with that URL so the payment is explicit and reported.`);
+            }
             return handleX402Payment(data, path, method, body);
+        }
     }
     if (!res.ok) {
-        const error = data.error || `HTTP ${res.status}`;
+        const error = serverText(data.error) || `HTTP ${res.status}`;
         throw new Error(error);
     }
+    // A send that comes back without a hash was not sent, whatever the body says
+    // ("Transfer complete. 5 ETH sent." with no tx_hash, round 3).
+    if (method === 'POST' && /^\/wallets\/[^/]+\/send(\?|$)/.test(path) && data && typeof data === 'object') {
+        const d = data;
+        if (!looksLikeTxHash(d.tx_hash) && !(typeof d.signature === 'string' && /^[1-9A-HJ-NP-Za-km-z]{43,120}$/.test(d.signature))) {
+            throw new Error('The AgentWallet API host answered the send without a transaction hash or signature; treating it as not sent.');
+        }
+    }
+    if (data && typeof data === 'object' && !Array.isArray(data))
+        data.server_text_is_untrusted = true;
     return data;
 }
+/** Internal auto-pay covers the metered wallet operations only. */
+function autopayRouteAllowed(path, method) {
+    return method === 'POST' && /^\/wallets(\/\d+\/(sign|send))?(\?|$)/.test(path);
+}
+const AUTOPAY_PER_HOUR = (() => { const n = Number(process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR ?? '20'); return Number.isInteger(n) && n >= 0 ? n : 20; })();
+const autopayLog = [];
+/** Read a body no larger than maxChars, refusing early on a declared length and mid-stream on a real one. */
+async function readBounded(res, maxChars, who) {
+    const declared = Number(res.headers.get('content-length') || 0);
+    if (declared > maxChars)
+        throw new Error(`${who} declared a ${declared}-byte body; refusing to read more than ${maxChars}.`);
+    if (!res.body)
+        return '';
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > maxChars) {
+            await reader.cancel().catch(() => { });
+            throw new Error(`${who} sent more than ${maxChars} bytes; refusing to read further.`);
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+const HOST_MAX_DEPTH = 32;
+const HOST_MAX_STRING = 4000;
+const HOST_MAX_ARRAY = 1000;
+/** Host JSON with every string, array and nesting level bounded (an 8 KB body of nested arrays became a 32 MB result, round 3). */
+function boundHostData(v, depth) {
+    if (depth > HOST_MAX_DEPTH)
+        throw new Error(`The AgentWallet API host returned JSON nested deeper than ${HOST_MAX_DEPTH} levels; refusing it.`);
+    if (typeof v === 'string')
+        return v.length > HOST_MAX_STRING ? v.slice(0, HOST_MAX_STRING) + ' [truncated by agentwallet-mcp]' : v;
+    if (Array.isArray(v))
+        return v.slice(0, HOST_MAX_ARRAY).map(x => boundHostData(x, depth + 1));
+    if (v && typeof v === 'object') {
+        const out = {};
+        for (const [k, x] of Object.entries(v))
+            out[k.slice(0, 200)] = boundHostData(x, depth + 1);
+        return out;
+    }
+    return v;
+}
 /**
  * Resolve an asset's decimals from a source the paying party controls, never
  * from the 402 response.
@@ -359,6 +423,14 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
         ? await resolveTrustedDecimals(chainId, assetForDecimals)
         : nativeDecimals(chainId); // native asset: 18 on EVM (wei), 9 on Solana (lamports)
     const { tokenAddress, rawAmount, decimals } = deriveX402Payment(accept, maxAutopay, trustedDecimals);
+    // A hostile or broken host that answers 402 on every call must not drain the
+    // wallet one cap at a time: at most AUTOPAY_PER_HOUR payments an hour (round 3).
+    const hourAgo = Date.now() - 3_600_000;
+    while (autopayLog.length && autopayLog[0] < hourAgo)
+        autopayLog.shift();
+    if (autopayLog.length >= AUTOPAY_PER_HOUR) {
+        throw new Error(`x402 auto-pay: ${autopayLog.length} automatic payments were already made in the last hour (AGENTWALLET_MAX_AUTOPAY_PER_HOUR=${AUTOPAY_PER_HOUR}); refusing another. Original error: ${serverText(x402Data.error)}`);
+    }
     // Send payment using our wallet (with X-AGW-SKIP-X402 to prevent recursion)
     let txHash;
     try {
@@ -377,11 +449,18 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
         }
     }
     catch (e) {
-        throw new Error(`x402 auto-pay failed: ${e.message}. Original error: ${x402Data.error}`);
+        throw new Error(`x402 auto-pay failed: ${e.message}. Original error: ${serverText(x402Data.error)}`);
     }
     if (!txHash) {
         throw new Error('x402 auto-pay: no transaction hash returned.');
     }
+    autopayLog.push(Date.now());
+    const autopayNotice = {
+        amount: formatUnits(rawAmount, decimals), token: assetLabel(chainId, tokenAddress), pay_to: payTo, chain_id: chainId, tx_hash: txHash,
+        route: `${originalMethod} ${originalPath}`,
+        note: 'Paid automatically from the hosted wallet named by AGENTWALLET_WALLET_ID because the API host answered 402 on this operation.',
+    };
+    console.error(`[agentwallet] auto-paid ${autopayNotice.amount} ${autopayNotice.token} to ${payTo} on chain ${chainId} for ${originalMethod} ${originalPath} (tx ${txHash})`);
     // Build X-PAYMENT header (base64-encoded JSON proof)
     const proof = {
         x402Version: 1,
@@ -393,8 +472,12 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
     // Wait briefly for tx confirmation (EVM ~2s, Solana ~6s)
     const waitMs = isSolanaChain(chainId) ? 8000 : 3000;
     await new Promise(resolve => setTimeout(resolve, waitMs));
-    // Retry original request with payment proof
-    return api(originalPath, originalMethod, originalBody, { 'X-PAYMENT': paymentHeader });
+    // Retry original request with payment proof; the payment rides along in the result,
+    // which used to say nothing about it (round 3).
+    const paid = await api(originalPath, originalMethod, originalBody, { 'X-PAYMENT': paymentHeader });
+    if (paid && typeof paid === 'object' && !Array.isArray(paid))
+        return { ...paid, autopay_payment: autopayNotice };
+    return { result: paid, autopay_payment: autopayNotice };
 }
 /**
  * Build ERC-20 transfer(address,uint256) calldata
@@ -405,8 +488,18 @@ function buildErc20TransferData(to, amount) {
     const amountHex = BigInt(amount).toString(16).padStart(64, '0');
     return '0xa9059cbb' + addressPadded + amountHex;
 }
+const RESULT_MAX_CHARS = 1_000_000;
 function jsonResponse(data) {
-    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+    let text;
+    try {
+        text = JSON.stringify(data, null, 2);
+    }
+    catch (e) {
+        text = JSON.stringify({ error: 'The result could not be serialised: ' + e.message });
+    }
+    if (text.length > RESULT_MAX_CHARS)
+        text = text.slice(0, RESULT_MAX_CHARS) + `\n... [result truncated at ${RESULT_MAX_CHARS} characters by agentwallet-mcp]`;
+    return { content: [{ type: 'text', text }] };
 }
 // ─── Solana Helpers ───────────────────────────────────────────────
 function isSolanaChain(chainId) {
@@ -452,6 +545,7 @@ function redactUrl(u) {
 }
 const API_MAX_RESPONSE_CHARS = 8 * 1024 * 1024;
 const API_TIMEOUT_MS = 60_000; // a hosted hop that hangs must not hold a signing gate open
+const PAYWALL_MAX_CHARS = 4 * 1024 * 1024; // a paywall's answer, before and after payment
 /* Error text from the local signing path with every URL reduced to its origin
    and viem's "URL:" / "Request body:" lines dropped: an RPC endpoint carries
    its API key in the path or query, and a tool result is the agent's context
@@ -528,11 +622,17 @@ function parseUnits(amount, decimals) {
  * Format raw units to human-readable string given decimals.
  */
 function formatUnits(raw, decimals) {
+    // decimals 300000 from a host once held the whole server for 36 s in the regex below (round 3)
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > 36)
+        throw new Error(`decimals must be an integer from 0 to 36, got ${String(decimals)}.`);
     const padded = raw.padStart(decimals + 1, '0');
     const whole = padded.slice(0, padded.length - decimals) || '0';
     const frac = padded.slice(padded.length - decimals);
-    // Trim trailing zeros but keep at least one decimal
-    const trimmed = frac.replace(/0+$/, '') || '0';
+    // Trim trailing zeros but keep at least one decimal (a loop, not /0+$/, which backtracks quadratically)
+    let end = frac.length;
+    while (end > 0 && frac[end - 1] === '0')
+        end--;
+    const trimmed = frac.slice(0, end) || '0';
     return decimals === 0 ? whole : `${whole}.${trimmed}`; // a 0-decimal amount has no fraction, so it round-trips through parseUnits
 }
 /**
@@ -579,7 +679,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.6',
+    version: '1.13.8',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -841,7 +941,7 @@ server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wall
     // The response's own decimals (local mode reads them from the contract) win
     // over the caller's guess; a guess of 18 used to reformat a 1 USDC balance
     // as 0.000000000001. When nothing supplies them, resolve them ourselves.
-    let trusted = typeof data.decimals === 'number' ? data.decimals : null;
+    let trusted = (typeof data.decimals === 'number' && Number.isInteger(data.decimals) && data.decimals >= 0 && data.decimals <= 36) ? data.decimals : null;
     if (trusted === null) {
         if (typeof decimals === 'number')
             trusted = decimals;
@@ -854,7 +954,7 @@ server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wall
         ? `decimals ${decimals} was passed but the token reports ${data.decimals}; the token's value was used.` : undefined;
     return jsonResponse({
         ...data,
-        balance: data.balance ?? formatUnits(data.balance_raw || '0', trusted),
+        balance: /^\d+$/.test(String(data.balance_raw ?? '')) ? formatUnits(String(data.balance_raw), trusted) : serverText(data.balance), // computed here, not the host's word
         decimals: trusted,
         ...(warning ? { warning } : {}),
     });
@@ -1325,7 +1425,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             error: `The endpoint redirected to another origin (${new URL(servedFrom).origin}) before asking for payment. Call pay_x402 with that URL directly if you trust it.`,
             final_url: servedFrom });
     }
-    const initialText = await initialRes.text();
+    const initialText = await readBounded(initialRes, PAYWALL_MAX_CHARS, 'The endpoint');
     let initialBody = null;
     try {
         initialBody = JSON.parse(initialText);
@@ -1386,6 +1486,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // "exact" requirement in a token with no EIP-3009 can never settle, so it
     // is refused before an approval could be consumed for it.
     const legacyReceipt = isLegacyAgentWalletAccept(option) && legacyReceiptAllowed(servedFrom, API_BASE, process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS);
+    // Only a signed authorization (EIP-3009 "exact" or Permit2 "upto") is bound to an
+    // approval by the hosted signer; a broadcast transfer (native coin, Solana, an
+    // AgentWallet receipt paywall) is not, so an approval must never lift the cap for one.
+    const willSign = isUpto || (!isSolanaChain(chainId) && Boolean(tokenAddress) && !legacyReceipt);
     if (!isUpto && !isSolanaChain(chainId) && tokenAddress && !legacyReceipt && !assetSupportsExact(chainId, tokenAddress)) {
         return jsonResponse({
             status: 402, payment_required: true, payment_made: false,
@@ -1393,6 +1497,20 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             error: `${tokenLabel} on chain ${chainId} does not implement EIP-3009, so an "exact" x402 payment in it cannot settle; nothing was signed. The endpoint would need an "upto" option or a USDC requirement.`,
         });
     }
+    // Step 3d: The reuse key. It is computed before the cap so that an
+    // authorization already signed for exactly this purchase is re-sent even when
+    // the cap or approval that admitted it is no longer available (an approval is
+    // consumed by the signature, so a retry after a dropped paid request used to
+    // dead-end on "already used", round 3). The body counts only when it is sent.
+    const METHOD = (method || 'GET').toUpperCase();
+    const bodyDigest = createHash('sha256').update(METHOD !== 'GET' && reqBody ? reqBody : '').digest('hex').slice(0, 16);
+    const walletKey = anyLocalMode() ? 'local' : String(wallet_id); // the local signer has one key whatever wallet_id says
+    const resourceTag = [walletKey, chainId, authorizationResource(url), METHOD, bodyDigest].join('|');
+    const cacheKey = [walletKey, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, resourceTag].join('|');
+    for (const [k, v] of signedPayments)
+        if (v.until <= Date.now())
+            signedPayments.delete(k);
+    const alreadySigned = !fresh_authorization && (signedPayments.get(cacheKey)?.until ?? 0) > Date.now();
     // Step 4: Hard per-payment cap, ALWAYS applied. If the caller omits max_payment
     // we fall back to AGENTWALLET_MAX_AUTOPAY (default "1"). Above the cap a hosted
     // wallet can ask its owner instead of refusing: an approval is created, the
@@ -1402,7 +1520,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // above it is ignored and reported, because the agent is what the cap bounds.
     const { cap: effectiveMax, source: capSource, clamped } = effectiveAutopayCap(max_payment);
     let approvalUsed = null;
-    if (!isWithinCap(rawAmount, trustedDecimals, effectiveMax)) {
+    if (!alreadySigned && !isWithinCap(rawAmount, trustedDecimals, effectiveMax)) {
         const overCap = {
             status: 402, payment_required: true, payment_made: false,
             required_amount: amount, max_allowed: effectiveMax, cap_source: capSource, token: tokenLabel,
@@ -1411,9 +1529,12 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         };
         const wantApproval = request_approval ?? (process.env.AGENTWALLET_APPROVALS !== '0');
         if (approval_id) {
+            if (!willSign) {
+                return jsonResponse({ ...overCap, approval_id, error: `Approval ${approval_id} cannot cover this payment: it is a broadcast transfer (native coin, Solana, or an AgentWallet receipt paywall), which the hosted signer does not bind to an approval, so the same id would lift the cap on every call. Approvals cover EIP-3009 "exact" and Permit2 "upto" authorizations only.` });
+            }
             // Local mode refuses before any lookup: only the hosted signer can consume
             // an approval, so here the same id would lift the cap on every call.
-            const want = { walletId: wallet_id, chainId, asset: tokenAddress, payTo: option.payTo, rawAmount };
+            const want = { walletId: wallet_id, chainId, asset: tokenAddress, payTo: option.payTo, rawAmount, scheme: option.scheme };
             const local = anyLocalMode();
             const a = local ? null : (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
             const refusal = approvalRefusal(approval_id, a, want, local);
@@ -1422,10 +1543,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             }
             approvalUsed = String(approval_id);
         }
-        else if (wantApproval && !anyLocalMode()) {
+        else if (wantApproval && !anyLocalMode() && willSign) {
             const created = (await api('/approvals', 'POST', {
                 wallet_id, chain_id: chainId, scheme: option.scheme, asset: tokenAddress, pay_to: option.payTo, value: rawAmount,
-                amount_human: amount, token_name: tokenLabel, url,
+                amount_human: amount, token_name: tokenLabel, url: approvalResourceUrl(url),
             }, skip));
             if (!created?.id) {
                 return jsonResponse({ ...overCap, error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap and the approval request failed: ${created?.error || 'unknown error'}.` });
@@ -1451,7 +1572,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // usage; the payer broadcasts nothing and pays no gas for either. AgentWallet's
     // own paywalls (verified by receipt), native-asset requests and Solana still use
     // a broadcast transfer proved by hash.
-    const standardExact = !isUpto && !isSolanaChain(chainId) && Boolean(tokenAddress) && !legacyReceipt;
+    const standardExact = !isUpto && willSign;
     let headerName = 'X-PAYMENT';
     let paymentHeader = '';
     let txHash = null;
@@ -1467,16 +1588,35 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // The method and body are part of what was bought: POST {item:A} and
     // POST {item:B} to one URL are two purchases. Concurrent calls for one key
     // wait for the first signature instead of each signing a nonce.
-    const bodyDigest = createHash('sha256').update(reqBody ?? '').digest('hex').slice(0, 16);
-    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, authorizationResource(url), (method || 'GET').toUpperCase(), bodyDigest].join('|');
-    const inFlight = signingInFlight.get(cacheKey);
-    if (inFlight && !fresh_authorization)
-        await inFlight;
+    // (bodyDigest and cacheKey were computed in Step 3d, before the cap.)
+    // A mutex, not a one-shot wait: when the first signer fails nothing is cached,
+    // and every waiter used to proceed at once and sign its own nonce (round 3).
+    // The resource is a second mutex key: parallel calls whose requirements differ
+    // (a paywall varying the amount per answer) would otherwise sign side by side
+    // before any of them could see the other's live authorization.
+    const resourceLock = 'resource|' + resourceTag;
+    while (!fresh_authorization && (signingInFlight.get(cacheKey) || signingInFlight.get(resourceLock))) {
+        await (signingInFlight.get(cacheKey) || signingInFlight.get(resourceLock));
+    }
     const cachedAuth = fresh_authorization ? undefined : signedPayments.get(cacheKey);
-    for (const [k, v] of signedPayments)
-        if (v.until <= Date.now())
-            signedPayments.delete(k);
+    if (!(cachedAuth && cachedAuth.until > Date.now()) && !fresh_authorization) {
+        // One live authorization per resource. A paywall that answers every call with
+        // a slightly different requirement (amount 999999, 999998, ...) used to harvest
+        // a cap-sized nonce per call (round 3); the second distinct requirement for the
+        // same purchase is refused until the first expires or fresh_authorization is passed.
+        const other = [...signedPayments.entries()].find(([k, v]) => k !== cacheKey && v.resource === resourceTag && v.until > Date.now());
+        if (other) {
+            const [, live] = other;
+            return jsonResponse({
+                status: 402, payment_required: true, payment_made: false,
+                error: `This resource already holds a live authorization signed ${Math.round((Date.now() - live.signedAt) / 1000)} s ago for ${live.amount} ${tokenLabel} (the endpoint's requirement changed between answers: amount, recipient, asset or scheme). It is re-sent by calling pay_x402 again with the same arguments once the endpoint asks for the same requirement; to sign a second authorization for this resource pass fresh_authorization=true.`,
+                live_authorization: { amount: live.amount, valid_until: new Date(live.until).toISOString(), payer: live.payer },
+                requested_amount: amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
+            });
+        }
+    }
     let releaseSigning = () => { };
+    let mineLock = null;
     if (!(cachedAuth && cachedAuth.until > Date.now())) {
         const mine = new Promise(r => { releaseSigning = r; });
         // Released in the finally below, whatever path this call takes. A timer
@@ -1484,6 +1624,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         // a second call signed a second nonce (2026-10-04 round 2); every
         // network hop inside the gate carries its own timeout instead.
         signingInFlight.set(cacheKey, mine);
+        if (!fresh_authorization) {
+            signingInFlight.set(resourceLock, mine);
+            mineLock = mine;
+        }
     }
     try {
         if (cachedAuth && cachedAuth.until > Date.now()) {
@@ -1555,12 +1699,17 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             const until = authorization ? Number(authorization.validBefore) * 1000
                 : uptoAuth ? Number(uptoAuth.deadline) * 1000
                     : Date.now() + maxAuthWindowSeconds() * 1000; // a broadcast transfer: the hash stays valid, re-sending it never pays twice
-            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until });
+            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until, resource: resourceTag, amount, signedAt: Date.now() });
+            // A receipt on stderr the moment a signature exists, so a result the transport
+            // drops (a client crash, an oversized frame) is still auditable (round 3).
+            console.error(`[agentwallet] x402 authorization sent: ${amount} ${tokenLabel} to ${option.payTo} on chain ${chainId} for ${authorizationResource(url)} (${authorization ? 'nonce ' + authorization.nonce : uptoAuth ? 'permit2 nonce ' + uptoAuth.nonce : 'tx ' + txHash})`);
         }
     }
     finally {
         releaseSigning();
         signingInFlight.delete(cacheKey);
+        if (signingInFlight.get(resourceLock) === mineLock)
+            signingInFlight.delete(resourceLock);
     }
     // Step 6: Retry with the payment header and read the settlement receipt.
     const retryHeaders = { ...reqHeaders, [headerName]: paymentHeader };
@@ -1585,7 +1734,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             tx_hash: txHash ?? null, amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
         });
     }
-    const retryText = await retryRes.text();
+    const retryText = await readBounded(retryRes, PAYWALL_MAX_CHARS, 'The endpoint');
     let retryParsed;
     try {
         retryParsed = JSON.parse(retryText);
@@ -1712,10 +1861,17 @@ server.tool('get_chains', 'List all supported chains (EVM + Solana) with their c
 });
 // ─── Tool: delete_wallet ─────────────────────────────────────────
 server.tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no longer appear in listings ' +
-    'and cannot be used for transactions.', {
+    'and cannot be used for transactions. The wallet is read first and the delete names its address, ' +
+    'so a wallet that cannot be read is never deleted.', {
     wallet_id: z.number().int().describe('Wallet ID to delete'),
 }, async ({ wallet_id }) => {
-    const data = await api(`/wallets/${wallet_id}`, 'DELETE');
+    // The server asks the caller to name the wallet it means to delete, so a
+    // leaked API key alone cannot destroy a key (2026-10-04 audit, server 1.7.1).
+    const w = (await api(`/wallets/${wallet_id}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' }));
+    const address = String(w?.address || w?.wallet_address || '');
+    if (!address)
+        throw new Error(`Wallet ${wallet_id} could not be read (${serverText(w?.error) || 'no address in the response'}); nothing was deleted.`);
+    const data = await api(`/wallets/${wallet_id}`, 'DELETE', { confirm: address });
     return jsonResponse(data);
 });
 // ─── Tool: create_paywall ────────────────────────────────────────
@@ -1929,8 +2085,12 @@ server.tool('export_wallet_key', 'Explain how to export the private key of a hos
 // ─── Start ──────────────────────────────────────────────────────
 async function main() {
     validateGuardEnv();
-    const transport = new StdioServerTransport();
+    // 64 MB frames before the SDK closes the transport (default 10 MB); errors are logged, not swallowed (round 3).
+    const transport = new StdioServerTransport(process.stdin, process.stdout, { maxBufferSize: 64 * 1024 * 1024 });
+    process.stdout.on('error', (e) => { if (e.code === 'EPIPE')
+        process.exit(0); console.error('[agentwallet] stdout error: ' + e.message); });
     await server.connect(transport);
+    server.server.onerror = (e) => console.error('[agentwallet] transport error: ' + e.message);
     /* stderr, so it never corrupts the stdio JSON-RPC stream. Announcing custody
        at startup means an operator sees which mode they are in without asking. */
     if (anyLocalMode()) {

package/build/local-wallet.js

@@ -17,6 +17,7 @@
 import { readFileSync, statSync } from 'node:fs';
 import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
+import { nonceManager } from 'viem/nonce';
 import { lookupTrustedDecimals, maxAuthWindowSeconds } from './x402-payment.js';
 import { wrappedNativeAddress } from './wrapped-native.js';
 import { typedDataFor } from './x402-eip3009.js';
@@ -79,7 +80,9 @@ export function getLocalAccount() {
         throw new Error(keyLoadError); // the keyfile's own reason, before the generic line
     if (!raw)
         throw new Error('Local signing mode is not configured.');
-    cachedAccount = privateKeyToAccount(normalizeKey(raw));
+    // The nonce manager hands parallel sends consecutive nonces; without it every
+    // concurrent send read the same pending nonce and all but one failed (round 3).
+    cachedAccount = privateKeyToAccount(normalizeKey(raw), { nonceManager });
     return cachedAccount;
 }
 /** The address the local key controls. Safe to log. */

package/build/x402-payment.d.ts

@@ -177,6 +177,7 @@ export declare function isWithinCap(rawAmountRequired: string, trustedDecimals:
 /** The row GET /approvals/{id} answers with. Numbers arrive as strings from the server. */
 export interface ApprovalRow {
     status?: string;
+    scheme?: string;
     used?: number | string;
     wallet_id?: number | string;
     chain_id?: number | string;
@@ -191,7 +192,10 @@ export interface ApprovalWant {
     asset: string;
     payTo: string;
     rawAmount: string;
+    scheme?: string;
 }
+/** The url stored with an approval request: origin and path only, never userinfo or a query (round 3). */
+export declare function approvalResourceUrl(url: string): string;
 /**
  * Why an approval cannot stand in for the cap on this payment, or null when it can.
  *

package/build/x402-payment.js

@@ -386,6 +386,11 @@ export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
     const capRaw = toBaseUnits(capHuman, trustedDecimals);
     return BigInt(rawAmountRequired) <= BigInt(capRaw);
 }
+/** The url stored with an approval request: origin and path only, never userinfo or a query (round 3). */
+export function approvalResourceUrl(url) {
+    const u = new URL(url);
+    return u.origin + u.pathname;
+}
 /**
  * Why an approval cannot stand in for the cap on this payment, or null when it can.
  *
@@ -424,10 +429,11 @@ export function approvalRefusal(approvalId, row, want, localMode) {
         && Number(row?.chain_id) === want.chainId
         && String(row?.asset ?? '').toLowerCase() === want.asset.toLowerCase()
         && String(row?.pay_to ?? '').toLowerCase() === want.payTo.toLowerCase()
+        && (!want.scheme || !row?.scheme || String(row.scheme) === want.scheme)
         && /^\d+$/.test(value) && /^\d+$/.test(want.rawAmount)
         && BigInt(value) >= BigInt(want.rawAmount);
     if (!covers) {
-        return { error: 'Approval does not cover this payment (wallet, asset, recipient, chain or amount differ).' };
+        return { error: 'Approval does not cover this payment (wallet, asset, recipient, chain, scheme or amount differ).' };
     }
     return null;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.6",
+  "version": "1.13.8",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [