agentwallet-mcp 1.13.7 → 1.13.9

package/build/index.js

@@ -13,14 +13,14 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, approvalResourceUrl, } from './x402-payment.js';
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
-import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, } from './x402-eip3009.js';
+import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, } from './local-solana.js';
 /** True when either chain family is running non-custodially. */
 function anyLocalMode() {
@@ -223,6 +223,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     const url = `${API_BASE}${path}`;
     const headers = {
         'Content-Type': 'application/json',
+        'Accept-Encoding': 'identity', // a 500 KB gzip body inflated to 500 MB before the size check (round 3)
         ...extraHeaders,
     };
     if (API_USER && API_PASS) {
@@ -240,9 +241,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     if (res.status >= 300 && res.status < 400) {
         throw new Error(`The AgentWallet API host answered ${path} with a redirect (HTTP ${res.status}); refusing to follow it.`);
     }
-    const text = await res.text();
-    if (text.length > API_MAX_RESPONSE_CHARS)
-        throw new Error(`The AgentWallet API host returned an oversized response (${text.length} characters); refusing to parse it.`);
+    const text = await readBounded(res, API_MAX_RESPONSE_CHARS, 'The AgentWallet API host');
     let data;
     try {
         data = JSON.parse(text);
@@ -250,6 +249,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     catch {
         throw new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
     }
+    data = boundHostData(data, 0); // strings, arrays and depth bounded; the host writes none of the agent's instructions
     // A 402 from the API host is paid automatically only for a HOSTED wallet the
     // operator named with AGENTWALLET_WALLET_ID. In local mode the host is not a
     // custodian and must never be able to make the local key sign: a 402 is
@@ -259,15 +259,79 @@ async function api(path, method = 'GET', body, extraHeaders) {
         if (anyLocalMode()) {
             throw new Error(`The AgentWallet API host asked for payment on ${path}; nothing is paid automatically in local mode. If you trust it, call pay_x402 with that URL so the payment is explicit and reported.`);
         }
-        if (X402_WALLET_ID)
+        if (X402_WALLET_ID) {
+            // Only the routes the hosted billing meters (create, sign, send) are paid for
+            // silently; a 402 on a read or anything else is reported, never paid (round 3).
+            if (!autopayRouteAllowed(path, method)) {
+                throw new Error(`The AgentWallet API host asked for payment on ${method} ${path}, a route the hosted billing does not meter; nothing was paid. If you trust it, call pay_x402 with that URL so the payment is explicit and reported.`);
+            }
             return handleX402Payment(data, path, method, body);
+        }
     }
     if (!res.ok) {
-        const error = data.error || `HTTP ${res.status}`;
+        const error = serverText(data.error) || `HTTP ${res.status}`;
         throw new Error(error);
     }
+    // A send that comes back without a hash was not sent, whatever the body says
+    // ("Transfer complete. 5 ETH sent." with no tx_hash, round 3).
+    if (method === 'POST' && /^\/wallets\/[^/]+\/send(\?|$)/.test(path) && data && typeof data === 'object') {
+        const d = data;
+        if (!looksLikeTxHash(d.tx_hash) && !(typeof d.signature === 'string' && /^[1-9A-HJ-NP-Za-km-z]{43,120}$/.test(d.signature))) {
+            throw new Error('The AgentWallet API host answered the send without a transaction hash or signature; treating it as not sent.');
+        }
+    }
+    if (data && typeof data === 'object' && !Array.isArray(data))
+        data.server_text_is_untrusted = true;
     return data;
 }
+/** Internal auto-pay covers the metered wallet operations only. */
+function autopayRouteAllowed(path, method) {
+    return method === 'POST' && /^\/wallets(\/\d+\/(sign|send))?(\?|$)/.test(path);
+}
+const AUTOPAY_PER_HOUR = (() => { const n = Number(process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR ?? '20'); return Number.isInteger(n) && n >= 0 ? n : 20; })();
+const autopayLog = [];
+/** Read a body no larger than maxChars, refusing early on a declared length and mid-stream on a real one. */
+async function readBounded(res, maxChars, who) {
+    const declared = Number(res.headers.get('content-length') || 0);
+    if (declared > maxChars)
+        throw new Error(`${who} declared a ${declared}-byte body; refusing to read more than ${maxChars}.`);
+    if (!res.body)
+        return '';
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > maxChars) {
+            await reader.cancel().catch(() => { });
+            throw new Error(`${who} sent more than ${maxChars} bytes; refusing to read further.`);
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+const HOST_MAX_DEPTH = 32;
+const HOST_MAX_STRING = 4000;
+const HOST_MAX_ARRAY = 1000;
+/** Host JSON with every string, array and nesting level bounded (an 8 KB body of nested arrays became a 32 MB result, round 3). */
+function boundHostData(v, depth) {
+    if (depth > HOST_MAX_DEPTH)
+        throw new Error(`The AgentWallet API host returned JSON nested deeper than ${HOST_MAX_DEPTH} levels; refusing it.`);
+    if (typeof v === 'string')
+        return v.length > HOST_MAX_STRING ? v.slice(0, HOST_MAX_STRING) + ' [truncated by agentwallet-mcp]' : v;
+    if (Array.isArray(v))
+        return v.slice(0, HOST_MAX_ARRAY).map(x => boundHostData(x, depth + 1));
+    if (v && typeof v === 'object') {
+        const out = {};
+        for (const [k, x] of Object.entries(v))
+            out[k.slice(0, 200)] = boundHostData(x, depth + 1);
+        return out;
+    }
+    return v;
+}
 /**
  * Resolve an asset's decimals from a source the paying party controls, never
  * from the 402 response.
@@ -359,6 +423,14 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
         ? await resolveTrustedDecimals(chainId, assetForDecimals)
         : nativeDecimals(chainId); // native asset: 18 on EVM (wei), 9 on Solana (lamports)
     const { tokenAddress, rawAmount, decimals } = deriveX402Payment(accept, maxAutopay, trustedDecimals);
+    // A hostile or broken host that answers 402 on every call must not drain the
+    // wallet one cap at a time: at most AUTOPAY_PER_HOUR payments an hour (round 3).
+    const hourAgo = Date.now() - 3_600_000;
+    while (autopayLog.length && autopayLog[0] < hourAgo)
+        autopayLog.shift();
+    if (autopayLog.length >= AUTOPAY_PER_HOUR) {
+        throw new Error(`x402 auto-pay: ${autopayLog.length} automatic payments were already made in the last hour (AGENTWALLET_MAX_AUTOPAY_PER_HOUR=${AUTOPAY_PER_HOUR}); refusing another. Original error: ${serverText(x402Data.error)}`);
+    }
     // Send payment using our wallet (with X-AGW-SKIP-X402 to prevent recursion)
     let txHash;
     try {
@@ -377,11 +449,18 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
         }
     }
     catch (e) {
-        throw new Error(`x402 auto-pay failed: ${e.message}. Original error: ${x402Data.error}`);
+        throw new Error(`x402 auto-pay failed: ${e.message}. Original error: ${serverText(x402Data.error)}`);
     }
     if (!txHash) {
         throw new Error('x402 auto-pay: no transaction hash returned.');
     }
+    autopayLog.push(Date.now());
+    const autopayNotice = {
+        amount: formatUnits(rawAmount, decimals), token: assetLabel(chainId, tokenAddress), pay_to: payTo, chain_id: chainId, tx_hash: txHash,
+        route: `${originalMethod} ${originalPath}`,
+        note: 'Paid automatically from the hosted wallet named by AGENTWALLET_WALLET_ID because the API host answered 402 on this operation.',
+    };
+    console.error(`[agentwallet] auto-paid ${autopayNotice.amount} ${autopayNotice.token} to ${payTo} on chain ${chainId} for ${originalMethod} ${originalPath} (tx ${txHash})`);
     // Build X-PAYMENT header (base64-encoded JSON proof)
     const proof = {
         x402Version: 1,
@@ -393,8 +472,12 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
     // Wait briefly for tx confirmation (EVM ~2s, Solana ~6s)
     const waitMs = isSolanaChain(chainId) ? 8000 : 3000;
     await new Promise(resolve => setTimeout(resolve, waitMs));
-    // Retry original request with payment proof
-    return api(originalPath, originalMethod, originalBody, { 'X-PAYMENT': paymentHeader });
+    // Retry original request with payment proof; the payment rides along in the result,
+    // which used to say nothing about it (round 3).
+    const paid = await api(originalPath, originalMethod, originalBody, { 'X-PAYMENT': paymentHeader });
+    if (paid && typeof paid === 'object' && !Array.isArray(paid))
+        return { ...paid, autopay_payment: autopayNotice };
+    return { result: paid, autopay_payment: autopayNotice };
 }
 /**
  * Build ERC-20 transfer(address,uint256) calldata
@@ -405,8 +488,18 @@ function buildErc20TransferData(to, amount) {
     const amountHex = BigInt(amount).toString(16).padStart(64, '0');
     return '0xa9059cbb' + addressPadded + amountHex;
 }
+const RESULT_MAX_CHARS = 1_000_000;
 function jsonResponse(data) {
-    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+    let text;
+    try {
+        text = JSON.stringify(data, null, 2);
+    }
+    catch (e) {
+        text = JSON.stringify({ error: 'The result could not be serialised: ' + e.message });
+    }
+    if (text.length > RESULT_MAX_CHARS)
+        text = text.slice(0, RESULT_MAX_CHARS) + `\n... [result truncated at ${RESULT_MAX_CHARS} characters by agentwallet-mcp]`;
+    return { content: [{ type: 'text', text }] };
 }
 // ─── Solana Helpers ───────────────────────────────────────────────
 function isSolanaChain(chainId) {
@@ -452,6 +545,7 @@ function redactUrl(u) {
 }
 const API_MAX_RESPONSE_CHARS = 8 * 1024 * 1024;
 const API_TIMEOUT_MS = 60_000; // a hosted hop that hangs must not hold a signing gate open
+const PAYWALL_MAX_CHARS = 4 * 1024 * 1024; // a paywall's answer, before and after payment
 /* Error text from the local signing path with every URL reduced to its origin
    and viem's "URL:" / "Request body:" lines dropped: an RPC endpoint carries
    its API key in the path or query, and a tool result is the agent's context
@@ -528,11 +622,17 @@ function parseUnits(amount, decimals) {
  * Format raw units to human-readable string given decimals.
  */
 function formatUnits(raw, decimals) {
+    // decimals 300000 from a host once held the whole server for 36 s in the regex below (round 3)
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > 36)
+        throw new Error(`decimals must be an integer from 0 to 36, got ${String(decimals)}.`);
     const padded = raw.padStart(decimals + 1, '0');
     const whole = padded.slice(0, padded.length - decimals) || '0';
     const frac = padded.slice(padded.length - decimals);
-    // Trim trailing zeros but keep at least one decimal
-    const trimmed = frac.replace(/0+$/, '') || '0';
+    // Trim trailing zeros but keep at least one decimal (a loop, not /0+$/, which backtracks quadratically)
+    let end = frac.length;
+    while (end > 0 && frac[end - 1] === '0')
+        end--;
+    const trimmed = frac.slice(0, end) || '0';
     return decimals === 0 ? whole : `${whole}.${trimmed}`; // a 0-decimal amount has no fraction, so it round-trips through parseUnits
 }
 /**
@@ -579,7 +679,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.7',
+    version: '1.13.9',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -841,7 +941,7 @@ server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wall
     // The response's own decimals (local mode reads them from the contract) win
     // over the caller's guess; a guess of 18 used to reformat a 1 USDC balance
     // as 0.000000000001. When nothing supplies them, resolve them ourselves.
-    let trusted = typeof data.decimals === 'number' ? data.decimals : null;
+    let trusted = (typeof data.decimals === 'number' && Number.isInteger(data.decimals) && data.decimals >= 0 && data.decimals <= 36) ? data.decimals : null;
     if (trusted === null) {
         if (typeof decimals === 'number')
             trusted = decimals;
@@ -854,7 +954,7 @@ server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wall
         ? `decimals ${decimals} was passed but the token reports ${data.decimals}; the token's value was used.` : undefined;
     return jsonResponse({
         ...data,
-        balance: data.balance ?? formatUnits(data.balance_raw || '0', trusted),
+        balance: /^\d+$/.test(String(data.balance_raw ?? '')) ? formatUnits(String(data.balance_raw), trusted) : serverText(data.balance), // computed here, not the host's word
         decimals: trusted,
         ...(warning ? { warning } : {}),
     });
@@ -1190,8 +1290,11 @@ async function resolveTokenDomain(chainId, asset, extra) {
         return declared;
     let name = '', version = '';
     try {
-        name = decodeAbiString(await ethCallHex(chainId, asset, '0x06fdde03')); // name()
-        version = decodeAbiString(await ethCallHex(chainId, asset, '0x54fd4d50')); // version()
+        // The signing decoder (256 bytes, strict UTF-8), not the 64-char display sanitiser
+        // get_token_info uses: a truncated or replaced name signs under a domain the
+        // token never had (round 3).
+        name = decodeDomainString(await ethCallHex(chainId, asset, '0x06fdde03')); // name()
+        version = decodeDomainString(await ethCallHex(chainId, asset, '0x54fd4d50')); // version()
     }
     catch { /* refused below */ }
     if (!name || !version) {
@@ -1325,7 +1428,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             error: `The endpoint redirected to another origin (${new URL(servedFrom).origin}) before asking for payment. Call pay_x402 with that URL directly if you trust it.`,
             final_url: servedFrom });
     }
-    const initialText = await initialRes.text();
+    const initialText = await readBounded(initialRes, PAYWALL_MAX_CHARS, 'The endpoint');
     let initialBody = null;
     try {
         initialBody = JSON.parse(initialText);
@@ -1386,6 +1489,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // "exact" requirement in a token with no EIP-3009 can never settle, so it
     // is refused before an approval could be consumed for it.
     const legacyReceipt = isLegacyAgentWalletAccept(option) && legacyReceiptAllowed(servedFrom, API_BASE, process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS);
+    // Only a signed authorization (EIP-3009 "exact" or Permit2 "upto") is bound to an
+    // approval by the hosted signer; a broadcast transfer (native coin, Solana, an
+    // AgentWallet receipt paywall) is not, so an approval must never lift the cap for one.
+    const willSign = isUpto || (!isSolanaChain(chainId) && Boolean(tokenAddress) && !legacyReceipt);
     if (!isUpto && !isSolanaChain(chainId) && tokenAddress && !legacyReceipt && !assetSupportsExact(chainId, tokenAddress)) {
         return jsonResponse({
             status: 402, payment_required: true, payment_made: false,
@@ -1393,6 +1500,20 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             error: `${tokenLabel} on chain ${chainId} does not implement EIP-3009, so an "exact" x402 payment in it cannot settle; nothing was signed. The endpoint would need an "upto" option or a USDC requirement.`,
         });
     }
+    // Step 3d: The reuse key. It is computed before the cap so that an
+    // authorization already signed for exactly this purchase is re-sent even when
+    // the cap or approval that admitted it is no longer available (an approval is
+    // consumed by the signature, so a retry after a dropped paid request used to
+    // dead-end on "already used", round 3). The body counts only when it is sent.
+    const METHOD = (method || 'GET').toUpperCase();
+    const bodyDigest = createHash('sha256').update(METHOD !== 'GET' && reqBody ? reqBody : '').digest('hex').slice(0, 16);
+    const walletKey = anyLocalMode() ? 'local' : String(wallet_id); // the local signer has one key whatever wallet_id says
+    const resourceTag = [walletKey, chainId, authorizationResource(url), METHOD, bodyDigest].join('|');
+    const cacheKey = [walletKey, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, resourceTag].join('|');
+    for (const [k, v] of signedPayments)
+        if (v.until <= Date.now())
+            signedPayments.delete(k);
+    const alreadySigned = !fresh_authorization && (signedPayments.get(cacheKey)?.until ?? 0) > Date.now();
     // Step 4: Hard per-payment cap, ALWAYS applied. If the caller omits max_payment
     // we fall back to AGENTWALLET_MAX_AUTOPAY (default "1"). Above the cap a hosted
     // wallet can ask its owner instead of refusing: an approval is created, the
@@ -1402,7 +1523,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // above it is ignored and reported, because the agent is what the cap bounds.
     const { cap: effectiveMax, source: capSource, clamped } = effectiveAutopayCap(max_payment);
     let approvalUsed = null;
-    if (!isWithinCap(rawAmount, trustedDecimals, effectiveMax)) {
+    if (!alreadySigned && !isWithinCap(rawAmount, trustedDecimals, effectiveMax)) {
         const overCap = {
             status: 402, payment_required: true, payment_made: false,
             required_amount: amount, max_allowed: effectiveMax, cap_source: capSource, token: tokenLabel,
@@ -1411,9 +1532,12 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         };
         const wantApproval = request_approval ?? (process.env.AGENTWALLET_APPROVALS !== '0');
         if (approval_id) {
+            if (!willSign) {
+                return jsonResponse({ ...overCap, approval_id, error: `Approval ${approval_id} cannot cover this payment: it is a broadcast transfer (native coin, Solana, or an AgentWallet receipt paywall), which the hosted signer does not bind to an approval, so the same id would lift the cap on every call. Approvals cover EIP-3009 "exact" and Permit2 "upto" authorizations only.` });
+            }
             // Local mode refuses before any lookup: only the hosted signer can consume
             // an approval, so here the same id would lift the cap on every call.
-            const want = { walletId: wallet_id, chainId, asset: tokenAddress, payTo: option.payTo, rawAmount };
+            const want = { walletId: wallet_id, chainId, asset: tokenAddress, payTo: option.payTo, rawAmount, scheme: option.scheme };
             const local = anyLocalMode();
             const a = local ? null : (await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, skip));
             const refusal = approvalRefusal(approval_id, a, want, local);
@@ -1422,10 +1546,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             }
             approvalUsed = String(approval_id);
         }
-        else if (wantApproval && !anyLocalMode()) {
+        else if (wantApproval && !anyLocalMode() && willSign) {
             const created = (await api('/approvals', 'POST', {
                 wallet_id, chain_id: chainId, scheme: option.scheme, asset: tokenAddress, pay_to: option.payTo, value: rawAmount,
-                amount_human: amount, token_name: tokenLabel, url,
+                amount_human: amount, token_name: tokenLabel, url: approvalResourceUrl(url),
             }, skip));
             if (!created?.id) {
                 return jsonResponse({ ...overCap, error: `Payment of ${amount} ${tokenLabel} exceeds the ${effectiveMax} cap and the approval request failed: ${created?.error || 'unknown error'}.` });
@@ -1451,7 +1575,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // usage; the payer broadcasts nothing and pays no gas for either. AgentWallet's
     // own paywalls (verified by receipt), native-asset requests and Solana still use
     // a broadcast transfer proved by hash.
-    const standardExact = !isUpto && !isSolanaChain(chainId) && Boolean(tokenAddress) && !legacyReceipt;
+    const standardExact = !isUpto && willSign;
     let headerName = 'X-PAYMENT';
     let paymentHeader = '';
     let txHash = null;
@@ -1467,16 +1591,35 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // The method and body are part of what was bought: POST {item:A} and
     // POST {item:B} to one URL are two purchases. Concurrent calls for one key
     // wait for the first signature instead of each signing a nonce.
-    const bodyDigest = createHash('sha256').update(reqBody ?? '').digest('hex').slice(0, 16);
-    const cacheKey = [wallet_id, chainId, tokenAddress.toLowerCase(), option.payTo.toLowerCase(), rawAmount, option.scheme, authorizationResource(url), (method || 'GET').toUpperCase(), bodyDigest].join('|');
-    const inFlight = signingInFlight.get(cacheKey);
-    if (inFlight && !fresh_authorization)
-        await inFlight;
+    // (bodyDigest and cacheKey were computed in Step 3d, before the cap.)
+    // A mutex, not a one-shot wait: when the first signer fails nothing is cached,
+    // and every waiter used to proceed at once and sign its own nonce (round 3).
+    // The resource is a second mutex key: parallel calls whose requirements differ
+    // (a paywall varying the amount per answer) would otherwise sign side by side
+    // before any of them could see the other's live authorization.
+    const resourceLock = 'resource|' + resourceTag;
+    while (!fresh_authorization && (signingInFlight.get(cacheKey) || signingInFlight.get(resourceLock))) {
+        await (signingInFlight.get(cacheKey) || signingInFlight.get(resourceLock));
+    }
     const cachedAuth = fresh_authorization ? undefined : signedPayments.get(cacheKey);
-    for (const [k, v] of signedPayments)
-        if (v.until <= Date.now())
-            signedPayments.delete(k);
+    if (!(cachedAuth && cachedAuth.until > Date.now()) && !fresh_authorization) {
+        // One live authorization per resource. A paywall that answers every call with
+        // a slightly different requirement (amount 999999, 999998, ...) used to harvest
+        // a cap-sized nonce per call (round 3); the second distinct requirement for the
+        // same purchase is refused until the first expires or fresh_authorization is passed.
+        const other = [...signedPayments.entries()].find(([k, v]) => k !== cacheKey && v.resource === resourceTag && v.until > Date.now());
+        if (other) {
+            const [, live] = other;
+            return jsonResponse({
+                status: 402, payment_required: true, payment_made: false,
+                error: `This resource already holds a live authorization signed ${Math.round((Date.now() - live.signedAt) / 1000)} s ago for ${live.amount} ${tokenLabel} (the endpoint's requirement changed between answers: amount, recipient, asset or scheme). It is re-sent by calling pay_x402 again with the same arguments once the endpoint asks for the same requirement. Nothing more is signed for this resource until that authorization expires.`,
+                live_authorization: { amount: live.amount, valid_until: new Date(live.until).toISOString(), payer: live.payer },
+                requested_amount: amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
+            });
+        }
+    }
     let releaseSigning = () => { };
+    let mineLock = null;
     if (!(cachedAuth && cachedAuth.until > Date.now())) {
         const mine = new Promise(r => { releaseSigning = r; });
         // Released in the finally below, whatever path this call takes. A timer
@@ -1484,6 +1627,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         // a second call signed a second nonce (2026-10-04 round 2); every
         // network hop inside the gate carries its own timeout instead.
         signingInFlight.set(cacheKey, mine);
+        if (!fresh_authorization) {
+            signingInFlight.set(resourceLock, mine);
+            mineLock = mine;
+        }
     }
     try {
         if (cachedAuth && cachedAuth.until > Date.now()) {
@@ -1510,7 +1657,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
                         token: tokenLabel, token_address: tokenAddress, chain_id: chainId, payer, permit2: permit2Address(chainId),
                         error: `This endpoint uses the x402 "upto" scheme, which settles through Permit2. Wallet ${payer} has not approved ` +
                             `${tokenLabel} to Permit2 on chain ${chainId}. Call approve_permit2 once for this token (a normal transaction that needs gas), ` +
-                            `or set AGENTWALLET_PERMIT2_AUTO_APPROVE=1, then call pay_x402 again.`,
+                            `then call pay_x402 again.` + (assetPolicy.via === 'stablecoin' ? ' The operator may instead set AGENTWALLET_PERMIT2_AUTO_APPROVE=1 (registry stablecoins only); that is the operator\'s setting, not the agent\'s.' : ''),
                     });
                 }
             }
@@ -1555,12 +1702,17 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             const until = authorization ? Number(authorization.validBefore) * 1000
                 : uptoAuth ? Number(uptoAuth.deadline) * 1000
                     : Date.now() + maxAuthWindowSeconds() * 1000; // a broadcast transfer: the hash stays valid, re-sending it never pays twice
-            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until });
+            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until, resource: resourceTag, amount, signedAt: Date.now() });
+            // A receipt on stderr the moment a signature exists, so a result the transport
+            // drops (a client crash, an oversized frame) is still auditable (round 3).
+            console.error(`[agentwallet] x402 authorization sent: ${amount} ${tokenLabel} to ${option.payTo} on chain ${chainId} for ${authorizationResource(url)} (${authorization ? 'nonce ' + authorization.nonce : uptoAuth ? 'permit2 nonce ' + uptoAuth.nonce : 'tx ' + txHash})`);
         }
     }
     finally {
         releaseSigning();
         signingInFlight.delete(cacheKey);
+        if (signingInFlight.get(resourceLock) === mineLock)
+            signingInFlight.delete(resourceLock);
     }
     // Step 6: Retry with the payment header and read the settlement receipt.
     const retryHeaders = { ...reqHeaders, [headerName]: paymentHeader };
@@ -1585,7 +1737,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             tx_hash: txHash ?? null, amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
         });
     }
-    const retryText = await retryRes.text();
+    const retryText = await readBounded(retryRes, PAYWALL_MAX_CHARS, 'The endpoint');
     let retryParsed;
     try {
         retryParsed = JSON.parse(retryText);
@@ -1600,6 +1752,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     const retryServedFrom = finalUrlOf(retryRes, url);
     const retryCrossOrigin = new URL(retryServedFrom).origin !== new URL(url).origin;
     const verdict = settlementVerdict(retryRes.status, settlement, retryCrossOrigin);
+    const claimedRaw = typeof settlement?.amount === 'string' && /^\d+$/.test(settlement.amount) ? settlement.amount : null;
+    const claimedAboveMax = claimedRaw !== null && BigInt(claimedRaw) > BigInt(rawAmount);
     if (retryCrossOrigin) {
         retryError = `The paid request was redirected to another origin (${new URL(retryServedFrom).origin}); the payment header is never forwarded across origins, so this response did not see the payment.`;
     }
@@ -1624,6 +1778,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         permit2_approval_tx: permit2ApprovalTx,
         x402_version: x402Version,
         amount,
+        // For upto the amount is the MAXIMUM the facilitator may settle, not what was
+        // taken; the server's claimed settled amount is shown apart and unverified (round 3).
+        ...(isUpto ? { amount_is_maximum: true, authorized_max: amount, settled_amount_claimed: serverText(settlement?.amount), settled_claim_inconsistent: claimedAboveMax } : {}),
         token: tokenLabel,
         token_address: tokenAddress || null,
         network: option.network,
@@ -1936,8 +2093,12 @@ server.tool('export_wallet_key', 'Explain how to export the private key of a hos
 // ─── Start ──────────────────────────────────────────────────────
 async function main() {
     validateGuardEnv();
-    const transport = new StdioServerTransport();
+    // 64 MB frames before the SDK closes the transport (default 10 MB); errors are logged, not swallowed (round 3).
+    const transport = new StdioServerTransport(process.stdin, process.stdout, { maxBufferSize: 64 * 1024 * 1024 });
+    process.stdout.on('error', (e) => { if (e.code === 'EPIPE')
+        process.exit(0); console.error('[agentwallet] stdout error: ' + e.message); });
     await server.connect(transport);
+    server.server.onerror = (e) => console.error('[agentwallet] transport error: ' + e.message);
     /* stderr, so it never corrupts the stdio JSON-RPC stream. Announcing custody
        at startup means an operator sees which mode they are in without asking. */
     if (anyLocalMode()) {

package/build/local-wallet.js

@@ -17,6 +17,7 @@
 import { readFileSync, statSync } from 'node:fs';
 import { createPublicClient, createWalletClient, http, encodeFunctionData, parseAbi, formatUnits, } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
+import { nonceManager } from 'viem/nonce';
 import { lookupTrustedDecimals, maxAuthWindowSeconds } from './x402-payment.js';
 import { wrappedNativeAddress } from './wrapped-native.js';
 import { typedDataFor } from './x402-eip3009.js';
@@ -79,7 +80,9 @@ export function getLocalAccount() {
         throw new Error(keyLoadError); // the keyfile's own reason, before the generic line
     if (!raw)
         throw new Error('Local signing mode is not configured.');
-    cachedAccount = privateKeyToAccount(normalizeKey(raw));
+    // The nonce manager hands parallel sends consecutive nonces; without it every
+    // concurrent send read the same pending nonce and all but one failed (round 3).
+    cachedAccount = privateKeyToAccount(normalizeKey(raw), { nonceManager });
     return cachedAccount;
 }
 /** The address the local key controls. Safe to log. */

package/build/x402-eip3009.js

@@ -121,7 +121,14 @@ export function decodeAbiString(hex) {
     if (!Number.isFinite(len) || len <= 0 || len > 256)
         return '';
     const bytes = Buffer.from(h.slice(128, 128 + len * 2), 'hex');
-    return bytes.toString('utf8');
+    // The domain separator is keccak of the raw bytes: a name that is not valid
+    // UTF-8 cannot be reproduced from a string, so it is refused, never guessed.
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return '';
+    }
 }
 /** Build the payment payload the resource server expects for this x402 version. */
 export function buildPaymentPayload(x402Version, req, auth, signature, resource, extensions) {
@@ -188,7 +195,11 @@ export function parsePaymentRequired(getHeader, body) {
    network and payTo are strings. A null entry, or an array where an address
    should be, used to reach the pickers and surface a raw TypeError or a
    coerced value (2026-10-04 round 2). Numeric amounts are kept as strings. */
-const MAX_ACCEPTS = 64; // a bound on the picker's work, well above anything a real server lists
+const MAX_ACCEPTS = 64;
+/** An all-uppercase hex address is not an EIP-55 checksum and viem refuses it at signing; lowercase has no checksum to fail (round 3). Mixed case is kept: it IS a checksum. */
+function lowerIfAllCaps(v) {
+    return (typeof v === 'string' && /^0x[0-9A-F]{40}$/.test(v) && /[A-F]/.test(v)) ? v.toLowerCase() : v;
+} // a bound on the picker's work, well above anything a real server lists
 export function sanitizeRequired(req) {
     const str = (v) => (typeof v === 'string' ? v : typeof v === 'number' && Number.isFinite(v) ? String(v) : undefined);
     const accepts = [];
@@ -196,7 +207,7 @@ export function sanitizeRequired(req) {
         if (!a || typeof a !== 'object' || Array.isArray(a))
             continue;
         const o = a;
-        const scheme = str(o.scheme), network = str(o.network), payTo = str(o.payTo);
+        const scheme = str(o.scheme), network = str(o.network), payTo = lowerIfAllCaps(str(o.payTo));
         if (scheme === undefined || network === undefined || payTo === undefined)
             continue;
         const extraIn = (o.extra && typeof o.extra === 'object' && !Array.isArray(o.extra)) ? o.extra : undefined;
@@ -206,6 +217,8 @@ export function sanitizeRequired(req) {
                 if (k in extra && typeof extra[k] !== 'string')
                     delete extra[k];
             }
+        if (extra && typeof extra.token === 'string')
+            extra.token = lowerIfAllCaps(extra.token);
         const out = { ...o, scheme, network, payTo };
         for (const k of ['amount', 'maxAmountRequired', 'asset', 'description', 'resource', 'mimeType']) {
             const v = str(o[k]);
@@ -214,6 +227,8 @@ export function sanitizeRequired(req) {
             else
                 out[k] = v;
         }
+        if (typeof out.asset === 'string')
+            out.asset = lowerIfAllCaps(out.asset);
         if (extra)
             out.extra = extra;
         else
@@ -267,7 +282,11 @@ export function pickOption(accepts, resolveChainId, preferChain) {
     const payable = [...exact, ...upto];
     if (payable.length === 0) {
         const schemes = Array.from(new Set(accepts.map(a => String(a.scheme).slice(0, 40)))).slice(0, 10).join(', ') || 'none';
-        const reason = accepts.some(a => a.scheme === 'upto')
+        if (onChain.length === 0 && accepts.length > 0) {
+            const nets = Array.from(new Set(accepts.map(a => String(a.network).slice(0, 40)))).slice(0, 10).join(', ');
+            return { option: null, chainId: null, reason: `No payable option: the offered network(s) ${nets} are not ones this client knows (pass a CAIP-2 id like eip155:8453 or a chain id).` };
+        }
+        const reason = onChain.some(a => a.scheme === 'upto')
             ? 'This endpoint offers the x402 "upto" scheme without an extra.facilitatorAddress (or without an asset), so the ' +
                 'Permit2 authorization cannot be bound to a facilitator. AgentWallet will not approximate it with an upfront transfer. ' +
                 'Ask the endpoint operator to publish facilitatorAddress, or an "exact" option.'

package/build/x402-payment.d.ts

@@ -177,6 +177,7 @@ export declare function isWithinCap(rawAmountRequired: string, trustedDecimals:
 /** The row GET /approvals/{id} answers with. Numbers arrive as strings from the server. */
 export interface ApprovalRow {
     status?: string;
+    scheme?: string;
     used?: number | string;
     wallet_id?: number | string;
     chain_id?: number | string;
@@ -191,7 +192,10 @@ export interface ApprovalWant {
     asset: string;
     payTo: string;
     rawAmount: string;
+    scheme?: string;
 }
+/** The url stored with an approval request: origin and path only, never userinfo or a query (round 3). */
+export declare function approvalResourceUrl(url: string): string;
 /**
  * Why an approval cannot stand in for the cap on this payment, or null when it can.
  *

package/build/x402-payment.js

@@ -386,6 +386,11 @@ export function isWithinCap(rawAmountRequired, trustedDecimals, capHuman) {
     const capRaw = toBaseUnits(capHuman, trustedDecimals);
     return BigInt(rawAmountRequired) <= BigInt(capRaw);
 }
+/** The url stored with an approval request: origin and path only, never userinfo or a query (round 3). */
+export function approvalResourceUrl(url) {
+    const u = new URL(url);
+    return u.origin + u.pathname;
+}
 /**
  * Why an approval cannot stand in for the cap on this payment, or null when it can.
  *
@@ -424,10 +429,11 @@ export function approvalRefusal(approvalId, row, want, localMode) {
         && Number(row?.chain_id) === want.chainId
         && String(row?.asset ?? '').toLowerCase() === want.asset.toLowerCase()
         && String(row?.pay_to ?? '').toLowerCase() === want.payTo.toLowerCase()
+        && (!want.scheme || !row?.scheme || String(row.scheme) === want.scheme)
         && /^\d+$/.test(value) && /^\d+$/.test(want.rawAmount)
         && BigInt(value) >= BigInt(want.rawAmount);
     if (!covers) {
-        return { error: 'Approval does not cover this payment (wallet, asset, recipient, chain or amount differ).' };
+        return { error: 'Approval does not cover this payment (wallet, asset, recipient, chain, scheme or amount differ).' };
     }
     return null;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.7",
+  "version": "1.13.9",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [