agentwallet-mcp 1.13.9 → 1.13.10

package/README.md

@@ -37,7 +37,7 @@ Run `wallet_mode` at any time and the server will tell you which one you are in,
 }
 ```
 
-Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key out of your shell config. The key is read once, never written to disk, never logged, and never included in an error message.
+Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key out of your shell config (one or the other: the server refuses to start when both are set). The key is read once, never written to disk, never logged, and never included in an error message.
 
 `AGENTWALLET_RPC_<chainId>` (or `AGENTWALLET_RPC_URL` for all chains) points at an endpoint you trust. Without it a public RPC is used, and a public RPC can see which addresses you ask about.
 
@@ -69,7 +69,7 @@ Local signing uses [viem](https://viem.sh) for EVM and `@solana/web3.js` for Sol
 `npm audit` reports no advisories as of 1.13.5; the overrides in package.json keep two advisories under `@solana/web3.js`'s jayson closed. Earlier releases carried advisories inside `@modelcontextprotocol/sdk`'s HTTP transport dependencies. This server speaks stdio, so that code never loads, and the SDK is not something this package can patch. Run the audit yourself. Publishing a tree you can inspect is the point.
 
 <p align="center">
-  <img src="assets/demo.svg" alt="AgentWallet demo, AI agent pays x402 invoice automatically" width="800">
+  <img src="https://raw.githubusercontent.com/hifriendbot/agentwallet-mcp/main/assets/demo.svg" alt="AgentWallet demo, AI agent pays x402 invoice automatically" width="800">
 </p>
 
 ## Features
@@ -118,7 +118,7 @@ Add to your config:
 }
 ```
 
-> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet.
+> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet. Only the metered routes (creating a wallet, signing, sending) are paid this way, at most `AGENTWALLET_MAX_AUTOPAY_PER_HOUR` times an hour (default 20), and every automatic payment is reported in the tool result under `autopay_payment`. A 402 on any other route is reported, never paid.
 >
 > **Auto-pay safety cap.** `AGENTWALLET_MAX_AUTOPAY` (optional, default `1`) is the most one x402 payment may authorize, in stablecoin units: `1` means one dollar. It prices registry stablecoins only (USDC, USDT, USDbC, DAI on the supported chains, USDC and USDT on Solana). A requirement in the chain's native asset or in any other token is refused, because "1" measured in ETH is a few thousand dollars; list such assets in `AGENTWALLET_AUTOPAY_ASSETS` (comma-separated addresses or mints, or the word `native`) to allow them, and the cap then applies in that asset's own units. Any requirement above the cap is rejected instead of paid, so a malformed or tampered payment requirement cannot drain the wallet. This automatic path settles `exact` requirements only; an `upto` offer from the API is refused before any wallet call, because paying a usage maximum upfront is not what the offer means (use `pay_x402`, which signs a Permit2 authorization for it). The cap is the operator's ceiling: a `max_payment` argument can lower it for one call but never raise it. Raise the variable itself if you genuinely need larger automatic payments (for example `"5"` for up to 5 USDC per call).
 
@@ -337,8 +337,10 @@ Which guards apply depends on who holds the key.
 - `AGENTWALLET_MAX_AUTOPAY`: ceiling per x402 auto-payment in stablecoin units (default `1`); `AGENTWALLET_AUTOPAY_ASSETS` opts native or non-stable assets in; `AGENTWALLET_X402_MAX_TIMEOUT` bounds how long a signed authorization stays valid (default 3600 seconds)
 - `AGENTWALLET_SOLANA_RPC_<chainId>` (or `AGENTWALLET_SOLANA_RPC` for all clusters): the RPC's genesis hash is checked against the chain id before anything is sent, and an EVM RPC's `eth_chainId` likewise, so one URL cannot silently serve a different network than the one requested
 - `AGENTWALLET_TOKEN_RISK=0`: skip the GoPlus lookup `approve_token` performs (a third-party call that reveals which token you are about to approve)
+- `AGENTWALLET_CHAIN_ID`: the EVM chain used when a call names none (default 8453)
+- `AGENTWALLET_LEGACY_PAYWALL_ORIGINS`: comma-separated https origins whose legacy-shaped 402 may be settled by an on-chain transfer proved by hash; every other host gets a signed authorization
 
-All cap variables are validated at startup; a typo stops the server rather than reading as "no limit". `wallet_mode` reports every guard, including the token cap and whether unknown token calls are allowed. Node.js 22.19 or newer is required.
+Every `AGENTWALLET_*` variable is validated at startup: a malformed cap stops the server rather than reading as "no limit", and an unrecognised name (a misspelled cap) stops it too. `wallet_mode` reports every guard with its parsed value. Tool arguments are strict: an unknown argument name (a typo in `max_payment`) is an error, never silently ignored. `pay_x402` signs one live authorization per resource; a second, different requirement for the same resource is refused until the first expires unless `fresh_authorization` is passed. Node.js 22.19 or newer is required.
 
 **Either mode**, for x402 paywalls you run through the hosted API:
 

package/build/index.js

@@ -27,15 +27,35 @@ function anyLocalMode() {
     return isLocalMode() || isSolanaLocalMode();
 }
 // ─── Configuration ──────────────────────────────────────────────
-const API_BASE = process.env.AGENTWALLET_API_URL || 'https://hifriendbot.com/wp-json/agentwallet/v1';
-const API_USER = process.env.AGENTWALLET_USER || '';
-const API_PASS = process.env.AGENTWALLET_PASS || ''; // WordPress application password
-const X402_WALLET_ID = process.env.AGENTWALLET_WALLET_ID || ''; // Wallet ID for x402 auto-pay
-const DASHBOARD_URL = process.env.AGENTWALLET_DASHBOARD_URL || 'https://hifriendbot.com/wallet/';
+const API_BASE = (process.env.AGENTWALLET_API_URL || 'https://hifriendbot.com/wp-json/agentwallet/v1').trim().replace(/\/+$/, '');
+const API_USER = (process.env.AGENTWALLET_USER || '').trim();
+const API_PASS = (process.env.AGENTWALLET_PASS || '').trim(); // WordPress application password
+const X402_WALLET_ID = (process.env.AGENTWALLET_WALLET_ID || '').trim(); // Wallet ID for x402 auto-pay
+const DASHBOARD_URL = (process.env.AGENTWALLET_DASHBOARD_URL || 'https://hifriendbot.com/wallet/').trim();
 // Basic credentials and 402 auto-pay decisions ride on this URL, so it must be
-// https, or loopback for a local test server. Anything else is refused at start.
-if (/^http:/i.test(API_BASE) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?(\/|$)/i.test(API_BASE)) {
-    throw new Error(`AGENTWALLET_API_URL must be https (got ${API_BASE}); plain http is allowed only for localhost.`);
+// https, or loopback for a local test server. The value is parsed, not
+// pattern-matched: a leading space defeated the old regex while fetch still
+// sent the credentials in plaintext (2026-10-04 round 4).
+{
+    let u;
+    try {
+        u = new URL(API_BASE);
+    }
+    catch {
+        throw new Error(`AGENTWALLET_API_URL is not a URL: "${API_BASE}".`);
+    }
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '[::1]';
+    if (u.username || u.password)
+        throw new Error('AGENTWALLET_API_URL must not carry credentials; use AGENTWALLET_USER and AGENTWALLET_PASS.');
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && loopback)) {
+        throw new Error(`AGENTWALLET_API_URL must be https (got ${u.protocol}//${u.host}); plain http is allowed only for localhost.`);
+    }
+    if (API_USER.includes(':'))
+        throw new Error('AGENTWALLET_USER must not contain ":" (the Basic auth separator).');
+    if ((API_USER === '') !== (API_PASS === ''))
+        console.error('AgentWallet MCP: warning, only one of AGENTWALLET_USER / AGENTWALLET_PASS is set; hosted calls will carry no credentials.');
+    if (X402_WALLET_ID && !/^\d+$/.test(X402_WALLET_ID))
+        throw new Error(`AGENTWALLET_WALLET_ID must be a wallet id (digits only), got "${X402_WALLET_ID}".`);
 }
 /* ── Local-mode routing ──────────────────────────────────────────
    Translates the REST paths the tools already speak into in-process signing
@@ -288,7 +308,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
 function autopayRouteAllowed(path, method) {
     return method === 'POST' && /^\/wallets(\/\d+\/(sign|send))?(\?|$)/.test(path);
 }
-const AUTOPAY_PER_HOUR = (() => { const n = Number(process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR ?? '20'); return Number.isInteger(n) && n >= 0 ? n : 20; })();
+const AUTOPAY_PER_HOUR = (() => { const raw = (process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR ?? '20').trim(); return /^\d+$/.test(raw) ? Number(raw) : 20; })(); // validated in validateGuardEnv
 const autopayLog = [];
 /** Read a body no larger than maxChars, refusing early on a declared length and mid-stream on a real one. */
 async function readBounded(res, maxChars, who) {
@@ -552,7 +572,8 @@ const PAYWALL_MAX_CHARS = 4 * 1024 * 1024; // a paywall's answer, before and aft
    and the client's log (2026-10-04 audit). */
 function redactRpcSecrets(err) {
     const e = err;
-    let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : String(e?.message ?? err);
+    // A rejection that is not an Error (web3.js rejects with a raw {InstructionError} object) used to read "[object Object]".
+    let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : (e?.message !== undefined ? String(e.message) : (err && typeof err === 'object' ? JSON.stringify(err) : String(err)));
     msg = msg.split(/\r?\n/).filter(l => !/^\s*(URL|Request body|Request Arguments|Raw Call Arguments)\s*:/i.test(l)).join('\n').trim();
     return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
 }
@@ -600,6 +621,48 @@ function validateGuardEnv() {
     if (t && (!/^\d+$/.test(t) || Number(t) < 60 || Number(t) > 31_536_000)) {
         throw new Error(`AGENTWALLET_X402_MAX_TIMEOUT must be a whole number of seconds between 60 and 31536000, got "${t}".`);
     }
+    const perHour = process.env.AGENTWALLET_MAX_AUTOPAY_PER_HOUR;
+    if (perHour !== undefined && !/^\d+$/.test(perHour.trim())) {
+        throw new Error(`AGENTWALLET_MAX_AUTOPAY_PER_HOUR must be a whole number (0 disables internal auto-pay), got "${perHour}".`);
+    }
+    for (const o of (process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS || '').split(',').map(x => x.trim()).filter(Boolean)) {
+        let u = null;
+        try {
+            u = new URL(o);
+        }
+        catch {
+            u = null;
+        }
+        if (!u || u.protocol !== 'https:' || u.origin !== o.replace(/\/+$/, '')) {
+            throw new Error(`AGENTWALLET_LEGACY_PAYWALL_ORIGINS entry "${o}" is not an https origin (scheme and host only, like https://shop.example).`);
+        }
+    }
+    // Two sources for one key family is ambiguous; refuse rather than pick one silently.
+    if ((process.env.AGENTWALLET_PRIVATE_KEY || '').trim() && (process.env.AGENTWALLET_KEYFILE || '').trim()) {
+        throw new Error('Both AGENTWALLET_PRIVATE_KEY and AGENTWALLET_KEYFILE are set; keep one.');
+    }
+    if ((process.env.AGENTWALLET_SOLANA_KEY || '').trim() && (process.env.AGENTWALLET_SOLANA_KEYFILE || '').trim()) {
+        throw new Error('Both AGENTWALLET_SOLANA_KEY and AGENTWALLET_SOLANA_KEYFILE are set; keep one.');
+    }
+    // An unrecognised AGENTWALLET_* name is almost always a misspelled cap, which
+    // would run uncapped without a word (round 4). Refuse to start instead.
+    for (const k of Object.keys(process.env)) {
+        if (!k.startsWith('AGENTWALLET_'))
+            continue;
+        if (KNOWN_ENV.has(k) || /^AGENTWALLET_(RPC|SOLANA_RPC)_\d+$/.test(k))
+            continue;
+        throw new Error(`Unknown environment variable ${k}. AgentWallet refuses to start on an unrecognised AGENTWALLET_* name so that a misspelled cap cannot run uncapped. Known names: ${[...KNOWN_ENV].join(', ')}, AGENTWALLET_RPC_<chainId>, AGENTWALLET_SOLANA_RPC_<chainId>.`);
+    }
+}
+const KNOWN_ENV = new Set(["AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS", "AGENTWALLET_API_URL", "AGENTWALLET_APPROVALS", "AGENTWALLET_AUTOPAY_ASSETS", "AGENTWALLET_CHAIN_ID", "AGENTWALLET_DASHBOARD_URL", "AGENTWALLET_KEYFILE", "AGENTWALLET_LEGACY_PAYWALL_ORIGINS", "AGENTWALLET_MAX_AUTOPAY", "AGENTWALLET_MAX_AUTOPAY_PER_HOUR", "AGENTWALLET_MAX_TX_NATIVE", "AGENTWALLET_MAX_TX_SOL", "AGENTWALLET_MAX_TX_TOKEN", "AGENTWALLET_PASS", "AGENTWALLET_PERMIT2_AUTO_APPROVE", "AGENTWALLET_PRIVATE_KEY", "AGENTWALLET_RPC_URL", "AGENTWALLET_SOLANA_KEY", "AGENTWALLET_SOLANA_KEYFILE", "AGENTWALLET_SOLANA_RPC", "AGENTWALLET_TOKEN_DECIMALS", "AGENTWALLET_TOKEN_RISK", "AGENTWALLET_USER", "AGENTWALLET_WALLET_ID", "AGENTWALLET_X402_MAX_TIMEOUT"]);
+/**
+ * Register a tool whose arguments are strict: an unknown key (max_payemnt for
+ * max_payment) is an error that names it, not a silently dropped guard. The
+ * advertised schema always said additionalProperties: false; now the runtime
+ * agrees (round 4).
+ */
+function tool(name, description, shape, cb) {
+    return server.registerTool(name, { description, inputSchema: z.object(shape).strict() }, cb);
 }
 // ─── EVM Helpers ──────────────────────────────────────────────────
 /**
@@ -679,10 +742,10 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.9',
+    version: '1.13.10',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
-        ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
+        ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
         : 'Private keys are encrypted server-side and never exposed: agents sign and broadcast transactions without ever touching raw keys.'}
 
 ## Getting Started
@@ -738,9 +801,7 @@ Create paywalls to charge other agents for accessing your resources:
 
 ## Wallet Security
 - ${anyLocalMode() ? 'pause_wallet does not exist in local mode: revoke the key (rotate it and move the funds) if the process is compromised.' : 'Use pause_wallet to immediately freeze a wallet if compromised. No transactions can be signed while paused.'}
-- Use unpause_wallet to resume operations.
-- Use delete_wallet to permanently disable a wallet.
-- ${anyLocalMode() ? 'Spend limits are the AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL / _AUTOPAY caps the operator set; run wallet_mode to see them. Unset means no limit.' : 'Wallets have server-enforced spending limits.'}
+${anyLocalMode() ? '' : '- Use unpause_wallet to resume operations.\n- Use delete_wallet to permanently disable a wallet.\n'}- ${anyLocalMode() ? 'Spend limits are the AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL caps the operator set (unset means no limit) and AGENTWALLET_MAX_AUTOPAY for x402 (default 1); run wallet_mode to see them.' : 'Wallets have server-enforced spending limits.'}
 
 ## Tool Selection Guide
 | Goal | Tool |
@@ -760,7 +821,7 @@ Create paywalls to charge other agents for accessing your resources:
 | Check usage/billing | get_usage |`,
 });
 // ─── Tool: create_wallet ─────────────────────────────────────────
-server.tool('create_wallet', 'Create a new EVM or Solana wallet. Returns the wallet ID and address. ' +
+tool('create_wallet', 'Create a new EVM or Solana wallet. Returns the wallet ID and address. ' +
     (anyLocalMode() ? 'In local mode this reports the key already configured; no wallet is created remotely.' : 'Private key is encrypted server-side and never exposed.'), {
     label: z.string().default('').describe('Friendly name for the wallet'),
     chain_id: z.number().int().default(8453).describe('Default chain ID (1=Ethereum, 8453=Base, 42161=Arbitrum, 10=Optimism, 137=Polygon, 43114=Avalanche, 56=BSC, 7777777=Zora, 369=PulseChain, 900=Solana, 901=Solana Devnet)'),
@@ -769,13 +830,13 @@ server.tool('create_wallet', 'Create a new EVM or Solana wallet. Returns the wal
     return jsonResponse(data);
 });
 // ─── Tool: list_wallets ──────────────────────────────────────────
-server.tool('list_wallets', 'List all wallets owned by the authenticated user. ' +
+tool('list_wallets', 'List all wallets owned by the authenticated user. ' +
     'Returns wallet IDs, addresses, labels, chain IDs, and status.', {}, async () => {
     const data = await api('/wallets');
     return jsonResponse(data);
 });
 // ─── Tool: get_wallet ────────────────────────────────────────────
-server.tool('get_wallet', 'Get details for a specific wallet by ID. ' +
+tool('get_wallet', 'Get details for a specific wallet by ID. ' +
     'Returns address, label, chain, spending limits, and pause status.', {
     wallet_id: z.number().int().describe('Wallet ID'),
 }, async ({ wallet_id }) => {
@@ -783,7 +844,7 @@ server.tool('get_wallet', 'Get details for a specific wallet by ID. ' +
     return jsonResponse(data);
 });
 // ─── Tool: get_balance ───────────────────────────────────────────
-server.tool('get_balance', 'Get the native token balance for a wallet on a specific chain. ' +
+tool('get_balance', 'Get the native token balance for a wallet on a specific chain. ' +
     'Returns balance in both wei (or lamports for Solana) and human-readable format.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     chain_id: z.number().int().optional().describe('Chain ID to check (defaults to wallet\'s default chain)'),
@@ -793,7 +854,7 @@ server.tool('get_balance', 'Get the native token balance for a wallet on a speci
     return jsonResponse(data);
 });
 // ─── Tool: sign_transaction ──────────────────────────────────────
-server.tool('sign_transaction', 'Sign a transaction with a wallet\'s private key. ' +
+tool('sign_transaction', 'Sign a transaction with a wallet\'s private key. ' +
     'For EVM: returns signed raw transaction hex. For Solana: returns base64 signed transaction. ' +
     'Does NOT broadcast — use send_transaction for sign + broadcast.', {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -839,7 +900,7 @@ server.tool('sign_transaction', 'Sign a transaction with a wallet\'s private key
     return jsonResponse(result);
 });
 // ─── Tool: send_transaction ──────────────────────────────────────
-server.tool('send_transaction', 'Sign and broadcast a transaction. ' +
+tool('send_transaction', 'Sign and broadcast a transaction. ' +
     'Returns the transaction hash (EVM) or signature (Solana) on success. ' +
     (anyLocalMode() ? 'Signed in this process with the local key and broadcast via the configured RPC.' : 'The transaction is signed server-side and broadcast via RPC.'), {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -885,7 +946,7 @@ server.tool('send_transaction', 'Sign and broadcast a transaction. ' +
     return jsonResponse(result);
 });
 // ─── Tool: transfer ─────────────────────────────────────────────
-server.tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to an address. ' +
+tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to an address. ' +
     'Specify the amount in human-readable format (e.g. "0.1" for 0.1 ETH). ' +
     'The amount is converted to wei/lamports automatically. Signs and broadcasts the transaction.', {
     wallet_id: z.number().int().describe('Wallet ID to send from'),
@@ -916,7 +977,7 @@ server.tool('transfer', 'Send native tokens (ETH, AVAX, BNB, POL, PLS, SOL) to a
     });
 });
 // ─── Tool: get_token_balance ────────────────────────────────────
-server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wallet on a specific chain. ' +
+tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wallet on a specific chain. ' +
     'Returns the raw balance and human-readable balance. ' +
     'Use get_chains to find stablecoin addresses for each chain.', {
     wallet_id: z.number().int().describe('Wallet ID to check'),
@@ -960,7 +1021,7 @@ server.tool('get_token_balance', 'Get the ERC-20 or SPL token balance for a wall
     });
 });
 // ─── Tool: transfer_token ───────────────────────────────────────
-server.tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) to an address. ' +
+tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) to an address. ' +
     'Specify the amount in human-readable format (e.g. "100" for 100 USDC). ' +
     'Signs and broadcasts the transaction. Use get_chains to find stablecoin addresses.', {
     wallet_id: z.number().int().describe('Wallet ID to send from'),
@@ -1009,7 +1070,7 @@ server.tool('transfer_token', 'Send ERC-20 tokens (EVM) or SPL tokens (Solana) t
     });
 });
 // ─── Tool: call_contract ────────────────────────────────────────
-server.tool('call_contract', 'Execute a read-only call against a smart contract (eth_call). ' +
+tool('call_contract', 'Execute a read-only call against a smart contract (eth_call). ' +
     'Returns the raw hex result. Does not cost gas or modify state. ' +
     'Useful for reading on-chain data like token balances, prices, positions.', {
     chain_id: z.number().int().describe('Chain ID'),
@@ -1023,7 +1084,7 @@ server.tool('call_contract', 'Execute a read-only call against a smart contract
     return jsonResponse(result);
 });
 // ─── Tool: approve_token ────────────────────────────────────────
-server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 tokens on your behalf. ' +
+tool('approve_token', 'Approve a spender contract to transfer ERC-20 tokens on your behalf. ' +
     'Required before interacting with any DeFi protocol (DEXs, lending, etc.). ' +
     'Use amount "max" for unlimited approval, or specify an exact amount.', {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -1071,7 +1132,7 @@ server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 toke
     });
 });
 // ─── Tool: get_allowance ────────────────────────────────────────
-server.tool('get_allowance', 'Check how many ERC-20 tokens a spender is approved to transfer. ' +
+tool('get_allowance', 'Check how many ERC-20 tokens a spender is approved to transfer. ' +
     'Returns the allowance in both raw and human-readable format. ' +
     'Use this to check if an approval is needed before a DeFi transaction.', {
     wallet_id: z.number().int().describe('Wallet ID (used to determine the owner address)'),
@@ -1107,7 +1168,7 @@ server.tool('get_allowance', 'Check how many ERC-20 tokens a spender is approved
 });
 // ─── WETH / Wrapped Native Token addresses ──────────────────────
 // ─── Tool: wrap_eth ─────────────────────────────────────────────
-server.tool('wrap_eth', 'Wrap native tokens (ETH, AVAX, BNB, POL, PLS) into their wrapped ERC-20 version (WETH, WAVAX, etc.). ' +
+tool('wrap_eth', 'Wrap native tokens (ETH, AVAX, BNB, POL, PLS) into their wrapped ERC-20 version (WETH, WAVAX, etc.). ' +
     'Required for most DeFi protocols that use ERC-20 tokens instead of raw native tokens. ' +
     'Specify amount in human-readable format (e.g. "0.5" for 0.5 ETH).', {
     wallet_id: z.number().int().describe('Wallet ID'),
@@ -1137,7 +1198,7 @@ server.tool('wrap_eth', 'Wrap native tokens (ETH, AVAX, BNB, POL, PLS) into thei
     });
 });
 // ─── Tool: unwrap_eth ───────────────────────────────────────────
-server.tool('unwrap_eth', 'Unwrap wrapped tokens (WETH, WAVAX, WBNB, etc.) back to native tokens. ' +
+tool('unwrap_eth', 'Unwrap wrapped tokens (WETH, WAVAX, WBNB, etc.) back to native tokens. ' +
     'Specify amount in human-readable format (e.g. "0.5" for 0.5 WETH).', {
     wallet_id: z.number().int().describe('Wallet ID'),
     amount: z.string().describe('Amount to unwrap in human-readable format (e.g. "0.5")'),
@@ -1196,7 +1257,7 @@ function decodeAbiString(hex) {
         return '';
     }
 }
-server.tool('get_token_info', 'Get the name, symbol, and decimals of any ERC-20 token by its contract address. ' +
+tool('get_token_info', 'Get the name, symbol, and decimals of any ERC-20 token by its contract address. ' +
     'Useful for discovering token details before transfers or approvals.', {
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
@@ -1336,7 +1397,7 @@ async function signPermit2(walletId, chainId, auth, approvalId) {
     return sig;
 }
 // ─── Tool: pay_x402 ─────────────────────────────────────────────
-server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server returns HTTP 402 Payment Required, ' +
+tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server returns HTTP 402 Payment Required, ' +
     'parses the payment requirements (v1 body or v2 PAYMENT-REQUIRED header), signs an EIP-3009 ' +
     'TransferWithAuthorization for the "exact" scheme (no gas, nothing broadcast by the payer), and retries ' +
     'the request with the payment header. AgentWallet paywalls are paid by on-chain transfer instead. ' +
@@ -1360,6 +1421,9 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     fresh_authorization: z.boolean().optional().describe('Sign a new authorization even if one for the same endpoint, amount and recipient is still valid. By default a repeat call ' +
         'within the validity window re-sends the earlier signature (same nonce, so it cannot settle twice) instead of paying again.'),
 }, async ({ url, wallet_id, method, headers: headersJson, body: reqBody, max_payment, prefer_chain, request_approval, approval_id, fresh_authorization }) => {
+    if (max_payment !== undefined && !/^\d+(\.\d+)?$/.test(String(max_payment).trim())) {
+        throw new Error(`max_payment must be a decimal number of stablecoin units, got "${serverText(max_payment)}"; nothing was fetched.`);
+    }
     // Build request headers
     const reqHeaders = { Accept: 'application/json' };
     if (headersJson) {
@@ -1801,10 +1865,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     });
 });
 // ─── Tool: check_approval ───────────────────────────────────────
-server.tool('check_approval', 'Status of a payment approval created when pay_x402 exceeded the cap on a hosted wallet. ' +
+tool('check_approval', 'Status of a payment approval created when pay_x402 exceeded the cap on a hosted wallet. ' +
     'Returns pending, approved, denied or expired. Once approved, call pay_x402 again with approval_id.', { approval_id: z.string().describe('Approval id returned by pay_x402') }, async ({ approval_id }) => jsonResponse(await api(`/approvals/${encodeURIComponent(approval_id)}`, 'GET', undefined, { 'X-AGW-SKIP-X402': 'true' })));
 // ─── Tool: approve_permit2 ──────────────────────────────────────
-server.tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
+tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permit2 contract, needed before paying x402 "upto" endpoints with that token. ' +
     'A normal on-chain transaction (needs gas). By default approves the maximum, the ecosystem norm, so it never has to be repeated; ' +
     'pass amount to grant a bounded allowance instead (required under AGENTWALLET_MAX_TX_TOKEN, which refuses a max approval). ' +
     'Permit2 itself only moves what each signed authorization allows.', {
@@ -1824,20 +1888,20 @@ server.tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permi
     return jsonResponse({ ...result, token, spender: permit2Address(chain_id), amount: amount ?? 'unlimited', note: 'Permit2 only transfers what a signed authorization allows; the allowance itself moves nothing.' });
 });
 // ─── Tool: check_token_risk ─────────────────────────────────────
-server.tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it: honeypot, taxes, owner powers, verified source, ' +
+tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it: honeypot, taxes, owner powers, verified source, ' +
     'holder concentration, DEX liquidity. Uses GoPlus Security (free, no key) with an on-chain fallback. ' +
     'A warning for the caller to weigh, never a block.', {
     token: z.string().regex(/^0x[a-fA-F0-9]{40}$/).describe('ERC-20 token contract address'),
     chain_id: z.number().int().describe('Chain ID'),
 }, async ({ token, chain_id }) => jsonResponse({ token, chain_id, risk: await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data)) }));
 // ─── Tool: get_usage ─────────────────────────────────────────────
-server.tool('get_usage', 'Get the current month\'s usage statistics. ' +
+tool('get_usage', 'Get the current month\'s usage statistics. ' +
     'Returns operations count, tier info, remaining quota, and fees.', {}, async () => {
     const data = await api('/usage');
     return jsonResponse(data);
 });
 // ─── Tool: buy_verification_credits ─────────────────────────────
-server.tool('buy_verification_credits', 'Buy x402 verification credits with USDC on-chain. ' +
+tool('buy_verification_credits', 'Buy x402 verification credits with USDC on-chain. ' +
     'Paywall owners need credits to process verifications beyond the free tier (1,000/month) ' +
     'when they don\'t have Stripe billing configured. ' +
     'Returns 402 payment instructions — pay on-chain and retry with proof.', {
@@ -1848,27 +1912,27 @@ server.tool('buy_verification_credits', 'Buy x402 verification credits with USDC
     return jsonResponse(data);
 });
 // ─── Tool: pause_wallet ──────────────────────────────────────────
-server.tool('pause_wallet', 'Emergency pause a wallet. No transactions can be signed while paused.', {
+tool('pause_wallet', 'Emergency pause a wallet. No transactions can be signed while paused.', {
     wallet_id: z.number().int().describe('Wallet ID to pause'),
 }, async ({ wallet_id }) => {
     const data = await api(`/wallets/${wallet_id}/pause`, 'POST');
     return jsonResponse(data);
 });
 // ─── Tool: unpause_wallet ────────────────────────────────────────
-server.tool('unpause_wallet', 'Resume a paused wallet so transactions can be signed again.', {
+tool('unpause_wallet', 'Resume a paused wallet so transactions can be signed again.', {
     wallet_id: z.number().int().describe('Wallet ID to unpause'),
 }, async ({ wallet_id }) => {
     const data = await api(`/wallets/${wallet_id}/unpause`, 'POST');
     return jsonResponse(data);
 });
 // ─── Tool: get_chains ────────────────────────────────────────────
-server.tool('get_chains', 'List all supported chains (EVM + Solana) with their chain IDs, native tokens, ' +
+tool('get_chains', 'List all supported chains (EVM + Solana) with their chain IDs, native tokens, ' +
     'stablecoins, and RPC configuration status.', {}, async () => {
     const data = await api('/chains');
     return jsonResponse(data);
 });
 // ─── Tool: delete_wallet ─────────────────────────────────────────
-server.tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no longer appear in listings ' +
+tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no longer appear in listings ' +
     'and cannot be used for transactions. The wallet is read first and the delete names its address, ' +
     'so a wallet that cannot be read is never deleted.', {
     wallet_id: z.number().int().describe('Wallet ID to delete'),
@@ -1883,7 +1947,7 @@ server.tool('delete_wallet', 'Delete (soft-delete) a wallet. The wallet will no
     return jsonResponse(data);
 });
 // ─── Tool: create_paywall ────────────────────────────────────────
-server.tool('create_paywall', 'Create an x402 paywall that charges agents/clients for accessing a resource. ' +
+tool('create_paywall', 'Create an x402 paywall that charges agents/clients for accessing a resource. ' +
     'Returns a public access URL that returns HTTP 402 until paid. ' +
     'Agents pay on-chain, then retry with proof to get the content.', {
     wallet_id: z.number().int().describe('Wallet ID to receive payments'),
@@ -1923,7 +1987,7 @@ server.tool('create_paywall', 'Create an x402 paywall that charges agents/client
     });
 });
 // ─── Tool: list_paywalls ────────────────────────────────────────
-server.tool('list_paywalls', 'List all your x402 paywalls. Returns paywall IDs, names, pricing, ' +
+tool('list_paywalls', 'List all your x402 paywalls. Returns paywall IDs, names, pricing, ' +
     'access URLs, payment counts, and revenue totals.', {
     page: z.number().int().default(1).describe('Page number'),
     per_page: z.number().int().min(1).max(100).default(50).describe('Results per page (max 100)'),
@@ -1932,7 +1996,7 @@ server.tool('list_paywalls', 'List all your x402 paywalls. Returns paywall IDs,
     return jsonResponse(data);
 });
 // ─── Tool: get_paywall ──────────────────────────────────────────
-server.tool('get_paywall', 'Get details for a specific x402 paywall by ID. ' +
+tool('get_paywall', 'Get details for a specific x402 paywall by ID. ' +
     'Returns pricing, access URL, payment stats, and configuration.', {
     paywall_id: z.number().int().describe('Paywall ID'),
 }, async ({ paywall_id }) => {
@@ -1940,7 +2004,7 @@ server.tool('get_paywall', 'Get details for a specific x402 paywall by ID. ' +
     return jsonResponse(data);
 });
 // ─── Tool: update_paywall ───────────────────────────────────────
-server.tool('update_paywall', 'Update an x402 paywall configuration. ' +
+tool('update_paywall', 'Update an x402 paywall configuration. ' +
     'Can change price, resource URL, active status, or any other field.', {
     paywall_id: z.number().int().describe('Paywall ID to update'),
     name: z.string().optional().describe('New paywall name'),
@@ -1978,14 +2042,14 @@ server.tool('update_paywall', 'Update an x402 paywall configuration. ' +
     return jsonResponse(data);
 });
 // ─── Tool: delete_paywall ───────────────────────────────────────
-server.tool('delete_paywall', 'Delete an x402 paywall. The access URL will return 404 after deletion.', {
+tool('delete_paywall', 'Delete an x402 paywall. The access URL will return 404 after deletion.', {
     paywall_id: z.number().int().describe('Paywall ID to delete'),
 }, async ({ paywall_id }) => {
     const data = await api(`/x402/paywalls/${paywall_id}`, 'DELETE');
     return jsonResponse(data);
 });
 // ─── Tool: get_paywall_payments ─────────────────────────────────
-server.tool('get_paywall_payments', 'Get payment history for a specific x402 paywall. ' +
+tool('get_paywall_payments', 'Get payment history for a specific x402 paywall. ' +
     'Returns verified payments with TX hashes, payer addresses, amounts, and timestamps.', {
     paywall_id: z.number().int().describe('Paywall ID'),
     page: z.number().int().default(1).describe('Page number'),
@@ -1995,13 +2059,13 @@ server.tool('get_paywall_payments', 'Get payment history for a specific x402 pay
     return jsonResponse(data);
 });
 // ─── Tool: get_x402_revenue ─────────────────────────────────────
-server.tool('get_x402_revenue', 'Get aggregate x402 revenue statistics across all your paywalls. ' +
+tool('get_x402_revenue', 'Get aggregate x402 revenue statistics across all your paywalls. ' +
     'Returns total payments and revenue broken down by chain and token.', {}, async () => {
     const data = await api('/x402/revenue');
     return jsonResponse(data);
 });
 // ─── Tool: wallet_mode ──────────────────────────────────────────
-server.tool('wallet_mode', 'Report whether this server is signing locally (self-custody, the private key never leaves this machine) ' +
+tool('wallet_mode', 'Report whether this server is signing locally (self-custody, the private key never leaves this machine) ' +
     'or through the hosted AgentWallet API (custodial). Use this to verify custody before moving funds.', {}, async () => {
     if (!anyLocalMode()) {
         return jsonResponse({
@@ -2011,8 +2075,13 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
             api_base: redactUrl(API_BASE),
             client_guards: {
                 autopay_cap_usd: autopayEnvCap(),
+                internal_autopay_armed: Boolean(X402_WALLET_ID),
+                max_autopay_per_hour: AUTOPAY_PER_HOUR,
                 autopay_assets: (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').trim() || 'registry stablecoins only',
                 x402_max_timeout_seconds: maxAuthWindowSeconds(),
+                approvals: process.env.AGENTWALLET_APPROVALS !== '0',
+                permit2_auto_approve: process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1',
+                legacy_paywall_origins: (process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS || '').trim() || 'none (API host only)',
                 note: 'These bound pay_x402 on hosted wallets too; the hosted signer adds its own pause, daily limit and approval checks.',
             },
             to_self_custody: 'Set AGENTWALLET_PRIVATE_KEY for EVM and/or AGENTWALLET_SOLANA_KEY for Solana, then restart. ' +
@@ -2023,12 +2092,18 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
         mode: 'local',
         custody: 'self',
         signing: 'Signed in this process. Keys are never sent to AgentWallet or anyone else.',
-        max_autopay: process.env.AGENTWALLET_MAX_AUTOPAY || '1',
-        autopay_assets: process.env.AGENTWALLET_AUTOPAY_ASSETS || 'registry stablecoins only',
+        max_autopay: autopayEnvCap(),
+        max_autopay_per_hour: AUTOPAY_PER_HOUR,
+        internal_autopay_armed: false, // internal auto-pay never runs in local mode
+        autopay_assets: (process.env.AGENTWALLET_AUTOPAY_ASSETS || '').trim() || 'registry stablecoins only',
         x402_max_timeout_seconds: maxAuthWindowSeconds(),
-        per_tx_cap_token: process.env.AGENTWALLET_MAX_TX_TOKEN || 'not set (ERC-20 and SPL transfers are uncapped)',
+        per_tx_cap_token: (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim() || 'not set (ERC-20 and SPL transfers are uncapped)',
         allow_unknown_token_calls: process.env.AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS === '1',
         token_decimals_pins: parseDecimalPins(process.env.AGENTWALLET_TOKEN_DECIMALS).size,
+        token_risk_lookup: process.env.AGENTWALLET_TOKEN_RISK !== '0',
+        permit2_auto_approve: process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1',
+        legacy_paywall_origins: (process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS || '').trim() || 'none (API host only)',
+        default_chain_id: (process.env.AGENTWALLET_CHAIN_ID || '').trim() || '8453',
     };
     if (isLocalMode()) {
         let rpc = 'default public endpoint';
@@ -2039,7 +2114,7 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
         report.evm = {
             address: getLocalAddress(),
             rpc_endpoint: redactUrl(rpc),
-            per_tx_cap_native: process.env.AGENTWALLET_MAX_TX_NATIVE || 'not set',
+            per_tx_cap_native: (process.env.AGENTWALLET_MAX_TX_NATIVE || '').trim() || 'not set',
         };
     }
     else {
@@ -2054,8 +2129,8 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
         report.solana = {
             address: getSolanaAddress(),
             rpc_endpoint: redactUrl(rpc),
-            per_tx_cap_sol: process.env.AGENTWALLET_MAX_TX_SOL || 'not set',
-            per_tx_cap_token: process.env.AGENTWALLET_MAX_TX_TOKEN || 'not set (SPL transfers are uncapped; AGENTWALLET_MAX_TX_SOL does not cover them)',
+            per_tx_cap_sol: (process.env.AGENTWALLET_MAX_TX_SOL || '').trim() || 'not set',
+            per_tx_cap_token: (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim() || 'not set (SPL transfers are uncapped; AGENTWALLET_MAX_TX_SOL does not cover them)',
         };
     }
     else {
@@ -2064,7 +2139,7 @@ server.tool('wallet_mode', 'Report whether this server is signing locally (self-
     return jsonResponse(report);
 });
 // ─── Tool: export_wallet_key ────────────────────────────────────
-server.tool('export_wallet_key', 'Explain how to export the private key of a hosted (custodial) AgentWallet so it can be moved ' +
+tool('export_wallet_key', 'Explain how to export the private key of a hosted (custodial) AgentWallet so it can be moved ' +
     'to self-custody or any other wallet. Export itself is deliberately human-gated and is not ' +
     'performed by this tool.', {
     wallet_id: z.number().int().optional().describe('Hosted wallet ID to export'),

package/build/local-solana.d.ts

@@ -16,6 +16,22 @@ export declare function isSolanaLocalMode(): boolean;
 export declare function getSolanaKeypair(): Keypair;
 export declare function getSolanaAddress(): string;
 export declare function resolveSolanaRpc(chainId?: number): string;
+/**
+ * Bound SPL movement. AGENTWALLET_MAX_TX_SOL only ever covered native SOL, so
+ * an SPL transfer, which is how USDC moves on Solana and the whole point of the
+ * x402 rail here, went out with no local ceiling at all. Mirrors
+ * AGENTWALLET_MAX_TX_TOKEN on the EVM side and uses the same variable so an
+ * operator sets one token cap, not one per chain family.
+ *
+ * Decimals for the cap come from the trusted table when the mint is known, then
+ * from the mint account itself, and finally 0. The caller-supplied value is
+ * never used for the ceiling: an inflated one would inflate the cap exactly
+ * like the x402 bypass.
+ *
+ * 0 is the only safe fallback. Assuming 6 for an unknown mint is what AW-001
+ * exploited: for a mint with d decimals, a ceiling evaluated at 6 is 10**(6-d)
+ * times too permissive, and SPL mints with 0 to 5 decimals are common.
+ */
 /** The mint's decimals from the chain, or null when they cannot be read. Never guesses. */
 export declare function mintDecimalsStrict(mint: string, chainId: number): Promise<number | null>;
 export declare function localSolBalance(chainId?: number): Promise<{

package/build/local-solana.js

@@ -12,7 +12,7 @@
  * that when the two instructions it needs are a dozen lines each.
  */
 import { readFileSync } from 'node:fs';
-import { Connection, Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction, sendAndConfirmTransaction, LAMPORTS_PER_SOL, } from '@solana/web3.js';
+import { Connection, Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction, LAMPORTS_PER_SOL, } from '@solana/web3.js';
 import bs58 from 'bs58';
 import { lookupTrustedDecimals } from './x402-payment.js';
 /* ── Program IDs ─────────────────────────────────────────────────── */
@@ -171,7 +171,10 @@ function assertWithinSolCap(lamports) {
  * exploited: for a mint with d decimals, a ceiling evaluated at 6 is 10**(6-d)
  * times too permissive, and SPL mints with 0 to 5 decimals are common.
  */
-const splDecimalsCache = new Map();
+/* The cap and the instruction read the mint's decimals through ONE call now:
+   a cached cap-side read and an uncached instruction-side read let a hostile
+   RPC answer 6 to one and 18 to the other, which scaled the cap by 10^12
+   while the instruction carried the real byte (2026-10-04 round 4). */
 /** The mint's decimals from the chain, or null when they cannot be read. Never guesses. */
 export async function mintDecimalsStrict(mint, chainId) {
     const known = lookupTrustedDecimals(chainId, mint);
@@ -189,37 +192,14 @@ export async function mintDecimalsStrict(mint, chainId) {
         return null;
     }
 }
-async function resolveMintDecimals(mint, chainId) {
-    const known = lookupTrustedDecimals(chainId, mint);
-    if (typeof known === 'number')
-        return known;
-    const cacheKey = `${chainId}:${mint}`; // the same mint address can exist on two clusters with different decimals
-    const cached = splDecimalsCache.get(cacheKey);
-    if (typeof cached === 'number')
-        return cached;
-    try {
-        const conn = connection(chainId);
-        const info = await conn.getParsedAccountInfo(new PublicKey(mint));
-        const data = info?.value?.data;
-        const d = Number(data?.parsed?.info?.decimals);
-        if (Number.isInteger(d) && d >= 0 && d <= 36) {
-            splDecimalsCache.set(cacheKey, d);
-            return d;
-        }
-    }
-    catch {
-        // Unreachable RPC or non-standard mint: fall through to the safe floor.
-    }
-    return 0;
-}
-async function assertWithinSplCap(mint, rawAmount, chainId = 900) {
+/** The cap is evaluated at exactly the decimals the instruction will carry; the caller passes the value it just verified against the chain. */
+function assertWithinSplCap(rawAmount, decimals) {
     const cap = (process.env.AGENTWALLET_MAX_TX_TOKEN || '').trim();
     if (!cap)
         return;
     if (!/^\d+(\.\d+)?$/.test(cap)) {
         throw new Error(`AGENTWALLET_MAX_TX_TOKEN must be a decimal number, got "${cap}".`);
     }
-    const decimals = await resolveMintDecimals(mint, chainId);
     const [whole, frac = ''] = cap.split('.');
     const capRaw = BigInt(whole + frac.padEnd(decimals, '0').slice(0, decimals));
     if (rawAmount > capRaw) {
@@ -228,6 +208,41 @@ async function assertWithinSplCap(mint, rawAmount, chainId = 900) {
             `Raise the cap deliberately if this is intended.`);
     }
 }
+const CONFIRM_TIMEOUT_MS = 90_000;
+/**
+ * Sign, broadcast and confirm. The signature reported is the one computed
+ * here, never the node's answer (a node that returned a different string had
+ * the agent confirming and reporting a signature that was not this
+ * transaction, round 4); anything that fails after the broadcast says so and
+ * carries the signature, so an agent does not retry a transfer that went out.
+ */
+async function sendSigned(conn, tx, payer) {
+    const { blockhash, lastValidBlockHeight } = await conn.getLatestBlockhash();
+    tx.recentBlockhash = blockhash;
+    tx.feePayer = payer.publicKey;
+    tx.sign(payer);
+    if (!tx.signature)
+        throw new Error('The transaction could not be signed.');
+    const local = bs58.encode(tx.signature);
+    const reported = await conn.sendRawTransaction(tx.serialize());
+    const after = (what) => new Error(`Transaction ${local} was BROADCAST but ${what}. Check it on an explorer before retrying: a retry is a second transfer.`);
+    if (reported !== local)
+        throw after(`the RPC answered with a different signature (${String(reported).slice(0, 90)}), so the node cannot be trusted about its fate`);
+    const confirm = conn.confirmTransaction({ signature: local, blockhash, lastValidBlockHeight }, 'confirmed');
+    const timeout = new Promise((_, reject) => setTimeout(() => reject(after(`was not confirmed within ${CONFIRM_TIMEOUT_MS / 1000} s`)), CONFIRM_TIMEOUT_MS).unref());
+    let result;
+    try {
+        result = await Promise.race([confirm, timeout]);
+    }
+    catch (e) {
+        if (e instanceof Error && /was BROADCAST/.test(e.message))
+            throw e;
+        throw after(`confirmation failed: ${e instanceof Error ? e.message : JSON.stringify(e)}`);
+    }
+    if (result.value.err)
+        throw after(`it failed on chain: ${JSON.stringify(result.value.err)}`);
+    return local;
+}
 /* ── Reads ───────────────────────────────────────────────────────── */
 export async function localSolBalance(chainId = 900) {
     const conn = connection(chainId);
@@ -344,7 +359,7 @@ export async function localSolTransfer(to, lamports, chainId = 900) {
         toPubkey: new PublicKey(to),
         lamports: Number(amount),
     }));
-    const signature = await sendAndConfirmTransaction(conn, tx, [payer]);
+    const signature = await sendSigned(conn, tx, payer);
     return {
         signature,
         from: payer.publicKey.toBase58(),
@@ -396,22 +411,23 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     // The cluster is verified before the cap reads decimals from it, so the
     // decimals cache is never filled from a node serving another chain.
     await assertCluster(conn, chainId);
-    await assertWithinSplCap(mintStr, BigInt(rawAmount), chainId);
-    const payer = getSolanaKeypair();
-    const mint = new PublicKey(mintStr);
-    const recipient = new PublicKey(to);
-    await assertRecipientIsWallet(conn, recipient);
-    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     // The caller scaled the amount by `decimals`. That value must be the mint's
     // real one: substituting the real value into the instruction (as 1.13.0
     // did) let a wrong guess through, because the amount had already been
     // scaled by the guess and TransferChecked only sees the real byte
-    // (2026-10-04 audit). A mismatch refuses.
+    // (2026-10-04 audit). A mismatch refuses. Read ONCE, and the cap below is
+    // evaluated at this same value (round 4).
     const real = await mintDecimalsStrict(mintStr, chainId);
     if (real === null)
         throw new Error(`Could not read the decimals of mint ${mintStr} from the chain; refusing to guess the scale of the amount.`);
     if (decimals !== real)
         throw new Error(`decimals ${decimals} was passed but mint ${mintStr} has ${real} decimals; refusing to scale the amount by the wrong factor.`);
+    assertWithinSplCap(BigInt(rawAmount), real);
+    const payer = getSolanaKeypair();
+    const mint = new PublicKey(mintStr);
+    const recipient = new PublicKey(to);
+    await assertRecipientIsWallet(conn, recipient);
+    const { tokenProgram, ataSize } = await mintLayout(conn, mint);
     const sourceAta = associatedTokenAddress(payer.publicKey, mint, tokenProgram);
     const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
     const tx = new Transaction();
@@ -430,13 +446,16 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
         // Rent follows the account's real size, which for Token-2022 is above 165;
         // SOL already sitting at the address reduces what the payer tops up.
-        const rent = await conn.getMinimumBalanceForRentExemption(ataSize);
-        const shortfall = Math.max(0, rent - (destInfo?.lamports ?? 0));
-        assertWithinSolCap(BigInt(shortfall));
+        // The node's rent figure is floored at the cluster constant and the SOL the
+        // node says already sits at the address is not credited: both are numbers a
+        // lying RPC used to zero so the create went out under the cap (round 4).
+        const claimed = Number(await conn.getMinimumBalanceForRentExemption(ataSize));
+        const rent = Math.max(Number.isFinite(claimed) ? Math.trunc(claimed) : 0, (128 + ataSize) * 6960);
+        assertWithinSolCap(BigInt(rent));
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }
     tx.add(transferCheckedIx(tokenProgram, sourceAta, mint, destAta, payer.publicKey, BigInt(rawAmount), decimals));
-    const signature = await sendAndConfirmTransaction(conn, tx, [payer]);
+    const signature = await sendSigned(conn, tx, payer);
     return {
         signature,
         from: payer.publicKey.toBase58(),

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.9",
+  "repository": { "type": "git", "url": "https://github.com/hifriendbot/agentwallet-mcp" },
+  "version": "1.13.10",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +17,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs && node test/delete-confirm.test.mjs && node test/audit-1138.test.mjs && node test/audit-1139.test.mjs && node test/audit-11310.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [