agentwallet-mcp 1.14.1 → 1.14.2

package/README.md

@@ -384,7 +384,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. On startup the chain is verified, and a ledger that does not verify refuses every spend until the operator has looked at it. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -444,12 +444,16 @@ async function api(path, method = 'GET', body, extraHeaders) {
         delete extraHeaders['X-AGW-CTX'];
     }
     let reserved = null;
-    const m = /^\/wallets\/([^/]+)\/send(\?|$)/.exec(path);
-    if (method === 'POST' && m && body) {
+    // /sign with a transaction body is the same spend as /send: the caller gets
+    // a broadcast-ready raw transaction (2026-10-14 report, 1.14.2). A message
+    // signature (body.message) moves nothing and is not gated.
+    const m = /^\/wallets\/([^/]+)\/(send|sign)(\?|$)/.exec(path);
+    const signsTx = m !== null && (m[2] === 'send' || typeof body?.message !== 'string');
+    if (method === 'POST' && m && body && signsTx) {
         const chainId = localChainId(body, new URLSearchParams(path.split('?')[1] || ''));
         const d = await describeSend(body, chainId);
         assertSendTarget(d, chainId);
-        const input = spendInputOf(d, chainId, ctx.tool || 'send', m[1], ctx);
+        const input = spendInputOf(d, chainId, ctx.tool || (m[2] === 'sign' ? 'sign_transaction' : 'send'), m[1], ctx);
         if (input)
             reserved = reserveSpend(input);
     }
@@ -457,7 +461,10 @@ async function api(path, method = 'GET', body, extraHeaders) {
         const out = await apiInner(path, method, body, extraHeaders);
         if (reserved !== null) {
             const r = out;
-            LEDGER.settle(reserved, 'broadcast', typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : null);
+            if (m[2] === 'sign')
+                LEDGER.settle(reserved, 'signed', 'raw transaction returned to the caller; not broadcast by this process, so it stays counted');
+            else
+                LEDGER.settle(reserved, 'broadcast', typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : null);
         }
         return out;
     }
@@ -1111,7 +1118,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.1',
+    version: '1.14.2',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1225,7 +1232,8 @@ tool('get_balance', 'Get the native token balance for a wallet on a specific cha
 // ─── Tool: sign_transaction ──────────────────────────────────────
 tool('sign_transaction', 'Sign a transaction with a wallet\'s private key. ' +
     'For EVM: returns signed raw transaction hex. For Solana: returns base64 signed transaction. ' +
-    'Does NOT broadcast — use send_transaction for sign + broadcast.', {
+    'Does NOT broadcast. Use send_transaction for sign + broadcast. ' +
+    'A signed transaction is a spend: under a spend policy it is checked, reserved on the ledger and counted against the budgets exactly as send_transaction is, because the caller can broadcast it.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     to: AddressSchema.describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
     chain_id: z.number().int().optional().describe('Chain ID (defaults to wallet\'s default)'),

package/build/ledger.d.ts

@@ -76,42 +76,59 @@ export interface Limits {
     } | null;
     unpriced: 'refuse' | 'allow';
 }
+export interface LedgerOptions {
+    /** Tests shorten the wait for a held lock. */
+    lockWaitMs?: number;
+}
 export declare class Ledger {
     readonly path: string | null;
     private entries;
     private last;
     private seq;
-    /** null = intact; otherwise what broke. */
+    /** null = intact; otherwise what broke. Refreshed from the file on every read. */
     integrity: string | null;
     private webhook;
+    private lockWaitMs;
     constructor(path: string | null, webhook?: {
         url: string;
         secret: string;
-    } | null);
-    private load;
+    } | null, opts?: LedgerOptions);
+    /**
+     * Re-read the file so the sums include what every other process wrote.
+     * The file must still begin with what this process has seen, line for
+     * line; otherwise it was rewritten underneath us and nothing is adopted.
+     */
+    private sync;
+    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    private lock;
     private append;
     private notify;
     /** Spends not voided, newest last. */
     private liveSpends;
-    /** Dollar sums over rolling windows; nowMs for tests. */
+    /** Dollar sums over rolling windows from a fresh read of the file; nowMs for tests. */
     spentUsd(nowMs?: number, host?: string): Spent;
     spentNative(chainId: number, nowMs?: number): Spent;
+    private sumUsd;
+    private sumNative;
     private sum;
-    /** Would this spend fit every limit? The reason names the first it does not. */
+    /** Would this spend fit every limit, given what every process has written so far? The reason names the first limit it does not. */
     check(input: ReserveInput, limits: Limits, nowMs?: number): {
         ok: true;
     } | {
         ok: false;
         reason: string;
     };
-    /** Check and record in one synchronous step. Returns the spend's seq. */
+    private evaluate;
+    /** Re-read, check and record in one step under the lock. Returns the spend's seq. */
     reserve(input: ReserveInput, limits: Limits): number;
+    /** A follow-up line, written under the lock after a fresh read so it chains onto whatever any process wrote last. */
+    private follow;
     /** The spend never happened (signing or broadcast failed before anything left this process). */
     void(ref: number, detail: string): void;
     /** What the endpoint or chain said afterwards. Never throws: the payment already happened. */
     settle(ref: number, outcome: string, detail: string | null): void;
     size(): number;
-    /** Spends newest first with their latest follow-up folded in. */
+    /** Spends newest first with their latest follow-up folded in, from a fresh read. */
     payments(opts: {
         limit: number;
         host?: string;

package/build/ledger.js

@@ -3,69 +3,146 @@
  * process reserved, and what became of it.
  *
  * Budgets are enforced from it, so a reservation is written BEFORE the
- * signature exists: check and append happen in one synchronous step, which in
- * a single-threaded process means two concurrent calls cannot both fit the
- * last dollar. A reservation whose signing fails is voided by a later line;
- * the spend line itself is never edited, so the chain stays verifiable.
+ * signature exists. Check and append happen in one step under an exclusive
+ * lock file, after the file has been re-read and the chain re-verified, so
+ * two concurrent calls cannot both fit the last dollar, whether they come
+ * from one process or from several agentwallet-mcp processes sharing the
+ * file (two MCP clients configured with the same wallet and ledger). A
+ * reservation whose signing fails is voided by a later line; the spend line
+ * itself is never edited, so the chain stays verifiable.
  *
  * Each line carries the sha256 of the previous line's hash plus its own body.
- * On load the chain is verified; a broken chain with a budget configured
- * refuses every spend until the operator looks at the file.
+ * The chain is verified on every read; a broken chain with a budget
+ * configured refuses every spend until the operator looks at the file, and a
+ * file that no longer holds what this process wrote is refused the same way.
  */
-import { appendFileSync, existsSync, readFileSync, openSync, closeSync } from 'node:fs';
+import { appendFileSync, existsSync, readFileSync, openSync, closeSync, writeSync, unlinkSync, statSync } from 'node:fs';
 import { createHash, createHmac } from 'node:crypto';
 import { DAY_MS, MONTH_MS, units, rawToUnits, human } from './policy.js';
 const GENESIS = '0'.repeat(64);
 const MAX_LINE = 16 * 1024;
+/** How long a spend waits for another process to finish its own check-and-append. */
+const LOCK_WAIT_MS = 10_000;
+/** A lock older than this was left by a process that died holding it. */
+const LOCK_STALE_MS = 30_000;
+const sleeper = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) { Atomics.wait(sleeper, 0, 0, ms); }
 function hashOf(prev, body) {
     return createHash('sha256').update(prev + '\n' + JSON.stringify(body)).digest('hex');
 }
+/** Parse and verify a ledger file's text. A trailing line without its newline is still being written by another process and is not read. */
+function parseChain(text) {
+    const complete = text.endsWith('\n') || !text.includes('\n') && text.trim() === '' ? text : text.slice(0, text.lastIndexOf('\n') + 1);
+    const lines = complete.split('\n').filter(l => l.trim());
+    const out = { entries: [], last: GENESIS, seq: 0, integrity: null };
+    let prev = GENESIS;
+    for (let i = 0; i < lines.length; i++) {
+        let e;
+        try {
+            e = JSON.parse(lines[i]);
+        }
+        catch {
+            out.integrity = `line ${i + 1} is not JSON`;
+            break;
+        }
+        const { hash, ...body } = e;
+        if (e.prev !== prev || hashOf(prev, body) !== hash) {
+            out.integrity = `chain broken at line ${i + 1} (seq ${e.seq})`;
+            break;
+        }
+        if (e.seq !== out.seq + 1) {
+            out.integrity = `sequence gap at line ${i + 1}`;
+            break;
+        }
+        out.entries.push(e);
+        out.seq = e.seq;
+        prev = hash;
+    }
+    out.last = prev;
+    return out;
+}
 export class Ledger {
     path;
     entries = [];
     last = GENESIS;
     seq = 0;
-    /** null = intact; otherwise what broke. */
+    /** null = intact; otherwise what broke. Refreshed from the file on every read. */
     integrity = null;
     webhook = null;
-    constructor(path, webhook) {
+    lockWaitMs = LOCK_WAIT_MS;
+    constructor(path, webhook, opts) {
         this.path = path;
         this.webhook = webhook ?? null;
-        if (path)
-            this.load();
+        if (opts?.lockWaitMs !== undefined)
+            this.lockWaitMs = opts.lockWaitMs;
+        if (path) {
+            // Create it now so a permissions problem shows at startup, not at the first spend.
+            if (!existsSync(path))
+                closeSync(openSync(path, 'a', 0o600));
+            this.sync();
+        }
     }
-    load() {
+    /**
+     * Re-read the file so the sums include what every other process wrote.
+     * The file must still begin with what this process has seen, line for
+     * line; otherwise it was rewritten underneath us and nothing is adopted.
+     */
+    sync() {
+        if (!this.path)
+            return;
         if (!existsSync(this.path)) {
-            // Create it now so a permissions problem shows at startup, not at the first spend.
-            closeSync(openSync(this.path, 'a', 0o600));
+            this.integrity = `the file was removed while this process was running (it held seq ${this.seq})`;
             return;
         }
-        const text = readFileSync(this.path, 'utf8');
-        const lines = text.split('\n').filter(l => l.trim());
-        let prev = GENESIS;
-        for (let i = 0; i < lines.length; i++) {
-            let e;
+        const c = parseChain(readFileSync(this.path, 'utf8'));
+        const n = this.entries.length;
+        if (c.entries.length < n || (n > 0 && c.entries[n - 1].hash !== this.last)) {
+            this.integrity = c.integrity && c.entries.length < n ? c.integrity : `the file was rewritten underneath this process (it held seq ${this.seq} ending ${this.last.slice(0, 12)}, the file now ends at seq ${c.seq})`;
+            return;
+        }
+        this.entries = c.entries;
+        this.seq = c.seq;
+        this.last = c.last;
+        this.integrity = c.integrity;
+    }
+    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    lock() {
+        if (!this.path)
+            return () => { };
+        const lockPath = this.path + '.lock';
+        const deadline = Date.now() + this.lockWaitMs;
+        for (;;) {
             try {
-                e = JSON.parse(lines[i]);
+                const fd = openSync(lockPath, 'wx', 0o600);
+                try {
+                    writeSync(fd, `${process.pid} ${new Date().toISOString()}\n`);
+                }
+                finally {
+                    closeSync(fd);
+                }
+                return () => { try {
+                    unlinkSync(lockPath);
+                }
+                catch { /* already gone */ } };
             }
-            catch {
-                this.integrity = `line ${i + 1} is not JSON`;
-                break;
+            catch (e) {
+                if (e.code !== 'EEXIST')
+                    throw e;
             }
-            const { hash, ...body } = e;
-            if (e.prev !== prev || hashOf(prev, body) !== hash) {
-                this.integrity = `chain broken at line ${i + 1} (seq ${e.seq})`;
-                break;
+            try {
+                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+                    unlinkSync(lockPath);
+                    continue;
+                }
+            }
+            catch {
+                continue; /* released between the two calls */
             }
-            if (e.seq !== this.seq + 1) {
-                this.integrity = `sequence gap at line ${i + 1}`;
-                break;
+            if (Date.now() >= deadline) {
+                throw new Error(`The ledger at ${this.path} is locked by another agentwallet-mcp process (${lockPath}) that did not finish within ${this.lockWaitMs} ms. Nothing was signed. If no other process is running, remove the lock file.`);
             }
-            this.entries.push(e);
-            this.seq = e.seq;
-            prev = hash;
+            sleepSync(5);
         }
-        this.last = prev;
     }
     append(body) {
         if (this.integrity)
@@ -103,11 +180,19 @@ export class Ledger {
         const voided = new Set(this.entries.filter(e => e.kind === 'void').map(e => e.ref));
         return this.entries.filter((e) => e.kind === 'spend' && !voided.has(e.seq));
     }
-    /** Dollar sums over rolling windows; nowMs for tests. */
+    /** Dollar sums over rolling windows from a fresh read of the file; nowMs for tests. */
     spentUsd(nowMs = Date.now(), host) {
-        return this.sum(nowMs, e => (host === undefined || e.host === host) && e.usd !== null ? units(e.usd) : 0n);
+        this.sync();
+        return this.sumUsd(nowMs, host);
     }
     spentNative(chainId, nowMs = Date.now()) {
+        this.sync();
+        return this.sumNative(chainId, nowMs);
+    }
+    sumUsd(nowMs, host) {
+        return this.sum(nowMs, e => (host === undefined || e.host === host) && e.usd !== null ? units(e.usd) : 0n);
+    }
+    sumNative(chainId, nowMs) {
         return this.sum(nowMs, e => e.chain_id === chainId && e.asset === '' ? rawToUnits(e.raw, nativeDecimalsOf(chainId)) : 0n);
     }
     sum(nowMs, f) {
@@ -125,13 +210,17 @@ export class Ledger {
         }
         return out;
     }
-    /** Would this spend fit every limit? The reason names the first it does not. */
+    /** Would this spend fit every limit, given what every process has written so far? The reason names the first limit it does not. */
     check(input, limits, nowMs = Date.now()) {
+        this.sync();
+        return this.evaluate(input, limits, nowMs);
+    }
+    evaluate(input, limits, nowMs) {
         if (this.integrity)
             return { ok: false, reason: `The ledger at ${this.path} is not intact (${this.integrity}); every spend is refused until the operator has looked at it.` };
         const amount18 = rawToUnits(input.raw, input.decimals);
         if (input.asset === '') {
-            const r = refusal(limits.native, this.spentNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
+            const r = refusal(limits.native, this.sumNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
             if (r)
                 return { ok: false, reason: r };
         }
@@ -142,33 +231,51 @@ export class Ledger {
         }
         if (input.usd !== null) {
             const usd18 = units(input.usd);
-            const r = refusal(limits.usd, this.spentUsd(nowMs), usd18, 'budget');
+            const r = refusal(limits.usd, this.sumUsd(nowMs), usd18, 'budget');
             if (r)
                 return { ok: false, reason: r };
             if (limits.host && input.host) {
-                const h = refusal({ daily: limits.host.daily, monthly: limits.host.monthly }, this.spentUsd(nowMs, input.host), usd18, `per_host["${limits.host.pattern}"]`);
+                const h = refusal({ daily: limits.host.daily, monthly: limits.host.monthly }, this.sumUsd(nowMs, input.host), usd18, `per_host["${limits.host.pattern}"]`);
                 if (h)
                     return { ok: false, reason: h };
             }
         }
         return { ok: true };
     }
-    /** Check and record in one synchronous step. Returns the spend's seq. */
+    /** Re-read, check and record in one step under the lock. Returns the spend's seq. */
     reserve(input, limits) {
-        const c = this.check(input, limits);
-        if (!c.ok)
-            throw new Error(c.reason);
-        const amount = human(rawToUnits(input.raw, input.decimals));
-        const e = this.append({
-            kind: 'spend', tool: input.tool, mode: input.mode, wallet: input.wallet, chain_id: input.chainId, asset: input.asset, asset_label: input.assetLabel,
-            amount, raw: input.raw, usd: input.usd, to: input.to, host: input.host, resource: input.resource, method: input.method, proof: input.proof ?? null,
-        });
-        return e.seq;
+        const unlock = this.lock();
+        try {
+            this.sync();
+            const c = this.evaluate(input, limits, Date.now());
+            if (!c.ok)
+                throw new Error(c.reason);
+            const amount = human(rawToUnits(input.raw, input.decimals));
+            const e = this.append({
+                kind: 'spend', tool: input.tool, mode: input.mode, wallet: input.wallet, chain_id: input.chainId, asset: input.asset, asset_label: input.assetLabel,
+                amount, raw: input.raw, usd: input.usd, to: input.to, host: input.host, resource: input.resource, method: input.method, proof: input.proof ?? null,
+            });
+            return e.seq;
+        }
+        finally {
+            unlock();
+        }
+    }
+    /** A follow-up line, written under the lock after a fresh read so it chains onto whatever any process wrote last. */
+    follow(body) {
+        const unlock = this.lock();
+        try {
+            this.sync();
+            this.append(body);
+        }
+        finally {
+            unlock();
+        }
     }
     /** The spend never happened (signing or broadcast failed before anything left this process). */
     void(ref, detail) {
         try {
-            this.append({ kind: 'void', ref, outcome: 'void', detail: detail.slice(0, 300) });
+            this.follow({ kind: 'void', ref, outcome: 'void', detail: detail.slice(0, 300) });
         }
         catch (e) {
             console.error(`[agentwallet] ledger void failed: ${e.message}`);
@@ -177,15 +284,16 @@ export class Ledger {
     /** What the endpoint or chain said afterwards. Never throws: the payment already happened. */
     settle(ref, outcome, detail) {
         try {
-            this.append({ kind: 'settle', ref, outcome: outcome.slice(0, 40), detail: detail ? detail.slice(0, 300) : null });
+            this.follow({ kind: 'settle', ref, outcome: outcome.slice(0, 40), detail: detail ? detail.slice(0, 300) : null });
         }
         catch (e) {
             console.error(`[agentwallet] ledger settle failed: ${e.message}`);
         }
     }
-    size() { return this.entries.length; }
-    /** Spends newest first with their latest follow-up folded in. */
+    size() { this.sync(); return this.entries.length; }
+    /** Spends newest first with their latest follow-up folded in, from a fresh read. */
     payments(opts) {
+        this.sync();
         const follow = new Map();
         for (const e of this.entries)
             if (e.kind !== 'spend')

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.1",
+  "version": "1.14.2",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",