agentwallet-mcp 1.14.1 → 1.14.3

package/README.md

@@ -384,7 +384,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. On startup the chain is verified, and a ledger that does not verify refuses every spend until the operator has looked at it. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, is always voided and never consumes budget. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -34,6 +34,7 @@ import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalanc
 import { localSimulate } from './local-wallet.js';
 import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
+import { markMaybeLive, isMaybeLive, carryMaybeLive, connectionNeverMade } from './maybe-live.js';
 import { discover } from './discovery.js';
 /* `agentwallet-mcp encrypt-keyfile <in> <out>` runs the keyfile tool instead of the server. */
 if (process.argv[2] === 'encrypt-keyfile') {
@@ -444,12 +445,16 @@ async function api(path, method = 'GET', body, extraHeaders) {
         delete extraHeaders['X-AGW-CTX'];
     }
     let reserved = null;
-    const m = /^\/wallets\/([^/]+)\/send(\?|$)/.exec(path);
-    if (method === 'POST' && m && body) {
+    // /sign with a transaction body is the same spend as /send: the caller gets
+    // a broadcast-ready raw transaction (2026-10-14 report, 1.14.2). A message
+    // signature (body.message) moves nothing and is not gated.
+    const m = /^\/wallets\/([^/]+)\/(send|sign)(\?|$)/.exec(path);
+    const signsTx = m !== null && (m[2] === 'send' || typeof body?.message !== 'string');
+    if (method === 'POST' && m && body && signsTx) {
         const chainId = localChainId(body, new URLSearchParams(path.split('?')[1] || ''));
         const d = await describeSend(body, chainId);
         assertSendTarget(d, chainId);
-        const input = spendInputOf(d, chainId, ctx.tool || 'send', m[1], ctx);
+        const input = spendInputOf(d, chainId, ctx.tool || (m[2] === 'sign' ? 'sign_transaction' : 'send'), m[1], ctx);
         if (input)
             reserved = reserveSpend(input);
     }
@@ -457,15 +462,23 @@ async function api(path, method = 'GET', body, extraHeaders) {
         const out = await apiInner(path, method, body, extraHeaders);
         if (reserved !== null) {
             const r = out;
-            LEDGER.settle(reserved, 'broadcast', typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : null);
+            if (m[2] === 'sign')
+                LEDGER.settle(reserved, 'signed', 'raw transaction returned to the caller; not broadcast by this process, so it stays counted');
+            else
+                LEDGER.settle(reserved, 'broadcast', typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : null);
         }
         return out;
     }
     catch (e) {
-        // A send that may already be on the wire stays counted; only a spend that never left this process is voided.
+        // A send that may already be on the wire stays counted; only a spend that
+        // never left this process is voided. The signers mark the former on the
+        // error object (markMaybeLive); the decision used to be a regex over the
+        // message and the word "broadcasts" in the local-mode refusal of
+        // transaction signing made every refused sign_transaction consume the
+        // budget for good (reported privately 2026-10-16, 1.14.3).
         if (reserved !== null) {
             const msg = e.message;
-            if (/BROADCAST|MAY be live/i.test(msg))
+            if (isMaybeLive(e))
                 LEDGER.settle(reserved, 'unknown', msg);
             else
                 LEDGER.void(reserved, msg);
@@ -483,7 +496,7 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
             handled = await routeLocally(path, method, body);
         }
         catch (e) {
-            throw new Error(redactRpcSecrets(e)); // viem puts the RPC URL, key and all, in its messages
+            throw carryMaybeLive(e, new Error(redactRpcSecrets(e))); // viem puts the RPC URL, key and all, in its messages; the may-be-live marker rides along
         }
         if (handled !== NOT_HANDLED)
             return handled;
@@ -505,7 +518,23 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
     if (body && method !== 'GET') {
         options.body = JSON.stringify(body);
     }
-    const res = await fetch(url, options);
+    // Hosted mode: a connection that was never made (refused, unresolvable,
+    // TLS rejected) carried nothing to the host, so a reserved spend is voided.
+    // A timeout waiting for the answer or a reset mid-request may have reached
+    // the custodian, which may have signed and broadcast; a spend there stays
+    // counted (1.14.3).
+    let res;
+    try {
+        res = await fetch(url, options);
+    }
+    catch (e) {
+        if (method === 'POST' && /^\/wallets\/[^/]+\/(send|sign)(\?|$)/.test(path) && !connectionNeverMade(e)) {
+            const cause = e.cause;
+            const why = e?.name === 'TimeoutError' ? `no answer within ${API_TIMEOUT_MS / 1000} s` : (cause?.code || cause?.message || e?.message || 'connection failed');
+            throw markMaybeLive(new Error(`The AgentWallet API host did not answer ${path} (${why}). The request may have reached it, so a transaction may be live; check the wallet's history before retrying.`));
+        }
+        throw e;
+    }
     if (res.status >= 300 && res.status < 400) {
         throw new Error(`The AgentWallet API host answered ${path} with a redirect (HTTP ${res.status}); refusing to follow it.`);
     }
@@ -515,7 +544,9 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
         data = JSON.parse(text);
     }
     catch {
-        throw new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
+        // A 2xx the host did not phrase as JSON may still have been a completed send; counted, not voided (1.14.3).
+        const err = new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
+        throw res.ok && method === 'POST' ? markMaybeLive(err) : err;
     }
     data = boundHostData(data, 0); // strings, arrays and depth bounded; the host writes none of the agent's instructions
     // A 402 from the API host is paid automatically only for a HOSTED wallet the
@@ -545,7 +576,8 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
     if (method === 'POST' && /^\/wallets\/[^/]+\/send(\?|$)/.test(path) && data && typeof data === 'object') {
         const d = data;
         if (!looksLikeTxHash(d.tx_hash) && !(typeof d.signature === 'string' && /^[1-9A-HJ-NP-Za-km-z]{43,120}$/.test(d.signature))) {
-            throw new Error('The AgentWallet API host answered the send without a transaction hash or signature; treating it as not sent.');
+            // The agent is told it was not sent (no hash to act on); the ledger keeps it counted because the host may disagree (1.14.3).
+            throw markMaybeLive(new Error('The AgentWallet API host answered the send without a transaction hash or signature; treating it as not sent.'));
         }
     }
     // The marker comes FIRST so a truncated result still carries it, and an
@@ -1111,7 +1143,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.1',
+    version: '1.14.3',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1225,7 +1257,8 @@ tool('get_balance', 'Get the native token balance for a wallet on a specific cha
 // ─── Tool: sign_transaction ──────────────────────────────────────
 tool('sign_transaction', 'Sign a transaction with a wallet\'s private key. ' +
     'For EVM: returns signed raw transaction hex. For Solana: returns base64 signed transaction. ' +
-    'Does NOT broadcast — use send_transaction for sign + broadcast.', {
+    'Does NOT broadcast. Use send_transaction for sign + broadcast. ' +
+    'A signed transaction is a spend: under a spend policy it is checked, reserved on the ledger and counted against the budgets exactly as send_transaction is, because the caller can broadcast it.', {
     wallet_id: z.number().int().describe('Wallet ID'),
     to: AddressSchema.describe('Destination address (0x-prefixed for EVM, Base58 for Solana)'),
     chain_id: z.number().int().optional().describe('Chain ID (defaults to wallet\'s default)'),

package/build/ledger.d.ts

@@ -76,42 +76,59 @@ export interface Limits {
     } | null;
     unpriced: 'refuse' | 'allow';
 }
+export interface LedgerOptions {
+    /** Tests shorten the wait for a held lock. */
+    lockWaitMs?: number;
+}
 export declare class Ledger {
     readonly path: string | null;
     private entries;
     private last;
     private seq;
-    /** null = intact; otherwise what broke. */
+    /** null = intact; otherwise what broke. Refreshed from the file on every read. */
     integrity: string | null;
     private webhook;
+    private lockWaitMs;
     constructor(path: string | null, webhook?: {
         url: string;
         secret: string;
-    } | null);
-    private load;
+    } | null, opts?: LedgerOptions);
+    /**
+     * Re-read the file so the sums include what every other process wrote.
+     * The file must still begin with what this process has seen, line for
+     * line; otherwise it was rewritten underneath us and nothing is adopted.
+     */
+    private sync;
+    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    private lock;
     private append;
     private notify;
     /** Spends not voided, newest last. */
     private liveSpends;
-    /** Dollar sums over rolling windows; nowMs for tests. */
+    /** Dollar sums over rolling windows from a fresh read of the file; nowMs for tests. */
     spentUsd(nowMs?: number, host?: string): Spent;
     spentNative(chainId: number, nowMs?: number): Spent;
+    private sumUsd;
+    private sumNative;
     private sum;
-    /** Would this spend fit every limit? The reason names the first it does not. */
+    /** Would this spend fit every limit, given what every process has written so far? The reason names the first limit it does not. */
     check(input: ReserveInput, limits: Limits, nowMs?: number): {
         ok: true;
     } | {
         ok: false;
         reason: string;
     };
-    /** Check and record in one synchronous step. Returns the spend's seq. */
+    private evaluate;
+    /** Re-read, check and record in one step under the lock. Returns the spend's seq. */
     reserve(input: ReserveInput, limits: Limits): number;
+    /** A follow-up line, written under the lock after a fresh read so it chains onto whatever any process wrote last. */
+    private follow;
     /** The spend never happened (signing or broadcast failed before anything left this process). */
     void(ref: number, detail: string): void;
     /** What the endpoint or chain said afterwards. Never throws: the payment already happened. */
     settle(ref: number, outcome: string, detail: string | null): void;
     size(): number;
-    /** Spends newest first with their latest follow-up folded in. */
+    /** Spends newest first with their latest follow-up folded in, from a fresh read. */
     payments(opts: {
         limit: number;
         host?: string;

package/build/ledger.js

@@ -3,69 +3,146 @@
  * process reserved, and what became of it.
  *
  * Budgets are enforced from it, so a reservation is written BEFORE the
- * signature exists: check and append happen in one synchronous step, which in
- * a single-threaded process means two concurrent calls cannot both fit the
- * last dollar. A reservation whose signing fails is voided by a later line;
- * the spend line itself is never edited, so the chain stays verifiable.
+ * signature exists. Check and append happen in one step under an exclusive
+ * lock file, after the file has been re-read and the chain re-verified, so
+ * two concurrent calls cannot both fit the last dollar, whether they come
+ * from one process or from several agentwallet-mcp processes sharing the
+ * file (two MCP clients configured with the same wallet and ledger). A
+ * reservation whose signing fails is voided by a later line; the spend line
+ * itself is never edited, so the chain stays verifiable.
  *
  * Each line carries the sha256 of the previous line's hash plus its own body.
- * On load the chain is verified; a broken chain with a budget configured
- * refuses every spend until the operator looks at the file.
+ * The chain is verified on every read; a broken chain with a budget
+ * configured refuses every spend until the operator looks at the file, and a
+ * file that no longer holds what this process wrote is refused the same way.
  */
-import { appendFileSync, existsSync, readFileSync, openSync, closeSync } from 'node:fs';
+import { appendFileSync, existsSync, readFileSync, openSync, closeSync, writeSync, unlinkSync, statSync } from 'node:fs';
 import { createHash, createHmac } from 'node:crypto';
 import { DAY_MS, MONTH_MS, units, rawToUnits, human } from './policy.js';
 const GENESIS = '0'.repeat(64);
 const MAX_LINE = 16 * 1024;
+/** How long a spend waits for another process to finish its own check-and-append. */
+const LOCK_WAIT_MS = 10_000;
+/** A lock older than this was left by a process that died holding it. */
+const LOCK_STALE_MS = 30_000;
+const sleeper = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) { Atomics.wait(sleeper, 0, 0, ms); }
 function hashOf(prev, body) {
     return createHash('sha256').update(prev + '\n' + JSON.stringify(body)).digest('hex');
 }
+/** Parse and verify a ledger file's text. A trailing line without its newline is still being written by another process and is not read. */
+function parseChain(text) {
+    const complete = text.endsWith('\n') || !text.includes('\n') && text.trim() === '' ? text : text.slice(0, text.lastIndexOf('\n') + 1);
+    const lines = complete.split('\n').filter(l => l.trim());
+    const out = { entries: [], last: GENESIS, seq: 0, integrity: null };
+    let prev = GENESIS;
+    for (let i = 0; i < lines.length; i++) {
+        let e;
+        try {
+            e = JSON.parse(lines[i]);
+        }
+        catch {
+            out.integrity = `line ${i + 1} is not JSON`;
+            break;
+        }
+        const { hash, ...body } = e;
+        if (e.prev !== prev || hashOf(prev, body) !== hash) {
+            out.integrity = `chain broken at line ${i + 1} (seq ${e.seq})`;
+            break;
+        }
+        if (e.seq !== out.seq + 1) {
+            out.integrity = `sequence gap at line ${i + 1}`;
+            break;
+        }
+        out.entries.push(e);
+        out.seq = e.seq;
+        prev = hash;
+    }
+    out.last = prev;
+    return out;
+}
 export class Ledger {
     path;
     entries = [];
     last = GENESIS;
     seq = 0;
-    /** null = intact; otherwise what broke. */
+    /** null = intact; otherwise what broke. Refreshed from the file on every read. */
     integrity = null;
     webhook = null;
-    constructor(path, webhook) {
+    lockWaitMs = LOCK_WAIT_MS;
+    constructor(path, webhook, opts) {
         this.path = path;
         this.webhook = webhook ?? null;
-        if (path)
-            this.load();
+        if (opts?.lockWaitMs !== undefined)
+            this.lockWaitMs = opts.lockWaitMs;
+        if (path) {
+            // Create it now so a permissions problem shows at startup, not at the first spend.
+            if (!existsSync(path))
+                closeSync(openSync(path, 'a', 0o600));
+            this.sync();
+        }
     }
-    load() {
+    /**
+     * Re-read the file so the sums include what every other process wrote.
+     * The file must still begin with what this process has seen, line for
+     * line; otherwise it was rewritten underneath us and nothing is adopted.
+     */
+    sync() {
+        if (!this.path)
+            return;
         if (!existsSync(this.path)) {
-            // Create it now so a permissions problem shows at startup, not at the first spend.
-            closeSync(openSync(this.path, 'a', 0o600));
+            this.integrity = `the file was removed while this process was running (it held seq ${this.seq})`;
             return;
         }
-        const text = readFileSync(this.path, 'utf8');
-        const lines = text.split('\n').filter(l => l.trim());
-        let prev = GENESIS;
-        for (let i = 0; i < lines.length; i++) {
-            let e;
+        const c = parseChain(readFileSync(this.path, 'utf8'));
+        const n = this.entries.length;
+        if (c.entries.length < n || (n > 0 && c.entries[n - 1].hash !== this.last)) {
+            this.integrity = c.integrity && c.entries.length < n ? c.integrity : `the file was rewritten underneath this process (it held seq ${this.seq} ending ${this.last.slice(0, 12)}, the file now ends at seq ${c.seq})`;
+            return;
+        }
+        this.entries = c.entries;
+        this.seq = c.seq;
+        this.last = c.last;
+        this.integrity = c.integrity;
+    }
+    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    lock() {
+        if (!this.path)
+            return () => { };
+        const lockPath = this.path + '.lock';
+        const deadline = Date.now() + this.lockWaitMs;
+        for (;;) {
             try {
-                e = JSON.parse(lines[i]);
+                const fd = openSync(lockPath, 'wx', 0o600);
+                try {
+                    writeSync(fd, `${process.pid} ${new Date().toISOString()}\n`);
+                }
+                finally {
+                    closeSync(fd);
+                }
+                return () => { try {
+                    unlinkSync(lockPath);
+                }
+                catch { /* already gone */ } };
             }
-            catch {
-                this.integrity = `line ${i + 1} is not JSON`;
-                break;
+            catch (e) {
+                if (e.code !== 'EEXIST')
+                    throw e;
             }
-            const { hash, ...body } = e;
-            if (e.prev !== prev || hashOf(prev, body) !== hash) {
-                this.integrity = `chain broken at line ${i + 1} (seq ${e.seq})`;
-                break;
+            try {
+                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+                    unlinkSync(lockPath);
+                    continue;
+                }
+            }
+            catch {
+                continue; /* released between the two calls */
             }
-            if (e.seq !== this.seq + 1) {
-                this.integrity = `sequence gap at line ${i + 1}`;
-                break;
+            if (Date.now() >= deadline) {
+                throw new Error(`The ledger at ${this.path} is locked by another agentwallet-mcp process (${lockPath}) that did not finish within ${this.lockWaitMs} ms. Nothing was signed. If no other process is running, remove the lock file.`);
             }
-            this.entries.push(e);
-            this.seq = e.seq;
-            prev = hash;
+            sleepSync(5);
         }
-        this.last = prev;
     }
     append(body) {
         if (this.integrity)
@@ -103,11 +180,19 @@ export class Ledger {
         const voided = new Set(this.entries.filter(e => e.kind === 'void').map(e => e.ref));
         return this.entries.filter((e) => e.kind === 'spend' && !voided.has(e.seq));
     }
-    /** Dollar sums over rolling windows; nowMs for tests. */
+    /** Dollar sums over rolling windows from a fresh read of the file; nowMs for tests. */
     spentUsd(nowMs = Date.now(), host) {
-        return this.sum(nowMs, e => (host === undefined || e.host === host) && e.usd !== null ? units(e.usd) : 0n);
+        this.sync();
+        return this.sumUsd(nowMs, host);
     }
     spentNative(chainId, nowMs = Date.now()) {
+        this.sync();
+        return this.sumNative(chainId, nowMs);
+    }
+    sumUsd(nowMs, host) {
+        return this.sum(nowMs, e => (host === undefined || e.host === host) && e.usd !== null ? units(e.usd) : 0n);
+    }
+    sumNative(chainId, nowMs) {
         return this.sum(nowMs, e => e.chain_id === chainId && e.asset === '' ? rawToUnits(e.raw, nativeDecimalsOf(chainId)) : 0n);
     }
     sum(nowMs, f) {
@@ -125,13 +210,17 @@ export class Ledger {
         }
         return out;
     }
-    /** Would this spend fit every limit? The reason names the first it does not. */
+    /** Would this spend fit every limit, given what every process has written so far? The reason names the first limit it does not. */
     check(input, limits, nowMs = Date.now()) {
+        this.sync();
+        return this.evaluate(input, limits, nowMs);
+    }
+    evaluate(input, limits, nowMs) {
         if (this.integrity)
             return { ok: false, reason: `The ledger at ${this.path} is not intact (${this.integrity}); every spend is refused until the operator has looked at it.` };
         const amount18 = rawToUnits(input.raw, input.decimals);
         if (input.asset === '') {
-            const r = refusal(limits.native, this.spentNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
+            const r = refusal(limits.native, this.sumNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
             if (r)
                 return { ok: false, reason: r };
         }
@@ -142,33 +231,51 @@ export class Ledger {
         }
         if (input.usd !== null) {
             const usd18 = units(input.usd);
-            const r = refusal(limits.usd, this.spentUsd(nowMs), usd18, 'budget');
+            const r = refusal(limits.usd, this.sumUsd(nowMs), usd18, 'budget');
             if (r)
                 return { ok: false, reason: r };
             if (limits.host && input.host) {
-                const h = refusal({ daily: limits.host.daily, monthly: limits.host.monthly }, this.spentUsd(nowMs, input.host), usd18, `per_host["${limits.host.pattern}"]`);
+                const h = refusal({ daily: limits.host.daily, monthly: limits.host.monthly }, this.sumUsd(nowMs, input.host), usd18, `per_host["${limits.host.pattern}"]`);
                 if (h)
                     return { ok: false, reason: h };
             }
         }
         return { ok: true };
     }
-    /** Check and record in one synchronous step. Returns the spend's seq. */
+    /** Re-read, check and record in one step under the lock. Returns the spend's seq. */
     reserve(input, limits) {
-        const c = this.check(input, limits);
-        if (!c.ok)
-            throw new Error(c.reason);
-        const amount = human(rawToUnits(input.raw, input.decimals));
-        const e = this.append({
-            kind: 'spend', tool: input.tool, mode: input.mode, wallet: input.wallet, chain_id: input.chainId, asset: input.asset, asset_label: input.assetLabel,
-            amount, raw: input.raw, usd: input.usd, to: input.to, host: input.host, resource: input.resource, method: input.method, proof: input.proof ?? null,
-        });
-        return e.seq;
+        const unlock = this.lock();
+        try {
+            this.sync();
+            const c = this.evaluate(input, limits, Date.now());
+            if (!c.ok)
+                throw new Error(c.reason);
+            const amount = human(rawToUnits(input.raw, input.decimals));
+            const e = this.append({
+                kind: 'spend', tool: input.tool, mode: input.mode, wallet: input.wallet, chain_id: input.chainId, asset: input.asset, asset_label: input.assetLabel,
+                amount, raw: input.raw, usd: input.usd, to: input.to, host: input.host, resource: input.resource, method: input.method, proof: input.proof ?? null,
+            });
+            return e.seq;
+        }
+        finally {
+            unlock();
+        }
+    }
+    /** A follow-up line, written under the lock after a fresh read so it chains onto whatever any process wrote last. */
+    follow(body) {
+        const unlock = this.lock();
+        try {
+            this.sync();
+            this.append(body);
+        }
+        finally {
+            unlock();
+        }
     }
     /** The spend never happened (signing or broadcast failed before anything left this process). */
     void(ref, detail) {
         try {
-            this.append({ kind: 'void', ref, outcome: 'void', detail: detail.slice(0, 300) });
+            this.follow({ kind: 'void', ref, outcome: 'void', detail: detail.slice(0, 300) });
         }
         catch (e) {
             console.error(`[agentwallet] ledger void failed: ${e.message}`);
@@ -177,15 +284,16 @@ export class Ledger {
     /** What the endpoint or chain said afterwards. Never throws: the payment already happened. */
     settle(ref, outcome, detail) {
         try {
-            this.append({ kind: 'settle', ref, outcome: outcome.slice(0, 40), detail: detail ? detail.slice(0, 300) : null });
+            this.follow({ kind: 'settle', ref, outcome: outcome.slice(0, 40), detail: detail ? detail.slice(0, 300) : null });
         }
         catch (e) {
             console.error(`[agentwallet] ledger settle failed: ${e.message}`);
         }
     }
-    size() { return this.entries.length; }
-    /** Spends newest first with their latest follow-up folded in. */
+    size() { this.sync(); return this.entries.length; }
+    /** Spends newest first with their latest follow-up folded in, from a fresh read. */
     payments(opts) {
+        this.sync();
         const follow = new Map();
         for (const e of this.entries)
             if (e.kind !== 'spend')

package/build/local-solana.js

@@ -16,6 +16,7 @@ import { Connection, Keypair, PublicKey, SystemProgram, Transaction, Transaction
 import bs58 from 'bs58';
 import { lookupTrustedDecimals } from './x402-payment.js';
 import { openKeyfile } from './keyfile.js';
+import { markMaybeLive, isMaybeLive } from './maybe-live.js';
 /* ── Program IDs ─────────────────────────────────────────────────── */
 const TOKEN_PROGRAM = new PublicKey('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
 const TOKEN_2022_PROGRAM = new PublicKey('TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb');
@@ -244,7 +245,8 @@ async function sendSigned(conn, tx, payer) {
         throw new Error('The transaction could not be signed.');
     const local = bs58.encode(tx.signature);
     const reported = await conn.sendRawTransaction(tx.serialize());
-    const after = (what) => new Error(`Transaction ${local} was BROADCAST but ${what}. Check it on an explorer before retrying: a retry is a second transfer.`);
+    // Marked, not worded: the ledger keeps the spend counted because of the marker, never because of the text (1.14.3).
+    const after = (what) => markMaybeLive(new Error(`Transaction ${local} was BROADCAST but ${what}. Check it on an explorer before retrying: a retry is a second transfer.`));
     if (reported !== local)
         throw after(`the RPC answered with a different signature (${String(reported).slice(0, 90)}), so the node cannot be trusted about its fate`);
     const confirm = conn.confirmTransaction({ signature: local, blockhash, lastValidBlockHeight }, 'confirmed');
@@ -254,7 +256,7 @@ async function sendSigned(conn, tx, payer) {
         result = await Promise.race([confirm, timeout]);
     }
     catch (e) {
-        if (e instanceof Error && /was BROADCAST/.test(e.message))
+        if (isMaybeLive(e))
             throw e;
         throw after(`confirmation failed: ${e instanceof Error ? e.message : JSON.stringify(e)}`);
     }

package/build/local-wallet.js

@@ -23,6 +23,7 @@ import { wrappedNativeAddress } from './wrapped-native.js';
 import { typedDataFor } from './x402-eip3009.js';
 import { uptoTypedData } from './x402-permit2.js';
 import { openKeyfile } from './keyfile.js';
+import { markMaybeLive } from './maybe-live.js';
 /* ── Key loading ─────────────────────────────────────────────────── */
 /**
  * Read the key once at startup. Kept module-private: nothing exports the key
@@ -552,10 +553,11 @@ export async function localSend(chainId, to, valueWei, data, fees) {
     }
     catch (e) {
         account.nonceManager.reset({ address, chainId });
-        throw new Error(`Broadcast of transaction ${localHash} (nonce ${nonce}) failed: ${e.message.split('\n')[0]}. The transaction is signed and MAY be live if the node forwarded it before answering; check the hash on an explorer before retrying.`);
+        // Marked, not worded: the ledger keeps this spend counted because of the marker, never because of the text (1.14.3).
+        throw markMaybeLive(new Error(`Broadcast of transaction ${localHash} (nonce ${nonce}) failed: ${e.message.split('\n')[0]}. The transaction is signed and MAY be live if the node forwarded it before answering; check the hash on an explorer before retrying.`));
     }
     if (reported.toLowerCase() !== localHash.toLowerCase()) {
-        throw new Error(`Transaction ${localHash} (nonce ${nonce}) was BROADCAST, but the node answered with a different hash (${String(reported).slice(0, 80)}), so it cannot be trusted about its fate. Verify ${localHash} on an explorer before retrying.`);
+        throw markMaybeLive(new Error(`Transaction ${localHash} (nonce ${nonce}) was BROADCAST, but the node answered with a different hash (${String(reported).slice(0, 80)}), so it cannot be trusted about its fate. Verify ${localHash} on an explorer before retrying.`));
     }
     return {
         tx_hash: localHash,

package/build/maybe-live.d.ts

@@ -0,0 +1,13 @@
+/** Mark `err` as thrown after the transaction may have gone out. Returns it. */
+export declare function markMaybeLive<T extends object>(err: T): T;
+/** Was this error thrown after the transaction may have gone out? */
+export declare function isMaybeLive(err: unknown): boolean;
+/** Copy the marker from `from` onto `to` (for errors re-thrown with a redacted message). */
+export declare function carryMaybeLive<T extends object>(from: unknown, to: T): T;
+/**
+ * A fetch() rejection whose cause says the connection was never made: nothing
+ * reached the host, so a reserved spend can be voided. Anything else (a timeout
+ * waiting for the answer, a reset mid-request, an unknown cause) may have
+ * reached the host, and a send there is treated as possibly live.
+ */
+export declare function connectionNeverMade(err: unknown): boolean;

package/build/maybe-live.js

@@ -0,0 +1,48 @@
+/**
+ * Marks an error thrown after a transaction may already have left this
+ * process, so the ledger keeps the reservation counted instead of voiding it.
+ *
+ * The decision used to be a regex over the error text (/BROADCAST|MAY be live/i)
+ * and misfired on any message that merely contained the word "broadcasts",
+ * including the local-mode refusal of transaction signing, so every refused
+ * sign_transaction consumed the budget for good (reported privately, 2026-10-16,
+ * fixed in 1.14.3). A marker on the error object cannot misfire on wording.
+ *
+ * Symbol.for so the marker survives a duplicated module in the bundle; a plain
+ * `instanceof` would not.
+ */
+const MARK = Symbol.for('agentwallet.maybeLive');
+/** Mark `err` as thrown after the transaction may have gone out. Returns it. */
+export function markMaybeLive(err) {
+    err[MARK] = true;
+    return err;
+}
+/** Was this error thrown after the transaction may have gone out? */
+export function isMaybeLive(err) {
+    return typeof err === 'object' && err !== null && err[MARK] === true;
+}
+/** Copy the marker from `from` onto `to` (for errors re-thrown with a redacted message). */
+export function carryMaybeLive(from, to) {
+    return isMaybeLive(from) ? markMaybeLive(to) : to;
+}
+/**
+ * A fetch() rejection whose cause says the connection was never made: nothing
+ * reached the host, so a reserved spend can be voided. Anything else (a timeout
+ * waiting for the answer, a reset mid-request, an unknown cause) may have
+ * reached the host, and a send there is treated as possibly live.
+ */
+export function connectionNeverMade(err) {
+    const e = err;
+    const code = e?.cause?.code ?? '';
+    // fetch() refuses some requests before opening a socket (a blocked port such
+    // as 1, an unsupported scheme, a URL it will not parse); undici reports those
+    // as "fetch failed" with a bare-message cause and no errno.
+    if (!code && /^(bad port|invalid url|unsupported scheme|unknown scheme|url scheme ".*" is not supported|fetch failed)$/i.test(e?.cause?.message ?? ''))
+        return true;
+    if (/^(ECONNREFUSED|ENOTFOUND|EAI_AGAIN|EHOSTUNREACH|ENETUNREACH|EADDRNOTAVAIL|UND_ERR_CONNECT_TIMEOUT|ERR_TLS_CERT_ALTNAME_INVALID|CERT_HAS_EXPIRED|DEPTH_ZERO_SELF_SIGNED_CERT|SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_VERIFY_LEAF_SIGNATURE|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|ERR_INVALID_URL)$/.test(code))
+        return true;
+    // Node's own TLS errors arrive as the cause with a name and no errno code.
+    if (/^(ERR_TLS_|ERR_SSL_)/.test(code))
+        return true;
+    return false;
+}

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.1",
+  "version": "1.14.3",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",