agentwallet-mcp 1.14.10 → 1.14.12

package/README.md

@@ -369,6 +369,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
   "per_host": { "*.example.com": { "daily": "2", "per_payment": "0.25" } },
   "recipients": { "deny": ["0x0000000000000000000000000000000000000000"] },
   "chains": { "allow": [8453, 900] },
+  "contracts": { "allow": ["8453:0x2626664c2603336E57B271c5C0b26F421741e481"] },
   "approval": { "above": "0.50", "max": "20" },
   "tools": { "allow": ["pay_x402", "quote_x402", "discover_x402", "get_balance", "list_payments", "spend_policy", "wallet_mode"] }
 }
@@ -376,16 +377,17 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
 - **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers, native x402 payments and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it). The dollar budget has no price for the chain's coin, so on a chain with no `native_budget` entry a native spend is an unpriced spend: refused while a `budget` or a `per_host` ceiling is set, unless `"unpriced_spends": "allow"`. Give every chain the wallet spends on an entry.
-- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `increaseApproval`, either `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`, EIP-6909 `setOperator`) is unbounded by construction and refused the same way. Every token mover the standards define is a spend to its recipient: ERC-20 `transfer` and `transferFrom`, the ERC-677 and ERC-1363 `transferAndCall` and `transferFromAndCall` shapes, the ERC-223 `transfer` with data, ERC-777 `send` and `operatorSend`, and the ERC-721, ERC-1155 and EIP-6909 transfers, which no budget can price and so are refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A redemption of the wallet's own position is a spend too: ERC-4626 `redeem` and `withdraw` are spends of the vault to the receiver (unpriced, like an NFT), and Aave `Pool.withdraw` is a transfer of the underlying to the receiver. A zero-value call to any other contract (a router, a bridge, a protocol whose payout shape is not listed here) reserves nothing: it can only pull what an approval already granted, or pay out a position in a shape the policy does not know, so a policy that holds positions elsewhere should set `recipients.allow`. The exception is Permit2 itself: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy, since each moves tokens or changes what may be moved.
+- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `increaseApproval`, either `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`, EIP-6909 `setOperator`) is unbounded by construction and refused the same way. Every token mover the standards define is a spend to its recipient: ERC-20 `transfer` and `transferFrom`, the ERC-677 and ERC-1363 `transferAndCall` and `transferFromAndCall` shapes, the ERC-223 `transfer` with data, ERC-777 `send` and `operatorSend`, and the ERC-721, ERC-1155 and EIP-6909 transfers, which no budget can price and so are refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A redemption of the wallet's own position is a spend too: ERC-4626 `redeem` and `withdraw` are spends of the vault to the receiver (unpriced, like an NFT), and Aave `Pool.withdraw` is a transfer of the underlying to the receiver. A call to any other contract (a router, a bridge, a protocol whose payout shape is not listed here) is refused under a policy unless the contract is in `contracts.allow` or `unknown_calls` is `"allow"`, since 1.14.11: the policy cannot tell what such a call moves, so the operator decides which contracts may receive one. A listed contract's unpriced call reserves nothing beyond the native value it carries: it can only pull what an approval already granted, or pay out a position in a shape the policy does not know, so a policy that lists protocol contracts should set `recipients.allow` too. Permit2 is never admitted this way: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy whatever the lists say, since each moves tokens or changes what may be moved.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
-- **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
+- **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a call is aimed at (a token being approved, a router) is checked against the deny list, the chain list and the `contracts` lists.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.
+- **`contracts`**, **`unknown_calls`**: what the wallet may call with calldata the policy cannot price. The policy prices the token movers, approvals, permits and redemptions listed under "Approvals are spends" below; any other calldata (a swap, a bridge, a protocol call) is refused under a policy unless the contract is in `contracts.allow` (entries scoped `"8453:0x..."` or bare), because a shape the policy does not know could be moving anything. `"unknown_calls": "allow"` restores the pre-1.14.11 behaviour of passing such calls as zero-value contract calls, with their native value still counted. `contracts.deny` refuses every call to a contract, priced or not. Without a policy nothing is refused on this ground.
 - **`approval`**: above `above`, every x402 payment is put to the human at the MCP client through [elicitation](https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation) (the client shows the amount, token, recipient and resource and asks yes or no; a client that declared no elicitation support cannot answer, so the payment is refused). In local mode an accepted answer may admit a payment above the per-payment cap, up to `max`. Budgets are never lifted by anyone's approval.
 - **`tools`**: the tools the model sees. A payer-only deployment exposes seven; the rest are not registered. `wallet_mode` and `spend_policy` are always present so the operator can see what the server is.
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped or answered with a 5xx, any host answer that carries a transaction hash) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, or a 4xx refusal from the host, is always voided and never consumes budget. A hosted send is forwarded with the chain the policy priced it on (`chain_id`, else `AGENTWALLET_CHAIN_ID`, else 8453), and a custodian answer naming another chain is written onto the ledger line as a mismatch. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped or answered with a 5xx, any host answer that carries a transaction hash) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, or a 4xx refusal from the host, is always voided and never consumes budget. A hosted send is forwarded with the chain the policy priced it on (`chain_id`, else `AGENTWALLET_CHAIN_ID`, else 8453), and a custodian answer naming another chain is written onto the ledger line as a mismatch. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process and reclaimed in one step through `<ledger>.lock.reclaim`, and a release removes only the lock it took. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -28,13 +28,13 @@ import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDe
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals, assertRpcServesChain } from './local-wallet.js';
-import { WRAPPED_NATIVE } from './wrapped-native.js';
+import { WRAPPED_NATIVE, wrappedNativeAddress } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, sanitizeRequired, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, splAccountRent, } from './local-solana.js';
 import { localSimulate } from './local-wallet.js';
-import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
+import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, unknownCallAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
 import { markMaybeLive, isMaybeLive, carryMaybeLive, connectionNeverMade } from './maybe-live.js';
 import { discover } from './discovery.js';
@@ -121,6 +121,8 @@ function spendVerdict(input) {
 function usdOf(chainId, asset, raw, decimals) {
     return autopayAssetAllowed(chainId, asset).via === 'stablecoin' ? policyHuman(rawToUnits(raw, decimals)) : null;
 }
+/** WETH9 deposit() and withdraw(uint256): known shapes when aimed at the chain's own wrapped-native contract (wrap_eth, unwrap_eth). */
+const WRAPPED_NATIVE_SELECTORS = new Set(['d0e30db0', '2e1a7d4d']);
 /* Calldata the policy prices: which word holds the amount, which the recipient
    or spender, and for Permit2.approve which the token (there `to` is Permit2).
    The same functions the local token cap prices, so the two guards agree. */
@@ -318,8 +320,15 @@ async function describeSend(body, chainId) {
                 `refused rather than treated as a plain contract call. Use Permit2 approve or a single permit, each of which is reserved as an approval. Nothing was signed.`);
         }
     }
-    if (data && data !== '0x')
-        return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
+    if (data && data !== '0x') {
+        // A shape the table does not know. Under a policy it is refused unless
+        // the operator listed the contract (assertSendTarget, 1.14.11); the
+        // chain's wrapped-native deposit and withdraw are known shapes, since
+        // wrap_eth and unwrap_eth build them.
+        const selector = /^0x[0-9a-fA-F]{8}/.test(data) ? data.slice(0, 10).toLowerCase() : data.slice(0, 10);
+        const isWrapped = to.toLowerCase() === wrappedNativeAddress(chainId) && WRAPPED_NATIVE_SELECTORS.has(selector.slice(2));
+        return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId), ...(isWrapped ? {} : { unknown: selector }) };
+    }
     return { kind: 'native', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
 }
 /** The ledger method a decoded send is recorded under, unless the caller named one. */
@@ -337,15 +346,28 @@ function assertSendTarget(d, chainId) {
     if (!c.ok)
         throw new Error(c.reason + ' Nothing was signed.');
     if (d.kind === 'contract' || d.kind === 'approval') {
-        const t = targetAllowed(POL(), d.kind === 'approval' ? d.asset : d.to);
+        const t = targetAllowed(POL(), d.kind === 'approval' ? d.asset : d.to, chainId);
+        if (!t.ok)
+            throw new Error(t.reason + ' Nothing was signed.');
+    }
+    if (d.kind === 'token' && d.asset) {
+        const t = targetAllowed(POL(), d.asset, chainId); // the token or vault being moved; contracts.deny binds it
         if (!t.ok)
             throw new Error(t.reason + ' Nothing was signed.');
     }
     if (d.carried) {
-        const t = targetAllowed(POL(), d.carried.to); // the contract that keeps the value
+        const t = targetAllowed(POL(), d.carried.to, chainId); // the contract that keeps the value
         if (!t.ok)
             throw new Error(t.reason + ' Nothing was signed.');
     }
+    // Calldata the table cannot price is the operator's call, not the table's
+    // (1.14.11). Without a policy nothing changes: the local caps and the
+    // hosted signer judge the call on their own terms, as before.
+    if (d.unknown && POLICY.path) {
+        const u = unknownCallAllowed(POL(), chainId, d.to, d.unknown);
+        if (!u.ok)
+            throw new Error(u.reason + ' Nothing was signed.');
+    }
 }
 /**
  * The spends a decoded send makes against the policy, in the order they are
@@ -1377,7 +1399,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.10',
+    version: '1.14.12',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/ledger.d.ts

@@ -102,8 +102,29 @@ export declare class Ledger {
      * line; otherwise it was rewritten underneath us and nothing is adopted.
      */
     private sync;
-    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    /**
+     * Take the exclusive lock file; returns the release. A lock a dead process
+     * left behind is cleared after LOCK_STALE_MS (reclaimStale). The release
+     * removes the lock only while it still carries this call's token: a lock
+     * this process held past the stale window and another process reclaimed
+     * belongs to whoever took it next, and must not be removed from under them.
+     */
     private lock;
+    /**
+     * Clear a lock left by a process that died holding it. The judgement that
+     * the lock is stale and its removal are one step under a second file, the
+     * claim, taken with 'wx' like the lock itself: a waiter that cannot take the
+     * claim leaves the lock alone and retries, and the one that holds it looks
+     * at the lock again (mtime and first line) before removing it, so a fresh
+     * lock another waiter took in the meantime is never the one removed. Before
+     * 1.14.12 the stat and the unlink were two calls with nothing between them,
+     * and two waiters judging one stale lock could, between them, remove the
+     * fresh lock one of them had just taken, after which both held the ledger
+     * (reported privately, 2026-11-02). A claim older than the stale window was
+     * itself left by a waiter that died inside this step and is removed the old
+     * way; the step is a stat and an unlink, so that is the window that remains.
+     */
+    private reclaimStale;
     private append;
     private notify;
     /** Spends not voided, newest last. */

package/build/ledger.js

@@ -17,7 +17,7 @@
  * file that no longer holds what this process wrote is refused the same way.
  */
 import { appendFileSync, existsSync, readFileSync, openSync, closeSync, writeSync, unlinkSync, statSync } from 'node:fs';
-import { createHash, createHmac } from 'node:crypto';
+import { createHash, createHmac, randomBytes } from 'node:crypto';
 import { DAY_MS, MONTH_MS, units, rawToUnits, human, canonicalHost } from './policy.js';
 const GENESIS = '0'.repeat(64);
 const MAX_LINE = 16 * 1024;
@@ -25,6 +25,17 @@ const MAX_LINE = 16 * 1024;
 const LOCK_WAIT_MS = 10_000;
 /** A lock older than this was left by a process that died holding it. */
 const LOCK_STALE_MS = 30_000;
+/** What a lock file holds: the holder's pid and a random token, so a release can tell its own lock from one taken after it. */
+function lockToken() { return `${process.pid} ${randomBytes(8).toString('hex')}`; }
+/** The lock file as one thing to compare: its mtime and its first line. null when it is gone. */
+function lockIdentity(lockPath) {
+    try {
+        return { mtimeMs: statSync(lockPath).mtimeMs, line: readFileSync(lockPath, 'utf8').split(/\r?\n/)[0] };
+    }
+    catch {
+        return null;
+    }
+}
 const sleeper = new Int32Array(new SharedArrayBuffer(4));
 function sleepSync(ms) { Atomics.wait(sleeper, 0, 0, ms); }
 function hashOf(prev, body) {
@@ -105,43 +116,101 @@ export class Ledger {
         this.last = c.last;
         this.integrity = c.integrity;
     }
-    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    /**
+     * Take the exclusive lock file; returns the release. A lock a dead process
+     * left behind is cleared after LOCK_STALE_MS (reclaimStale). The release
+     * removes the lock only while it still carries this call's token: a lock
+     * this process held past the stale window and another process reclaimed
+     * belongs to whoever took it next, and must not be removed from under them.
+     */
     lock() {
         if (!this.path)
             return () => { };
         const lockPath = this.path + '.lock';
+        const token = lockToken();
         const deadline = Date.now() + this.lockWaitMs;
         for (;;) {
             try {
                 const fd = openSync(lockPath, 'wx', 0o600);
                 try {
-                    writeSync(fd, `${process.pid} ${new Date().toISOString()}\n`);
+                    writeSync(fd, `${token} ${new Date().toISOString()}\n`);
                 }
                 finally {
                     closeSync(fd);
                 }
-                return () => { try {
-                    unlinkSync(lockPath);
-                }
-                catch { /* already gone */ } };
+                return () => {
+                    if (!lockIdentity(lockPath)?.line.startsWith(token + ' '))
+                        return; // reclaimed as stale and retaken, or already gone
+                    try {
+                        unlinkSync(lockPath);
+                    }
+                    catch { /* already gone */ }
+                };
             }
             catch (e) {
                 if (e.code !== 'EEXIST')
                     throw e;
             }
+            this.reclaimStale(lockPath);
+            if (Date.now() >= deadline) {
+                throw new Error(`The ledger at ${this.path} is locked by another agentwallet-mcp process (${lockPath}) that did not finish within ${this.lockWaitMs} ms. Nothing was signed. If no other process is running, remove the lock file.`);
+            }
+            sleepSync(5);
+        }
+    }
+    /**
+     * Clear a lock left by a process that died holding it. The judgement that
+     * the lock is stale and its removal are one step under a second file, the
+     * claim, taken with 'wx' like the lock itself: a waiter that cannot take the
+     * claim leaves the lock alone and retries, and the one that holds it looks
+     * at the lock again (mtime and first line) before removing it, so a fresh
+     * lock another waiter took in the meantime is never the one removed. Before
+     * 1.14.12 the stat and the unlink were two calls with nothing between them,
+     * and two waiters judging one stale lock could, between them, remove the
+     * fresh lock one of them had just taken, after which both held the ledger
+     * (reported privately, 2026-11-02). A claim older than the stale window was
+     * itself left by a waiter that died inside this step and is removed the old
+     * way; the step is a stat and an unlink, so that is the window that remains.
+     */
+    reclaimStale(lockPath) {
+        const seen = lockIdentity(lockPath);
+        if (!seen || Date.now() - seen.mtimeMs <= LOCK_STALE_MS)
+            return; // gone, or live
+        const claimPath = lockPath + '.reclaim';
+        let fd;
+        try {
+            fd = openSync(claimPath, 'wx', 0o600);
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
+            try {
+                if (Date.now() - statSync(claimPath).mtimeMs > LOCK_STALE_MS)
+                    unlinkSync(claimPath);
+            }
+            catch { /* finished or cleared meanwhile */ }
+            return; // another waiter is clearing it; retry the lock
+        }
+        try {
             try {
-                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+                writeSync(fd, `${lockToken()} ${new Date().toISOString()}\n`);
+            }
+            finally {
+                closeSync(fd);
+            }
+            const now = lockIdentity(lockPath);
+            if (now && now.mtimeMs === seen.mtimeMs && now.line === seen.line && Date.now() - now.mtimeMs > LOCK_STALE_MS) {
+                try {
                     unlinkSync(lockPath);
-                    continue;
                 }
+                catch { /* gone meanwhile */ }
             }
-            catch {
-                continue; /* released between the two calls */
-            }
-            if (Date.now() >= deadline) {
-                throw new Error(`The ledger at ${this.path} is locked by another agentwallet-mcp process (${lockPath}) that did not finish within ${this.lockWaitMs} ms. Nothing was signed. If no other process is running, remove the lock file.`);
+        }
+        finally {
+            try {
+                unlinkSync(claimPath);
             }
-            sleepSync(5);
+            catch { /* already gone */ }
         }
     }
     append(body) {

package/build/policy.d.ts

@@ -35,6 +35,14 @@ export declare const PolicySchema: z.ZodObject<{
     assets: z.ZodOptional<z.ZodObject<{
         allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    contracts: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    unknown_calls: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        refuse: "refuse";
+    }>>;
     approval: z.ZodOptional<z.ZodObject<{
         above: z.ZodOptional<z.ZodString>;
         max: z.ZodOptional<z.ZodString>;
@@ -96,7 +104,22 @@ export declare function recipientAllowed(p: Policy, to: string): {
     reason: string;
 };
 /** A contract target (approve, wrap, arbitrary calldata): the deny list only; an allow list is about where funds go. */
-export declare function targetAllowed(p: Policy, to: string): {
+export declare function targetAllowed(p: Policy, to: string, chainId?: number): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * May the wallet send calldata the policy cannot price to this contract?
+ * Since 1.14.11 the answer under a policy is no unless the operator listed
+ * the contract or set unknown_calls to "allow": the classifier is a table of
+ * known shapes, and every shape it did not know was, until then, a
+ * zero-value call that reserved nothing (nineteen disclosure rows between
+ * 2026-10-14 and 2026-11-02 were that one gap). The open set is now the
+ * operator's decision, not the table's.
+ */
+export declare function unknownCallAllowed(p: Policy, chainId: number, to: string, selector: string): {
     ok: true;
 } | {
     ok: false;

package/build/policy.js

@@ -35,6 +35,10 @@ export const PolicySchema = z.object({
     recipients: z.object({ allow: z.array(Address).max(1000).optional(), deny: z.array(Address).max(1000).optional() }).strict().optional(),
     chains: z.object({ allow: z.array(z.number().int().positive()).max(100).optional() }).strict().optional(),
     assets: z.object({ allow: z.array(AssetRef).max(500).optional() }).strict().optional(),
+    /** Contracts the wallet may call with calldata the policy cannot price (a router, a bridge, a protocol). Entries may be scoped "chainId:0x...". deny refuses any call to the contract, priced or not. */
+    contracts: z.object({ allow: z.array(AssetRef).max(1000).optional(), deny: z.array(AssetRef).max(1000).optional() }).strict().optional(),
+    /** What to do with calldata the policy cannot price, aimed at a contract not in contracts.allow. Default refuse (1.14.11); "allow" restores the pre-1.14.11 behaviour of passing it as a zero-value call. */
+    unknown_calls: z.enum(['refuse', 'allow']).optional(),
     /** Ask the human (MCP elicitation) above `above`; in local mode an accepted ask may admit up to `max`, above the per-payment cap. */
     approval: z.object({ above: Dec.optional(), max: Dec.optional(), timeout_seconds: z.number().int().min(30).max(3600).optional() }).strict().optional(),
     tools: z.object({ allow: z.array(z.string().regex(/^[a-z_0-9]+$/)).max(100).optional(), deny: z.array(z.string().regex(/^[a-z_0-9]+$/)).max(100).optional() }).strict().optional(),
@@ -102,6 +106,12 @@ export function parsePolicy(text) {
         throw new Error('policy field hosts.allow: an empty allow list would refuse every host; remove it or list hosts.');
     if (p.recipients?.allow && p.recipients.allow.length === 0)
         throw new Error('policy field recipients.allow: an empty allow list would refuse every recipient; remove it or list addresses.');
+    if (p.contracts?.allow && p.contracts.allow.length === 0)
+        throw new Error('policy field contracts.allow: an empty allow list is the default (unpriced calls refused); remove it or list contracts.');
+    for (const k of ['allow', 'deny'])
+        for (const e of p.contracts?.[k] || [])
+            if (e.endsWith('native'))
+                throw new Error(`policy field contracts.${k}: "${e}" is not a contract.`);
     return p;
 }
 /** Load the policy named by AGENTWALLET_POLICY (none set: EMPTY). The ledger path comes from AGENTWALLET_LEDGER, then the policy, then a default next to the policy when a budget needs one. */
@@ -181,11 +191,40 @@ export function recipientAllowed(p, to) {
     return { ok: true };
 }
 /** A contract target (approve, wrap, arbitrary calldata): the deny list only; an allow list is about where funds go. */
-export function targetAllowed(p, to) {
+export function targetAllowed(p, to, chainId) {
     if (p.recipients?.deny?.some(x => sameAddress(x, to)))
         return { ok: false, reason: `policy denies contract target ${to} (recipients.deny).` };
+    if (chainId !== undefined && p.contracts?.deny?.some(e => contractRefMatches(e, chainId, to)))
+        return { ok: false, reason: `policy denies contract ${to} on chain ${chainId} (contracts.deny).` };
     return { ok: true };
 }
+/** "8453:0xabc" matches that contract on that chain; a bare address matches it on every chain. */
+function contractRefMatches(entry, chainId, to) {
+    const i = entry.indexOf(':');
+    if (i < 0)
+        return sameAddress(entry, to);
+    return Number(entry.slice(0, i)) === chainId && sameAddress(entry.slice(i + 1), to);
+}
+/**
+ * May the wallet send calldata the policy cannot price to this contract?
+ * Since 1.14.11 the answer under a policy is no unless the operator listed
+ * the contract or set unknown_calls to "allow": the classifier is a table of
+ * known shapes, and every shape it did not know was, until then, a
+ * zero-value call that reserved nothing (nineteen disclosure rows between
+ * 2026-10-14 and 2026-11-02 were that one gap). The open set is now the
+ * operator's decision, not the table's.
+ */
+export function unknownCallAllowed(p, chainId, to, selector) {
+    if (p.contracts?.allow?.some(e => contractRefMatches(e, chainId, to)))
+        return { ok: true };
+    if ((p.unknown_calls ?? 'refuse') === 'allow')
+        return { ok: true };
+    return {
+        ok: false,
+        reason: `policy: calldata selector ${selector} to ${to} on chain ${chainId} is not a shape the policy can price (a transfer, an approval, a permit, a redemption), and the policy does not list the contract in contracts.allow; ` +
+            `refused rather than passed as a zero-value call. The operator can add "${chainId}:${to}" to contracts.allow, or set unknown_calls to "allow" to let every unpriced call through as before 1.14.11.`,
+    };
+}
 export function chainAllowed(p, chainId) {
     if (p.chains?.allow && !p.chains.allow.includes(chainId))
         return { ok: false, reason: `policy does not allow chain ${chainId}: it is not in chains.allow.` };
@@ -245,6 +284,8 @@ export function describePolicy(lp) {
         recipients: p.recipients ? { allow: p.recipients.allow?.length ?? null, deny: p.recipients.deny?.length ?? null } : null,
         chains: p.chains ?? null,
         assets: p.assets ?? null,
+        contracts: p.contracts ? { allow: p.contracts.allow?.length ?? null, deny: p.contracts.deny?.length ?? null } : null,
+        unknown_calls: lp.path ? (p.unknown_calls ?? 'refuse') : 'allow (no policy set)',
         approval: p.approval ?? null,
         tools: p.tools ?? null,
         ledger: lp.ledgerPath,

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.10",
+  "version": "1.14.12",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",