agentwallet-mcp 1.14.11 → 1.14.12

package/README.md

@@ -387,7 +387,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped or answered with a 5xx, any host answer that carries a transaction hash) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, or a 4xx refusal from the host, is always voided and never consumes budget. A hosted send is forwarded with the chain the policy priced it on (`chain_id`, else `AGENTWALLET_CHAIN_ID`, else 8453), and a custodian answer naming another chain is written onto the ledger line as a mismatch. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped or answered with a 5xx, any host answer that carries a transaction hash) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, or a 4xx refusal from the host, is always voided and never consumes budget. A hosted send is forwarded with the chain the policy priced it on (`chain_id`, else `AGENTWALLET_CHAIN_ID`, else 8453), and a custodian answer naming another chain is written onto the ledger line as a mismatch. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process and reclaimed in one step through `<ledger>.lock.reclaim`, and a release removes only the lock it took. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -1399,7 +1399,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.11',
+    version: '1.14.12',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/ledger.d.ts

@@ -102,8 +102,29 @@ export declare class Ledger {
      * line; otherwise it was rewritten underneath us and nothing is adopted.
      */
     private sync;
-    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    /**
+     * Take the exclusive lock file; returns the release. A lock a dead process
+     * left behind is cleared after LOCK_STALE_MS (reclaimStale). The release
+     * removes the lock only while it still carries this call's token: a lock
+     * this process held past the stale window and another process reclaimed
+     * belongs to whoever took it next, and must not be removed from under them.
+     */
     private lock;
+    /**
+     * Clear a lock left by a process that died holding it. The judgement that
+     * the lock is stale and its removal are one step under a second file, the
+     * claim, taken with 'wx' like the lock itself: a waiter that cannot take the
+     * claim leaves the lock alone and retries, and the one that holds it looks
+     * at the lock again (mtime and first line) before removing it, so a fresh
+     * lock another waiter took in the meantime is never the one removed. Before
+     * 1.14.12 the stat and the unlink were two calls with nothing between them,
+     * and two waiters judging one stale lock could, between them, remove the
+     * fresh lock one of them had just taken, after which both held the ledger
+     * (reported privately, 2026-11-02). A claim older than the stale window was
+     * itself left by a waiter that died inside this step and is removed the old
+     * way; the step is a stat and an unlink, so that is the window that remains.
+     */
+    private reclaimStale;
     private append;
     private notify;
     /** Spends not voided, newest last. */

package/build/ledger.js

@@ -17,7 +17,7 @@
  * file that no longer holds what this process wrote is refused the same way.
  */
 import { appendFileSync, existsSync, readFileSync, openSync, closeSync, writeSync, unlinkSync, statSync } from 'node:fs';
-import { createHash, createHmac } from 'node:crypto';
+import { createHash, createHmac, randomBytes } from 'node:crypto';
 import { DAY_MS, MONTH_MS, units, rawToUnits, human, canonicalHost } from './policy.js';
 const GENESIS = '0'.repeat(64);
 const MAX_LINE = 16 * 1024;
@@ -25,6 +25,17 @@ const MAX_LINE = 16 * 1024;
 const LOCK_WAIT_MS = 10_000;
 /** A lock older than this was left by a process that died holding it. */
 const LOCK_STALE_MS = 30_000;
+/** What a lock file holds: the holder's pid and a random token, so a release can tell its own lock from one taken after it. */
+function lockToken() { return `${process.pid} ${randomBytes(8).toString('hex')}`; }
+/** The lock file as one thing to compare: its mtime and its first line. null when it is gone. */
+function lockIdentity(lockPath) {
+    try {
+        return { mtimeMs: statSync(lockPath).mtimeMs, line: readFileSync(lockPath, 'utf8').split(/\r?\n/)[0] };
+    }
+    catch {
+        return null;
+    }
+}
 const sleeper = new Int32Array(new SharedArrayBuffer(4));
 function sleepSync(ms) { Atomics.wait(sleeper, 0, 0, ms); }
 function hashOf(prev, body) {
@@ -105,43 +116,101 @@ export class Ledger {
         this.last = c.last;
         this.integrity = c.integrity;
     }
-    /** Take the exclusive lock file; returns the release. A lock a dead process left behind is cleared after LOCK_STALE_MS. */
+    /**
+     * Take the exclusive lock file; returns the release. A lock a dead process
+     * left behind is cleared after LOCK_STALE_MS (reclaimStale). The release
+     * removes the lock only while it still carries this call's token: a lock
+     * this process held past the stale window and another process reclaimed
+     * belongs to whoever took it next, and must not be removed from under them.
+     */
     lock() {
         if (!this.path)
             return () => { };
         const lockPath = this.path + '.lock';
+        const token = lockToken();
         const deadline = Date.now() + this.lockWaitMs;
         for (;;) {
             try {
                 const fd = openSync(lockPath, 'wx', 0o600);
                 try {
-                    writeSync(fd, `${process.pid} ${new Date().toISOString()}\n`);
+                    writeSync(fd, `${token} ${new Date().toISOString()}\n`);
                 }
                 finally {
                     closeSync(fd);
                 }
-                return () => { try {
-                    unlinkSync(lockPath);
-                }
-                catch { /* already gone */ } };
+                return () => {
+                    if (!lockIdentity(lockPath)?.line.startsWith(token + ' '))
+                        return; // reclaimed as stale and retaken, or already gone
+                    try {
+                        unlinkSync(lockPath);
+                    }
+                    catch { /* already gone */ }
+                };
             }
             catch (e) {
                 if (e.code !== 'EEXIST')
                     throw e;
             }
+            this.reclaimStale(lockPath);
+            if (Date.now() >= deadline) {
+                throw new Error(`The ledger at ${this.path} is locked by another agentwallet-mcp process (${lockPath}) that did not finish within ${this.lockWaitMs} ms. Nothing was signed. If no other process is running, remove the lock file.`);
+            }
+            sleepSync(5);
+        }
+    }
+    /**
+     * Clear a lock left by a process that died holding it. The judgement that
+     * the lock is stale and its removal are one step under a second file, the
+     * claim, taken with 'wx' like the lock itself: a waiter that cannot take the
+     * claim leaves the lock alone and retries, and the one that holds it looks
+     * at the lock again (mtime and first line) before removing it, so a fresh
+     * lock another waiter took in the meantime is never the one removed. Before
+     * 1.14.12 the stat and the unlink were two calls with nothing between them,
+     * and two waiters judging one stale lock could, between them, remove the
+     * fresh lock one of them had just taken, after which both held the ledger
+     * (reported privately, 2026-11-02). A claim older than the stale window was
+     * itself left by a waiter that died inside this step and is removed the old
+     * way; the step is a stat and an unlink, so that is the window that remains.
+     */
+    reclaimStale(lockPath) {
+        const seen = lockIdentity(lockPath);
+        if (!seen || Date.now() - seen.mtimeMs <= LOCK_STALE_MS)
+            return; // gone, or live
+        const claimPath = lockPath + '.reclaim';
+        let fd;
+        try {
+            fd = openSync(claimPath, 'wx', 0o600);
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
+            try {
+                if (Date.now() - statSync(claimPath).mtimeMs > LOCK_STALE_MS)
+                    unlinkSync(claimPath);
+            }
+            catch { /* finished or cleared meanwhile */ }
+            return; // another waiter is clearing it; retry the lock
+        }
+        try {
             try {
-                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+                writeSync(fd, `${lockToken()} ${new Date().toISOString()}\n`);
+            }
+            finally {
+                closeSync(fd);
+            }
+            const now = lockIdentity(lockPath);
+            if (now && now.mtimeMs === seen.mtimeMs && now.line === seen.line && Date.now() - now.mtimeMs > LOCK_STALE_MS) {
+                try {
                     unlinkSync(lockPath);
-                    continue;
                 }
+                catch { /* gone meanwhile */ }
             }
-            catch {
-                continue; /* released between the two calls */
-            }
-            if (Date.now() >= deadline) {
-                throw new Error(`The ledger at ${this.path} is locked by another agentwallet-mcp process (${lockPath}) that did not finish within ${this.lockWaitMs} ms. Nothing was signed. If no other process is running, remove the lock file.`);
+        }
+        finally {
+            try {
+                unlinkSync(claimPath);
             }
-            sleepSync(5);
+            catch { /* already gone */ }
         }
     }
     append(body) {

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.11",
+  "version": "1.14.12",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",