agentwallet-mcp 1.14.2 → 1.14.3

package/README.md

@@ -384,7 +384,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, is always voided and never consumes budget. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -34,6 +34,7 @@ import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalanc
 import { localSimulate } from './local-wallet.js';
 import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
+import { markMaybeLive, isMaybeLive, carryMaybeLive, connectionNeverMade } from './maybe-live.js';
 import { discover } from './discovery.js';
 /* `agentwallet-mcp encrypt-keyfile <in> <out>` runs the keyfile tool instead of the server. */
 if (process.argv[2] === 'encrypt-keyfile') {
@@ -469,10 +470,15 @@ async function api(path, method = 'GET', body, extraHeaders) {
         return out;
     }
     catch (e) {
-        // A send that may already be on the wire stays counted; only a spend that never left this process is voided.
+        // A send that may already be on the wire stays counted; only a spend that
+        // never left this process is voided. The signers mark the former on the
+        // error object (markMaybeLive); the decision used to be a regex over the
+        // message and the word "broadcasts" in the local-mode refusal of
+        // transaction signing made every refused sign_transaction consume the
+        // budget for good (reported privately 2026-10-16, 1.14.3).
         if (reserved !== null) {
             const msg = e.message;
-            if (/BROADCAST|MAY be live/i.test(msg))
+            if (isMaybeLive(e))
                 LEDGER.settle(reserved, 'unknown', msg);
             else
                 LEDGER.void(reserved, msg);
@@ -490,7 +496,7 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
             handled = await routeLocally(path, method, body);
         }
         catch (e) {
-            throw new Error(redactRpcSecrets(e)); // viem puts the RPC URL, key and all, in its messages
+            throw carryMaybeLive(e, new Error(redactRpcSecrets(e))); // viem puts the RPC URL, key and all, in its messages; the may-be-live marker rides along
         }
         if (handled !== NOT_HANDLED)
             return handled;
@@ -512,7 +518,23 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
     if (body && method !== 'GET') {
         options.body = JSON.stringify(body);
     }
-    const res = await fetch(url, options);
+    // Hosted mode: a connection that was never made (refused, unresolvable,
+    // TLS rejected) carried nothing to the host, so a reserved spend is voided.
+    // A timeout waiting for the answer or a reset mid-request may have reached
+    // the custodian, which may have signed and broadcast; a spend there stays
+    // counted (1.14.3).
+    let res;
+    try {
+        res = await fetch(url, options);
+    }
+    catch (e) {
+        if (method === 'POST' && /^\/wallets\/[^/]+\/(send|sign)(\?|$)/.test(path) && !connectionNeverMade(e)) {
+            const cause = e.cause;
+            const why = e?.name === 'TimeoutError' ? `no answer within ${API_TIMEOUT_MS / 1000} s` : (cause?.code || cause?.message || e?.message || 'connection failed');
+            throw markMaybeLive(new Error(`The AgentWallet API host did not answer ${path} (${why}). The request may have reached it, so a transaction may be live; check the wallet's history before retrying.`));
+        }
+        throw e;
+    }
     if (res.status >= 300 && res.status < 400) {
         throw new Error(`The AgentWallet API host answered ${path} with a redirect (HTTP ${res.status}); refusing to follow it.`);
     }
@@ -522,7 +544,9 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
         data = JSON.parse(text);
     }
     catch {
-        throw new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
+        // A 2xx the host did not phrase as JSON may still have been a completed send; counted, not voided (1.14.3).
+        const err = new Error(`The AgentWallet API host returned a non-JSON response (HTTP ${res.status}).`);
+        throw res.ok && method === 'POST' ? markMaybeLive(err) : err;
     }
     data = boundHostData(data, 0); // strings, arrays and depth bounded; the host writes none of the agent's instructions
     // A 402 from the API host is paid automatically only for a HOSTED wallet the
@@ -552,7 +576,8 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
     if (method === 'POST' && /^\/wallets\/[^/]+\/send(\?|$)/.test(path) && data && typeof data === 'object') {
         const d = data;
         if (!looksLikeTxHash(d.tx_hash) && !(typeof d.signature === 'string' && /^[1-9A-HJ-NP-Za-km-z]{43,120}$/.test(d.signature))) {
-            throw new Error('The AgentWallet API host answered the send without a transaction hash or signature; treating it as not sent.');
+            // The agent is told it was not sent (no hash to act on); the ledger keeps it counted because the host may disagree (1.14.3).
+            throw markMaybeLive(new Error('The AgentWallet API host answered the send without a transaction hash or signature; treating it as not sent.'));
         }
     }
     // The marker comes FIRST so a truncated result still carries it, and an
@@ -1118,7 +1143,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.2',
+    version: '1.14.3',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/local-solana.js

@@ -16,6 +16,7 @@ import { Connection, Keypair, PublicKey, SystemProgram, Transaction, Transaction
 import bs58 from 'bs58';
 import { lookupTrustedDecimals } from './x402-payment.js';
 import { openKeyfile } from './keyfile.js';
+import { markMaybeLive, isMaybeLive } from './maybe-live.js';
 /* ── Program IDs ─────────────────────────────────────────────────── */
 const TOKEN_PROGRAM = new PublicKey('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
 const TOKEN_2022_PROGRAM = new PublicKey('TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb');
@@ -244,7 +245,8 @@ async function sendSigned(conn, tx, payer) {
         throw new Error('The transaction could not be signed.');
     const local = bs58.encode(tx.signature);
     const reported = await conn.sendRawTransaction(tx.serialize());
-    const after = (what) => new Error(`Transaction ${local} was BROADCAST but ${what}. Check it on an explorer before retrying: a retry is a second transfer.`);
+    // Marked, not worded: the ledger keeps the spend counted because of the marker, never because of the text (1.14.3).
+    const after = (what) => markMaybeLive(new Error(`Transaction ${local} was BROADCAST but ${what}. Check it on an explorer before retrying: a retry is a second transfer.`));
     if (reported !== local)
         throw after(`the RPC answered with a different signature (${String(reported).slice(0, 90)}), so the node cannot be trusted about its fate`);
     const confirm = conn.confirmTransaction({ signature: local, blockhash, lastValidBlockHeight }, 'confirmed');
@@ -254,7 +256,7 @@ async function sendSigned(conn, tx, payer) {
         result = await Promise.race([confirm, timeout]);
     }
     catch (e) {
-        if (e instanceof Error && /was BROADCAST/.test(e.message))
+        if (isMaybeLive(e))
             throw e;
         throw after(`confirmation failed: ${e instanceof Error ? e.message : JSON.stringify(e)}`);
     }

package/build/local-wallet.js

@@ -23,6 +23,7 @@ import { wrappedNativeAddress } from './wrapped-native.js';
 import { typedDataFor } from './x402-eip3009.js';
 import { uptoTypedData } from './x402-permit2.js';
 import { openKeyfile } from './keyfile.js';
+import { markMaybeLive } from './maybe-live.js';
 /* ── Key loading ─────────────────────────────────────────────────── */
 /**
  * Read the key once at startup. Kept module-private: nothing exports the key
@@ -552,10 +553,11 @@ export async function localSend(chainId, to, valueWei, data, fees) {
     }
     catch (e) {
         account.nonceManager.reset({ address, chainId });
-        throw new Error(`Broadcast of transaction ${localHash} (nonce ${nonce}) failed: ${e.message.split('\n')[0]}. The transaction is signed and MAY be live if the node forwarded it before answering; check the hash on an explorer before retrying.`);
+        // Marked, not worded: the ledger keeps this spend counted because of the marker, never because of the text (1.14.3).
+        throw markMaybeLive(new Error(`Broadcast of transaction ${localHash} (nonce ${nonce}) failed: ${e.message.split('\n')[0]}. The transaction is signed and MAY be live if the node forwarded it before answering; check the hash on an explorer before retrying.`));
     }
     if (reported.toLowerCase() !== localHash.toLowerCase()) {
-        throw new Error(`Transaction ${localHash} (nonce ${nonce}) was BROADCAST, but the node answered with a different hash (${String(reported).slice(0, 80)}), so it cannot be trusted about its fate. Verify ${localHash} on an explorer before retrying.`);
+        throw markMaybeLive(new Error(`Transaction ${localHash} (nonce ${nonce}) was BROADCAST, but the node answered with a different hash (${String(reported).slice(0, 80)}), so it cannot be trusted about its fate. Verify ${localHash} on an explorer before retrying.`));
     }
     return {
         tx_hash: localHash,

package/build/maybe-live.d.ts

@@ -0,0 +1,13 @@
+/** Mark `err` as thrown after the transaction may have gone out. Returns it. */
+export declare function markMaybeLive<T extends object>(err: T): T;
+/** Was this error thrown after the transaction may have gone out? */
+export declare function isMaybeLive(err: unknown): boolean;
+/** Copy the marker from `from` onto `to` (for errors re-thrown with a redacted message). */
+export declare function carryMaybeLive<T extends object>(from: unknown, to: T): T;
+/**
+ * A fetch() rejection whose cause says the connection was never made: nothing
+ * reached the host, so a reserved spend can be voided. Anything else (a timeout
+ * waiting for the answer, a reset mid-request, an unknown cause) may have
+ * reached the host, and a send there is treated as possibly live.
+ */
+export declare function connectionNeverMade(err: unknown): boolean;

package/build/maybe-live.js

@@ -0,0 +1,48 @@
+/**
+ * Marks an error thrown after a transaction may already have left this
+ * process, so the ledger keeps the reservation counted instead of voiding it.
+ *
+ * The decision used to be a regex over the error text (/BROADCAST|MAY be live/i)
+ * and misfired on any message that merely contained the word "broadcasts",
+ * including the local-mode refusal of transaction signing, so every refused
+ * sign_transaction consumed the budget for good (reported privately, 2026-10-16,
+ * fixed in 1.14.3). A marker on the error object cannot misfire on wording.
+ *
+ * Symbol.for so the marker survives a duplicated module in the bundle; a plain
+ * `instanceof` would not.
+ */
+const MARK = Symbol.for('agentwallet.maybeLive');
+/** Mark `err` as thrown after the transaction may have gone out. Returns it. */
+export function markMaybeLive(err) {
+    err[MARK] = true;
+    return err;
+}
+/** Was this error thrown after the transaction may have gone out? */
+export function isMaybeLive(err) {
+    return typeof err === 'object' && err !== null && err[MARK] === true;
+}
+/** Copy the marker from `from` onto `to` (for errors re-thrown with a redacted message). */
+export function carryMaybeLive(from, to) {
+    return isMaybeLive(from) ? markMaybeLive(to) : to;
+}
+/**
+ * A fetch() rejection whose cause says the connection was never made: nothing
+ * reached the host, so a reserved spend can be voided. Anything else (a timeout
+ * waiting for the answer, a reset mid-request, an unknown cause) may have
+ * reached the host, and a send there is treated as possibly live.
+ */
+export function connectionNeverMade(err) {
+    const e = err;
+    const code = e?.cause?.code ?? '';
+    // fetch() refuses some requests before opening a socket (a blocked port such
+    // as 1, an unsupported scheme, a URL it will not parse); undici reports those
+    // as "fetch failed" with a bare-message cause and no errno.
+    if (!code && /^(bad port|invalid url|unsupported scheme|unknown scheme|url scheme ".*" is not supported|fetch failed)$/i.test(e?.cause?.message ?? ''))
+        return true;
+    if (/^(ECONNREFUSED|ENOTFOUND|EAI_AGAIN|EHOSTUNREACH|ENETUNREACH|EADDRNOTAVAIL|UND_ERR_CONNECT_TIMEOUT|ERR_TLS_CERT_ALTNAME_INVALID|CERT_HAS_EXPIRED|DEPTH_ZERO_SELF_SIGNED_CERT|SELF_SIGNED_CERT_IN_CHAIN|UNABLE_TO_VERIFY_LEAF_SIGNATURE|UNABLE_TO_GET_ISSUER_CERT_LOCALLY|ERR_INVALID_URL)$/.test(code))
+        return true;
+    // Node's own TLS errors arrive as the cause with a name and no errno code.
+    if (/^(ERR_TLS_|ERR_SSL_)/.test(code))
+        return true;
+    return false;
+}

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.2",
+  "version": "1.14.3",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",