agentwallet-mcp 1.14.4 → 1.14.5

package/README.md

@@ -373,10 +373,10 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 }
 ```
 
-- **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`.
+- **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
 - **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract).
 - **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused outright, since no budget can count it; grant an exact amount. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted.
-- **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote.
+- **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
 - **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.
 - **`approval`**: above `above`, every x402 payment is put to the human at the MCP client through [elicitation](https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation) (the client shows the amount, token, recipient and resource and asks yes or no; a client that declared no elicitation support cannot answer, so the payment is refused). In local mode an accepted answer may admit a payment above the per-payment cap, up to `max`. Budgets are never lifted by anyone's approval.

package/build/index.js

@@ -32,7 +32,7 @@ import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, sanitizeRequired, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, } from './local-solana.js';
 import { localSimulate } from './local-wallet.js';
-import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
+import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
 import { markMaybeLive, isMaybeLive, carryMaybeLive, connectionNeverMade } from './maybe-live.js';
 import { discover } from './discovery.js';
@@ -135,7 +135,13 @@ async function describeSend(body, chainId) {
     if (body.token_mint) {
         const mint = String(body.token_mint);
         const d = Number(body.token_decimals);
-        return { kind: 'spl', to: String(body.to || ''), asset: mint, raw: String(body.value ?? '0'), decimals: Number.isInteger(d) && d >= 0 && d <= 36 ? d : await verifiedDecimals(chainId, mint) };
+        // The caller's token_decimals only ever confirms the mint's own value: in
+        // hosted mode it was taken as given, so "18" for USDC priced a 1,000 USDC
+        // send at a trillionth of a dollar against the budget and the request
+        // reached the custodian (reported privately 2026-10-24, 1.14.5). The chain
+        // would have refused the TransferChecked, but the ledger was already wrong.
+        const given = Number.isInteger(d) && d >= 0 && d <= 36 ? d : undefined;
+        return { kind: 'spl', to: String(body.to || ''), asset: mint, raw: String(body.value ?? '0'), decimals: await verifiedDecimals(chainId, mint, given) };
     }
     const data = String(body.data || '');
     const to = String(body.to || '');
@@ -783,8 +789,8 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
     }
     // Send payment using our wallet (with X-AGW-SKIP-X402 to prevent recursion).
     // The ledger context names the API host and route; the /send hook reserves and settles the spend.
-    const ctx = { 'X-AGW-SKIP-X402': 'true', 'X-AGW-CTX': JSON.stringify({ tool: 'autopay', host: new URL(API_BASE).hostname, resource: `${originalMethod} ${originalPath.split('?')[0]}`, method: 'autopay' }) };
-    const hostRule = hostAllowed(POL(), new URL(API_BASE).hostname);
+    const ctx = { 'X-AGW-SKIP-X402': 'true', 'X-AGW-CTX': JSON.stringify({ tool: 'autopay', host: hostOf(API_BASE), resource: `${originalMethod} ${originalPath.split('?')[0]}`, method: 'autopay' }) };
+    const hostRule = hostAllowed(POL(), hostOf(API_BASE));
     if (!hostRule.ok)
         throw new Error(`x402 auto-pay refused: ${hostRule.reason}`);
     let txHash;
@@ -1169,7 +1175,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.4',
+    version: '1.14.5',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -1890,9 +1896,9 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     }
     // A host the policy denies is never contacted at all, not even for the quote.
     {
-        const early = hostAllowed(POL(), new URL(url).hostname);
+        const early = hostAllowed(POL(), hostOf(url));
         if (!early.ok)
-            return jsonResponse({ status: null, payment_required: null, payment_made: false, policy_refusal: true, host: new URL(url).hostname, error: early.reason + ' The endpoint was not contacted.' });
+            return jsonResponse({ status: null, payment_required: null, payment_made: false, policy_refusal: true, host: hostOf(url), error: early.reason + ' The endpoint was not contacted.' });
     }
     // Validate URL: canonicalizes IP literals (including IPv4-mapped IPv6) and
     // resolves DNS names, rejecting any private/internal destination. An early
@@ -2030,7 +2036,7 @@ tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the server
     // Step 3e: Spend policy. The host, chain, asset and recipient lists, the
     // per-host ceiling, and whether the rolling budgets have room. Nothing is
     // recorded here; the reservation is written at signing time.
-    const payHost = new URL(url).hostname;
+    const payHost = hostOf(url);
     const hostLimit = perHostRule(POL(), payHost);
     const amount18 = rawToUnits(rawAmount, trustedDecimals);
     const policyInput = {
@@ -2650,7 +2656,7 @@ tool('quote_x402', 'Ask what an x402 endpoint charges without paying: fetches th
             reqHeaders[k] = v;
         }
     }
-    const host = new URL(url).hostname;
+    const host = hostOf(url);
     {
         const early = hostAllowed(POL(), host);
         if (!early.ok)

package/build/ledger.js

@@ -18,7 +18,7 @@
  */
 import { appendFileSync, existsSync, readFileSync, openSync, closeSync, writeSync, unlinkSync, statSync } from 'node:fs';
 import { createHash, createHmac } from 'node:crypto';
-import { DAY_MS, MONTH_MS, units, rawToUnits, human } from './policy.js';
+import { DAY_MS, MONTH_MS, units, rawToUnits, human, canonicalHost } from './policy.js';
 const GENESIS = '0'.repeat(64);
 const MAX_LINE = 16 * 1024;
 /** How long a spend waits for another process to finish its own check-and-append. */
@@ -190,7 +190,10 @@ export class Ledger {
         return this.sumNative(chainId, nowMs);
     }
     sumUsd(nowMs, host) {
-        return this.sum(nowMs, e => (host === undefined || e.host === host) && e.usd !== null ? units(e.usd) : 0n);
+        // Lines are written with the canonical host, but a ledger from before 1.14.5
+        // may hold "api.example.com." lines; they belong to the same host's sum.
+        const want = host === undefined ? undefined : canonicalHost(host);
+        return this.sum(nowMs, e => (want === undefined || (e.host !== null && canonicalHost(e.host) === want)) && e.usd !== null ? units(e.usd) : 0n);
     }
     sumNative(chainId, nowMs) {
         return this.sum(nowMs, e => e.chain_id === chainId && e.asset === '' ? rawToUnits(e.raw, nativeDecimalsOf(chainId)) : 0n);
@@ -303,7 +306,7 @@ export class Ledger {
             const e = this.entries[i];
             if (e.kind !== 'spend')
                 continue;
-            if (opts.host !== undefined && e.host !== opts.host)
+            if (opts.host !== undefined && (e.host === null || canonicalHost(e.host) !== canonicalHost(opts.host)))
                 continue;
             if (opts.since !== undefined && Date.parse(e.ts) < opts.since)
                 continue;

package/build/policy.d.ts

@@ -218,6 +218,16 @@ export declare function parsePolicy(text: string): Policy;
 export declare function loadPolicy(env?: NodeJS.ProcessEnv): LoadedPolicy;
 /** A budget is only meaningful across restarts, so it needs a file. */
 export declare function needsLedger(p: Policy): boolean;
+/**
+ * A DNS name as the policy compares, sums and records it: lowercase, without
+ * the root label's trailing dot. "api.example.com." (and its %2E spelling)
+ * names the same host as "api.example.com", TLS accepts either, and Node's URL
+ * parser keeps the dot, so the raw hostname slipped past hosts.deny and
+ * per_host (reported privately 2026-10-24, 1.14.5). IP literals pass through.
+ */
+export declare function canonicalHost(host: string): string;
+/** The host of a URL as the policy sees it. */
+export declare function hostOf(url: string): string;
 export declare function hostMatches(pattern: string, host: string): boolean;
 export declare function hostAllowed(p: Policy, host: string): {
     ok: true;

package/build/policy.js

@@ -131,9 +131,28 @@ export function needsLedger(p) {
     return Boolean(p.budget || p.native_budget || (p.per_host && Object.values(p.per_host).some(h => h.daily || h.monthly)));
 }
 /* ── Matching ─────────────────────────────────────────────────────── */
+/**
+ * A DNS name as the policy compares, sums and records it: lowercase, without
+ * the root label's trailing dot. "api.example.com." (and its %2E spelling)
+ * names the same host as "api.example.com", TLS accepts either, and Node's URL
+ * parser keeps the dot, so the raw hostname slipped past hosts.deny and
+ * per_host (reported privately 2026-10-24, 1.14.5). IP literals pass through.
+ */
+export function canonicalHost(host) {
+    let h = host.trim().toLowerCase();
+    if (h.startsWith('['))
+        return h;
+    while (h.endsWith('.'))
+        h = h.slice(0, -1);
+    return h;
+}
+/** The host of a URL as the policy sees it. */
+export function hostOf(url) {
+    return canonicalHost(new URL(url).hostname);
+}
 export function hostMatches(pattern, host) {
-    const p = pattern.toLowerCase();
-    const h = host.toLowerCase();
+    const p = canonicalHost(pattern);
+    const h = canonicalHost(host);
     if (p.startsWith('*.'))
         return h.endsWith(p.slice(1)) && h.length > p.length - 1;
     return p === h;

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.4",
+  "version": "1.14.5",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",