agentwallet-mcp 1.14.8 → 1.14.10

package/README.md

@@ -43,7 +43,7 @@ Use `AGENTWALLET_KEYFILE=/path/to/key` instead if you would rather keep the key
 
 `AGENTWALLET_MAX_TX_NATIVE` is a per-transaction ceiling in native units (ETH, MATIC and so on). In hosted mode the server enforces limits; in local mode there is no server, so these guards are the only ones there are. Set them.
 
-`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance`, Permit2 `approve`, and `deposit()` / `withdraw(uint256)` on the chain's own wrapped-native contract (so `wrap_eth` and `unwrap_eth` keep working under the cap), the approvals because an unbounded allowance is a drain waiting to happen. ERC-721 and ERC-1155 calldata (`setApprovalForAll`, `safeTransferFrom`) is refused while the cap is set, since nothing prices an NFT; without the cap it passes the way an ERC-20 transfer of any size does, except that an operator grant is an unlimited approval and is refused everywhere by default (see `AGENTWALLET_ALLOW_UNLIMITED_APPROVAL`). Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. `increaseAllowance` is judged on the resulting total: the current allowance is read first and the call refuses if it cannot be, so two compliant increments cannot stack a standing allowance above the cap. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open. For a token outside the registry the RPC is the only source of decimals, and an RPC you do not control could scale the amount and the cap together; pin such tokens with `AGENTWALLET_TOKEN_DECIMALS` (for example `8453:0x<token>=6`) and the pin is used everywhere the RPC's answer would have been.
+`AGENTWALLET_MAX_TX_TOKEN` is the equivalent ceiling for ERC-20 movement, in human units of the token. **Set this one too if you hold stablecoins.** The native cap cannot see a token transfer: an ERC-20 send carries `value = 0` with the amount in the calldata, so `AGENTWALLET_MAX_TX_NATIVE` alone leaves a USDC balance uncapped. `AGENTWALLET_MAX_TX_TOKEN` covers `transfer`, `transferFrom`, `approve`, `increaseAllowance`, EIP-2612 `permit`, Permit2 `approve`, and `deposit()` / `withdraw(uint256)` on the chain's own wrapped-native contract (so `wrap_eth` and `unwrap_eth` keep working under the cap), the approvals because an unbounded allowance is a drain waiting to happen. ERC-721 and ERC-1155 calldata (`setApprovalForAll`, `safeTransferFrom`) is refused while the cap is set, since nothing prices an NFT; without the cap it passes the way an ERC-20 transfer of any size does, except that an operator grant is an unlimited approval and is refused everywhere by default (see `AGENTWALLET_ALLOW_UNLIMITED_APPROVAL`). Any other calldata sent to a token contract or to Permit2 is refused while the cap is set, because the guard cannot price it; set `AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1` to allow such calls deliberately. `increaseAllowance` is judged on the resulting total: the current allowance is read first and the call refuses if it cannot be, so two compliant increments cannot stack a standing allowance above the cap. Calls to other contracts (routers, bridges) pass, since they can only pull what an approval already allowed; a contract counts as "other" only when it demonstrably declines `decimals()`, so an absurd or malformed answer, or an RPC that cannot be reached, refuses rather than allows. Decimals are resolved locally from the trusted registry, then the token's own `decimals()`; a token that resolves neither way is evaluated at 0 decimals, the only value that cannot fail open. For a token outside the registry the RPC is the only source of decimals, and an RPC you do not control could scale the amount and the cap together; pin such tokens with `AGENTWALLET_TOKEN_DECIMALS` (for example `8453:0x<token>=6`) and the pin is used everywhere the RPC's answer would have been.
 
 ### Solana local signing
 
@@ -119,7 +119,7 @@ Add to your config:
 }
 ```
 
-> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet. Only the metered routes (creating a wallet, signing, sending) are paid this way, at most `AGENTWALLET_MAX_AUTOPAY_PER_HOUR` times an hour (default 20), and every automatic payment is reported in the tool result under `autopay_payment`. A 402 on any other route is reported, never paid.
+> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet. Only the metered routes (creating a wallet, signing, sending) are paid this way, at most `AGENTWALLET_MAX_AUTOPAY_PER_HOUR` times an hour (default 20; the slot is taken before the payment is sent, so parallel calls cannot overrun it, and processes sharing a ledger file share the hour, while without one the count is per process), and every automatic payment is reported in the tool result under `autopay_payment`. A 402 on any other route is reported, never paid.
 >
 > **Auto-pay safety cap.** `AGENTWALLET_MAX_AUTOPAY` (optional, default `1`) is the most one x402 payment may authorize, in stablecoin units: `1` means one dollar. It prices registry stablecoins only (USDC, USDT, USDbC, DAI on the supported chains, USDC and USDT on Solana). A requirement in the chain's native asset or in any other token is refused, because "1" measured in ETH is a few thousand dollars; list such assets in `AGENTWALLET_AUTOPAY_ASSETS` (comma-separated addresses or mints, or the word `native`) to allow them, and the cap then applies in that asset's own units. Any requirement above the cap is rejected instead of paid, so a malformed or tampered payment requirement cannot drain the wallet. This automatic path settles `exact` requirements only; an `upto` offer from the API is refused before any wallet call, because paying a usage maximum upfront is not what the offer means (use `pay_x402`, which signs a Permit2 authorization for it). The cap is the operator's ceiling: a `max_payment` argument can lower it for one call but never raise it. Raise the variable itself if you genuinely need larger automatic payments (for example `"5"` for up to 5 USDC per call).
 
@@ -375,8 +375,8 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 ```
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
-- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it).
-- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An NFT operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`) is unbounded by construction and refused the same way, and an ERC-721 or ERC-1155 transfer is a spend of the collection to the recipient that no budget can price, so it is refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted.
+- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers, native x402 payments and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it). The dollar budget has no price for the chain's coin, so on a chain with no `native_budget` entry a native spend is an unpriced spend: refused while a `budget` or a `per_host` ceiling is set, unless `"unpriced_spends": "allow"`. Give every chain the wallet spends on an entry.
+- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `increaseApproval`, either `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`, EIP-6909 `setOperator`) is unbounded by construction and refused the same way. Every token mover the standards define is a spend to its recipient: ERC-20 `transfer` and `transferFrom`, the ERC-677 and ERC-1363 `transferAndCall` and `transferFromAndCall` shapes, the ERC-223 `transfer` with data, ERC-777 `send` and `operatorSend`, and the ERC-721, ERC-1155 and EIP-6909 transfers, which no budget can price and so are refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A redemption of the wallet's own position is a spend too: ERC-4626 `redeem` and `withdraw` are spends of the vault to the receiver (unpriced, like an NFT), and Aave `Pool.withdraw` is a transfer of the underlying to the receiver. A zero-value call to any other contract (a router, a bridge, a protocol whose payout shape is not listed here) reserves nothing: it can only pull what an approval already granted, or pay out a position in a shape the policy does not know, so a policy that holds positions elsewhere should set `recipients.allow`. The exception is Permit2 itself: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy, since each moves tokens or changes what may be moved.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
 - **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.
@@ -385,7 +385,7 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, is always voided and never consumes budget. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped or answered with a 5xx, any host answer that carries a transaction hash) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, or a 4xx refusal from the host, is always voided and never consumes budget. A hosted send is forwarded with the chain the policy priced it on (`chain_id`, else `AGENTWALLET_CHAIN_ID`, else 8453), and a custodian answer naming another chain is written onto the ledger line as a mismatch. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -150,6 +150,68 @@ const SPEND_LAYOUTS = {
     b88d4fde: { kind: 'token', what: 'ERC-721 safeTransferFrom', toIndex: 1, amountIndex: -1, nft: true }, // safeTransferFrom(address,address,uint256,bytes)
     f242432a: { kind: 'token', what: 'ERC-1155 safeTransferFrom', toIndex: 1, amountIndex: 3, nft: true }, // safeTransferFrom(address,address,uint256,uint256,bytes)
     '2eb2c2d6': { kind: 'token', what: 'ERC-1155 safeBatchTransferFrom', toIndex: 1, amountIndex: 3, nft: true, batch: true }, // safeBatchTransferFrom(address,address,uint256[],uint256[],bytes)
+    // Signed allowances (reported privately 2026-11-01, 1.14.9): permit() sets
+    // allowance[owner][spender] exactly as approve() does, and the wallet can
+    // produce the owner's signature in-process, so one send_transaction both
+    // signs and broadcasts a standing allowance. None of these was decoded, so
+    // a permit fell through as a zero-value contract call with no budget line,
+    // no ledger line, no spender check and no unlimited refusal: the 1.14.1
+    // bypass again, through a selector that fix did not cover. The owner word
+    // is not compared with the wallet: a permit relayed for another owner is
+    // counted as if it were the wallet's own, which over-counts, never under.
+    d505accf: { kind: 'approval', what: 'EIP-2612 permit', toIndex: 1, amountIndex: 2 }, // permit(address,address,uint256,uint256,uint8,bytes32,bytes32)
+    '8fcbaf0c': { kind: 'approval', what: 'DAI permit', toIndex: 1, amountIndex: 4, operator: true }, // permit(address,address,uint256,uint256,bool,uint8,bytes32,bytes32): allowed=true is unbounded by construction
+    '2b67b570': { kind: 'approval', what: 'Permit2 permit', toIndex: 5, amountIndex: 2, tokenIndex: 1, permit2Only: true }, // Permit2.permit(address,((address,uint160,uint48,uint48),address,uint256),bytes): PermitSingle is static, so inlined
+    // Sibling shapes of the movers and grants above (reported privately
+    // 2026-11-02, 1.14.10, four reports): the legacy StandardToken
+    // increaseApproval, the ERC-1363 two-argument transferAndCall and
+    // approveAndCall and both transferFromAndCall shapes, the ERC-223 transfer
+    // with data, and the EIP-6909 multi-token movers and grants. Each moves the
+    // token or grants a standing allowance exactly as the shape already decoded
+    // beside it, and each fell through as a zero-value contract call.
+    d73dd623: { kind: 'approval', what: 'increaseApproval', toIndex: 0, amountIndex: 1 }, // increaseApproval(address,uint256)
+    '3177029f': { kind: 'approval', what: 'approveAndCall', toIndex: 0, amountIndex: 1 }, // approveAndCall(address,uint256) (ERC-1363)
+    '1296ee62': { kind: 'token', what: 'transferAndCall', toIndex: 0, amountIndex: 1 }, // transferAndCall(address,uint256) (ERC-1363)
+    d8fbe994: { kind: 'token', what: 'transferFromAndCall', toIndex: 1, amountIndex: 2 }, // transferFromAndCall(address,address,uint256) (ERC-1363)
+    c1d34b89: { kind: 'token', what: 'transferFromAndCall', toIndex: 1, amountIndex: 2 }, // transferFromAndCall(address,address,uint256,bytes) (ERC-1363)
+    be45fd62: { kind: 'token', what: 'ERC-223 transfer', toIndex: 0, amountIndex: 1 }, // transfer(address,uint256,bytes)
+    // EIP-6909: setOperator is the setApprovalForAll of a multi-token contract
+    // (unbounded by construction); the per-id approve and the movers carry an
+    // id word before the amount, and the contract has no decimals or price, so
+    // they are treated as the ERC-1155 shapes are: unpriced, recipient-checked.
+    '558a7297': { kind: 'approval', what: 'EIP-6909 setOperator', toIndex: 0, amountIndex: 1, nft: true, operator: true }, // setOperator(address,bool)
+    '426a8493': { kind: 'approval', what: 'EIP-6909 approve', toIndex: 0, amountIndex: 2, nft: true }, // approve(address,uint256,uint256)
+    '095bcdb6': { kind: 'token', what: 'EIP-6909 transfer', toIndex: 0, amountIndex: 2, nft: true }, // transfer(address,uint256,uint256)
+    fe99049a: { kind: 'token', what: 'EIP-6909 transferFrom', toIndex: 1, amountIndex: 3, nft: true }, // transferFrom(address,address,uint256,uint256)
+    // Redemptions (reported privately 2026-11-02, 1.14.10): a vault or lending
+    // position is the wallet's asset, and its withdraw and redeem calls name a
+    // receiver, so a zero-value call paid the whole position to any address
+    // with nothing reserved. An ERC-4626 vault is itself the share token, so
+    // the spend is recorded under the vault (shares for redeem; for withdraw
+    // the amount is in the underlying, printed at the vault's decimals, which
+    // the standard keeps equal to the underlying's in every common vault), and
+    // priced only if the registry knows it, which a vault never is: refused
+    // under a dollar budget unless unpriced_spends allows, recipient-checked
+    // either way. Aave's Pool.withdraw names the underlying in the calldata, so
+    // that one is priced like a transfer of it. Any other protocol's shape is
+    // outside this table: a policy that holds positions elsewhere should list
+    // recipients.allow and, where it can, the contracts it may call.
+    ba087652: { kind: 'token', what: 'ERC-4626 redeem', toIndex: 1, amountIndex: 0 }, // redeem(uint256,address,address)
+    b460af94: { kind: 'token', what: 'ERC-4626 withdraw', toIndex: 1, amountIndex: 0 }, // withdraw(uint256,address,address)
+    '69328dec': { kind: 'token', what: 'Aave withdraw', toIndex: 2, amountIndex: 1, tokenIndex: 0 }, // Pool.withdraw(address,uint256,address)
+};
+/* The rest of Permit2's surface, by selector: permitBatch, transferFrom (two
+   shapes), lockdown, permitTransferFrom and permitWitnessTransferFrom (two
+   each), invalidateNonces and invalidateUnorderedNonces. Each moves tokens or
+   changes what may be moved, in shapes this table does not price (a batch is
+   several allowances in one call), so under a policy such a call to the
+   chain's Permit2 is refused rather than let through as a zero-value call to
+   "some contract" (1.14.9). The local token cap has refused the same calls
+   since the 2026-10-04 audit. */
+const PERMIT2_OTHER = {
+    '2a2d80d1': 'permit (batch)', '36c78516': 'transferFrom', '0d58b1db': 'transferFrom (batch)', cc53287f: 'lockdown',
+    '30f28b7a': 'permitTransferFrom', edd9444b: 'permitTransferFrom (batch)', '137c29fe': 'permitWitnessTransferFrom', fe8ec1a7: 'permitWitnessTransferFrom (batch)',
+    '3ff9dcb1': 'invalidateNonces', '65d9723c': 'invalidateUnorderedNonces',
 };
 const UNBOUNDED_APPROVAL = 1n << 128n;
 const UINT256_MAX = (1n << 256n) - 1n;
@@ -248,6 +310,13 @@ async function describeSend(body, chainId) {
             }
             return { kind: layout.kind, to: counterparty, asset: token, raw: amount.toString(), decimals, ...(carried ? { carried } : {}) };
         }
+        // Every priced layout has returned by now; a Permit2 target here is a call
+        // the table does not know.
+        if (isPermit2 && POLICY.path) {
+            const other = PERMIT2_OTHER[data.slice(2, 10).toLowerCase()];
+            throw new Error(`policy: calldata selector 0x${data.slice(2, 10)} aimed at Permit2 is ${other ? `Permit2 ${other}` : 'not a Permit2 call this policy can price'}, which moves tokens or changes what may be moved in a shape the policy cannot count; ` +
+                `refused rather than treated as a plain contract call. Use Permit2 approve or a single permit, each of which is reserved as an approval. Nothing was signed.`);
+        }
     }
     if (data && data !== '0x')
         return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
@@ -369,7 +438,13 @@ function localChainId(body, qs) {
     const fromEnv = (process.env.AGENTWALLET_CHAIN_ID || '').trim();
     if (fromEnv)
         return parseInt(fromEnv, 10);
-    return 8453; // Base, matching the custodial default
+    // Base. This used to say "matching the custodial default", and it did not:
+    // the hosted signer falls back to chain 1 when a body names no chain, so a
+    // chain-less hosted send was priced and ledgered here on 8453 and executed
+    // there on Ethereum (reported privately 2026-11-02, 1.14.10). The hosted
+    // path now writes the chain it priced into the body it forwards (api()), so
+    // whatever this returns, the custodian is told the same chain.
+    return 8453;
 }
 /**
  * Refuse rather than silently hand the operation to someone else's signer.
@@ -552,8 +627,18 @@ async function api(path, method = 'GET', body, extraHeaders) {
     // signature (body.message) moves nothing and is not gated.
     const m = /^\/wallets\/([^/]+)\/(send|sign)(\?|$)/.exec(path);
     const signsTx = m !== null && (m[2] === 'send' || typeof body?.message !== 'string');
+    let reservedChain = null;
     if (method === 'POST' && m && body && signsTx) {
         const chainId = localChainId(body, new URLSearchParams(path.split('?')[1] || ''));
+        // The custodian must execute on the chain the policy priced. A body with
+        // no chain_id used to go out as it came and the hosted signer chose its
+        // own default (chain 1), while the ledger said 8453 (reported privately
+        // 2026-11-02, 1.14.10). The chain is written into the body here, before
+        // the decode, so the two cannot differ; the custodian's answer is still
+        // compared with it below.
+        if (!anyLocalMode() && typeof body.chain_id !== 'number')
+            body = { ...body, chain_id: chainId };
+        reservedChain = chainId;
         const d = await describeSend(body, chainId);
         assertSendTarget(d, chainId);
         const tool = ctx.tool || (m[2] === 'sign' ? 'sign_transaction' : 'send');
@@ -572,12 +657,21 @@ async function api(path, method = 'GET', body, extraHeaders) {
     }
     try {
         const out = await apiInner(path, method, body, extraHeaders);
+        // A custodian that answers with a chain other than the one it was asked
+        // for executed somewhere the ledger did not count; the line cannot be
+        // re-booked (the spend is live), so the mismatch is written onto it and
+        // onto stderr for the operator.
+        const reported = out?.chain_id;
+        const mismatch = reserved.length && reservedChain !== null && typeof reported === 'number' && reported !== reservedChain
+            ? ` CHAIN MISMATCH: reserved on chain ${reservedChain}, the API host reports chain ${reported}; the budget of chain ${reported} did not count this spend.` : '';
+        if (mismatch)
+            console.error(`[agentwallet] ${path}:${mismatch}`);
         for (const seq of reserved) {
             const r = out;
             if (m[2] === 'sign')
-                LEDGER.settle(seq, 'signed', 'raw transaction returned to the caller; not broadcast by this process, so it stays counted');
+                LEDGER.settle(seq, 'signed', 'raw transaction returned to the caller; not broadcast by this process, so it stays counted' + mismatch);
             else
-                LEDGER.settle(seq, 'broadcast', typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : null);
+                LEDGER.settle(seq, 'broadcast', (typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : '') + mismatch || null);
         }
         return out;
     }
@@ -681,6 +775,21 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
     }
     if (!res.ok) {
         const error = serverText(data.error) || `HTTP ${res.status}`;
+        // The host was reached and answered. A 4xx is its refusal and the
+        // reservation is voided; a 5xx on a send or sign came after it took the
+        // request, and the custodian may have broadcast before whatever failed
+        // (a downstream write, a proxy), so the spend stays counted as unknown.
+        // Until 1.14.10 every non-2xx voided, and a 500 that carried the
+        // transaction hash in its body restored the whole budget and dropped
+        // the hash (reported privately 2026-11-02).
+        if (method === 'POST' && /^\/wallets\/[^/]+\/(send|sign)(\?|$)/.test(path)) {
+            const d = data;
+            const hash = looksLikeTxHash(d?.tx_hash) ? d.tx_hash : typeof d?.signature === 'string' && /^[1-9A-HJ-NP-Za-km-z]{43,120}$/.test(d.signature) ? d.signature : null;
+            if (hash)
+                throw markMaybeLive(new Error(`${error} The AgentWallet API host answered ${path} with HTTP ${res.status} but reported a transaction (${hash}), so the spend is live and stays counted; check the wallet's history before retrying.`));
+            if (res.status >= 500)
+                throw markMaybeLive(new Error(`${error} The AgentWallet API host answered ${path} with HTTP ${res.status} after taking the request; whether the custodian broadcast is unknown, so the spend stays counted. Check the wallet's history before retrying.`));
+        }
         throw new Error(error);
     }
     // A send that comes back without a hash was not sent, whatever the body says
@@ -861,12 +970,24 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
     const { tokenAddress, rawAmount, decimals } = deriveX402Payment(accept, maxAutopay, trustedDecimals);
     // A hostile or broken host that answers 402 on every call must not drain the
     // wallet one cap at a time: at most AUTOPAY_PER_HOUR payments an hour (round 3).
+    // The slot is taken here, synchronously, before anything is awaited: the
+    // count used to be read here and written after the payment, so eight calls
+    // pipelined at once all read 0 and all paid under a limit of 2 (reported
+    // privately 2026-11-02, 1.14.10). A payment that never left this process
+    // gives its slot back below; one that may be live keeps it. The ledger's
+    // own auto-pay lines are counted too, so several processes sharing one
+    // ledger share the hour; without a ledger file the count is per process.
     const hourAgo = Date.now() - 3_600_000;
     while (autopayLog.length && autopayLog[0] < hourAgo)
         autopayLog.shift();
-    if (autopayLog.length >= AUTOPAY_PER_HOUR) {
-        throw new Error(`x402 auto-pay: ${autopayLog.length} automatic payments were already made in the last hour (AGENTWALLET_MAX_AUTOPAY_PER_HOUR=${AUTOPAY_PER_HOUR}); refusing another. Original error: ${serverText(x402Data.error)}`);
-    }
+    const made = Math.max(autopayLog.length, LEDGER.countSince('autopay', hourAgo));
+    if (made >= AUTOPAY_PER_HOUR) {
+        throw new Error(`x402 auto-pay: ${made} automatic payments were already made in the last hour (AGENTWALLET_MAX_AUTOPAY_PER_HOUR=${AUTOPAY_PER_HOUR}); refusing another. Original error: ${serverText(x402Data.error)}`);
+    }
+    const slot = Date.now();
+    autopayLog.push(slot);
+    const giveBack = () => { const i = autopayLog.indexOf(slot); if (i >= 0)
+        autopayLog.splice(i, 1); };
     // Send payment using our wallet (with X-AGW-SKIP-X402 to prevent recursion).
     // The ledger context names the API host and route; the /send hook reserves and settles the spend.
     const ctx = { 'X-AGW-SKIP-X402': 'true', 'X-AGW-CTX': JSON.stringify({ tool: 'autopay', host: hostOf(API_BASE), resource: `${originalMethod} ${originalPath.split('?')[0]}`, method: 'autopay' }) };
@@ -890,12 +1011,13 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
         }
     }
     catch (e) {
+        if (!isMaybeLive(e))
+            giveBack(); // refused, or never reached the host: the slot is free again
         throw new Error(`x402 auto-pay failed: ${e.message}. Original error: ${serverText(x402Data.error)}`);
     }
     if (!txHash) {
-        throw new Error('x402 auto-pay: no transaction hash returned.');
+        throw new Error('x402 auto-pay: no transaction hash returned.'); // the host answered the send; the slot stays taken
     }
-    autopayLog.push(Date.now());
     const autopayNotice = {
         amount: formatUnits(rawAmount, decimals), token: assetLabel(chainId, tokenAddress), pay_to: payTo, chain_id: chainId, tx_hash: txHash,
         route: `${originalMethod} ${originalPath}`,
@@ -1255,7 +1377,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.8',
+    version: '1.14.10',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/ledger.d.ts

@@ -110,6 +110,8 @@ export declare class Ledger {
     private liveSpends;
     /** Dollar sums over rolling windows from a fresh read of the file; nowMs for tests. */
     spentUsd(nowMs?: number, host?: string): Spent;
+    /** Live spends (not voided) with this method written since `sinceMs`, from a fresh read: the hourly auto-pay count across every process sharing the file (1.14.10). */
+    countSince(method: SpendMethod, sinceMs: number): number;
     spentNative(chainId: number, nowMs?: number): Spent;
     private sumUsd;
     private sumNative;

package/build/ledger.js

@@ -185,6 +185,11 @@ export class Ledger {
         this.sync();
         return this.sumUsd(nowMs, host);
     }
+    /** Live spends (not voided) with this method written since `sinceMs`, from a fresh read: the hourly auto-pay count across every process sharing the file (1.14.10). */
+    countSince(method, sinceMs) {
+        this.sync();
+        return this.liveSpends().filter(e => e.method === method && Date.parse(e.ts) >= sinceMs).length;
+    }
     spentNative(chainId, nowMs = Date.now()) {
         this.sync();
         return this.sumNative(chainId, nowMs);
@@ -223,9 +228,21 @@ export class Ledger {
             return { ok: false, reason: `The ledger at ${this.path} is not intact (${this.integrity}); every spend is refused until the operator has looked at it.` };
         const amount18 = rawToUnits(input.raw, input.decimals);
         if (input.asset === '') {
-            const r = refusal(limits.native, this.sumNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
-            if (r)
-                return { ok: false, reason: r };
+            // The chain's own coin is counted by native_budget alone; the dollar
+            // budget has no price for it. Until 1.14.10 a chain with no
+            // native_budget entry fell through here with nothing checked, so a
+            // policy of "budget daily 0.5, unpriced_spends refuse" bounded every
+            // stablecoin payment and no native one (reported privately
+            // 2026-11-02). Now such a spend is what it is to the dollar budget, an
+            // unpriced spend, and the unpriced rule decides it.
+            if (limits.native) {
+                const r = refusal(limits.native, this.sumNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
+                if (r)
+                    return { ok: false, reason: r };
+            }
+            else if (limits.unpriced === 'refuse' && (limits.usd || limits.host)) {
+                return { ok: false, reason: `policy: ${input.assetLabel} on chain ${input.chainId} is the chain's own coin, which the dollar budget cannot price, and the policy has no native_budget.${input.chainId}; refused (add native_budget.${input.chainId} to the policy to count it, or set unpriced_spends to "allow" to let native spends through uncounted). Nothing was signed.` };
+            }
         }
         else if (input.usd === null) {
             if (limits.unpriced === 'refuse' && (limits.usd || limits.host)) {

package/build/local-wallet.js

@@ -337,7 +337,8 @@ const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516
    and so read as "not a token" to the cap, which let setApprovalForAll to an
    attacker through uncapped (2026-10-04 round 2, verified on a live
    collection). Nothing prices an NFT, so these are refused outright. */
-const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6', '959b8c3f']); // plus ERC-777 authorizeOperator: an unbounded delegation
+const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6', '959b8c3f', // plus ERC-777 authorizeOperator: an unbounded delegation
+    '558a7297', '426a8493', '095bcdb6', 'fe99049a']); // EIP-6909 setOperator, approve, transfer, transferFrom: a multi-token contract has no decimals() either (1.14.10)
 const CAP_LAYOUTS = {
     a9059cbb: { amountIndex: 1, what: 'token transfer' }, // transfer(address,uint256)
     '23b872dd': { amountIndex: 2, what: 'token transfer' }, // transferFrom(address,address,uint256)
@@ -351,6 +352,22 @@ const CAP_LAYOUTS = {
     '9bd9bbc6': { amountIndex: 1, what: 'token transfer (ERC-777 send)' }, // send(address,uint256,bytes)
     '62ad1b83': { amountIndex: 2, what: 'token transfer (ERC-777 operatorSend)' }, // operatorSend(address,address,uint256,bytes,bytes)
     '87517c45': { amountIndex: 2, tokenIndex: 0, what: 'Permit2 approval' }, // Permit2.approve(address,address,uint160,uint48)
+    // EIP-2612 permit sets the allowance exactly as approve does, with the
+    // owner's signature in the calldata (the local key can produce it), so it
+    // is priced as an approval (1.14.9, reported privately 2026-11-01). The DAI
+    // permit (0x8fcbaf0c, a bool grant) and Permit2.permit stay unpriced here
+    // and are refused by the rule below, as every unpriced call to a token or to
+    // Permit2 is; the spend policy classifies both.
+    d505accf: { amountIndex: 2, what: 'approval (EIP-2612 permit)' }, // permit(address,address,uint256,uint256,uint8,bytes32,bytes32)
+    // Sibling shapes priced by the spend policy since 1.14.10 (reported
+    // privately 2026-11-02): the same amount word, the same treatment, so the
+    // two guards keep pricing the same calls.
+    d73dd623: { amountIndex: 1, what: 'approval (increaseApproval)' }, // increaseApproval(address,uint256)
+    '3177029f': { amountIndex: 1, what: 'approval (approveAndCall)' }, // approveAndCall(address,uint256)
+    '1296ee62': { amountIndex: 1, what: 'token transfer (transferAndCall)' }, // transferAndCall(address,uint256)
+    d8fbe994: { amountIndex: 2, what: 'token transfer (transferFromAndCall)' }, // transferFromAndCall(address,address,uint256)
+    c1d34b89: { amountIndex: 2, what: 'token transfer (transferFromAndCall)' }, // transferFromAndCall(address,address,uint256,bytes)
+    be45fd62: { amountIndex: 1, what: 'token transfer (ERC-223)' }, // transfer(address,uint256,bytes)
     // WETH9 calls, priced only when `to` is the chain's own wrapped-native
     // contract (wrappedNativeOnly). deposit() carries its amount as msg.value,
     // not in calldata, hence amountIndex -1; withdraw(uint256) has it at word 0.
@@ -404,12 +421,12 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
                 ? `the RPC for chain ${chainId} could not be reached to classify the target, so the guard cannot tell a token from a router`
                 : `the target is ${isPermit2 ? 'Permit2' : 'a token contract'} and this calldata is not one AGENTWALLET_MAX_TX_TOKEN can price`;
             throw new Error(`Blocked by local guard: calldata selector 0x${selector} refused rather than let through uncapped: ${why}. ` +
-                `Use transfer, transferFrom, approve, increaseAllowance, Permit2 approve, ` +
+                `Use transfer, transferFrom, approve, increaseAllowance, EIP-2612 permit, Permit2 approve, ` +
                 `or deposit/withdraw on the chain's wrapped-native contract, ` +
                 `or ask the operator, who alone can set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1.`);
         }
         if (NFT_SELECTORS.has(selector)) {
-            throw new Error(`Blocked by local guard: calldata selector 0x${selector} is an NFT approval or transfer (ERC-721/1155) aimed at ${to}; AGENTWALLET_MAX_TX_TOKEN cannot price it, ` +
+            throw new Error(`Blocked by local guard: calldata selector 0x${selector} is an NFT approval or transfer (ERC-721/1155, or an EIP-6909 multi-token call) aimed at ${to}; AGENTWALLET_MAX_TX_TOKEN cannot price it, ` +
                 `so it is refused rather than let through uncapped. Only the operator can allow it (AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1).`);
         }
         if (PERMIT2_SELECTORS.has(selector)) {

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.8",
+  "version": "1.14.10",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",