agentwallet-mcp 1.14.9 → 1.14.11

package/README.md

@@ -119,7 +119,7 @@ Add to your config:
 }
 ```
 
-> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet. Only the metered routes (creating a wallet, signing, sending) are paid this way, at most `AGENTWALLET_MAX_AUTOPAY_PER_HOUR` times an hour (default 20), and every automatic payment is reported in the tool result under `autopay_payment`. A 402 on any other route is reported, never paid.
+> `AGENTWALLET_WALLET_ID` is optional. Set it to enable x402 auto-pay: when you exceed the free tier without a credit card, the MCP server automatically pays for operations with USDC from this wallet. Only the metered routes (creating a wallet, signing, sending) are paid this way, at most `AGENTWALLET_MAX_AUTOPAY_PER_HOUR` times an hour (default 20; the slot is taken before the payment is sent, so parallel calls cannot overrun it, and processes sharing a ledger file share the hour, while without one the count is per process), and every automatic payment is reported in the tool result under `autopay_payment`. A 402 on any other route is reported, never paid.
 >
 > **Auto-pay safety cap.** `AGENTWALLET_MAX_AUTOPAY` (optional, default `1`) is the most one x402 payment may authorize, in stablecoin units: `1` means one dollar. It prices registry stablecoins only (USDC, USDT, USDbC, DAI on the supported chains, USDC and USDT on Solana). A requirement in the chain's native asset or in any other token is refused, because "1" measured in ETH is a few thousand dollars; list such assets in `AGENTWALLET_AUTOPAY_ASSETS` (comma-separated addresses or mints, or the word `native`) to allow them, and the cap then applies in that asset's own units. Any requirement above the cap is rejected instead of paid, so a malformed or tampered payment requirement cannot drain the wallet. This automatic path settles `exact` requirements only; an `upto` offer from the API is refused before any wallet call, because paying a usage maximum upfront is not what the offer means (use `pay_x402`, which signs a Permit2 authorization for it). The cap is the operator's ceiling: a `max_payment` argument can lower it for one call but never raise it. Raise the variable itself if you genuinely need larger automatic payments (for example `"5"` for up to 5 USDC per call).
 
@@ -369,23 +369,25 @@ A per-transaction cap bounds one signature. It cannot see that the five hundredt
   "per_host": { "*.example.com": { "daily": "2", "per_payment": "0.25" } },
   "recipients": { "deny": ["0x0000000000000000000000000000000000000000"] },
   "chains": { "allow": [8453, 900] },
+  "contracts": { "allow": ["8453:0x2626664c2603336E57B271c5C0b26F421741e481"] },
   "approval": { "above": "0.50", "max": "20" },
   "tools": { "allow": ["pay_x402", "quote_x402", "discover_x402", "get_balance", "list_payments", "spend_policy", "wallet_mode"] }
 }
 ```
 
 - **`budget`**: rolling dollar budgets (last 24 hours, last 30 days, lifetime) across every chain, counting x402 payments, stablecoin transfers and stablecoin approvals in registry stablecoins. A spend the budget cannot price (a token outside the registry) is refused while a budget is set, unless `"unpriced_spends": "allow"`. An SPL send is priced at the mint's own decimals; a `token_decimals` hint that disagrees with the mint is refused before any request is made.
-- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it).
-- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An NFT operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`) is unbounded by construction and refused the same way, and an ERC-721 or ERC-1155 transfer is a spend of the collection to the recipient that no budget can price, so it is refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A zero-value call to any other contract (a router, a bridge) reserves nothing: it can only pull what an approval already granted. The exception is Permit2 itself: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy, since each moves tokens or changes what may be moved.
+- **`native_budget`**: the same per chain, in the chain's own coin, counting native transfers, native x402 payments and the native value sent into any contract (`wrap_eth`, `send_transaction` with value and calldata), including value carried on a token transfer or approval call (a payable token contract keeps it, so it is a second spend, to that contract) and, in local Solana mode, the rent an SPL send pays to create the recipient's token account (the recipient owns that account and can close it for the lamports; the ledger records it as its own line, method `rent`, to the recipient, and `assets.allow` does not need to list `native` for it). The dollar budget has no price for the chain's coin, so on a chain with no `native_budget` entry a native spend is an unpriced spend: refused while a `budget` or a `per_host` ceiling is set, unless `"unpriced_spends": "allow"`. Give every chain the wallet spends on an entry.
+- **Approvals are spends.** An ERC-20 allowance (`approve_token`, `approve_permit2`, `increaseAllowance`, `increaseApproval`, either `approveAndCall`, Permit2 `approve`, a signed `permit` in its EIP-2612, DAI or Permit2 shape, or the same calldata through `send_transaction`) is what the spender will take later, so it is priced, checked and reserved on the ledger when it is granted, the spender is checked against the recipient lists, and an unlimited approval (2^128 base units or more) is refused, since no budget can count it; grant an exact amount. An operator grant (`setApprovalForAll`, ERC-777 `authorizeOperator`, EIP-6909 `setOperator`) is unbounded by construction and refused the same way. Every token mover the standards define is a spend to its recipient: ERC-20 `transfer` and `transferFrom`, the ERC-677 and ERC-1363 `transferAndCall` and `transferFromAndCall` shapes, the ERC-223 `transfer` with data, ERC-777 `send` and `operatorSend`, and the ERC-721, ERC-1155 and EIP-6909 transfers, which no budget can price and so are refused under a dollar budget unless `unpriced_spends` is `"allow"`, with the recipient checked either way. A redemption of the wallet's own position is a spend too: ERC-4626 `redeem` and `withdraw` are spends of the vault to the receiver (unpriced, like an NFT), and Aave `Pool.withdraw` is a transfer of the underlying to the receiver. A call to any other contract (a router, a bridge, a protocol whose payout shape is not listed here) is refused under a policy unless the contract is in `contracts.allow` or `unknown_calls` is `"allow"`, since 1.14.11: the policy cannot tell what such a call moves, so the operator decides which contracts may receive one. A listed contract's unpriced call reserves nothing beyond the native value it carries: it can only pull what an approval already granted, or pay out a position in a shape the policy does not know, so a policy that lists protocol contracts should set `recipients.allow` too. Permit2 is never admitted this way: a call to it that the policy cannot price (`permitBatch`, `transferFrom`, `permitTransferFrom`, `lockdown`, nonce invalidation, or an unknown selector) is refused under a policy whatever the lists say, since each moves tokens or changes what may be moved.
 - **`hosts`**, **`per_host`**: which endpoints `pay_x402` may pay, and how much per host per day, per month and per payment. A denied host is never contacted, not even for a quote. A host is matched by its canonical DNS name (lowercase, the root label's trailing dot removed), so `api.example.com.` and its percent-encoded spelling are `api.example.com` to every list and to the ledger's per-host sums.
-- **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a zero-value call is aimed at (a token being approved, a router) is checked against the deny list and the chain list.
+- **`recipients`**: where funds may go (transfers, x402 `payTo`, approval spenders, contracts that receive native value). The allow list covers those funds destinations; the contract a call is aimed at (a token being approved, a router) is checked against the deny list, the chain list and the `contracts` lists.
 - **`chains`**, **`assets`**: allow lists; an asset entry can be scoped `"8453:0x..."` or be the word `native`.
+- **`contracts`**, **`unknown_calls`**: what the wallet may call with calldata the policy cannot price. The policy prices the token movers, approvals, permits and redemptions listed under "Approvals are spends" below; any other calldata (a swap, a bridge, a protocol call) is refused under a policy unless the contract is in `contracts.allow` (entries scoped `"8453:0x..."` or bare), because a shape the policy does not know could be moving anything. `"unknown_calls": "allow"` restores the pre-1.14.11 behaviour of passing such calls as zero-value contract calls, with their native value still counted. `contracts.deny` refuses every call to a contract, priced or not. Without a policy nothing is refused on this ground.
 - **`approval`**: above `above`, every x402 payment is put to the human at the MCP client through [elicitation](https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation) (the client shows the amount, token, recipient and resource and asks yes or no; a client that declared no elicitation support cannot answer, so the payment is refused). In local mode an accepted answer may admit a payment above the per-payment cap, up to `max`. Budgets are never lifted by anyone's approval.
 - **`tools`**: the tools the model sees. A payer-only deployment exposes seven; the rest are not registered. `wallet_mode` and `spend_policy` are always present so the operator can see what the server is.
 
 An unknown key stops the server, so a misspelled `budgets` cannot run unbounded. `spend_policy` reports the file, its sha256 (compare it with the file you reviewed), what each budget has spent and has left, and which tools the policy hid. `quote_x402` answers "would this be paid?" for a URL before anything is signed.
 
-**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, is always voided and never consumes budget. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
+**The ledger.** Budgets are enforced from an append-only, hash-chained JSONL file (`AGENTWALLET_LEDGER`, or the policy's `ledger`, or `agentwallet-ledger.jsonl` beside the policy when a budget needs one). A spend is reserved on it before the signature exists; a reservation whose signing fails is voided by a later line; the endpoint's or chain's answer is settled onto it afterwards. A spend that may already be on the wire (a broadcast that failed after the bytes left, a hosted request the API host took and then dropped or answered with a 5xx, any host answer that carries a transaction hash) is kept counted as `unknown` rather than voided; a failure before anything left this process, including a policy or local-mode refusal, or a 4xx refusal from the host, is always voided and never consumes budget. A hosted send is forwarded with the chain the policy priced it on (`chain_id`, else `AGENTWALLET_CHAIN_ID`, else 8453), and a custodian answer naming another chain is written onto the ledger line as a mismatch. The chain is verified on every read, and a ledger that does not verify refuses every spend until the operator has looked at it. Several agentwallet-mcp processes may share one ledger (two MCP clients on one wallet): the file is re-read before every check, and the check-and-append step holds an exclusive lock file (`<ledger>.lock`) across processes, so the budget is one budget however many processes enforce it; a lock older than 30 seconds is treated as left by a dead process. A transaction signed without being broadcast (`sign_transaction`) is reserved and counted like a send, since whoever holds it can broadcast it. A call that moves two things (a token transfer that also carries native value) is two lines, reserved in turn and released together when either is refused. `list_payments` reads it, `export_receipts` turns it into CSV or JSONL, and `AGENTWALLET_WEBHOOK_URL` receives every line as it is written.
 
 ### Encrypted keyfiles
 

package/build/index.js

@@ -28,13 +28,13 @@ import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDe
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto, probeTokenDecimals, assertRpcServesChain } from './local-wallet.js';
-import { WRAPPED_NATIVE } from './wrapped-native.js';
+import { WRAPPED_NATIVE, wrappedNativeAddress } from './wrapped-native.js';
 import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
 import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, decodeAbiString as decodeDomainString, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, sanitizeRequired, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, splAccountRent, } from './local-solana.js';
 import { localSimulate } from './local-wallet.js';
-import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
+import { loadPolicy, describePolicy, hostAllowed, recipientAllowed, targetAllowed, unknownCallAllowed, chainAllowed, assetAllowed, perHostRule, toolAllowed, hostOf, budgetReport, units as policyUnits, human as policyHuman, rawToUnits, } from './policy.js';
 import { Ledger } from './ledger.js';
 import { markMaybeLive, isMaybeLive, carryMaybeLive, connectionNeverMade } from './maybe-live.js';
 import { discover } from './discovery.js';
@@ -121,6 +121,8 @@ function spendVerdict(input) {
 function usdOf(chainId, asset, raw, decimals) {
     return autopayAssetAllowed(chainId, asset).via === 'stablecoin' ? policyHuman(rawToUnits(raw, decimals)) : null;
 }
+/** WETH9 deposit() and withdraw(uint256): known shapes when aimed at the chain's own wrapped-native contract (wrap_eth, unwrap_eth). */
+const WRAPPED_NATIVE_SELECTORS = new Set(['d0e30db0', '2e1a7d4d']);
 /* Calldata the policy prices: which word holds the amount, which the recipient
    or spender, and for Permit2.approve which the token (there `to` is Permit2).
    The same functions the local token cap prices, so the two guards agree. */
@@ -162,6 +164,43 @@ const SPEND_LAYOUTS = {
     d505accf: { kind: 'approval', what: 'EIP-2612 permit', toIndex: 1, amountIndex: 2 }, // permit(address,address,uint256,uint256,uint8,bytes32,bytes32)
     '8fcbaf0c': { kind: 'approval', what: 'DAI permit', toIndex: 1, amountIndex: 4, operator: true }, // permit(address,address,uint256,uint256,bool,uint8,bytes32,bytes32): allowed=true is unbounded by construction
     '2b67b570': { kind: 'approval', what: 'Permit2 permit', toIndex: 5, amountIndex: 2, tokenIndex: 1, permit2Only: true }, // Permit2.permit(address,((address,uint160,uint48,uint48),address,uint256),bytes): PermitSingle is static, so inlined
+    // Sibling shapes of the movers and grants above (reported privately
+    // 2026-11-02, 1.14.10, four reports): the legacy StandardToken
+    // increaseApproval, the ERC-1363 two-argument transferAndCall and
+    // approveAndCall and both transferFromAndCall shapes, the ERC-223 transfer
+    // with data, and the EIP-6909 multi-token movers and grants. Each moves the
+    // token or grants a standing allowance exactly as the shape already decoded
+    // beside it, and each fell through as a zero-value contract call.
+    d73dd623: { kind: 'approval', what: 'increaseApproval', toIndex: 0, amountIndex: 1 }, // increaseApproval(address,uint256)
+    '3177029f': { kind: 'approval', what: 'approveAndCall', toIndex: 0, amountIndex: 1 }, // approveAndCall(address,uint256) (ERC-1363)
+    '1296ee62': { kind: 'token', what: 'transferAndCall', toIndex: 0, amountIndex: 1 }, // transferAndCall(address,uint256) (ERC-1363)
+    d8fbe994: { kind: 'token', what: 'transferFromAndCall', toIndex: 1, amountIndex: 2 }, // transferFromAndCall(address,address,uint256) (ERC-1363)
+    c1d34b89: { kind: 'token', what: 'transferFromAndCall', toIndex: 1, amountIndex: 2 }, // transferFromAndCall(address,address,uint256,bytes) (ERC-1363)
+    be45fd62: { kind: 'token', what: 'ERC-223 transfer', toIndex: 0, amountIndex: 1 }, // transfer(address,uint256,bytes)
+    // EIP-6909: setOperator is the setApprovalForAll of a multi-token contract
+    // (unbounded by construction); the per-id approve and the movers carry an
+    // id word before the amount, and the contract has no decimals or price, so
+    // they are treated as the ERC-1155 shapes are: unpriced, recipient-checked.
+    '558a7297': { kind: 'approval', what: 'EIP-6909 setOperator', toIndex: 0, amountIndex: 1, nft: true, operator: true }, // setOperator(address,bool)
+    '426a8493': { kind: 'approval', what: 'EIP-6909 approve', toIndex: 0, amountIndex: 2, nft: true }, // approve(address,uint256,uint256)
+    '095bcdb6': { kind: 'token', what: 'EIP-6909 transfer', toIndex: 0, amountIndex: 2, nft: true }, // transfer(address,uint256,uint256)
+    fe99049a: { kind: 'token', what: 'EIP-6909 transferFrom', toIndex: 1, amountIndex: 3, nft: true }, // transferFrom(address,address,uint256,uint256)
+    // Redemptions (reported privately 2026-11-02, 1.14.10): a vault or lending
+    // position is the wallet's asset, and its withdraw and redeem calls name a
+    // receiver, so a zero-value call paid the whole position to any address
+    // with nothing reserved. An ERC-4626 vault is itself the share token, so
+    // the spend is recorded under the vault (shares for redeem; for withdraw
+    // the amount is in the underlying, printed at the vault's decimals, which
+    // the standard keeps equal to the underlying's in every common vault), and
+    // priced only if the registry knows it, which a vault never is: refused
+    // under a dollar budget unless unpriced_spends allows, recipient-checked
+    // either way. Aave's Pool.withdraw names the underlying in the calldata, so
+    // that one is priced like a transfer of it. Any other protocol's shape is
+    // outside this table: a policy that holds positions elsewhere should list
+    // recipients.allow and, where it can, the contracts it may call.
+    ba087652: { kind: 'token', what: 'ERC-4626 redeem', toIndex: 1, amountIndex: 0 }, // redeem(uint256,address,address)
+    b460af94: { kind: 'token', what: 'ERC-4626 withdraw', toIndex: 1, amountIndex: 0 }, // withdraw(uint256,address,address)
+    '69328dec': { kind: 'token', what: 'Aave withdraw', toIndex: 2, amountIndex: 1, tokenIndex: 0 }, // Pool.withdraw(address,uint256,address)
 };
 /* The rest of Permit2's surface, by selector: permitBatch, transferFrom (two
    shapes), lockdown, permitTransferFrom and permitWitnessTransferFrom (two
@@ -281,8 +320,15 @@ async function describeSend(body, chainId) {
                 `refused rather than treated as a plain contract call. Use Permit2 approve or a single permit, each of which is reserved as an approval. Nothing was signed.`);
         }
     }
-    if (data && data !== '0x')
-        return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
+    if (data && data !== '0x') {
+        // A shape the table does not know. Under a policy it is refused unless
+        // the operator listed the contract (assertSendTarget, 1.14.11); the
+        // chain's wrapped-native deposit and withdraw are known shapes, since
+        // wrap_eth and unwrap_eth build them.
+        const selector = /^0x[0-9a-fA-F]{8}/.test(data) ? data.slice(0, 10).toLowerCase() : data.slice(0, 10);
+        const isWrapped = to.toLowerCase() === wrappedNativeAddress(chainId) && WRAPPED_NATIVE_SELECTORS.has(selector.slice(2));
+        return { kind: 'contract', to, asset: '', raw: value, decimals: nativeDecimals(chainId), ...(isWrapped ? {} : { unknown: selector }) };
+    }
     return { kind: 'native', to, asset: '', raw: value, decimals: nativeDecimals(chainId) };
 }
 /** The ledger method a decoded send is recorded under, unless the caller named one. */
@@ -300,15 +346,28 @@ function assertSendTarget(d, chainId) {
     if (!c.ok)
         throw new Error(c.reason + ' Nothing was signed.');
     if (d.kind === 'contract' || d.kind === 'approval') {
-        const t = targetAllowed(POL(), d.kind === 'approval' ? d.asset : d.to);
+        const t = targetAllowed(POL(), d.kind === 'approval' ? d.asset : d.to, chainId);
+        if (!t.ok)
+            throw new Error(t.reason + ' Nothing was signed.');
+    }
+    if (d.kind === 'token' && d.asset) {
+        const t = targetAllowed(POL(), d.asset, chainId); // the token or vault being moved; contracts.deny binds it
         if (!t.ok)
             throw new Error(t.reason + ' Nothing was signed.');
     }
     if (d.carried) {
-        const t = targetAllowed(POL(), d.carried.to); // the contract that keeps the value
+        const t = targetAllowed(POL(), d.carried.to, chainId); // the contract that keeps the value
         if (!t.ok)
             throw new Error(t.reason + ' Nothing was signed.');
     }
+    // Calldata the table cannot price is the operator's call, not the table's
+    // (1.14.11). Without a policy nothing changes: the local caps and the
+    // hosted signer judge the call on their own terms, as before.
+    if (d.unknown && POLICY.path) {
+        const u = unknownCallAllowed(POL(), chainId, d.to, d.unknown);
+        if (!u.ok)
+            throw new Error(u.reason + ' Nothing was signed.');
+    }
 }
 /**
  * The spends a decoded send makes against the policy, in the order they are
@@ -401,7 +460,13 @@ function localChainId(body, qs) {
     const fromEnv = (process.env.AGENTWALLET_CHAIN_ID || '').trim();
     if (fromEnv)
         return parseInt(fromEnv, 10);
-    return 8453; // Base, matching the custodial default
+    // Base. This used to say "matching the custodial default", and it did not:
+    // the hosted signer falls back to chain 1 when a body names no chain, so a
+    // chain-less hosted send was priced and ledgered here on 8453 and executed
+    // there on Ethereum (reported privately 2026-11-02, 1.14.10). The hosted
+    // path now writes the chain it priced into the body it forwards (api()), so
+    // whatever this returns, the custodian is told the same chain.
+    return 8453;
 }
 /**
  * Refuse rather than silently hand the operation to someone else's signer.
@@ -584,8 +649,18 @@ async function api(path, method = 'GET', body, extraHeaders) {
     // signature (body.message) moves nothing and is not gated.
     const m = /^\/wallets\/([^/]+)\/(send|sign)(\?|$)/.exec(path);
     const signsTx = m !== null && (m[2] === 'send' || typeof body?.message !== 'string');
+    let reservedChain = null;
     if (method === 'POST' && m && body && signsTx) {
         const chainId = localChainId(body, new URLSearchParams(path.split('?')[1] || ''));
+        // The custodian must execute on the chain the policy priced. A body with
+        // no chain_id used to go out as it came and the hosted signer chose its
+        // own default (chain 1), while the ledger said 8453 (reported privately
+        // 2026-11-02, 1.14.10). The chain is written into the body here, before
+        // the decode, so the two cannot differ; the custodian's answer is still
+        // compared with it below.
+        if (!anyLocalMode() && typeof body.chain_id !== 'number')
+            body = { ...body, chain_id: chainId };
+        reservedChain = chainId;
         const d = await describeSend(body, chainId);
         assertSendTarget(d, chainId);
         const tool = ctx.tool || (m[2] === 'sign' ? 'sign_transaction' : 'send');
@@ -604,12 +679,21 @@ async function api(path, method = 'GET', body, extraHeaders) {
     }
     try {
         const out = await apiInner(path, method, body, extraHeaders);
+        // A custodian that answers with a chain other than the one it was asked
+        // for executed somewhere the ledger did not count; the line cannot be
+        // re-booked (the spend is live), so the mismatch is written onto it and
+        // onto stderr for the operator.
+        const reported = out?.chain_id;
+        const mismatch = reserved.length && reservedChain !== null && typeof reported === 'number' && reported !== reservedChain
+            ? ` CHAIN MISMATCH: reserved on chain ${reservedChain}, the API host reports chain ${reported}; the budget of chain ${reported} did not count this spend.` : '';
+        if (mismatch)
+            console.error(`[agentwallet] ${path}:${mismatch}`);
         for (const seq of reserved) {
             const r = out;
             if (m[2] === 'sign')
-                LEDGER.settle(seq, 'signed', 'raw transaction returned to the caller; not broadcast by this process, so it stays counted');
+                LEDGER.settle(seq, 'signed', 'raw transaction returned to the caller; not broadcast by this process, so it stays counted' + mismatch);
             else
-                LEDGER.settle(seq, 'broadcast', typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : null);
+                LEDGER.settle(seq, 'broadcast', (typeof r?.tx_hash === 'string' ? r.tx_hash : typeof r?.signature === 'string' ? r.signature : '') + mismatch || null);
         }
         return out;
     }
@@ -713,6 +797,21 @@ async function apiInner(path, method = 'GET', body, extraHeaders) {
     }
     if (!res.ok) {
         const error = serverText(data.error) || `HTTP ${res.status}`;
+        // The host was reached and answered. A 4xx is its refusal and the
+        // reservation is voided; a 5xx on a send or sign came after it took the
+        // request, and the custodian may have broadcast before whatever failed
+        // (a downstream write, a proxy), so the spend stays counted as unknown.
+        // Until 1.14.10 every non-2xx voided, and a 500 that carried the
+        // transaction hash in its body restored the whole budget and dropped
+        // the hash (reported privately 2026-11-02).
+        if (method === 'POST' && /^\/wallets\/[^/]+\/(send|sign)(\?|$)/.test(path)) {
+            const d = data;
+            const hash = looksLikeTxHash(d?.tx_hash) ? d.tx_hash : typeof d?.signature === 'string' && /^[1-9A-HJ-NP-Za-km-z]{43,120}$/.test(d.signature) ? d.signature : null;
+            if (hash)
+                throw markMaybeLive(new Error(`${error} The AgentWallet API host answered ${path} with HTTP ${res.status} but reported a transaction (${hash}), so the spend is live and stays counted; check the wallet's history before retrying.`));
+            if (res.status >= 500)
+                throw markMaybeLive(new Error(`${error} The AgentWallet API host answered ${path} with HTTP ${res.status} after taking the request; whether the custodian broadcast is unknown, so the spend stays counted. Check the wallet's history before retrying.`));
+        }
         throw new Error(error);
     }
     // A send that comes back without a hash was not sent, whatever the body says
@@ -893,12 +992,24 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
     const { tokenAddress, rawAmount, decimals } = deriveX402Payment(accept, maxAutopay, trustedDecimals);
     // A hostile or broken host that answers 402 on every call must not drain the
     // wallet one cap at a time: at most AUTOPAY_PER_HOUR payments an hour (round 3).
+    // The slot is taken here, synchronously, before anything is awaited: the
+    // count used to be read here and written after the payment, so eight calls
+    // pipelined at once all read 0 and all paid under a limit of 2 (reported
+    // privately 2026-11-02, 1.14.10). A payment that never left this process
+    // gives its slot back below; one that may be live keeps it. The ledger's
+    // own auto-pay lines are counted too, so several processes sharing one
+    // ledger share the hour; without a ledger file the count is per process.
     const hourAgo = Date.now() - 3_600_000;
     while (autopayLog.length && autopayLog[0] < hourAgo)
         autopayLog.shift();
-    if (autopayLog.length >= AUTOPAY_PER_HOUR) {
-        throw new Error(`x402 auto-pay: ${autopayLog.length} automatic payments were already made in the last hour (AGENTWALLET_MAX_AUTOPAY_PER_HOUR=${AUTOPAY_PER_HOUR}); refusing another. Original error: ${serverText(x402Data.error)}`);
-    }
+    const made = Math.max(autopayLog.length, LEDGER.countSince('autopay', hourAgo));
+    if (made >= AUTOPAY_PER_HOUR) {
+        throw new Error(`x402 auto-pay: ${made} automatic payments were already made in the last hour (AGENTWALLET_MAX_AUTOPAY_PER_HOUR=${AUTOPAY_PER_HOUR}); refusing another. Original error: ${serverText(x402Data.error)}`);
+    }
+    const slot = Date.now();
+    autopayLog.push(slot);
+    const giveBack = () => { const i = autopayLog.indexOf(slot); if (i >= 0)
+        autopayLog.splice(i, 1); };
     // Send payment using our wallet (with X-AGW-SKIP-X402 to prevent recursion).
     // The ledger context names the API host and route; the /send hook reserves and settles the spend.
     const ctx = { 'X-AGW-SKIP-X402': 'true', 'X-AGW-CTX': JSON.stringify({ tool: 'autopay', host: hostOf(API_BASE), resource: `${originalMethod} ${originalPath.split('?')[0]}`, method: 'autopay' }) };
@@ -922,12 +1033,13 @@ async function handleX402Payment(x402Data, originalPath, originalMethod, origina
         }
     }
     catch (e) {
+        if (!isMaybeLive(e))
+            giveBack(); // refused, or never reached the host: the slot is free again
         throw new Error(`x402 auto-pay failed: ${e.message}. Original error: ${serverText(x402Data.error)}`);
     }
     if (!txHash) {
-        throw new Error('x402 auto-pay: no transaction hash returned.');
+        throw new Error('x402 auto-pay: no transaction hash returned.'); // the host answered the send; the slot stays taken
     }
-    autopayLog.push(Date.now());
     const autopayNotice = {
         amount: formatUnits(rawAmount, decimals), token: assetLabel(chainId, tokenAddress), pay_to: payTo, chain_id: chainId, tx_hash: txHash,
         route: `${originalMethod} ${originalPath}`,
@@ -1287,7 +1399,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.14.9',
+    version: '1.14.11',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the environment caps (AGENTWALLET_MAX_TX_NATIVE / _TOKEN / _SOL per transaction, AGENTWALLET_MAX_AUTOPAY and AGENTWALLET_AUTOPAY_ASSETS for x402, AGENTWALLET_X402_MAX_TIMEOUT for authorization windows). There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'

package/build/ledger.d.ts

@@ -110,6 +110,8 @@ export declare class Ledger {
     private liveSpends;
     /** Dollar sums over rolling windows from a fresh read of the file; nowMs for tests. */
     spentUsd(nowMs?: number, host?: string): Spent;
+    /** Live spends (not voided) with this method written since `sinceMs`, from a fresh read: the hourly auto-pay count across every process sharing the file (1.14.10). */
+    countSince(method: SpendMethod, sinceMs: number): number;
     spentNative(chainId: number, nowMs?: number): Spent;
     private sumUsd;
     private sumNative;

package/build/ledger.js

@@ -185,6 +185,11 @@ export class Ledger {
         this.sync();
         return this.sumUsd(nowMs, host);
     }
+    /** Live spends (not voided) with this method written since `sinceMs`, from a fresh read: the hourly auto-pay count across every process sharing the file (1.14.10). */
+    countSince(method, sinceMs) {
+        this.sync();
+        return this.liveSpends().filter(e => e.method === method && Date.parse(e.ts) >= sinceMs).length;
+    }
     spentNative(chainId, nowMs = Date.now()) {
         this.sync();
         return this.sumNative(chainId, nowMs);
@@ -223,9 +228,21 @@ export class Ledger {
             return { ok: false, reason: `The ledger at ${this.path} is not intact (${this.integrity}); every spend is refused until the operator has looked at it.` };
         const amount18 = rawToUnits(input.raw, input.decimals);
         if (input.asset === '') {
-            const r = refusal(limits.native, this.sumNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
-            if (r)
-                return { ok: false, reason: r };
+            // The chain's own coin is counted by native_budget alone; the dollar
+            // budget has no price for it. Until 1.14.10 a chain with no
+            // native_budget entry fell through here with nothing checked, so a
+            // policy of "budget daily 0.5, unpriced_spends refuse" bounded every
+            // stablecoin payment and no native one (reported privately
+            // 2026-11-02). Now such a spend is what it is to the dollar budget, an
+            // unpriced spend, and the unpriced rule decides it.
+            if (limits.native) {
+                const r = refusal(limits.native, this.sumNative(input.chainId, nowMs), amount18, `native_budget.${input.chainId}`);
+                if (r)
+                    return { ok: false, reason: r };
+            }
+            else if (limits.unpriced === 'refuse' && (limits.usd || limits.host)) {
+                return { ok: false, reason: `policy: ${input.assetLabel} on chain ${input.chainId} is the chain's own coin, which the dollar budget cannot price, and the policy has no native_budget.${input.chainId}; refused (add native_budget.${input.chainId} to the policy to count it, or set unpriced_spends to "allow" to let native spends through uncounted). Nothing was signed.` };
+            }
         }
         else if (input.usd === null) {
             if (limits.unpriced === 'refuse' && (limits.usd || limits.host)) {

package/build/local-wallet.js

@@ -337,7 +337,8 @@ const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516
    and so read as "not a token" to the cap, which let setApprovalForAll to an
    attacker through uncapped (2026-10-04 round 2, verified on a live
    collection). Nothing prices an NFT, so these are refused outright. */
-const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6', '959b8c3f']); // plus ERC-777 authorizeOperator: an unbounded delegation
+const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6', '959b8c3f', // plus ERC-777 authorizeOperator: an unbounded delegation
+    '558a7297', '426a8493', '095bcdb6', 'fe99049a']); // EIP-6909 setOperator, approve, transfer, transferFrom: a multi-token contract has no decimals() either (1.14.10)
 const CAP_LAYOUTS = {
     a9059cbb: { amountIndex: 1, what: 'token transfer' }, // transfer(address,uint256)
     '23b872dd': { amountIndex: 2, what: 'token transfer' }, // transferFrom(address,address,uint256)
@@ -358,6 +359,15 @@ const CAP_LAYOUTS = {
     // and are refused by the rule below, as every unpriced call to a token or to
     // Permit2 is; the spend policy classifies both.
     d505accf: { amountIndex: 2, what: 'approval (EIP-2612 permit)' }, // permit(address,address,uint256,uint256,uint8,bytes32,bytes32)
+    // Sibling shapes priced by the spend policy since 1.14.10 (reported
+    // privately 2026-11-02): the same amount word, the same treatment, so the
+    // two guards keep pricing the same calls.
+    d73dd623: { amountIndex: 1, what: 'approval (increaseApproval)' }, // increaseApproval(address,uint256)
+    '3177029f': { amountIndex: 1, what: 'approval (approveAndCall)' }, // approveAndCall(address,uint256)
+    '1296ee62': { amountIndex: 1, what: 'token transfer (transferAndCall)' }, // transferAndCall(address,uint256)
+    d8fbe994: { amountIndex: 2, what: 'token transfer (transferFromAndCall)' }, // transferFromAndCall(address,address,uint256)
+    c1d34b89: { amountIndex: 2, what: 'token transfer (transferFromAndCall)' }, // transferFromAndCall(address,address,uint256,bytes)
+    be45fd62: { amountIndex: 1, what: 'token transfer (ERC-223)' }, // transfer(address,uint256,bytes)
     // WETH9 calls, priced only when `to` is the chain's own wrapped-native
     // contract (wrappedNativeOnly). deposit() carries its amount as msg.value,
     // not in calldata, hence amountIndex -1; withdraw(uint256) has it at word 0.
@@ -416,7 +426,7 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
                 `or ask the operator, who alone can set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1.`);
         }
         if (NFT_SELECTORS.has(selector)) {
-            throw new Error(`Blocked by local guard: calldata selector 0x${selector} is an NFT approval or transfer (ERC-721/1155) aimed at ${to}; AGENTWALLET_MAX_TX_TOKEN cannot price it, ` +
+            throw new Error(`Blocked by local guard: calldata selector 0x${selector} is an NFT approval or transfer (ERC-721/1155, or an EIP-6909 multi-token call) aimed at ${to}; AGENTWALLET_MAX_TX_TOKEN cannot price it, ` +
                 `so it is refused rather than let through uncapped. Only the operator can allow it (AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1).`);
         }
         if (PERMIT2_SELECTORS.has(selector)) {

package/build/policy.d.ts

@@ -35,6 +35,14 @@ export declare const PolicySchema: z.ZodObject<{
     assets: z.ZodOptional<z.ZodObject<{
         allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    contracts: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    unknown_calls: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        refuse: "refuse";
+    }>>;
     approval: z.ZodOptional<z.ZodObject<{
         above: z.ZodOptional<z.ZodString>;
         max: z.ZodOptional<z.ZodString>;
@@ -96,7 +104,22 @@ export declare function recipientAllowed(p: Policy, to: string): {
     reason: string;
 };
 /** A contract target (approve, wrap, arbitrary calldata): the deny list only; an allow list is about where funds go. */
-export declare function targetAllowed(p: Policy, to: string): {
+export declare function targetAllowed(p: Policy, to: string, chainId?: number): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * May the wallet send calldata the policy cannot price to this contract?
+ * Since 1.14.11 the answer under a policy is no unless the operator listed
+ * the contract or set unknown_calls to "allow": the classifier is a table of
+ * known shapes, and every shape it did not know was, until then, a
+ * zero-value call that reserved nothing (nineteen disclosure rows between
+ * 2026-10-14 and 2026-11-02 were that one gap). The open set is now the
+ * operator's decision, not the table's.
+ */
+export declare function unknownCallAllowed(p: Policy, chainId: number, to: string, selector: string): {
     ok: true;
 } | {
     ok: false;

package/build/policy.js

@@ -35,6 +35,10 @@ export const PolicySchema = z.object({
     recipients: z.object({ allow: z.array(Address).max(1000).optional(), deny: z.array(Address).max(1000).optional() }).strict().optional(),
     chains: z.object({ allow: z.array(z.number().int().positive()).max(100).optional() }).strict().optional(),
     assets: z.object({ allow: z.array(AssetRef).max(500).optional() }).strict().optional(),
+    /** Contracts the wallet may call with calldata the policy cannot price (a router, a bridge, a protocol). Entries may be scoped "chainId:0x...". deny refuses any call to the contract, priced or not. */
+    contracts: z.object({ allow: z.array(AssetRef).max(1000).optional(), deny: z.array(AssetRef).max(1000).optional() }).strict().optional(),
+    /** What to do with calldata the policy cannot price, aimed at a contract not in contracts.allow. Default refuse (1.14.11); "allow" restores the pre-1.14.11 behaviour of passing it as a zero-value call. */
+    unknown_calls: z.enum(['refuse', 'allow']).optional(),
     /** Ask the human (MCP elicitation) above `above`; in local mode an accepted ask may admit up to `max`, above the per-payment cap. */
     approval: z.object({ above: Dec.optional(), max: Dec.optional(), timeout_seconds: z.number().int().min(30).max(3600).optional() }).strict().optional(),
     tools: z.object({ allow: z.array(z.string().regex(/^[a-z_0-9]+$/)).max(100).optional(), deny: z.array(z.string().regex(/^[a-z_0-9]+$/)).max(100).optional() }).strict().optional(),
@@ -102,6 +106,12 @@ export function parsePolicy(text) {
         throw new Error('policy field hosts.allow: an empty allow list would refuse every host; remove it or list hosts.');
     if (p.recipients?.allow && p.recipients.allow.length === 0)
         throw new Error('policy field recipients.allow: an empty allow list would refuse every recipient; remove it or list addresses.');
+    if (p.contracts?.allow && p.contracts.allow.length === 0)
+        throw new Error('policy field contracts.allow: an empty allow list is the default (unpriced calls refused); remove it or list contracts.');
+    for (const k of ['allow', 'deny'])
+        for (const e of p.contracts?.[k] || [])
+            if (e.endsWith('native'))
+                throw new Error(`policy field contracts.${k}: "${e}" is not a contract.`);
     return p;
 }
 /** Load the policy named by AGENTWALLET_POLICY (none set: EMPTY). The ledger path comes from AGENTWALLET_LEDGER, then the policy, then a default next to the policy when a budget needs one. */
@@ -181,11 +191,40 @@ export function recipientAllowed(p, to) {
     return { ok: true };
 }
 /** A contract target (approve, wrap, arbitrary calldata): the deny list only; an allow list is about where funds go. */
-export function targetAllowed(p, to) {
+export function targetAllowed(p, to, chainId) {
     if (p.recipients?.deny?.some(x => sameAddress(x, to)))
         return { ok: false, reason: `policy denies contract target ${to} (recipients.deny).` };
+    if (chainId !== undefined && p.contracts?.deny?.some(e => contractRefMatches(e, chainId, to)))
+        return { ok: false, reason: `policy denies contract ${to} on chain ${chainId} (contracts.deny).` };
     return { ok: true };
 }
+/** "8453:0xabc" matches that contract on that chain; a bare address matches it on every chain. */
+function contractRefMatches(entry, chainId, to) {
+    const i = entry.indexOf(':');
+    if (i < 0)
+        return sameAddress(entry, to);
+    return Number(entry.slice(0, i)) === chainId && sameAddress(entry.slice(i + 1), to);
+}
+/**
+ * May the wallet send calldata the policy cannot price to this contract?
+ * Since 1.14.11 the answer under a policy is no unless the operator listed
+ * the contract or set unknown_calls to "allow": the classifier is a table of
+ * known shapes, and every shape it did not know was, until then, a
+ * zero-value call that reserved nothing (nineteen disclosure rows between
+ * 2026-10-14 and 2026-11-02 were that one gap). The open set is now the
+ * operator's decision, not the table's.
+ */
+export function unknownCallAllowed(p, chainId, to, selector) {
+    if (p.contracts?.allow?.some(e => contractRefMatches(e, chainId, to)))
+        return { ok: true };
+    if ((p.unknown_calls ?? 'refuse') === 'allow')
+        return { ok: true };
+    return {
+        ok: false,
+        reason: `policy: calldata selector ${selector} to ${to} on chain ${chainId} is not a shape the policy can price (a transfer, an approval, a permit, a redemption), and the policy does not list the contract in contracts.allow; ` +
+            `refused rather than passed as a zero-value call. The operator can add "${chainId}:${to}" to contracts.allow, or set unknown_calls to "allow" to let every unpriced call through as before 1.14.11.`,
+    };
+}
 export function chainAllowed(p, chainId) {
     if (p.chains?.allow && !p.chains.allow.includes(chainId))
         return { ok: false, reason: `policy does not allow chain ${chainId}: it is not in chains.allow.` };
@@ -245,6 +284,8 @@ export function describePolicy(lp) {
         recipients: p.recipients ? { allow: p.recipients.allow?.length ?? null, deny: p.recipients.deny?.length ?? null } : null,
         chains: p.chains ?? null,
         assets: p.assets ?? null,
+        contracts: p.contracts ? { allow: p.contracts.allow?.length ?? null, deny: p.contracts.deny?.length ?? null } : null,
+        unknown_calls: lp.path ? (p.unknown_calls ?? 'refuse') : 'allow (no policy set)',
         approval: p.approval ?? null,
         tools: p.tools ?? null,
         ledger: lp.ledgerPath,

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "git+https://github.com/hifriendbot/agentwallet-mcp.git"
   },
-  "version": "1.14.9",
+  "version": "1.14.11",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",