open-agents-ai 0.85.0 → 0.87.0

package/README.md

@@ -66,7 +66,7 @@ D8AgCTrxpDKD5meJ2bpAfVwcST3NF3EPuy9xczYycnXn
 - **OpenCode delegation** — offload coding tasks to opencode (sst/opencode) as an autonomous sub-agent with auto-install, progress monitoring, and result evaluation
 - **Long-horizon cron agents** — schedule recurring autonomous agent tasks with goals, completion criteria, execution history, and automatic evaluation (daily code reviews, weekly dep updates, continuous monitoring)
 - **Nexus P2P networking** — decentralized agent-to-agent communication via [open-agents-nexus](https://www.npmjs.com/package/open-agents-nexus). Join rooms, discover peers, share resources, and communicate across the agent mesh with encrypted P2P transport
-- **x402 micropayments** — agents can register inference services with USDC pricing on Base network, create secure wallets (AES-256-GCM encrypted, keys never exposed to LLM context), and participate in paid inference markets
+- **x402 micropayments** — native x402 payment rails via open-agents-nexus@1.5.6. Agents create secp256k1/EVM wallets (AES-256-GCM encrypted, keys never exposed to LLM), register inference with USDC pricing on Base, auto-handle `payment_required`/`payment_proof` negotiation, track earnings/spending in ledger.jsonl, enforce budget policies, and sign gasless EIP-3009 transfers
 - **Inference capability proof** — benchmark local models with anti-spoofing SHA-256 hashed proofs, generate capability scorecards for peer verification
 - **Ralph Loop** — iterative task execution that keeps retrying until completion criteria are met
 - **Dream Mode** — creative idle exploration modeled after real sleep architecture (NREM→REM cycles)
@@ -926,7 +926,7 @@ The steering sub-agent uses the same model and backend as the main agent with `m
 - **LATS** (Zhou et al., 2024) — mid-execution replanning with user-provided value signals improves task completion on complex multi-step problems
 - **AutoGen** (Wu et al., 2023) — human-in-the-loop patterns work best when user messages are expanded into structured instructions, reducing ambiguity for the primary agent
 
-## Tools (47)
+## Tools (54)
 
 | Tool | Description |
 |------|-------------|
@@ -994,6 +994,13 @@ The steering sub-agent uses the same model and backend as the main agent with `m
 | `aiwg_setup` | Deploy AIWG SDLC framework |
 | `aiwg_health` | Analyze project SDLC health and readiness |
 | `aiwg_workflow` | Execute AIWG commands and workflows |
+| **Nexus P2P & x402 Payments** | |
+| `nexus` | Decentralized agent networking — connect, rooms, DMs, peer discovery, invoke capabilities, metering, trust/blocking, IPFS storage |
+| `nexus:expose` | Expose local Ollama models as metered inference capabilities with OpenRouter-based pricing |
+| `nexus:wallet_create` | Generate secp256k1/EVM wallet (Base mainnet USDC) with AES-256-GCM encryption + x402-wallet.key |
+| `nexus:spend` | Sign EIP-3009 USDC TransferWithAuthorization — budget-checked, gasless for payer |
+| `nexus:ledger_status` | Transaction history (earned/spent/pending USDC) |
+| `nexus:budget_set` | Configure spending limits — daily cap, per-invoke max, auto-approve threshold |
 
 Read-only tools execute concurrently when called in the same turn. Mutating tools run sequentially.
 
@@ -1045,6 +1052,55 @@ All context-dependent values scale automatically with the actual context window
 | Tool output cap | 2K-8K chars (scales with context) |
 | File read limits | 80-120 line cap for small/medium context windows |
 
+## x402 Payment Rails & Nexus P2P
+
+Agents can earn and spend USDC on Base mainnet through the native x402 protocol built into [open-agents-nexus@1.5.6](https://www.npmjs.com/package/open-agents-nexus).
+
+### Wallet & Identity
+```
+nexus(action='wallet_create')                          # Generate secp256k1/EVM wallet
+nexus(action='wallet_status')                          # Address, balance, ledger summary
+```
+Creates `wallet.enc` (AES-256-GCM encrypted) and `x402-wallet.key` (plaintext, 0600 perms for daemon x402 module). Keys never enter LLM context.
+
+### Expose Inference with Pricing
+```
+nexus(action='expose', margin='0.5')                   # 50% of OpenRouter market rate
+nexus(action='expose', margin='0')                     # Free (self-hosted)
+nexus(action='pricing_menu')                           # Current pricing for exposed models
+```
+When margin > 0, capabilities are registered with USDC pricing metadata. The daemon auto-handles `invoke.payment_required` → `payment_proof` negotiation via x402.
+
+### Spend — Gasless USDC Transfers (EIP-3009)
+```
+nexus(action='spend', target_address='0x...', amount_usdc='0.10')
+```
+Signs an EIP-3009 `TransferWithAuthorization`. Budget-checked before signing. The recipient (or any facilitator) submits on-chain — no gas needed from the payer. Proof saved to `.oa/nexus/pending-transfer.json`.
+
+### Ledger & Budget
+```
+nexus(action='ledger_status')                          # Earned/spent/pending history
+nexus(action='budget_status')                          # Limits and today's usage
+nexus(action='budget_set', daily_limit='1.00')         # Max daily spend
+nexus(action='budget_set', per_invoke_max='0.10')      # Max per invocation
+nexus(action='budget_set', auto_approve_below='0.01')  # Auto-approve micropayments
+```
+
+### How x402 Works (End to End)
+1. **wallet_create** → generates wallet + x402-wallet.key for daemon signing
+2. **expose** with margin > 0 → registers capabilities with USDC pricing
+3. Peer calls **invoke_capability** → daemon sends `payment_required` with terms
+4. Consumer's daemon auto-signs `payment_proof` → provider validates → invoke proceeds
+5. Metering hook writes payment events to `ledger.jsonl`
+6. **spend** → direct agent-to-agent USDC transfers (EIP-3009, gasless)
+
+### Security Model
+- Private keys: AES-256-GCM encrypted in `wallet.enc` (scrypt-derived key)
+- `x402-wallet.key`: plaintext (0600 perms) — used only by daemon subprocess
+- Budget policy: daily limits, per-invoke caps, circuit breaker, peer denylist
+- All outbound messages scanned for key material before sending
+- Keys NEVER appear in tool output, logs, or LLM context
+
 ## Voice Feedback (TTS)
 
 ```bash

package/dist/index.js

@@ -11239,9 +11239,13 @@ const cmdFile = join(nexusDir, 'cmd.json');
 const respFile = join(nexusDir, 'resp.json');
 const statusFile = join(nexusDir, 'status.json');
 const inboxDir = join(nexusDir, 'inbox');
+const logFile = join(nexusDir, 'daemon.log');
+function dlog(msg) { try { appendFileSync(logFile, new Date().toISOString() + ' ' + msg + '\\n'); } catch {} }
 const pidFile = join(nexusDir, 'daemon.pid');
 const invocationsDir = join(nexusDir, 'invocations');
 const meteringFile = join(nexusDir, 'metering.jsonl');
+const x402KeyPath = join(nexusDir, 'x402-wallet.key');
+const hasX402Key = existsSync(x402KeyPath);
 
 mkdirSync(inboxDir, { recursive: true });
 mkdirSync(invocationsDir, { recursive: true });
@@ -11250,7 +11254,7 @@ mkdirSync(invocationsDir, { recursive: true });
 writeFileSync(pidFile, String(process.pid));
 
 const keyPath = join(nexusDir, 'identity.key');
-const nexus = new NexusClient({
+var nexusOpts = {
   keyStorePath: keyPath,
   agentName,
   agentType,
@@ -11262,7 +11266,18 @@ const nexus = new NexusClient({
   enableCircuitRelay: true,
   usePublicBootstrap: true,
   trustPolicy: { denylist: [], allowlist: [] },
-});
+};
+if (hasX402Key) {
+  nexusOpts.x402 = {
+    enabled: true,
+    walletKeyPath: x402KeyPath,
+    maxPaymentPerRequest: '5000000',
+  };
+  if (process.env.ALCHEMY_API_KEY) {
+    nexusOpts.x402.alchemyApiKey = process.env.ALCHEMY_API_KEY;
+  }
+}
+const nexus = new NexusClient(nexusOpts);
 
 const rooms = new Map();
 let connected = false;
@@ -11292,6 +11307,7 @@ function writeResp(id, result) {
 
 async function handleCmd(cmd) {
   const { id, action, args } = cmd;
+  dlog('handleCmd: action=' + action + ' id=' + id);
   try {
     switch (action) {
       case 'join_room': {
@@ -11374,8 +11390,19 @@ async function handleCmd(cmd) {
         const capability = args.capability || 'text-generation';
         const input = args.input || {};
         if (!peerId) { writeResp(id, { ok: false, output: 'target_peer is required' }); return; }
-        const result = await nexus.invokeCapability(peerId, capability, typeof input === 'string' ? { prompt: input } : input, { stream: false, maxDurationMs: 60000 });
-        writeResp(id, { ok: true, output: JSON.stringify(result, null, 2) });
+        dlog('invoke_capability: peer=' + peerId.slice(0, 20) + ' cap=' + capability);
+        try {
+          // Wrap in a 90s timeout to prevent hangs from nexus library issues
+          const INVOKE_TIMEOUT = 90_000;
+          const invokePromise = nexus.invokeCapability(peerId, capability, typeof input === 'string' ? { prompt: input } : input, { stream: false, maxDurationMs: 60000 });
+          const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('invoke_capability timed out after ' + (INVOKE_TIMEOUT / 1000) + 's (client-side timeout)')), INVOKE_TIMEOUT));
+          const result = await Promise.race([invokePromise, timeoutPromise]);
+          dlog('invoke_capability: SUCCESS');
+          writeResp(id, { ok: true, output: JSON.stringify(result, null, 2) });
+        } catch (invokeErr) {
+          dlog('invoke_capability: ERROR ' + (invokeErr.message || String(invokeErr)));
+          writeResp(id, { ok: false, output: 'Invoke error: ' + (invokeErr.message || String(invokeErr)) });
+        }
         break;
       }
       case 'store_content': {
@@ -11629,6 +11656,18 @@ async function handleCmd(cmd) {
           // Register as nexus capability
           const capName = 'inference:' + model.name.replace(/[^a-zA-Z0-9._-]/g, '_');
           if (typeof nexus.registerCapability === 'function') {
+            var capOpts = {};
+            if (margin > 0 && entry.pricing.input_per_1m_tokens > 0) {
+              var tokensPerReq = 1000;
+              var amountPerReq = Math.round(entry.pricing.input_per_1m_tokens * tokensPerReq);
+              if (amountPerReq > 0) {
+                capOpts.pricing = {
+                  amount: String(amountPerReq),
+                  currency: 'USDC',
+                  description: 'Inference: ' + model.name,
+                };
+              }
+            }
             nexus.registerCapability(capName, async (request, stream) => {
               const logEntry = {
                 ts: Date.now(),
@@ -11705,7 +11744,7 @@ async function handleCmd(cmd) {
                 });
               }
               stream.close();
-            });
+            }, capOpts);
           }
         }
 
@@ -11773,7 +11812,9 @@ setInterval(() => {
     const cmd = JSON.parse(raw);
     if (cmd.id === lastCmdId) return; // already processed
     lastCmdId = cmd.id;
-    handleCmd(cmd);
+    handleCmd(cmd).catch((err) => {
+      writeResp(cmd.id, { ok: false, output: 'Error: ' + (err.message || String(err)) });
+    });
   } catch {}
 }, 500);
 
@@ -11806,6 +11847,37 @@ process.on('unhandledRejection', (reason) => {
       }
     } catch {}
 
+    // Write payment events to ledger.jsonl
+    try {
+      if (nexus.metering && typeof nexus.metering.addHook === 'function') {
+        nexus.metering.addHook(function(record) {
+          if (!record.payment) return;
+          var ledgerFile = join(nexusDir, 'ledger.jsonl');
+          var entry = {
+            timestamp: new Date().toISOString(),
+            type: record.direction === 'inbound' ? 'earned' : 'spent',
+            amount: String(record.payment.amount || 0),
+            amountUsd: (Number(record.payment.amount || 0) / 1000000).toFixed(6),
+            peer: record.peerId || 'unknown',
+            capability: record.service || record.capability || 'unknown',
+            txHash: record.payment.txHash || '',
+            note: 'auto:metering',
+          };
+          try { appendFileSync(ledgerFile, JSON.stringify(entry) + '\\n'); } catch {}
+        });
+      }
+    } catch {}
+
+    // Init x402 wallet if key file exists
+    if (hasX402Key && nexus.x402 && typeof nexus.x402.initWallet === 'function') {
+      try {
+        var addr = nexus.x402.initWallet(x402KeyPath);
+        dlog('x402 wallet initialized: ' + addr);
+      } catch (e) {
+        dlog('x402 wallet init failed: ' + (e.message || e));
+      }
+    }
+
     // v1.5.0: Client-level events for global message/DM/invoke routing
     try {
       if (typeof nexus.on === 'function') {
@@ -11860,7 +11932,7 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
     ];
     NexusTool = class {
       name = "nexus";
-      description = "Decentralized agent-to-agent communication via open-agents-nexus v1.5.0. Spawns a background Node.js process with real network sockets for libp2p + NATS P2P mesh. Simple flow: connect \u2192 join room \u2192 send messages. Auto-installs/updates nexus if needed. EXPOSE: expose action queries Ollama models, fetches OpenRouter market rates, registers metered inference capabilities so peers can invoke your models. pricing_menu shows rates. v1.5.0: register_capability, block_peer/unblock_peer, metering_status, room_members. Also supports direct peer invoke, IPFS storage, DMs, discovery, x402, inference proofs.";
+      description = "Decentralized agent-to-agent communication via open-agents-nexus v1.5.0. Spawns a background Node.js process with real network sockets for libp2p + NATS P2P mesh. Simple flow: connect \u2192 join room \u2192 send messages. Auto-installs/updates nexus if needed. EXPOSE: expose action queries Ollama models, fetches OpenRouter market rates, registers metered inference capabilities so peers can invoke your models. pricing_menu shows rates. v1.5.0: register_capability, block_peer/unblock_peer, metering_status, room_members. Also supports direct peer invoke, IPFS storage, DMs, discovery, x402, inference proofs. WALLET: wallet_create generates EVM wallet (secp256k1, Base mainnet USDC). wallet_status shows address, USDC balance, and ledger summary. PAYMENTS: ledger_status tracks earnings/spending. budget_status/budget_set configure spending limits. spend: sign EIP-3009 USDC transfer (target_address + amount_usdc). x402 native payment via daemon.";
       parameters = {
         type: "object",
         properties: {
@@ -11892,7 +11964,11 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
               "metering_status",
               "room_members",
               "expose",
-              "pricing_menu"
+              "pricing_menu",
+              "ledger_status",
+              "budget_status",
+              "budget_set",
+              "spend"
             ],
             description: "The nexus action to perform"
           },
@@ -11947,6 +12023,26 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
           margin: {
             type: "string",
             description: "Price margin multiplier for expose (0.5 = 50% of market rate, 0 = free). Default: 0.5"
+          },
+          daily_limit: {
+            type: "string",
+            description: "For budget_set: max daily USDC spend (e.g. '1.00')"
+          },
+          per_invoke_max: {
+            type: "string",
+            description: "For budget_set: max per-invoke USDC spend (e.g. '0.10')"
+          },
+          auto_approve_below: {
+            type: "string",
+            description: "For budget_set: auto-approve payments below this USD amount (e.g. '0.01')"
+          },
+          target_address: {
+            type: "string",
+            description: "For spend: target EVM address (0x + 40 hex chars)"
+          },
+          amount_usdc: {
+            type: "string",
+            description: "For spend: USDC amount to transfer (e.g. '0.10')"
           }
         },
         required: ["action"],
@@ -12000,10 +12096,10 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
               result = await this.doSendDM(args);
               break;
             case "find_agent":
-              result = await this.sendDaemonCmd("find_agent", args);
+              result = await this.sendDaemonCmd("find_agent", args, 3e4);
               break;
             case "invoke_capability":
-              result = await this.sendDaemonCmd("invoke_capability", args);
+              result = await this.sendDaemonCmd("invoke_capability", args, 1e5);
               break;
             case "store_content":
               result = await this.sendDaemonCmd("store_content", args);
@@ -12047,6 +12143,18 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
             case "pricing_menu":
               result = await this.sendDaemonCmd("pricing_menu", args);
               break;
+            case "ledger_status":
+              result = await this.doLedgerStatus();
+              break;
+            case "budget_status":
+              result = await this.doBudgetStatus();
+              break;
+            case "budget_set":
+              result = await this.doBudgetSet(args);
+              break;
+            case "spend":
+              result = await this.doSpend(args);
+              break;
             default:
               return { success: false, output: "", error: `Unknown nexus action: ${action}`, durationMs: Date.now() - start };
           }
@@ -12380,6 +12488,9 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         }
         return lines.join("\n");
       }
+      // ---------------------------------------------------------------------------
+      // Step 1: Wallet v2 — secp256k1 via viem for proper EVM addresses
+      // ---------------------------------------------------------------------------
       async doWalletStatus() {
         await this.ensureDir();
         const walletPath = join28(this.nexusDir, "wallet.enc");
@@ -12388,13 +12499,33 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         }
         try {
           const w = JSON.parse(await readFile13(walletPath, "utf8"));
-          return [
+          const lines = [
             `Wallet Status:`,
             `  Address: ${w.address}`,
+            `  Version: ${w.version} (${w.version === 2 ? "secp256k1/EVM" : "legacy SHA256"})`,
+            `  Network: ${w.network || "none"} (chain ${w.chainId || "N/A"})`,
             `  Created: ${w.createdAt}`,
             `  Encryption: AES-256-GCM + scrypt`,
             `  NOTE: Private key is encrypted and NEVER accessible to the agent.`
-          ].join("\n");
+          ];
+          if (w.version === 2 && w.address) {
+            const balance = await this.queryUsdcBalance(w.address, w.chainId || 8453);
+            if (balance !== null) {
+              const usdcHuman = (Number(balance) / 1e6).toFixed(6);
+              lines.push(`  USDC Balance: $${usdcHuman}`);
+              const budget = await this.loadBudget();
+              if (budget && Number(balance) < budget.circuitBreakerUsdc) {
+                lines.push(`  \u26A0 CIRCUIT BREAKER: Balance below $${(budget.circuitBreakerUsdc / 1e6).toFixed(2)} \u2014 all payments BLOCKED`);
+              } else if (budget && Number(balance) < budget.lowBalanceAlertUsdc) {
+                lines.push(`  \u26A0 LOW BALANCE: Below $${(budget.lowBalanceAlertUsdc / 1e6).toFixed(2)} threshold`);
+              }
+            }
+          }
+          const ledgerSummary = await this.getLedgerSummary();
+          if (ledgerSummary) {
+            lines.push(`  Earned: $${ledgerSummary.totalEarned}  Spent: $${ledgerSummary.totalSpent}  Net: $${ledgerSummary.net}`);
+          }
+          return lines.join("\n");
         } catch {
           return "Wallet file exists but could not be read.";
         }
@@ -12403,51 +12534,444 @@ process.on('SIGINT', () => process.emit('SIGTERM'));
         await this.ensureDir();
         const walletPath = join28(this.nexusDir, "wallet.enc");
         if (existsSync21(walletPath))
-          return "Wallet already exists.";
+          return "Wallet already exists. Delete wallet.enc to create a new one.";
         const userAddress = args.wallet_address;
         if (userAddress) {
           if (!/^0x[0-9a-fA-F]{40}$/.test(userAddress)) {
             return "Invalid address format. Expected 0x + 40 hex chars.";
           }
           const w2 = {
-            version: 1,
+            version: 2,
             address: userAddress,
             encryptedKey: "",
             iv: "",
             authTag: "",
             salt: "",
-            createdAt: (/* @__PURE__ */ new Date()).toISOString()
+            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+            network: "base",
+            chainId: 8453
           };
           await writeFile12(walletPath, JSON.stringify(w2, null, 2));
           await chmod(walletPath, 384);
-          return `Wallet configured: ${userAddress} (user-managed)`;
+          await this.ensureDefaultBudget();
+          return `Wallet configured: ${userAddress} (user-managed, Base mainnet, no x402 key \u2014 spend/sign requires self-hosted wallet)`;
+        }
+        let address;
+        let privKeyHex;
+        try {
+          const { privateKeyToAccount } = await import("viem/accounts");
+          const privKey = randomBytes6(32);
+          privKeyHex = privKey.toString("hex");
+          const account = privateKeyToAccount(`0x${privKeyHex}`);
+          address = account.address;
+          privKey.fill(0);
+        } catch {
+          const privKey = randomBytes6(32);
+          privKeyHex = privKey.toString("hex");
+          address = "0x" + createHash("sha256").update(privKey).digest("hex").slice(0, 40);
+          privKey.fill(0);
         }
-        const privKey = randomBytes6(32);
-        const address = "0x" + createHash("sha256").update(privKey).digest("hex").slice(0, 40);
         const salt = randomBytes6(32);
         const key = scryptSync(`${hostname()}:${userInfo().username}:nexus-wallet`, salt, 32, { N: 16384, r: 8, p: 1 });
         const iv = randomBytes6(16);
         const cipher = createCipheriv("aes-256-gcm", key, iv);
-        let enc = cipher.update(privKey.toString("hex"), "utf8", "hex");
+        let enc = cipher.update(privKeyHex, "utf8", "hex");
         enc += cipher.final("hex");
-        privKey.fill(0);
+        const x402KeyPath = join28(this.nexusDir, "x402-wallet.key");
+        await writeFile12(x402KeyPath, "0x" + privKeyHex);
+        await chmod(x402KeyPath, 384);
+        privKeyHex = "0".repeat(64);
         const w = {
-          version: 1,
+          version: 2,
           address,
           encryptedKey: enc,
           iv: iv.toString("hex"),
           authTag: cipher.getAuthTag().toString("hex"),
           salt: salt.toString("hex"),
-          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          network: "base",
+          chainId: 8453
         };
         await writeFile12(walletPath, JSON.stringify(w, null, 2));
         await chmod(walletPath, 384);
+        await this.ensureDefaultBudget();
         return [
-          `Wallet created: ${address}`,
+          `Wallet created (v2, secp256k1/EVM):`,
+          `  Address: ${address}`,
+          `  Network: Base mainnet (chain 8453)`,
+          `  Token: USDC`,
           `  Encrypted with AES-256-GCM (key NEVER visible to agent)`,
-          `  File: ${walletPath} (0600)`
+          `  File: ${walletPath} (0600)`,
+          ``,
+          `Fund this address with USDC on Base to enable paid inference.`,
+          `Free inference (margin=0) works without funding.`
         ].join("\n");
       }
+      // ---------------------------------------------------------------------------
+      // Step 2: USDC Balance Query via Base RPC
+      // ---------------------------------------------------------------------------
+      balanceCache = null;
+      async queryUsdcBalance(address, chainId) {
+        if (this.balanceCache && Date.now() - this.balanceCache.fetchedAt < 6e4) {
+          return this.balanceCache.value;
+        }
+        const rpcUrl = chainId === 84532 ? "https://sepolia.base.org" : "https://mainnet.base.org";
+        const usdcContract = chainId === 84532 ? "0x036CbD53842c5426634e7929541eC2318f3dCF7e" : "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+        const paddedAddress = address.slice(2).toLowerCase().padStart(64, "0");
+        const data = `0x70a08231${paddedAddress}`;
+        try {
+          const resp = await fetch(rpcUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              jsonrpc: "2.0",
+              id: 1,
+              method: "eth_call",
+              params: [{ to: usdcContract, data }, "latest"]
+            }),
+            signal: AbortSignal.timeout(5e3)
+          });
+          const json = await resp.json();
+          if (json.result) {
+            const balance = BigInt(json.result).toString();
+            this.balanceCache = { value: balance, fetchedAt: Date.now() };
+            return balance;
+          }
+        } catch {
+        }
+        return null;
+      }
+      // ---------------------------------------------------------------------------
+      // Step 3: Ledger — Track earnings and expenditures
+      // ---------------------------------------------------------------------------
+      async doLedgerStatus() {
+        await this.ensureDir();
+        const ledgerPath = join28(this.nexusDir, "ledger.jsonl");
+        if (!existsSync21(ledgerPath)) {
+          return "No ledger entries. Earnings and spending will be tracked here after x402 transactions.";
+        }
+        try {
+          const raw = await readFile13(ledgerPath, "utf8");
+          const entries = raw.trim().split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
+          if (entries.length === 0) {
+            return "Ledger is empty. No transactions recorded.";
+          }
+          let totalEarned = 0n, totalSpent = 0n, pending = 0n;
+          for (const e of entries) {
+            const amt = BigInt(e.amount);
+            if (e.type === "earned")
+              totalEarned += amt;
+            else if (e.type === "spent")
+              totalSpent += amt;
+            else if (e.type === "pending")
+              pending += amt;
+          }
+          const lines = [
+            `Ledger Status (${entries.length} entries):`,
+            `  Total Earned: $${(Number(totalEarned) / 1e6).toFixed(6)} USDC`,
+            `  Total Spent:  $${(Number(totalSpent) / 1e6).toFixed(6)} USDC`,
+            `  Net:          $${(Number(totalEarned - totalSpent) / 1e6).toFixed(6)} USDC`
+          ];
+          if (pending > 0n) {
+            lines.push(`  Pending:      $${(Number(pending) / 1e6).toFixed(6)} USDC`);
+          }
+          const recent = entries.slice(-5);
+          lines.push(``, `Recent transactions:`);
+          for (const e of recent) {
+            const sign = e.type === "earned" ? "+" : e.type === "spent" ? "-" : "~";
+            const peerShort = (e.peer || "?").slice(0, 16) + "...";
+            lines.push(`  ${e.timestamp.slice(0, 19)} ${sign}$${e.amountUsd} ${e.capability} (${peerShort})`);
+          }
+          return lines.join("\n");
+        } catch {
+          return "Error reading ledger file.";
+        }
+      }
+      async getLedgerSummary() {
+        const ledgerPath = join28(this.nexusDir, "ledger.jsonl");
+        if (!existsSync21(ledgerPath))
+          return null;
+        try {
+          const raw = await readFile13(ledgerPath, "utf8");
+          const entries = raw.trim().split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
+          let totalEarned = 0n, totalSpent = 0n;
+          for (const e of entries) {
+            const amt = BigInt(e.amount);
+            if (e.type === "earned")
+              totalEarned += amt;
+            else if (e.type === "spent")
+              totalSpent += amt;
+          }
+          return {
+            totalEarned: (Number(totalEarned) / 1e6).toFixed(6),
+            totalSpent: (Number(totalSpent) / 1e6).toFixed(6),
+            net: (Number(totalEarned - totalSpent) / 1e6).toFixed(6)
+          };
+        } catch {
+          return null;
+        }
+      }
+      async appendLedger(entry) {
+        await this.ensureDir();
+        const ledgerPath = join28(this.nexusDir, "ledger.jsonl");
+        const line = JSON.stringify(entry) + "\n";
+        await writeFile12(ledgerPath, existsSync21(ledgerPath) ? await readFile13(ledgerPath, "utf8") + line : line);
+      }
+      // ---------------------------------------------------------------------------
+      // Step 4: Budget Policy — Spending limits and auto-approve thresholds
+      // ---------------------------------------------------------------------------
+      async loadBudget() {
+        const budgetPath = join28(this.nexusDir, "budget.json");
+        if (!existsSync21(budgetPath))
+          return null;
+        try {
+          return JSON.parse(await readFile13(budgetPath, "utf8"));
+        } catch {
+          return null;
+        }
+      }
+      async ensureDefaultBudget() {
+        const budgetPath = join28(this.nexusDir, "budget.json");
+        if (existsSync21(budgetPath))
+          return;
+        const defaultBudget = {
+          version: 1,
+          autoApproveBelow: 1e3,
+          // $0.001 — auto-approve micropayments
+          dailyLimitUsdc: 1e6,
+          // $1.00/day default
+          perInvokeMaxUsdc: 1e5,
+          // $0.10 per invoke max
+          requireConfirmationAbove: 5e5,
+          // $0.50 — ask human above this
+          lowBalanceAlertUsdc: 5e5,
+          // $0.50 — warn when low
+          circuitBreakerUsdc: 1e5,
+          // $0.10 — refuse payments below this balance
+          allowedCapabilities: ["inference:*", "transfer:direct"],
+          deniedPeers: []
+        };
+        await this.ensureDir();
+        await writeFile12(budgetPath, JSON.stringify(defaultBudget, null, 2));
+      }
+      async doBudgetStatus() {
+        await this.ensureDir();
+        const budget = await this.loadBudget();
+        if (!budget) {
+          return "No budget policy configured. Use wallet_create to initialize defaults, or budget_set to configure.";
+        }
+        const todaySpent = await this.getTodaySpending();
+        const lines = [
+          `Budget Policy:`,
+          `  Auto-approve below: $${(budget.autoApproveBelow / 1e6).toFixed(6)}`,
+          `  Per-invoke max:     $${(budget.perInvokeMaxUsdc / 1e6).toFixed(6)}`,
+          `  Daily limit:        $${(budget.dailyLimitUsdc / 1e6).toFixed(6)}`,
+          `  Today's spending:   $${(todaySpent / 1e6).toFixed(6)} / $${(budget.dailyLimitUsdc / 1e6).toFixed(6)}`,
+          `  Confirm above:      $${(budget.requireConfirmationAbove / 1e6).toFixed(6)}`,
+          `  Low balance alert:  $${(budget.lowBalanceAlertUsdc / 1e6).toFixed(6)}`,
+          `  Circuit breaker:    $${(budget.circuitBreakerUsdc / 1e6).toFixed(6)}`,
+          `  Allowed caps:       ${budget.allowedCapabilities.join(", ")}`
+        ];
+        if (budget.deniedPeers.length > 0) {
+          lines.push(`  Denied peers:       ${budget.deniedPeers.length} blocked`);
+        }
+        return lines.join("\n");
+      }
+      async doBudgetSet(args) {
+        await this.ensureDir();
+        let budget = await this.loadBudget();
+        if (!budget) {
+          await this.ensureDefaultBudget();
+          budget = await this.loadBudget();
+        }
+        const parseUsdc = (s) => Math.round(parseFloat(s) * 1e6);
+        const changes = [];
+        if (args.daily_limit) {
+          budget.dailyLimitUsdc = parseUsdc(args.daily_limit);
+          changes.push(`daily_limit=$${args.daily_limit}`);
+        }
+        if (args.per_invoke_max) {
+          budget.perInvokeMaxUsdc = parseUsdc(args.per_invoke_max);
+          changes.push(`per_invoke_max=$${args.per_invoke_max}`);
+        }
+        if (args.auto_approve_below) {
+          budget.autoApproveBelow = parseUsdc(args.auto_approve_below);
+          changes.push(`auto_approve_below=$${args.auto_approve_below}`);
+        }
+        if (changes.length === 0) {
+          return "No budget parameters provided. Use daily_limit, per_invoke_max, or auto_approve_below.";
+        }
+        const budgetPath = join28(this.nexusDir, "budget.json");
+        await writeFile12(budgetPath, JSON.stringify(budget, null, 2));
+        return `Budget updated: ${changes.join(", ")}`;
+      }
+      async getTodaySpending() {
+        const ledgerPath = join28(this.nexusDir, "ledger.jsonl");
+        if (!existsSync21(ledgerPath))
+          return 0;
+        try {
+          const todayPrefix = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+          const raw = await readFile13(ledgerPath, "utf8");
+          let total = 0;
+          for (const line of raw.trim().split("\n")) {
+            if (!line.trim())
+              continue;
+            const entry = JSON.parse(line);
+            if (entry.type === "spent" && entry.timestamp.startsWith(todayPrefix)) {
+              total += Number(BigInt(entry.amount));
+            }
+          }
+          return total;
+        } catch {
+          return 0;
+        }
+      }
+      async checkBudget(amountUsdc, capability, peerId) {
+        const budget = await this.loadBudget();
+        if (!budget)
+          return { allowed: true };
+        if (budget.deniedPeers.includes(peerId)) {
+          return { allowed: false, reason: `Peer ${peerId.slice(0, 16)}... is denied by budget policy` };
+        }
+        const capAllowed = budget.allowedCapabilities.some((pattern) => {
+          if (pattern === "*")
+            return true;
+          if (pattern.endsWith(":*"))
+            return capability.startsWith(pattern.slice(0, -1));
+          return capability === pattern;
+        });
+        if (!capAllowed) {
+          return { allowed: false, reason: `Capability "${capability}" not in allowed list` };
+        }
+        if (amountUsdc > budget.perInvokeMaxUsdc) {
+          return { allowed: false, reason: `Amount $${(amountUsdc / 1e6).toFixed(6)} exceeds per-invoke max $${(budget.perInvokeMaxUsdc / 1e6).toFixed(6)}` };
+        }
+        const todaySpent = await this.getTodaySpending();
+        if (todaySpent + amountUsdc > budget.dailyLimitUsdc) {
+          return { allowed: false, reason: `Would exceed daily limit ($${((todaySpent + amountUsdc) / 1e6).toFixed(6)} > $${(budget.dailyLimitUsdc / 1e6).toFixed(6)})` };
+        }
+        const walletPath = join28(this.nexusDir, "wallet.enc");
+        if (existsSync21(walletPath)) {
+          try {
+            const w = JSON.parse(await readFile13(walletPath, "utf8"));
+            if (w.version === 2 && w.address) {
+              const balance = await this.queryUsdcBalance(w.address, w.chainId || 8453);
+              if (balance !== null && Number(balance) < budget.circuitBreakerUsdc) {
+                return { allowed: false, reason: `Balance $${(Number(balance) / 1e6).toFixed(6)} below circuit breaker threshold $${(budget.circuitBreakerUsdc / 1e6).toFixed(6)}` };
+              }
+            }
+          } catch {
+          }
+        }
+        return { allowed: true };
+      }
+      // ---------------------------------------------------------------------------
+      // Step 5: Spend — Agent-initiated USDC transfer (EIP-3009)
+      // ---------------------------------------------------------------------------
+      async doSpend(args) {
+        const targetAddress = args.target_address;
+        const amountUsd = args.amount_usdc;
+        if (!targetAddress || !/^0x[0-9a-fA-F]{40}$/.test(targetAddress))
+          throw new Error("Valid target_address (0x + 40 hex) is required");
+        if (!amountUsd || isNaN(parseFloat(amountUsd)))
+          throw new Error("amount_usdc is required (e.g. '0.10')");
+        const amountSmallest = Math.round(parseFloat(amountUsd) * 1e6);
+        if (amountSmallest <= 0)
+          throw new Error("amount must be positive");
+        const budgetResult = await this.checkBudget(amountSmallest, "transfer:direct", "");
+        if (!budgetResult.allowed)
+          return `BLOCKED by budget policy: ${budgetResult.reason}`;
+        const walletPath = join28(this.nexusDir, "wallet.enc");
+        if (!existsSync21(walletPath))
+          throw new Error("No wallet. Use wallet_create first.");
+        const w = JSON.parse(await readFile13(walletPath, "utf8"));
+        if (!w.encryptedKey)
+          throw new Error("User-managed wallet cannot spend (no private key)");
+        const salt = Buffer.from(w.salt, "hex");
+        const key = scryptSync(`${hostname()}:${userInfo().username}:nexus-wallet`, salt, 32, { N: 16384, r: 8, p: 1 });
+        const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(w.iv, "hex"));
+        decipher.setAuthTag(Buffer.from(w.authTag, "hex"));
+        let privKeyHex = decipher.update(w.encryptedKey, "hex", "utf8");
+        privKeyHex += decipher.final("utf8");
+        try {
+          const { privateKeyToAccount } = await import("viem/accounts");
+          const account = privateKeyToAccount(`0x${privKeyHex}`);
+          const nonce = "0x" + randomBytes6(32).toString("hex");
+          const now = Math.floor(Date.now() / 1e3);
+          const validAfter = now - 60;
+          const validBefore = now + 3600;
+          const USDC_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+          const domain = {
+            name: "USD Coin",
+            version: "2",
+            chainId: 8453,
+            verifyingContract: USDC_ADDRESS
+          };
+          const types = {
+            TransferWithAuthorization: [
+              { name: "from", type: "address" },
+              { name: "to", type: "address" },
+              { name: "value", type: "uint256" },
+              { name: "validAfter", type: "uint256" },
+              { name: "validBefore", type: "uint256" },
+              { name: "nonce", type: "bytes32" }
+            ]
+          };
+          const message = {
+            from: account.address,
+            to: targetAddress,
+            value: BigInt(amountSmallest),
+            validAfter: BigInt(validAfter),
+            validBefore: BigInt(validBefore),
+            nonce
+          };
+          const { signTypedData } = await import("viem/accounts");
+          const signature = await signTypedData({
+            privateKey: `0x${privKeyHex}`,
+            domain,
+            types,
+            primaryType: "TransferWithAuthorization",
+            message
+          });
+          await this.appendLedger({
+            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+            type: "spent",
+            amount: String(amountSmallest),
+            amountUsd: (amountSmallest / 1e6).toFixed(6),
+            peer: targetAddress,
+            capability: "transfer:direct",
+            note: "signed, awaiting submission"
+          });
+          const proofFile = join28(this.nexusDir, "pending-transfer.json");
+          const proof = {
+            from: account.address,
+            to: targetAddress,
+            value: String(amountSmallest),
+            validAfter: String(validAfter),
+            validBefore: String(validBefore),
+            nonce,
+            signature,
+            chainId: 8453,
+            usdcContract: USDC_ADDRESS,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          await writeFile12(proofFile, JSON.stringify(proof, null, 2));
+          return [
+            `Transfer signed (EIP-3009 TransferWithAuthorization):`,
+            `  From: ${account.address}`,
+            `  To: ${targetAddress}`,
+            `  Amount: $${(amountSmallest / 1e6).toFixed(6)} USDC`,
+            `  Valid: ${new Date(validAfter * 1e3).toISOString()} to ${new Date(validBefore * 1e3).toISOString()}`,
+            `  Signature: ${signature.slice(0, 20)}...`,
+            `  Proof saved: ${proofFile}`,
+            ``,
+            `To submit on-chain: anyone can call USDC.transferWithAuthorization() with this proof.`,
+            `The recipient or a facilitator can submit it \u2014 no gas needed from the payer.`
+          ].join("\n");
+        } finally {
+          privKeyHex = "0".repeat(64);
+        }
+      }
       async doInferenceProof() {
         try {
           const psRaw = execSync21("ollama ps 2>/dev/null", { timeout: 1e4, encoding: "utf8" });
@@ -40683,7 +41207,7 @@ ${result.text}`;
             const steerPrompt = [
               `The user typed a mid-task message while the agent is working. Your job:`,
               `1. Understand what the user wants changed/added/corrected`,
-              `2. Produce a brief spoken acknowledgment (1 sentence, conversational)`,
+              `2. Produce a brief, UNIQUE spoken acknowledgment that reflects WHAT they asked for`,
               `3. Expand their input into a clear, structured steering instruction for the main agent`,
               ``,
               `Current task goal: "${steerTaskGoal.slice(0, 500)}"`,
@@ -40694,11 +41218,30 @@ ${result.text}`;
               `User's mid-task message: "${input}"`,
               ``,
               `Call task_complete with:`,
-              `- acknowledgment: brief spoken response to the user (e.g. "Got it, I'll adjust the approach")`,
+              `- acknowledgment: a brief spoken response SPECIFIC to what the user said. Reference the actual change they want. DO NOT use generic phrases like "Got it" or "adjusting". Instead describe what you'll do differently. Examples of GOOD acknowledgments:`,
+              `  - "Switching to the new API endpoint now"`,
+              `  - "Right, I'll use TypeScript instead"`,
+              `  - "Understood, dropping the database mock"`,
+              `  - "On it, pulling in that dependency first"`,
+              `  - "Yep, let me rethink the caching layer"`,
+              `  - "Makes sense, I'll refactor that into a separate module"`,
               `- summary: expanded instruction for the main agent (e.g. "USER STEERING: The user wants X instead of Y. Adjust your approach to prioritize Z. Specifically, they are asking you to...")`
             ].join("\n");
             const result = await steerAgent.run(steerPrompt, "Steering sub-agent \u2014 interpret user input and produce instruction.");
-            let acknowledgment = "Got it, adjusting.";
+            const STEER_FALLBACKS = [
+              `Noted, changing course.`,
+              `On it, shifting approach.`,
+              `Understood, recalibrating.`,
+              `Right, let me rework that.`,
+              `Okay, taking a different angle.`,
+              `Heard you, pivoting now.`,
+              `Sure thing, rethinking this.`,
+              `Copy that, adapting.`,
+              `Makes sense, re-routing.`,
+              `Roger, new plan.`
+            ];
+            const fbIdx = Math.floor(Math.random() * STEER_FALLBACKS.length);
+            let acknowledgment = STEER_FALLBACKS[fbIdx];
             let steering = `USER STEERING: ${input}`;
             try {
               const parsed = JSON.parse(result.summary || "{}");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-agents-ai",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "AI coding agent powered by open-source models (Ollama/vLLM) — interactive TUI with agentic tool-calling loop",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,7 +49,11 @@
     "peer-to-peer",
     "inference-network",
     "secret-vault",
-    "websocket"
+    "websocket",
+    "x402",
+    "usdc",
+    "eip-3009",
+    "micropayments"
   ],
   "author": "robit-man",
   "license": "MIT",
@@ -70,6 +74,7 @@
   },
   "optionalDependencies": {
     "moondream": "^0.2.0",
-    "open-agents-nexus": "^1.5.0"
+    "open-agents-nexus": "^1.5.6",
+    "viem": "^2.47.4"
   }
 }

package/prompts/agentic/system-large.md

@@ -185,7 +185,7 @@ If you notice you're performing the SAME multi-step sequence for the 3rd time or
 - Test the tool mentally before creating — ensure the steps would work in order
 - Prefer 'project' scope unless the pattern genuinely applies to all projects
 
-## Nexus P2P Networking (v1.5.0) — Decentralized Agent Communication
+## Nexus P2P Networking (v1.5.6) — Decentralized Agent Communication + x402 Payments
 
 You HAVE the nexus tool. It is one of your registered tools. USE IT when asked about connecting, messaging, or networking with other agents.
 
@@ -263,13 +263,46 @@ expose queries local Ollama for models, fetches live market rates from OpenRoute
 nexus capability (inference:{model_name}), and writes pricing to .oa/nexus/pricing.json.
 Peers can invoke your models via invoke_capability and see metered usage.
 
+### x402 Payment Rails (native, wired to open-agents-nexus@1.5.6)
+
+wallet_create generates a secp256k1/EVM wallet on Base mainnet. An `x402-wallet.key` file
+is auto-created alongside `wallet.enc` for the daemon's x402 module. When margin > 0 in
+expose, registerCapability passes pricing metadata — the daemon auto-handles
+`invoke.payment_required` → `payment_proof` negotiation.
+
+  nexus(action='wallet_create')                — generate new EVM wallet (secp256k1, Base, USDC)
+  nexus(action='wallet_create', wallet_address='0x...')  — register existing address (no x402 signing)
+  nexus(action='wallet_status')                — address, USDC balance, ledger summary
+
+### Ledger & Budget
+  nexus(action='ledger_status')                — transaction history (earned/spent/pending)
+  nexus(action='budget_status')                — spending limits and today's usage
+  nexus(action='budget_set', daily_limit='1.00')               — set daily USDC limit
+  nexus(action='budget_set', per_invoke_max='0.10')            — max per invocation
+  nexus(action='budget_set', auto_approve_below='0.01')        — auto-approve micropayments
+
+### Spend — Agent-Initiated USDC Transfer (EIP-3009)
+  nexus(action='spend', target_address='0x...', amount_usdc='0.10')
+
+Signs an EIP-3009 TransferWithAuthorization for USDC on Base. Budget-checked before signing.
+The signed proof is saved to `.oa/nexus/pending-transfer.json` — anyone can submit it on-chain
+via `USDC.transferWithAuthorization()`. No gas needed from the payer.
+
+### x402 Flow Summary
+1. wallet_create → generates wallet + x402-wallet.key (plaintext, 0600, for daemon)
+2. expose with margin > 0 → registers capabilities with USDC pricing
+3. Peers invoke_capability → daemon auto-handles payment_required/payment_proof
+4. Metering hook writes payment events to ledger.jsonl
+5. spend → sign direct USDC transfers (EIP-3009)
+
 SECURITY: Wallet private keys are AES-256-GCM encrypted and NEVER accessible to you.
-All outbound messages are scanned for key material leaks.
+x402-wallet.key is 0600-permissioned for daemon use only. All outbound messages are scanned
+for key material leaks.
 
 When the user asks about expanding capabilities or connecting with other agents, suggest
 enabling nexus networking. Use expose to share your models with the network, pricing_menu
-to check rates, register_capability to serve custom invocations, and room_members to
-discover who's online.
+to check rates, register_capability to serve custom invocations, room_members to
+discover who's online, and spend for direct USDC transfers.
 
 ## Temporal Agency — Scheduling, Reminders & Long-Horizon Tasks