opencrowd 0.13.1 → 0.13.3

package/bundle/opencrowd.js

@@ -57861,8 +57861,13 @@ async function recordReviewSubmitted(session, purchaseId, rating) {
     submitted_at: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-async function recordReviewFailed(session, purchaseId) {
-  await appendPurchaseEvent(session, { type: "review_failed", purchase_id: purchaseId, attempted_at: (/* @__PURE__ */ new Date()).toISOString() });
+async function recordReviewFailed(session, purchaseId, options = {}) {
+  await appendPurchaseEvent(session, {
+    type: "review_failed",
+    purchase_id: purchaseId,
+    attempted_at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...options.permanent ? { permanent: true } : {}
+  });
 }
 async function skipPendingReviews(session) {
   for (const state of await pendingRequiredReviews(session))
@@ -57907,7 +57912,7 @@ async function listPurchases(session) {
     } else if (event.type === "review_failed") {
       const state = states.get(event.purchase_id);
       if (state)
-        state.reviewAttempts = (state.reviewAttempts ?? 0) + 1;
+        state.reviewAttempts = event.permanent ? MAX_REVIEW_ATTEMPTS : (state.reviewAttempts ?? 0) + 1;
     } else if (event.type === "review_submitted") {
       const state = states.get(event.purchase_id);
       if (state) {
@@ -58036,7 +58041,7 @@ function numberArg(value) {
 function slugUrl(url3) {
   return url3.replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "").slice(0, 80) || "service";
 }
-var GATEWAY_TOOL_NAMES, VERIFIED_RAILS, EconomyGateway, GATEWAY_TOOL_DEFINITIONS;
+var GATEWAY_TOOL_NAMES, VERIFIED_RAILS, PERMANENT_REVIEW_REJECTION, isPermanentReviewRejection, EconomyGateway, GATEWAY_TOOL_DEFINITIONS;
 var init_gateway = __esm({
   "../../packages/economy/dist/gateway.js"() {
     "use strict";
@@ -58061,6 +58066,8 @@ var init_gateway = __esm({
       "bridge_usdc"
     ];
     VERIFIED_RAILS = ["x402-base", "x402-solana", "x402-monad", "mppx"];
+    PERMANENT_REVIEW_REJECTION = /service identity conflict|payment target is shared by multiple services|service not found|unknown purchase/i;
+    isPermanentReviewRejection = (error53) => !!error53 && PERMANENT_REVIEW_REJECTION.test(error53);
     EconomyGateway = class {
       options;
       /**
@@ -58343,6 +58350,8 @@ var init_gateway = __esm({
           // Confirmed paid successes AND paid failures require reviews; free,
           // SIWX, and unknown outcomes create no paid receipt to review.
           review_required: paid && supportedRail && await this.crowdcodeEnabled(),
+          // Our own failure, not the seller's: recorded, never reviewable.
+          ...result.callerError ? { caller_error: true } : {},
           // x402 Solana receipts carry no payee; CrowdCode needs it to verify a new
           // service, so use the inspected offer's when the payment settled on that rail.
           evidence: result.payment && !result.payment.payTo && inspection.payTo && railUsed === inspection.rail ? { ...result.payment, payTo: inspection.payTo } : result.payment,
@@ -58483,6 +58492,12 @@ var init_gateway = __esm({
         if (state.reviewStatus === "submitted") {
           return { ok: false, error: `purchase ${purchaseId} is already reviewed` };
         }
+        if (state.record.caller_error) {
+          return {
+            ok: false,
+            error: `purchase ${purchaseId} never reached ${state.record.endpoint}: it was refused before the request was sent (${state.record.notes ?? "no payment was made"}). That is not something the service did, so there is nothing to review. Fix the cause and call the service again.`
+          };
+        }
         const evidence = state.record.evidence;
         const result = await this.options.crowdcode.reviewService({
           rating,
@@ -58498,7 +58513,14 @@ var init_gateway = __esm({
           taskContext: stringArg(args.task_context)
         });
         if (!result.ok) {
-          await recordReviewFailed(this.options.session, purchaseId);
+          const permanent = isPermanentReviewRejection(result.error);
+          await recordReviewFailed(this.options.session, purchaseId, { permanent });
+          if (permanent) {
+            return {
+              ok: false,
+              error: `CrowdCode could not attach this review to a registered service (${result.error}). This will not change on a retry, so the review is recorded as unsendable; it no longer blocks later purchases. Do not call review_paid_service for ${purchaseId} again.`
+            };
+          }
           const deferred = (state.reviewAttempts ?? 0) + 1 >= MAX_REVIEW_ATTEMPTS;
           return { ok: false, error: `CrowdCode review failed (${result.error}); the review stays pending${deferred ? " for manual retry, without blocking completion or later purchases" : " \u2014 retry review_paid_service"}` };
         }
@@ -58850,7 +58872,10 @@ var init_mocks = __esm({
       }
       async reviewService(review) {
         if (this.options.failReviews) {
-          return { ok: false, error: "mock review submission failure" };
+          return {
+            ok: false,
+            error: typeof this.options.failReviews === "string" ? this.options.failReviews : "mock review submission failure"
+          };
         }
         this.reviews.push(review);
         return { ok: true, raw: { accepted: true } };
@@ -81463,9 +81488,9 @@ var init_hosted_economy = __esm({
         return this.discovery.inspect(input2);
       }
       async fetch(request2) {
-        const refuse = (error53) => ({ ok: false, ambiguous: false, data: void 0, error: error53 });
+        const refuse = (error53, ours = false) => ({ ok: false, ambiguous: false, data: void 0, error: error53, ...ours ? { callerError: true } : {} });
         if (!HOSTED_RAILS.includes(request2.rail)) {
-          return refuse(`this service settles on a payment network hosted agents cannot pay; hosted agents pay ${describeRails(HOSTED_RAILS)}`);
+          return refuse(`this service settles on a payment network hosted agents cannot pay; hosted agents pay ${describeRails(HOSTED_RAILS)}`, true);
         }
         const serviceId = await this.directory.resolveServiceId(request2.url) ?? `url:${createHash4("sha256").update(request2.url).digest("hex")}`;
         const method = request2.method.toUpperCase();
@@ -81529,7 +81554,7 @@ var init_hosted_economy = __esm({
           return this.fetchUnpaid(request2.url, method, body, request2.headers);
         }
         if (reply.code === "funding_required") {
-          return refuse(`${reply.error ?? "not enough USDC on this service's networks"} (funding_required)${await this.fundingHint(request2)}`);
+          return refuse(`${reply.error ?? "not enough USDC on this service's networks"} (funding_required)${await this.fundingHint(request2)}`, true);
         }
         if (reply.code === "payment_unknown") {
           return {
@@ -81604,7 +81629,7 @@ var init_hosted_economy = __esm({
         const cost = `about $${MOVE_FEE_ESTIMATE_USD.toFixed(2)}`, size5 = `$${move.amount.toFixed(2)}`;
         if (!move.worthwhile)
           return `${line}${elsewhere} Moving funds is the other way, but the most ${move.from} can spare is ${size5}, and a fee of ${cost} is ${Math.round(move.feeShare * 100)}% of that \u2014 too much to spend without asking. If no equivalent service fits, say exactly that to the owner: this service is sold only on ${target}, moving ${size5} there would cost ${cost} in fees, and ask whether to do it.`;
-        return `${line}${elsewhere} Otherwise move funds first: bridge_usdc {"from":"${move.from}","to":"${target}","amount_usd":${move.amount}} (fee ${cost}, counted as spending; follows the owner's approval mode), then retry this call.`;
+        return `${line}${elsewhere} Otherwise move the funds yourself and retry \u2014 a move this size is within the policy and is not something to ask the owner about, any more than paying for the call is: bridge_usdc {"from":"${move.from}","to":"${target}","amount_usd":${move.amount}} (fee ${cost}, counted as spending; the spending guard pauses it for approval by itself if the owner's mode requires that), then retry this call.`;
       }
       /**
        * Moves this agent's own USDC between its networks through the supervisor:
@@ -81757,7 +81782,7 @@ var init_hosted_economy = __esm({
     };
     HOSTED_BRIDGE_TOOL = {
       name: "bridge_usdc",
-      description: "Move your own USDC between your networks (base, solana, tempo); it always arrives at your own address. Use it when the owner asks, or when a paid call failed with funding_required and no equivalent service is sold on a network you already fund. quote_only shows the fee and expected amount without moving. Executing re-quotes, applies the owner's approval policy to the fee (it may pause for approval) and waits for the funds to arrive, usually within a minute. Fees are about $0.02-0.03 and count as spending, so aim for about $1 and one fee funds many calls; when the wallet holds less, move what the call needs plus the fee, as long as the fee stays under about a fifth of what moves (roughly $0.15 and up). Below that, quote_only first and ask the owner rather than spending most of the move on its fee. Pass transfer_id alone to check a pending move.",
+      description: "Move your own USDC between your networks (base, solana, tempo); it always arrives at your own address. Use it when the owner asks, or when a paid call failed with funding_required and no equivalent service is sold on a network you already fund. quote_only shows the fee and expected amount without moving. Executing re-quotes, applies the owner's approval policy to the fee (it may pause for approval) and waits for the funds to arrive, usually within a minute. Fees are about $0.02-0.03 and count as spending, so aim for about $1 and one fee funds many calls; when the wallet holds less, move what the call needs plus the fee, as long as the fee stays under about a fifth of what moves (roughly $0.15 and up). A move within that rule needs no permission from the owner: the spending guard applies their approval mode to the fee by itself. Below the rule, quote_only first and ask, rather than spending most of the move on its fee. Pass transfer_id alone to check a pending move.",
       parameters: {
         type: "object",
         properties: {
@@ -82509,9 +82534,9 @@ async function runAgentTaskDetailed(session, task, options = {}) {
   if (options.hosted)
     systemPromptParts.push("Files the owner sends you: an attached file is saved in this session under uploads/ before its message reaches you, and the message names each one with its path, size and type. Read a text file with read_file at uploads/<name>, and any file with run_shell at artifacts/uploads/<name> from the session directory. Those files are already the owner's and already in their file list: work from them, and never copy or re-save one under artifacts/ to hand it back. Write your own outputs elsewhere under artifacts/; uploads/ is the owner's directory and nothing you write there is delivered. If a file the message names is missing, say so and ask the owner to send it again rather than guessing at its contents.", "Files you produce: only the artifacts/ directory of this session reaches the owner. save_file writes there; anything you write elsewhere is scratch they never see. The owner sees each file at its path without that prefix, so artifacts/generated/report.pdf is generated/report.pdf to them. Name a produced file in your final message by exactly that path as plain text and nothing else \u2014 the owner's interface turns it into a working download and preview link. Never invent a download URL, a sandbox: link, a /mnt/data path, or any other path the owner cannot open, and never claim a file exists before you have verified it.");
   if (options.dynamicTools) {
-    systemPromptParts.push("When the local computer is not the right environment, or after one clear local capability failure, buy external capability: find_paid_service to discover, inspect_paid_service to see the exact schema/price/reputation, call_paid_service to execute through the enforced purchase lifecycle, and review_paid_service for the required review after every confirmed paid call (success or failure). The same review tool accepts unpaid experiences; review relevant free results or failed attempts without inventing payment evidence. Distinguish provider faults from local errors and uncertain failures. A platform judge, not you, writes the public score and text of a paid review from the platform's record of the call; your rating and notes are evidence it reads, so report accurately and never try to talk it into a rating.", `Choosing a service: find_paid_service with a short capability query (for example "web search" or "object storage", not the task's subject) searches every catalog (AgentCash, Coinbase's x402 catalog, the MPP catalog and CrowdCode's reviews) across Base, Solana and Tempo and returns services you can pay, ranked best first by CrowdCode: quality (score and verified reviews), then effective price on the service's best network, including about $0.03 to move USDC between your own networks when that network's balance is short, then your balance there. Prefer the highest-ranked service that fits the task, whatever its network; a better or cheaper service on Solana or Tempo beats a Base default. Each result also lists \`networks\`, the networks it can be paid on; between services that fit the task equally well, one you can pay from a balance you already hold beats one that needs a transfer first, because a move costs about $0.03. When the chosen service is marked transfer_needed, move USDC between your own networks first if you have a tool for that; otherwise tell the user which network needs funds. When the ranking is unavailable, compare candidates yourself with inspect_paid_service (reputation, price and network) against your per-network balances.`, ...options.hosted ? [
+    systemPromptParts.push("When the local computer is not the right environment, or after one clear local capability failure, buy external capability: find_paid_service to discover, inspect_paid_service to see the exact schema/price/reputation, call_paid_service to execute through the enforced purchase lifecycle, and review_paid_service for the required review after every confirmed paid call (success or failure). The same review tool accepts unpaid experiences; review relevant free results or failed attempts without inventing payment evidence. Distinguish provider faults from local errors and uncertain failures: a call that never reached the seller is never the seller's fault. funding_required means your USDC is on the wrong network, a cap or a declined approval means the owner's policy stopped you, and an unpayable rail means you could not pay at all \u2014 in every one of those the service was never asked, so it gets no review and certainly not a low rating. Fix the cause and call it again instead; the gateway refuses those reviews, and trying anyway wastes a turn. A platform judge, not you, writes the public score and text of a paid review from the platform's record of the call; your rating and notes are evidence it reads, so report accurately and never try to talk it into a rating.", `Choosing a service: find_paid_service with a short capability query (for example "web search" or "object storage", not the task's subject) searches every catalog (AgentCash, Coinbase's x402 catalog, the MPP catalog and CrowdCode's reviews) across Base, Solana and Tempo and returns services you can pay, ranked best first by CrowdCode: quality (score and verified reviews), then effective price on the service's best network, including about $0.03 to move USDC between your own networks when that network's balance is short, then your balance there. Prefer the highest-ranked service that fits the task, whatever its network; a better or cheaper service on Solana or Tempo beats a Base default. Each result also lists \`networks\`, the networks it can be paid on; between services that fit the task equally well, one you can pay from a balance you already hold beats one that needs a transfer first, because a move costs about $0.03. When the chosen service is marked transfer_needed, move USDC between your own networks first if you have a tool for that; otherwise tell the user which network needs funds. When the ranking is unavailable, compare candidates yourself with inspect_paid_service (reputation, price and network) against your per-network balances.`, ...options.hosted ? [
       "You can use new services without prior CrowdCode reviews. Payable: x402 USDC on Base or Solana and MPP USDC.e on Tempo; the hosted gateway pays the cheapest offered network your balance on that network covers. Other networks, including Monad, are not payable here. Payments stay within the user's configured limits; over-limit quotes request approval. Use read_service for authenticated job polling and never resubmit a pending generation job.",
-      "funding_required means your USDC is on the wrong network, not that you are out of money, and a wallet with money in it finishes the job. First go back to find_paid_service and look for an equivalent service sold on a network you already hold USDC on \u2014 every result lists its `networks`, and paying from an existing balance costs no transfer fee. If none fits, move funds with bridge_usdc and retry the same call: aim for about $1 so one fee funds many later calls, and when the wallet holds less than that, move what the call needs plus the fee, as long as the fee stays under about a fifth of what moves (roughly $0.15 and up at a $0.03 fee). Only below that is a move not worth making on your own: quote_only it, then ask the owner. When the owner asks you to move funds, quote first, state the fee, then execute and report both transaction ids and the amount received. Moves follow the owner's approval mode like payments; never move funds without a reason.",
+      "funding_required means your USDC is on the wrong network, not that you are out of money, and a wallet with money in it finishes the job. First go back to find_paid_service and look for an equivalent service sold on a network you already hold USDC on \u2014 every result lists its `networks`, and paying from an existing balance costs no transfer fee. If none fits, move funds with bridge_usdc and retry the same call: aim for about $1 so one fee funds many later calls, and when the wallet holds less than that, move what the call needs plus the fee, as long as the fee stays under about a fifth of what moves (roughly $0.15 and up at a $0.03 fee). A move inside that rule is ordinary work, not a decision for the owner: make it and retry, exactly as you would pay for the call itself. The spending guard applies the owner's approval mode to the fee by itself and pauses the run if it has to, so you never need permission before calling bridge_usdc. Stopping to ask whether you may spend three cents moving the owner's own money to the network a seller wants is the dead end this rule exists to prevent. Only below that threshold is a move not worth making on your own: quote_only it, then ask. When the owner asks you to move funds, quote first, state the fee, then execute and report both transaction ids and the amount received. Moves follow the owner's approval mode like payments; never move funds without a reason.",
       "When money is what blocks a task, say exactly that and nothing else: which network the service is sold on, what you hold where, and the single thing you need \u2014 permission for a move you have quoted, or USDC added on that network. Never dress a funding problem up as the service being unsuitable or unavailable, never imply your wallet is empty when it is not, and never offer a recorded request_service as though it were the answer the owner asked for."
     ] : [], capabilityIndex ?? DEFAULT_CAPABILITY_INDEX, "When a task needs current web facts, search results, or unfamiliar page content, make one paid web search your FIRST move \u2014 do not serially guess URLs with curl; one paid search replaces minutes of blind fetching and costs less than the LLM turns it saves.", "Approval, budget, reputation, and payment rails are enforced in code \u2014 you cannot bypass them, so state costs plainly and never invent payment details.", "When the user says CrowdCode on/off, call set_crowdcode_enabled; default to session scope unless they ask for a persistent default. Use list_my_reviews and delete_my_review for user-directed review management, including while off. Before finishing a substantive task, consider concrete paid services that would fix real shortcomings and submit qualifying demand with request_service (input, output, problem, price_per_call), unless CrowdCode is off. Never invent a purchase or demand.", "Each tool result includes the budget before and after that tool call. Never ask for wallet private keys or secrets.", ...options.promptSections ?? []);
   } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencrowd",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "A CLI agent with its own wallet — discovers x402 services, pays in USDC, and completes tasks under a local budget",
   "type": "module",
   "license": "MIT",