safehands-pharos 1.5.0 → 2.8.0

package/dist/demo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../src/demo.ts"],"names":[],"mappings":"AA4EA,wBAAsB,OAAO,kBA4G5B"}
+{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../src/demo.ts"],"names":[],"mappings":"AA4EA,wBAAsB,OAAO,kBAsJ5B"}

package/dist/demo.js

@@ -11,7 +11,7 @@ import { handleSafeHandsX402Preflight } from "./tools/safehandsX402Preflight.js"
 import { handleX402PayAndFetch } from "./tools/x402PayAndFetch.js";
 import { handleSendPayment } from "./tools/sendPayment.js";
 import { handleExplainRisk } from "./tools/explainRisk.js";
-import { CHAIN_ID, PHAROS_ENVIRONMENT, USDC_ADDRESS } from "./lib/constants.js";
+import { CHAIN_ID, PHAROS_ENVIRONMENT, activeUsdcAddress, IS_MAINNET } from "./lib/constants.js";
 const RECIPIENT = "0x0000000000000000000000000000000000000001";
 function section(title) {
     console.log(`\n${"═".repeat(78)}`);
@@ -51,7 +51,7 @@ async function withLocalX402DemoServer(handler) {
             error: "Payment Required",
             demo: true,
             price: "0.001",
-            asset: USDC_ADDRESS,
+            asset: activeUsdcAddress(),
             network: `eip155:${CHAIN_ID}`,
         });
     });
@@ -82,26 +82,27 @@ export async function runDemo() {
         console.log("   Mode: non-destructive demo, no real transactions broadcast");
         section("1. Wallet Health");
         print("safehands_wallet_health", await handleSafeHandsWalletHealth({}));
-        section("2. Safe Payment Preflight: ALLOW");
+        section("2. Safe Payment Preflight: PREPARE_ONLY");
         print("safehands_preflight_check", await handleSafeHandsPreflightCheck({
             actionType: "send_payment",
             chainId: CHAIN_ID,
-            isMainnet: false,
+            isMainnet: IS_MAINNET,
             amount: "0.001",
-            amountUnit: "PHRS",
+            amountUnit: "PROS",
             recipient: RECIPIENT,
         }));
         section("3. Unlimited Approval Preflight: BLOCK");
         const blockedApproval = await handleSafeHandsPreflightCheck({
             actionType: "approve_token",
             chainId: CHAIN_ID,
-            isMainnet: false,
+            isMainnet: IS_MAINNET,
             approvalAmount: "max",
+            approvalToken: "USDC",
             spender: RECIPIENT,
         });
         print("safehands_preflight_check", blockedApproval);
         section("4. Token Registry Status");
-        print("token_registry_status", await handleTokenRegistryStatus({ tokenAddress: USDC_ADDRESS }));
+        print("token_registry_status", await handleTokenRegistryStatus({ tokenAddress: activeUsdcAddress() }));
         section("5. x402 Preflight Without Private Key");
         await withLocalX402DemoServer(async (baseUrl) => {
             const restoreLocal = setEnv("ALLOW_LOCAL_X402_FETCH", "true");
@@ -152,9 +153,43 @@ export async function runDemo() {
             riskLevel: "HIGH",
             reasons: ["Unlimited approval requested"],
             requiredActions: ["Use a limited approval amount before approving a spender"],
+            environment: PHAROS_ENVIRONMENT,
+            chainId: CHAIN_ID,
+            isMainnet: IS_MAINNET,
         }));
+        section("11. Tokenized-Asset (RWA) Transfer Compliance: REQUIRE_CONFIRMATION");
+        // A Real-Fi scenario: an agent asks to approve spending of a tokenized-asset
+        // contract that is NOT in the active token registry. SafeHands does not block
+        // outright — it demands human review, the transfer-restriction behavior
+        // regulated real-world assets require.
+        print("safehands_preflight_check", await handleSafeHandsPreflightCheck({
+            actionType: "approve_token",
+            chainId: CHAIN_ID,
+            isMainnet: IS_MAINNET,
+            approvalAmount: "25",
+            tokenAddress: "0x00000000000000000000000000000000000000aa", // synthetic fixture: an unregistered asset token
+            spender: RECIPIENT,
+            spenderVerified: false,
+        }));
+        section("12. Real-Fi Settlement Cap (x402/USDC): over-cap enforcement");
+        // A Real-Fi scenario: an agent tries to settle a real-world invoice over x402
+        // for 5 USDC while the active policy caps x402 settlement per call. The
+        // deterministic policy engine refuses — no model can talk it into paying.
+        await withLocalX402DemoServer(async (baseUrl) => {
+            const restoreLocal = setEnv("ALLOW_LOCAL_X402_FETCH", "true");
+            try {
+                print("safehands_x402_preflight over policy cap", await handleSafeHandsX402Preflight({
+                    url: `${baseUrl}/paid`,
+                    paymentAmountUsdc: "5",
+                    probeEndpoint: false,
+                }));
+            }
+            finally {
+                restoreLocal();
+            }
+        });
         section("Demo Complete");
-        console.log("SafeHands demonstrated wallet health, ALLOW/BLOCK policy, token registry, x402 safety, SSRF blocking, write-tool guardrails, and explainable risk output.");
+        console.log("SafeHands demonstrated wallet health, ALLOW/BLOCK policy, token registry, x402 safety, SSRF blocking, write-tool guardrails, explainable risk output, and Real-Fi/RWA compliance gating (unregistered-asset review + settlement caps).");
     }
     finally {
         restoreWalletMode();

package/dist/demo.js.map

@@ -1 +1 @@
-{"version":3,"file":"demo.js","sourceRoot":"","sources":["../src/demo.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,oCAAoC;AACpC,2EAA2E;AAE3E,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,KAAc;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,KAAyB;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9B,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAI,OAAwC;IAChF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI;YACV,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC;YAClC,OAAO,EAAE,UAAU,QAAQ,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,UAAU,QAAQ,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAW,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjG,OAAO,MAAM,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,IAAI,qBAAqB,IAAI,MAAM;YAAG,MAAc,CAAC,mBAAmB,EAAE,CAAC;QAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,MAAM,iBAAiB,GAAG,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,MAAM,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;QAE7E,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5B,KAAK,CAAC,yBAAyB,EAAE,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC;QAExE,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAC5C,KAAK,CACH,2BAA2B,EAC3B,MAAM,6BAA6B,CAAC;YAClC,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CAAC;YAC1D,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,KAAK;YACrB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QACH,KAAK,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;QAEpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACpC,KAAK,CAAC,uBAAuB,EAAE,MAAM,yBAAyB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAEhG,OAAO,CAAC,uCAAuC,CAAC,CAAC;QACjD,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CACH,0BAA0B,EAC1B,MAAM,4BAA4B,CAAC;oBACjC,GAAG,EAAE,GAAG,OAAO,OAAO;oBACtB,iBAAiB,EAAE,OAAO;oBAC1B,aAAa,EAAE,KAAK;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,sDAAsD,CAAC,CAAC;QAChE,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CAAC,kCAAkC,EAAE,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC;YAC1G,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,sCAAsC,CAAC,CAAC;QAChD,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CAAC,kCAAkC,EAAE,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9H,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3B,MAAM,mBAAmB,GAAG,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,KAAK,CAAC,4CAA4C,EAAE,MAAM,4BAA4B,CAAC,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC;QACtI,CAAC;gBAAS,CAAC;YACT,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnC,KAAK,CAAC,sBAAsB,EAAE,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAElG,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/C,KAAK,CACH,cAAc,EACd,MAAM,iBAAiB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,CAAC,8BAA8B,CAAC;YACzC,eAAe,EAAE,CAAC,0DAA0D,CAAC;SAC9E,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,eAAe,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,2JAA2J,CAAC,CAAC;IAC3K,CAAC;YAAS,CAAC;QACT,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,CAAC;QACf,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"demo.js","sourceRoot":"","sources":["../src/demo.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,oCAAoC;AACpC,2EAA2E;AAE3E,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEjG,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,KAAc;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,KAAyB;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9B,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACnC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAI,OAAwC;IAChF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI;YACV,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC;YAClC,OAAO,EAAE,UAAU,QAAQ,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,iBAAiB,EAAE;YAC1B,OAAO,EAAE,UAAU,QAAQ,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAW,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjG,OAAO,MAAM,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,IAAI,qBAAqB,IAAI,MAAM;YAAG,MAAc,CAAC,mBAAmB,EAAE,CAAC;QAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,MAAM,iBAAiB,GAAG,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,MAAM,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,kBAAkB,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;QAE7E,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5B,KAAK,CAAC,yBAAyB,EAAE,MAAM,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC;QAExE,OAAO,CAAC,yCAAyC,CAAC,CAAC;QACnD,KAAK,CACH,2BAA2B,EAC3B,MAAM,6BAA6B,CAAC;YAClC,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,QAAQ;YACnB,SAAS,EAAE,UAAU;YACnB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,6BAA6B,CAAC;YAC1D,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,UAAU;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,MAAM;YACrB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QACH,KAAK,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;QAEpD,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACpC,KAAK,CAAC,uBAAuB,EAAE,MAAM,yBAAyB,CAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC;QAEvG,OAAO,CAAC,uCAAuC,CAAC,CAAC;QACjD,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CACH,0BAA0B,EAC1B,MAAM,4BAA4B,CAAC;oBACjC,GAAG,EAAE,GAAG,OAAO,OAAO;oBACtB,iBAAiB,EAAE,OAAO;oBAC1B,aAAa,EAAE,KAAK;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,sDAAsD,CAAC,CAAC;QAChE,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CAAC,kCAAkC,EAAE,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC;YAC1G,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,sCAAsC,CAAC,CAAC;QAChD,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CAAC,kCAAkC,EAAE,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9H,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3B,MAAM,mBAAmB,GAAG,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,KAAK,CAAC,4CAA4C,EAAE,MAAM,4BAA4B,CAAC,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC;QACtI,CAAC;gBAAS,CAAC;YACT,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnC,KAAK,CAAC,sBAAsB,EAAE,MAAM,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAElG,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/C,KAAK,CACH,cAAc,EACd,MAAM,iBAAiB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,CAAC,8BAA8B,CAAC;YACzC,eAAe,EAAE,CAAC,0DAA0D,CAAC;YAC7E,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,UAAU;SACtB,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,qEAAqE,CAAC,CAAC;QAC/E,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,uCAAuC;QACvC,KAAK,CACH,2BAA2B,EAC3B,MAAM,6BAA6B,CAAC;YAClC,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,UAAU;YACrB,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,4CAA4C,EAAE,iDAAiD;YAC7G,OAAO,EAAE,SAAS;YAClB,eAAe,EAAE,KAAK;SACvB,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,8DAA8D,CAAC,CAAC;QACxE,8EAA8E;QAC9E,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,KAAK,CACH,0CAA0C,EAC1C,MAAM,4BAA4B,CAAC;oBACjC,GAAG,EAAE,GAAG,OAAO,OAAO;oBACtB,iBAAiB,EAAE,GAAG;oBACtB,aAAa,EAAE,KAAK;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,eAAe,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,wOAAwO,CAAC,CAAC;IACxP,CAAC;YAAS,CAAC;QACT,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,CAAC;QACf,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.js

@@ -1,31 +1,32 @@
 #!/usr/bin/env node
 // ─── SafeHands MCP Server ──────────────────────────────────────────────
-// Entry point — registers 27 tools (17 legacy/core + 3 managed wallet + 7 SafeHands guardrail tools) and starts the MCP server.
+// Entry point — registers 33 tools and starts the MCP server.
 // ────────────────────────────────────────────────────────────────────────
 // Must be first import — loads .env before any module reads process.env at init time
 import "./lib/envLoader.js";
 import { createRequire } from "module";
+import { pathToFileURL } from "url";
 const require = createRequire(import.meta.url);
 const PKG_VERSION = require("../package.json").version;
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { assessRiskSchema, handleAssessRisk } from "./tools/assessRisk.js";
-import { executeSwapSchema, handleExecuteSwap } from "./tools/executeSwap.js";
-import { sendPaymentSchema, handleSendPayment } from "./tools/sendPayment.js";
-import { simulateTransactionSchema, handleSimulateTransaction } from "./tools/simulateTransaction.js";
-import { getExecutionHistorySchema, handleGetExecutionHistory } from "./tools/getExecutionHistory.js";
-import { getTokenPriceSchema, handleGetTokenPrice } from "./tools/getTokenPrice.js";
-import { getWalletBalanceSchema, handleGetWalletBalance } from "./tools/getWalletBalance.js";
-import { checkAllowanceSchema, handleCheckAllowance } from "./tools/checkAllowance.js";
-import { getTransactionStatusSchema, handleGetTransactionStatus } from "./tools/getTransactionStatus.js";
-import { estimateGasSchema, handleEstimateGas } from "./tools/estimateGas.js";
-import { publishRiskScoreSchema, handlePublishRiskScore } from "./tools/publishRiskScore.js";
-import { queryRiskRegistrySchema, handleQueryRiskRegistry } from "./tools/queryRiskRegistry.js";
-import { approveTokenSchema, handleApproveToken } from "./tools/approveToken.js";
-import { getGasPriceSchema, handleGetGasPrice } from "./tools/getGasPrice.js";
-import { getPoolInfoSchema, handleGetPoolInfo } from "./tools/getPoolInfo.js";
-import { checkTokenSecuritySchema, handleCheckTokenSecurity } from "./tools/checkTokenSecurity.js";
-import { x402PayAndFetchSchema, handleX402PayAndFetch } from "./tools/x402PayAndFetch.js";
+import { assessRiskTool, handleAssessRisk } from "./tools/assessRisk.js";
+import { simulateTransactionTool, handleSimulateTransaction } from "./tools/simulateTransaction.js";
+import { getExecutionHistoryTool, handleGetExecutionHistory } from "./tools/getExecutionHistory.js";
+import { getTokenPriceTool, handleGetTokenPrice } from "./tools/getTokenPrice.js";
+import { getWalletBalanceTool, handleGetWalletBalance } from "./tools/getWalletBalance.js";
+import { checkAllowanceTool, handleCheckAllowance } from "./tools/checkAllowance.js";
+import { getTransactionStatusTool, handleGetTransactionStatus } from "./tools/getTransactionStatus.js";
+import { estimateGasTool, handleEstimateGas } from "./tools/estimateGas.js";
+import { publishRiskScoreTool, handlePublishRiskScore } from "./tools/publishRiskScore.js";
+import { queryRiskRegistryTool, handleQueryRiskRegistry } from "./tools/queryRiskRegistry.js";
+import { verifyRiskInclusionTool, handleVerifyRiskInclusion } from "./tools/verifyRiskInclusion.js";
+import { getAgentReputationTool, handleGetAgentReputation } from "./tools/getAgentReputation.js";
+import { getGasPriceTool, handleGetGasPrice } from "./tools/getGasPrice.js";
+import { getPoolInfoTool, handleGetPoolInfo } from "./tools/getPoolInfo.js";
+import { queryGoldskySchema, handleQueryGoldsky } from "./tools/queryGoldsky.js";
+import { getSpvProofSchema, handleGetSpvProof } from "./tools/getSpvProof.js";
+import { checkTokenSecurityTool, handleCheckTokenSecurity } from "./tools/checkTokenSecurity.js";
 import { createAgentWalletSchema, handleCreateAgentWallet } from "./tools/createAgentWallet.js";
 import { safehandsPreflightCheckSchema, handleSafeHandsPreflightCheck } from "./tools/safehandsPreflightCheck.js";
 import { safehandsSafeExecuteSchema, handleSafeHandsSafeExecute } from "./tools/safehandsSafeExecute.js";
@@ -36,19 +37,33 @@ import { explainRiskSchema, handleExplainRisk } from "./tools/explainRisk.js";
 import { tokenRegistryStatusSchema, handleTokenRegistryStatus } from "./tools/tokenRegistryStatus.js";
 import { getAgentWalletSchema, handleGetAgentWallet } from "./tools/getAgentWallet.js";
 import { getAgentWalletBalanceSchema, handleGetAgentWalletBalance } from "./tools/getAgentWalletBalance.js";
+import { getAgentPolicySchema, handleGetAgentPolicy } from "./tools/getAgentPolicy.js";
+import { setAgentPolicySchema, handleSetAgentPolicy } from "./tools/setAgentPolicy.js";
+import { executeSwapTool, handleExecuteSwap } from "./tools/executeSwap.js";
+import { sendPaymentTool, handleSendPayment } from "./tools/sendPayment.js";
+import { approveTokenTool, handleApproveToken } from "./tools/approveToken.js";
+import { x402PayAndFetchTool, handleX402PayAndFetch } from "./tools/x402PayAndFetch.js";
 import { fail, ok } from "./lib/toolResponse.js";
 import { auditLog } from "./lib/auditLog.js";
+import { walletStore, encryptKey, getEffectiveEncryptionKey } from "./lib/wallet/index.js";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
 import { runSkillCli } from "./cli.js";
 import { runDemo } from "./demo.js";
 import { runInit } from "./init.js";
+process.on("unhandledRejection", (reason) => {
+    console.error("SafeHands MCP unhandled rejection:", reason);
+});
+process.on("uncaughtException", (error) => {
+    console.error("SafeHands MCP uncaught exception:", error);
+    process.exit(1);
+});
 // ─── Per-tool rate limiting ────────────────────────────────────────────
 // Heavy tools (block-scan history) get a tighter limit.
 // Write tools get a moderate limit to prevent agent loops.
 // All other tools share a generous global limit.
 const HEAVY_TOOLS = new Set(["get_execution_history"]);
 const WRITE_TOOLS = new Set([
-    "execute_swap", "send_payment", "approve_token",
-    "publish_risk_score", "x402_pay_and_fetch", "safehands_safe_execute",
+    "publish_risk_score", "safehands_safe_execute",
 ]);
 const RATE_LIMITS = {
     heavy: parseInt(process.env.MCP_RATE_LIMIT_HEAVY || "5", 10),
@@ -144,103 +159,148 @@ if (isDemoMode) {
 }
 // ─── CLI Help ──────────────────────────────────────────────────────────
 if (process.argv.includes("--help") || process.argv.includes("-h")) {
-    process.stdout.write(`
-🛡️  SafeHands-Pharos — Transaction Safety Firewall for AI Agents
-   v${PKG_VERSION} | Pharos Atlantic Testnet | Chain ID 688689
-
-USAGE
-  npx safehands-pharos
-      Start SafeHands as an MCP server over stdio.
-
-  npx safehands-pharos --help
-      Show this help.
-
-  npx safehands-pharos init
-      Launch the interactive setup wizard to configure your .env file safely.
-
-  npx safehands-pharos --demo
-      Run the deterministic non-destructive hackathon demo.
-
-  npx safehands-pharos skill <tool_name> --input-json '<json>'
-      Run a Pharos Skill Engine-compatible SafeHands CLI tool.
-
-POSITIONING
-  SafeHands is a guardrail layer, not a generic Web3 toolbox.
-  It checks whether an AI agent action is safe before execution.
-
-  User intent
-  → SafeHands preflight
-  → ALLOW / WARN / BLOCK / REQUIRE_CONFIRMATION
-  → Pharos Skill Engine or MCP execution only if safe
-  → SafeHands risk report
-
-SAFEHANDS BRANDED TOOLS
-  safehands_preflight_check   Policy preflight for payments, approvals, swaps, x402, and custom calls
-  safehands_safe_execute      Guarded wrapper that preflights before execution
-  safehands_wallet_health     Wallet/signer/gas/x402 readiness report
-  safehands_x402_preflight    URL, payment, token, and signer safety check before x402 payment
-  safehands_risk_report       Human-readable judge/demo risk report
-  explain_risk                Explain ALLOW/WARN/BLOCK decisions in plain English
-  token_registry_status       Classify canonical, test, custom, unknown, or invalid token address
-
-OTHER MCP TOOLS
-  Core safety: assess_risk, check_token_security, simulate_transaction, estimate_gas
-  Execution: execute_swap, send_payment, approve_token
-  Market: get_token_price, get_pool_info, get_gas_price
-  Wallet/history: get_wallet_balance, check_allowance, get_transaction_status, get_execution_history
-  Risk registry: publish_risk_score, query_risk_registry
-  x402: x402_pay_and_fetch
-  Managed testnet wallet: create_agent_wallet, get_agent_wallet, get_agent_wallet_balance
-
-PHAROS ATLANTIC TESTNET
-  Environment: atlantic-testnet
-  Chain ID: 688689
-  RPC: https://atlantic.dplabs-internal.com
-  Explorer: https://atlantic.pharosscan.xyz/
-  RiskRegistry: 0x61962a6c812ee9f57b207e1ea47c19ae70bb7141
-
-x402 BEHAVIOR
-  Free endpoints, such as /supported and /health, do not require a private key.
-  Paid endpoints are fetched normally first. Only after HTTP 402 does SafeHands run x402 preflight and request a signer.
-  Signed payment payloads and payment headers are not logged or returned.
-
-DEFAULT SAFETY
-  WALLET_MODE=none
-  WRITE_TOOLS_ENABLED=false
-  ALLOW_UNLIMITED_APPROVAL=false
-  ALLOW_LOCAL_X402_FETCH=false
-
-  No wallet is created on install, import, or startup.
-  Write tools are disabled by default.
-  Unlimited approvals are blocked by default.
-  Mainnet actions are blocked.
-  SSRF-sensitive x402 URLs are blocked by default.
-
-EXAMPLES
-  npx safehands-pharos skill safehands_preflight_check --input-json '{"actionType":"send_payment","chainId":688689,"isMainnet":false,"amount":"0.001","recipient":"0x0000000000000000000000000000000000000001"}'
-
-  npx safehands-pharos skill token_registry_status --input-json '{"tokenAddress":"0xE0BE08c77f415F577A1B3A9aD7a1Df1479564ec8"}'
-
-DOCS
-  README.md
-  skill/SKILL.md
+    process.stdout.write(`
+🛡️  SafeHands-Pharos: Transaction Safety Firewall for AI Agents
+   v${PKG_VERSION} | Pharos Pacific Mainnet | Chain ID 1672
+
+USAGE
+  npx github:SZtch/safehands-pharos
+      Start SafeHands as an MCP server over stdio.
+
+  npx github:SZtch/safehands-pharos --help
+      Show this help.
+
+  npx github:SZtch/safehands-pharos init
+      Launch the interactive setup wizard to configure your .env file safely.
+
+  npx github:SZtch/safehands-pharos --demo
+      Run the deterministic non-destructive hackathon demo.
+
+  npx github:SZtch/safehands-pharos skill <tool_name> --input-json '<json>'
+      Run a Pharos Skill Engine-compatible SafeHands CLI tool.
+
+POSITIONING
+  SafeHands is an open-source reusable Pharos Skill that gives AI agents
+  a safety gateway before on-chain actions. Mainnet-first for Pharos Pacific
+  read/check/analyze; execution/signing/managed-wallet/on-chain publishing
+  remain gated and disabled by default.
+
+  User intent
+  → SafeHands preflight
+  → ALLOW / BLOCK / REQUIRE_CONFIRMATION / PREPARE_ONLY
+  → Execute only if safe
+  → SafeHands risk report
+
+EXECUTION MODES
+  Preflight / read-only    No wallet, no key, no authorization required
+  User-signed              SafeHands validates; user signs externally
+  Managed execution        SafeHandsRegistry authorization + funding required
+  Env wallet (advanced)    Local mainnet key, not default UX
+  Operator / demo          Auto-authorize via owner key, mainnet only
+
+SAFEHANDS TOOLS (33)
+  Safety preflight:   safehands_preflight_check, safehands_x402_preflight,
+                      safehands_risk_report, safehands_wallet_health,
+                      explain_risk, token_registry_status, query_risk_registry,
+                      verify_risk_inclusion, get_agent_reputation
+  Execution (gated):  safehands_safe_execute, execute_swap, send_payment,
+                      approve_token, publish_risk_score, x402_pay_and_fetch
+  Risk + analysis:    assess_risk, check_token_security, simulate_transaction,
+                      estimate_gas
+  Market + chain:     get_token_price, get_pool_info, get_gas_price,
+                      get_wallet_balance, check_allowance,
+                      get_transaction_status, get_execution_history,
+                      query_goldsky_subgraph, get_spv_proof
+  Agent policy:       get_agent_policy, set_agent_policy
+  Managed wallet:     create_agent_wallet, get_agent_wallet,
+                      get_agent_wallet_balance
+
+PHAROS PACIFIC MAINNET (default: read/check/analyze)
+  Network: Pharos Pacific Mainnet
+  Chain ID: 1672
+  Native token: PROS
+  RPC: https://rpc.pharos.xyz
+  Explorer: https://www.pharosscan.xyz
+
+PHAROS ATLANTIC TESTNET (deprecated for execution)
+  Environment: atlantic-testnet
+  Chain ID: 688689
+  RPC: https://atlantic.dplabs-internal.com
+  Explorer: https://atlantic.pharosscan.xyz/
+
+x402 BEHAVIOR
+  Free endpoints, such as /supported and /health, do not require a private key.
+  Paid endpoints are fetched normally first. Only after HTTP 402 does SafeHands run x402 preflight and request a signer.
+  Signed payment payloads and payment headers are not logged or returned.
+
+DEFAULT SAFETY
+  WALLET_MODE=none
+  WRITE_TOOLS_ENABLED=false
+  ALLOW_UNLIMITED_APPROVAL=false
+  ALLOW_LOCAL_X402_FETCH=false
+
+  No wallet is created on install, import, or startup.
+  Write tools are disabled by default.
+  Unlimited approvals are blocked by default.
+  Mainnet write/payment actions are gated and disabled by default.
+  SSRF-sensitive x402 URLs are blocked by default.
+
+EXAMPLES
+  npx github:SZtch/safehands-pharos skill safehands_preflight_check --input-json '{"actionType":"send_payment","chainId":1672,"isMainnet":true,"amount":"0.001","recipient":"0x0000000000000000000000000000000000000001"}'
+
+  npx github:SZtch/safehands-pharos skill token_registry_status --input-json '{"tokenAddress":"0xc879c018db60520f4355c26ed1a6d572cdac1815"}'
+
+DOCS
+  README.md
 `);
     process.exit(0);
 }
 if (!isDemoMode) {
-    // ─── Startup Validation ────────────────────────────────────────────────
+    // ─── Auto-Wallet Creation ─────────────────────────────────────────────
+    // If WALLET_MODE=managed-mainnet and no default wallet exists yet,
+    // auto-create one so the user just needs to fund it.
+    const DEFAULT_AGENT_ID = "default";
     const walletMode = process.env.WALLET_MODE || "none";
-    const hasManagedWalletMode = walletMode === "managed-testnet";
-    const hasExplicitSignerMode = walletMode === "managed-testnet" || walletMode === "env";
+    if (walletMode === "managed-mainnet" && process.env.MANAGED_WALLET_ENABLED === "true") {
+        const existing = await walletStore.get(DEFAULT_AGENT_ID);
+        if (!existing) {
+            try {
+                const privateKey = generatePrivateKey();
+                const account = privateKeyToAccount(privateKey);
+                const encrypted = encryptKey(privateKey, getEffectiveEncryptionKey());
+                await walletStore.set(DEFAULT_AGENT_ID, {
+                    agentId: DEFAULT_AGENT_ID,
+                    address: account.address,
+                    encryptedKey: encrypted,
+                    environment: "pacific-mainnet",
+                    chainId: 1672,
+                    isMainnet: true,
+                    createdAt: new Date().toISOString(),
+                });
+                console.error(`🛡️  SafeHands - auto-created managed agent wallet: ${account.address}`);
+                console.error(`   Fund it with PROS for gas. Use a DEDICATED low-value wallet; managed execution stays OFF until you opt in.`);
+                console.error("");
+            }
+            catch {
+                console.error("⚠️  SafeHands: failed to auto-create wallet. Use create_agent_wallet manually.");
+                console.error("");
+            }
+        }
+        else {
+            console.error(`🛡️  SafeHands - agent wallet ready: ${existing.address}`);
+            console.error("");
+        }
+    }
+    // ─── Startup Validation ────────────────────────────────────────────────
+    const hasExplicitSignerMode = walletMode === "managed-mainnet" || walletMode === "env";
     if (process.env.WRITE_TOOLS_ENABLED !== "true") {
-        console.error("⚠️  SafeHands — write tools are disabled by default.");
-        console.error("   Preflight, risk report, token registry, read-only, and x402 free endpoint checks remain available.");
-        console.error("   To execute trusted testnet actions, set WRITE_TOOLS_ENABLED=true and configure a signer via WALLET_MODE=managed-testnet or WALLET_MODE=env.");
+        console.error("⚠️  SafeHands: write tools are disabled. Read-only tools remain available.");
+        console.error("   To enable writes, set WRITE_TOOLS_ENABLED=true in your .env or MCP config.");
         console.error("");
     }
     else if (!hasExplicitSignerMode) {
-        console.error("⚠️  SafeHands — write tools enabled but no signer mode detected.");
-        console.error("   Use WALLET_MODE=managed-testnet with create_agent_wallet, or WALLET_MODE=env for testnet developer mode.");
+        console.error("⚠️  SafeHands: write tools enabled but no signer mode detected.");
+        console.error("   Set WALLET_MODE=managed-mainnet or WALLET_MODE=env.");
         console.error("");
     }
     // ─── Server Setup ──────────────────────────────────────────────────────
@@ -250,42 +310,59 @@ if (!isDemoMode) {
     });
     // ─── Tool Registration ─────────────────────────────────────────────────
     server.tool("safehands_preflight_check", "Run a SafeHands policy preflight before an AI agent sends payment, approves tokens, swaps, publishes risk data, or pays x402.", safehandsPreflightCheckSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsPreflightCheck, params, "safehands_preflight_check")));
-    server.tool("safehands_safe_execute", "Guarded execution wrapper: preflight first, then execute only allowed and explicitly confirmed testnet actions.", safehandsSafeExecuteSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsSafeExecute, params, "safehands_safe_execute")));
-    server.tool("safehands_wallet_health", "Check whether an AI agent wallet is funded, signer-ready, and safe to use on Pharos Atlantic Testnet.", safehandsWalletHealthSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsWalletHealth, params, "safehands_wallet_health")));
-    server.tool("safehands_x402_preflight", "Check an x402 paid resource for URL safety, payment amount, token, signer, and testnet policy before signing.", safehandsX402PreflightSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsX402Preflight, params, "safehands_x402_preflight")));
+    server.tool("safehands_safe_execute", "Guarded execution wrapper: preflight first, then execute only allowed and explicitly confirmed mainnet actions.", safehandsSafeExecuteSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsSafeExecute, params, "safehands_safe_execute")));
+    // ─── Execution Tools (Gated) ───────────────────────────────────────────
+    server.tool(executeSwapTool.name, executeSwapTool.description, executeSwapTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleExecuteSwap, params, "execute_swap")));
+    server.tool(sendPaymentTool.name, sendPaymentTool.description, sendPaymentTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleSendPayment, params, "send_payment")));
+    server.tool(approveTokenTool.name, approveTokenTool.description, approveTokenTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleApproveToken, params, "approve_token")));
+    server.tool(x402PayAndFetchTool.name, x402PayAndFetchTool.description, x402PayAndFetchTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleX402PayAndFetch, params, "x402_pay_and_fetch")));
+    server.tool("safehands_wallet_health", "Check whether an AI agent wallet is funded, signer-ready, and safe to use on Pharos Mainnet.", safehandsWalletHealthSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsWalletHealth, params, "safehands_wallet_health")));
+    server.tool("safehands_x402_preflight", "Check an x402 paid resource for URL safety, payment amount, token, signer, and mainnet policy before signing.", safehandsX402PreflightSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsX402Preflight, params, "safehands_x402_preflight")));
     server.tool("safehands_risk_report", "Generate an audit-friendly human-readable SafeHands risk report for an AI agent action.", safehandsRiskReportSchema.shape, async (params) => mcpText(await invokeTool(handleSafeHandsRiskReport, params, "safehands_risk_report")));
     server.tool("explain_risk", "Explain a SafeHands risk/policy decision in human-readable language.", explainRiskSchema.shape, async (params) => mcpText(await invokeTool(handleExplainRisk, params, "explain_risk")));
-    server.tool("token_registry_status", "Classify exact token input as canonical testnet token, test liquidity token, custom, unknown, or invalid.", tokenRegistryStatusSchema.shape, async (params) => mcpText(await invokeTool(handleTokenRegistryStatus, params, "token_registry_status")));
-    server.tool("assess_risk", "Evaluate the risk of a planned on-chain action (swap or transfer). Returns 0-100 risk score with 5-dimension breakdown.", assessRiskSchema.shape, async (params) => mcpText(await invokeTool(handleAssessRisk, params, "assess_risk")));
-    server.tool("execute_swap", "Swap tokens via FaroSwap with built-in risk gate. Runs risk assessment first, blocks if score > 80.", executeSwapSchema.shape, async (params) => mcpText(await invokeTool(handleExecuteSwap, params, "execute_swap")));
-    server.tool("send_payment", "Send native PHRS with pre-flight validation. Checks address, balance, and warns on high exposure.", sendPaymentSchema.shape, async (params) => mcpText(await invokeTool(handleSendPayment, params, "send_payment")));
-    server.tool("simulate_transaction", "Dry run a swap or transfer via eth_call — no gas spent. Returns expected output and revert reasons.", simulateTransactionSchema.shape, async (params) => mcpText(await invokeTool(handleSimulateTransaction, params, "simulate_transaction")));
-    server.tool("get_execution_history", "Pull on-chain transaction history for a wallet. Filters by swap, transfer, or all.", getExecutionHistorySchema.shape, async (params) => mcpText(await invokeTool(handleGetExecutionHistory, params, "get_execution_history")));
-    server.tool("get_token_price", "Fetch real-time price of PHRS, USDC, or USDT on Pharos using DODO liquidity quotes.", getTokenPriceSchema.shape, async (params) => mcpText(await invokeTool(handleGetTokenPrice, params, "get_token_price")));
-    server.tool("get_wallet_balance", "Return PHRS, USDC, USDT balances for a wallet with total USD estimate.", getWalletBalanceSchema.shape, async (params) => mcpText(await invokeTool(handleGetWalletBalance, params, "get_wallet_balance")));
-    server.tool("check_allowance", "Check ERC-20 token allowance for DODO swap approval. Returns whether approval is needed.", checkAllowanceSchema.shape, async (params) => mcpText(await invokeTool(handleCheckAllowance, params, "check_allowance")));
-    server.tool("get_transaction_status", "Check on-chain transaction status by hash. Returns status, block, gas, and explorer link.", getTransactionStatusSchema.shape, async (params) => mcpText(await invokeTool(handleGetTransactionStatus, params, "get_transaction_status")));
-    server.tool("estimate_gas", "Estimate gas cost for a swap or transfer before executing. Returns cost in PHRS and USD.", estimateGasSchema.shape, async (params) => mcpText(await invokeTool(handleEstimateGas, params, "estimate_gas")));
-    server.tool("publish_risk_score", "Run risk assessment and publish result to the on-chain RiskRegistry. Other agents can query it.", publishRiskScoreSchema.shape, async (params) => mcpText(await invokeTool(handlePublishRiskScore, params, "publish_risk_score")));
-    server.tool("query_risk_registry", "Query the on-chain RiskRegistry for a wallet's published risk score. Read-only, no private key needed.", queryRiskRegistrySchema.shape, async (params) => mcpText(await invokeTool(handleQueryRiskRegistry, params, "query_risk_registry")));
-    server.tool("approve_token", "Approve ERC-20 token spending for FaroSwap (DODO) router. Required before swapping non-native tokens.", approveTokenSchema.shape, async (params) => mcpText(await invokeTool(handleApproveToken, params, "approve_token")));
-    server.tool("get_gas_price", "Get current gas price on Pharos with trend classification and cost estimates.", getGasPriceSchema.shape, async (params) => mcpText(await invokeTool(handleGetGasPrice, params, "get_gas_price")));
-    server.tool("get_pool_info", "Fetch DODO liquidity pool info for a token pair on Pharos. Returns price ratio, impact, and fees.", getPoolInfoSchema.shape, async (params) => mcpText(await invokeTool(handleGetPoolInfo, params, "get_pool_info")));
-    server.tool("check_token_security", "Check token contract security (honeypot, mintable, ownership privileges, tax) via GoPlus Security API.", checkTokenSecuritySchema.shape, async (params) => mcpText(await invokeTool(handleCheckTokenSecurity, params, "check_token_security")));
-    server.tool("x402_pay_and_fetch", "Fetch resources from an HTTP x402 payment-gated server. Automatically handles HTTP 402 payment challenge.", x402PayAndFetchSchema.shape, async (params) => mcpText(await invokeTool(handleX402PayAndFetch, params, "x402_pay_and_fetch")));
+    server.tool("token_registry_status", "Classify exact token input as canonical mainnet token, custom, unknown, or invalid.", tokenRegistryStatusSchema.shape, async (params) => mcpText(await invokeTool(handleTokenRegistryStatus, params, "token_registry_status")));
+    server.tool(assessRiskTool.name, assessRiskTool.description, assessRiskTool.inputSchema.shape, async (params) => {
+        const result = await handleAssessRisk(params);
+        return mcpText(result);
+    });
+    server.tool(simulateTransactionTool.name, simulateTransactionTool.description, simulateTransactionTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleSimulateTransaction, params, "simulate_transaction")));
+    server.tool(getExecutionHistoryTool.name, getExecutionHistoryTool.description, getExecutionHistoryTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetExecutionHistory, params, "get_execution_history")));
+    server.tool(getTokenPriceTool.name, getTokenPriceTool.description, getTokenPriceTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetTokenPrice, params, "get_token_price")));
+    server.tool(getWalletBalanceTool.name, getWalletBalanceTool.description, getWalletBalanceTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetWalletBalance, params, "get_wallet_balance")));
+    server.tool(checkAllowanceTool.name, checkAllowanceTool.description, checkAllowanceTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleCheckAllowance, params, "check_allowance")));
+    server.tool(getTransactionStatusTool.name, getTransactionStatusTool.description, getTransactionStatusTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetTransactionStatus, params, "get_transaction_status")));
+    server.tool(estimateGasTool.name, estimateGasTool.description, estimateGasTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleEstimateGas, params, "estimate_gas")));
+    server.tool(publishRiskScoreTool.name, publishRiskScoreTool.description, publishRiskScoreTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handlePublishRiskScore, params, "publish_risk_score")));
+    server.tool(queryRiskRegistryTool.name, queryRiskRegistryTool.description, queryRiskRegistryTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleQueryRiskRegistry, params, "query_risk_registry")));
+    server.tool(verifyRiskInclusionTool.name, verifyRiskInclusionTool.description, verifyRiskInclusionTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleVerifyRiskInclusion, params, "verify_risk_inclusion")));
+    server.tool(getAgentReputationTool.name, getAgentReputationTool.description, getAgentReputationTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetAgentReputation, params, "get_agent_reputation")));
+    server.tool(getGasPriceTool.name, getGasPriceTool.description, getGasPriceTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetGasPrice, params, "get_gas_price")));
+    server.tool(getPoolInfoTool.name, getPoolInfoTool.description, getPoolInfoTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleGetPoolInfo, params, "get_pool_info")));
+    server.tool("query_goldsky_subgraph", "Execute a GraphQL query against the configured Pharos Goldsky Subgraph endpoint to fetch historical indexing data.", queryGoldskySchema.shape, async (params) => mcpText(await invokeTool(handleQueryGoldsky, params, "query_goldsky_subgraph")));
+    server.tool("get_spv_proof", "Cryptographically verify account and storage data at a specific block height using Pharos SPV (Simplified Payment Verification).", getSpvProofSchema.shape, async (params) => mcpText(await invokeTool(handleGetSpvProof, params, "get_spv_proof")));
+    server.tool(checkTokenSecurityTool.name, checkTokenSecurityTool.description, checkTokenSecurityTool.inputSchema.shape, async (params) => mcpText(await invokeTool(handleCheckTokenSecurity, params, "check_token_security")));
+    // ─── Agent Policy Tools ───────────────────────────────────────────────
+    server.tool("get_agent_policy", "Get the active safety policy for an agent. Returns limits, flags, and profile name. Read-only.", getAgentPolicySchema.shape, async (params) => mcpText(await invokeTool(handleGetAgentPolicy, params, "get_agent_policy")));
+    server.tool("set_agent_policy", "Set or update safety policy for an agent. Choose a profile (conservative/balanced/advanced) or set custom limits. Saved to local policy file.", setAgentPolicySchema.shape, async (params) => mcpText(await invokeTool(handleSetAgentPolicy, params, "set_agent_policy")));
     // ─── Managed Wallet Tools ──────────────────────────────────────────────
-    server.tool("create_agent_wallet", "Create a new managed testnet agent wallet. Private key is encrypted and never returned. Fund the wallet with testnet PHRS before using write tools.", createAgentWalletSchema.shape, async (params) => mcpText(await invokeTool(handleCreateAgentWallet, params, "create_agent_wallet")));
+    server.tool("create_agent_wallet", "Create a new managed mainnet agent wallet. Private key is encrypted and never returned. Fund the wallet with PROS before using write tools.", createAgentWalletSchema.shape, async (params) => mcpText(await invokeTool(handleCreateAgentWallet, params, "create_agent_wallet")));
     server.tool("get_agent_wallet", "Get public info (address, environment, chainId) for a managed agent wallet. Never returns private key.", getAgentWalletSchema.shape, async (params) => mcpText(await invokeTool(handleGetAgentWallet, params, "get_agent_wallet")));
-    server.tool("get_agent_wallet_balance", "Get PHRS, USDC, and USDT balances for a managed agent wallet on Pharos testnet.", getAgentWalletBalanceSchema.shape, async (params) => mcpText(await invokeTool(handleGetAgentWalletBalance, params, "get_agent_wallet_balance")));
+    server.tool("get_agent_wallet_balance", "Get PROS, USDC, and USDT balances for a managed agent wallet on Pharos Mainnet.", getAgentWalletBalanceSchema.shape, async (params) => mcpText(await invokeTool(handleGetAgentWalletBalance, params, "get_agent_wallet_balance")));
     // ─── Start Server ──────────────────────────────────────────────────────
     async function main() {
         const transport = new StdioServerTransport();
         await server.connect(transport);
+        transport.onclose = () => process.exit(0);
+        process.on("SIGINT", () => process.exit(0));
+        process.on("SIGTERM", () => process.exit(0));
         console.error(`SafeHands-Pharos MCP Server v${PKG_VERSION} running on stdio`);
     }
-    main().catch((error) => {
-        console.error("Fatal error:", error);
-        process.exit(1);
-    });
+    const invokedDirectly = !!process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+    if (invokedDirectly) {
+        main().catch((error) => {
+            console.error("Fatal error:", error);
+            process.exit(1);
+        });
+    }
 } // end: !isDemoMode
 //# sourceMappingURL=index.js.map