spendos 0.1.0

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "spendos",
+  "version": "0.1.0",
+  "description": "The first autonomous AI agent that governs its own spending. Earns USDC, self-funds inference, proposes investments — all on-chain.",
+  "type": "module",
+  "bin": {
+    "spendos": "./bin/spendos.js"
+  },
+  "keywords": ["ai-agent", "autonomous", "usdc", "x402", "ows", "base", "defi", "governance", "acp", "venice"],
+  "author": "Roman Mondello <romy@consensus.sh>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/consensus-hq/spendos"
+  },
+  "homepage": "https://spendos.xyz",
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "start": "tsx src/server.ts",
+    "deploy-contract": "tsx scripts/deploy.ts",
+    "mcp": "tsx src/mcp-server.ts"
+  },
+  "dependencies": {
+    "@coinbase/x402": "^2.1.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@open-wallet-standard/core": "^1.2.0",
+    "@x402/axios": "^2.9.0",
+    "@x402/core": "^2.9.0",
+    "@x402/evm": "^2.9.0",
+    "@x402/express": "^2.9.0",
+    "@x402/fetch": "^2.9.0",
+    "@xmtp/node-sdk": "^6.0.0",
+    "cors": "^2.8.5",
+    "express": "^4.21.0",
+    "mppx": "^0.5.5",
+    "viem": "^2.46.2",
+    "x402": "^1.1.0"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.17",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  },
+  "optionalDependencies": {
+    "@xmtp/node-bindings-darwin-arm64": "npm:null@*"
+  }
+}

package/plugins/spendos-events/index.ts

@@ -0,0 +1,78 @@
+/**
+ * SpendOS Events Plugin for OpenClaw
+ *
+ * Injects revenue events into the agent's context so it knows
+ * when it earns money, what its balance is, and when to propose
+ * new investment delegations.
+ */
+import { definePluginEntry } from 'openclaw/plugin-sdk/plugin-entry';
+import { Type } from 'openclaw/plugin-sdk/typebox';
+
+const SPENDOS_URL = process.env.SPENDOS_URL ?? 'https://spendos-production.up.railway.app';
+
+export default definePluginEntry({
+  id: 'spendos-events',
+  name: 'SpendOS Revenue Events',
+  description: 'Injects P&L and delegation data into agent context',
+
+  register(api) {
+    // Hook: inject P&L context before every agent response
+    api.registerHook('before_agent_start', async () => {
+      try {
+        const pnlRes = await fetch(`${SPENDOS_URL}/api/pnl`);
+        const pnl = await pnlRes.json() as any;
+
+        const reqRes = await fetch(`${SPENDOS_URL}/api/requests`);
+        const requests = await reqRes.json() as any[];
+
+        const pending = requests.filter((r: any) => r.status === 'pending').length;
+        const active = requests.filter((r: any) => r.status === 'approved').length;
+
+        const context = [
+          `[SpendOS] P&L: earned $${pnl.totalEarned.toFixed(3)}, spent $${pnl.totalSpent.toFixed(4)}, profit $${pnl.profit.toFixed(4)} (${pnl.queryCount} queries, ${pnl.totalEarned > 0 ? ((pnl.profit / pnl.totalEarned) * 100).toFixed(0) : 0}% margin)`,
+          pending > 0 ? `[SpendOS] ${pending} delegation(s) pending your proposals` : '',
+          active > 0 ? `[SpendOS] ${active} active delegation(s)` : '',
+        ].filter(Boolean).join('\n');
+
+        return { systemContext: context };
+      } catch {
+        return {};
+      }
+    });
+
+    // Tool: let the agent check revenue in real-time
+    api.registerTool({
+      name: 'spendos_revenue_status',
+      description: 'Get real-time SpendOS revenue status including P&L, active delegations, and Venice inference balance',
+      parameters: Type.Object({}),
+      async execute() {
+        try {
+          const [pnlRes, walletRes, reqRes] = await Promise.all([
+            fetch(`${SPENDOS_URL}/api/pnl`),
+            fetch(`${SPENDOS_URL}/api/wallet`),
+            fetch(`${SPENDOS_URL}/api/requests`),
+          ]);
+          const pnl = await pnlRes.json() as any;
+          const wallet = await walletRes.json() as any;
+          const requests = await reqRes.json() as any[];
+
+          const text = [
+            `Revenue Status:`,
+            `  Earned: $${pnl.totalEarned.toFixed(3)} (${pnl.queryCount} queries)`,
+            `  Spent: $${pnl.totalSpent.toFixed(4)}`,
+            `  Profit: $${pnl.profit.toFixed(4)} (${pnl.totalEarned > 0 ? ((pnl.profit / pnl.totalEarned) * 100).toFixed(0) : 0}% margin)`,
+            `  Wallet: ${wallet.address}`,
+            `  Inference: ${wallet.inferenceMode} (Venice wallet auth)`,
+            `  Venice balance: $${wallet.veniceBalance?.balanceUsd?.toFixed(2) ?? 'unknown'}`,
+            `  Pending delegations: ${requests.filter((r: any) => r.status === 'pending').length}`,
+            `  Active delegations: ${requests.filter((r: any) => r.status === 'approved').length}`,
+          ].join('\n');
+
+          return { content: [{ type: 'text', text }] };
+        } catch (err) {
+          return { content: [{ type: 'text', text: `SpendOS unavailable: ${err}` }] };
+        }
+      },
+    });
+  },
+});

package/plugins/spendos-events/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@spendos/openclaw-events-plugin",
+  "version": "0.1.0",
+  "type": "module",
+  "openclaw": {
+    "extensions": ["./index.ts"],
+    "compat": {
+      "pluginApi": ">=2026.3.24"
+    }
+  },
+  "dependencies": {
+    "openclaw": ">=2026.4.0"
+  }
+}

package/policies/enforce-bounds.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+
+function deny(reason) {
+  process.stdout.write(JSON.stringify({ allow: false, reason }));
+  process.exit(0);
+}
+
+function allow() {
+  process.stdout.write(JSON.stringify({ allow: true }));
+  process.exit(0);
+}
+
+function normalizeAddress(value) {
+  return String(value).trim().toLowerCase();
+}
+
+function parseBigInt(value, fallback = 0n) {
+  if (value === undefined || value === null || value === "") return fallback;
+  try {
+    return BigInt(String(value));
+  } catch {
+    return fallback;
+  }
+}
+
+try {
+  const raw = readFileSync(0, "utf8");
+  const ctx = JSON.parse(raw);
+
+  const tx = ctx.transaction ?? {};
+  const policy = ctx.policy_config ?? {};
+
+  const to = tx.to ? normalizeAddress(tx.to) : undefined;
+  const valueWei = parseBigInt(tx.value, 0n);
+  const dailyTotalWei = parseBigInt(ctx.spending?.daily_total, 0n);
+
+  const allowedRecipients = Array.isArray(policy.allowed_recipients)
+    ? policy.allowed_recipients.map(normalizeAddress)
+    : [];
+
+  const maxNativeValueWei = parseBigInt(policy.max_native_value_wei, 0n);
+  const maxDailyTotalWei = parseBigInt(policy.max_daily_total_wei, 0n);
+
+  if (allowedRecipients.length > 0) {
+    if (!to) {
+      deny("Transaction recipient missing.");
+    }
+    if (!allowedRecipients.includes(to)) {
+      deny(`Recipient ${to} is not on the allowlist.`);
+    }
+  }
+
+  if (maxNativeValueWei > 0n && valueWei > maxNativeValueWei) {
+    deny(
+      `Native value exceeds limit: ${valueWei.toString()} > ${maxNativeValueWei.toString()}`,
+    );
+  }
+
+  if (maxDailyTotalWei > 0n && dailyTotalWei + valueWei > maxDailyTotalWei) {
+    deny(
+      `Daily native spend exceeds limit: ${(dailyTotalWei + valueWei).toString()} > ${maxDailyTotalWei.toString()}`,
+    );
+  }
+
+  allow();
+} catch (error) {
+  const message = error instanceof Error ? error.message : "unknown policy error";
+  process.stderr.write(message);
+  process.exit(1);
+}