warpmetal 0.7.1 → 0.7.3

package/README.md

@@ -34,7 +34,7 @@ published wallet CLI with the exact version WarpMetal reports:
 npm install --global warpmetal
 warpmetal --help
 
-npm install --global @x402api/agent-wallet-cli@0.2.3
+npm install --global @x402api/agent-wallet-cli@0.2.4
 x402api help --json
 ```
 
@@ -58,7 +58,7 @@ integration.
 
 The repository also contains a skills-only WarpMetal plugin for the public
 Plugins Directory shared by Codex and ChatGPT. The plugin remains a separate
-artifact from the npm CLI and requires `warpmetal` CLI version 0.7.1 or newer.
+artifact from the npm CLI and requires `warpmetal` CLI version 0.7.3 or newer.
 
 To test the repository marketplace after the plugin lands on `main`:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -11,7 +11,7 @@ with ad hoc HTTP commands.
 
 ## Start safely
 
-1. Run `warpmetal --version` and require version `0.7.1` or newer for this
+1. Run `warpmetal --version` and require version `0.7.3` or newer for this
    plugin. If it is missing or older, explain the compatibility requirement,
    ask before installing or upgrading software, and use only the official npm
    package from `https://www.npmjs.com/package/warpmetal`.

package/skills/warpmetal/references/cli-reference.md

@@ -61,8 +61,12 @@ arrays. The default envelope and suggested artifact paths live under the
 private WarpMetal state directory. An explicit output path must not already
 contain different content. `challengeHandle` is intentionally absent from the
 wallet envelope: it is neither a buyer payment identifier nor signing input.
+If a previously issued unsigned sponsorship reservation expired, WarpMetal may
+retire that attempt and return a new `paymentAttemptId`. The CLI replaces the
+saved challenge and stale wallet-attempt metadata; use only the newly returned
+workflow.
 
-The current integration targets `@x402api/agent-wallet-cli@0.2.3`. A compatible
+The current integration targets `@x402api/agent-wallet-cli@0.2.4`. A compatible
 live term is marked `agentWalletSupported: true` and must use the sponsored
 Base USDC or Solana USDC/USDT launch profile with buyer native fees disabled.
 For the current declaration, x402api pays actual gas from its platform treasury

package/skills/warpmetal/references/payments.md

@@ -16,10 +16,16 @@ The separate x402api Agent Wallet owns encrypted network keys, balance checks,
 payment authorization, and durable payment attempts. Never merge their state
 files or pass a WarpMetal credential to `x402api`.
 
+The CLI includes the matching `@x402api/agent-wallet-core` SDK. That SDK is the
+authoritative buyer-side parser and signer contract. WarpMetal retains its own
+merchant-side validation because the backend is Python and additionally binds
+the challenge to WarpMetal's exact resource, amount, recipient, and receipt
+contract.
+
 WarpMetal runs on Node.js 20 or 22. The x402api Agent Wallet currently requires
 Node.js 22. Use the exact published package reported by
 `paymentWorkflow.signerPackage.spec`; the current contract is
-`@x402api/agent-wallet-cli@0.2.3`. Do not add it as a WarpMetal dependency,
+`@x402api/agent-wallet-cli@0.2.4`. Do not add it as a WarpMetal dependency,
 install executable wallet code from an unpinned repository URL, or substitute
 a similarly named package.
 
@@ -130,7 +136,7 @@ reservation or any buyer-funded, unsupported, or unbound alternative.
 
 x402api pays actual gas from its platform treasury. The merchant tenant's
 active sponsorship allowance controls admission, but actual gas is not a
-tenant debit. During the coordinated rollout, accept only the exact 0.2.3
+tenant debit. During the coordinated rollout, accept only the exact 0.2.4
 platform-treasury declaration or the matched legacy tenant-credit declaration;
 never accept a mixed billing and final-charge policy.
 
@@ -165,6 +171,12 @@ current `termEndsAt` generation are different.
 
 ## Retries and recovery
 
+- Expired unsigned gas sponsorship: run the WarpMetal challenge flow again.
+  WarpMetal retires the expired merchant attempt and requests fresh instructions
+  under a new payment-attempt ID and idempotency key. The CLI replaces stale
+  wallet-attempt metadata when it saves the new challenge. Inspect the new
+  terms and authorize only the new workflow; never reuse an expired envelope or
+  artifact.
 - `payment_pending` or `payment_finalizing`: keep the same checkout bytes and
   artifact. `--wait` performs bounded retries with that exact authorization.
 - Timeout or process restart after authorization: use the saved x402api attempt
@@ -182,6 +194,6 @@ current `termEndsAt` generation are different.
   a fresh challenge; never retry the artifact or fall back to buyer-funded gas.
 - `manual_review`: payment or fulfillment may be final. Stop all payment and
   mutation retries.
-- Expired or corrupt artifact, changed request digest, unexpected recipient,
+- Expired or corrupt signed artifact, changed request digest, unexpected recipient,
   unsupported network, asset, profile, sponsorship error, or request-binding
   mismatch: stop instead of falling back or asking the buyer to fund ETH/SOL.

package/skills/warpmetal/references/safety.md

@@ -105,6 +105,11 @@ Confirm the plan, hostname, OS, and public key before preparing it.
 ## Retry and terminal-state rules
 
 - Reuse the same idempotency key only for the exact same logical request.
+- If an unsigned gas-sponsorship reservation expires, run `warpmetal checkout
+  challenge` again. WarpMetal retires the old merchant attempt, requests fresh
+  instructions with a new payment-attempt ID and idempotency key, and the CLI
+  replaces its saved challenge metadata. Re-evaluate the new terms before
+  authorization; never sign or submit the expired challenge.
 - For `payment_pending`, retry the exact checkout body and the exact same
   payment artifact. Do not create a replacement payment.
 - A signed HTTP 402 rejects that signature. Use the new live challenge for one

package/src/payment.js

@@ -15,7 +15,7 @@ const MAX_ARTIFACT_BYTES = 1024 * 1024;
 const MAX_SIGNATURE_BYTES = 512 * 1024;
 
 export const AGENT_WALLET_PACKAGE = "@x402api/agent-wallet-cli";
-export const AGENT_WALLET_VERSION = "0.2.3";
+export const AGENT_WALLET_VERSION = "0.2.4";
 const AGENT_WALLET_SPEC = `${AGENT_WALLET_PACKAGE}@${AGENT_WALLET_VERSION}`;
 const GAS_SPONSORSHIP_EXTENSION = "com.x402api.gas-sponsorship";
 const BASE_NETWORK = "eip155:8453";
@@ -183,6 +183,9 @@ function paymentResource(value, label) {
 function validateGasSponsorship(declaration) {
   const info = declaration.info;
   const schema = declaration.schema;
+  // Mirror @x402api/agent-wallet-core: platform treasury is canonical, the
+  // matched tenant-credit pair remains rollout-compatible, and mixed pairs
+  // must fail closed.
   const platformTreasuryPolicy =
     isObject(info) &&
     info.billingParty === "platform_treasury" &&

package/src/state.js

@@ -6,6 +6,26 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 import { CliError } from "./errors.js";
 
 const STATE_VERSION = 3;
+const WALLET_PAYMENT_STATE_FIELDS = [
+  "walletPaymentAttemptId",
+  "walletBuyerPaymentIdentifier",
+  "walletName",
+  "walletPayerAddress",
+  "paymentArtifactExpiresAt",
+  "paymentArtifactSavedAt",
+];
+
+function replaceChallenge(record, challenge) {
+  const changed =
+    (record.paymentAttemptId &&
+      record.paymentAttemptId !== challenge.paymentAttemptId) ||
+    (record.paymentChallengeDigest &&
+      record.paymentChallengeDigest !== challenge.paymentChallengeDigest);
+  if (changed) {
+    for (const name of WALLET_PAYMENT_STATE_FIELDS) delete record[name];
+  }
+  Object.assign(record, challenge);
+}
 
 function emptyState() {
   return {
@@ -235,9 +255,8 @@ export class StateStore {
   async saveRenewalChallenge(serverId, challenge) {
     await this.update((state) => {
       const renewal = state.renewals[serverId] || { serverId };
-      Object.assign(renewal, challenge, {
-        challengeSavedAt: new Date().toISOString(),
-      });
+      replaceChallenge(renewal, challenge);
+      renewal.challengeSavedAt = new Date().toISOString();
       state.renewals[serverId] = renewal;
     });
   }
@@ -292,13 +311,15 @@ export class StateStore {
         throw new CliError(`No local order state exists for ${taskId}.`, {
           exitCode: 2,
         });
-      order.paymentRequired = paymentRequired;
-      order.paymentAttemptId = paymentAttemptId;
-      order.challengeHandle = challengeHandle;
-      order.paymentRequestDigest = paymentRequestDigest;
-      order.paymentChallengeDigest = paymentChallengeDigest;
-      order.paymentRequestEnvelopePath = paymentWorkflow?.requestEnvelopePath;
-      order.paymentArtifactPath = paymentWorkflow?.paymentArtifactPath;
+      replaceChallenge(order, {
+        paymentRequired,
+        paymentAttemptId,
+        challengeHandle,
+        paymentRequestDigest,
+        paymentChallengeDigest,
+        paymentRequestEnvelopePath: paymentWorkflow?.requestEnvelopePath,
+        paymentArtifactPath: paymentWorkflow?.paymentArtifactPath,
+      });
       order.paymentChallengeSavedAt = new Date().toISOString();
     });
   }