warpmetal 0.7.2 → 0.7.3

package/README.md

@@ -58,7 +58,7 @@ integration.
 
 The repository also contains a skills-only WarpMetal plugin for the public
 Plugins Directory shared by Codex and ChatGPT. The plugin remains a separate
-artifact from the npm CLI and requires `warpmetal` CLI version 0.7.1 or newer.
+artifact from the npm CLI and requires `warpmetal` CLI version 0.7.3 or newer.
 
 To test the repository marketplace after the plugin lands on `main`:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -11,7 +11,7 @@ with ad hoc HTTP commands.
 
 ## Start safely
 
-1. Run `warpmetal --version` and require version `0.7.1` or newer for this
+1. Run `warpmetal --version` and require version `0.7.3` or newer for this
    plugin. If it is missing or older, explain the compatibility requirement,
    ask before installing or upgrading software, and use only the official npm
    package from `https://www.npmjs.com/package/warpmetal`.

package/skills/warpmetal/references/cli-reference.md

@@ -61,6 +61,10 @@ arrays. The default envelope and suggested artifact paths live under the
 private WarpMetal state directory. An explicit output path must not already
 contain different content. `challengeHandle` is intentionally absent from the
 wallet envelope: it is neither a buyer payment identifier nor signing input.
+If a previously issued unsigned sponsorship reservation expired, WarpMetal may
+retire that attempt and return a new `paymentAttemptId`. The CLI replaces the
+saved challenge and stale wallet-attempt metadata; use only the newly returned
+workflow.
 
 The current integration targets `@x402api/agent-wallet-cli@0.2.4`. A compatible
 live term is marked `agentWalletSupported: true` and must use the sponsored

package/skills/warpmetal/references/payments.md

@@ -171,6 +171,12 @@ current `termEndsAt` generation are different.
 
 ## Retries and recovery
 
+- Expired unsigned gas sponsorship: run the WarpMetal challenge flow again.
+  WarpMetal retires the expired merchant attempt and requests fresh instructions
+  under a new payment-attempt ID and idempotency key. The CLI replaces stale
+  wallet-attempt metadata when it saves the new challenge. Inspect the new
+  terms and authorize only the new workflow; never reuse an expired envelope or
+  artifact.
 - `payment_pending` or `payment_finalizing`: keep the same checkout bytes and
   artifact. `--wait` performs bounded retries with that exact authorization.
 - Timeout or process restart after authorization: use the saved x402api attempt
@@ -188,6 +194,6 @@ current `termEndsAt` generation are different.
   a fresh challenge; never retry the artifact or fall back to buyer-funded gas.
 - `manual_review`: payment or fulfillment may be final. Stop all payment and
   mutation retries.
-- Expired or corrupt artifact, changed request digest, unexpected recipient,
+- Expired or corrupt signed artifact, changed request digest, unexpected recipient,
   unsupported network, asset, profile, sponsorship error, or request-binding
   mismatch: stop instead of falling back or asking the buyer to fund ETH/SOL.

package/skills/warpmetal/references/safety.md

@@ -105,6 +105,11 @@ Confirm the plan, hostname, OS, and public key before preparing it.
 ## Retry and terminal-state rules
 
 - Reuse the same idempotency key only for the exact same logical request.
+- If an unsigned gas-sponsorship reservation expires, run `warpmetal checkout
+  challenge` again. WarpMetal retires the old merchant attempt, requests fresh
+  instructions with a new payment-attempt ID and idempotency key, and the CLI
+  replaces its saved challenge metadata. Re-evaluate the new terms before
+  authorization; never sign or submit the expired challenge.
 - For `payment_pending`, retry the exact checkout body and the exact same
   payment artifact. Do not create a replacement payment.
 - A signed HTTP 402 rejects that signature. Use the new live challenge for one

package/src/state.js

@@ -6,6 +6,26 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 import { CliError } from "./errors.js";
 
 const STATE_VERSION = 3;
+const WALLET_PAYMENT_STATE_FIELDS = [
+  "walletPaymentAttemptId",
+  "walletBuyerPaymentIdentifier",
+  "walletName",
+  "walletPayerAddress",
+  "paymentArtifactExpiresAt",
+  "paymentArtifactSavedAt",
+];
+
+function replaceChallenge(record, challenge) {
+  const changed =
+    (record.paymentAttemptId &&
+      record.paymentAttemptId !== challenge.paymentAttemptId) ||
+    (record.paymentChallengeDigest &&
+      record.paymentChallengeDigest !== challenge.paymentChallengeDigest);
+  if (changed) {
+    for (const name of WALLET_PAYMENT_STATE_FIELDS) delete record[name];
+  }
+  Object.assign(record, challenge);
+}
 
 function emptyState() {
   return {
@@ -235,9 +255,8 @@ export class StateStore {
   async saveRenewalChallenge(serverId, challenge) {
     await this.update((state) => {
       const renewal = state.renewals[serverId] || { serverId };
-      Object.assign(renewal, challenge, {
-        challengeSavedAt: new Date().toISOString(),
-      });
+      replaceChallenge(renewal, challenge);
+      renewal.challengeSavedAt = new Date().toISOString();
       state.renewals[serverId] = renewal;
     });
   }
@@ -292,13 +311,15 @@ export class StateStore {
         throw new CliError(`No local order state exists for ${taskId}.`, {
           exitCode: 2,
         });
-      order.paymentRequired = paymentRequired;
-      order.paymentAttemptId = paymentAttemptId;
-      order.challengeHandle = challengeHandle;
-      order.paymentRequestDigest = paymentRequestDigest;
-      order.paymentChallengeDigest = paymentChallengeDigest;
-      order.paymentRequestEnvelopePath = paymentWorkflow?.requestEnvelopePath;
-      order.paymentArtifactPath = paymentWorkflow?.paymentArtifactPath;
+      replaceChallenge(order, {
+        paymentRequired,
+        paymentAttemptId,
+        challengeHandle,
+        paymentRequestDigest,
+        paymentChallengeDigest,
+        paymentRequestEnvelopePath: paymentWorkflow?.requestEnvelopePath,
+        paymentArtifactPath: paymentWorkflow?.paymentArtifactPath,
+      });
       order.paymentChallengeSavedAt = new Date().toISOString();
     });
   }