0.50.0 — three audit rounds, each aimed at the one before it

[VickyXAI]

Round 2 of the audit loop, aimed at round 1. 13 commits, 694 tests.

Why this round exists

0.49.0's 37 fixes were written by six agents working in parallel. This round went looking for what that costs, and found the shape immediately: each agent hardened the rail it was looking at. The quote guard landed on video and image but not music and speech. The in-flight booking landed on Base and the account rail but not Solana, the default chain. Music's Solana call passed no onQuote at all, so the guard hook fired against nobody while the transfer was signed. Every one was a money path and every one passed CI.

The honest headline

Ten angles, 52 raw findings, 30 confirmed after adversarial verification, and not one is a P0 or a P1 — 0.49.0's own list had one of each. The completeness critic's verdict, which I acted on rather than commissioning a round 3:

Do not commission a round 3 as another ten-angle sweep — the general search is spent. Instead: fix the 11 P2s, then run ONE bounded, mechanical rail-parity matrix, which is a table someone fills in, not an audit. Then ship.

The table

test/rail-parity.test.ts states, per paid tool and per rail, which treatments a paid call needs: quote checked before signing, re-reservation at the real price, in-flight booking, honest give-up wording, correct ledger figure. A cell is a claim about the source, so a rail-specific guard that lands without its siblings turns the file red. It also pins the division that is deliberate (the seven tools whose 402 the SDK owns must not grow a quote guard — they cannot see the quote) and fails when a paid tool is missing from the table. It found four more gaps on its first run, all fixed here.

The money paths

Funded wallet moved off its chain	0.49.0's own P0 fix stored the new Solana key and deleted the session file — which is what getChain() keys on — so the continuity pin was never written and the next start moved a funded Base user onto an empty Solana wallet
Two wallets minted at once	The cache was assigned after the await, reachable from two entry points; one caller could get a funding QR for an address whose key was discarded
Duplicate orders	The card re-enabled an armed Place button mid-submit, and treated every transport failure as "nothing happened"
Preview bound not enforced	"Signed at the worst fill you saw" held inside one call; preview and confirm are two, and the confirm re-walked a fresh book
Billed chat booked $0	The account rail short-circuited the settled-cost wrapper, so a billed-then-dropped stream read as a free failure
Unguarded signing	music, speech and realface signed whatever the 402 quoted
Unbooked charges	Solana give-up booked nothing in video and music; speech, image and realface had no in-flight tracking at all
Ledger 2x hot	The reserve was booked as spend: an agent capped at $1.00 on blockrun_rpc was cut off after 250 calls having spent $0.50
Self-refilling cap	delegate wrote spent: 0, and delegate is a tool the model can call
Undisclosed allowance	The Polymarket approval prompt never said the default grant is unlimited
Guard armed on nothing	The relayer's double-send lock fired on credential failures that happen before the batch exists, and its 4xx detector never saw a CLOB ApiError's status

Saying the true thing

"Your wallet needs funding" no longer appears on messages that say nothing was charged — including this repo's own unreadable-quote refusal, which told a wallet holding $1,000 to top up. Account-rail errors are classified at all now: the status boundary excluded a following dot, which is what keeps $402.50 from reading as a status and also what made every BlockRun account API error: 502. fall through silently. A locked keychain is no longer reported as a missing wallet. Card top-up is no longer offered where it does not exist.

Verification

• npm test: 717 pass, 0 fail (was 636 on main)
• npm run typecheck, npm run build: clean
• npm run verify:prices: exit 0 — 0 under-reserving on either chain; the catalogue sweep now names the free-list members it cannot verify instead of counting them as checked
• Context figures resynced: 12,767 tokens full, 5,270 trading

Refuted, and not changed

Two findings were refuted by their verifiers, and one of the critic's own was refuted by a live probe: it filed phone.ts's unknown-reserve comment as citing a dead route, but /v1/phone/numbers/search answers 402 today, so the comment is accurate.

Round 3 (added after review)

The critic's narrow list, run. It was right that the sweep was spent and wrong about what the list contained: the keychain item turned up a live destroy path, and the polymarket item turned out to be documentation rather than deletion.

What	Why it matters
An empty ~/.blockrun/.session overwrote a funded key in the keychain	The gate deciding whether to read the keychain asked existsSync; the loaders behind it trim the file and treat whitespace as no key. Zero-byte file: present to the gate, absent to the loader — keychain skipped, new wallet minted, mirror-back overwrote the funded entry. saveWallet is a non-atomic write, so an interrupted one is enough. Both rails now ask whether the file holds a key, which getChain() already asked twice with comments saying why.
keychainDelete answered differently on Linux	Documents "gone, including was never there"; only macOS honoured it. Zero callers, which is why nothing caught it.
l1-auth-1271.ts told the next maintainer to delete the live credential path	Its header still described the ERC-7739 wrapped L1 signature as the workaround in force and signed off with "delete this module when upstream is fixed". The wrap was the wrong diagnosis, both call sites derive as a plain EOA, and the module has since become the home of deriveApiCreds — so following that instruction stops all trading.
The live e2e scripts printed the wallet address they promised to hide	Four scripts, four different regexes. The two that move real money matched 64-hex only, which is a transaction hash; a 40-hex address went through untouched, and the withdrawal error text really does carry one. Only the isError branch was redacted at all — a thrown exception printed the raw message and stack.
smoke-speech.ts charged the wallet for being run	No flag, limit: null, header advertising "$0.001" for a run that ends with a $0.0525 sound effect.

Three new guards came out of it, in the spirit of the rail-parity matrix — each pins an assumption that previously lived only in a comment:

• test/axios-scope.test.ts — applyClobProxyOnce mutates axios.defaults process-wide and cannot be scoped, because clob-client-v2 reaches for the hoisted axios itself. The safety argument is that only Polymarket shares it. Now a non-Polymarket axios import turns the suite red instead of silently routing that module through an operator's POLYMARKET_CLOB_PROXY.
• test/scripts-redaction.test.ts — one redaction, and no script may grow its own.
• test/scripts-spend-gate.test.ts — anything in scripts/ that registers a tool handler needs a confirm gate and a budget cap. Static on purpose: a behavioural test would charge the wallet the day the gate broke.

The release automation

Four scripts nobody had audited, each able to produce confident output from a failure. Found by a read-only audit subagent, every finding re-verified before fixing.

What	Why it matters
measure-tool-schema.mjs measured a JSON-RPC error as zero tokens	rpc() never looked at msg.error, callers destructure { result }, so an error reply became undefined → result?.tools ?? [] → "0 tokens across 0 tools" at exit 0. With --svg that reaches the context-cost cards as "0.0K tokens" and, since cut divides by the total, a literal "NaN% less". A server answering initialize with an error — the foreign-server case this tool advertises — is all it takes.
…and decoded stdout per chunk	buf += chunk on a Buffer, so an em dash split across a 16KB pipe boundary became U+FFFD. JSON.parse still succeeds; only the number is wrong. The test that pins these figures measures through InMemoryTransport and never touches this reader, so it would have surfaced as an unexplainable README diff.
stamp-server-json.mjs announced a stamp it had not made	No matching package entry → nothing stamped → the template's 0.0.0-template survives (valid semver, so mcp-publisher validate passes) → the success line prints anyway → the registry entry points PulseMCP, Glama and the rest at an npm version that does not exist. The input was guarded against a placeholder; the output was not.
changelog-section.mjs published an empty release body through a symlink	It compared a realpath'd import.meta.url against a non-realpath'd argv[1]. Node realpaths the ESM main entry, so from any symlinked checkout the CLI half did nothing at exit 0 — and publish.yml guards on if ! node scripts/changelog-section.mjs "$VERSION", so exit 0 with empty stdout skips the fallback. Verified: nothing printed before, the section prints now.
sync-brand-numbers.mjs wrote unvalidated remote JSON into the README	String(value) into src="…" and alt="…" with no escaping, in files an unattended bot commits and pushes to the default branch weekly with contents: write. A quote or an angle bracket closes the attribute and injects markup into every consuming repo. Values are now checked at the point of use and escaped on top; verified with a quote-carrying value (exit 1, nothing written).

Its --check also stopped listing stale fenced markers and then declaring everything up to date. Two documentation claims nothing was watching are covered now: the README said "same 20 tools either way" two lines under a marker rendering 19, and docs/mcp-schema-overhead.md kept an unpinned second copy of the profile-cost table.

scripts/ is also in the typecheck now. These files import from src/ and were checked by nothing, so a changed signature would first surface while running against a funded wallet. Adding them surfaced no errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RNqnahSKcBqQemPn5TaMLg

[VickyXAI]

Superseded by #150 (0.51.0), which carries every commit of this branch.