Skip to content

v0.3.4 - hardening

Latest

Choose a tag to compare

@modulout modulout released this 08 Oct 18:14
  • Spending log: locked across processes, written to a unique temp file, pruned by age (a week) instead of by count - two assistants on one wallet cannot overrun the daily cap, and a flood of tiny entries cannot push large ones out of the window.
  • Confirmation dialog: a payment the person confirms may be at most 20 USDC by default (P2FLUX_MAX_CONFIRMED; was 1000).
  • Local server: only public web addresses are paid (no private networks, no .local/.internal names).
  • Hosted server: the paid text is handed out with a claim the assistant holds; the approval link alone unlocks nothing. get_paid_page now takes request_id and claim.

npm: @p2flux/mcp 0.3.4