0.32.3 — nine audit findings, including one in 0.32.2's own headline fix (#64)

A multi-agent audit of 0.32.2 across nine angles, every finding put through two
independent skeptics. 32 findings, 23 survived, 9 refuted. This ships the nine
that could actually hurt someone.

The nastiest is not a money bug: sharp is an optionalDependency but was imported
at the top level, so ESM resolution failed before main() ran. With sharp absent,
`node dist/index.js --version` exited 1 with ERR_MODULE_NOT_FOUND and empty
stdout — all 19 tools gone, for a preview feature that is off by default. A fresh
npx install hits it on musl, unusual arch, offline CI or --no-optional, and no dev
machine ever saw it because every dev machine has sharp built.

0.32.2's own headline fix had its premise inverted: the free-tier cap is on
CHARACTERS, not bytes. That sweep only probed ASCII, where the two are the same
number. 131,000 CJK characters (393,000 bytes) pass through whole. Because UTF-8
length is always >= string length, the byte check could only over-fire — it never
missed a real truncation, it invented ones, and advised callers to leave a working
$0 model for a paid one on a false premise.

Also: the SSRF guard was literal-only and 127.0.0.1.nip.io was verified reading a
local server end-to-end; two reserve bypasses (exa contents?x=1 at 17x, chat
ignoring input tokens at 11.4x); running blockrun_wallet flipped the chain
Base->Solana and made the funding path unreachable; a reverted pUSD transfer
reported success; the 0.32.2 CI automation could fail after npm had published;
and the README understated markets/surf pricing by 27%.

204 tests, typecheck, build and verify:prices (20/20 exact) green. Each fix
carries a regression test; sharp, the chain flip and SSRF were additionally
verified by reproducing the original failure and re-running after.

Author: VickyXAI

.github/workflows/publish.yml

@@ -93,7 +93,12 @@ jobs:
       # Same independent-guard shape as the two publishes above — it checks
       # whether the tag already exists rather than assuming, so re-runs and
       # workflow_dispatch are safe.
+      # Gated on the same version diff as the npm publish above. Without it, a
+      # push that only touched publish.yml (or a workflow_dispatch) would tag
+      # HEAD and title the release from an unrelated commit subject — precisely
+      # in the "release is missing" state this automation exists to repair.
       - name: Tag + GitHub release
+        if: steps.v.outputs.pkg != steps.v.outputs.npm
         env:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.v.outputs.pkg }}
@@ -123,10 +128,19 @@ jobs:
             TITLE="$TAG — $HEADLINE"
           fi
 
-          if ! git rev-parse "$TAG" >/dev/null 2>&1; then
+          # Ask the REMOTE, not the local clone: actions/checkout fetches no tags
+          # by default, so `git rev-parse "$TAG"` always missed and the push ran
+          # unconditionally. An annotated tag already on origin is then rejected
+          # as non-fast-forward, and `set -e` fails the job AFTER npm and the
+          # registry have already published — the worst place to fail.
+          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
+            echo "tag $TAG already on origin — not re-pushing"
+          else
             git tag -a "$TAG" -m "$TITLE"
             git push origin "$TAG"
           fi
 
-          gh release create "$TAG" --title "$TITLE" --notes-file /tmp/notes.md --latest
+          # Pin the release to the tag's commit explicitly rather than letting
+          # GitHub default to the branch head.
+          gh release create "$TAG" --title "$TITLE" --notes-file /tmp/notes.md --latest --target "$(git rev-parse HEAD)"
           echo "Released $TAG"

CHANGELOG.md

@@ -2,6 +2,67 @@
 
 All notable changes to BlockRun MCP will be documented in this file.
 
+## 0.32.3
+
+A multi-agent audit of 0.32.2 across nine angles, every finding put through two
+independent skeptics. It caught nine real defects — including one in 0.32.2's own
+headline fix. The nastiest is not a money bug: **an optional dependency could kill
+the entire server.**
+
+- **`fix(server)` — a missing `sharp` took down all 19 tools.** `sharp` is an
+  `optionalDependency`, but `inline-image.ts` imported it at the top level, so ESM
+  resolution failed before `main()` ran. Reproduced: with sharp absent,
+  `node dist/index.js --version` exits **1** with `ERR_MODULE_NOT_FOUND` and empty
+  stdout — for a preview feature that is **off by default**, on profiles that never
+  register `blockrun_image`. A fresh `npx -y @blockrun/mcp@latest` hits it on musl,
+  unusual arch, offline CI or `--no-optional`. No dev machine ever saw it, because
+  every dev machine has sharp built. `qr.ts` documents this exact hazard and loads
+  lazily; this module now does too. Verified after the fix: `--version` returns
+  `0.32.3` and `tools/list` returns all 19 tools with sharp removed.
+- **`fix(chat)` — 0.32.2's truncation cap was measured in BYTES; the gateway caps
+  CHARACTERS.** The original sweep only probed ASCII, where the two are the same
+  number. CJK separates them: **131,000 CJK characters (393,000 bytes) pass through
+  whole** (`prompt_tokens 131,065`), and both alphabets cap at ~131,072 characters.
+  Because UTF-8 length is always >= string length, the byte check could only
+  **over**-fire — it never missed a real truncation, it invented ones, bolting
+  "⚠️ TRUNCATED … only the first ~87%" onto complete, correct answers for any
+  non-ASCII prompt and advising the caller to switch to a **paid** model. It pushed
+  agents off a working $0 path into real USDC spend on a false premise, which is
+  worse than the silence it was meant to fix. The test that pinned the wrong
+  behaviour is now inverted.
+- **`fix(security)` — SSRF guard was literal-only; wildcard DNS walked through it.**
+  `127.0.0.1.nip.io` is a public name that resolves to loopback, and was verified
+  end-to-end reading a local server and base64ing the body into the data URI sent
+  onward to the gateway; `169.254.169.254.nip.io` reaches cloud metadata the same
+  way. No redirect needed, so the per-hop literal check saw nothing suspicious.
+  Hostnames are now resolved and **every** returned address is checked, failing
+  closed on NXDOMAIN.
+- **`fix(budget)` — two reserve bypasses.** `blockrun_exa` matched the raw path, so
+  `contents?x=1` missed the per-URL branch: 100 URLs reserved **$0.012** and settled
+  **$0.202** (17x), booked wrong permanently. And `estimateChatCost` ignored input
+  entirely — a 100k-word prompt settled **$0.2557** against a **$0.0225** reserve
+  (11.4x), with break-even at ~15 KB, an ordinary pasted file. Both now priced.
+- **`fix(wallet)` — running `blockrun_wallet` flipped the chain Base → Solana.**
+  `ensureBothWallets()` (the *default* status action) writes `.solana-session`, and
+  chain autodetect keys off that file existing. Afterwards every paid tool signs
+  from a zero-balance Solana wallet or refuses "Base-only" — including
+  `action:"deposit"`, so the funding path itself became unreachable. Reproduced in a
+  clean HOME; the chain is now pinned across provisioning.
+- **`fix(polymarket)` — a reverted pUSD transfer reported success.** viem does not
+  throw on revert; the receipt was discarded, so a failed withdrawal still printed
+  "✅ Withdrawal submitted … the bridge delivers USDC to Base". `redeem.ts` and
+  `setup.ts` both assert `receipt.status`; this path now does too.
+- **`fix(ci)` — the 0.32.2 tag/release automation had two holes.** The step had no
+  version-changed guard, so a `publish.yml`-only push or `workflow_dispatch` would
+  tag HEAD and title the release from an unrelated commit. And `actions/checkout`
+  fetches no tags, so the "tag exists" check always missed and the push ran
+  unconditionally — failing the job *after* npm had already published. Now gated on
+  the version diff and checked against `git ls-remote`.
+- **`docs` — the README advertised $0.0075 for `blockrun_markets`/`blockrun_surf`;
+  both charge $0.0095.** A 27% understatement of real money in the most-read file,
+  and "$5 covers ~5,000 market queries" was 9.5x off (~525). Five lines corrected.
+- 204 tests, typecheck, build and `verify:prices` (20/20 exact) green.
+
 ## 0.32.2
 
 The free tier throws away everything past 128 KiB and returns `200` as if it

README.md

@@ -163,7 +163,7 @@ An unknown profile name falls back to `full`. `modal` and `phone` are `full`-pro
 
 Run `blockrun_wallet` to see your address. The server pays on **Base** by default — send USDC on Base (Coinbase → USDC → Base network → paste address, or bridge via [bridge.base.org](https://bridge.base.org)).
 
-**$5 covers** ~5,000 market queries · ~500 Exa searches · ~250 image generations · ~10 Seedance 1.5-pro clips.
+**$5 covers** ~525 market queries · ~500 Exa searches · ~250 image generations · ~10 Seedance 1.5-pro clips.
 
 Prefer Solana? See [Fund your wallet](#fund-your-wallet) — two tool calls, no restart.
 
@@ -181,7 +181,7 @@ Claude reads the odds with `blockrun_markets` and — with your confirmation —
 
 > **Claude:** According to Polymarket, the market puts a **73% probability** on the Fed holding rates steady, 24% on a 25bp cut, 3% on a hike. 24h volume: $2.1M. The "Hold" contract last traded at $0.73.
 >
-> *(via `blockrun_markets` · cost: $0.0075)*
+> *(via `blockrun_markets` · cost: $0.0095)*
 
 ---
 
@@ -204,9 +204,9 @@ Claude reads the odds with `blockrun_markets` and — with your confirmation —
 | `blockrun_music` | MiniMax music generation | per track |
 | `blockrun_speech` | ElevenLabs TTS (Flash/Turbo/Multilingual/v3, 8 voices) + cinematic sound effects; free voice listing | $0.05–0.10/1k chars |
 | `blockrun_price` | Pyth-backed realtime + OHLC — crypto / FX / commodity (free), 12 stock markets (paid) | free or $0.001/call |
-| `blockrun_markets` | Polymarket (markets, candles, trades, orderbooks, leaderboards, smart-wallet PnL/clusters, UMA oracle), Kalshi, Limitless, Opinion, Predict.Fun, dFlow, Binance Futures, cross-platform search | $0.0075/query |
+| `blockrun_markets` | Polymarket (markets, candles, trades, orderbooks, leaderboards, smart-wallet PnL/clusters, UMA oracle), Kalshi, Limitless, Opinion, Predict.Fun, dFlow, Binance Futures, cross-platform search | $0.0095/query |
 | `blockrun_polymarket` | **Trade on Polymarket** (CLOB V2): place/cancel real bets, positions, redeem winnings — signed locally, settled in pUSD from a gasless deposit wallet. Confirm-gated, $25/order default cap. [Details ↓](#-polymarket-trading) | free tool; bets are your funds |
-| `blockrun_surf` | Surf (asksurf.ai) — 84 endpoints: CEX data, on-chain SQL (13 chains, 80+ tables), 100M+ labeled wallets, Polymarket + Kalshi, social mindshare, news, Surf-1.5 chat with citations | $0.0075/call |
+| `blockrun_surf` | Surf (asksurf.ai) — 84 endpoints: CEX data, on-chain SQL (13 chains, 80+ tables), 100M+ labeled wallets, Polymarket + Kalshi, social mindshare, news, Surf-1.5 chat with citations | $0.0095/call |
 | `blockrun_exa` | Neural web search (Exa) — research, competitors, papers, URL content | $0.01/query |
 | `blockrun_search` | Grok Live Search — web + X/Twitter + news with citations | $0.025 × max_results |
 | `blockrun_dex` | Live DEX prices via DexScreener | free |
@@ -274,7 +274,7 @@ Run `blockrun_wallet` to see your address. The server pays on **Base** by defaul
 | Coinbase | Send → USDC → Base network → paste address |
 | Bridge from Ethereum | [bridge.base.org](https://bridge.base.org) |
 
-$5 covers ~5,000 market queries, ~500 Exa searches, ~250 image generations, or ~10 Seedance 1.5-pro clips (5s @ 720p+audio, ~$0.46 each).
+$5 covers ~525 market queries, ~500 Exa searches, ~250 image generations, or ~10 Seedance 1.5-pro clips (5s @ 720p+audio, ~$0.46 each).
 
 ### Pay on Solana
 
@@ -326,8 +326,8 @@ Prompts and a worked example are in [`skills/image-prompting/SKILL.md`](skills/i
 | | Direct APIs | BlockRun |
 |---|---|---|
 | Exa | Sign up, $20/mo minimum | $0.01/call, no subscription |
-| Polymarket | Undocumented, rate-limited | $0.0075/call, clean JSON — plus you can **trade** |
-| Surf (asksurf.ai) | Account + monthly plan | $0.0075/call, no account, 84 endpoints |
+| Polymarket | Undocumented, rate-limited | $0.0095/call, clean JSON — plus you can **trade** |
+| Surf (asksurf.ai) | Account + monthly plan | $0.0095/call, no account, 84 endpoints |
 | Multiple sources | 3 accounts, 3 API keys, 3 billing pages | **1 wallet** |
 
 One wallet. All sources. No dashboards.

VERSION

@@ -1 +1 @@
-0.32.2
+0.32.3

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/mcp",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "mcpName": "io.github.BlockRunAI/blockrun-mcp",
   "description": "BlockRun MCP Server - Give your AI agent web search, deep research, prediction markets, and crypto data. Paid via x402 micropayments.",
   "type": "module",

src/tools/chat.ts

@@ -4,35 +4,35 @@ import { z } from "zod";
 import { buildClient, buildClientWithTimeout, getAnthropicClient, baseOnlyMessage } from "../utils/wallet.js";
 import { handleAnthropicNative, isAnthropicModel } from "./chat-anthropic.js";
 import { extractErrorMessage, formatError } from "../utils/errors.js";
-import { MODEL_TIERS, FREE_MODEL_TIMEOUT_MS, FREE_TIER_DEADLINE_MS, FREE_TIER_MAX_PROMPT_BYTES, type RoutingMode } from "../utils/constants.js";
+import { MODEL_TIERS, FREE_MODEL_TIMEOUT_MS, FREE_TIER_DEADLINE_MS, FREE_TIER_MAX_PROMPT_CHARS, type RoutingMode } from "../utils/constants.js";
 import { reserveBudget, recordActualSpend } from "../utils/budget.js";
 import { withTxFee } from "../utils/tx-fee.js";
 import type { ApiClient } from "../utils/wallet.js";
 import type { BudgetState } from "../types.js";
 
 /**
- * Byte size of everything we are about to send as prompt. Used only to decide
- * whether the free path will silently drop part of it.
+ * Character length of everything we are about to send as prompt. Used only to
+ * decide whether the free path will silently drop part of it.
+ *
+ * CHARACTERS, not bytes. 0.32.2 measured this in bytes and was wrong — see
+ * FREE_TIER_MAX_PROMPT_CHARS for the CJK measurements that disproved it.
  */
-export function promptByteSize(
+export function promptCharSize(
   message: string,
   system?: string,
   messages?: Array<{ content: unknown }>,
 ): number {
-  let bytes = Buffer.byteLength(message, "utf8");
-  if (system) bytes += Buffer.byteLength(system, "utf8");
+  let chars = message.length;
+  if (system) chars += system.length;
   for (const m of messages ?? []) {
-    bytes += Buffer.byteLength(
-      typeof m.content === "string" ? m.content : JSON.stringify(m.content ?? ""),
-      "utf8",
-    );
+    chars += (typeof m.content === "string" ? m.content : JSON.stringify(m.content ?? "")).length;
   }
-  return bytes;
+  return chars;
 }
 
 /**
  * The free NVIDIA path truncates at 128 KiB and still answers 200 with a
- * confident, well-formed reply — see FREE_TIER_MAX_PROMPT_BYTES for the
+ * confident, well-formed reply — see FREE_TIER_MAX_PROMPT_CHARS for the
  * measurements. Nothing in the response says the input was cut, so an agent
  * summarising a large document over mode:"free" would present an answer about
  * the first 128 KiB as an answer about the whole thing.
@@ -41,15 +41,15 @@ export function promptByteSize(
  * it is indistinguishable from success. We cannot stop the gateway doing it, so
  * the tool says so out loud. Returns null when nothing was lost.
  */
-export function freeTierTruncationNote(promptBytes: number, model: string): string | null {
+export function freeTierTruncationNote(promptChars: number, model: string): string | null {
   if (!model.startsWith("nvidia/")) return null; // paid models scale past this
-  if (promptBytes <= FREE_TIER_MAX_PROMPT_BYTES) return null;
-  const keptPct = Math.round((FREE_TIER_MAX_PROMPT_BYTES / promptBytes) * 100);
+  if (promptChars <= FREE_TIER_MAX_PROMPT_CHARS) return null;
+  const keptPct = Math.round((FREE_TIER_MAX_PROMPT_CHARS / promptChars) * 100);
   return (
-    `\n\n⚠️ TRUNCATED: the prompt was ${Math.round(promptBytes / 1024)} KiB, but the free ` +
-    `NVIDIA path silently caps input at ${FREE_TIER_MAX_PROMPT_BYTES / 1024} KiB. Roughly ` +
-    `${100 - keptPct}% of it never reached the model, so the answer above covers only the ` +
-    `first ~${keptPct}%. Paid models do not truncate — pass an explicit model (or a paid ` +
+    `\n\n⚠️ TRUNCATED: the prompt was ${promptChars.toLocaleString("en-US")} characters, but ` +
+    `the free NVIDIA path silently caps input at ${FREE_TIER_MAX_PROMPT_CHARS.toLocaleString("en-US")}. ` +
+    `Roughly ${100 - keptPct}% of it never reached the model, so the answer above covers only ` +
+    `the first ~${keptPct}%. Paid models do not truncate — pass an explicit model (or a paid ` +
     `mode) to send the whole prompt.`
   );
 }
@@ -68,6 +68,7 @@ export function estimateChatCost(
   mode: string | undefined,
   model: string | undefined,
   thinkingBudget?: number,
+  promptChars?: number,
 ): number {
   // Free paths bypass the gate entirely — but ONLY when the call is genuinely
   // free, and `mode` alone does not make it so.
@@ -100,7 +101,17 @@ export function estimateChatCost(
   // reserve must cover the CHARGE, not the base. Rounded to micro-dollars because
   // the raw float drifts — (1024/1e6)*20 is 0.020479999999999998, which then
   // surfaces verbatim in budget messages.
-  const frontierReserve = withTxFee(Math.max(0.01, Math.round((out / 1_000_000) * 20 * 1e6) / 1e6));
+  // INPUT counts too. Until 0.32.3 the reserve was derived from output alone,
+  // so a large pasted document reserved the same as a one-line question: a
+  // 100k-word prompt settled $0.2557 against a $0.0225 reserve (11.4x short),
+  // and break-even was only ~15 KB of prompt — an ordinary pasted file. A
+  // BLOCKRUN_BUDGET_LIMIT was then blown several times over by ONE approved
+  // call, and concurrency multiplied it. ~4 chars/token, priced at a frontier
+  // input rate; over-reserving only tightens the gate, the ledger still books
+  // the real settled cost via recordActualSpend().
+  const inTokens = Math.ceil((promptChars ?? 0) / 4);
+  const inputReserve = (rate: number) => Math.round((inTokens / 1_000_000) * rate * 1e6) / 1e6;
+  const frontierReserve = withTxFee(Math.max(0.01, Math.round((out / 1_000_000) * 20 * 1e6) / 1e6) + inputReserve(5));
 
   // Any tier whose FIRST-CHOICE model is a frontier model, plus any explicit
   // single model, can settle at a price we can't know up front — reserve
@@ -123,7 +134,7 @@ export function estimateChatCost(
   if (model) return frontierReserve;
 
   // Only the explicitly-cheap tiers (cheap/fast/glm) pick budget models.
-  return withTxFee(Math.max(0.002, Math.round((out / 1_000_000) * 3 * 1e6) / 1e6));
+  return withTxFee(Math.max(0.002, Math.round((out / 1_000_000) * 3 * 1e6) / 1e6) + inputReserve(1));
 }
 
 /**
@@ -197,11 +208,11 @@ Run blockrun_models to see all available models with pricing.`,
 
       // Measured once and checked against whichever model each path settles on:
       // the free NVIDIA path drops everything past 128 KiB without saying so.
-      const promptBytes = promptByteSize(message, system, messages);
+      const promptChars = promptCharSize(message, system, messages);
 
       // Budget gate: global + per-agent enforcement. The tier/model is resolved
       // AFTER the gate, so reserve the worst case it could settle at.
-      const estimatedCost = estimateChatCost(max_tokens, mode, model, thinking?.budget_tokens);
+      const estimatedCost = estimateChatCost(max_tokens, mode, model, thinking?.budget_tokens, promptChars);
       // Reserve the estimate up front so concurrent calls can't each pass a
       // stale budget; release in finally once the call settles or fails (the
       // real settled cost is booked separately via recordActualSpend).
@@ -275,7 +286,7 @@ Run blockrun_models to see all available models with pricing.`,
           }));
           const reply = result.choices?.[0]?.message?.content || "";
           recordActualSpend(budget, settledUsd, estimatedCost, agent_id);
-          const note = freeTierTruncationNote(promptBytes, targetModel);
+          const note = freeTierTruncationNote(promptChars, targetModel);
           return {
             content: [{ type: "text", text: `[${targetModel} | ${fullMessages.length} msgs]\n\n${reply}${note ?? ""}` }],
             structuredContent: { model_used: targetModel, response: reply, message_count: fullMessages.length, ...(note ? { truncated: true } : {}) },
@@ -296,7 +307,7 @@ Run blockrun_models to see all available models with pricing.`,
             stop,
           }));
           recordActualSpend(budget, settledUsd, estimatedCost, agent_id);
-          return { content: [{ type: "text", text: `${response}${freeTierTruncationNote(promptBytes, model) ?? ""}` }] };
+          return { content: [{ type: "text", text: `${response}${freeTierTruncationNote(promptChars, model) ?? ""}` }] };
         } catch (error) {
           return {
             content: [{ type: "text", text: formatError(extractErrorMessage(error)) }],
@@ -335,7 +346,7 @@ Run blockrun_models to see all available models with pricing.`,
             stop,
           }));
           recordActualSpend(budget, settledUsd, estimatedCost, agent_id);
-          const note = freeTierTruncationNote(promptBytes, m);
+          const note = freeTierTruncationNote(promptChars, m);
           return {
             content: [{ type: "text", text: `[${m}]\n\n${response}${note ?? ""}` }],
             structuredContent: { model_used: m, response, ...(note ? { truncated: true } : {}) },