fix(x402): enforce documented payment ceiling - #228
Open
MagMueller wants to merge 1 commit into
Open
MagMueller wants to merge 1 commit into
MagMueller wants to merge 1 commit into
Conversation
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
2 issues found across 10 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="browser-use-python/src/browser_use_sdk/_core/x402.py">
<violation number="1" location="browser-use-python/src/browser_use_sdk/_core/x402.py:111">
P2: String caps with more than 28 significant digits can round upward during multiplication before `ROUND_FLOOR`, allowing a cap above the requested amount. Scale the decimal exactly or use a precision-sized local decimal context before flooring.</violation>
</file>
<file name="browser-use-node/src/core/x402.ts">
<violation number="1" location="browser-use-node/src/core/x402.ts:50">
P2: For valid decimal caps such as `0.000249`, floating-point multiplication falls just below the intended atomic-unit value, so the ceiling becomes one unit lower than requested. Convert the cap with decimal-safe arithmetic or compensate for representation error before flooring.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
| if not amount.is_finite() or amount <= 0: | ||
| raise ValueError("x402_max_payment_usd must be a positive finite number") | ||
| atomic_units = int( | ||
| (amount * _USDC_ATOMIC_UNITS_PER_DOLLAR).to_integral_value( |
Contributor
There was a problem hiding this comment.
P2: String caps with more than 28 significant digits can round upward during multiplication before ROUND_FLOOR, allowing a cap above the requested amount. Scale the decimal exactly or use a precision-sized local decimal context before flooring.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At browser-use-python/src/browser_use_sdk/_core/x402.py, line 111:
<comment>String caps with more than 28 significant digits can round upward during multiplication before `ROUND_FLOOR`, allowing a cap above the requested amount. Scale the decimal exactly or use a precision-sized local decimal context before flooring.</comment>
<file context>
@@ -97,7 +100,43 @@ def _missing_x402() -> ImportError:
+ if not amount.is_finite() or amount <= 0:
+ raise ValueError("x402_max_payment_usd must be a positive finite number")
+ atomic_units = int(
+ (amount * _USDC_ATOMIC_UNITS_PER_DOLLAR).to_integral_value(
+ rounding=ROUND_FLOOR
+ )
</file context>
| if (!Number.isFinite(maxPaymentUsd) || maxPaymentUsd <= 0) { | ||
| throw new RangeError("x402MaxPaymentUsd must be a positive finite number."); | ||
| } | ||
| const atomicUnits = Math.floor(maxPaymentUsd * USDC_ATOMIC_UNITS_PER_DOLLAR); |
Contributor
There was a problem hiding this comment.
P2: For valid decimal caps such as 0.000249, floating-point multiplication falls just below the intended atomic-unit value, so the ceiling becomes one unit lower than requested. Convert the cap with decimal-safe arithmetic or compensate for representation error before flooring.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At browser-use-node/src/core/x402.ts, line 50:
<comment>For valid decimal caps such as `0.000249`, floating-point multiplication falls just below the intended atomic-unit value, so the ceiling becomes one unit lower than requested. Convert the cap with decimal-safe arithmetic or compensate for representation error before flooring.</comment>
<file context>
@@ -20,13 +20,58 @@ export const X402_BASE_URL_DEFAULT = "https://x402.api.browser-use.com/api/v3";
+ if (!Number.isFinite(maxPaymentUsd) || maxPaymentUsd <= 0) {
+ throw new RangeError("x402MaxPaymentUsd must be a positive finite number.");
+ }
+ const atomicUnits = Math.floor(maxPaymentUsd * USDC_ATOMIC_UNITS_PER_DOLLAR);
+ if (!Number.isSafeInteger(atomicUnits) || atomicUnits < 1) {
+ throw new RangeError("x402MaxPaymentUsd must resolve to at least one USDC atomic unit.");
</file context>
Suggested change
| const atomicUnits = Math.floor(maxPaymentUsd * USDC_ATOMIC_UNITS_PER_DOLLAR); | |
| const atomicUnits = Math.floor( | |
| maxPaymentUsd * USDC_ATOMIC_UNITS_PER_DOLLAR + | |
| Number.EPSILON * Math.max(1, Math.abs(maxPaymentUsd * USDC_ATOMIC_UNITS_PER_DOLLAR)), | |
| ); |
|
I'm interested in building x402 integration for my users with browser use. If this gets merged and fixes the top off issue before I get some other integration in place I'd love to use it. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
x402_max_payment_usdandx402MaxPaymentUsdoptions to the Python and TypeScript V2/V3 clientsWhy
The public quickstart already passes these options, but SDK 3.11.1 does not implement them. Python raises
TypeErrorbefore making a request. TypeScript does not declare the option, and untyped JavaScript ignores it. That means the advertised safety ceiling is not actually registered on SDK-created x402 clients.This is adjacent to #221 but intentionally narrower. It makes the payment ceiling real and makes the current behavior explicit. It does not add generic wallet authentication, allow existing wallet-keyed credit to bypass a new payment challenge, add V4 x402 support, change the $1 minimum, or change the
uptotier.Validation
llms.txtgeneration is idempotentgit diff --checkpassesNo wallet funds, payment, API key, customer data, or live Cloud request was used.
Summary by cubic
Enforces the documented
x402MaxPaymentUsd/x402_max_payment_usdoption in the Python and TypeScript V2/V3 clients. The option previously had no effect (Python raisedTypeError, TypeScript never declared it); SDK-created x402 clients now reject payment requirements above the configured ceiling and default to $1 per payment.Details
RangeError/ValueError.Written for commit 0bed23f. Summary will update on new commits.