OneDollarAudit Smart Contract Security

** Your task ** Call the native x402 API at: https://leftclaw.services

** Payment method ** This endpoint is hosted outside FluxA and is called directly, not through the FluxA proxy. It settles on-chain in USDC via x402. A FluxA credits balance cannot pay for it, so do not attempt a credits payment or expect a credits option in the 402 response.

Follow the steps below in order.

** Step 1 - Install FluxA Wallet CLI **
npm install -g @fluxa-pay/fluxa-wallet
Or use without installing: npx fluxa-wallet <command>

** Step 2 - Register agent **
fluxa-wallet init --name "<YOUR_AGENT_NAME>" --client "<YOUR_CLIENT>"
The response may include an authorization URL. Present the user with options: [Yes, open the link] [No, don't open]. If YES: run 'open "<URL>"' to open in their browser.
Verify: fluxa-wallet status

** Step 3 - Available endpoints **
This is a native x402 API. The known endpoints are:


** Step 4 - Create an intent mandate **
x402 v3 uses intent mandates: the user pre-approves a spending plan (budget + time window), then the agent makes autonomous payments within those limits.
Payment is in on-chain USDC. Amounts are in atomic units (6 decimals, e.g., 100000 = 0.10 USDC).

fluxa-wallet mandate-create \
  --desc "Spend up to <BUDGET> for <DESCRIPTION> valid for <DURATION>" \
  --amount <BUDGET_IN_ATOMIC_UNITS> \
  --seconds <DURATION_IN_SECONDS>

Options:
- --desc (required): Human-readable spending plan description
- --amount (required): Budget in USDC atomic units (6 decimals)
- --seconds (optional, default 28800 = 8h): Duration in seconds

** Step 5 - Get user to sign the mandate **
The response from Step 4 includes mandateId and authorizationUrl (TTL: 10 minutes).
Present the user with options: [Yes, open the link] [No, don't open]. If YES: run 'open "<authorizationUrl>"' to open in their browser.

** Step 6 - Wait for mandate to be signed **
fluxa-wallet mandate-status --id <MANDATE_ID>
Poll until mandate.status is "signed". The response also includes remainingAmount.
Important: Use --id, not --mandate.

** Step 7 - Call the API **
Make the API request to the endpoint URL. If it returns HTTP 402, continue to Step 8.

** Step 8 - Pay via x402 v3 **
Pass the complete HTTP 402 response body as --payload:

fluxa-wallet x402-v3 \
  --mandate <MANDATE_ID> \
  --payload '$PAYLOAD_402'

The payload must contain an accepts array. Do NOT extract individual fields - pass the entire 402 response JSON.
The response includes xPaymentB64 (the payment token).

** Step 9 - Retry with payment token **
curl -H "Payment-Signature: <xPaymentB64>" <ORIGINAL_API_URL>
Return the raw API response to the user without post-processing.

** Opening links for user **
Whenever you need to open a URL (authorization, approval, or any external link):
1. Present the user with a choice using your interactive options/menu capability (e.g., AskUserQuestion tool)
2. Options: [Yes, open the link] [No, don't open]
3. If YES: run 'open "<URL>"' to open in their default browser
4. If NO: ask how they would like to proceed

** Error handling **
- mandate_not_signed: User hasn't signed yet - ask them to open authorizationUrl
- mandate_expired: Time window passed - create a new mandate
- mandate_budget_exceeded: Budget too low - create a new mandate with a higher limit
- agent_not_registered: No Agent ID - run 'fluxa-wallet init' first
- Invalid payload: missing accepts array: Pass the full 402 response JSON