From 2f07f741266fa9daf7562b07d6ccca85ed7962e8 Mon Sep 17 00:00:00 2001
From: RissRIce <jsdavid278@gmail.com>
Date: Mon, 22 Jun 2026 06:24:46 -0600
Subject: [PATCH] fix(agentstack): reject malformed CoinPay DIDs (#83)

---
 packages/agentstack/src/index.test.ts | 11 ++++++-----
 packages/agentstack/src/index.ts      | 16 +++++++++-------
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/packages/agentstack/src/index.test.ts b/packages/agentstack/src/index.test.ts
index 0e5f27a..b262257 100644
--- a/packages/agentstack/src/index.test.ts
+++ b/packages/agentstack/src/index.test.ts
@@ -26,11 +26,12 @@ describe("DID helpers", () => {
     expect(parseDid(agentDid("abc"))).toEqual({ kind: "agent", id: "abc" });
   });
 
-  it("rejects non-CoinPay DIDs", () => {
-    expect(parseDid("did:web:example.com")).toBeNull();
-    expect(parseDid("did:coinpay:bot:abc")).toBeNull();
-  });
-});
+  it("rejects non-CoinPay DIDs", () => {
+    expect(parseDid("did:web:example.com")).toBeNull();
+    expect(parseDid("did:coinpay:bot:abc")).toBeNull();
+    expect(parseDid("did:coinpay:user:abc:extra")).toBeNull();
+  });
+});
 
 describe("AgentStack manifest", () => {
   it("is a valid LogicSRC plugin manifest", () => {
diff --git a/packages/agentstack/src/index.ts b/packages/agentstack/src/index.ts
index c439eb3..1aec33d 100644
--- a/packages/agentstack/src/index.ts
+++ b/packages/agentstack/src/index.ts
@@ -22,13 +22,15 @@ export const userDid = (id: string) => makeDid("user", id);
 export const agentDid = (id: string) => makeDid("agent", id);
 
 /** Parse a CoinPay DID into its kind and id, or return null if it is not one. */
-export function parseDid(did: string): { kind: DidKind; id: string } | null {
-  const prefix = `${DID_METHOD}:`;
-  if (!did.startsWith(prefix)) return null;
-  const [kind, id] = did.slice(prefix.length).split(":");
-  if ((kind !== "user" && kind !== "agent") || !id) return null;
-  return { kind, id };
-}
+export function parseDid(did: string): { kind: DidKind; id: string } | null {
+  const prefix = `${DID_METHOD}:`;
+  if (!did.startsWith(prefix)) return null;
+  const parts = did.slice(prefix.length).split(":");
+  if (parts.length !== 2) return null;
+  const [kind, id] = parts;
+  if ((kind !== "user" && kind !== "agent") || !id) return null;
+  return { kind, id };
+}
 
 export function isDidTask(value: unknown): value is DidTask {
   return (