fix(agentstack): reject malformed CoinPay DIDs

packages/agentstack/src/index.test.ts

@@ -26,11 +26,12 @@ describe("DID helpers", () => {
     expect(parseDid(agentDid("abc"))).toEqual({ kind: "agent", id: "abc" });
   });
 
-  it("rejects non-CoinPay DIDs", () => {
-    expect(parseDid("did:web:example.com")).toBeNull();
-    expect(parseDid("did:coinpay:bot:abc")).toBeNull();
-  });
-});
+  it("rejects non-CoinPay DIDs", () => {
+    expect(parseDid("did:web:example.com")).toBeNull();
+    expect(parseDid("did:coinpay:bot:abc")).toBeNull();
+    expect(parseDid("did:coinpay:user:abc:extra")).toBeNull();
+  });
+});
 
 describe("AgentStack manifest", () => {
   it("is a valid LogicSRC plugin manifest", () => {

packages/agentstack/src/index.ts

@@ -22,13 +22,15 @@ export const userDid = (id: string) => makeDid("user", id);
 export const agentDid = (id: string) => makeDid("agent", id);
 
 /** Parse a CoinPay DID into its kind and id, or return null if it is not one. */
-export function parseDid(did: string): { kind: DidKind; id: string } | null {
-  const prefix = `${DID_METHOD}:`;
-  if (!did.startsWith(prefix)) return null;
-  const [kind, id] = did.slice(prefix.length).split(":");
-  if ((kind !== "user" && kind !== "agent") || !id) return null;
-  return { kind, id };
-}
+export function parseDid(did: string): { kind: DidKind; id: string } | null {
+  const prefix = `${DID_METHOD}:`;
+  if (!did.startsWith(prefix)) return null;
+  const parts = did.slice(prefix.length).split(":");
+  if (parts.length !== 2) return null;
+  const [kind, id] = parts;
+  if ((kind !== "user" && kind !== "agent") || !id) return null;
+  return { kind, id };
+}
 
 export function isDidTask(value: unknown): value is DidTask {
   return (