v0.5.3

What's Changed

• docs: run build before typecheck, and say why by @agentx402-bot in #24
• chore(deps): override nanoid to ^3.3.18 to clear the audit gate by @agentx402-bot in #28
• chore(deps): bump viem from 2.55.11 to 2.55.19 by @dependabot[bot] in #27
• chore(deps): update biome to 2.5.10 by @agentx402-bot in #31
• chore(deps-dev): bump vitest to 4.1.11 by @agentx402-bot in #33
• chore(deps): adopt @agentx402-ai/core ^0.4.1 (@x402 2.23.0) by @agentx402-bot in #34
• chore(release): 0.5.3 — adopt core 0.4.1 (@x402 2.23.0) by @agentx402-bot in #35

Full Changelog: v0.5.2...v0.5.3

v0.5.2

What's Changed

• chore(deps): bump @agentx402-ai/core from 0.3.0 to 0.4.0 by @dependabot[bot] in #22
• chore(release): 0.5.2 — raise the agentx402-ai/core floor to ^0.4.0 by @agentx402-bot in #23

Full Changelog: v0.5.1...v0.5.2

v0.5.1 — no wallet minted on a usage error

Ships a fix that has been on main since #20 and never reached npm: v0.5.0 was tagged two commits before it, so every user on the published CLI still had the bug.

Fixed

• A usage error no longer mints a wallet. A valid command with a missing or invalid required argument created and persisted ~/.agentscout/wallet.json before reporting the error, so agentscout read with no URL answered a typo with created a new wallet 0x… Fund it, then retry — pointing you at spending money to fix a missing argument, and leaving a private key on disk as a side effect of a mistake.

  Affected read, extract (missing/invalid --schema), quote, crawl (missing --url/--max-pages), crawl status, and crawl artifact. Each command now validates its own arguments before anything can touch the keystore.

  Nothing is lost by upgrading: the mint was reused on later runs, so this only stops the unwanted one. The deliberate first-run mint on a genuinely valid command is unchanged.

• Three vulnerable transitive dependencies pinned via overrides. All arrive through @modelcontextprotocol/sdk, a runtime dependency of this CLI, and the SDK has not shipped a release that moves them:

  Package	Severity	Advisory
  ip-address <=10.3.0	2× HIGH	leading-zero octets decoded as decimal while resolvers read them as octal; a CIDR suffix suppressing special-use classification — both bypass SSRF and trust-boundary checks
  fast-uri 3.0.0–3.1.4	HIGH	host confusion via a backslash authority introducer
  hono <4.12.34	moderate	ReDoS in the CORS middleware

  Each override stays inside its package's current major. The SSRF pair is the one that matters for this product: AgentScout exists to fetch arbitrary user-supplied URLs.

Service-side change since 0.5.0

This shipped to the hosted service independently and applies no matter which client version you run.

• Plain-text pages are now read correctly, and are billable. text/plain, text/markdown, text/csv and similar bodies were being run through an HTML extractor that yielded zero characters, so every .txt / .md / RFC / source-file page failed the read-success predicate.

  This changes crawl billing. A crawl only bills pages meeting the read predicate — a failed page is non-billable and refunded — so a plain-text page that previously failed and was refunded now succeeds and bills at the per-page rate. Crawling a site containing .txt files will cost more than before, and will return the content you are paying for. A server mislabelling real HTML as text/plain is still detected and extracted as HTML.

Published to npm with SLSA provenance via OIDC trusted publishing.

v0.5.0

Money-safety and correctness work. Full detail in CHANGELOG.md.

Three changes can break a setup that appeared to work — each replaces a silent degradation with a hard, typed failure: a corrupt or unreadable config.json (which previously dropped your spend cap and reverted the endpoint to production), a non-absolute endpoint, and a corrupt wallet.json (which previously read as "no wallet" even when it held a funded key). If you start seeing these on upgrade, the file was already being ignored.

Fixed — the cumulative session spend cap now holds under concurrency; it was checked against a counter incremented only after the paid round-trip, so parallel operations each passed the same stale check and each signed.

Changed — a configured max_toll_usd default is ignored in account-key mode rather than disabling the entire paid surface; the paid MCP tools declare destructiveHint: false.

Added — an agentscout wallet command and a read-only MCP tool, so the auto-minted wallet can be found to fund and back up.

v0.4.0

Promotes 0.4.0-rc.1 to stable — contents identical.

New ScoutErrorCode members surfaced from @agentx402-ai/core 0.2.0's payment/transport guards (network_error, aborted, unpinned_network, unsupported_network, network_mismatch, asset_mismatch, domain_mismatch, invalid_challenge, invalid_amount). A client that pins its network and signs an honest challenge never sees these — they identify a spoofed/mismatched challenge or a transport failure.

The @agentx402-ai/core dependency floor rises to ^0.2.0: safe-by-default money path (the network + canonical-asset pin is now required before an EIP-3009 authorization is signed), a typed challenge taxonomy, and abort-aware retry. AgentScout's own API is unchanged apart from the added error codes.

See CHANGELOG.md.

v0.4.0-rc.1

Prerelease dry run of the restructured publish workflow, before 0.4.0 goes to latest.

Publishes to the next npm dist-tag — npm install @agentscout/cli continues to resolve 0.3.1. Install this explicitly with @agentscout/cli@next.

Contents are the intended 0.4.0 release: new ScoutErrorCode members surfaced from agentx402-ai/core 0.2.0's payment/transport guards, and the dependency floor raised to ^0.2.0 (network + canonical-asset pin now required before an EIP-3009 authorization is signed). See CHANGELOG.md.

v0.3.1

What's Changed

• chore(deps-dev): bump @biomejs/biome from 2.5.4 to 2.5.5 in the dev-dependencies group by @dependabot[bot] in #4
• chore(deps): bump viem from 2.55.2 to 2.55.10 by @dependabot[bot] in #5

New Contributors

• @dependabot[bot] made their first contribution in #4

Full Changelog: v0.3.0...v0.3.1

v0.3.0 — async extraction, source verification, read links

Async extraction jobs are now polled transparently: await scout.extract(...) behaves the same whether the server needed one pass or ninety. A large page returns a 202 job handle, which 0.2.0 could not handle at all.

• Async extract: free polling with backoff, maxWaitMs (default 120s) whose timeout error carries the status_url — losing patience is not losing the extraction, the job keeps running server-side.
• winning_rung: "chunked" plus chunks / merge_conflicts. A non-zero merge_conflicts means two passes disagreed on a scalar and the winner was chosen by position — part of that answer is a guess, and you can now see it.
• Source verification documented on ExtractResult, with its limits: token-like values are checked against the fetched page and dropped if absent, but prose is exempt and only array items are removed. Schema-valid remains a shape check plus a literal check — not a truth check.
• read({ links }) typed and actually forwarded (previously typed but never sent).

Additive only; existing calls behave identically. Pay-on-success is unchanged and holds across the async path: charged once when a schema-valid result exists, never for a failed job, never per poll.

v0.2.0 — service price increase (upgrade required)

Full Changelog: v0.1.1...v0.2.0

v0.1.1 — read price sync (upgrade required)

Upgrade required

The AgentScout service raises read from $0.002 to $0.003. @agentscout/client@0.1.0 pins its authorized spend ceiling for a read at $0.002 and refuses any 402 quoting above it, so every read() on 0.1.0 throws SpendCapError once the new price is live. 0.1.1 tracks the new price and works against the service both before and after the change.

extract ($0.012) and crawl ($0.002/page) are unchanged.

Also

• Prepaid AgentScout credits are 20% off the per-op price — each service sets its own prepay discount, and AgentScout's is deliberately shallower than AgentKV's 90%-off because every Scout call pays a real upstream fetch (and an LLM pass on extract). Scout credit costs: read 24, extract 96, crawl 16/page.
• Plugin skill reference and SDK usage fixtures requote $0.003.

Full changelog: see CHANGELOG.md