v0.5.1 — no wallet minted on a usage error

Ships a fix that has been on main since #20 and never reached npm: v0.5.0 was tagged two commits before it, so every user on the published CLI still had the bug.

Fixed

• A usage error no longer mints a wallet. A valid command with a missing or invalid required argument created and persisted ~/.agentscout/wallet.json before reporting the error, so agentscout read with no URL answered a typo with created a new wallet 0x… Fund it, then retry — pointing you at spending money to fix a missing argument, and leaving a private key on disk as a side effect of a mistake.

  Affected read, extract (missing/invalid --schema), quote, crawl (missing --url/--max-pages), crawl status, and crawl artifact. Each command now validates its own arguments before anything can touch the keystore.

  Nothing is lost by upgrading: the mint was reused on later runs, so this only stops the unwanted one. The deliberate first-run mint on a genuinely valid command is unchanged.

• Three vulnerable transitive dependencies pinned via overrides. All arrive through @modelcontextprotocol/sdk, a runtime dependency of this CLI, and the SDK has not shipped a release that moves them:

  Package	Severity	Advisory
  ip-address <=10.3.0	2× HIGH	leading-zero octets decoded as decimal while resolvers read them as octal; a CIDR suffix suppressing special-use classification — both bypass SSRF and trust-boundary checks
  fast-uri 3.0.0–3.1.4	HIGH	host confusion via a backslash authority introducer
  hono <4.12.34	moderate	ReDoS in the CORS middleware

  Each override stays inside its package's current major. The SSRF pair is the one that matters for this product: AgentScout exists to fetch arbitrary user-supplied URLs.

Service-side change since 0.5.0

This shipped to the hosted service independently and applies no matter which client version you run.

• Plain-text pages are now read correctly, and are billable. text/plain, text/markdown, text/csv and similar bodies were being run through an HTML extractor that yielded zero characters, so every .txt / .md / RFC / source-file page failed the read-success predicate.

  This changes crawl billing. A crawl only bills pages meeting the read predicate — a failed page is non-billable and refunded — so a plain-text page that previously failed and was refunded now succeeds and bills at the per-page rate. Crawling a site containing .txt files will cost more than before, and will return the content you are paying for. A server mislabelling real HTML as text/plain is still detected and extracted as HTML.

Published to npm with SLSA provenance via OIDC trusted publishing.