# Changelog

## [0.4.0] - 2026-03-20

### Changed
- Refreshed dependencies and test tooling around Bun + Vitest 4 while keeping the local-first package workflow validated via tarball installs
- EVM agent search now uses a hybrid strategy: SDK-first for filtered queries and direct subgraph pagination for broad browse queries
- Documentation refreshed for the current setup flow, tool surface, and MCP client transport usage
- IPFS uploads now default to the Studio MCP upload endpoint instead of an embedded shared Pinata JWT

### Fixed
- Aligned Solana registration and EVM wallet write paths with the current SDK interfaces used by `8004-solana` and `agent0-sdk`
- Restored deployed subgraph defaults for BSC and Monad through the MCP defaults layer
- Marked Polygon Amoy as undeployed on testnet instead of silently treating it as live
- `config_set({ chain: ... })` now switches the real EVM default provider key
- `health_check` now reports the packaged server version instead of a stale hardcoded value
- Refreshed E2E feedback tests to match the current `feedback_give` API and explicit global-ID usage
- `ipfs_add_image`, registration uploads, and x402 auto-storage now all flow through the shared IPFS service path
- Rolled out the dedicated Studio MCP IPFS upload endpoint live at `https://studio.qnt.sh/api/mcp/ipfs/upload`
- Kept `8004-mcp` on the dedicated Studio MCP upload endpoint as the default zero-config path
- Added black-box installed-package IPFS coverage and aligned the Studio backend for SVG + multipart compatibility

### Testing
- `8004-minter`: `npm run test:run -- tests/mcp-ipfs.test.ts tests/mcp-ipfs-route.test.ts`, `npm run check`, `npm run build`, `npm run build:functions`, `firebase deploy --only functions:ssr`
- `8004-mcp`: `bun run build`, `bun run lint`, targeted live-dependent suites green, then full E2E suite green: `21` files, `274` passed, `11` skipped
- Added local-tarball black-box MCP E2Es for installed package startup and installed-package IPFS backend behavior

## [0.3.2] - 2026-02-09

### Added
- BSC Mainnet (56) and Testnet (97) chain support
- Monad Mainnet (143) and Testnet (10143) chain support
- IPFS CID format validation (CIDv0/CIDv1)

### Removed
- Arbitrum and Optimism chains (no deployed contracts)

### Security
- Wallet unlock rate limiting with exponential backoff (1s→16s max after 5 failures)
- Write mutex on wallet store to prevent race conditions
- DNS rebinding service blocking (nip.io, sslip.io, xip.io, localtest.me) in endpoint URL validation
- Error message sanitization in main handler to prevent sensitive data leakage
- FTS5 query escaping for boolean/proximity operators
- Circular reference protection in JSON serialization

### Fixed
- Hardcoded contract addresses from subgraph source of truth

## [0.3.1] - 2026-02-09

### Added
- New search filters: `oasfSkills`, `oasfDomains`, `keyword` (semantic search), `minFeedbackCount`, `minFeedbackValue`
- New fields in search results: `web`, `email`, `createdAt`, `updatedAt`, `feedbackCount`, `averageValue`, `oasfSkills`, `oasfDomains`
- Polygon Mainnet (chain 137) auto-configured from SDK defaults

### Changed
- Upgraded `agent0-sdk` from ^1.4.2 to ^1.5.2
- Leaderboard now uses unified `searchAgents` with `FeedbackFilters` (replaces removed `searchAgentsByReputation`)
- EVM search returns flat array from SDK (cursor-based pagination removed upstream)
- `AgentSummary.mcp` and `.a2a` are now endpoint URL strings (previously boolean flags)

## [0.3.0] - 2026-02-09

### Security
- Redact private keys, JWTs, and API keys from `config_get` output
- SSRF validation for RPC/indexer URL inputs in `config_set`
- Removed session token from `wallet_unlock` response

### Changed
- Bumped `8004-solana` SDK dependency from ^0.5.3 to ^0.6.1

### Fixed
- Feedback revoke and response tools now correctly read SEAL hash from indexer

## [0.2.3] - 2026-02-03

### Added
- `estimateCost` option for `agent_register` - get accurate cost estimates before transactions
- Solana cost breakdown: AgentAccount rent, Metaplex NFT rent, AtomStats rent, tx fees
- EVM cost breakdown: HTTP flow (1 tx) vs IPFS flow (2 tx) with gas estimates

### Fixed
- Binary image uploads in `ipfs_add_image` - Buffer to Uint8Array conversion for native fetch
- Image magic bytes now correctly preserved (PNG, JPEG, GIF, WebP)

### Changed
- Removed external dependencies (got, form-data) - now uses native Node.js fetch
- Simplified cost documentation in skill.md

## [0.2.2] - 2026-02-01

### Security
- SQL injection prevention via column whitelist in cache queries
- Session tokens for password-less wallet operations after unlock
- Wallet export writes to file instead of returning encrypted data

### Added
- Advanced SDK search filters: `mcpTools`, `a2aSkills`, `active`, `x402support`, `hasMcp`, `hasA2a`
- Multi-chain agent search with parallel queries
- Full-text search via SQLite FTS5 cache
- Cursor-based pagination for EVM chains

### Documentation
- Added [skill.md](./skill.md) integration guide for AI agents
- Profile-specific workflows (Beginners, Developers, Agent Owners, AI Agents)
- Search behavior tips (cache_search for fuzzy, agent_search for exact)
- Write operation prerequisites and error handling guide
- Transaction preview examples with skipSend parameter
- Wallet password security warnings

### Fixed
- Use viem `formatUnits()` for decimal precision
- Preserve error stack traces in logging
- Wallet import now correctly generates session token
- Test cleanup scripts to kill orphan vitest processes

### Changed
- Removed tracked scripts with hardcoded test credentials

## [0.1.0] - 2026-01-20

### Added
- Initial release
- Multi-chain support (Solana, Ethereum, Base, Polygon)
- Agent search, get, register operations
- Feedback operations (give, list, revoke)
- Wallet management (create, import, unlock, export)
- x402 protocol integration
- Solana hash-chain integrity verification
- SQLite local cache with lazy sync