v0.14.4

Highlights

• Pre-sign gate hardening — prepare_custom_call gains a value-exfil selector classifier (#659); setApprovalForAll on uncurated destinations now selector-decoded instead of opaque (#658); pair_ledger_* mandates per-address device verification in tool instructions (#660).
• preview_send enriched — surfaces pinned network fee + EIP-1559 baseFee/priorityFee breakdown so the agent can present total cost before pre-sign checks (#661).
• NFT floor-sweep — new get_nft_listings tool returns ranked floor candidates per collection (#657).
• Glama build repair (round 2) — .npmrc + pnpm.overrides make Glama's auto-generated pnpm Dockerfile build succeed alongside npm (#663). Companion to v0.14.3's project Dockerfile fix.
• Docs — codifies the per-protocol vs prepare_custom_call cutoff rule in CLAUDE.md (#662).

Included PRs

• #657 feat(nft): add get_nft_listings for ranked floor-sweep candidates
• #658 feat(decode): selector-only partial decode for setApprovalForAll on uncurated destinations
• #659 feat(custom-call): selector classifier for value-exfil patterns
• #660 feat(pair_ledger): mandate per-address device verification in instructions
• #661 feat(preview): surface pinned network fee + EIP-1559 breakdown at preview_send
• #662 docs(CLAUDE.md): codify per-protocol vs. prepare_custom_call cutoff rule
• #663 fix(deps): make Glama's pnpm build succeed alongside npm
• #664 chore(release): 0.14.4

v0.14.3

Highlights

• Glama Docker build repair — docker build . now succeeds end-to-end on a clean cache. Three stacked failures fixed in one PR: lockfile drift (npm ci was rejecting with EUSAGE), missing COPY vendor / COPY patches (required by the file: dep and prepare: patch-package script), and native modules (usb, node-hid) falling through to node-gyp rebuild on alpine without a build toolchain.
• Restructured Dockerfile: builder stage owns native compilation + npm prune --omit=dev, runtime stage pulls the pruned node_modules plus libusb / eudev-libs runtime .sos only.

Included PRs

• #655 fix(docker): repair Glama Docker build
• #656 chore(release): 0.14.3

v0.14.2

Highlights

• Pre-sign UX — estimated network fee surfaced before pre-sign checks (#648); SCOPE + AGENT BEHAVIOR clauses on data-surfacing tools (#646); Safe API key visible in get_vaultpilot_config_status (#644).
• Bug fixes — read_contract EXECUTOR_ROLE hash typo corrected (#634); Safe STS submit errors enriched with diagnostic read probe (#635); skill-pin bumped to v15 (#653).
• Docs — AGENTS.md Step 0 reframed as hard refusal gate (#642); Step 2 restructured as per-client router (#643).
• Tooling — per-conversation MCP static-surface token-cost benchmark (#647).

Included PRs

• #634 fix(read_contract): correct EXECUTOR_ROLE hash in description and test fixture
• #635 fix(safe): enrich opaque STS submit errors with diagnostic read probe
• #642 docs(agents): reframe Step 0 as hard refusal gate (MUST / MUST NOT)
• #643 docs(agents): restructure Step 2 as per-client router with heading-anchored subsections
• #644 feat(diagnostics): surface Safe API key in get_vaultpilot_config_status
• #646 Add SCOPE + AGENT BEHAVIOR clauses to data-surfacing tools (#599)
• #647 feat(bench): measure per-conversation MCP tool static-surface token cost
• #648 feat(prepare): surface estimated network fee before pre-sign checks
• #653 fix(skill-pin): bump to v15

v0.14.1

Patch release. Doc-only PRs since v0.14.0.

Highlights

• Install instructions for Claude Desktop on Windows — AGENTS.md Step 2 now routes by host client (Claude Code CLI vs. Claude Desktop / Cursor / Continue / other) and documents the Windows cmd /c npx wrapper required because Claude Desktop on Windows spawns MCP commands without a shell. Adds Step 0 host-client detection so agents identify the right path before proposing commands. (#632)
• Roadmap maintenance — broken plan links fixed, missing plans linked. (#631)
• Skill pin sync — bumped to v0.10. (#629)

Included PRs

• #629 chore(sync-skill-pin): v0.10
• #631 chore(roadmap): link missing plans, fix broken links
• #632 docs(install): route Step 2 by host client; document Windows cmd /c wrapper

Deliberately deferred

• No source-code changes — the wizard's auto-register path (src/setup/register-clients.ts buildServerEntry()) was already Windows-safe in v0.14.0; this release ships the doc-side fix to npm + MCP Registry so agents fetching AGENTS.md from the latest tarball see the corrected Step 2 routing.

v0.14.0

Highlights

• New tool — read_contract: generic view/pure ABI reader, paving the way for explain-and-replay flows (#606). explain_tx now exposes rawInput + decodedCall args to feed it (#605).
• New tool — prepare_token_approve: dedicated path for ERC-20 approvals; routes approve(...) out of prepare_custom_call and refuses unlimited approve to canonical burn addresses (#564, plus earlier work).
• Curve swap support: prepare_curve_swap for stETH/ETH with direct 1inch /swap fallback (#616); generalized to stable_ng factory pools (#619); swap leg now stamps acknowledgedNonProtocolTarget (#628).
• Tool annotations on all 186 registerTool sites — readOnlyHint / destructiveHint / idempotentHint / openWorldHint surfaced to hosts (#601).
• Approve-allowlist softened to advisory: non-canonical spender becomes a ⚠ NON-CANONICAL SPENDER recommendation instead of a hard refusal; rogue-spender protection still in place (#618).
• Pre-sign gate accepts Safe handles: prepare_safe_tx_* flows no longer trip the spender allowlist (#611).
• Local-skill drift notice: distinguishes stale (user clone behind MCP-pinned) vs. tampered (hash mismatch) (#623).
• Per-response footprint: PIN block trimmed ~30%, sign-time agent-task block trimmed ~44% (#622, #627).
• Strategy share/import hardening: strict-shape gate rejects unknown keys (#571).
• Skill pin bumped to v12: covers strategy share/import + crypto-constants rules (#629).
• explain_tx routing nudge + demo-exit wording (#621).
• Yields: null riskScore rows now flagged via notes[] warning (#550).
• Security: auto-stamps secondLlmRequired on opaque-calldata flows.

Included PRs

#549, #550, #551, #552, #553, #554, #555, #564, #570, #571, #572, #588, #601, #605, #606, #607, #611, #616, #618, #619, #620, #621, #622, #623, #624, #625, #627, #628, #629

Deliberately deferred

• Typed-data signing tools (prepare_eip2612_permit, prepare_permit2_*, prepare_cowswap_order) — gated on Inv #1b (typed-data tree decode) + Inv #2b (digest recompute) shipping in the same release. Tracked at #453.
• EIP-7702 over WalletConnect — Ledger Live exposure pending; firmware ready, host integration not.

v0.13.1

Highlights

• Binary size — drop ~125 MB from the bundled binary (#548). Stubs @kamino-finance/kliquidity-sdk with a 50-LoC local package, removing Raydium (85 MB) + Orca (13 MB) + assorted DEX-adapter transit through kliquidity. Linux-x64 binary should drop from ~420 MB toward ~295 MB. Pairs naturally with the install-time patience guidance below.
• Install-time agent guidance (#546). AGENTS.md gets three new subsections under the binary-installer path: patience expectations (1–10 min realistic download), no-fallback-to-npm-when-Node-was-confirmed-absent rule, and trust-the-installer's-auto-registration rule (don't manually edit settings.json / .mcp.json after). Caught a live Windows + Claude Code Desktop install regression where the agent bailed mid-download then flailed through five wrong-path attempts.
• Roadmap maintenance — 9 backlog plans linked into ROADMAP and archived (#535), 6 tool-follow-up plans linked + archived (#533), all archived plan links retargeted to claude-work/archive/ (#534).

Included PRs

• #533 — docs(roadmap): link 8 entries from claude-work tool-follow-up plans
• #534 — docs(roadmap): retarget archived plan links to claude-work/archive/
• #535 — docs(roadmap): link 9 backlog plans + archive their files
• #546 — docs(agents): patience + no-fallback rules for the binary installer path
• #547 — chore(release): bump to 0.13.1
• #548 — perf(deps): stub kliquidity-sdk — drop ~125 MB from bundled binary

Deliberately deferred

• install.ps1 progress output (bytes/sec). Would help patience heuristics but is a separate code change; the AGENTS.md patience rules in #546 are the smaller fix.
• The remaining items on the Tier-2 binary slim plan — #548 took the kliquidity-stub path; further trimming (e.g. Meteora dlmm) deferred until evidence of actual upload-failure pressure on the new ~295 MB baseline.
• No tool-surface or runtime-behavior changes in this release. AGENTS.md is for the agent reading the install instructions, not the server runtime.

v0.13.0

Highlights

New tools

• resolve_token (#440) — symbol+chain → canonical contract w/ bridged-variant warnings (USDC vs USDC.e on Arbitrum/Polygon/Optimism, USDC vs USDbC on Base).
• list_solana_validators (#436) — stakewiz-backed ranking helper for prepare_native_stake_delegate. Surfaces wiz_score, commission, MEV-enabled, APY estimate, delinquent + superminority flags.
• prepare_sunswap_swap (#432) — TRON-native DEX for same-chain TRX↔TRC20 swaps.
• EVM + Solana swap filters (#439, #516) — excludeExchanges / excludeBridges / order (LiFi), dexes / excludeDexes (Jupiter).

Security hardening

• Invariant #14 (#460) — durableBindings field on every prepare_* tool that binds funds to a durable on-chain object selected from a multi-candidate set (validator vote pubkey, TRON SR, Compound Comet, Morpho marketId, MarginFi bank, Uniswap V3 LP tokenId, BTC multisig xpub, allowance spender). Skill consumes it as the assertion target.
• Invariant #8 BIP-137 hardening (#454) — messageSha256 byte-fingerprint in sign_message_btc / ltc responses + drainer-string refusal (transfer / authorize / grant / custody / release / consent markers, plus multi-word templates).
• SignedContactEntry.intendedChains (#482) — CONTACT-CHAIN MISMATCH warning when prepare's chain arg doesn't match the contact's intended chain set.
• UnsignedTx.secondLlmRequired scaffold (#501) — flag for Inv #12.5 hard-trigger ops.

Token-send

• tokenClass framework (#441) — non-standard transfer-semantics flags (rebasing seeded; blocklisted/FoT/pausable/upgradeable_admin deferred per #508).
• prepare_solana_native_send memo (#434) — optional UTF-8 memo via SPL Memo program v2.
• prepare_morpho_repay accepts amount: "max" (#437) — shares-mode close, exact regardless of accrued interest between sign and broadcast.

Yields v2 (#431)

• DefiLlama bundle (#287, #289, #290, #291) — Marinade + Jito + Kamino-lend + Morpho-Blue curated vaults via one cached fetch.
• MarginFi on-chain wallet-less reader (#288) — DefiLlama doesn't carry MarginFi borrow-lend.
• EigenLayer + native-stake deferred indefinitely (#292, #293) — LRT issuers + Marinade/Jito are the practical substitutes.

PnL

• get_pnl_summary mtd period (#447) — calendar month-to-date.

Fixes

• TRON_TOKENS.USDD pointed at WTRX (#507).
• Self-referencing glama badge breaking on glama.ai (#521).

Roadmap defers

• BIP-322 message signing (#438), prepare_eip7702_authorization (#481), Tier-1 bridge facet decoders (#451), Solana NFT trio (#474 / #475 / #476), BTC/LTC dryRun (#479), solo-validator deposit (#430).

Deliberately deferred

• Token-class seed data for blocklisted/FoT/pausable/upgradeable_admin (#508) — closed as won't-fix-until-concrete-case. Three classes have no live targets; upgradeable_admin needs a more targeted rule. Framework itself is shipped.
• Multi-route swap comparison endpoint (#517) — closed; order: "CHEAPEST" covers the dominant case.
• Skill-side coordination for Invariant #14 enforcement (#460) — companion work in vaultpilot-security-skill. The MCP-side durableBindings field is wire-ready; skill version bump + sentinel update lands separately.

v0.12.1 — unified binary (setup wizard as subcommand)

Highlights

• One binary per platform instead of two (#487) — the setup wizard is now invoked as a subcommand, vaultpilot-mcp setup. The MCP server and setup wizard ship as a single vaultpilot-mcp-<platform>-<arch>-server binary; the standalone *-setup binaries are gone. Halves bandwidth per release (~2.4 GB → ~1.2 GB) and eliminates the macos-x64-setup flake leg that was the most frequent post-release blocker on v0.12.0.

Backward compat

• Binary path: the *-server asset name is preserved. Users following the latest install.sh / install.ps1 get the unified binary at the same URL automatically.
• npm path: the vaultpilot-mcp-setup bin entry still works — it's a backward-compat shim that points at dist/setup.js directly. Both vaultpilot-mcp setup and vaultpilot-mcp-setup are valid on npm.

Included PRs

• #487 feat(release): unify server + setup wizard into one binary via setup subcommand
• #488 chore(release): bump to 0.12.1

Deliberately deferred

• Cross-OS validation in CI separate from the release run. This release IS the first cross-OS test of the unified-binary code; release-binaries.yml is the integration harness. If the macos-x64 leg flakes, that's a runner issue, not the new code (the argv-detection contract is unit-tested at 7 cases).

v0.12.0 — adversarial-smoke-test batch + demo followups + health-alerts expansion + Solana NFT

Highlights

• Adversarial-smoke-test invariant batch — coordinated with skill v0.6.0. New agent-side invariants: outer dispatch-target allowlist (#1.a), chain-must-be-explicit refusal (#2.5), Tier-1 bridge facet decoder (#6b), set-level intent verification (#14), durable-binding source-of-truth (#15), §8 message-signing hardening (byte fingerprint + drainer-template refusal), §12.5 mandatory second-LLM hard-trigger ops, forward-looking §16 EIP-7702 refuse-all + §1b/#2b typed-data (skill v9 will populate when MCP surface ships). MCP companion: [SET-LEVEL ENUMERATION] block on get_token_allowances, assertCanonicalDispatchTarget helper, sentinel pin bump v7→v8 (#480, closes #450, #451 Tier-1, #452, #453, #454, #455 forward-looking, #460, #461).
• Earlier skill pin bumps — multi-step BTC combine_btc_psbts + prepare_btc_rbf_bump re-decode (Inv #13, skill v0.5.0, MCP #465 closes #463); Inv #2 framed as corroborating-not-load-bearing (skill v0.5.1, MCP #468 closes #462).
• Health-alerts multi-protocol expansion — get_health_alerts now monitors Compound V3, Morpho Blue, MarginFi, and Kamino alongside Aave V3 (#466, closes #427).
• Demo-mode followups (#449) — markdown-rendered simulation envelope, --demo CLI alias, persona-affinity-aware refusal messages, weekly persona rotation watcher CI job, README + CONTRIBUTING docs for the post-#380 demo model.
• Update-available notice + get_update_command tool — install-path-aware update flow that detects whether the user is on the npm CLI / pkg-bundled binary / source clone and emits the right one-liner (#457).
• Solana NFT portfolio — get_nft_portfolio covers Solana via Helius DAS getAssetsByOwner (#478, closes #433).
• Dry-run / unsigned-bytes mode for prepare_* — agents can inspect prepared txs end-to-end without entering the signing path (#477, closes #446).
• Lido stETH ↔ wstETH wrap/unwrap — prepare_lido_wrap / prepare_lido_unwrap (#467, closes #442).
• Incident report v1 — build_incident_report produces a redacted, sign-anchored bundle for adversarial-event triage (#426, closes #425).
• MEV-protection hint on EVM swaps — sandwich-MEV warning when slippage × notional crosses the mainnet threshold (#472, closes #445); L2 expansion deferred to roadmap.
• Contacts without Ledger — first-run users can label addresses before pairing via in-memory store (#471, closes #428).
• BTC RBF + fee priority — prepare_btc_rbf_bump for replace-by-fee, smarter mempool-fee defaults (#473, closes #435).
• Demo persona contacts pre-loaded — friendly labels in demo without manual contact entry (#406).
• Aave V3 frozen-market hardening — clearer error surface when a market is paused/frozen (#419).

Included PRs

• #406 feat(demo): pre-load demo persona contacts
• #407 ci: drop redundant binary smoke from PR runs (kept in release-binaries.yml)
• #408 fix(demo): decouple restart-required from demo framing in error prose (#415)
• #410 fix(solana): proactive Helius nudge + broaden public-RPC throttle detection (#423)
• #409 fix(demo): one-shot state-precondition hint on prepare_* failures (#422)
• #411 fix: protocol-routing edge-case in lending-positions (#421)
• #413 fix(allowances): error surface tightening (#416)
• #414 fix(preflight): pin block format edge case (#417)
• #418 chore(claude-md): always branch from main, never stack PRs
• #419 fix(aave): frozen-market error path
• #420 feat(demo): enrich personas with rehearsable-flows + flow-gaps metadata
• #422 (link via #409)
• #423 (link via #410)
• #424 chore(release): orphan 0.11.1 bump (subsumed into 0.12.0)
• #426 feat: incident-report v1 (#425)
• #427 (link via #466)
• #428 (link via #471)
• #433 (link via #478)
• #435 (link via #473)
• #442 (link via #467)
• #445 (link via #472)
• #446 (link via #477)
• #449 feat(demo): demo-saga followups bundle (#3-#7 from plan)
• #450 closed by skill v0.6.0 + MCP #480
• #451 Tier-1 closed by skill v0.6.0; Tier-2 deferred to roadmap
• #452 closed by skill v0.6.0
• #453 forward-looking closed by skill v0.6.0
• #454 closed by skill v0.6.0
• #455 forward-looking closed by skill v0.6.0; impl tracked at #481
• #457 feat: install-path-aware update flow + get_update_command tool
• #458 chore(release): orphan 0.11.1 retag (subsumed into 0.12.0)
• #459 ci: auto-triage agent (subsequently reverted, see #464)
• #460 closed by skill v0.6.0 + MCP #480
• #461 closed by skill v0.6.0 + MCP #480
• #462 closed by skill v0.5.1 + MCP #468
• #463 closed by skill v0.5.0 + MCP #465
• #464 chore: revert auto-triage workflow (#459)
• #465 fix(skill-pin): bump to v6 for Inv #13 multi-step BTC
• #466 fix(health-alerts): extend coverage to Compound V3 / Morpho / MarginFi / Kamino
• #467 feat(lido): prepare_lido_wrap / prepare_lido_unwrap (stETH ↔ wstETH)
• #468 fix(skill-pin): bump to v7 for Inv #2 framing
• #469 chore(roadmap): defer #443 (separate compare_yields adapter expansion)
• #470 chore(roadmap): defer Aptos / Sui chain support to roadmap
• #471 fix(contacts): in-memory store for first-run / no-Ledger users
• #472 feat(swap): sandwich-MEV hint on mainnet swaps + slippage × notional threshold
• #473 fix(btc): RBF bump + improved fee-priority defaults
• #477 feat: dry-run / unsigned-bytes mode for prepare_*
• #478 feat(nft): Solana NFT portfolio via Helius DAS
• #480 feat(skill-v8): pin bump + SET-LEVEL ENUMERATION + Inv #1.a allowlist mirror
• #484 docs: roadmap entry for Tier-2 bridge facet decoders
• #485 docs: full reflection of skill v0.6.0 + MCP companion in README + SECURITY
• #486 chore(release): bump to 0.12.0

Deliberately deferred

• Tier-2 bridge facet decoders (deBridge / DLN, Stargate composeMsg, Hop, Symbiosis) — Tier-1 (Wormhole / Mayan / NEAR Intents / Across V3) shipped under skill Inv #6b in v0.6.0. Tier-2 routes fall back to mandatory second-LLM (Inv #12.5) until shipped. Plan: claude-work/plan-bridge-facet-decoder-tier2.md, README roadmap entry in #484.
• EIP-7702 prepare_eip7702_authorization builder — skill v0.6.0 §16 refuses 7702 setCode unconditionally. Implementation paired with skill v9 allowlist tracked at #481.
• Per-EVM-chain contact tag — companion to skill Inv #2.5 chain-must-be-explicit. Current contacts schema is per-chain-family (btc | evm | solana | tron); per-EVM-chain extension tracked at #482. Skill-side rule remains the load-bearing defense.
• Per-handler wiring of assertCanonicalDispatchTarget — helper module shipped in this release (src/security/canonical-dispatch.ts) with regression tests, but not yet called from individual prepare_* flows (different tx-chain shapes need per-flow review). Tracked at #483. Skill-side Inv #1.a remains the load-bearing defense.
• Aptos / Sui chain support — large surface (Move VM, separate signing primitives). Roadmap entry added in #470.
• Auto-triage agent for issues — experimented in #459, reverted in #464 to preserve manual triage.
• Sandwich-MEV hint on L2s — mainnet ships in #472; per-chain L2 thresholds + ordering-model wording deferred (claude-work/plan-mev-hint-l2-expansion.md).

Companion releases

• vaultpilot-security-skill v0.5.0 — Inv #13 multi-step BTC flows
• vaultpilot-security-skill v0.5.1 — Inv #2 framing: corroborating, not load-bearing
• vaultpilot-security-skill v0.6.0 — adversarial-smoke-test invariant batch (paired with this release's #480)

v0.11.0

Highlights

• Native BTC ↔ EVM/Solana bridging — prepare_btc_lifi_swap opens cross-chain BTC routes via LiFi without leaving the Ledger-signed flow (#401, closes #397).
• Auto-demo on fresh install — first-run users get a working demo wallet without configuring VAULTPILOT_DEMO. Companion skills (preflight + setup) lazy-install on first signing-class call (#399, #403).
• 2D demo persona matrix — chain × type cells with per-cell loader, replacing the flat persona list (#404).
• Solana integrity-check labeling — agent now surfaces a one-line preface before the node -e Bash prompt fires, so the approval modal isn't a surprise mid-send (#400, closes #396).
• Demo-mode robustness — preview_send no longer requires WALLETCONNECT_PROJECT_ID in demo (#398, closes #395); persona enumeration always works regardless of env state (#394, closes #392); set_demo_wallet discoverability via VAULTPILOT NOTICE (#391).

Included PRs

• #391 feat(demo): demo-wallet onboarding via VAULTPILOT NOTICE
• #394 fix(demo): always enumerate personas + clearer env-state message
• #398 fix(demo): preview_send no longer requires WALLETCONNECT_PROJECT_ID
• #399 feat(demo): auto-demo mode on fresh install
• #400 fix(verification): label Solana integrity-check block
• #401 feat(btc): native BTC ↔ EVM/Solana bridge via LiFi
• #403 feat(setup): lazy first-run auto-install of companion skills
• #404 feat(demo): 2D chain × type matrix + per-cell loader

Deliberately deferred

• THORChain memo-PSBT path for #397 — LiFi covers the same UX with broader reach and reuses the existing Ledger flow; THORChain stays a future option if LiFi route quality drops.
• Skill-shipped vaultpilot-verify-solana-msg bin (#396 fix #2) — companion skills are pure prompt and cannot ship executables. CLAUDE.md rule added to lock this in. The labeling fix in #400 is the full fix for #396.