@artblocks/abx-cli 0.1.0-alpha.36 → 0.1.0-alpha.38

package/CHANGELOG.md

@@ -1,5 +1,92 @@
 # @artblocks/abx-cli
 
+## 0.1.0-alpha.38
+
+### Patch Changes
+
+- d4b1de8: Fixes from the 2026-08-27 w7 agent sandbox sweep — a co-located `abx effects` bug that silently
+  defeated auto-rendering, and four help-text truthfulness gaps.
+
+  - **`abx effects --resolver-port <n>`** — the "no manual `abx render`" pipeline could silently never
+    render for two compounding reasons, both hit live on Sepolia in the sweep (real deploy, real mint,
+    two confirmed `configure-param` txs, zero renders landed): co-located mode had no way to say which
+    port the local `abx serve` was actually on (it assumed the default, 8787), and a leftover
+    `ABX_REMOTE_SELF_TOKEN` — auto-saved to `.env` by any earlier `deploy-resolver`/`deploy-effects` run
+    in the same project — silently flipped a later, unrelated `abx effects` into remote/control-plane
+    mode against a bare `abx serve` that never implements it, producing a 404 whose own suggested fix
+    ("check the token") was a dead end. `--resolver-port` fixes the first outright and, by declaring
+    co-location explicitly, ignores the stale token instead of being ambushed by it. When the same
+    combination shows up _without_ the flag (an existing loopback `ABX_RESOLVER_URL` + a stale token),
+    `abx effects` now warns up front with the actual fix, rather than failing silently at the first
+    publish attempt. The decision logic is split into `resolveEffectsTarget()` (`commands/service.ts`),
+    unit-tested directly (`test/effects-target.test.ts`) without needing a chain client or HTTP server.
+  - **`--dry-run`'s "no signer known" hint no longer suggests a flag most commands don't have.** It used
+    to say `pass --for 0x.. (or set a signing key)` unconditionally — but `--for` is only accepted by
+    `deploy`/`predict`/`doctor`/`storage balance`; every owner-op write (`configure-param`, `set-field`,
+    `lock-field`, …) funnels through the same shared `gatedSend`/`simulateDryRun` choke point and doesn't
+    accept it. The hint now leads with what's universally true (set a signing key, or `--sign`) and only
+    mentions `--for` as a caveat for the commands that take it.
+  - **`abx help lock-field` / `abx help lock-uri` now list `--dry-run`.** Both flags already worked
+    (confirmed on a live Sepolia contract in the sweep); neither `--help` output said so, so the exact
+    preview a creator most wants before an irreversible freeze was undiscoverable without already
+    knowing to try it.
+  - **`abx help set-field` / `abx help attach` now state that every write pings ERC-4906** — the on-chain
+    behavior (`MetadataUpdate(tokenId)` per token-scope write, `BatchMetadataUpdate` for `--collection`)
+    was already correct and load-bearing (marketplaces rely on it to self-refresh after a metadata edit),
+    but the only place ERC-4906 was named anywhere in the discoverable surface was a side remark in
+    `abx help ping-uri` about a different, edition-only command.
+
+  Also corrects this repo's own `dev-loop-test` skill, which claimed `.env` duplicate keys are
+  last-wins — the sweep proved the real CLI is first-wins (confirmed live: a duplicate
+  `ABX_RPC_URLS_SEPOLIA` silently routed every read to the wrong RPC, ignoring an intentionally later
+  override).
+
+## 0.1.0-alpha.37
+
+### Patch Changes
+
+- c5e0d84: The skill and CLI now name the extension and setup paths agents were missing: a shared on-chain
+  program with a per-token `Bytes` payload, `abx set-param-hooks`, and Foundry's stricter private-key
+  prefix requirement.
+
+  The routing table in the bundled skill, `reference/code.md`, and `abx capabilities` all list
+  `deploy-code --script` + `<key>:Bytes:Creator` as a native lane — not an escape hatch — so an agent
+  does not conclude the shape is out of scope and hand-roll Solidity. They now say truthfully that the
+  payload is configured after mint with `configure-param --file`; `mint` has no payload flag. Top-level
+  `abx help` lists `set-param-hooks` (the only command that wires a custom hook), and the `--schema`
+  description in `deploy-code --help` points at it for mint-time snapshot / veto / live derivation. Setup guidance
+  also distinguishes the CLI's optional `0x` private-key prefix from Foundry `vm.envUint`'s required one.
+
+  Reported in the 2026-08-27 tester batch (feedback 599722e5, d12929f5, ff28d128, 3d4eda3f).
+
+- c5e0d84: Published package `homepage` and `bugs` fields now point at docs.abx.io instead of a private GitHub
+  repo that 404s. File reports with `abx feedback`; `npm bugs` no longer names a repository the public
+  cannot open.
+
+  Reported in the 2026-08-27 tester batch (feedback 40142396).
+
+- c5e0d84: Read commands no longer collapse "the RPC is down" into "this isn't an ABX contract."
+
+  `abx state` now refuses an ignored singular `ABX_RPC_URL`, probes chain reachability, and retains the
+  errors from its required getter reads. A dead endpoint, a node that answers block/code queries but
+  rate-limits `eth_call`, a codeless address, and code without ABX getters now receive distinct answers;
+  an RPC failure is never stated as a contract verdict. `abx add`'s deploy-block discovery no longer
+  guesses "a non-archive RPC?" when the same node `abx doctor` just certified — the failure can also be
+  rate-limiting or a refused historical `getCode`. The `deploy-code` Surfaces block still flags an
+  orphaned collection-wide thumbnail, and now names the per-token `set-field --field image` hatch (raw
+  SVG bytes, not a data-URI) instead of claiming you cannot backfill at all. `submit-app` now confirms
+  only the on-chain update and tells users to verify hosted catalog copy separately instead of promising
+  an unverified refresh on the provider's "next read."
+
+  Reported in the 2026-08-27 tester batch (feedback ae7cc4a8, bd75dc5f, 89315be8, 1f3c0992, c2101d6f).
+
+- Updated dependencies [c5e0d84]
+- Updated dependencies [c5e0d84]
+  - @artblocks/abx-sdk@0.1.0-alpha.28
+  - @artblocks/abx-indexer@0.1.0-alpha.29
+  - @artblocks/abx-storage@0.1.0-alpha.28
+  - @artblocks/abx-token-api@0.1.0-alpha.31
+
 ## 0.1.0-alpha.36
 
 ### Minor Changes

package/dist/commands/deploy.js

@@ -3427,7 +3427,7 @@ export async function cmdDeployCodeBody(flags, emit) {
                     ? `on-chain url-template → your bucket (renders upload there; marketplace-visible ✓)`
                     : resolverInGraph
                         ? `served by the resolver (/image; renders publish to it ✓)`
-                        : `⚠ NO PUBLIC DESTINATION — the on-chain image is a placeholder. \`abx render\` to a local store is ORPHANED (marketplaces never see it) and you CANNOT backfill a thumbnail to an on-chain image with no pointer. Decide NOW: --image-renderer <a Solidity SVG renderer>, --image-base <public bucket>, or run a resolver`;
+                        : `⚠ NO PUBLIC DESTINATION — the collection-wide image is a placeholder. \`abx render\` to a local store is ORPHANED (marketplaces never see it). A collection-wide default needs --image-renderer, --image-base, or a resolver NOW; per token, \`abx set-field --field image\` (raw SVG bytes, not a data-URI) still writes after mint`;
     // TRAITS — on-chain renderer / off-chain resolver / omitted / codeless-renderer.
     const attributesRendererCodeless = hasAttributesRenderer && attributesRendererCodePresent === false;
     const traitsOmitted = !hasAttributesRenderer && !resolverInGraph && !!scriptAnalysis?.traits.present;