What VEX
ships.

Launches are verified, not trusted. The launchpad's backend hands VEX a ready-made launch transaction; VEX never signs it on faith. It decodes the calldata and re-derives every field against the chain — name, symbol, paired asset against the factory's own allowlist, the deployment fee against the contract's live value and its on-chain bounds, the predicted token address recomputed three independent ways, and the exact transaction value — thirteen checks in all, every one required before your approval is even requested. What you approve is the exact byte-for-byte transaction that gets broadcast.

Atomic first buy. A launch can include an ETH prebuy that fills in the same transaction the pool is created in. Its minimum output is pinned to the exact simulated fill, never a percentage band, so the first buy cannot be quietly worse than what was shown.

The creator fee stream is yours, and claimable. On every agent launch the fee recipient is pinned to your session wallet — the tools expose no parameter to point it anywhere else. Fee claims are previewed as a free on-chain simulation and report both legs, the launched token and the paired asset, as raw amounts with their decimals. Figures the locker merely holds already are labeled as such, never presented as the claimable total.

Research at full provider depth. Five read tools cover screening with every server-verified filter and sort, name search, price candles, single-token deep reads (with decimals read on-chain, not assumed), and your own launch history. A filter the provider does not support is refused by name with a pointer to the tool that can answer it.

Trading needs no new venue. Because a pools.fun token sits in an ordinary Sushi V3 pool, VEX quotes and trades it through KyberSwap like any other token — measured against live launches before shipping, not assumed.

A launch form with two honest stages. The launchpad card now hosts a platform selector (Trench | pools.fun). Stage one shows the final predicted token address, the resolved fee recipient, and the exact cost breakdown; only the Deploy click authorizes precisely that transaction.

A signed installer. Vex-0.2.5-win-x64.exe is signed as VEX LABS PTE. LTD. through Azure Trusted Signing, with an RFC3161 timestamp so the signature stays valid long after the short lived signing certificate rotates. Windows shows a named publisher instead of Unknown publisher.

Updates check their author before they install. From this version on, VEX on Windows updates itself. Before an update is applied, the downloaded installer's signature must be attributed to VEX LABS PTE. LTD. exactly, or it is refused. This pairing gets its first real world exercise with the next release.

Every binary is verified before it ships. The release pipeline fails closed unless the installer and every executable inside it are signed, timestamped, and attributed correctly. An unsigned Windows build cannot be published, the same way an un notarized macOS build cannot.

What signing does not buy. SmartScreen reputation attaches to the certificate identity and starts at zero, so early downloads may still see a warning until reputation accrues. That is expected, and it fades. And a self custodial wallet is antivirus bait: signing sharply reduces false positives, it does not eliminate them.

Off by default, and there is no default. The reporter only wakes if a service endpoint is configured, and this release configures none. Until a public AgentScan domain is announced, nothing is sent anywhere.

Privacy by construction, not by filter. A report event is built only from named, allowlisted fields, and excluded columns are never read: there is no line of code that touches them. Registration uses a random identity generated on your machine. Values that fail validation are sent as null rather than silently repaired.

Once, and only once. Reporting diffs the activity feed against a permanent report log, so an event can be reported exactly once, and the money path code gained zero hooks. Server verdicts are honored: quarantine or revocation stops the lane permanently, and only transient failures retry.

The fix. A launch with any prebuy refused with the launch cost changed since you were shown it, and pressing review new price produced the same refusal forever. The preview's identifier carries the creation fee read at a specific block, but the submit check was comparing it against the full amount to send, which is the fee plus your prebuy. Those two numbers are equal only when the prebuy is zero, which is why every zero prebuy launch worked and every other one was impossible. The check now compares the fee, as the identifier always intended.

The gap behind it. No test had ever driven a real preview into a real submit. One suite hand wrote an identifier of one shape while another asserted the opposite shape, and the two never met. That end to end path is now covered with a nonzero prebuy, so this class of mismatch cannot come back silently.

What it does not do. This release makes both sides agree on the fee. It does not yet bind the exact form you previewed to the one you submit, because the app keeps no record of the quote it issued. That work is designed and comes next.

Every image looked broken, and did not. The dry run reported a digest mismatch for every staged image, fell back to simulating an empty one, and told you the launch would refuse. The launch would not have refused. Two parts of the app spelled the same hash differently, and the comparison now accounts for that, so the gas estimate reflects the image you actually staged, which is several times higher than an empty image estimate.

The preview can price a prebuy. Pass one and the simulation, the gas estimate, the fee, and the totals all include it, instead of leaving the arithmetic to be done by hand. The affordability verdict now states which scenario it priced.

A launched token appears in your balances. VEX pins it for you when the launch confirms, so you no longer have to add it by hand to see what you just paid for.

The agent's own instructions stay out of your chat. In one session the model printed parts of its operator instructions into the conversation, including wallet addresses. The instruction blocks are now explicitly delimited, with a stated rule never to repeat them, and text pulled in from documents or memory cannot forge those delimiters.

One definition for the metadata limits. Name, symbol, description, and link limits now live in one place shared by every part of the app that checks them, so they cannot drift apart.

Creator signature attribution. The moment the create transaction confirms, the same wallet that signed it signs a short attestation naming the new token, and VEX sends that proof to Trench Express. Their site then shows the VEX mark on the token. Nothing about the launch itself changes: you stay the creator, your keys never leave your machine, and the attestation is a local signature over a fixed string. Not a transaction, not an approval, not a fee.

It can never touch your launch. The attribution step runs after the launch and its fee are fully settled, and every failure path, whether a refused signature, a network drop, or a provider error, is logged and retried later without being able to fail, delay, or reorder the launch. A badge is cosmetic and a launch is real money, and the code treats them accordingly.

Durable retries, honest gaps. A background sweep retries unclaimed badges every two minutes from the stored signature. Tokens launched before this release have no stored signature, so the sweep names them as a gap instead of pretending. The whole flow was verified live on mainnet before shipping, with the badge granted 196 ms after confirmation.

A five minute cadence. The previous ambient check throttled itself to once every six hours, so a fresh release could sit unnoticed for most of a day. Now every five minute tick may check, guarded by a persisted four minute success throttle so bursts still collapse into one request.

Never over an active download. A check refuses to run while an update is downloading, downloaded, or installing, and the guard is verified twice, before and after the asynchronous preferences read, so a download you start in that gap is never interrupted. Late results from a silent check cannot rewind an active state either.

No nagging. Silent checks are invisible unless they find something. A dismissed error banner stays dismissed while the feed is broken, and retries back off exponentially, ten minutes doubling up to a two hour cap, resetting the moment a check succeeds. The per version Later snooze is unchanged: snoozing one version never hides a newer one.

Launch a token from a form. The launch flow is a structured form with a preview: exact spend, VEX fee, estimated gas, predicted address. The form itself is the approval, and nothing signs without it. A consent matrix governs who may authorize a launch, whether the form was user submitted or the session runs at full autonomy, and the answer is recorded per intent.

Trench Photos. Launch images live in a locker on the BOOK panel. VEX square crops and auto downscales every image and reports the resulting byte size, because the picture is stored inside the launch transaction and its size is gas you pay.

Curve trading with two honest fees. Buys and sells on the curve go through ordinary approval cards and price checks. Two separate fees apply to the ETH leg and both are named in the quote: Trench's own 1% curve fee, and the VEX 0.25%. On a sell whose proceeds cannot be decoded, VEX takes no fee at all rather than charging a percentage of a guess.

In flight truth. My Launches shows a broadcast but unconfirmed launch as in flight, no token address yet. A launch whose nonce was used by another transaction is classified superseded and reported for what it is, never silently dropped and never faked into a failure.

Manifests as real functions. Discovered tools inject as complete function schemas: parameters with types and units, enums, required flags, examples, constraints. The agent sees exactly what it can set and how. Since the change, live sessions have produced zero invalid parameter tool calls.

List, describe, call. Listing a protocol stays a cheap index of names and descriptions, with a nextStep pointer heading every listing. A hidden describe_tools turns chosen toolIds, up to 40 exact ids, into full manifests that are callable on the very next step, and a schema fetched this way is byte identical to one reached through ranked discovery, pinned by an equivalence test. Anything displaced by the session cap is named, never silently dropped.

Errors with the real cause. A failed tool call states what actually happened: sanitized, classified by name, with a remediation such as top up the wallet or use dexscreener.search for that chain. Never a generic unexpected error that sends the agent retrying blind. Slippage defaults to 1% with a hard 10% ceiling that rejects by name and never silently clamps.

Approvals survive the rebuild. Queued approvals resume through a durable envelope fingerprinting the exact tool contract they were approved against, so a changed contract fails closed instead of executing something you never saw.

Executed amounts from the source. The moment a mutating tool returns with evidence, the row records the amounts that actually moved, with the status provenance and the amount provenance tracked separately (migration 067), so confirmed can never quietly borrow an estimate's numbers.

A settlement decoder for the gaps. When a response cannot prove amounts, a fallback decodes the receipt itself: a correlated router event plus a required same value unwrap corroboration, proven against the exact live receipt the old logic returned null for. Unmapped venues decline by name, and nothing generically guesses.

The VEX fee reaches the row. Fee legs project onto their parent operation from one whole source and fail closed on ambiguity, and a fee that was genuinely charged stays visible even when its parent operation failed. Revenue accounting is untouched: the projection reads, never writes.

Contradiction quarantine. If stored and decoded evidence disagree about money, the row is quarantined with the conflict named, never merged into a plausible looking hybrid.

Five seconds, then thirty. In flight transactions are re checked every 5 seconds for their first ten minutes, phased from the immutable broadcast time, then every 30 seconds, with a durable claim lease (migration 068) so no two workers can ever race one row, and a token fence so a stale worker that comes back from the dead writes zero rows.

Live pushes. A dedicated progress bus streams pending updates to the Activity panel as they happen. The renderer no longer waits out a 60 second poll.

An honest terminal state. A transaction the network no longer knows about transitions to superseded, outcome unproven, behind a bounded clock and the standing money gate. It sets no failure code, preserves its evidence, and releases the portfolio snapshot freeze that one stuck row used to inflict on everything else.

Repair loops that converge. The verifiers that warned every 30 seconds forever now classify their reasons (in mempool, RPC unreachable, chain echo mismatch, unreadable receipt), log once per change, back off on a schedule, and treat not yet mined as the quiet null it always should have been.

Visible whenever it works. The button renders off a six fact engine aggregate (active run, live lease, pending wake, pending approval, incomplete approval lifecycle, outstanding user form) pushed over IPC, so a session sleeping between timed checks shows Stop, and pressing it cancels the pending wake instead of letting the agent rise again.

Effective everywhere. Three engine paths that could outrun a Stop are now gated behind it under one lock discipline: approval resumes, the reconciler's own chat continuations, and launch form continuations, whose durable consumption marker (migrations 069 and 070) survives crashes, recovers orphans, and closes a deleted session's continuation exactly once. Interleavings, such as a Stop after the result lands but before the turn, or a Stop inside the lease release window, are pinned by real database tests.

Starts respect stops. Starting or recovering a mission with an operator Stop outstanding refuses cleanly instead of creating a run the Stop could never reach.

Launch outcomes by status, not by hash. A pending broadcast wakes the agent with an honest not confirmed, do not retry. Only a proven receipt says launched. The launch dialog auto dismisses only on that proof, holds on a revert, and refuses Escape or a backdrop click while a signature is in flight.

Itemised on approval cards. Every swap and bridge approval shows VEX fee (0.25%) as its own labelled line, computed from the engine's own constants on the same amount being signed and injected through the unspoofable channel. The model structurally cannot supply or alter it. Bridge cards also gained the moved amount itself, which had never been projected.

The guide finally says it. How VEX works was rewritten top to bottom: 354 lines with a costs section (model tokens, gas, and the fee's three rules), the backup flow, a chains at a glance table, a UI states table, an FAQ, a glossary, and every number verified against the shipping constants. The 60 minute approval TTL replaces a wrong roughly 5 minutes, and the retired plan mode and tool names are gone from the text. The word fee appeared zero times in the old guide.

Treasury addresses, buyback and burn, and the charge only after success rule are unchanged from 0.2.0. Now they are simply visible.

vexing. The word Working is retired. A fresh message conjures the VEX mark from a feathered radial cloud of particles in the centre of the chat, assemble, hold, disperse, with the elapsed counter beneath. Mid turn rounds show a compact vexing pill that never covers the transcript, and everything goes still while a signature awaits. The scene shows only over a provably empty viewport, latched on real transcript evidence, so it structurally cannot cover streamed content.

Quieter chrome. Messages slide into the transcript iOS style. Scrollbars are macOS style overlays that appear only while scrolling and sit at the panel's true edge beside the BOOK rail, and the draft field's own scrollbar got the same treatment. BOOK cards drag into any order with a soft settle animation and remember it. The session list dropped its redundant mode glyphs. Trench Photos and Launch a token merged into one Trench Express card.

Tool calls wear their venues again. Retiring execute_tool had silently stripped venue marks from chat. Every protocol call now canonicalizes to its venue at the main process boundary and renders its mark and a human title, and a dry run or preview can never render as an execution.

Icons that tell the truth. The icon layer was renamed to Lucide's own names, including the three arrows that were chevrons and the Bitcoin wallet that was a generic wallet, with zero visual change, proven by identity of the exported glyphs.

Two full multi agent cycles ran end to end before merge: six research agents with individually verified plans, seven builders with exclusive file ownership, six delta review arcs, and a three turn adversarial final review whose every finding landed as a fix with a failing test written first.

The suite stands at 11,474 root and 4,855 app tests, all green at the tag. The test type ratchet improved 310 baseline fingerprints, and the escape checker's blind spot for brand new test files was found and emptied.

Engine workers no longer race database migrations at boot, behind a startup ordering gate, and nine oversized modules were split along responsibility seams during the wave with imports left stable.

22 commits, 5 pull requests, 9 migrations (062 to 070), roughly 24k insertions net across the waves.

Pending lane: 5 second cadence for 10 minutes, then 30 seconds, with a durable claim lease and a token fence.

Approval TTL 60 minutes, now documented truthfully. Two step confirm window 4 seconds. Prepared send 10 minutes.

Session tool capacity: 40 injected manifests, with displacements named. Worst legal context envelope measured at 34.3% of 256k.

Slippage: default 100 bps, ceiling 1000 bps, rejection rather than clamping. VEX fee 25 bps. Trench curve fee 1%, which is the venue's own.

Invalid parameter tool calls since manifest injection: zero.

The funded verification wave. Every fix in this release passed tests and adversarial review. The next step is the standing live probe suite: re running the original failure scenarios with real funds across all six venues, including the paths only a live chain can prove, such as a genuinely superseded launch and a live Uniswap fee leg capture.

Tool retention. Discovered tools currently leave a session oldest first when the 40 slot cap fills. The planned change evicts least recently used and pins anything the agent touched in its last ten turns, so a tool never vanishes mid workflow.

Hardened input boundaries. A root guard for all internal tool handlers, after an audit found 15 sharing a pre parse dereference pattern, is specified and awaiting the go.

Still on the roadmap from 0.2.0: price based Wake Up, Telegram remote control, perpetuals via Lighter, the white paper, and Windows builds. The launchpad line item is done, and it shipped as Trench Express.

First install, and every version upgrade, plays a three act cinematic prologue: star field, rotating fibonacci globe, break orbit assembly onto the letterforms. After that it condenses to roughly 1.2 seconds. Any input skips it, and reduced motion users get a fully static gate.

Every pre shell screen (setup wizard, unlock, provider config) was rebuilt in the cobalt ink register: boxless centered composition, larger type, colour rails instead of alert boxes.

Settings moved into the shell. The old reconfigure wizard is gone. Settings is now a proper in app screen with calm full page sub views, and per chain private key export lives only there, behind the settings surface, never in the wizard.

The Turn Activity Island. The moment you press send, a live island mounts and moves through Working, Thinking, Calling, Writing. You watch the agent's actual reasoning stream in full, rendered as markdown and segmented per round: when a tool call lands, the current thought collapses into a stamp and the next round streams fresh underneath.

Reasoning is persisted. The agent's thinking and each tool's duration are stored per message and survive restarts. The transcript you reopen tomorrow shows the same reasoning it showed live.

No more auto scroll. The chat never yanks the view. A Latest pill offers the jump, the transcript opens at the bottom on load, and it stays exactly where you left it.

Honest tool cards. Tool calls render with a venue mark, a human title, and a duration, and they only claim what actually happened. Executed appears only for a proven, successful mutating operation. Quotes always carry a visible Quote label. An ambiguous result shows Pending instead of a false FAILED. Amounts render only when they match the canonical decimal exactly, or they do not render at all. Only curated venues can wear a brand mark, so a crafted tool name cannot impersonate a protocol.

Typography settled after live use: Instrument Serif for display, Instrument Sans at 15px on 1.65 for prose, reasoning in muted serif italic.

An Etherscan like, infinitely scrolling log of every action: swaps, bridges, lends, predictions, yield operations, and fees, with filters by kind, status, protocol, chain, and session, plus day grouping, expandable rows, bridge leg audit trails, and explorer links.

A new accounting spine underneath it. Every broadcast is staged before signing: the intent is recorded first, the hash is taken from the signed bytes, and confirmation comes only from an on chain receipt. Ambiguity never fabricates an outcome, so a transaction the chain has not answered for stays visibly pending rather than guessed.

Pending transactions now resolve themselves. A 30 second background sweep asks one question per pending row: did this hash succeed or revert on its chain, by EVM receipt or Solana signature status. Success confirms, a mined revert fails, ambiguity waits. Proven end to end against a real stuck Robinhood Chain swap that older versions would have shown as pending forever.

A sleeping agent is no longer invisible. When the agent parks itself with a timed defer of up to 24 hours, the session shows a went to sleep banner with the wake time, a live countdown, and the agent's own stated reason. A sleeping agent never looks like a dead one again.

A position card with a serif display total and a unified chain row. Solana is now first class beside the EVM chains.

Session wallets (read only, real labels), balances with dust filtering and a full Assets view, and session activity backed by the real Agent Scan feed with a visible scope marker.

A Session Runtime card: the active model, the serving provider, token usage, and a context pressure meter driven by the engine's real pressure bands, so you can watch a long session approach compaction before it happens.

Token history: per token transaction feeds with cost basis and explorer links, one click from any exact identity token row.

Automatic context compaction, version two. Long sessions no longer stall at the context ceiling. Compaction prepares in the background from a frozen snapshot once pressure crosses 0.80, an Apply button appears when the summary is ready, and at critical pressure it applies itself. The manual compact_now tool is gone, so you never have to think about context again.

Provider failover. On a provider capacity failure VEX retries, then switches once per session to the highest uptime sibling endpoint, sticks to it, and re resolves pricing and context window so the meter stays honest.

Errors you can see. 27 SDK error types and 15 status classes now surface into a session banner, a global surface for session less failures, and a durable last error on runtime state. No more staring at a silent session wondering what happened.

Control that works. Approve and Reject in chat actually resume the agent. Stop is run scoped and aborts in flight inference. A stopped mission can be restarted with an operator instruction. Mission updates push instead of poll. The autonomy budget rose to 1000 iterations per turn.

Tool call tape integrity. A provider returning a duplicate or blank tool call id used to poison a session permanently, with every later turn rejected. The tape is now normalized in flight, deterministically, without rewriting history.

Memory pipeline unblocked. A chunk size mismatch had silently prevented sessions from ever receiving narrative memory. Fixed, with a bounded repair round.

Model catalogue and endpoints. A newest first model list, per model provider endpoint pinning ranked by uptime and restricted to tool capable endpoints, edit in place configuration that keeps your stored API key unless you type a new one, and a per model reasoning effort selector.

Pendle, complete. 16 tools became 29: full market data (history, candles, orderbook, rewards, prices), a cross chain yields query with 20 named filters, position values with exact per leg amounts and accrued claimables, and a complete mutating surface (SY mint and redeem, dual LP add and remove, PT rollover, LP transfer, LP to PT) with per field price floors and matured market handling that either resolves correctly or refuses by name.

Solana, complete. The full Jupiter suite: fee bearing swaps, the borrow lifecycle, Lend Earn with a dust free full exit, and prediction markets (buy, sell, close all) with payout settlement confirmed from the keeper's own transaction. Live verified with real funds.

Bridges you can watch. Khalani as primary, Relay as a route bound fallback and always on for Robinhood Chain. Bridge legs are first class recorded activity with honest in flight messaging (tracked automatically, do not re bridge) and a background sweep that confirms fills from on chain evidence. Live verified in both directions with real transfers.

The gate audit. All 35 pre sign refusal gates were audited under one principle: gates exist to refuse theft, not market conditions. Gates that second guessed the market, such as one re validating a fresh quote against a stale one over a 0.0033% move, were removed. Gates that stop calldata exploits, overcharges, and unattributable value transfers were kept and hardened. A miscalibrated Solana priority fee cap that overstated exposure by 3.45 times was fixed. The agent trades freely inside hard safety rails, and that is the design.

Research tools that tell the truth. All 14 DexScreener tools were rebuilt around answering in one call: filters, sorting, paging, and self diagnosing empty results on every feed. Two tools that failed on 100% of calls in 0.1.4 were fixed, two silent row caps were exposed, and four false tool descriptions were corrected. twitter_account was restored from a total outage, and both research tools now lead every output with an untrusted content warning. The agent treats web and social content as data, never as instructions.

Aggregator swap fees (the KyberSwap route level feeReceiver, the Jupiter platform fee on the input mint) and the 25 bps bridge fee accrue to the two addresses above.

All collected fees fund VEX buyback and burn. The treasury addresses are public constants in the codebase, so anyone can watch them on chain.

Fee mechanics are safety audited. A fee is charged only after the operation it charges for succeeds, so a failure can never charge you for something that did not happen. Fee amounts and destinations are hard coded product policy that the model cannot set, raise, or redirect: a model supplied fee parameter is rejected by name, and one legacy parameter that could have routed value to an arbitrary address was found and removed in this release.

Hyperliquid. The integration is removed wholesale, and its tables are dropped on upgrade.

Polymarket, Zaps (in, out, migrate), and limit orders (10 tools). Deleted.

FIFO and mark to market PnL, replaced by the plain, auditable agent_activity log that Agent Scan and the agent itself read. Legacy PnL projections are dropped on upgrade.

The subagent subsystem and its SUBAGENT_* configuration. Dead at runtime since before 0.1.0, so the config surface and the UI are gone and stale .env keys are simply ignored.

compact_now. Compaction is automatic now.

The tool output blob mechanism (tool_output_read). Tool outputs are persisted verbatim and inline, so the agent no longer reads its own results through a keyhole.

The reconfigure wizard, the chat auto scroll, and the NOTARY era UI chrome. The updater's Release notes button now opens projectvex.ai/releases instead of GitHub.

86 commits, roughly 385k lines touched at about 3:1 runtime to app, 19 database migrations.

The prompt system was rebuilt for unambiguity: roughly 290 tokens saved per turn, with invariants moved into the cached prefix.

Default context 256k. Compaction prepares at 0.80 pressure. Autonomy budget 1000 iterations.

Global slippage ceiling 1000 bps, enforced by rejection, never by silent clamping.

Pending transaction resolver at 30 seconds. Agent sleep up to 24 hours, now visible.

Pendle: 29 tools. DexScreener: 14 tools, all with full parameter vocabularies.

Integrator fee: 25 bps on swaps and bridges, to the treasury, funding buyback and burn.

Price based Wake Up. Chronos made the sleeping agent visible; the next step makes it reactive. A deferred session will be able to arm a price trigger alongside its timer, so if the market moves against a position VEX wakes immediately instead of sleeping out the clock, and either acts on a pre authorized instruction or wakes with options on the table. On the way up, the same mechanism offers a stop loss, a take profit, or simply wake me and let me look. A 30 minute nap stops meaning 30 minutes of blind exposure.

Telegram remote control. Connect a session to Telegram and talk to VEX from anywhere: session steering, approvals, and conversation without sitting at the computer. The desktop app stays the custodian, Telegram becomes the remote.

An agent side token launchpad. VEX will be able to create tokens through a new launchpad integration: the agent as a launcher, not only a trader.

Perpetuals via Lighter. The next trading venue on the list is Lighter, a perpetuals DEX built as an application specific zk rollup on Ethereum, where the order book runs off chain but every match, funding payment, and liquidation is proven correct with zero knowledge proofs before settlement. Verifiable execution is exactly the kind of venue an autonomous agent should trade perpetuals on, and it pairs naturally with price based Wake Up.

The white paper. The treasury and buyback mechanics above will be specified in full there.

Windows. The code signing certificate is in progress. macOS (arm64 and x64, signed and notarized) and Linux ship now.

A correct password is never called wrong. Vault unlock now classifies failures by phase: only a failed cryptographic authentication can say "wrong password". A corrupt file says corrupt, a vault written by a newer build says update VEX, and a transient system error says try again. None of them advance the lockout throttle or steer you toward wiping keystores.

Helper processes lost their keyring. Docker helpers spawned by the app only need PATH and a socket. They no longer inherit your unlocked API secrets, and the strip survives Windows' case insensitive environment semantics.

Web research fetches only through Tavily. The raw local fetch fallback is gone: the privileged process never fetches arbitrary URLs from your machine anymore, which deletes the entire local SSRF surface instead of guarding it. Provider responses are now accounted exactly once, so duplicate, conflicting, or unrequested entries can't multiply results or poison the cache.

Uniswap and KyberSwap classify by economics, not by tool name. A wrapped native leg (WETH, WBNB, WPOL, WMNT, wS, WBERA and friends) records as the native side of the trade. KyberSwap gained a fail closed wrapped native registry covering all 19 aggregator chains, with every address verified on chain before it shipped.

Portfolio lines can't be spoofed by a symbol. Positions aggregate by token address, never by self declared symbol, so a fake "WETH" can't melt into your real one, and brand icons render only for address verified tokens.

Polymarket responses are validated end to end. All nine previously raw reward and market endpoints now parse through strict, bounded schemas, so a garbled number rejects instead of silently displaying as zero.

A Review & accept contract bar now appears exactly where Start mission will be. The passive header badge is no longer the only way in, and accepting closes the modal right onto the Start button. Merged directly from the community.

Readiness is honest. While the action plan is still loading, failed to load, or empty, every surface (badge, bar, and modal) says Preparing, and a failed read gets an explicit Retry instead of a dead end.

A dropped event can't hide the bar. Live sync now carries a fallback poll, so mission state stays current even if a push goes missing.

The exit drain animation actually plays. The trading room theme holds through the drain and hands back your own theme cleanly, with reduced motion respected.

Focus follows you. Into the room on enter, back to the chat composer on exit, with proper screen reader labels along the way.

Earn cards stopped clipping their actions in short windows.

darahub · #43, #44, #46: the vault, SSRF, and secrets findings.

Nishant-Adhikari · #39 merged directly, and the accounting discipline behind the registry work.

mandatedisrael · #37 merged directly, and #38: the mission acceptance flow.

alexastro01 · #36 and #40: the polish that shipped, and the best design issue this repo has received in #21.

ellygeronline-lab · issues #26, #41, #42: diagnoses precise enough to fix from.

Every mutating Hyperliquid tool is live the moment the trading mode is active. An earlier release gate that hid the perp open tool behind a flag was removed after live testing showed it caused the agent to waste turns searching for a hidden tool.

Stop loss stays mandatory on every position open. Take profit can now be added or replaced independently through setTpsl, so a compensation flow that restores a stop after a rejected entry can no longer lose the take profit target.

The level 2 slippage gate was rewritten to be direction aware. It previously flagged a price improving fill as a slippage violation because it measured the absolute difference instead of the adverse direction, which caused real, false positive trade blocks in production.

Protection state reads now parse venue decimal values leniently instead of rejecting legitimate books, and skip validation entirely for read only tools that cannot move funds.

Per wallet mutation locks, durable pre sign execution intents, and complete approval previews (size, price, duration) were added ahead of the wave 2 security audit.

A persistent candle store lets the agent watch markets, scan for breakouts, volume spikes, moving average crosses, and RSI conditions without paying the token cost of re fetching history every turn.

The Hyperliquid builder fee now routes to the VEX treasury, funding VEX token buyback and burn.

Transaction receipts are now checked for a reverted status everywhere the agent waits on chain. Previously a reverted approval could be treated as a granted allowance, and a reverted swap could be reported as a completed trade. This is now caught with a dedicated CONFIRMATION_UNKNOWN code so the agent never blindly retries an ambiguous outcome.

ERC 20 balances are checked before every approval and swap, replacing a confusing on chain revert with a clear, specific error naming the token and the shortfall.

Fee on transfer tokens can now be sold on Uniswap V2. The previous swap functions assumed no transfer tax and always reverted on exit for these tokens; the fee aware router variants fix that.

Relay, Khalani, and Polymarket integrations now report terminal failures honestly instead of quietly treating a failed or refunded bridge step, or a rejected order, as a success.

The trade side recorded for Uniswap and KyberSwap trades is now derived from the actual economic direction of the swap rather than the tool name that was called.

KyberSwap approvals are exact amount only, quotes and executions are bound to the same slippage value so a stale quote can no longer silently pass a fresh execution, and every response is verified against the expected router address before broadcast.

Wallet send now flows through a proper two step approval handoff. A prepared send synthesizes the confirmation step through the standard tool path, so restricted sessions see the approval card immediately instead of requiring an extra model round trip.

Turns that end incomplete, whether from a timeout, an iteration limit, or exhausted context, now surface an honest, operator facing notice instead of silently looking finished.

Mission mode gained a hard time box. The mission duration is frozen into the run's contract the moment it starts, so nothing can move the deadline after the fact, and the turn loop stops cleanly with a dedicated deadline reached status rather than burning another inference call past the limit. A time boxed mission is now presented as time boxed, not as a failure.

Every mission now writes to a per wallet results ledger: a race free record of what was opened, closed, and valued, visible in a new read only Mission History panel.

The tool output reader gained search, path, and array query modes (where, sort, offset, limit) for large tool responses that overflow into a blob. Previously those responses could only be read as blind byte slices, which had already caused the agent to wrongly conclude a real market did not exist because the listing was cut off mid page.

The Docker based backend now recovers from a stale bind mount automatically with a non destructive recreate, instead of leaving the operator stuck at a dead end with only a support contact link.

Session lease handling (stop, pause, resume, retry) now follows explicit per operation contracts instead of an unobservable enqueue, so a paused or stopped session behaves predictably from the UI.

Mission renewal is now transactionally idempotent, and the UI hides the Renew action once a draft already exists for that slot.

Token symbols shown in the Moves feed and the trading chart are now resolved only from a verified mint address. A token symbol or brand claim that arrives as free text from an activity record is always dropped rather than trusted, closing a path where a malicious or malformed token name could impersonate a known brand.

Explorer links were added across Moves and the tool ledger for over twenty networks, including Hyperliquid, HyperEVM, Robinhood Chain, Avalanche, Linea, Mantle, Sonic, Berachain, Ronin, Unichain, Plasma, Etherlink, Monad, MegaETH, and zkSync, so any transaction or account can be opened directly on its native block explorer.

The welcome screen now supports multiple configured wallets. With more than one wallet, a chip switcher shows a single wallet's holdings grouped by chain, while the combined total remains the default view.

A searchable model picker in the provider setup wizard, replacing a paste only model id field with a live, filterable catalogue from OpenRouter.

Search and mode filters in the session library, so operators can find a past session by title instead of scrolling.

One click address copy on the wallets review card, so recovering a public address no longer requires entering edit mode.

The New Session dialog now defaults to Mission mode when the session list is already filtered to missions.