Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

The address poster shows the account's primary NFD near the top (reverse
lookup, never fatal — the card renders without it). /nfd/gabe.algo
forward-resolves and borrows the address card wholesale, the requested
name riding along so no second lookup runs. @txnlab/nfd-sdk, already in
the workspace, is now a declared agent dependency.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

algod account state with exclude=all (a busy account's asset arrays are
huge; the totals are all a card needs). Checksum-validated key, mutable
cache. The sixth and last entity route.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

An indexer search by group id, final once visible: five enriched rows,
the rest counted. The URL carries base64url (plain base64 accepted) —
a raw group id's slash can't ride in a path segment.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Explorer header, share card and posters, page brands, siteName, wallet
siteName, and metadataBase all move off VibeKit Agent / agent.getvibekit.ai.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

/transaction, /asset, /application, /block render a branded 1200×630
poster for crawlers and a summary page for humans, straight from chain
state — nothing stored. Txns resolve indexer-first with an algod
pending-pool rescue; cache headers graduate an algod render to the
indexer's immutable one and never let a miss stick. Posters serve from
/og/<kind>/<ref> (the file convention can't live in a catch-all).

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Newest GitHub release (prereleases included — alphas are the product),
cached 24h in ~/.config/vibekit/update-check.json, compared with
Bun.semver. One dim stderr line; skipped for mcp stdio, non-TTY, CI,
and VIBEKIT_NO_UPDATE_CHECK.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

clack's path prompt with tab completion, rooted at cwd, directories only.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Pointer files gain the AGENTS.md paragraph by guarded append; a project's
own AGENTS.md is kept, ours lands beside it as AGENTS.vibekit.md, chained
by one line. TOML configs now parse-and-merge like JSON (Bun.TOML), so a
user's codex/grok settings survive.

Claude-Session: https://claude.ai/code/session_01HSTYunMrd3nHfxWVNJGssA

Adds a plugin for buying mobile airtime and data top-ups in 150+ countries,
paid per order in USDC on Algorand via x402.

Everything an agent can currently buy over x402 is another API response. This
delivers a physical-world good to a phone number, which makes the merchant's
promises checkable rather than trusted: payment settles on chain before
anything is bought, a failed delivery refunds on chain automatically, every
terminal order carries an ed25519-signed receipt naming both transactions, and
the delivery ledger is public — including `stranded`, the count of payers who
were charged, received nothing, and could not be refunded. `topup_ledger` and
`verify_topup_receipt` exist so an agent can check that before trusting it.

The plugin holds no wallet. `buy_topup` returns the x402 payment challenge —
exact amount, asset, payTo, facilitator — for the host's own signer to settle,
so no key is ever custodied by the plugin. It is the only tool marked
`mutatesState`, because it is the step that precedes spending and should be
approval-gated; the other seven are queries.

Mainnet only: there is no testnet storefront, and serving one network's
catalogue to another network's agent would be worse than refusing.

No new dependencies — fetch and zod only. Not added to `defaultPlugins()`: a
merchant that spends real money should be opt-in.

Notes for reviewers, both pre-existing on main and unrelated to this change:
`bunx turbo run build typecheck test` fails in @initlabs/vibekit-tui only
because tmux is absent from the environment, and `verify:packed` fails because
packed-consumer asserts `defaultPlugins().length !== 4` while the preset now
returns five (web was added). @initlabs/vibekit itself is green: build,
typecheck, and 475 tests including the 11 added here.

iOS Safari revokes the tap's transient activation while /api/share is in
flight, so writeText afterwards throws NotAllowedError. Hand clipboard.write
the pending URL as a promise-valued ClipboardItem instead, then offer the
native share sheet on coarse pointers.

The host slug is still nodely; the GET label (and both credits) is the brand.

The agent GET now carries providerUrl — https:// plus the host's last two
labels (router.ai.nodely.io → https://nodely.io) — and both credits wear
it: the composer's standing line and the first mention in qt314's hello.
Brass like every other link; plain text when the URL can't be derived.

The provider label is now the host's second-level name (router.ai.nodely.io
→ nodely, api.together.xyz → together), and it flows from the agent GET into
the composer's standing line and qt314's welcome note. No provider, no
credit — the lines vanish if the endpoint goes away.

The agent tab wears her face, the website wears the V — both cropped from
out/brand and shipped as png + ico. Next serves app/icon.png and
app/favicon.ico by convention; the Astro layout links its pair explicitly.

Two stacked errors. Vestige's /protocols has no denominating param and
reports tvl in ALGO; get_defi_overview relabeled it USD unchecked. And its
liquid-staking rows count both the backing ALGO and the minted derivative
(xALGO showed 553M against a real ~280M ALGO — exactly 2x).

The handler now converts with Vestige's own ALGO/USD price and keeps type-0
(DEX) rows only, refusing outright when the price is unavailable rather
than reporting zeros. Cards say 'locked in dex pools' since that is what
the number is now. Live cross-check: $714.99M became $6.35M, with Tinyman
2.0 at $4.95M against DefiLlama's ~$5.4M.

A client island builds a local result store from the payload's records and
renders them through ResultCard — the same switch the feed uses, with no
handlers, so drill-ins and pagination simply are not there. A record that
does not fit its view still falls to RawCard. Nothing enters the visitor's
session or the model; safeHref gates every record-derived URL. The Satori
poster keeps the flat derivation — Satori cannot render client components.

'share' in the header row, faint until hovered, brass on hover like every
button; '✓ copied' in signal for 1.2s once the link is on the clipboard —
the same readout Copyable gives.

A share glyph on a section's header POSTs the exchange — prompt, her reply,
its view blocks — to /api/share, which strips, hashes (sha256, 48 bits, the
preimage is everything the card displays), and stores it in KV for 90 days.
First write wins: an offline hash collision becomes a failed share, never a
hijack. /s/[hash] is a static server-rendered page — the exchange as a
poster, her line marked as shared, and one button into the Explorer with the
question prefilled — plus a Satori OG image on the brand palette, immutable
by content hash. Nothing from a payload ever enters a visitor's session or
the model's context; the visitor re-asks live.

The explorer routes move into an (explorer) route group so the share page
renders without the client-only shell, and both OG routes read vendored
JetBrains Mono (OFL) instead of scraping Google Fonts CSS per render.