From b6e9f7b2b62f28ba510a9536466a647d3d6b8670 Mon Sep 17 00:00:00 2001 From: 1bcMax Date: Mon, 9 Nov 2026 22:27:54 -0600 Subject: [PATCH] chore: release 3.49.27, @blockrun/llm ^3.26.5 (Solana payments sign on the quoted blockhash) --- CHANGELOG.md | 10 ++++++++++ apps/desktop/package.json | 2 +- package-lock.json | 14 +++++++------- package.json | 4 ++-- 4 files changed, 20 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 975f584..15612a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## Franklin Agent 3.49.27 — Solana payments sign on the gateway's quoted blockhash + +Requires `@blockrun/llm` 3.26.5 (was 3.19.1 in the lockfile). When a Solana 402 +quotes `extra.recentBlockhash`, every paid tool now signs on that blockhash instead +of one the SDK fetched itself. It is a `finalized` hash every facilitator verifier +has already seen, and the Solana gateway applies its sandbox-create payment-window +check only to payments signed on the hash it quoted. All 18 Franklin call sites +already pass the 402's `extra` through, so no Franklin code changes. With no valid +quote the payment is built exactly as before. + ## Franklin Agent 3.49.26 — `franklin serve` needs a token, and the panel token stays off the command line Security fix. Upgrade if you run `franklin serve` or `franklin panel`. Thanks to diff --git a/apps/desktop/package.json b/apps/desktop/package.json index c3917d3..24f7775 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -40,7 +40,7 @@ "test:skills": "npm run build && node test/skills.e2e.mjs" }, "dependencies": { - "@blockrun/llm": "^3.19.1", + "@blockrun/llm": "^3.26.5", "@blockrun/model-catalog": "https://codeload.github.com/BlockRunAI/model-catalog/tar.gz/aecf20b4d5ee51af4a38a69a1b9c81e3e64b955c", "@blockrun/router-core": "https://codeload.github.com/BlockRunAI/router-core/tar.gz/273c2af0a9abe70212efbad7117b72eb3038cffc", "@fontsource/poppins": "^5.2.7", diff --git a/package-lock.json b/package-lock.json index a83c8c9..78f5dfa 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,18 +1,18 @@ { "name": "@blockrun/franklin", - "version": "3.49.26", + "version": "3.49.27", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@blockrun/franklin", - "version": "3.49.26", + "version": "3.49.27", "license": "Apache-2.0", "workspaces": [ "apps/desktop" ], "dependencies": { - "@blockrun/llm": "^3.19.1", + "@blockrun/llm": "^3.26.5", "@blockrun/model-catalog": "https://codeload.github.com/BlockRunAI/model-catalog/tar.gz/aecf20b4d5ee51af4a38a69a1b9c81e3e64b955c", "@blockrun/router-core": "https://codeload.github.com/BlockRunAI/router-core/tar.gz/273c2af0a9abe70212efbad7117b72eb3038cffc", "@colbymchenry/codegraph": "^1.5.0", @@ -58,7 +58,7 @@ "version": "0.2.0-beta.10", "license": "Apache-2.0", "dependencies": { - "@blockrun/llm": "^3.19.1", + "@blockrun/llm": "^3.26.5", "@blockrun/model-catalog": "https://codeload.github.com/BlockRunAI/model-catalog/tar.gz/aecf20b4d5ee51af4a38a69a1b9c81e3e64b955c", "@blockrun/router-core": "https://codeload.github.com/BlockRunAI/router-core/tar.gz/273c2af0a9abe70212efbad7117b72eb3038cffc", "@fontsource/poppins": "^5.2.7", @@ -1935,9 +1935,9 @@ "link": true }, "node_modules/@blockrun/llm": { - "version": "3.19.1", - "resolved": "https://registry.npmjs.org/@blockrun/llm/-/llm-3.19.1.tgz", - "integrity": "sha512-Ekl7dTsoVbhP5SOF/Np2n1EvNlbsggmHyyfdHcZEXuo9xB8KqHfGi5YWfwen8L0ezwQ2mT7Al/RYFvNk7BuRYA==", + "version": "3.26.5", + "resolved": "https://registry.npmjs.org/@blockrun/llm/-/llm-3.26.5.tgz", + "integrity": "sha512-jOlvInVsYLV4qT1QWQDa7XxP9jABmLjA89WSK03u7XMjPzMpeCt6knwOkq6A6NSjVjHHjzmXRVisxabNW/b8eA==", "license": "MIT", "dependencies": { "@anthropic-ai/sdk": "^0.123.0", diff --git a/package.json b/package.json index 524dc60..4a43eb2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@blockrun/franklin", - "version": "3.49.26", + "version": "3.49.27", "description": "Franklin Agent — The AI agent with a wallet. Spends USDC autonomously to get real work done. Pay per action, no subscriptions.", "type": "module", "exports": { @@ -75,7 +75,7 @@ "node": ">=20.19.0" }, "dependencies": { - "@blockrun/llm": "^3.19.1", + "@blockrun/llm": "^3.26.5", "@blockrun/model-catalog": "https://codeload.github.com/BlockRunAI/model-catalog/tar.gz/aecf20b4d5ee51af4a38a69a1b9c81e3e64b955c", "@blockrun/router-core": "https://codeload.github.com/BlockRunAI/router-core/tar.gz/273c2af0a9abe70212efbad7117b72eb3038cffc", "@colbymchenry/codegraph": "^1.5.0",