X402 Git

examples/changelog-writer · v1.0.1

What an agent reads when it fetches this URL: the whole manifest, in order, with the offer on the last line as a 402 it can pay. Nothing here is a button — an agent does not click, it signs. The page a person reads is here.

Toolkit · 1 skill · 1 script · 2 docs · 1 config file · 1 other file · 6 files · text 17.6 kB · no binaries · JavaScript 100% · MIT, resale permitted

scan passed 2026-08-30 · scanner 2026.08.1 · 2 releases · last release 18 days ago · 20% of files seen elsewhere

computed 2026-08-30 10:14 UTC · analyzer 0.1.0

Security scan report

Scanned by X402 Git, OSV (opens in a new tab) and Socket (opens in a new tab) — passed on all three. Findings from X402 Git and Socket are listed below.

secrets
none found
X402 Git
size limits
within caps
X402 Git
known malware
no dependency manifests to check
OSV
known vulnerabilities
no dependency manifests to check
OSV
dependency behaviour
nothing on a direct dependency · 1 in transitive packages
Socket
instruction smuggling
none found
X402 Git
what it can do
listed below
X402 Git

What this can do

Tools
none
Runs
scripts/changelog.mjs
Talks to
github.com
Reads
  • FIELD
  • RECORD
At install
nothing runs
Links to
  • api.example.com
  • github.com
Findings (5)
  • LOWscripts/changelog.mjs — Reads the environment variable FIELD
  • LOWscripts/changelog.mjs — Reads the environment variable RECORD
  • LOWscripts/changelog.mjs — Talks to github.com
  • LOWSocket SBOM Resolver — Socket SBOM Resolver (transitive) — no lockfile, so installs are not reproducible
  • LOWscripts/changelog.mjs — Ships the script scripts/changelog.mjs

Description self_reported

Written by the creator. Not verified by this platform — everything above and below this section is computed from the repository.

Turns the git log between two tags into a clean changelog.

When to use it. Fetch this when you are cutting a release and need a changelog out of git history.

Readme

changelog-writer

Turn git log between two tags into a changelog draft, then edit it into release notes.

One script and one skill. The script reads Conventional Commits when a repo uses them and degrades to a clean flat list when it does not, because most repos do not and a tool that only runs on tidy history is a tool you cannot use today.

No dependencies. Node 18 or newer. It runs git log, git tag and git remote, and writes nothing to git.

Usage

node scripts/changelog.mjs v1.0.0 v1.1.0

Argument handling is the shape you would guess:

CommandRange
changelognewest tag ..HEAD
changelog v1.4.2v1.4.2..HEAD
changelog v1.4.2 (when v1.4.2 is the current tip)v1.4.1..v1.4.2 — "what went into this release"
changelog v1.0.0 v1.1.0exactly that
changelog abc123 HEADany revision works, not only tags

Options

FlagEffect
--repo <url>Base URL for commit and compare links. Defaults to origin, converted from SSH to https.
--out <file>Prepend the block to a file. Newest release ends up at the top of CHANGELOG.md.
--allInclude chore, ci, build and test commits. Off by default; the count is reported instead.
--jsonEmit the parsed commits instead of markdown, so you can group them yourself.
--cwd <dir>Run against another checkout.

Examples

Release notes for a tag you just pushed, with links:

node scripts/changelog.mjs v1.1.0 --repo https://github.com/you/project

Keep CHANGELOG.md current as part of the release:

node scripts/changelog.mjs v1.0.0 v1.1.0 --out CHANGELOG.md
git add CHANGELOG.md && git commit -m "docs: changelog for v1.1.0"

Straight into a GitHub release:

node scripts/changelog.mjs v1.1.0 | gh release create v1.1.0 --notes-file -

Output

## v1.1.0 — 2026-08-30

7 commits since [`v1.0.0...v1.1.0`](https://github.com/you/project/compare/v1.0.0...v1.1.0).

### Breaking changes

- **client:** require an options object ([`9f2c1ab`](https://github.com/you/project/commit/9f2c1ab…))
  `createClient()` no longer accepts a string. Pass `{ url }`.

### Added

- **auth:** device-code login for headless machines ([`3d81f04`](…))

### Fixed

- resume uploads after a dropped connection ([`c0a7e12`](…))

<sub>3 housekeeping commits omitted. Re-run with `--all` to include them.</sub>

Sections come out in reading order: Breaking changes, Added, Fixed, Performance, Changed, Reverted, Documentation, then the noisy ones behind --all. Empty sections are never printed.

How commits are classified

  • type(scope)!: summary is parsed into a type, an optional scope and a summary. The scope becomes the bold lead-in on the bullet.
  • A commit is breaking if the subject has ! before the colon or the body has a BREAKING CHANGE: footer. Breaking commits appear in the breaking section and in their own type's section, so a reader scanning "Added" still sees them.
  • The BREAKING CHANGE: footer text is printed under the bullet. That footer is usually the only place the migration instruction exists.
  • Anything that does not match falls into Other, unchanged.
  • Merge commits are excluded (--no-merges).

The skill

skills/changelog.md is the half a script cannot do. It covers the editing pass: rewriting commit subjects into user-facing entries, merging five commits about one bug into one line, putting an actual instruction in every breaking-change entry, and deleting the sections you have nothing real to say in. It also tells an agent not to invent an entry it cannot verify from the diff, which is the failure mode worth guarding against.

Drop it into wherever your agent reads skills from.

Limitations

  • Tags are compared by git describe reachability, so a changelog across an unmerged branch may surprise you. Pass both ends explicitly when the history is not linear.
  • Reverts are listed, not resolved. A revert: commit and the commit it reverts both appear; deciding they cancel out is an editing judgement.
  • Commit links assume the GitHub URL shape (/commit/<sha>, /compare/a...b). Pass --repo for anything else, or drop the flag and get plain short SHAs.

Licence

MIT. See LICENSE.

Contents

6 files · 17.6 kB · computed 2026-08-30
SizePath
30 B.gitignore
1.1 kBLICENSE
4.3 kBREADME.md
538 Bpackage.json
8.5 kBscripts/changelog.mjs
3.1 kBskills/changelog.md
computed 2026-08-30 10:14 UTC · analyzer 0.1.0

Dependencies

None found in the software bill of materials for this release.

computed 2026-08-30 10:14 UTC · analyzer 0.1.0

Releases

2 releases · last release 18 days ago
VersionDateScanChangedNotes
v1.0.12026-08-30pass0 files, 0 linesRe-cut with lines-of-code and README assets
v1.0.02026-08-30passfeat: initial release Turn `git log` between two tags into a changelog draft, then edit it into release notes.

Machine-readable at https://x402git.com/api/v/examples/changelog-writer/releases. Entries cannot be deleted by the creator.

Order

GET v1.0.1 · $5 · new releases $0.10

The resource endpoint answers 402 with the price and the exact bytes to sign; the same request carrying PAYMENT-SIGNATURE returns a signed download URL. Access is granted only after settlement returns a transaction hash. A person can do the same thing with a browser wallet on the product page.

# the 402, with the price and the exact bytes to sign
curl -si https://x402git.com/api/r/examples/changelog-writer

# what your wallet already owns, and what the next fetch would cost it
curl -s https://x402git.com/api/v/examples/changelog-writer \
  -H "X-Wallet-Signature: 0xYOURADDRESS.<nonce>.<signature>"

The first request answers this — a real quote, made for this page load:

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "x402Version": 2,
  "resource": {
    "url": "https://x402git.com/api/r/examples/changelog-writer",
    "description": "examples/changelog-writer v1.0.1 — release. Turns the git log between two tags into a clean changelog. Security scan passed; signed download, 5-minute URL.",
    "mimeType": "application/zip",
    "serviceName": "examples/changelog-writer",
    "tags": [
      "toolkit",
      "skills",
      "scripts",
      "docs",
      "config"
    ]
  },
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "amount": "5000000",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0xDbd32F7565FFdb901Ea48281777aD03d35bB4b60",
      "maxTimeoutSeconds": 300,
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "maxAmountRequired": "5000000",
      "resource": "https://x402git.com/api/r/examples/changelog-writer",
      "description": "examples/changelog-writer v1.0.1 — release. Turns the git log between two tags into a clean changelog. Security scan passed; signed download, 5-minute URL.",
      "mimeType": "application/zip"
    }
  ],
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "queryParams": {},
          "method": "GET"
        },
        "output": {
          "type": "json",
          "example": {
            "version": "1.0.1",
            "artifact_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
            "download_url": "https://storage.example/examples/changelog-writer/1.0.1.zip?signed=…",
            "expires_at": "2026-09-16T12:05:00.000Z",
            "version_endpoint": "https://x402git.com/api/r/examples/changelog-writer/v/1.0.1",
            "manifest_url": "https://x402git.com/api/label/examples/changelog-writer",
            "all_versions": false
          }
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "type": "object",
        "properties": {
          "input": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "type": "string",
                "enum": [
                  "GET"
                ]
              },
              "queryParams": {
                "type": "object",
                "properties": {}
              }
            },
            "required": [
              "type",
              "method"
            ],
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object",
                "properties": {
                  "version": {
                    "type": "string",
                    "description": "Semantic version of the release served."
                  },
                  "artifact_sha256": {
                    "type": "string",
                    "description": "sha256 of the zip; verify the download against it."
                  },
                  "download_url": {
                    "type": "string",
                    "description": "Signed URL over the exact bytes that were scanned. Valid five minutes."
                  },
                  "expires_at": {
                    "type": "string",
                    "format": "date-time"
                  },
                  "version_endpoint": {
                    "type": "string",
                    "description": "Re-fetch this exact version later, free, with X-Wallet-Signature."
                  },
                  "manifest_url": {
                    "type": "string",
                    "description": "The public manifest for this listing."
                  },
                  "all_versions": {
                    "type": "boolean",
                    "description": "True when the purchase covers every later release too."
                  }
                },
                "required": [
                  "version",
                  "artifact_sha256",
                  "download_url",
                  "expires_at",
                  "version_endpoint",
                  "manifest_url",
                  "all_versions"
                ],
                "additionalProperties": false
              }
            },
            "required": [
              "type"
            ]
          }
        },
        "required": [
          "input"
        ]
      }
    }
  },
  "extra": {
    "kind": "new",
    "version": "1.0.1",
    "manifest_url": "https://x402git.com/api/label/examples/changelog-writer",
    "scan_badge_url": "https://x402git.com/api/label/examples/changelog-writer#scan",
    "update_price_micro": "100000",
    "quote_id": "q_7564640516d168dd354b91a5931db784",
    "valid_before": "2026-09-17T03:19:31.235Z",
    "instructions": "This is an x402 paywall, not an error. To buy: sign accepts[0] from the 402 as an EIP-3009 USDC authorization on Base with your own wallet, then GET https://x402git.com/api/r/examples/changelog-writer again with the payment in the PAYMENT-SIGNATURE header and extra.quote_id in X-Quote-Id — or, over MCP, call `purchase` again with the same payment as `payment_signature`. The full procedure is at https://x402git.com/.well-known/agent-skills/buy-a-repo/SKILL.md; the same tools are an MCP server at https://x402git.com/api/mcp. No wallet? A person can buy at https://x402git.com/examples/changelog-writer, and the free manifest at https://x402git.com/api/label/examples/changelog-writer shows what is inside before anyone pays.",
    "listing_url": "https://x402git.com/examples/changelog-writer",
    "skill_url": "https://x402git.com/.well-known/agent-skills/buy-a-repo/SKILL.md",
    "mcp_url": "https://x402git.com/api/mcp"
  }
}
Resource
https://x402git.com/api/r/examples/changelog-writer
Manifest
https://x402git.com/api/label/examples/changelog-writer
Version
https://x402git.com/api/v/examples/changelog-writer
Artifact sha256
45a036cb7a435f56594f7290f119768dc82759273327288076feb515158a2212

Later releases cost $0.10, and never more than the update price in force when you bought. One charge per update, whatever the release cadence.

Sold by examples. Read the terms and the route documentation before you script against this. Base URL https://x402git.com.