@orth/cli 0.2.33 → 0.2.34

package/dist/api.d.ts

@@ -13,6 +13,7 @@ export interface SearchResponse {
             price?: number;
             hasDynamicPricing?: boolean;
             pricing_formula?: string;
+            apiSlug?: string;
         }>;
     }>;
     count: number;
@@ -139,6 +140,7 @@ export interface ApiBySlugResponse {
             required: boolean;
             description?: string;
         }>;
+        apiSlug?: string;
     }>;
     count: number;
 }

package/dist/commands/api.js

@@ -7,6 +7,7 @@ exports.apiCommand = apiCommand;
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const api_js_1 = require("../api.js");
+const utils_js_1 = require("../utils.js");
 async function apiCommand(slug, path, options) {
     const spinner = (0, ora_1.default)("Loading...").start();
     try {
@@ -162,7 +163,14 @@ async function apiCommand(slug, path, options) {
                                 ? chalk_1.default.dim(ep)
                                 : chalk_1.default.dim(`$${parseFloat(Number(ep).toFixed(4))}`);
                     })();
-                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}`);
+                // Group members commonly collide on the same upstream path (e.g.
+                // AbstractAPI's many products all expose "/v1") — when the endpoint's
+                // own callable slug differs from the card's flat slug, show it so the
+                // right identifier is obvious before calling `orth run`.
+                const memberTag = endpoint.apiSlug && endpoint.apiSlug !== api.slug
+                    ? chalk_1.default.dim(`  [${(0, utils_js_1.sanitizeForTerminal)(endpoint.apiSlug)}]`)
+                    : "";
+                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}${memberTag}`);
                 if (endpoint.description) {
                     console.log(chalk_1.default.gray(`       ${endpoint.description.slice(0, 80)}${endpoint.description.length > 80 ? "..." : ""}`));
                 }
@@ -195,7 +203,10 @@ async function apiCommand(slug, path, options) {
                                 ? chalk_1.default.dim(ep2)
                                 : chalk_1.default.dim(`$${parseFloat(Number(ep2).toFixed(4))}`);
                     })();
-                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}`);
+                const memberTag = endpoint.apiSlug && endpoint.apiSlug !== api.slug
+                    ? chalk_1.default.dim(`  [${(0, utils_js_1.sanitizeForTerminal)(endpoint.apiSlug)}]`)
+                    : "";
+                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}${memberTag}`);
                 if (endpoint.description) {
                     console.log(chalk_1.default.gray(`       ${endpoint.description.slice(0, 80)}${endpoint.description.length > 80 ? "..." : ""}`));
                 }

package/dist/commands/search.js

@@ -7,6 +7,7 @@ exports.searchCommand = searchCommand;
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const api_js_1 = require("../api.js");
+const utils_js_1 = require("../utils.js");
 async function searchCommand(query, options) {
     const spinner = (0, ora_1.default)("Searching APIs...").start();
     try {
@@ -21,9 +22,17 @@ async function searchCommand(query, options) {
             console.log(chalk_1.default.cyan.bold(`${api.name}`) + chalk_1.default.gray(` (${api.slug})`));
             for (const endpoint of api.endpoints.slice(0, 3)) {
                 const method = endpoint.method.padEnd(6);
+                // Group members commonly collide on the same upstream path (e.g.
+                // AbstractAPI's many products all expose "/v1") — when the endpoint's
+                // own callable slug differs from the card's flat slug, show it so the
+                // right identifier is obvious before calling `orth run`.
+                const memberTag = endpoint.apiSlug && endpoint.apiSlug !== api.slug
+                    ? chalk_1.default.dim(`  [${(0, utils_js_1.sanitizeForTerminal)(endpoint.apiSlug)}]`)
+                    : "";
                 console.log(chalk_1.default.gray("  ") +
                     chalk_1.default.yellow(method) +
-                    chalk_1.default.white(endpoint.path));
+                    chalk_1.default.white(endpoint.path) +
+                    memberTag);
                 if (endpoint.description) {
                     console.log(chalk_1.default.gray(`       ${endpoint.description.slice(0, 80)}${endpoint.description.length > 80 ? "..." : ""}`));
                 }

package/dist/utils.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeForTerminal(value: string): string;

package/dist/utils.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeForTerminal = sanitizeForTerminal;
+// Strips ASCII control characters (including ESC, 0x1B) from a string before
+// it's written to the terminal. Needed for any remotely-sourced value we
+// render directly (e.g. apiSlug, which an API owner sets) — without this, a
+// crafted value containing terminal escape sequences could manipulate another
+// user's terminal (spoofed output, hidden/cleared text, deceptive hyperlinks).
+function sanitizeForTerminal(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\x00-\x1F\x7F]/g, "");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orth/cli",
-  "version": "0.2.33",
+  "version": "0.2.34",
   "description": "CLI to access all APIs and skills on the Orthogonal platform",
   "main": "dist/index.js",
   "bin": {