@orth/cli 0.2.33 → 0.3.0

package/dist/analytics.d.ts

@@ -2,4 +2,4 @@
  * Fire-and-forget analytics event for CLI usage tracking.
  * Never blocks, never throws, never shows errors to the user.
  */
-export declare function trackEvent(command: string, args?: Record<string, string | undefined>): void;
+export declare function trackEvent(command: string, args?: Record<string, string | undefined>, response?: unknown): void;

package/dist/analytics.js

@@ -3,12 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.trackEvent = trackEvent;
 const config_js_1 = require("./config.js");
 const CLI_VERSION = process.env.npm_package_version || "0.2.0";
-const BASE_URL = "https://api.orthogonal.com/v1";
+const PRODUCTION_BASE_URL = "https://api.orthogonal.com/v1";
+function getAnalyticsBaseUrl() {
+    return process.env.ORTH_API_URL || PRODUCTION_BASE_URL;
+}
 /**
  * Fire-and-forget analytics event for CLI usage tracking.
  * Never blocks, never throws, never shows errors to the user.
  */
-function trackEvent(command, args) {
+function trackEvent(command, args, response) {
     // Don't track if no API key (not authenticated)
     const apiKey = (0, config_js_1.getApiKey)();
     if (!apiKey)
@@ -16,6 +19,7 @@ function trackEvent(command, args) {
     const payload = {
         command,
         args: args ? sanitizeArgs(args) : undefined,
+        response,
         cliVersion: CLI_VERSION,
         os: process.platform,
         nodeVersion: process.version,
@@ -23,7 +27,7 @@ function trackEvent(command, args) {
         timestamp: new Date().toISOString(),
     };
     // Fire and forget - don't await, don't catch visible errors
-    fetch(`${BASE_URL}/cli/events`, {
+    fetch(`${getAnalyticsBaseUrl()}/cli/events`, {
         method: "POST",
         headers: {
             Authorization: `Bearer ${apiKey}`,

package/dist/api.d.ts

@@ -13,6 +13,7 @@ export interface SearchResponse {
             price?: number;
             hasDynamicPricing?: boolean;
             pricing_formula?: string;
+            apiSlug?: string;
         }>;
     }>;
     count: number;
@@ -139,6 +140,7 @@ export interface ApiBySlugResponse {
             required: boolean;
             description?: string;
         }>;
+        apiSlug?: string;
     }>;
     count: number;
 }

package/dist/commands/api.js

@@ -7,6 +7,7 @@ exports.apiCommand = apiCommand;
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const api_js_1 = require("../api.js");
+const utils_js_1 = require("../utils.js");
 async function apiCommand(slug, path, options) {
     const spinner = (0, ora_1.default)("Loading...").start();
     try {
@@ -162,7 +163,14 @@ async function apiCommand(slug, path, options) {
                                 ? chalk_1.default.dim(ep)
                                 : chalk_1.default.dim(`$${parseFloat(Number(ep).toFixed(4))}`);
                     })();
-                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}`);
+                // Group members commonly collide on the same upstream path (e.g.
+                // AbstractAPI's many products all expose "/v1") — when the endpoint's
+                // own callable slug differs from the card's flat slug, show it so the
+                // right identifier is obvious before calling `orth run`.
+                const memberTag = endpoint.apiSlug && endpoint.apiSlug !== api.slug
+                    ? chalk_1.default.dim(`  [${(0, utils_js_1.sanitizeForTerminal)(endpoint.apiSlug)}]`)
+                    : "";
+                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}${memberTag}`);
                 if (endpoint.description) {
                     console.log(chalk_1.default.gray(`       ${endpoint.description.slice(0, 80)}${endpoint.description.length > 80 ? "..." : ""}`));
                 }
@@ -195,7 +203,10 @@ async function apiCommand(slug, path, options) {
                                 ? chalk_1.default.dim(ep2)
                                 : chalk_1.default.dim(`$${parseFloat(Number(ep2).toFixed(4))}`);
                     })();
-                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}`);
+                const memberTag = endpoint.apiSlug && endpoint.apiSlug !== api.slug
+                    ? chalk_1.default.dim(`  [${(0, utils_js_1.sanitizeForTerminal)(endpoint.apiSlug)}]`)
+                    : "";
+                console.log(`${method} ${chalk_1.default.white(endpoint.path)} ${price}${memberTag}`);
                 if (endpoint.description) {
                     console.log(chalk_1.default.gray(`       ${endpoint.description.slice(0, 80)}${endpoint.description.length > 80 ? "..." : ""}`));
                 }

package/dist/commands/search.d.ts

@@ -1,3 +1,4 @@
+import { SearchResponse } from "../api.js";
 export declare function searchCommand(query: string, options: {
     limit: string;
-}): Promise<void>;
+}): Promise<SearchResponse>;

package/dist/commands/search.js

@@ -7,6 +7,7 @@ exports.searchCommand = searchCommand;
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const api_js_1 = require("../api.js");
+const utils_js_1 = require("../utils.js");
 async function searchCommand(query, options) {
     const spinner = (0, ora_1.default)("Searching APIs...").start();
     try {
@@ -14,16 +15,24 @@ async function searchCommand(query, options) {
         spinner.stop();
         if (!data.results || data.results.length === 0) {
             console.log(chalk_1.default.yellow("No APIs found matching your query."));
-            return;
+            return data;
         }
         console.log(chalk_1.default.bold(`\nFound ${data.apisCount} APIs with ${data.count} matching endpoints:\n`));
         for (const api of data.results) {
             console.log(chalk_1.default.cyan.bold(`${api.name}`) + chalk_1.default.gray(` (${api.slug})`));
             for (const endpoint of api.endpoints.slice(0, 3)) {
                 const method = endpoint.method.padEnd(6);
+                // Group members commonly collide on the same upstream path (e.g.
+                // AbstractAPI's many products all expose "/v1") — when the endpoint's
+                // own callable slug differs from the card's flat slug, show it so the
+                // right identifier is obvious before calling `orth run`.
+                const memberTag = endpoint.apiSlug && endpoint.apiSlug !== api.slug
+                    ? chalk_1.default.dim(`  [${(0, utils_js_1.sanitizeForTerminal)(endpoint.apiSlug)}]`)
+                    : "";
                 console.log(chalk_1.default.gray("  ") +
                     chalk_1.default.yellow(method) +
-                    chalk_1.default.white(endpoint.path));
+                    chalk_1.default.white(endpoint.path) +
+                    memberTag);
                 if (endpoint.description) {
                     console.log(chalk_1.default.gray(`       ${endpoint.description.slice(0, 80)}${endpoint.description.length > 80 ? "..." : ""}`));
                 }
@@ -35,10 +44,10 @@ async function searchCommand(query, options) {
         }
         console.log(chalk_1.default.gray(`Run 'orth api <slug>' to see all endpoints for an API`));
         console.log(chalk_1.default.gray(`Run 'orth run <api> <path>' to call an endpoint`));
+        return data;
     }
     catch (error) {
         spinner.stop();
-        console.error(chalk_1.default.red(`Error: ${error instanceof Error ? error.message : "Unknown error"}`));
-        process.exit(1);
+        throw error;
     }
 }

package/dist/commands/skills.d.ts

@@ -1,3 +1,29 @@
+interface SkillResponse {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+    sourceType: "github" | "upload";
+    githubOwner?: string;
+    githubRepo?: string;
+    githubPath?: string;
+    githubRef?: string;
+    discoverable: boolean;
+    verified: boolean;
+    installCount: number;
+    tags?: string[];
+    installCommand?: string;
+    githubUrl?: string;
+    files?: {
+        filePath: string;
+        content: string;
+        isPrimary: boolean;
+    }[];
+}
+interface SkillSearchResponse {
+    results: SkillResponse[];
+    count: number;
+}
 export declare function skillsListCommand(options: {
     limit: string;
 }): Promise<void>;
@@ -6,7 +32,7 @@ export declare function skillsMineCommand(options: {
 }): Promise<void>;
 export declare function skillsSearchCommand(query: string, options: {
     limit: string;
-}): Promise<void>;
+}): Promise<SkillSearchResponse>;
 export declare function skillsShowCommand(slug: string): Promise<void>;
 export declare function skillsCreateCommand(githubRepo: string, options: {
     path?: string;
@@ -37,3 +63,4 @@ export declare function skillsPublishCommand(slug: string, options: {
     unpublish?: boolean;
 }): Promise<void>;
 export declare function skillsRequestCommand(input: string): Promise<void>;
+export {};

package/dist/commands/skills.js

@@ -150,7 +150,7 @@ async function skillsSearchCommand(query, options) {
         spinner.stop();
         if (!data.results || data.results.length === 0) {
             console.log(chalk_1.default.yellow("No skills found matching your query."));
-            return;
+            return data;
         }
         console.log(chalk_1.default.bold(`\nFound ${data.count} skills:\n`));
         for (const skill of data.results) {
@@ -164,11 +164,11 @@ async function skillsSearchCommand(query, options) {
             console.log();
         }
         console.log(chalk_1.default.gray("Run 'orth skills show <slug>' for full details"));
+        return data;
     }
     catch (error) {
         spinner.stop();
-        console.error(chalk_1.default.red(`Error: ${error instanceof Error ? error.message : "Unknown error"}`));
-        process.exit(1);
+        throw error;
     }
 }
 // ─────────────────────────────────────────────────────────────────────────────

package/dist/index.js

@@ -13,17 +13,31 @@ const apiRequest_js_1 = require("./commands/apiRequest.js");
 const analytics_js_1 = require("./analytics.js");
 /**
  * Wraps an async action callback so that rejected promises are caught,
- * logged, and cause the process to exit with code 1.  Without this,
+ * logged, and set the process exit code to 1. Without this,
  * Commander.js silently swallows unhandled rejections from async actions.
  */
 function asyncAction(fn) {
     return (...args) => {
         fn(...args).catch((err) => {
             console.error(err instanceof Error ? err.message : "Unknown error");
-            process.exit(1);
+            // Avoid a hard exit so fire-and-forget failure analytics can flush.
+            process.exitCode = 1;
         });
     };
 }
+async function runTrackedSearch(command, query, operation) {
+    try {
+        const response = await operation();
+        (0, analytics_js_1.trackEvent)(command, { query }, response);
+    }
+    catch (error) {
+        (0, analytics_js_1.trackEvent)(command, { query }, {
+            success: false,
+            error: error instanceof Error ? error.message : "Unknown error",
+        });
+        throw error;
+    }
+}
 const program = new commander_1.Command();
 program
     .name("orth")
@@ -99,8 +113,7 @@ apiGroup
     .description("Search for APIs using natural language")
     .option("-l, --limit <number>", "Max results", "10")
     .action(asyncAction(async (query, options) => {
-    (0, analytics_js_1.trackEvent)("api.search", { query });
-    await (0, search_js_1.searchCommand)(query, options);
+    await runTrackedSearch("api.search", query, () => (0, search_js_1.searchCommand)(query, options));
 }));
 apiGroup
     .command("run <slug> <path>")
@@ -159,8 +172,7 @@ skillsGroup
     .description("Search for agent skills")
     .option("-l, --limit <number>", "Max results", "20")
     .action(asyncAction(async (query, options) => {
-    (0, analytics_js_1.trackEvent)("skills.search", { query });
-    await (0, skills_js_1.skillsSearchCommand)(query, options);
+    await runTrackedSearch("skills.search", query, () => (0, skills_js_1.skillsSearchCommand)(query, options));
 }));
 skillsGroup
     .command("show <slug>")
@@ -254,8 +266,7 @@ program
     .description("Search for APIs (alias for 'orth api search')")
     .option("-l, --limit <number>", "Max results", "10")
     .action(asyncAction(async (query, options) => {
-    (0, analytics_js_1.trackEvent)("search", { query });
-    await (0, search_js_1.searchCommand)(query, options);
+    await runTrackedSearch("search", query, () => (0, search_js_1.searchCommand)(query, options));
 }));
 program
     .command("run <api> <path>")

package/dist/utils.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeForTerminal(value: string): string;

package/dist/utils.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeForTerminal = sanitizeForTerminal;
+// Strips ASCII control characters (including ESC, 0x1B) from a string before
+// it's written to the terminal. Needed for any remotely-sourced value we
+// render directly (e.g. apiSlug, which an API owner sets) — without this, a
+// crafted value containing terminal escape sequences could manipulate another
+// user's terminal (spoofed output, hidden/cleared text, deceptive hyperlinks).
+function sanitizeForTerminal(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\x00-\x1F\x7F]/g, "");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orth/cli",
-  "version": "0.2.33",
+  "version": "0.3.0",
   "description": "CLI to access all APIs and skills on the Orthogonal platform",
   "main": "dist/index.js",
   "bin": {