@papercraneai/cli 1.9.0 → 1.9.1-beta.1

package/lib/dev-server.js

@@ -335,7 +335,18 @@ export async function generateScaffolding(workspaceDir, { npmInstall = false, ke
   // NOTE: next is pinned to 16.1.7 in package.json. Next.js 16.2.0 introduced
   // a cross-origin HMR block that breaks webpack-hmr over Daytona proxy domains.
   // To upgrade past 16.1.7, add allowedDevOrigins: ['*.daytonaproxy01.net'] to
-  // the config below.
+  // the config below. A bare '*' does NOT work — Next's allowedDevOrigins only
+  // supports exact hosts or subdomain patterns like '*.domain.com' (see
+  // https://github.com/vercel/next.js/discussions/76999), so a true catch-all
+  // is not available and each preview domain must be enumerated.
+  //
+  // Security caveat for staying on 16.1.7: GHSA-q4gf-8mx6-v5v3 (CVE-2026-23869,
+  // CVSS 7.5) is a DoS in App Router Server Function deserialization that
+  // affects all 16.x < 16.2.3. The 16.1.x branch was NOT backported — only
+  // 15.5.15 and 16.2.3 are patched. Any unauthenticated POST to a Server
+  // Function endpoint can pin a worker's CPU. Acceptable for sandboxed dev
+  // environments behind Daytona proxy auth, but revisit before exposing
+  // dashboards on an untrusted network.
   const nextConfig = `/** @type {import('next').NextConfig} */
 const nextConfig = {
   transpilePackages: ['@papercraneai/cli', '@papercrane/dashboard-grid'],

package/lib/resolver.js

@@ -307,6 +307,28 @@ export async function resolve(node, path, ctx, params, method, inheritedScopes)
     return { ok: true, result };
   } catch (err) {
     const upstreamError = err.response?.data || err.response?.body;
+
+    // Google Ads API errors come as { errors: [{ message, error_code, location }], request_id }
+    if (err.errors?.length) {
+      const details = err.errors.map((e) => {
+        const fieldPath = e.location?.field_path_elements
+          ?.map((f) => f.field_name + (f.index != null ? `[${f.index}]` : ''))
+          .join('.');
+        return {
+          message: e.message || 'Unknown error',
+          error_code: e.error_code,
+          field: fieldPath || undefined,
+        };
+      });
+      return {
+        ok: false,
+        error: details.map((d) => d.field ? `${d.message} (field: ${d.field})` : d.message).join('; '),
+        details,
+        request_id: err.request_id,
+        status: 400,
+      };
+    }
+
     return {
       ok: false,
       error: upstreamError || (err instanceof Error ? err.message : 'Unknown error occurred'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papercraneai/cli",
-  "version": "1.9.0",
+  "version": "1.9.1-beta.1",
   "description": "CLI tool for managing OAuth credentials for LLM integrations",
   "main": "index.js",
   "type": "module",
@@ -75,7 +75,6 @@
     "https-proxy-agent": "^7.0.4",
     "input-otp": "^1.4.2",
     "jiti": "^2.4.2",
-    "inquirer": "^8.2.6",
     "lucide-react": "^0.559.0",
     "next": "16.1.7",
     "next-themes": "^0.4.6",