clishop 1.5.9 → 1.5.11

package/README.md

@@ -98,7 +98,7 @@ clishop setup start --email user@example.com --json
 
 `setup start` returns immediately with account-ready status and stores auth locally.
 
-In OpenClaw, prefer the installed CLISHOP MCP tools over CLI shell commands. For address management, the intended flow is to call `list_addresses` first, then `add_address` non-interactively with any known fields, and ask the user only for missing required address fields (`label`, `firstName`, `lastName`, `line1`, `city`, `postalCode`, `country`).
+In OpenClaw, prefer the installed CLISHOP MCP tools over CLI shell commands. For address management, the intended flow is to call `list_addresses` first, then `add_address` non-interactively with any known fields, and ask the user only for missing required address fields (`label`, `firstName`, `lastName`, `line1`, `city`, `postalCode`, `country`). For payments, use `add_payment_method` to generate a secure setup link for the human, then check `list_payment_methods` after the human completes the web flow. The agent should never ask for raw card details in chat.
 
 - Search products right away with `clishop search <query>`
 - Add a shipping address later with `clishop address add`

package/dist/index.js

@@ -1114,8 +1114,8 @@ async function runSetupWizard(emailArg, { json = false } = {}) {
   console.log();
   console.log(chalk4.bold.cyan("      W E L C O M E   T O   C L I S H O P"));
   console.log(chalk4.dim("      Order anything from your terminal."));
-  console.log(chalk4.dim(`      npm:   v${"1.5.9"}`));
-  console.log(chalk4.dim(`      Build: ${"2026-04-06T11:34:30.345Z"}`));
+  console.log(chalk4.dim(`      npm:   v${"1.5.11"}`));
+  console.log(chalk4.dim(`      Build: ${"2026-04-06T12:16:41.297Z"}`));
   console.log();
   divider(chalk4.cyan);
   console.log();
@@ -4261,7 +4261,7 @@ function registerDoctorCommand(program2) {
 
 // src/index.ts
 var program = new Command();
-program.name("clishop").version("1.5.9").description(
+program.name("clishop").version("1.5.11").description(
   chalk16.bold("CLISHOP") + ` \u2014 Order anything from your terminal.
 
   Run 'clishop setup <email>' or 'clishop setup start --email <email> --json' to create your account.

package/dist/mcp.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   claimSetupSession,
+  ensureAgentOnBackend,
   getApiClient,
   getSetupStatus,
   getUserInfo,
@@ -13815,7 +13816,7 @@ function safeCall(fn) {
 var server = new McpServer(
   {
     name: "clishop",
-    version: "1.5.9"
+    version: "1.5.11"
   },
   {
     capabilities: {
@@ -13999,7 +14000,7 @@ server.registerTool("buy_product", {
       throw new Error("No shipping address set. Add one first via the add_address tool.");
     }
     if (!paymentId) {
-      throw new Error("No payment method linked. Add one with the payment method tools before placing the order.");
+      throw new Error("No payment method linked. Use the add_payment_method tool to generate a secure human payment-setup link, then list_payment_methods after the human completes setup.");
     }
     const api = getApiClient();
     let product;
@@ -14212,6 +14213,41 @@ server.registerTool("remove_address", {
     return { success: true, message: "Address removed." };
   });
 });
+server.registerTool("add_payment_method", {
+  title: "Add Payment Method",
+  description: "Generate a secure payment-setup link for the active agent. Give this URL to the human so they can add a payment method in the web portal. The agent never handles raw card details.",
+  inputSchema: {
+    agent: external_exports.string().optional().describe("Agent name (defaults to active agent)")
+  },
+  annotations: {
+    title: "Add Payment Method",
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true
+  }
+}, async (args) => {
+  return safeCall(async () => {
+    const activeAgent = getActiveAgent();
+    const agentName = args.agent || activeAgent.name;
+    await ensureAgentOnBackend(agentName);
+    const api = getApiClient();
+    const res = await api.post("/payment-methods/setup", {
+      agent: agentName
+    });
+    const setupUrl = res.data?.setupUrl;
+    if (!setupUrl) {
+      throw new Error("Payment setup link was not returned by the backend.");
+    }
+    return {
+      ok: true,
+      agent: agentName,
+      setupUrl,
+      next_action: "open_setup_url",
+      human_message: "Give this secure link to the human so they can add their payment method. CLISHOP never collects raw card details inside the agent."
+    };
+  });
+});
 server.registerTool("list_payment_methods", {
   title: "List Payment Methods",
   description: "List saved payment methods for the active agent.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clishop",
   "displayName": "CLISHOP",
-  "version": "1.5.9",
+  "version": "1.5.11",
   "mcpName": "io.github.StefDCL/clishop",
   "description": "CLISHOP — Order anything from your terminal",
   "main": "dist/index.js",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/DavooxBv2/CLISHOP",
     "source": "github"
   },
-  "version": "1.5.9",
+  "version": "1.5.11",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "clishop",
-      "version": "1.5.9",
+      "version": "1.5.11",
       "runtime": "node",
       "args": ["--mcp"],
       "transport": {

package/skills/clishop/SKILL.md

@@ -34,9 +34,10 @@ node ./dist/mcp.js       # From the installed package directory
 
 When CLISHOP is installed in OpenClaw, prefer the MCP tools exposed by the CLISHOP server instead of shell commands.
 
-- OpenClaw commonly exposes these tools with a `clishop__<tool_name>` naming pattern, for example `clishop__list_addresses`, `clishop__add_address`, `clishop__set_default_address`, `clishop__list_payment_methods`, and `clishop__buy_product`.
+- OpenClaw commonly exposes these tools with a `clishop__<tool_name>` naming pattern, for example `clishop__list_addresses`, `clishop__add_address`, `clishop__set_default_address`, `clishop__add_payment_method`, `clishop__list_payment_methods`, and `clishop__buy_product`.
 - If those MCP tools are available, do not fall back to `clishop address add` or other CLI subcommands.
 - If a user asks to add a home or shipping address and the address is already known from memory or prior conversation context, call the address tool directly and only ask for missing required fields.
+- If a user asks to add a payment method, call `clishop__add_payment_method` or `add_payment_method` to generate a secure setup link for the human. Do not ask the user to paste card details into chat.
 
 ### Non-interactive address flow
 
@@ -46,6 +47,16 @@ When CLISHOP is installed in OpenClaw, prefer the MCP tools exposed by the CLISH
 4. Ask the user only for any missing required fields.
 5. Prefer `setDefault: true` when adding the main home address.
 
+### Payment method flow
+
+1. Call `clishop__list_payment_methods` or `list_payment_methods` first to see whether a payment method already exists.
+2. If none exists, call `clishop__add_payment_method` or `add_payment_method`.
+3. Give the returned `setupUrl` to the human and tell them to complete payment setup in the secure web portal.
+4. After the human confirms completion, call `clishop__list_payment_methods` again.
+5. If needed, call `clishop__set_default_payment_method` or `set_default_payment_method` with the chosen payment method ID.
+
+The agent must never collect raw card details in chat. The secure web flow is the supported path.
+
 Required fields for `add_address`:
 
 - `label`
@@ -67,6 +78,24 @@ Optional fields:
 - `instructions`
 - `setDefault`
 
+Example `add_address` payload for a US home address in San Francisco:
+
+```json
+{
+	"label": "Home",
+	"firstName": "Alex",
+	"lastName": "Johnson",
+	"line1": "1234 Hayes Street",
+	"city": "San Francisco",
+	"region": "CA",
+	"postalCode": "94117",
+	"country": "United States",
+	"phone": "+14155550123",
+	"instructions": "Leave at front door",
+	"setDefault": true
+}
+```
+
 ## Tools
 
 | Tool | Description | Read-only |
@@ -84,6 +113,7 @@ Optional fields:
 | `remove_address` | Remove a saved address | ❌ |
 | `set_default_address` | Set the default shipping address for the active agent | ❌ |
 | `list_payment_methods` | List saved payment methods | ✅ |
+| `add_payment_method` | Generate a secure payment-setup link for the human | ❌ |
 | `remove_payment_method` | Remove a saved payment method | ❌ |
 | `set_default_payment_method` | Set the default payment method for the active agent | ❌ |
 | `list_stores` | Browse available stores | ✅ |