fullstackgtm 0.52.0 → 0.52.1

package/CHANGELOG.md

@@ -7,6 +7,18 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullst
 
 ## [Unreleased]
 
+## [0.52.1] — 2026-07-11
+
+### Fixed
+
+- OpenRouter 401/403 failures now name `fullstackgtm login openrouter` as the
+  credential replacement path and explain that `OPENROUTER_API_KEY` overrides
+  the stored profile key.
+- Interactive secret prompts remain non-echoing but now confirm paste activity
+  with a masked glyph preview and received-character count.
+- Interactive ICP review cards cap their width, wrap long segment values, and
+  repaint only their own terminal rows instead of clearing the whole screen.
+
 ## [0.52.0] — 2026-07-11
 
 ### Added

package/dist/cli/icp.js

@@ -10,7 +10,7 @@ import { createFileJudgeStore, DEFAULT_JUDGE_PROMPT, judgeRunId, judgeSignals }
 import { DEFAULT_GOLDEN_NOW_ISO, DEFAULT_GOLDEN_SET, DEFAULT_MIN_ACCURACY, defaultJudgeFn, gradeAgainstOutcomes, gradeJudge, parseGoldenSet } from "../judgeEval.js";
 import { loadIcp, numericOption, option, readSecret, readSnapshot, resolveLlmBaseUrls, saveRequested } from "./shared.js";
 import { createStatusLine } from "./ui.js";
-import { box, colorEnabled, paint } from "./ui.js";
+import { box, colorEnabled, paint, truncateToWidth } from "./ui.js";
 import { getCredential, storeCredential } from "../credentials.js";
 import { deriveWebsiteIcp, icpReviewSegments, OPENROUTER_API_BASE } from "../icpDerive.js";
 import { unknownSubcommandError } from "./suggest.js";
@@ -43,11 +43,30 @@ function updateReviewSegment(icp, id, raw) {
 function renderDerivedIcp(result, selected = -1) {
     const p = paint(colorEnabled());
     const segments = icpReviewSegments(result.icp);
+    const contentWidth = Math.min(88, Math.max(64, (process.stdout.columns ?? 92) - 4));
+    const valueWidth = contentWidth - 18;
+    const segmentLines = segments.flatMap((segment, index) => {
+        const words = segment.value.split(/\s+/);
+        const wrapped = [];
+        let line = "";
+        for (const word of words) {
+            if (!line || line.length + word.length + 1 <= valueWidth)
+                line += `${line ? " " : ""}${word}`;
+            else {
+                wrapped.push(line);
+                line = word;
+            }
+        }
+        if (line)
+            wrapped.push(line);
+        const prefix = `${index === selected ? "›" : " "} ${segment.label.padEnd(15)} `;
+        return (wrapped.length ? wrapped : ["—"]).map((value, lineIndex) => `${lineIndex === 0 ? prefix : " ".repeat(18)}${truncateToWidth(value, valueWidth)}`);
+    });
     const lines = [
-        `${result.company.name}  ${result.company.domain}`,
+        truncateToWidth(`${result.company.name}  ${result.company.domain}`, contentWidth),
         `${Math.round(result.confidence * 100)}% confidence · ${result.derivation.model}`,
         "",
-        ...segments.map((segment, index) => `${index === selected ? "›" : " "} ${segment.label.padEnd(15)} ${segment.value}`),
+        ...segmentLines,
         "",
         selected >= 0 ? "↑/↓ select · enter edit · s save · q cancel" : `${result.evidence.length} website-verifiable evidence quote(s)`,
     ];
@@ -98,7 +117,14 @@ async function reviewDerivedIcp(result) {
         return result;
     let current = result;
     let selected = 0;
-    const render = () => process.stdout.write(`\u001b[2J\u001b[H${renderDerivedIcp(current, selected)}\n`);
+    let paintedLines = 0;
+    const render = (promptLines = 0) => {
+        const output = renderDerivedIcp(current, selected);
+        if (paintedLines > 0)
+            process.stdout.write(`\u001b[${paintedLines + promptLines}A\r\u001b[0J`);
+        process.stdout.write(`${output}\n`);
+        paintedLines = output.split("\n").length;
+    };
     emitKeypressEvents(process.stdin);
     process.stdin.setRawMode?.(true);
     process.stdin.resume();
@@ -137,7 +163,7 @@ async function reviewDerivedIcp(result) {
             emitKeypressEvents(process.stdin);
             process.stdin.setRawMode?.(true);
             process.stdin.on("keypress", onKey);
-            render();
+            render(2);
         };
         process.stdin.on("keypress", onKey);
     });

package/dist/cli/shared.js

@@ -305,6 +305,7 @@ export async function readSecret(label) {
     }
     const readline = await import("node:readline");
     return new Promise((resolveSecret) => {
+        process.stderr.write("Paste once, then press Enter. Input is masked.\n");
         const rl = readline.createInterface({
             input: process.stdin,
             output: process.stderr,
@@ -312,9 +313,21 @@ export async function readSecret(label) {
         });
         let muted = false;
         const mutable = rl;
+        let renderQueued = false;
         mutable._writeToOutput = (value) => {
-            if (!muted)
+            if (!muted) {
                 process.stderr.write(value);
+                return;
+            }
+            if (renderQueued)
+                return;
+            renderQueued = true;
+            queueMicrotask(() => {
+                renderQueued = false;
+                const length = mutable.line?.length ?? 0;
+                const mask = `${"•".repeat(Math.min(length, 12))}${length > 12 ? "…" : ""}`;
+                process.stderr.write(`\r\u001b[2K${label}: ${mask} (${length} character${length === 1 ? "" : "s"} received)`);
+            });
         };
         rl.question(`${label}: `, (answer) => {
             rl.close();

package/dist/llm.js

@@ -343,7 +343,7 @@ async function streamOpenAiToolCall(fetchImpl, url, body, options) {
         throw new Error(`Cannot reach ${new URL(url).hostname}${cause}. Check network access.`);
     }
     if (!response.ok)
-        throw new Error(`LLM API error ${response.status} ${response.statusText} from ${new URL(url).hostname}. Check the API key and model name.`);
+        throw llmApiError(response, url);
     if (!response.body)
         throw new Error("LLM API returned no streaming response body.");
     const reader = response.body.getReader();
@@ -407,10 +407,21 @@ async function llmFetch(fetchImpl, url, init) {
     }
     if (!response.ok) {
         // Status line only — provider error bodies can reflect request content.
-        throw new Error(`LLM API error ${response.status} ${response.statusText} from ${new URL(url).hostname}. Check the API key (\`fullstackgtm login anthropic|openai\`) and model name.`);
+        throw llmApiError(response, url);
     }
     return response.json();
 }
+function llmApiError(response, url) {
+    const host = new URL(url).hostname;
+    const prefix = `LLM API error ${response.status} ${response.statusText} from ${host}.`;
+    if ((response.status === 401 || response.status === 403) && host === "openrouter.ai") {
+        return new Error(`${prefix} Replace the saved key with \`fullstackgtm login openrouter\`. If OPENROUTER_API_KEY is set, update or unset it first because environment credentials override saved login.`);
+    }
+    if (response.status === 401 || response.status === 403) {
+        return new Error(`${prefix} Replace the API key with \`fullstackgtm login anthropic|openai\` (choose one provider), then retry.`);
+    }
+    return new Error(`${prefix} Check the model name, provider availability, and account limits.`);
+}
 function truncateTranscript(transcript) {
     if (transcript.length <= MAX_TRANSCRIPT_CHARS)
         return transcript;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.52.0",
+  "version": "0.52.1",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",

package/src/cli/icp.ts

@@ -11,7 +11,7 @@ import { createFileJudgeStore, DEFAULT_JUDGE_PROMPT, judgeRunId, judgeSignals }
 import { DEFAULT_GOLDEN_NOW_ISO, DEFAULT_GOLDEN_SET, DEFAULT_MIN_ACCURACY, defaultJudgeFn, gradeAgainstOutcomes, gradeJudge, parseGoldenSet } from "../judgeEval.ts";
 import { loadIcp, numericOption, option, readSecret, readSnapshot, resolveLlmBaseUrls, saveRequested } from "./shared.ts";
 import { createStatusLine } from "./ui.ts";
-import { box, colorEnabled, paint } from "./ui.ts";
+import { box, colorEnabled, paint, truncateToWidth } from "./ui.ts";
 import { getCredential, storeCredential } from "../credentials.ts";
 import { deriveWebsiteIcp, icpReviewSegments, OPENROUTER_API_BASE, type WebsiteIcpDerivation } from "../icpDerive.ts";
 import type { Icp } from "../icp.ts";
@@ -44,11 +44,25 @@ function updateReviewSegment(icp: Icp, id: string, raw: string): Icp {
 function renderDerivedIcp(result: WebsiteIcpDerivation, selected = -1): string {
   const p = paint(colorEnabled());
   const segments = icpReviewSegments(result.icp);
+  const contentWidth = Math.min(88, Math.max(64, (process.stdout.columns ?? 92) - 4));
+  const valueWidth = contentWidth - 18;
+  const segmentLines = segments.flatMap((segment, index) => {
+    const words = segment.value.split(/\s+/);
+    const wrapped: string[] = [];
+    let line = "";
+    for (const word of words) {
+      if (!line || line.length + word.length + 1 <= valueWidth) line += `${line ? " " : ""}${word}`;
+      else { wrapped.push(line); line = word; }
+    }
+    if (line) wrapped.push(line);
+    const prefix = `${index === selected ? "›" : " "} ${segment.label.padEnd(15)} `;
+    return (wrapped.length ? wrapped : ["—"]).map((value, lineIndex) => `${lineIndex === 0 ? prefix : " ".repeat(18)}${truncateToWidth(value, valueWidth)}`);
+  });
   const lines = [
-    `${result.company.name}  ${result.company.domain}`,
+    truncateToWidth(`${result.company.name}  ${result.company.domain}`, contentWidth),
     `${Math.round(result.confidence * 100)}% confidence · ${result.derivation.model}`,
     "",
-    ...segments.map((segment, index) => `${index === selected ? "›" : " "} ${segment.label.padEnd(15)} ${segment.value}`),
+    ...segmentLines,
     "",
     selected >= 0 ? "↑/↓ select · enter edit · s save · q cancel" : `${result.evidence.length} website-verifiable evidence quote(s)`,
   ];
@@ -98,7 +112,13 @@ async function reviewDerivedIcp(result: WebsiteIcpDerivation): Promise<WebsiteIc
   if (!process.stdin.isTTY || !process.stdout.isTTY) return result;
   let current = result;
   let selected = 0;
-  const render = () => process.stdout.write(`\u001b[2J\u001b[H${renderDerivedIcp(current, selected)}\n`);
+  let paintedLines = 0;
+  const render = (promptLines = 0) => {
+    const output = renderDerivedIcp(current, selected);
+    if (paintedLines > 0) process.stdout.write(`\u001b[${paintedLines + promptLines}A\r\u001b[0J`);
+    process.stdout.write(`${output}\n`);
+    paintedLines = output.split("\n").length;
+  };
   emitKeypressEvents(process.stdin);
   process.stdin.setRawMode?.(true);
   process.stdin.resume();
@@ -127,7 +147,7 @@ async function reviewDerivedIcp(result: WebsiteIcpDerivation): Promise<WebsiteIc
       emitKeypressEvents(process.stdin);
       process.stdin.setRawMode?.(true);
       process.stdin.on("keypress", onKey);
-      render();
+      render(2);
     };
     process.stdin.on("keypress", onKey);
   });

package/src/cli/shared.ts

@@ -356,15 +356,25 @@ export async function readSecret(label: string): Promise<string> {
 
   const readline = await import("node:readline");
   return new Promise<string>((resolveSecret) => {
+    process.stderr.write("Paste once, then press Enter. Input is masked.\n");
     const rl = readline.createInterface({
       input: process.stdin,
       output: process.stderr,
       terminal: true,
     });
     let muted = false;
-    const mutable = rl as unknown as { _writeToOutput?: (value: string) => void };
+    const mutable = rl as unknown as { _writeToOutput?: (value: string) => void; line?: string };
+    let renderQueued = false;
     mutable._writeToOutput = (value: string) => {
-      if (!muted) process.stderr.write(value);
+      if (!muted) { process.stderr.write(value); return; }
+      if (renderQueued) return;
+      renderQueued = true;
+      queueMicrotask(() => {
+        renderQueued = false;
+        const length = mutable.line?.length ?? 0;
+        const mask = `${"•".repeat(Math.min(length, 12))}${length > 12 ? "…" : ""}`;
+        process.stderr.write(`\r\u001b[2K${label}: ${mask} (${length} character${length === 1 ? "" : "s"} received)`);
+      });
     };
     rl.question(`${label}: `, (answer) => {
       rl.close();

package/src/llm.ts

@@ -489,7 +489,7 @@ async function streamOpenAiToolCall(
     const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
     throw new Error(`Cannot reach ${new URL(url).hostname}${cause}. Check network access.`);
   }
-  if (!response.ok) throw new Error(`LLM API error ${response.status} ${response.statusText} from ${new URL(url).hostname}. Check the API key and model name.`);
+  if (!response.ok) throw llmApiError(response, url);
   if (!response.body) throw new Error("LLM API returned no streaming response body.");
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
@@ -539,11 +539,23 @@ async function llmFetch(fetchImpl: typeof fetch, url: string, init: RequestInit)
   }
   if (!response.ok) {
     // Status line only — provider error bodies can reflect request content.
-    throw new Error(`LLM API error ${response.status} ${response.statusText} from ${new URL(url).hostname}. Check the API key (\`fullstackgtm login anthropic|openai\`) and model name.`);
+    throw llmApiError(response, url);
   }
   return response.json();
 }
 
+function llmApiError(response: Response, url: string): Error {
+  const host = new URL(url).hostname;
+  const prefix = `LLM API error ${response.status} ${response.statusText} from ${host}.`;
+  if ((response.status === 401 || response.status === 403) && host === "openrouter.ai") {
+    return new Error(`${prefix} Replace the saved key with \`fullstackgtm login openrouter\`. If OPENROUTER_API_KEY is set, update or unset it first because environment credentials override saved login.`);
+  }
+  if (response.status === 401 || response.status === 403) {
+    return new Error(`${prefix} Replace the API key with \`fullstackgtm login anthropic|openai\` (choose one provider), then retry.`);
+  }
+  return new Error(`${prefix} Check the model name, provider availability, and account limits.`);
+}
+
 function truncateTranscript(transcript: string): string {
   if (transcript.length <= MAX_TRANSCRIPT_CHARS) return transcript;
   const half = MAX_TRANSCRIPT_CHARS / 2;