promptdock 1.2.0 → 1.2.1

package/dist/verdicts.js

@@ -1,7 +1,11 @@
 import { CliError, EXIT } from "./errors.js";
+import { SERVER_LABEL_MAX, terminalLine } from "./terminal-text.js";
 import { retryHours } from "./ui.js";
-import { CANONICAL_INSTALL_COMMAND, CLI_DOS_MAX_SKILL_FILES, CLI_DOS_MAX_SKILL_TOTAL_BYTES, } from "./generated/constants.js";
-export const UPGRADE_URL = "https://promptdock.ai/pricing";
+import { CANONICAL_INSTALL_COMMAND, CANONICAL_ORIGIN, CLI_DOS_MAX_SKILL_FILES, CLI_DOS_MAX_SKILL_TOTAL_BYTES, } from "./generated/constants.js";
+/** ⚠️ DERIVED from `CANONICAL_ORIGIN`. This is the CTA a user follows the moment the CLI
+ *  tells them their plan is too low — the one link most likely to be clicked under
+ *  friction, so it must not spend a redirect hop. */
+export const UPGRADE_URL = `${CANONICAL_ORIGIN}/pricing`;
 /** Numeric semver compare; mirrors compareCliVersions in lib/validation/skills.ts. */
 function cmpVersion(a, b) {
     const pa = a.split(".").map((n) => Number(n) || 0);
@@ -23,12 +27,21 @@ function cmpVersion(a, b) {
  * `assertSafeManifest` stays as the untrusted-server backstop — this check makes it
  * unreachable in practice, never redundant.
  */
-function assertPackageCompatible(resolve, cliVersion) {
-    const upgrade = `Update: ${CANONICAL_INSTALL_COMMAND} …  (or: npm i -g promptdock@latest)`;
-    const title = resolve.title ? `"${resolve.title}"` : "This skill";
+function assertPackageCompatible(resolve, refString, cliVersion) {
+    // The ref is threaded in for ONE reason: this hint is the whole remedy, and a
+    // remedy is only a remedy if it can be pasted. The old copy ended in a literal
+    // "…" — three characters that look like a command and are not one, printed at
+    // exactly the moment the user is stuck and least able to guess the rest.
+    const upgrade = `Update: ${CANONICAL_INSTALL_COMMAND} ${refString}  (or: npm i -g promptdock@latest)`;
+    // ⚠️ The CliError constructor already strips control characters from these. What it
+    // deliberately does NOT do is bound them: `terminalBlock` keeps newlines and applies
+    // no cap, so a hostile title could still forge a second line or run to a megabyte.
+    // The fragment treatment is what makes the message BOUNDED.
+    const safeTitle = terminalLine(resolve.title, SERVER_LABEL_MAX);
+    const title = safeTitle ? `"${safeTitle}"` : "This skill";
     const min = resolve.min_cli_version;
     if (typeof min === "string" && min.length > 0 && cmpVersion(cliVersion, min) < 0) {
-        throw new CliError(`${title} needs promptdock CLI ${min} or newer — you are on ${cliVersion}.`, EXIT.DENIED, { footer: "upgrade_required", hint: upgrade });
+        throw new CliError(`${title} needs promptdock CLI ${terminalLine(min, SERVER_LABEL_MAX)} or newer — you are on ${cliVersion}.`, EXIT.DENIED, { footer: "upgrade_required", hint: upgrade });
     }
     // Belt and braces for a server too old to send min_cli_version: compare the shape
     // the resolve response already reports against this CLI's own fuses.
@@ -47,14 +60,17 @@ export function assertInstallable(resolve, refString, cliVersion) {
     switch (resolve.verdict) {
         case "ok":
         case "already_entitled":
-            assertPackageCompatible(resolve, cliVersion);
+            assertPackageCompatible(resolve, refString, cliVersion);
             return;
         case "not_found":
             throw new CliError(`skill not found: ${refString} — check the ref (the format is handle/slug; a pasted promptdock.ai skill URL also works)`, EXIT.DENIED, { footer: "not_found" });
         case "insufficient_tier": {
-            const title = resolve.title ? `"${resolve.title}"` : "This skill";
+            const safe = terminalLine(resolve.title, SERVER_LABEL_MAX);
+            const title = safe ? `"${safe}"` : "This skill";
             throw new CliError(`${title} is a premium skill. Premium skills need the Explorer plan ($10/mo) or higher` +
-                (resolve.current ? ` — your account is on the ${resolve.current} tier.` : "."), EXIT.DENIED, { footer: "insufficient_tier", hint: `Upgrade: ${UPGRADE_URL}` });
+                (resolve.current
+                    ? ` — your account is on the ${terminalLine(resolve.current, SERVER_LABEL_MAX)} tier.`
+                    : "."), EXIT.DENIED, { footer: "insufficient_tier", hint: `Upgrade: ${UPGRADE_URL}` });
         }
         case "cap_hit": {
             const wait = retryHours(Number(resolve.retry_after_secs) || 3600);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptdock",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Install AI agent skills from PromptDock — npx promptdock@latest install <handle>/<slug>",
   "keywords": [
     "promptdock",
@@ -10,14 +10,15 @@
     "claude",
     "cli"
   ],
-  "homepage": "https://promptdock.ai",
+  "homepage": "https://www.promptdock.ai",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/klicklabs/promptdock.ai.git",
     "directory": "packages/cli"
   },
   "bugs": {
-    "url": "https://promptdock.ai/docs/cli/errors"
+    "url": "https://www.promptdock.ai/docs/cli/errors",
+    "email": "support@promptdock.ai"
   },
   "license": "MIT",
   "type": "module",
@@ -42,5 +43,5 @@
     "typescript": "^5",
     "vitest": "^4.1.8"
   },
-  "gitHead": "53545d74fc0baeec63684c96b49134e93625d63a"
+  "gitHead": "46e6b02fe045e9b803f748b32b9443995a40b1ac"
 }