shopstack 0.2.2 → 0.2.4

package/README.md

@@ -63,12 +63,14 @@ Configure any stdio MCP client to run:
 
 The MCP server can start and poll verified signup, manage local profiles,
 create developer-owned users, list/connect Link, and create/poll/message/cancel
-checkouts. It exposes status, activity, and the latest bounded mechanical intent
-phase. It deliberately has no card-input or payment-approval tool.
+checkouts. Checkout creation returns the exact live-view URL as a clickable MCP
+resource; `get_live_view` replaces a lost one-time link for an active checkout.
+It exposes status, activity, and the latest bounded mechanical intent phase. It
+deliberately has no card-input or payment-approval tool.
 
 The canonical agent skill ships as `SKILL.md` in this package. After
 publication it is available at
-`https://unpkg.com/shopstack@0.2.2/SKILL.md` with the release-pinned package.
+`https://unpkg.com/shopstack@0.2.4/SKILL.md` with the release-pinned package.
 
 ## Connections
 
@@ -119,6 +121,13 @@ is view-only unless the model explicitly requests human assistance; while that
 request is active, one owner viewer can use **Take control** and **Return
 control**. **Stop** is always available and never approves payment.
 
+Treat the printed URL as opaque and open it exactly as returned, including its
+`#token=...` fragment. If that fragment is lost while the checkout is active,
+run `shopstack checkout view CHECKOUT_ID` to receive a replacement URL. The
+replacement disconnects an older viewer session but does not restart checkout.
+Omit `model_handle` to use the production GLM route. Set it to `qwen` only when
+you explicitly need the fixed Qwen comparison route.
+
 When no provider is selected, the checkout runs normally until the payment
 form, then asks for card details through a no-echo terminal prompt. Card data is
 sent only to the protected payment-details endpoint. The CLI separately shows

package/SKILL.md

@@ -131,11 +131,17 @@ The optional `live_view_url` is a private owner-viewer capability. Show it only
 to the initiating user. Do not store it in browser storage, analytics, logs,
 model context, or ordinary messages.
 
+Present `live_view_url` exactly as returned, including its fragment; never
+construct a viewer URL from the checkout ID. MCP returns it as a clickable
+resource link. If it is lost while the checkout is active, call
+`get_live_view` (or `shopstack checkout view CHECKOUT_ID`) once and present the
+replacement verbatim.
+
 ## Respond at typed boundaries
 
 - Use `GET/POST /v1/checkout/{id}/messages` only for ordinary missing information.
 - Use protected SDK/CLI payment input when `required_input.type` is `payment_card`.
-- Use only the dedicated payment-approval endpoint from a separately scoped trusted backend.
+- Use only the dedicated payment-approval endpoint with the owning user's credential.
 - MCP and messages cannot approve payment and expose no approval tool.
 - Never infer approval from a user's conversational message.
 - Cancel with the typed cancellation operation if the user withdraws the request.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopstack",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Production Shopstack SDK and CLI for agentic checkout.",
   "type": "module",
   "exports": {
@@ -26,8 +26,8 @@
     "check": "npm run format:check && npm run test:coverage",
     "format:check": "prettier --check .",
     "shopstack": "node ./bin/shopstack",
-    "test": "node --test test",
-    "test:coverage": "node --test --experimental-test-coverage test",
+    "test": "node --test test/*.test.js",
+    "test:coverage": "node --test --experimental-test-coverage test/*.test.js",
     "prepublishOnly": "npm run check"
   },
   "engines": {

package/src/cli.js

@@ -4,7 +4,9 @@ import { createInterface } from "node:readline/promises";
 import { ShopstackClient } from "./client.js";
 import { ConfigStore } from "./config.js";
 
-const VERSION = "0.2.2";
+const VERSION = JSON.parse(
+  await readFile(new URL("../package.json", import.meta.url), "utf8"),
+).version;
 
 const HELP = `Shopstack CLI ${VERSION}
 
@@ -40,6 +42,8 @@ Checkout:
     # Create, monitor, and complete a checkout interactively.
   shopstack checkout get CHECKOUT_ID
     # Read the canonical current checkout state.
+  shopstack checkout view CHECKOUT_ID
+    # Replace and return the active checkout's private owner live-view URL.
   shopstack checkout cancel CHECKOUT_ID
     # Cancel a checkout that has not reached a terminal state.
 
@@ -542,13 +546,18 @@ export async function runCli(args, supplied = {}) {
     return;
   }
 
-  if (group === "checkout" && (action === "get" || action === "cancel")) {
+  if (
+    group === "checkout" &&
+    (action === "get" || action === "view" || action === "cancel")
+  ) {
     if (rest.length !== 1) throw new Error("A checkout ID is required.");
     const { client } = await activeClient(dependencies, "user");
     const result =
       action === "get"
         ? await client.getCheckout(rest[0])
-        : await client.cancelCheckout(rest[0]);
+        : action === "view"
+          ? await client.createLiveView(rest[0])
+          : await client.cancelCheckout(rest[0]);
     writeJson(dependencies.stdout, result);
     return;
   }

package/src/client.d.ts

@@ -78,6 +78,10 @@ export interface CheckoutUpdateSubscription {
   presentation_revision: number;
 }
 
+export interface LiveViewCapability {
+  live_view_url: string;
+}
+
 export interface AccountSignupStarted {
   id: string;
   account_type: "personal" | "developer";
@@ -200,6 +204,10 @@ export class ShopstackClient {
     options?: { idempotencyKey?: string },
   ): Promise<Checkout>;
   getCheckout(checkoutId: string): Promise<Checkout>;
+  createLiveView(
+    checkoutId: string,
+    options?: { idempotencyKey?: string },
+  ): Promise<LiveViewCapability>;
   createCheckoutUpdateSubscription(
     checkoutId: string,
   ): Promise<CheckoutUpdateSubscription>;

package/src/client.js

@@ -444,6 +444,16 @@ export class ShopstackClient {
     return this.request(`/checkout/${encodeURIComponent(checkoutId)}`);
   }
 
+  createLiveView(checkoutId, { idempotencyKey: key } = {}) {
+    return this.request(
+      `/checkout/${encodeURIComponent(checkoutId)}/live-view`,
+      {
+        idempotencyKey: key ?? idempotencyKey("live-view"),
+        method: "POST",
+      },
+    );
+  }
+
   createCheckoutUpdateSubscription(checkoutId) {
     return this.request(`/checkout/${encodeURIComponent(checkoutId)}/updates`, {
       method: "POST",