shopstack 0.2.3 → 0.2.5

package/README.md

@@ -70,7 +70,7 @@ deliberately has no card-input or payment-approval tool.
 
 The canonical agent skill ships as `SKILL.md` in this package. After
 publication it is available at
-`https://unpkg.com/shopstack@0.2.3/SKILL.md` with the release-pinned package.
+`https://unpkg.com/shopstack@0.2.5/SKILL.md` with the release-pinned package.
 
 ## Connections
 
@@ -80,7 +80,10 @@ shopstack connect link
 ```
 
 Link is currently the only persistent payment provider. Connecting it is
-optional.
+optional. `shopstack connect link` opens the HTTPS Link setup page, displays the
+confirmation phrase, and checks the connection every five seconds for up to
+five minutes. It prints `Link connected` when the connection is ready. If a
+browser cannot open automatically, use the exact URL printed in the terminal.
 
 ## Run a checkout
 
@@ -125,6 +128,9 @@ Treat the printed URL as opaque and open it exactly as returned, including its
 `#token=...` fragment. If that fragment is lost while the checkout is active,
 run `shopstack checkout view CHECKOUT_ID` to receive a replacement URL. The
 replacement disconnects an older viewer session but does not restart checkout.
+Omit `model_handle` to use the production GLM route. Set it to `qwen` only when
+you explicitly need the fixed Qwen comparison route.
+
 When no provider is selected, the checkout runs normally until the payment
 form, then asks for card details through a no-echo terminal prompt. Card data is
 sent only to the protected payment-details endpoint. The CLI separately shows

package/SKILL.md

@@ -69,6 +69,11 @@ shopstack connect list
 shopstack connect link
 ```
 
+The Link command opens the HTTPS setup page, displays the confirmation phrase,
+and checks every five seconds for up to five minutes. Continue only after it
+prints `Link connected` and reports `checkout_ready: true`. If the browser does
+not open automatically, open the exact URL printed in the terminal.
+
 Include `payment_provider: "link"` only when the active user's Link connection reports checkout-ready. Otherwise omit `payment_provider`. Shopstack will run until card entry and request one protected checkout-scoped card through the SDK or no-echo CLI prompt.
 
 Never put card data in MCP arguments, natural-language messages, model output, logs, or ordinary CLI flags.
@@ -141,7 +146,7 @@ replacement verbatim.
 
 - Use `GET/POST /v1/checkout/{id}/messages` only for ordinary missing information.
 - Use protected SDK/CLI payment input when `required_input.type` is `payment_card`.
-- Use only the dedicated payment-approval endpoint from a separately scoped trusted backend.
+- Use only the dedicated payment-approval endpoint with the owning user's credential.
 - MCP and messages cannot approve payment and expose no approval tool.
 - Never infer approval from a user's conversational message.
 - Cancel with the typed cancellation operation if the user withdraws the request.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopstack",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Production Shopstack SDK and CLI for agentic checkout.",
   "type": "module",
   "exports": {
@@ -26,8 +26,8 @@
     "check": "npm run format:check && npm run test:coverage",
     "format:check": "prettier --check .",
     "shopstack": "node ./bin/shopstack",
-    "test": "node --test test",
-    "test:coverage": "node --test --experimental-test-coverage test",
+    "test": "node --test test/*.test.js",
+    "test:coverage": "node --test --experimental-test-coverage test/*.test.js",
     "prepublishOnly": "npm run check"
   },
   "engines": {

package/src/cli.js

@@ -1,10 +1,15 @@
+import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 
 import { ShopstackClient } from "./client.js";
 import { ConfigStore } from "./config.js";
 
-const VERSION = "0.2.2";
+const VERSION = JSON.parse(
+  await readFile(new URL("../package.json", import.meta.url), "utf8"),
+).version;
+const LINK_POLL_ATTEMPTS = 60;
+const LINK_POLL_INTERVAL_MS = 5_000;
 
 const HELP = `Shopstack CLI ${VERSION}
 
@@ -90,6 +95,77 @@ function writeJson(stream, value) {
   stream.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function openExternal(url) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:") {
+    throw new Error("Only HTTPS connection URLs can be opened.");
+  }
+  const [command, args] =
+    process.platform === "darwin"
+      ? ["open", [url]]
+      : process.platform === "win32"
+        ? ["cmd.exe", ["/d", "/s", "/c", "start", "", url]]
+        : ["xdg-open", [url]];
+  await new Promise((resolve, reject) => {
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+
+async function connectLink(client, dependencies) {
+  let result = await client.connect("link");
+  if (
+    result.connection_status !== "action_required" ||
+    typeof result.connect_url !== "string"
+  ) {
+    return result;
+  }
+
+  dependencies.stderr.write(`Open Link: ${result.connect_url}\n`);
+  if (typeof result.phrase === "string") {
+    dependencies.stderr.write(`Confirmation phrase: ${result.phrase}\n`);
+  }
+  try {
+    await dependencies.openExternal(result.connect_url);
+  } catch {
+    dependencies.stderr.write(
+      "The browser could not open automatically. Open the URL shown above.\n",
+    );
+  }
+  dependencies.stderr.write("Waiting for Link confirmation...\n");
+
+  for (let attempt = 0; attempt < dependencies.linkPollAttempts; attempt += 1) {
+    await dependencies.delay(dependencies.linkPollIntervalMs);
+    result = await client.connect("link");
+    if (
+      result.connection_status === "active" &&
+      result.checkout_ready === true
+    ) {
+      dependencies.stderr.write("✓ Link connected\n");
+      return result;
+    }
+    if (
+      result.connection_status !== "action_required" &&
+      result.connection_status !== "connecting"
+    ) {
+      return result;
+    }
+  }
+
+  dependencies.stderr.write(
+    "Link setup is still pending. Run `shopstack connect link` to resume.\n",
+  );
+  return result;
+}
+
 async function readJsonFile(path) {
   return JSON.parse(await readFile(path, "utf8"));
 }
@@ -264,6 +340,10 @@ export async function runCli(args, supplied = {}) {
     clientFactory: (options) => new ShopstackClient(options),
     configStore: new ConfigStore(),
     confirm: undefined,
+    delay,
+    linkPollAttempts: LINK_POLL_ATTEMPTS,
+    linkPollIntervalMs: LINK_POLL_INTERVAL_MS,
+    openExternal,
     prompt: undefined,
     readJsonFile,
     secretPrompt: undefined,
@@ -472,7 +552,7 @@ export async function runCli(args, supplied = {}) {
     const result =
       action === "list"
         ? await client.listConnections()
-        : await client.connect("link");
+        : await connectLink(client, dependencies);
     writeJson(dependencies.stdout, result);
     return;
   }