shopstack 0.2.4 → 0.2.5

package/README.md

@@ -70,7 +70,7 @@ deliberately has no card-input or payment-approval tool.
 
 The canonical agent skill ships as `SKILL.md` in this package. After
 publication it is available at
-`https://unpkg.com/shopstack@0.2.4/SKILL.md` with the release-pinned package.
+`https://unpkg.com/shopstack@0.2.5/SKILL.md` with the release-pinned package.
 
 ## Connections
 
@@ -80,7 +80,10 @@ shopstack connect link
 ```
 
 Link is currently the only persistent payment provider. Connecting it is
-optional.
+optional. `shopstack connect link` opens the HTTPS Link setup page, displays the
+confirmation phrase, and checks the connection every five seconds for up to
+five minutes. It prints `Link connected` when the connection is ready. If a
+browser cannot open automatically, use the exact URL printed in the terminal.
 
 ## Run a checkout
 

package/SKILL.md

@@ -69,6 +69,11 @@ shopstack connect list
 shopstack connect link
 ```
 
+The Link command opens the HTTPS setup page, displays the confirmation phrase,
+and checks every five seconds for up to five minutes. Continue only after it
+prints `Link connected` and reports `checkout_ready: true`. If the browser does
+not open automatically, open the exact URL printed in the terminal.
+
 Include `payment_provider: "link"` only when the active user's Link connection reports checkout-ready. Otherwise omit `payment_provider`. Shopstack will run until card entry and request one protected checkout-scoped card through the SDK or no-echo CLI prompt.
 
 Never put card data in MCP arguments, natural-language messages, model output, logs, or ordinary CLI flags.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopstack",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Production Shopstack SDK and CLI for agentic checkout.",
   "type": "module",
   "exports": {

package/src/cli.js

@@ -1,3 +1,4 @@
+import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 
@@ -7,6 +8,8 @@ import { ConfigStore } from "./config.js";
 const VERSION = JSON.parse(
   await readFile(new URL("../package.json", import.meta.url), "utf8"),
 ).version;
+const LINK_POLL_ATTEMPTS = 60;
+const LINK_POLL_INTERVAL_MS = 5_000;
 
 const HELP = `Shopstack CLI ${VERSION}
 
@@ -92,6 +95,77 @@ function writeJson(stream, value) {
   stream.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function openExternal(url) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:") {
+    throw new Error("Only HTTPS connection URLs can be opened.");
+  }
+  const [command, args] =
+    process.platform === "darwin"
+      ? ["open", [url]]
+      : process.platform === "win32"
+        ? ["cmd.exe", ["/d", "/s", "/c", "start", "", url]]
+        : ["xdg-open", [url]];
+  await new Promise((resolve, reject) => {
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+
+async function connectLink(client, dependencies) {
+  let result = await client.connect("link");
+  if (
+    result.connection_status !== "action_required" ||
+    typeof result.connect_url !== "string"
+  ) {
+    return result;
+  }
+
+  dependencies.stderr.write(`Open Link: ${result.connect_url}\n`);
+  if (typeof result.phrase === "string") {
+    dependencies.stderr.write(`Confirmation phrase: ${result.phrase}\n`);
+  }
+  try {
+    await dependencies.openExternal(result.connect_url);
+  } catch {
+    dependencies.stderr.write(
+      "The browser could not open automatically. Open the URL shown above.\n",
+    );
+  }
+  dependencies.stderr.write("Waiting for Link confirmation...\n");
+
+  for (let attempt = 0; attempt < dependencies.linkPollAttempts; attempt += 1) {
+    await dependencies.delay(dependencies.linkPollIntervalMs);
+    result = await client.connect("link");
+    if (
+      result.connection_status === "active" &&
+      result.checkout_ready === true
+    ) {
+      dependencies.stderr.write("✓ Link connected\n");
+      return result;
+    }
+    if (
+      result.connection_status !== "action_required" &&
+      result.connection_status !== "connecting"
+    ) {
+      return result;
+    }
+  }
+
+  dependencies.stderr.write(
+    "Link setup is still pending. Run `shopstack connect link` to resume.\n",
+  );
+  return result;
+}
+
 async function readJsonFile(path) {
   return JSON.parse(await readFile(path, "utf8"));
 }
@@ -266,6 +340,10 @@ export async function runCli(args, supplied = {}) {
     clientFactory: (options) => new ShopstackClient(options),
     configStore: new ConfigStore(),
     confirm: undefined,
+    delay,
+    linkPollAttempts: LINK_POLL_ATTEMPTS,
+    linkPollIntervalMs: LINK_POLL_INTERVAL_MS,
+    openExternal,
     prompt: undefined,
     readJsonFile,
     secretPrompt: undefined,
@@ -474,7 +552,7 @@ export async function runCli(args, supplied = {}) {
     const result =
       action === "list"
         ? await client.listConnections()
-        : await client.connect("link");
+        : await connectLink(client, dependencies);
     writeJson(dependencies.stdout, result);
     return;
   }