* Add MPP inspect command
* feat: rework mpp pay to handle full end-to-end 402 flow
mpp pay now probes the URL for a 402 challenge, parses the
WWW-Authenticate header to extract network_id and amount, creates a
spend request, yields the approval URL for the agent to present, and
completes payment with the SPT after approval.
- Remove mpp inspect (subsumed into pay flow)
- Add --context, --amount, --payment-method-id, --test flags
- Make --spend-request-id optional (backward compat)
- Agent mode yields approval URL immediately with _next hints
- Interactive mode handles full flow inline with polling
- Update SKILL.md and CLAUDE.md with new flow docs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: update mpp pay tests to handle generator array output
The mpp pay command now uses an async generator (`async *run`) which
wraps yielded values in an array in JSON output mode. Update three
tests to extract [0] from the output array.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* refactor: remove auto-generated context and step translation layer in mpp pay
Context is now required (min 100 chars) for the full MPP flow — agents must
provide a meaningful description. Also refactors onStep to emit typed Step
values directly, removing the string-to-enum mapping in the component.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* revert version bump in SKILL.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: remove extra blank line to pass biome format check
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add serve command to expose MCP endpoint over HTTP
Committed-By-Agent: claude
* fix: cleanup and readme
* Potential fix for pull request finding 'CodeQL / Information exposure through a stack trace'
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* feat: add noRefresh option to createAccessTokenProvider
Committed-By-Agent: claude
* feat: add env-based token provider to ResourceFactory
Committed-By-Agent: claude
* feat: read LINK_ACCESS_TOKEN, LINK_REFRESH_TOKEN, LINK_NO_REFRESH from env
Committed-By-Agent: claude
* docs: add LINK_ACCESS_TOKEN, LINK_REFRESH_TOKEN, LINK_NO_REFRESH to env vars docs
Committed-By-Agent: claude
* fix: auth status shows LINK_ACCESS_TOKEN state instead of stored credentials
Committed-By-Agent: claude
* refactor: extract resolveAuthInfo helper, simplify auth status component
Committed-By-Agent: claude
* fix: formatting
* support polling straight from auth login
* improvements
* sanitize output; make the polling into a shared helper and share across the auth login polling and the auth status polling
Server-returned string fields (merchant_name, line_items[].name,
billing_address.*, payment method brand/nickname) are now sanitized
before rendering in Ink components using strip-ansi plus control
character stripping. This prevents terminal escape sequence injection
that could spoof the approval UI.
Committed-By-Agent: claude
Co-authored-by: Ben Davis <ben@bencdavis.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* commands to cancel a spend request
* document
* nit: remove unneeded status text
* code improvements
* Fix typecheck
* Just go back to old promise approach
* migrate commander -> incur enabling mcp server
* save
* use incur skill handling and clarify to use mcp if running
* add changeset
* fix type error
* fix fmt
* fix tests
* fmt
Ryan Aubrey