Server-returned string fields (merchant_name, line_items[].name,
billing_address.*, payment method brand/nickname) are now sanitized
before rendering in Ink components using strip-ansi plus control
character stripping. This prevents terminal escape sequence injection
that could spoof the approval UI.
Committed-By-Agent: claude
Co-authored-by: Ben Davis <ben@bencdavis.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When context was provided but too short (< 100 chars), the CLI
incorrectly reported "Error: missing required argument <context>"
instead of the actual Zod validation message. This was fixed
upstream in incur PR #138 (incur@0.4.5) which distinguishes
between truly missing fields and invalid values.
Fixes LINK_AI_WALLET-208
Committed-By-Agent: claude
* migrate commander -> incur enabling mcp server
* save
* use incur skill handling and clarify to use mcp if running
* add changeset
* fix type error
* fix fmt
* fix tests
* fmt
Use update notifier to indicate new versions. In TTY outputs, this is a very standard update-notifier integration. For JSON outputs consumed by agents, we include the info in the auth status command to not interfere with agents parsing output in other commands.
Dan Hill