* docs(create-payment-credential): make Link Pay Token flow autonomous-safe
The Link Pay Token section covered token retrieval and injection but
omitted the pieces that make the flow complete unattended, so an agent
following it would fail detection/injection and retry in a loop:
- the "I am an AI agent" checkbox that gates the hidden
input[name="link_pay_token"] (and must be set via the native setter,
not .click());
- that the checkbox and input live in the Stripe accessory iframe;
- the ~5-minute token TTL (retrieve just before injecting);
- the exchange/lookup success signal to wait on;
- a bounded stop/fallback instead of endless retries.
Changes (docs only, merchant-agnostic; no internal flags/accounts):
- Step 2 detection now keys on the checkbox, not only the initially
absent token input.
- Step 5 Link Pay Token: fresh context -> reveal via checkbox -> retrieve
token -> inject -> wait for go-signal -> pay, plus "stop, don't loop".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* docs(create-payment-credential): gate LPT flow on the input, not the component
Review feedback (raubrey): lean on the AiAgentPaymentSteering block as the
anchor and instruction source instead of duplicating mechanics, and account
for surfaces that render the block but disable the inline token input.
The same component renders on Payment Elements (input on by default) and on
hosted Checkout (input gated by checkout_hosted_link_pay_token_enabled, off
today). So "found the component" cannot mean "do the token flow": on hosted
Checkout the checkbox and instructions show with no input, which would loop.
- Step 2 detection now confirms the token path by checking whether
input[name="link_pay_token"] appears after ticking the checkbox; if it does
not, follow the block's instructions and fall back to card.
- Step 5 delegates the flow narrative to the block's rendered steps, reveals
the checkbox with a DOM-level click() (matching the e2e deploy spec) instead
of a native-setter dance, and keeps the bounded stop/fallback so an
input-disabled surface never loops.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* update skill.md
* LPT to card fallback can reuse the same spend request
* udpate payment element and browser session detail
* drop references to elements
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: surface verification_url in spend-request error output
When the API returns additional_verification_required, surface the
verification_url so users know where to complete stepup verification.
Also fixes interactive mode hanging on error by calling useApp().exit().
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: resolve biome lint and format errors in spend-request commands
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
#150 added the report-outcomes docs to the README (which ships in the npm
package) and the create-payment-credential skill, but merged without a
changeset. Add a patch changeset so the next release publishes the updated
README.
Committed-By-Agent: claude
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* docs: add report command instructions to SKILL.md and README
- SKILL.md: reporting instructions (when to report, tag reference, examples)
- README.md: report outcomes section with usage examples
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* docs: make outcome reporting opt-in and add tag guidance
Address review feedback on the reporting docs:
- Soften the "REQUIRED" / "always report" language to encouraged-but-optional
in both SKILL.md and README, so reporting is suggested rather than mandated
for now.
- Add guidance to prefer the most specific tag and use `other` only when none
apply (describing details in --freeform-context).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Committed-By-Agent: claude
* docs: reword report rationale to "improve checkout for agents"
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Committed-By-Agent: claude
* docs: align SKILL.md report rationale wording with README
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add report command for agent observability
Add `link-cli report` command for reporting purchase outcomes (success,
blocked, abandoned) after every agent purchase attempt.
- packages/cli/src/commands/report/schema.ts — Zod schema using SDK constants
- packages/cli/src/commands/report/index.tsx — Command definition
- packages/cli/src/utils/resource-factory.ts — Add createReportResource()
- packages/cli/src/cli.tsx — Register the command
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: register report as a leaf command so CLI flags parse
The report command was registered with cli.command('', {...}) under a
router Cli. The empty-string subcommand name broke flag parsing
(`link-cli report --domain ...` treated --domain as a subcommand) and
produced the MCP tool name `report_`. Switch to the leaf-command form
used by demo/onboard — pass options/run directly to Cli.create — and
gate auth with requireAuthGuard inside run, matching spend-request.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add IReportResource interface and ReportResource implementation that
POSTs to /agent_observations. Supports reporting purchase outcomes
(success, blocked, abandoned) with domain, tags, and context.
* Upload SEAs to release artifacts as well
* Updates to SEA Build config
* Fixes to get the SEA builds working
* SEA-specific build config
* revert unneeded changes
* feat(sdk): migrate WebBotAuthResource to POST /web_bot_auth/sign
PR #2208449 (pay-server) added a dedicated signing endpoint. The
credentials endpoint no longer accepts the url parameter or returns
web_bot_auth. Update the SDK resource to call the dedicated endpoint.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* code review comments
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
jlau-stripe