feat: sync CLI with dashboard@v1.6.17

[cursor]

Upstream version

@photon-ai/dashboard-api 1.6.12 → 1.6.17 (dashboard@v1.6.17, commit e161fe16bb2a761a182dfaf8d7f14d8ebfd6c2a1). Spans dashboard releases v1.6.13, v1.6.14, v1.6.15, v1.6.16, v1.6.17.

Routes added/removed/changed

• Added POST /api/otp/phone2/send (dashboard#259, v1.6.15). Real phone-OTP send path; the pre-existing POST /api/otp/phone/send is retained as a decoy honeypot. CLI does not call either.
• Changed GET /api/projects/:id — response body gains additive fields avatarUrl: string | null, plan: PlanTier, platforms: SpectrumPlatformId[], userCount: number (dashboard#255, v1.6.14). Surfaced plan, platforms, userCount in photon projects show between location and owner. avatarUrl skipped — CLI can't render images and spectrum avatar already handles it.
• Removed: (none)
• Cosmetic: field ordering of code / captchaToken in the api.otp.phone.send body swapped (both still present).
• Server-side only (no CLI impact): dashboard#250 (>3-dot email local-part signup block, v1.6.13), #251 phone-OTP suspension (v1.6.14), #256 suspended-user redirect (v1.6.14), #257 email-domain OTP abuse controls (v1.6.14), #258 signup IP suspensions (v1.6.15), #260 log real phone sends after three OTP failures (v1.6.16), #261 block suspicious OTP IPs for seven days (v1.6.17).

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Additive API typing and extra read-only fields in project show output; no auth, billing, or destructive behavior changes in the CLI.

Overview
Syncs the CLI with dashboard@v1.6.17 by bumping dev dependency @photon-ai/dashboard-api 1.6.12 → 1.6.17 (package.json, bun.lock) and refreshing UPSTREAM_DIFF.md for that release range.

The only user-facing CLI change is photon projects show: it now prints plan, platforms, and userCount from the expanded GET /api/projects/:id response (between location and owner). avatarUrl is not shown on purpose.

Upstream adds POST /api/otp/phone2/send and several dashboard-only OTP/signup controls; the CLI still does not call OTP routes. No new runtime dependencies or snapshot updates.

^{Reviewed by Cursor Bugbot for commit 863193f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: Approve

What is right

• Upstream bump lands in package.json and bun.lock only (@photon-ai/dashboard-api 1.6.12 to 1.6.17) — no hand-edited API types.
• Additive GET /api/projects/:id fields (plan, platforms, userCount) surfaced in photon projects show at src/commands/projects.ts:137-139, slotted between location and owner per the PR body. avatarUrl deliberately skipped; rationale documented in UPSTREAM_DIFF.md.
• p.platforms uses the same length > 0 ? join(dash) : c.dim(dash) idiom already used in the list command — style matches.
• String(p.userCount) for the printKv string tuple — no implicit coercion.
• No forbidden deps, no .github/workflows/ or scripts/agent-flow/ touched, no snapshot files changed (PR body correctly lists none), no unrelated refactors.
• bun install --frozen-lockfile && bun run check green locally (typecheck + 90 tests + build).

Deferred (acknowledged in PR body)

• POST /api/otp/phone2/send (new v1.6.15 route) — CLI does not call the OTP send path; documented as decoy/honeypot context in UPSTREAM_DIFF.md.
• Server-side-only dashboard changes (#250, #251, #256, #257, #258, #260, #261) — no CLI surface.
• Cosmetic code/captchaToken field-order swap on api.otp.phone.send — both still present, CLI does not call this route.

Final note

Clean, minimal sync PR. Marking ready and approving.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 863193f. Configure here.}

[cursor]

Stale show fixture omits fields

Low Severity

projects show now reads plan, platforms, and userCount, but the mock fallback fixture project.show.json still lacks those fields. For unknown ids the mock returns that fixture, so human-readable show hits platforms.length and throws.

 

^{Reviewed by Cursor Bugbot for commit 863193f. Configure here.}

[cursor]

Stale show fixture after sync

Low Severity

photon projects show now reads plan, platforms, and userCount, but tests/fixtures/project.show.json still omits them. The mock GET /api/projects/:id fallback returns that fixture for unknown ids, so show crashes on platforms.length there even though list rows already include the fields.

 

^{Reviewed by Cursor Bugbot for commit 863193f. Configure here.}