feat: sync CLI with dashboard@v1.6.20

[cursor]

Upstream version

• dashboard@v1.6.20 (SHA f47eed5ab5d6806ac8b95b3bf8b46bdc18ebb5dc)
• Bumps @photon-ai/dashboard-api devDep 1.6.12 → 1.6.20
• Release: https://github.com/photon-hq/dashboard/releases/tag/v1.6.20

Routes added/removed/changed

v1.6.20 itself is a pure server-side release — its three dashboard PRs (#264 match suspicious OTP user-agent fragments, #265 match Android CAPTCHA UAs by prefix, #266 route datacenter IPs to Google reCAPTCHA) are OTP/captcha routing logic only, with no route or DTO changes.

Because main was still pinned at @photon-ai/dashboard-api@1.6.12, this sync also picks up the intervening additive-only changes from 1.6.13 – 1.6.19. Compared to 1.6.12:

• Added: GET /api/captcha/provider (new captcha-provider resolver, dashboard#262/#263)
• Added: POST /api/otp/phone2/send (real phone-OTP path introduced in dashboard#259; the pre-existing POST /api/otp/phone/send is retained as a decoy honeypot)
• Changed (additive): GET /api/projects/:id response now includes avatarUrl, plan, platforms, and userCount (dashboard#255, v1.6.14)
• Removed: (none)

CLI code impact: The CLI never touches api.otp.* or api.captcha.* (those are browser/mobile auth flows), so the new routes need no command wiring. This PR surfaces the new project-detail fields in photon projects show via printKv([...]) — showing plan, platforms (comma-joined, or — when empty, matching the list command's formatting), and userCount between location and owner. avatarUrl is intentionally not surfaced (CLI doesn't render images; it is already reachable via the spectrum avatar commands).

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Dev-dependency type sync plus additive CLI display fields; no auth, billing, or runtime dependency changes.

Overview
Bumps the @photon-ai/dashboard-api dev dependency from 1.6.12 to 1.6.20 (lockfile included) so the CLI tracks dashboard v1.6.20 API types.

photon projects show now prints plan, platforms (comma-separated, or — when empty, same as list), and userCount in the key-value output after location. --json still dumps the full API payload, including new fields like avatarUrl, which the text UI does not render.

The project.show test fixture is updated with the new response fields.

^{Reviewed by Cursor Bugbot for commit 73d3668. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review — Scenario A (initial review, draft opened by cursor bot). Verdict: Approve. What is right: (1) API types come from a clean @photon-ai/dashboard-api version bump 1.6.12 -> 1.6.20 in package.json and bun.lock, no hand-edited types. (2) Diff is scoped to the upstream sync — two dep-manifest lines plus 6 lines in src/commands/projects.ts plus 4 fields in tests/fixtures/project.show.json, no unrelated refactors. (3) projects show continues to use getApi() + Eden treaty, destructures data/error/status, and throws SessionExpiredError on 401 — no changes to the auth or error flow. (4) New DTO fields (plan: PlanTier, platforms: SpectrumPlatformId[], userCount: number) are consumed directly from the upstream response type; p.platforms.join(', ') with the em-dash fallback matches the empty-list formatting used by projects list. (5) avatarUrl is intentionally not surfaced — consistent with the PR body (image URL, already reachable via spectrum avatar commands). (6) New captcha/OTP routes (GET /api/captcha/provider, POST /api/otp/phone2/send) are correctly identified as out-of-scope for the CLI (browser and mobile auth flows). (7) No forbidden deps introduced; .github/workflows/ untouched; snapshot section correctly reports (none) — only golden snapshot is ping, unaffected. (8) bun install --frozen-lockfile plus bun run check (typecheck + 90 tests + build) green on HEAD 73d3668. Concerns: none blocking. Deferred (acknowledged in PR body): new captcha/OTP routes intentionally not wired into any CLI command. Final note: clean, well-scoped upstream sync surfacing three additive project fields; approved and marked ready.