feat: update mentions of MCP to AI and CLI

[jomifepe]

Summary

• Update the placeholder comment generated when creating a slice across the Next, Nuxt, Nuxt 2, and SvelteKit adapters to suggest using your own AI agent with the Prismic CLI (linking to https://prismic.io/docs/ai#create-slices) instead of the Prismic MCP server. Snapshot in adapter-sveltekit updated to match.
• Rename the user-facing "Prismic MCP" sidebar item to "Prismic with AI", rephrase its tooltip, and point the link to the https://prismic.io/docs/ai landing page.
• Update the slice builder promo button copy to "Boost your workflow with Prismic AI" and point it to the same docs landing page.
• Rename the promo link component (McpPromoLink → AIPromoLink) and update its import sites.
• Rename the related telemetry surface: event id mcp:promo-link-clicked → ai:promo-link-clicked, human name "MCP Promo Link Clicked" → "AI Promo Link Clicked", type McpPromoLinkClicked → AiPromoLinkClicked, and the sidebar link_name: "prismic_mcp" → "prismic_ai".
• Update Playwright coverage (locator name + variable + test title) to match the new "Prismic with AI" wording.

Preview

---

Security fix: defu prototype-pollution vulnerability (GHSA-737v-mqg7-c878)

Problem

The @slicemachine/plugin-kit CI audit step (yarn npm audit --environment production --severity high) was failing with:

└─ defu: 6.1.4
   ├─ ID: 1116102
   ├─ Issue: defu: Prototype pollution via `__proto__` key in defaults argument
   ├─ Severity: high
   ├─ Vulnerable Versions: <=6.1.4
   └─ Patched Versions: >=6.1.5

Root cause

Yarn 3.6.0's npm audit implementation (legacy v1 API) sends all resolved package versions in the entire monorepo to the npm registry's bulk advisory endpoint — not just the workspace's own dependency tree. This means even though plugin-kit itself resolved defu@^6.1.5 → 6.1.7, the audit still flagged defu@6.1.4 (resolved via h3, c12, rc9, etc. in sibling workspaces like @slicemachine/manager).

Fix

1. Bumped defu in packages/plugin-kit/package.json from ^6.1.2 to ^6.1.5
2. Added "defu": "^6.1.5" to the root package.json resolutions field — this forces all defu ranges across the entire monorepo to resolve to 6.1.7 (patched)

Compatibility checks

The resolution override affects consumers that previously required defu@^5.0.0 (→ 5.0.1) and defu@^6.x (→ 6.1.2 / 6.1.4). We verified the following:

Consumer	Previous version	Usage pattern	Compatible with 6.1.7?
@slicemachine/plugin-kit (direct)	6.1.2	import { defu } from "defu" (ESM named import)	✅ Same API since v6.0
@nuxt/loading-screen@2.0.4 (transitive via nuxt@2.16.3)	5.0.1	const defu = require('defu') (CJS default)	✅ defu 6.1.7's CJS entry (lib/defu.cjs) sets module.exports = defu for backwards compat
h3, c12, rc9, nitropack, @nuxt/kit, @nuxt/schema etc.	6.1.4	Named imports (import { defu } from "defu")	✅ Patch-level bump, no API changes
vite-plugin-sdk@0.1.1	6.1.2	Named import	✅ Same API
giget@1.1.2	6.1.2	Named import	✅ Same API

The 6.1.5 release contains only the prototype-pollution fix (unjs/defu#156) and "ignore inherited enumerable properties" — no breaking changes. Versions 6.1.6/6.1.7 add a types export fix and mixed-types build fix respectively.

---

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
slice-machine	Ready	Preview	May 14, 2026 2:51pm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 22f05f5. Configure here.}

[xrutayisire]

Nice!