@autohq/cli 0.1.164 → 0.1.166

package/dist/agent-bridge.js

@@ -19666,6 +19666,33 @@ var RuntimeBridgeOutputAckSchema = external_exports.object({
   at: external_exports.string().datetime()
 }).strict();
 
+// ../../packages/schemas/src/account.ts
+var AccountDeleteRequestSchema = external_exports.object({
+  deleteAdminOrganizations: external_exports.boolean().default(false),
+  confirmation: external_exports.string().trim().min(1)
+});
+var AccountDeleteOrganizationSchema = external_exports.object({
+  organizationId: external_exports.string().trim().min(1),
+  organizationSlug: external_exports.string().trim().min(1),
+  organizationName: external_exports.string().trim().min(1),
+  role: external_exports.enum(["admin", "member"]),
+  adminCount: external_exports.number().int().nonnegative(),
+  projectCount: external_exports.number().int().nonnegative()
+});
+var AccountDeleteDeletedOrganizationSchema = AccountDeleteOrganizationSchema.extend({
+  deleteReason: external_exports.enum(["last_admin", "delete_admin_orgs"])
+});
+var AccountDeleteResponseSchema = external_exports.object({
+  user: external_exports.object({
+    userId: external_exports.string().trim().min(1),
+    primaryEmail: external_exports.string().trim().min(1)
+  }),
+  deletedOrganizations: external_exports.array(AccountDeleteDeletedOrganizationSchema),
+  removedOrganizations: external_exports.array(AccountDeleteOrganizationSchema),
+  deletedProjectCount: external_exports.number().int().nonnegative(),
+  removedProjectMembershipCount: external_exports.number().int().nonnegative()
+});
+
 // ../../packages/schemas/src/ids.ts
 var OpaqueIdSchema2 = external_exports.string().trim().min(1);
 var ProfileIdSchema = OpaqueIdSchema2.brand();
@@ -22779,6 +22806,21 @@ var SetupOnboardingPullRequestSchema = external_exports.object({
 var SetupOnboardingPullRequestCreateResponseSchema = external_exports.object({
   pullRequest: SetupOnboardingPullRequestSchema
 });
+var SetupOnboardingPullRequestStatusRequestSchema = external_exports.object({
+  githubConnection: external_exports.string().trim().min(1).optional(),
+  repo: GithubSyncRepositoryFullNameSchema,
+  pullRequestNumber: external_exports.coerce.number().int().positive()
+});
+var SetupOnboardingPullRequestStatusResponseSchema = external_exports.object({
+  pullRequest: external_exports.object({
+    merged: external_exports.boolean(),
+    state: external_exports.string().trim().min(1)
+  }),
+  apply: external_exports.object({
+    applied: external_exports.boolean()
+  }),
+  ready: external_exports.boolean()
+});
 
 // ../../packages/schemas/src/runtimes.ts
 var RuntimeRecordSchema = external_exports.object({
@@ -26440,7 +26482,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.164",
+  version: "0.1.166",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"

package/dist/index.js

@@ -363,23 +363,25 @@ async function createOAuthLoopbackCallback(input) {
       );
       return;
     }
-    const code = url2.searchParams.get("code");
-    if (!code) {
+    const code = url2.searchParams.get("code") ?? "";
+    const sensitiveActionToken = url2.searchParams.get("sensitive_action_token") ?? void 0;
+    if (!code && !sensitiveActionToken) {
       response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
       endThenSettle(
         response,
         renderOAuthLoopbackPage({
           status: "failure",
           eyebrow: "Auto",
-          title: "Missing authorization code",
+          title: "Missing authorization result",
           message: "Return to your terminal to retry the authorization flow."
         }),
-        () => rejectResult(new Error("Missing authorization code"))
+        () => rejectResult(new Error("Missing authorization result"))
       );
       return;
     }
     const result2 = {
       code,
+      sensitiveActionToken,
       organizationName: url2.searchParams.get("organization_name") ?? void 0,
       projectName: url2.searchParams.get("project_name") ?? void 0,
       state: url2.searchParams.get("state") ?? void 0
@@ -16060,6 +16062,40 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/schemas/src/account.ts
+var AccountDeleteRequestSchema, AccountDeleteOrganizationSchema, AccountDeleteDeletedOrganizationSchema, AccountDeleteResponseSchema;
+var init_account = __esm({
+  "../../packages/schemas/src/account.ts"() {
+    "use strict";
+    init_zod();
+    AccountDeleteRequestSchema = external_exports.object({
+      deleteAdminOrganizations: external_exports.boolean().default(false),
+      confirmation: external_exports.string().trim().min(1)
+    });
+    AccountDeleteOrganizationSchema = external_exports.object({
+      organizationId: external_exports.string().trim().min(1),
+      organizationSlug: external_exports.string().trim().min(1),
+      organizationName: external_exports.string().trim().min(1),
+      role: external_exports.enum(["admin", "member"]),
+      adminCount: external_exports.number().int().nonnegative(),
+      projectCount: external_exports.number().int().nonnegative()
+    });
+    AccountDeleteDeletedOrganizationSchema = AccountDeleteOrganizationSchema.extend({
+      deleteReason: external_exports.enum(["last_admin", "delete_admin_orgs"])
+    });
+    AccountDeleteResponseSchema = external_exports.object({
+      user: external_exports.object({
+        userId: external_exports.string().trim().min(1),
+        primaryEmail: external_exports.string().trim().min(1)
+      }),
+      deletedOrganizations: external_exports.array(AccountDeleteDeletedOrganizationSchema),
+      removedOrganizations: external_exports.array(AccountDeleteOrganizationSchema),
+      deletedProjectCount: external_exports.number().int().nonnegative(),
+      removedProjectMembershipCount: external_exports.number().int().nonnegative()
+    });
+  }
+});
+
 // ../../packages/schemas/src/ids.ts
 var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, IdentityIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, AgentIdSchema, SessionIdSchema, SessionCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupTemplateIdSchema, UserIdSchema;
 var init_ids = __esm({
@@ -19553,7 +19589,7 @@ var init_session_commands = __esm({
 });
 
 // ../../packages/schemas/src/setup.ts
-var SetupOnboardingPullRequestCreateRequestSchema, SetupOnboardingPullRequestSchema, SetupOnboardingPullRequestCreateResponseSchema;
+var SetupOnboardingPullRequestCreateRequestSchema, SetupOnboardingPullRequestSchema, SetupOnboardingPullRequestCreateResponseSchema, SetupOnboardingPullRequestStatusRequestSchema, SetupOnboardingPullRequestStatusResponseSchema;
 var init_setup = __esm({
   "../../packages/schemas/src/setup.ts"() {
     "use strict";
@@ -19575,6 +19611,21 @@ var init_setup = __esm({
     SetupOnboardingPullRequestCreateResponseSchema = external_exports.object({
       pullRequest: SetupOnboardingPullRequestSchema
     });
+    SetupOnboardingPullRequestStatusRequestSchema = external_exports.object({
+      githubConnection: external_exports.string().trim().min(1).optional(),
+      repo: GithubSyncRepositoryFullNameSchema,
+      pullRequestNumber: external_exports.coerce.number().int().positive()
+    });
+    SetupOnboardingPullRequestStatusResponseSchema = external_exports.object({
+      pullRequest: external_exports.object({
+        merged: external_exports.boolean(),
+        state: external_exports.string().trim().min(1)
+      }),
+      apply: external_exports.object({
+        applied: external_exports.boolean()
+      }),
+      ready: external_exports.boolean()
+    });
   }
 });
 
@@ -19619,6 +19670,7 @@ var init_temporal = __esm({
 var init_src = __esm({
   "../../packages/schemas/src/index.ts"() {
     "use strict";
+    init_account();
     init_auth();
     init_chat();
     init_claude_code();
@@ -20603,6 +20655,26 @@ function createApiClient(input) {
       }
       return AuthWhoamiResponseSchema.parse(await response.json());
     },
+    async deleteAccount(inputOptions) {
+      const response = await bootstrapFetch(
+        apiUrl(apiPath("/account"), inputOptions.apiBaseUrl),
+        {
+          method: "DELETE",
+          headers: {
+            "content-type": "application/json",
+            "x-auto-sensitive-action-token": inputOptions.sensitiveActionToken
+          },
+          body: JSON.stringify({
+            deleteAdminOrganizations: inputOptions.deleteAdminOrganizations,
+            confirmation: inputOptions.confirmation
+          })
+        }
+      );
+      if (!response.ok) {
+        throw new Error(await responseErrorMessage(response));
+      }
+      return AccountDeleteResponseSchema.parse(await response.json());
+    },
     async listProjects(options = {}) {
       return fetchProjects2(options.apiBaseUrl);
     },
@@ -20948,6 +21020,23 @@ function createApiClient(input) {
         }
       );
     },
+    async getSetupOnboardingPullRequestStatus(request, options = {}) {
+      const project = await activeProject();
+      const searchParams = [
+        ["repo", request.repo],
+        ["pullRequestNumber", String(request.pullRequestNumber)]
+      ];
+      if (request.githubConnection) {
+        searchParams.push(["githubConnection", request.githubConnection]);
+      }
+      return requestJson(
+        projectApiPath(project, "/setup/onboarding-pr"),
+        {
+          apiBaseUrl: options.apiBaseUrl,
+          searchParams
+        }
+      );
+    },
     ...createResourceApi({
       activeProject,
       apiUrl,
@@ -21492,7 +21581,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.164",
+      version: "0.1.166",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -25334,10 +25423,10 @@ function ConversationView({
             return;
           }
           setStatus("failed");
-          await sleep2(1e3, abort.signal);
+          await sleep3(1e3, abort.signal);
           continue;
         }
-        await sleep2(250, abort.signal);
+        await sleep3(250, abort.signal);
       }
     })();
     void client.getSession(sessionId, { apiBaseUrl: apiUrl }).then(applyRunSnapshot).catch(() => void 0);
@@ -25390,10 +25479,10 @@ function ConversationView({
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
-          await sleep2(1e3, abort.signal);
+          await sleep3(1e3, abort.signal);
           continue;
         }
-        await sleep2(250, abort.signal);
+        await sleep3(250, abort.signal);
       }
     })();
     return () => {
@@ -25861,7 +25950,7 @@ function formatDuration(event) {
   }
   return `${(event.durationMs / 1e3).toFixed(1)}s`;
 }
-function sleep2(ms, signal) {
+function sleep3(ms, signal) {
   if (signal.aborted) {
     return Promise.resolve();
   }
@@ -29449,11 +29538,12 @@ var init_launcher = __esm({
 
 // src/cli/program.ts
 import { existsSync as existsSync4 } from "fs";
-import { Command, Option as Option3 } from "commander";
+import { Command, Option as Option4 } from "commander";
 
 // src/commands/account/commands.ts
 init_base_url();
 init_login();
+import { Option } from "commander";
 
 // src/commands/auth/profile.ts
 import { existsSync, rmSync } from "fs";
@@ -29754,6 +29844,210 @@ function formatScopeActions(actions) {
   return ordered.join("+");
 }
 
+// src/commands/account/delete.ts
+init_base_url();
+init_http();
+init_browser();
+init_file();
+init_loopback();
+
+// src/lib/stdio/readline.ts
+import { createInterface } from "readline/promises";
+function createCliReadline(input) {
+  return createInterface({
+    input: input.stdin,
+    output: input.stdout,
+    terminal: Boolean(input.stdin.isTTY)
+  });
+}
+
+// src/commands/account/delete.ts
+async function deleteAccount(input) {
+  const { context, options } = input;
+  const config2 = readConfig(context.configPath);
+  const confirmationTarget = config2.userEmail ?? options.confirm;
+  if (!confirmationTarget) {
+    throw new Error(
+      "Cannot determine the account email. Re-run with --confirm <email>."
+    );
+  }
+  const confirmation = await accountDeletionConfirmation({
+    context,
+    email: confirmationTarget,
+    options
+  });
+  const apiBaseUrl = resolveApiBaseUrl({
+    explicit: [options.apiUrl, context.globalApiUrl?.()],
+    env: context.env,
+    configServerUrl: config2.serverUrl
+  });
+  const sensitiveActionToken = options.sensitiveActionToken ?? (options.device ? await authorizeSensitiveActionDevice({
+    context,
+    apiBaseUrl
+  }) : await authorizeSensitiveActionLoopback({
+    context,
+    apiBaseUrl,
+    email: confirmationTarget
+  }));
+  const client = createContextApiClient(context);
+  const deleted = await client.deleteAccount({
+    deleteAdminOrganizations: Boolean(options.deleteAdminOrgs),
+    confirmation,
+    sensitiveActionToken,
+    apiBaseUrl
+  });
+  context.writeOutput(
+    context.io.style.success(`Deleted account ${deleted.user.primaryEmail}.`)
+  );
+  if (deleted.deletedOrganizations.length > 0) {
+    context.writeOutput(
+      `Deleted ${deleted.deletedOrganizations.length} organization(s) and ${deleted.deletedProjectCount} project(s).`
+    );
+  }
+  if (deleted.removedOrganizations.length > 0) {
+    context.writeOutput(
+      `Removed account memberships from ${deleted.removedOrganizations.length} organization(s).`
+    );
+  }
+  if (deleted.removedProjectMembershipCount > 0) {
+    context.writeOutput(
+      `Removed ${deleted.removedProjectMembershipCount} project membership(s).`
+    );
+  }
+  logout(context);
+}
+async function accountDeletionConfirmation(input) {
+  if (input.options.yes) {
+    if (!input.options.confirm) {
+      throw new Error(
+        "Pass --confirm <email> with --yes to delete an account non-interactively."
+      );
+    }
+    return input.options.confirm;
+  }
+  if (!input.context.stdin.isTTY) {
+    throw new Error(
+      "Account deletion requires an interactive terminal, or --yes --confirm <email>."
+    );
+  }
+  const rl = createCliReadline({
+    stdin: input.context.stdin,
+    stdout: input.context.stdout
+  });
+  try {
+    input.context.writeOutput(
+      `This will permanently delete the Auto account ${input.email}.`
+    );
+    input.context.writeOutput(
+      input.options.deleteAdminOrgs ? "Organizations where this account is an admin will be deleted, including their projects and resources." : "Organizations where this account is the last admin will be deleted; other organizations will keep their data."
+    );
+    input.context.writeOutput(
+      "Connections, tokens, identities, and account-scoped access will be removed."
+    );
+    await requireYes(rl, "Delete this Auto account? Type yes to continue: ");
+    await requireYes(rl, "This cannot be undone. Type yes to continue: ");
+    const confirmation = input.options.confirm ?? await rl.question(`Type ${input.email} to permanently delete: `);
+    if (confirmation.trim() !== input.email) {
+      throw new Error(
+        "Account deletion cancelled: confirmation did not match."
+      );
+    }
+    return confirmation.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function authorizeSensitiveActionLoopback(input) {
+  const callback = await createOAuthLoopbackCallback({
+    successHtml: () => renderOAuthLoopbackPage({
+      status: "success",
+      eyebrow: "Auto CLI",
+      title: "Account deletion confirmed",
+      message: "Auto received the fresh browser authorization. The CLI will finish deleting the account from your terminal.",
+      details: [{ label: "Account", value: input.email }]
+    }),
+    failureHtml: () => renderOAuthLoopbackPage({
+      status: "failure",
+      eyebrow: "Auto CLI",
+      title: "Account deletion confirmation failed",
+      message: "The browser authorization did not complete. Return to your terminal to retry or inspect the error.",
+      details: [{ label: "Account", value: input.email }]
+    })
+  });
+  try {
+    const authorizeUrl = new URL("/auth/cli", input.apiBaseUrl);
+    authorizeUrl.searchParams.set("purpose", "sensitive_action");
+    authorizeUrl.searchParams.set("redirect_uri", callback.redirectUri);
+    input.context.writeOutput(
+      `Opening ${input.context.io.style.url(authorizeUrl.toString())}`
+    );
+    input.context.writeOutput(
+      input.context.io.style.dim(
+        "Log in in your browser to confirm account deletion."
+      )
+    );
+    openBrowser(authorizeUrl.toString());
+    const result = await callback.result;
+    if (!result.sensitiveActionToken) {
+      throw new Error("Missing sensitive action authorization token");
+    }
+    return result.sensitiveActionToken;
+  } finally {
+    callback.close();
+  }
+}
+async function authorizeSensitiveActionDevice(input) {
+  const device = await postJson(
+    input.context.fetch,
+    `${input.apiBaseUrl}/api/v1/auth/device/code`,
+    {
+      purpose: "sensitive_action",
+      action: "account_delete"
+    }
+  );
+  input.context.writeOutput(
+    `Open ${input.context.io.style.url(device.verification_uri)} and enter ${input.context.io.style.label(
+      device.user_code
+    )}`
+  );
+  input.context.writeOutput(
+    `${input.context.io.style.label("Device code:")} ${input.context.io.style.id(
+      device.device_code
+    )}`
+  );
+  const deadline = Date.now() + device.expires_in * 1e3;
+  let firstAttempt = true;
+  while (Date.now() < deadline) {
+    if (!firstAttempt) {
+      await sleep2(Math.max(0, device.interval) * 1e3);
+    }
+    firstAttempt = false;
+    try {
+      const token2 = await postJson(input.context.fetch, `${input.apiBaseUrl}/api/v1/auth/cli/token`, {
+        grant_type: "urn:auto:params:oauth:grant-type:sensitive_action_device_code",
+        action: "account_delete",
+        device_code: device.device_code
+      });
+      return token2.sensitive_action_token;
+    } catch (error51) {
+      if (error51 instanceof Error && error51.message === "authorization_pending") {
+        continue;
+      }
+      throw error51;
+    }
+  }
+  throw new Error("Device authorization expired before approval.");
+}
+async function requireYes(rl, prompt) {
+  const answer = await rl.question(prompt);
+  if (answer.trim() !== "yes") {
+    throw new Error("Account deletion cancelled.");
+  }
+}
+async function sleep2(ms) {
+  await new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+
 // src/commands/account/commands.ts
 function registerAccountCommands(program, context) {
   const account = program.command("account").description("Manage stored account profiles.");
@@ -29783,6 +30077,17 @@ function registerAccountCommands(program, context) {
     (accountRef, options) => switchAccount(context, accountRef, options)
   );
   account.command("remove").description("Remove a stored account profile.").argument("<name>", "Profile name to remove").action((name) => removeProfile(context, name));
+  account.command("delete").description("Permanently delete the signed-in Auto account.").option("--api-url <url>", "Auto web server URL").option(
+    "--delete-admin-orgs",
+    "delete organizations where this account is an admin"
+  ).option("--device", "use device authorization for fresh confirmation").option("--yes", "skip interactive yes/no prompts").option("--confirm <email>", "account email required for deletion").addOption(
+    new Option(
+      "--sensitive-action-token <token>",
+      "fresh sensitive action authorization token"
+    ).hideHelp()
+  ).action(
+    (options) => deleteAccount({ context, options })
+  );
 }
 
 // src/commands/agent-bridge/git-credentials.ts
@@ -31766,16 +32071,6 @@ import { existsSync as existsSync3, mkdtempSync, writeFileSync as writeFileSync3
 import { homedir as homedir3, tmpdir } from "os";
 import { join as join4 } from "path";
 
-// src/lib/stdio/readline.ts
-import { createInterface } from "readline/promises";
-function createCliReadline(input) {
-  return createInterface({
-    input: input.stdin,
-    output: input.stdout,
-    terminal: Boolean(input.stdin.isTTY)
-  });
-}
-
 // src/lib/stdio/secret.ts
 async function questionSecret(context, prompt) {
   const readline = createCliReadline(context);
@@ -31846,7 +32141,7 @@ async function connectAgentPresence2(input) {
     );
     return;
   }
-  const sleep3 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const sleep4 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
   const openBrowser2 = input.openBrowser ?? openBrowser;
   const now3 = input.now ?? Date.now;
   const pollIntervalMs = input.pollIntervalMs ?? POLL_INTERVAL_MS;
@@ -31860,7 +32155,7 @@ async function connectAgentPresence2(input) {
     const deadline = now3() + pollTimeoutMs;
     let realized = false;
     while (now3() < deadline) {
-      await sleep3(pollIntervalMs);
+      await sleep4(pollIntervalMs);
       const presence = await input.client.getAgentPresence(
         { name: input.agent },
         options
@@ -32613,11 +32908,11 @@ async function activeGrantIds(input) {
   );
 }
 async function waitForNewGrant(input, knownGrantIds) {
-  const sleep3 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const sleep4 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
   const now3 = input.now ?? Date.now;
   const deadline = now3() + (input.pollTimeoutMs ?? POLL_TIMEOUT_MS2);
   while (now3() < deadline) {
-    await sleep3(input.pollIntervalMs ?? POLL_INTERVAL_MS2);
+    await sleep4(input.pollIntervalMs ?? POLL_INTERVAL_MS2);
     const result = await input.client.listConnections({
       provider: input.provider,
       apiBaseUrl: input.apiBaseUrl
@@ -33463,7 +33758,7 @@ function registerOnboardCommands(program, context) {
 }
 
 // src/commands/orgs/commands.ts
-import { Option } from "commander";
+import { Option as Option2 } from "commander";
 function registerOrganizationCommands(program, context) {
   const orgs = program.command("orgs").description("Manage the active organization.");
   orgs.command("use").argument("<organization>").option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").description("Set the active organization.").action(
@@ -33535,7 +33830,7 @@ function registerOrganizationCommands(program, context) {
     }
   });
   orgs.command("invite").description("Invite a user to the active organization by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -33570,7 +33865,7 @@ function registerOrganizationCommands(program, context) {
     }
   });
   members.command("add").description("Invite a user to the active organization by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -33588,7 +33883,7 @@ function registerOrganizationCommands(program, context) {
     );
   });
   members.command("set-role").description("Set an existing active organization member's role.").requiredOption("--email <email>", "Email address of an existing member").addOption(
-    new Option("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
+    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -33634,7 +33929,7 @@ function memberLine(member, style) {
 }
 
 // src/commands/projects/commands.ts
-import { Option as Option2 } from "commander";
+import { Option as Option3 } from "commander";
 init_active_project();
 init_file();
 
@@ -33721,7 +34016,7 @@ function registerProjectCommands(program, context) {
     }
   });
   projects.command("invite").description("Invite a user to the active project by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option3("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(context).inviteProjectMember(
       {
@@ -33752,7 +34047,7 @@ function registerProjectCommands(program, context) {
     }
   });
   members.command("add").description("Invite a user to the active project by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option3("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(context).addProjectMember({
       email: options.email,
@@ -33768,7 +34063,7 @@ function registerProjectCommands(program, context) {
     );
   });
   members.command("set-role").description("Set an existing active project member's role.").requiredOption("--email <email>", "Email address of an existing member").addOption(
-    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
+    new Option3("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -35199,8 +35494,12 @@ function registerSessionCommands(program, context) {
 }
 
 // src/commands/setup/actions.ts
+init_browser();
 init_file();
 init_login();
+var SETUP_STATUS_POLL_INTERVAL_MS = 5e3;
+var SETUP_STATUS_HINT_EVERY_POLLS = 12;
+var SETUP_STATUS_MAX_CONSECUTIVE_ERRORS = 12;
 async function setupAction(context, options) {
   const apiBaseUrl = apiUrlFromOptions(context, options);
   const client = createContextApiClient(context);
@@ -35231,15 +35530,26 @@ async function setupAction(context, options) {
   context.writeOutput("");
   context.writeOutput(`Opened PR #${response.pullRequest.number}.`);
   if (response.pullRequest.url) {
+    if (options.browser !== false) {
+      (options.openBrowser ?? openBrowser)(response.pullRequest.url);
+    }
     context.writeOutput(response.pullRequest.url);
   }
   context.writeOutput("");
-  context.writeOutput("Next steps:");
-  context.writeOutput("1. Review and merge the PR.");
   context.writeOutput(
-    "2. Wait for GitHub Sync to apply the merged `.auto` directory."
+    "Review and merge the PR. Auto will wait here and detect when the onboarding agent has been applied."
   );
-  context.writeOutput("3. Tag `@auto.onboarding` in Slack to begin.");
+  await waitForOnboardingReady(context, client, {
+    apiBaseUrl,
+    githubConnection: github.name,
+    repo,
+    pullRequestNumber: response.pullRequest.number,
+    pollIntervalMs: options.statusPollIntervalMs,
+    sleep: options.sleep
+  });
+  context.writeOutput("");
+  context.writeOutput("Onboarding is ready.");
+  context.writeOutput("Tag `@auto.onboarding` in Slack to begin.");
 }
 async function showPitchAndWait(context) {
   context.writeOutput(setupPitchText());
@@ -35534,6 +35844,68 @@ async function askRequired(context, question) {
     readline.close();
   }
 }
+async function waitForOnboardingReady(context, client, input) {
+  const sleep4 = input.sleep ?? defaultSleep;
+  const pollIntervalMs = input.pollIntervalMs ?? SETUP_STATUS_POLL_INTERVAL_MS;
+  let reportedMerged = false;
+  let reportedApplied = false;
+  let pollCount = 0;
+  let consecutiveStatusErrors = 0;
+  for (; ; ) {
+    pollCount += 1;
+    const status = await client.getSetupOnboardingPullRequestStatus(
+      {
+        githubConnection: input.githubConnection,
+        repo: input.repo,
+        pullRequestNumber: input.pullRequestNumber
+      },
+      { apiBaseUrl: input.apiBaseUrl }
+    ).catch((error51) => {
+      consecutiveStatusErrors += 1;
+      if (consecutiveStatusErrors === 1) {
+        context.writeOutput(
+          "Status check failed; retrying while the onboarding PR remains open."
+        );
+      }
+      if (consecutiveStatusErrors >= SETUP_STATUS_MAX_CONSECUTIVE_ERRORS) {
+        throw error51;
+      }
+      return void 0;
+    });
+    if (!status) {
+      await sleep4(pollIntervalMs);
+      continue;
+    }
+    consecutiveStatusErrors = 0;
+    if (!status.pullRequest.merged && status.pullRequest.state === "closed") {
+      throw new Error(
+        "The onboarding PR was closed without being merged. Re-run `auto setup` to open it again."
+      );
+    }
+    if (!status.pullRequest.merged && status.pullRequest.state !== "open") {
+      throw new Error(
+        `The onboarding PR is in unexpected state "${status.pullRequest.state}". Check the PR, then rerun \`auto setup\` if needed.`
+      );
+    }
+    if (status.pullRequest.merged && !reportedMerged) {
+      context.writeOutput("Detected PR merge.");
+      reportedMerged = true;
+    }
+    if (status.apply.applied && !reportedApplied) {
+      context.writeOutput("Detected GitHub Sync apply.");
+      reportedApplied = true;
+    }
+    if (status.ready) {
+      return;
+    }
+    if (pollCount % SETUP_STATUS_HINT_EVERY_POLLS === 0) {
+      context.writeOutput(
+        status.pullRequest.merged ? "Still waiting for GitHub Sync to apply the onboarding agent..." : "Still waiting for the onboarding PR to be merged..."
+      );
+    }
+    await sleep4(pollIntervalMs);
+  }
+}
 function organizationLabel(organization) {
   return `${organization.organizationName} (${organization.organizationSlug})`;
 }
@@ -35543,6 +35915,9 @@ function isRecord3(value) {
 function isDefined(value) {
   return value !== void 0;
 }
+function defaultSleep(delayMs) {
+  return new Promise((resolve3) => setTimeout(resolve3, delayMs));
+}
 
 // src/commands/setup/commands.ts
 function registerSetupCommands(program, context) {
@@ -35770,7 +36145,7 @@ function createProgram(options = {}) {
   const program = new Command();
   context.globalApiUrl = () => program.opts().apiUrl;
   program.name("auto").description("Auto CLI.").version(cliVersion).addOption(
-    new Option3("--format <format>", "output format").choices([
+    new Option4("--format <format>", "output format").choices([
       "text",
       "json",
       "stream-json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.164",
+  "version": "0.1.166",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"