@autohq/cli 0.1.363 → 0.1.365

package/dist/agent-bridge.js

@@ -23492,7 +23492,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.363",
+  version: "0.1.365",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -25876,9 +25876,21 @@ var GithubSyncBindingCreateRequestSchema = external_exports.object({
   branch: GithubSyncProductionBranchSchema.optional(),
   ciWatchdog: GithubSyncCiWatchdogSchema.optional()
 });
+var GithubSyncInitialSyncSchema = external_exports.object({
+  started: external_exports.boolean(),
+  headSha: external_exports.string().trim().min(1).optional(),
+  workflowId: external_exports.string().trim().min(1).optional(),
+  reason: external_exports.enum([
+    "no_auto_directory",
+    "already_applied",
+    "probe_failed",
+    "start_failed"
+  ]).optional()
+});
 var GithubSyncBindingCreateResponseSchema = external_exports.object({
   binding: GithubSyncBindingSchema,
-  created: external_exports.boolean()
+  created: external_exports.boolean(),
+  initialSync: GithubSyncInitialSyncSchema.optional()
 });
 var GithubSyncBindingListResponseSchema = external_exports.object({
   bindings: external_exports.array(GithubSyncBindingSchema)
@@ -26188,10 +26200,35 @@ var EncryptedSecretValueSchema = external_exports.object({
   dekAuthTag: SecretAesGcmAuthTagSchema
 });
 var SecretDescriptionSchema = external_exports.string().trim().max(1024);
+var SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+var SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "content-length",
+  "host",
+  "transfer-encoding"
+]);
+var SecretBindingHostSchema = external_exports.string().trim().toLowerCase().regex(
+  SECRET_BINDING_HOST_PATTERN,
+  "Binding hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
+);
+var SecretBindingHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_BINDING_HEADER_PATTERN, "Invalid HTTP header name").refine(
+  (header) => !SECRET_BINDING_FORBIDDEN_HEADERS.has(header.toLowerCase()),
+  "This header cannot carry a secret binding"
+);
+var SecretBindingSchema = external_exports.object({
+  hosts: external_exports.array(SecretBindingHostSchema).min(1).max(16),
+  header: SecretBindingHeaderSchema,
+  format: external_exports.string().min(1).max(256).refine(
+    (format) => format.includes("{value}"),
+    "Binding format must contain the {value} placeholder"
+  ).optional()
+});
 var SecretSetRequestSchema = external_exports.object({
   value: external_exports.string(),
   description: SecretDescriptionSchema.nullable().optional(),
-  protected: external_exports.boolean().optional()
+  protected: external_exports.boolean().optional(),
+  binding: SecretBindingSchema.nullable().optional()
 });
 var SecretRotateRequestSchema = external_exports.object({
   value: external_exports.string()
@@ -26203,6 +26240,9 @@ var SecretMetadataSchema = external_exports.object({
   name: ResourceNameSchema,
   description: external_exports.string().nullable(),
   protected: external_exports.boolean(),
+  // Defaulted rather than required so a newer client parsing an older
+  // server's metadata (deploy skew) treats an absent binding as unbound.
+  binding: SecretBindingSchema.nullable().default(null),
   createdAt: external_exports.string().datetime(),
   updatedAt: external_exports.string().datetime(),
   lastRotatedAt: external_exports.string().datetime().nullable(),
@@ -28793,19 +28833,32 @@ var SetupOnboardingPullRequestSchema = external_exports.object({
   baseBranch: GithubSyncProductionBranchSchema,
   headSha: external_exports.string().trim().min(1)
 });
-var SetupOnboardingPullRequestCreateResponseSchema = external_exports.object({
-  pullRequest: SetupOnboardingPullRequestSchema
+var SetupOnboardingSyncSchema = external_exports.object({
+  branch: GithubSyncProductionBranchSchema,
+  headSha: external_exports.string().trim().min(1).optional(),
+  workflowStarted: external_exports.boolean()
 });
+var SetupOnboardingPullRequestCreateResponseSchema = external_exports.discriminatedUnion("mode", [
+  external_exports.object({
+    mode: external_exports.literal("pull_request"),
+    pullRequest: SetupOnboardingPullRequestSchema
+  }),
+  external_exports.object({
+    mode: external_exports.literal("sync"),
+    sync: SetupOnboardingSyncSchema
+  })
+]);
 var SetupOnboardingPullRequestStatusRequestSchema = external_exports.object({
   githubConnection: external_exports.string().trim().min(1).optional(),
   repo: GithubSyncRepositoryFullNameSchema,
-  pullRequestNumber: external_exports.coerce.number().int().positive()
+  // Absent in sync mode: there is no bootstrap PR, so readiness is apply-only.
+  pullRequestNumber: external_exports.coerce.number().int().positive().optional()
 });
 var SetupOnboardingPullRequestStatusResponseSchema = external_exports.object({
   pullRequest: external_exports.object({
     merged: external_exports.boolean(),
     state: external_exports.string().trim().min(1)
-  }),
+  }).optional(),
   apply: external_exports.object({
     applied: external_exports.boolean()
   }),

package/dist/index.js

@@ -17234,7 +17234,7 @@ var init_connections = __esm({
 });
 
 // ../../packages/schemas/src/github-sync.ts
-var GITHUB_SYNC_AUTO_PATH, GITHUB_SYNC_CI_WATCHDOG_DEFAULT_DELAY_MS, GithubSyncRepositoryFullNameSchema, GithubSyncProductionBranchSchema, GithubSyncCiWatchdogWorkflowSchema, GithubSyncCiWatchdogSchema, GithubSyncBindingSchema, GithubSyncBindingCreateRequestSchema, GithubSyncBindingCreateResponseSchema, GithubSyncBindingListResponseSchema, GithubSyncTriggerArtifactSchema, GithubSyncWorkflowInputSchema, GithubSyncWorkflowResultSchema;
+var GITHUB_SYNC_AUTO_PATH, GITHUB_SYNC_CI_WATCHDOG_DEFAULT_DELAY_MS, GithubSyncRepositoryFullNameSchema, GithubSyncProductionBranchSchema, GithubSyncCiWatchdogWorkflowSchema, GithubSyncCiWatchdogSchema, GithubSyncBindingSchema, GithubSyncBindingCreateRequestSchema, GithubSyncInitialSyncSchema, GithubSyncBindingCreateResponseSchema, GithubSyncBindingListResponseSchema, GithubSyncTriggerArtifactSchema, GithubSyncWorkflowInputSchema, GithubSyncWorkflowResultSchema;
 var init_github_sync = __esm({
   "../../packages/schemas/src/github-sync.ts"() {
     "use strict";
@@ -17280,9 +17280,21 @@ var init_github_sync = __esm({
       branch: GithubSyncProductionBranchSchema.optional(),
       ciWatchdog: GithubSyncCiWatchdogSchema.optional()
     });
+    GithubSyncInitialSyncSchema = external_exports.object({
+      started: external_exports.boolean(),
+      headSha: external_exports.string().trim().min(1).optional(),
+      workflowId: external_exports.string().trim().min(1).optional(),
+      reason: external_exports.enum([
+        "no_auto_directory",
+        "already_applied",
+        "probe_failed",
+        "start_failed"
+      ]).optional()
+    });
     GithubSyncBindingCreateResponseSchema = external_exports.object({
       binding: GithubSyncBindingSchema,
-      created: external_exports.boolean()
+      created: external_exports.boolean(),
+      initialSync: GithubSyncInitialSyncSchema.optional()
     });
     GithubSyncBindingListResponseSchema = external_exports.object({
       bindings: external_exports.array(GithubSyncBindingSchema)
@@ -17587,7 +17599,7 @@ var init_mounts = __esm({
 });
 
 // ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SecretSetRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretRevealResponseSchema;
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SECRET_BINDING_HOST_PATTERN, SECRET_BINDING_HEADER_PATTERN, SECRET_BINDING_FORBIDDEN_HEADERS, SecretBindingHostSchema, SecretBindingHeaderSchema, SecretBindingSchema, SecretSetRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretRevealResponseSchema;
 var init_secrets = __esm({
   "../../packages/schemas/src/secrets.ts"() {
     "use strict";
@@ -17620,10 +17632,35 @@ var init_secrets = __esm({
       dekAuthTag: SecretAesGcmAuthTagSchema
     });
     SecretDescriptionSchema = external_exports.string().trim().max(1024);
+    SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+    SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "content-length",
+      "host",
+      "transfer-encoding"
+    ]);
+    SecretBindingHostSchema = external_exports.string().trim().toLowerCase().regex(
+      SECRET_BINDING_HOST_PATTERN,
+      "Binding hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
+    );
+    SecretBindingHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_BINDING_HEADER_PATTERN, "Invalid HTTP header name").refine(
+      (header) => !SECRET_BINDING_FORBIDDEN_HEADERS.has(header.toLowerCase()),
+      "This header cannot carry a secret binding"
+    );
+    SecretBindingSchema = external_exports.object({
+      hosts: external_exports.array(SecretBindingHostSchema).min(1).max(16),
+      header: SecretBindingHeaderSchema,
+      format: external_exports.string().min(1).max(256).refine(
+        (format) => format.includes("{value}"),
+        "Binding format must contain the {value} placeholder"
+      ).optional()
+    });
     SecretSetRequestSchema = external_exports.object({
       value: external_exports.string(),
       description: SecretDescriptionSchema.nullable().optional(),
-      protected: external_exports.boolean().optional()
+      protected: external_exports.boolean().optional(),
+      binding: SecretBindingSchema.nullable().optional()
     });
     SecretRotateRequestSchema = external_exports.object({
       value: external_exports.string()
@@ -17635,6 +17672,9 @@ var init_secrets = __esm({
       name: ResourceNameSchema,
       description: external_exports.string().nullable(),
       protected: external_exports.boolean(),
+      // Defaulted rather than required so a newer client parsing an older
+      // server's metadata (deploy skew) treats an absent binding as unbound.
+      binding: SecretBindingSchema.nullable().default(null),
       createdAt: external_exports.string().datetime(),
       updatedAt: external_exports.string().datetime(),
       lastRotatedAt: external_exports.string().datetime().nullable(),
@@ -20507,7 +20547,7 @@ var init_session_turns = __esm({
 });
 
 // ../../packages/schemas/src/setup.ts
-var SetupOnboardingPullRequestCreateRequestSchema, SetupOnboardingPullRequestSchema, SetupOnboardingPullRequestCreateResponseSchema, SetupOnboardingPullRequestStatusRequestSchema, SetupOnboardingPullRequestStatusResponseSchema;
+var SetupOnboardingPullRequestCreateRequestSchema, SetupOnboardingPullRequestSchema, SetupOnboardingSyncSchema, SetupOnboardingPullRequestCreateResponseSchema, SetupOnboardingPullRequestStatusRequestSchema, SetupOnboardingPullRequestStatusResponseSchema;
 var init_setup = __esm({
   "../../packages/schemas/src/setup.ts"() {
     "use strict";
@@ -20526,19 +20566,32 @@ var init_setup = __esm({
       baseBranch: GithubSyncProductionBranchSchema,
       headSha: external_exports.string().trim().min(1)
     });
-    SetupOnboardingPullRequestCreateResponseSchema = external_exports.object({
-      pullRequest: SetupOnboardingPullRequestSchema
+    SetupOnboardingSyncSchema = external_exports.object({
+      branch: GithubSyncProductionBranchSchema,
+      headSha: external_exports.string().trim().min(1).optional(),
+      workflowStarted: external_exports.boolean()
     });
+    SetupOnboardingPullRequestCreateResponseSchema = external_exports.discriminatedUnion("mode", [
+      external_exports.object({
+        mode: external_exports.literal("pull_request"),
+        pullRequest: SetupOnboardingPullRequestSchema
+      }),
+      external_exports.object({
+        mode: external_exports.literal("sync"),
+        sync: SetupOnboardingSyncSchema
+      })
+    ]);
     SetupOnboardingPullRequestStatusRequestSchema = external_exports.object({
       githubConnection: external_exports.string().trim().min(1).optional(),
       repo: GithubSyncRepositoryFullNameSchema,
-      pullRequestNumber: external_exports.coerce.number().int().positive()
+      // Absent in sync mode: there is no bootstrap PR, so readiness is apply-only.
+      pullRequestNumber: external_exports.coerce.number().int().positive().optional()
     });
     SetupOnboardingPullRequestStatusResponseSchema = external_exports.object({
       pullRequest: external_exports.object({
         merged: external_exports.boolean(),
         state: external_exports.string().trim().min(1)
-      }),
+      }).optional(),
       apply: external_exports.object({
         applied: external_exports.boolean()
       }),
@@ -30415,10 +30468,13 @@ function createApiClient(input) {
     },
     async getSetupOnboardingPullRequestStatus(request, options = {}) {
       const project = await activeProject();
-      const searchParams = [
-        ["repo", request.repo],
-        ["pullRequestNumber", String(request.pullRequestNumber)]
-      ];
+      const searchParams = [["repo", request.repo]];
+      if (request.pullRequestNumber !== void 0) {
+        searchParams.push([
+          "pullRequestNumber",
+          String(request.pullRequestNumber)
+        ]);
+      }
       if (request.githubConnection) {
         searchParams.push(["githubConnection", request.githubConnection]);
       }
@@ -31549,7 +31605,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.363",
+      version: "0.1.365",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -33347,9 +33403,14 @@ var init_template_variables = __esm({
 });
 
 // ../../packages/schemas/src/project-apply-files/agent-authoring.ts
-function readApplyDocument(path2, document, fileIndex) {
+function readApplyDocument(path2, document, fileIndex, contextVariables) {
   assertAgentAuthoringDocument(document, path2);
-  const result = compileAgentDocumentValue(document, path2, fileIndex);
+  const result = compileAgentDocumentValue(
+    document,
+    path2,
+    fileIndex,
+    contextVariables
+  );
   return result.resources.map((resource) => ({
     resource,
     generatedFromAgent: resource !== result.resource
@@ -33407,12 +33468,13 @@ function dedupeGeneratedResources(records) {
   }
   return deduped.map((record2) => record2.resource);
 }
-function compileAgentDocumentValue(document, path2, fileIndex) {
+function compileAgentDocumentValue(document, path2, fileIndex, contextVariables) {
   return compileAgentDraftResources(
     compileAgentDocument2(document, path2, {
       fileIndex,
       stack: [],
-      variables: /* @__PURE__ */ new Map()
+      variables: /* @__PURE__ */ new Map(),
+      ...contextVariables && Object.keys(contextVariables).length > 0 ? { contextVariables: new Map(Object.entries(contextVariables)) } : {}
     }),
     path2
   );
@@ -33427,7 +33489,10 @@ function compileAgentDocument2(document, path2, context) {
   if (!isRecord2(document)) {
     throw new Error(`Invalid agent authoring file ${path2}: expected object`);
   }
-  const variables = context.stack.length === 0 ? readVariableScope(document, normalizedPath) : context.variables;
+  const variables = context.stack.length === 0 ? new Map([
+    ...context.contextVariables ?? /* @__PURE__ */ new Map(),
+    ...readVariableScope(document, normalizedPath)
+  ]) : context.variables;
   let merged = emptyAgentDraft();
   for (const importPath of importPaths2(document)) {
     const imported = resolveImportPath2(
@@ -33757,7 +33822,10 @@ function readProjectApplyDirectorySource(input) {
   ).sort((left, right) => left.path.localeCompare(right.path));
   const resourceRecords = [];
   for (const file2 of agentFiles) {
-    const request = readProjectApplyDocumentSourceFile(file2, { fileIndex });
+    const request = readProjectApplyDocumentSourceFile(file2, {
+      fileIndex,
+      ...input.contextVariables ? { contextVariables: input.contextVariables } : {}
+    });
     resourceRecords.push(
       ...request.resources.map((resource) => ({
         resource,
@@ -33808,7 +33876,7 @@ function readProjectApplyDocumentSourceFile(file2, options = {}) {
     }
   }
   const resourceRecords = documents.flatMap(
-    (document) => readApplyDocument(file2.path, document, fileIndex)
+    (document) => readApplyDocument(file2.path, document, fileIndex, options.contextVariables)
   );
   return ProjectApplyRequestSchema.parse({
     delete: [],
@@ -49990,7 +50058,8 @@ async function setSecret(input) {
     {
       value,
       ...input.commandOptions.description === void 0 ? {} : { description: input.commandOptions.description },
-      ...resolveProtectedFlag(input.commandOptions)
+      ...resolveProtectedFlag(input.commandOptions),
+      ...resolveBindingFlags(input.commandOptions)
     },
     {
       projectId: await secretProjectId(input),
@@ -50054,6 +50123,30 @@ function resolveProtectedFlag(options) {
   }
   return {};
 }
+function resolveBindingFlags(options) {
+  const hasBindingFlags = (options.bindHost?.length ?? 0) > 0 || options.bindHeader !== void 0 || options.bindFormat !== void 0;
+  if (options.unbind) {
+    if (hasBindingFlags) {
+      throw new Error("Use either --unbind or the --bind-* flags, not both.");
+    }
+    return { binding: null };
+  }
+  if (!hasBindingFlags) {
+    return {};
+  }
+  if (!options.bindHost?.length || options.bindHeader === void 0) {
+    throw new Error(
+      "Binding a secret requires at least one --bind-host and a --bind-header."
+    );
+  }
+  return {
+    binding: {
+      hosts: options.bindHost,
+      header: options.bindHeader,
+      ...options.bindFormat === void 0 ? {} : { format: options.bindFormat }
+    }
+  };
+}
 async function removeSecret(input) {
   await confirmDestructiveAction(input.context, {
     message: `This will remove secret "${input.name}".`,
@@ -50208,7 +50301,18 @@ function registerSecretCommands(program, context) {
   secrets.command("set").description("Create or update a secret without printing its value.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--stdin", "read the secret value from stdin").option("--value <value>", "secret value").option(
     "--from-env <name>",
     "read the secret value from an environment variable"
-  ).option("--description <text>", "human-readable description for the secret").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
+  ).option("--description <text>", "human-readable description for the secret").option(
+    "--bind-host <host>",
+    "bind the secret to an exact destination host (repeatable); bound secrets are injected at the sandbox edge instead of entering the sandbox",
+    (host, hosts) => [...hosts, host],
+    []
+  ).option(
+    "--bind-header <header>",
+    "HTTP header the bound secret is injected into (e.g. Authorization)"
+  ).option(
+    "--bind-format <format>",
+    'header value template around the secret, e.g. "Bearer {value}"'
+  ).option("--unbind", "clear an existing destination binding").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
     "--unprotected",
     "allow scope-gated plaintext reveal of this secret"
   ).option("--raw", "allow empty values and preserve stdin exactly").option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
@@ -51575,7 +51679,7 @@ async function setupAction(rawContext, options) {
     "To kick things off, Auto will open a PR adding an onboarding agent that walks you through the rest of the process. Once you merge the PR, add `@auto` to a Slack channel, tag `@auto.onboarding` in a message, and that agent will take it from there."
   );
   context.writeOutput("");
-  context.writeOutput("Opening the onboarding PR...");
+  context.writeOutput("Preparing the onboarding agent...");
   const response = await client.createSetupOnboardingPullRequest(
     {
       githubConnection: github.name,
@@ -51584,32 +51688,42 @@ async function setupAction(rawContext, options) {
     },
     { apiBaseUrl }
   );
-  context.writeOutput("");
-  context.writeOutput(`Opened PR #${response.pullRequest.number}.`);
-  if (response.pullRequest.url) {
-    await explainBrowserStep(context, {
-      browser: options.browser,
-      heading: "Review the onboarding PR",
-      body: [
-        "Auto will open the pull request it just created.",
-        "Reviewing and merging this PR adds the onboarding agent to `.auto/`. GitHub Sync applies it after merge; then add `@auto` to a Slack channel and tag `@auto.onboarding` to start."
-      ],
-      prompt: "Press Enter to open the PR."
-    });
-    if (options.browser !== false) {
-      (options.openBrowser ?? openBrowser)(response.pullRequest.url);
+  if (response.mode === "sync") {
+    context.writeOutput("");
+    context.writeOutput(
+      `This repo already has Auto set up: found an onboarding agent under \`.auto/agents/\` on ${response.sync.branch}. Syncing its resources instead of opening a PR.`
+    );
+    context.writeOutput(
+      "Auto will wait here and detect when the onboarding agent has been applied."
+    );
+  } else {
+    context.writeOutput("");
+    context.writeOutput(`Opened PR #${response.pullRequest.number}.`);
+    if (response.pullRequest.url) {
+      await explainBrowserStep(context, {
+        browser: options.browser,
+        heading: "Review the onboarding PR",
+        body: [
+          "Auto will open the pull request it just created.",
+          "Reviewing and merging this PR adds the onboarding agent to `.auto/`. GitHub Sync applies it after merge; then add `@auto` to a Slack channel and tag `@auto.onboarding` to start."
+        ],
+        prompt: "Press Enter to open the PR."
+      });
+      if (options.browser !== false) {
+        (options.openBrowser ?? openBrowser)(response.pullRequest.url);
+      }
+      context.writeOutput(response.pullRequest.url);
     }
-    context.writeOutput(response.pullRequest.url);
+    context.writeOutput("");
+    context.writeOutput(
+      "Review and merge the PR. Auto will wait here and detect when the onboarding agent has been applied."
+    );
   }
-  context.writeOutput("");
-  context.writeOutput(
-    "Review and merge the PR. Auto will wait here and detect when the onboarding agent has been applied."
-  );
   await waitForOnboardingReady(context, client, {
     apiBaseUrl,
     githubConnection: github.name,
     repo,
-    pullRequestNumber: response.pullRequest.number,
+    ...response.mode === "pull_request" ? { pullRequestNumber: response.pullRequest.number } : {},
     pollIntervalMs: options.statusPollIntervalMs,
     sleep: options.sleep
   });
@@ -52053,13 +52167,13 @@ async function waitForOnboardingReady(context, client, input) {
       {
         githubConnection: input.githubConnection,
         repo: input.repo,
-        pullRequestNumber: input.pullRequestNumber
+        ...input.pullRequestNumber !== void 0 ? { pullRequestNumber: input.pullRequestNumber } : {}
       },
       { apiBaseUrl: input.apiBaseUrl }
     ).catch((error51) => {
       consecutiveStatusErrors += 1;
       if (consecutiveStatusErrors === 1) {
-        context.writeOutput("Waiting for PR to be merged...");
+        context.writeOutput("Waiting for onboarding to be ready...");
       }
       if (consecutiveStatusErrors >= SETUP_STATUS_MAX_CONSECUTIVE_ERRORS) {
         throw error51;
@@ -52071,17 +52185,18 @@ async function waitForOnboardingReady(context, client, input) {
       continue;
     }
     consecutiveStatusErrors = 0;
-    if (!status.pullRequest.merged && status.pullRequest.state === "closed") {
+    const pullRequest = status.pullRequest;
+    if (pullRequest && !pullRequest.merged && pullRequest.state === "closed") {
       throw new Error(
         "The onboarding PR was closed without being merged. Re-run `auto setup` to open it again."
       );
     }
-    if (!status.pullRequest.merged && status.pullRequest.state !== "open") {
+    if (pullRequest && !pullRequest.merged && pullRequest.state !== "open") {
       throw new Error(
-        `The onboarding PR is in unexpected state "${status.pullRequest.state}". Check the PR, then rerun \`auto setup\` if needed.`
+        `The onboarding PR is in unexpected state "${pullRequest.state}". Check the PR, then rerun \`auto setup\` if needed.`
       );
     }
-    if (status.pullRequest.merged && !reportedMerged) {
+    if (pullRequest?.merged && !reportedMerged) {
       context.writeOutput("Detected PR merge.");
       reportedMerged = true;
     }
@@ -52094,7 +52209,7 @@ async function waitForOnboardingReady(context, client, input) {
     }
     if (pollCount % SETUP_STATUS_HINT_EVERY_POLLS === 0) {
       context.writeOutput(
-        status.pullRequest.merged ? "Still waiting for GitHub Sync to apply the onboarding agent..." : "Still waiting for the onboarding PR to be merged..."
+        !pullRequest || pullRequest.merged ? "Still waiting for GitHub Sync to apply the onboarding agent..." : "Still waiting for the onboarding PR to be merged..."
       );
     }
     await sleep5(pollIntervalMs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.363",
+  "version": "0.1.365",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"