@webflow/webflow-cli 2.5.0-next.1 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @webflow/webflow-cli
 
+## 2.6.0
+
+### Minor Changes
+
+- 4354c28: After a `cloud`, `devlink`, `extension`, `auth`, or `apps` command succeeds, the CLI now checks once whether the coding agents on your machine have the Webflow skills installed, and offers to install them if they don't. The `apps` command exists on the `@next` build only, so a stable install has no `apps` command to trigger it. You'll see a line naming the agents it found, then a yes/no question; answer either way and it never asks again. Saying yes installs the five `webflow-cli` skills globally — the same place the check looked — so your agent picks them up in every project.
+
+  Nothing about it can affect the command you actually ran. It only appears after the command has already finished successfully, it never runs under `--json`, in CI, or anywhere without a TTY, and a failed install leaves your exit code alone. `extension serve` and `auth status` are excluded. Set `WEBFLOW_NO_SKILLS_PROMPT` to turn it off entirely.
+
+  Also stops the `--api-token` value from being recorded in the telemetry `command` field. Previously the token you passed to `devlink sync`, `devlink export`, `devlink import`, or `devlink bundle` was sent verbatim alongside the rest of your command line.
+
+### Patch Changes
+
+- e48ba9a: Patch the transitive `ws` memory-exhaustion denial-of-service vulnerability used by the CLI's module-federation and JSDOM dependencies.
+
+## 2.5.0
+
+### Minor Changes
+
+- 9bd265d: Stores telemetry configuration globally (colocated with `auth.json`) instead of in a local `webflow.json`. The first-run consent notice no longer creates `webflow.json` for telemetry-only reasons — bare CLI invocations in a project without a manifest leave it untouched. `webflow auth telemetry --enable/--disable` now writes `<configDir>/telemetry.json` (`~/.config/webflow/telemetry.json` on macOS/Linux, `%APPDATA%\webflow\telemetry.json` on Windows). A pre-existing `webflow.json` telemetry setting is still read and continues to override the global config for commands run in that directory. New `--local` flag on `webflow auth telemetry --enable/--disable` opts into writing `webflow.json` in the current directory for users who want a per-project override. `DO_NOT_TRACK` continues to override everything.
+
+### Patch Changes
+
+- b87bab7: Add `feature` field to error and performance telemetry events for unified backend querying
+- e4cad57: Patch transitive `brace-expansion` denial-of-service vulnerabilities used by the CLI's `minimatch` consumers.
+- 1eed47e: Update PostCSS to a patched release.
+  - @webflow/data-types@2.1.1
+
 ## 2.4.0
 
 ### Minor Changes

package/README.md

@@ -299,6 +299,8 @@ webflow extension bundle        # Build and package for upload (outputs bundle.z
 
 ## Apps (Webflow Cloud)
 
+> `apps env-vars` commands are in beta and ship only in `@next` builds (`npm i -g @webflow/webflow-cli@next`). They aren't registered in the stable release yet.
+
 Manage Webflow Cloud app environment variables non-interactively. `--app-id` and
 `--environment-id` default from `webflow.json` (`cloud.app_id` / `cloud.environment_id`)
 when omitted.