neon 2.45.0 → 2.46.0

package/dist/commands/link.js

@@ -4,6 +4,7 @@ import { applyContext, contextBranch, readContextFile, setContext, updateContext
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { createBranch, pickBranchInteractively, } from "../utils/branch_picker.js";
+import { getCliName } from "../utils/cli_name.js";
 import { hasNeonConfigFile, initCmd } from "./config.js";
 import { autoPullEnvAfterPin, renderAgentPullNote } from "./env.js";
 import { REGIONS } from "./projects.js";
@@ -34,7 +35,7 @@ export const builder = (argv) => argv
         alias: "branch-id",
         describe: "Branch name or ID to pin in the context (resolved to its ID before writing). " +
             "Without it, link only resolves the org and project — pin a branch with " +
-            "`neonctl checkout <branch>` (link never guesses a default).",
+            `\`${getCliName()} checkout <branch>\` (link never guesses a default).`,
         type: "string",
     },
     params: {
@@ -76,7 +77,7 @@ export const builder = (argv) => argv
     .example([
     [
         "$0 link --project-id polished-snowflake-12345678",
-        "Link an existing project (org is inferred); pin a branch later with 'neonctl checkout'",
+        `Link an existing project (org is inferred); pin a branch later with '${getCliName()} checkout'`,
     ],
     [
         "$0 link --org-id org-… --project-name my-app --region-id aws-us-east-2",
@@ -120,9 +121,9 @@ export const handler = async (props) => {
             "Missing inputs and CI environment detected (no TTY for prompts).",
             "",
             "Use one of:",
-            "  neonctl link --agent                                                    (JSON state machine for agents)",
-            "  neonctl link --project-id <project>                                     (link to an existing project; org is inferred)",
-            "  neonctl link --org-id <org> --project-name <name> --region-id <region>  (create a new project and link)",
+            `  ${getCliName()} link --agent                                                    (JSON state machine for agents)`,
+            `  ${getCliName()} link --project-id <project>                                     (link to an existing project; org is inferred)`,
+            `  ${getCliName()} link --org-id <org> --project-name <name> --region-id <region>  (create a new project and link)`,
         ].join("\n"));
         process.exit(1);
         return;
@@ -180,7 +181,7 @@ const validateInputs = (inputs) => {
         throw new Error("Conflicting inputs: --project-id selects an existing project; --project-name and --region-id describe a new one. Pass only one set.");
     }
     if (inputs.projectName && inputs.branch) {
-        throw new Error("Conflicting inputs: --branch pins a branch of an existing project, but --project-name creates a new one. Create the project first, then `neonctl checkout <branch>`.");
+        throw new Error(`Conflicting inputs: --branch pins a branch of an existing project, but --project-name creates a new one. Create the project first, then \`${getCliName()} checkout <branch>\`.`);
     }
 };
 /**
@@ -338,7 +339,7 @@ const resolveBranchRef = async (props, projectId, branchRef) => {
             .map((b) => `${b.id}${b.name ? ` (${b.name})` : ""}`)
             .join(", ")
         : "(none)";
-    throw new LinkInputError(`Branch '${branchRef}' not found in project '${projectId}'. Available branches: ${available}. Pin one with \`neonctl checkout <branch>\`.`, "NOT_FOUND");
+    throw new LinkInputError(`Branch '${branchRef}' not found in project '${projectId}'. Available branches: ${available}. Pin one with \`${getCliName()} checkout <branch>\`.`, "NOT_FOUND");
 };
 /**
  * The value to persist for a branch: prefer its human-readable **name** (nicer
@@ -717,7 +718,7 @@ const runAgent = async (props, inputs) => {
             context_file: props.contextFile,
             context: { orgId, projectId },
             project: { id: projectId },
-            message: `Linked ${props.contextFile} to project ${projectId}${orgSuffix}. No branch pinned — run \`neonctl checkout <branch>\` (omit the branch to list options) to pin one and pull its env vars.`,
+            message: `Linked ${props.contextFile} to project ${projectId}${orgSuffix}. No branch pinned — run \`${getCliName()} checkout <branch>\` (omit the branch to list options) to pin one and pull its env vars.`,
         });
         return;
     }
@@ -737,7 +738,7 @@ const runAgent = async (props, inputs) => {
                 name: region.name,
                 default: region.default,
             })),
-            next_command_template: `neonctl link --agent --org-id ${shellArg(orgId)} --project-name ${shellArg(projectName)} --region-id <region_id>`,
+            next_command_template: `${getCliName()} link --agent --org-id ${shellArg(orgId)} --project-name ${shellArg(projectName)} --region-id <region_id>`,
         });
         return;
     }
@@ -781,7 +782,7 @@ const runAgent = async (props, inputs) => {
     // the instruction rather than silently dropped.
     const projects = await listAllProjects(props, orgId);
     const branchNote = branch
-        ? ` A branch was requested (--branch ${branch}) but a branch can only be pinned once a project is chosen — re-run with --project-id first, then \`neonctl checkout ${branch}\`.`
+        ? ` A branch was requested (--branch ${branch}) but a branch can only be pinned once a project is chosen — re-run with --project-id first, then \`${getCliName()} checkout ${branch}\`.`
         : "";
     emitAgent({
         status: "needs_project",
@@ -796,9 +797,9 @@ const runAgent = async (props, inputs) => {
         })),
         create_option: {
             instruction: "To create a new project, ask the user for a project name. The region can be omitted to receive a follow-up needs_project_details response that lists available regions.",
-            next_command_template: `neonctl link --agent --org-id ${shellArg(orgId)} --project-name <name> --region-id <region_id>`,
+            next_command_template: `${getCliName()} link --agent --org-id ${shellArg(orgId)} --project-name <name> --region-id <region_id>`,
         },
-        next_command_template: `neonctl link --agent --org-id ${shellArg(orgId)} --project-id <project_id>`,
+        next_command_template: `${getCliName()} link --agent --org-id ${shellArg(orgId)} --project-id <project_id>`,
     });
 };
 const emitAgent = (response) => {
@@ -865,7 +866,7 @@ const buildNeedsOrgResponse = (resolution) => {
             status: "needs_org",
             instruction: "This Neon API key is organization-scoped, so the CLI cannot list the user's organizations and no existing project was found to auto-detect the org ID. Ask the user for their Neon organization ID (visible in the Neon Console under the org's Settings page, formatted like `org-bitter-breeze-12345678`) and re-run the next_command_template with that --org-id.",
             options: [],
-            next_command_template: "neonctl link --agent --org-id <org_id>",
+            next_command_template: `${getCliName()} link --agent --org-id <org_id>`,
         };
     }
     const orgs = resolution.orgs;
@@ -875,7 +876,7 @@ const buildNeedsOrgResponse = (resolution) => {
             ? "The user does not belong to any organizations. Ask them to create one in the Neon Console (https://console.neon.tech/) before linking."
             : `Ask the user which of these ${orgs.length} organization${orgs.length === 1 ? "" : "s"} they want to link the current directory to. After they pick one, re-run the next_command_template with the chosen --org-id value.`,
         options: orgs.map((org) => ({ id: org.id, name: org.name })),
-        next_command_template: "neonctl link --agent --org-id <org_id>",
+        next_command_template: `${getCliName()} link --agent --org-id <org_id>`,
     };
 };
 const toAgentError = (err) => {
@@ -954,7 +955,7 @@ const resolveInteractiveBranch = async (props, projectId) => {
     const picked = await pickBranchInteractively(branches, {
         message: "Which branch would you like to link?",
         nonInteractiveMessage: "No branch could be selected without an interactive terminal. " +
-            "Re-run `neonctl link` interactively, or `neonctl checkout <branch>` to pin one.",
+            `Re-run \`${getCliName()} link\` interactively, or \`${getCliName()} checkout <branch>\` to pin one.`,
     });
     if (picked.kind === "existing") {
         const existing = branches.find((b) => b.id === picked.branchId);
@@ -1031,7 +1032,7 @@ const printSummary = (_props, summary) => {
     }
     else if (summary.projectId && !summary.branch && !summary.orgOnly) {
         lines.push("");
-        lines.push("No branch pinned. Run `neonctl checkout <branch>` to pin a branch and pull its env vars.");
+        lines.push(`No branch pinned. Run \`${getCliName()} checkout <branch>\` to pin a branch and pull its env vars.`);
     }
     lines.push("");
     process.stdout.write(`${lines.join("\n")}\n`);

package/dist/commands/projects.js

@@ -4,6 +4,7 @@ import { updateContextFile } from "../context.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { projectCreateRequest, projectUpdateRequest, } from "../parameters.gen.js";
+import { getCliName } from "../utils/cli_name.js";
 import { getComputeUnits } from "../utils/compute_units.js";
 import { psql } from "../utils/psql.js";
 import { writer } from "../writer.js";
@@ -392,11 +393,11 @@ The organization ID has been saved in ${props.contextFile}
 
 If you'd like to change the default organization later, use
 
-    neonctl link --org-id <org_id>
+    ${getCliName()} link --org-id <org_id>
 
 Or to clear the context file and forget the default organization
 
-    neonctl link --clear
+    ${getCliName()} link --clear
 
 `);
     }

package/dist/commands/set_context.js

@@ -1,7 +1,8 @@
 import { applyContext } from "../context.js";
 import { log } from "../log.js";
+import { getCliName } from "../utils/cli_name.js";
 export const command = "set-context";
-export const describe = "Deprecated: use `neonctl link`. Set the .neon context (raw write).";
+export const describe = `Deprecated: use \`${getCliName()} link\`. Set the .neon context (raw write).`;
 export const builder = (argv) => argv.usage("$0 set-context [options]").options({
     "project-id": {
         describe: "Project ID",
@@ -17,9 +18,9 @@ export const builder = (argv) => argv.usage("$0 set-context [options]").options(
     },
 });
 export const handler = (props) => {
-    log.warning("`neonctl set-context` is deprecated and will be removed in a future release. " +
-        "Use `neonctl link` instead — it verifies inputs and infers the org for you " +
-        "(or `neonctl link --no-checks` for the same write-without-checks behavior).");
+    log.warning(`\`${getCliName()} set-context\` is deprecated and will be removed in a future release. ` +
+        `Use \`${getCliName()} link\` instead — it verifies inputs and infers the org for you ` +
+        `(or \`${getCliName()} link --no-checks\` for the same write-without-checks behavior).`);
     const context = {
         projectId: props.projectId,
         orgId: props.orgId,

package/dist/current_branch_fast_path.js

@@ -1,5 +1,6 @@
 import { contextBranch, currentContextFile, readContextFile, } from "./context.js";
 import { log } from "./log.js";
+import { getCliName } from "./utils/cli_name.js";
 /**
  * Offline fast path for `(config) status --current-branch` (used by shell prompts).
  *
@@ -35,7 +36,7 @@ cwd = process.cwd()) => {
         process.stdout.write(`${branch}\n`);
     }
     else {
-        log.info("No branch pinned. Run `neonctl checkout <branch>` to pin a branch and pull its env vars.");
+        log.info(`No branch pinned. Run \`${getCliName()} checkout <branch>\` to pin a branch and pull its env vars.`);
         process.exitCode = 1;
     }
     return true;

package/dist/dev/env.js

@@ -2,6 +2,7 @@ import { loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
 import { fetchEnvReusingSecrets, } from "@neon/env/runtime";
 import { log } from "../log.js";
+import { getCliName } from "../utils/cli_name.js";
 /** The API-targeting options every runtime call forwards from the context. */
 const apiOptions = (ctx) => ({
     ...(ctx.apiKey ? { apiKey: ctx.apiKey } : {}),
@@ -58,7 +59,7 @@ export const resolveNeonEnvVars = async (ctx) => {
     if (config) {
         if (!ctx.projectId || !ctx.branchId) {
             throw new MissingBranchContextError("Found a neon.ts but could not resolve the project/branch. " +
-                "Run `neonctl link` and `neonctl checkout <branch>`, or pass " +
+                `Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass ` +
                 "--project-id / --branch.");
         }
         // Resolve env from the policy with its `preview.functions` removed. Functions carry no
@@ -86,8 +87,8 @@ export const resolveNeonEnvVars = async (ctx) => {
         // the functions API here and only mints a storage credential when a bucket exists.
         return await fetchAndProject(pulled.config, ctx);
     }
-    throw new MissingBranchContextError("No project/branch context found. Link a branch (`neonctl link` / " +
-        "`neonctl checkout`) or pass --project-id and --branch.");
+    throw new MissingBranchContextError(`No project/branch context found. Link a branch (\`${getCliName()} link\` / ` +
+        `\`${getCliName()} checkout\`) or pass --project-id and --branch.`);
 };
 /**
  * `neon dev`'s env resolver: {@link resolveNeonEnvVars} with graceful degradation.
@@ -113,8 +114,8 @@ export const resolveDevEnv = async (ctx) => {
             return {
                 vars: {},
                 skipped: {
-                    reason: "no linked Neon branch — run `neonctl link`, then " +
-                        "`neonctl checkout <branch>`, to inject DATABASE_URL and friends",
+                    reason: `no linked Neon branch — run \`${getCliName()} link\`, then ` +
+                        `\`${getCliName()} checkout <branch>\`, to inject DATABASE_URL and friends`,
                 },
             };
         }
@@ -167,8 +168,8 @@ const assertPolicyMatchesBranch = async (config, ctx) => {
     const names = missing.map((change) => change.identifier).join(", ");
     throw new DevEnvMismatchError(`Your neon.ts declares ${names} for branch ${ctx.branchId}, but the branch ` +
         "does not have it yet, so the matching env vars cannot be injected. " +
-        "Provision it first with `neonctl deploy` (or `neonctl config apply`), " +
-        "then re-run `neonctl dev`.");
+        `Provision it first with \`${getCliName()} deploy\` (or \`${getCliName()} config apply\`), ` +
+        `then re-run \`${getCliName()} dev\`.`);
 };
 /**
  * A planned change that provisions a branch-level resource the branch lacks: a

package/dist/index.js

@@ -1,4 +1,3 @@
-import { basename } from "node:path";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { analyticsMiddleware, closeAnalytics, getAnalyticsEventProperties, initAnalyticsClientMiddleware, sendError, trackEvent, } from "./analytics.js";
@@ -13,6 +12,7 @@ import { isNetworkError, matchErrorCode, NETWORK_ERROR_MESSAGE, } from "./errors
 import { showHelp } from "./help.js";
 import { log } from "./log.js";
 import pkg from "./pkg.js";
+import { getCliName } from "./utils/cli_name.js";
 import { fillInArgs, resolveApiKeyFromEnv } from "./utils/middlewares.js";
 const NO_SUBCOMMANDS_VERBS = [
     // `api <path>` has a handler but no subcommands (like `status`), so the
@@ -159,7 +159,7 @@ builder = builder
     .group("version", "Global options:")
     .alias("version", "v")
     .completion()
-    .scriptName(basename(process.argv[1]) === "neon" ? "neon" : "neonctl")
+    .scriptName(getCliName())
     .epilog("For more information, visit https://neon.com/docs/reference/neon-cli")
     .wrap(null)
     .fail(false);

package/dist/init/agents.js

@@ -0,0 +1,127 @@
+/**
+ * All agents that can be configured via neon-init.
+ * Aligns with add-mcp's supported agents table.
+ * https://github.com/neondatabase/add-mcp#supported-agents
+ */
+export const ALL_CONFIGURABLE_AGENTS = [
+    {
+        editor: "Cursor",
+        addMcpId: "cursor",
+        hint: "Neon Local Connect extension",
+    },
+    {
+        editor: "VS Code",
+        addMcpId: "vscode",
+        hint: "Neon Local Connect extension",
+    },
+    { editor: "Claude CLI", addMcpId: "claude-code", hint: "MCP Server" },
+    {
+        editor: "Claude Desktop",
+        addMcpId: "claude-desktop",
+        hint: "MCP Server",
+    },
+    { editor: "Codex", addMcpId: "codex", hint: "MCP Server" },
+    { editor: "OpenCode", addMcpId: "opencode", hint: "MCP Server" },
+    { editor: "Antigravity", addMcpId: "antigravity", hint: "MCP Server" },
+    { editor: "Cline", addMcpId: "cline", hint: "MCP Server" },
+    { editor: "Cline CLI", addMcpId: "cline-cli", hint: "MCP Server" },
+    { editor: "Gemini CLI", addMcpId: "gemini-cli", hint: "MCP Server" },
+    {
+        editor: "GitHub Copilot CLI",
+        addMcpId: "github-copilot-cli",
+        hint: "MCP Server",
+    },
+    { editor: "Goose", addMcpId: "goose", hint: "MCP Server" },
+    { editor: "MCPorter", addMcpId: "mcporter", hint: "MCP Server" },
+    { editor: "Zed", addMcpId: "zed", hint: "MCP Server" },
+];
+export function getAddMcpAgentId(editor) {
+    const agent = ALL_CONFIGURABLE_AGENTS.find((a) => a.editor === editor);
+    if (!agent) {
+        throw new Error(`No add-mcp agent ID found for editor: ${editor}`);
+    }
+    return agent.addMcpId;
+}
+/**
+ * Maps a raw agent identifier (as reported by agents or passed via --agent)
+ * to the add-mcp compatible agent ID.
+ *
+ * This handles aliases like "copilot" → "vscode", "claude" → "claude-code", etc.
+ */
+const AGENT_ALIAS_TO_MCP_ID = {
+    cursor: "cursor",
+    copilot: "vscode",
+    "github-copilot": "vscode",
+    "vs-code": "vscode",
+    vscode: "vscode",
+    claude: "claude-code",
+    "claude-code": "claude-code",
+    "claude-desktop": "claude-desktop",
+    codex: "codex",
+    opencode: "opencode",
+    antigravity: "antigravity",
+    cline: "cline",
+    "cline-cli": "cline-cli",
+    "gemini-cli": "gemini-cli",
+    gemini: "gemini-cli",
+    goose: "goose",
+    windsurf: "windsurf",
+    "github-copilot-cli": "github-copilot-cli",
+    mcporter: "mcporter",
+    zed: "zed",
+};
+export function resolveAddMcpAgentId(rawAgent) {
+    const resolved = AGENT_ALIAS_TO_MCP_ID[rawAgent.toLowerCase()];
+    if (!resolved) {
+        throw new Error(`Unknown agent: "${rawAgent}". Supported agents: ${Object.keys(AGENT_ALIAS_TO_MCP_ID).join(", ")}`);
+    }
+    return resolved;
+}
+/**
+ * Maps a raw agent identifier to the skills CLI agent name.
+ */
+export function getSkillsAgentName(agent) {
+    switch (agent.toLowerCase()) {
+        case "cursor":
+            return "cursor";
+        case "copilot":
+        case "vscode":
+        case "vs-code":
+        case "github-copilot":
+            return "github-copilot";
+        case "claude":
+        case "claude-code":
+            return "claude-code";
+        case "codex":
+            return "codex";
+        case "opencode":
+            return "opencode";
+        case "antigravity":
+            return "antigravity";
+        case "cline":
+            return "cline";
+        case "gemini-cli":
+            return "gemini-cli";
+        case "goose":
+            return "goose";
+        case "claude-desktop":
+            return "claude-code";
+        case "cline-cli":
+            return "cline";
+        case "gemini":
+            return "gemini-cli";
+        case "windsurf":
+            return "windsurf";
+        case "github-copilot-cli":
+            return "github-copilot";
+        case "mcporter":
+            return "mcporter";
+        case "zed":
+            return "zed";
+        default:
+            // Fall back to "cursor" as a safe default — skills CLI uses the
+            // agent name to pick the output directory (.agents/skills, .cursor/skills, etc.)
+            // and "cursor" uses .agents/skills which works for all agents.
+            return "cursor";
+    }
+}

package/dist/init/auth.js

@@ -0,0 +1,77 @@
+import { log } from "@clack/prompts";
+import { execa } from "execa";
+import { inspectCredentials, interpretCredentials, } from "../_shared/credentials.js";
+import { resolveConfigFile } from "../_shared/paths.js";
+import { DEFAULT_PROFILE } from "../_shared/profiles.js";
+/**
+ * Ensures neonctl is authenticated by running a command that triggers auth if needed
+ * This will automatically start the OAuth flow if the user isn't already authenticated
+ */
+export async function ensureNeonctlAuth(options) {
+    const quiet = options?.json === true;
+    // If already authenticated (e.g. ran in a terminal before), we can proceed
+    const existingToken = await getNeonctlAccessToken();
+    if (existingToken)
+        return true;
+    try {
+        // Use execa to authenticate with neonctl
+        await execa("npx", ["-y", "neonctl", "me"], {
+            // Shows OAuth URL and prompts to the user
+            stdio: "inherit",
+            // Unset CI so neonctl doesn't refuse to open the browser (e.g. when run from agent chat)
+            env: { ...process.env, CI: undefined },
+        });
+        return true;
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : "Unknown error";
+        if (!quiet) {
+            if (msg.includes("interactive auth") || msg.includes("CI")) {
+                log.error("Auth requires an interactive terminal. Run neon init in your system terminal (outside the chat) to sign in.");
+            }
+            else {
+                log.error(`Authentication failed: ${msg}`);
+            }
+        }
+        return false;
+    }
+}
+/**
+ * Checks whether neonctl has stored OAuth credentials.
+ */
+export async function isAuthenticated() {
+    const token = await getNeonctlAccessToken();
+    return token !== null;
+}
+/**
+ * The credential the Neon CLI has stored, or `null` when there is none.
+ *
+ * Shares the reader with `neon` and `@neon/env` rather than keeping a copy — the inline path
+ * resolution this replaced was the third implementation of "where is the config directory", and
+ * it also looked only for `access_token`, so an account signed in with an API key read as not
+ * authenticated and got sent to a browser. See `shared/cli-core/README.md`.
+ *
+ * `null` means *absent*, and only absent. A file that exists and cannot be read throws: this
+ * value decides whether to start a browser sign-in, and a sign-in overwrites the file it could
+ * not read — as a different account, if a different one is chosen. Catching every error here
+ * made a damaged credential indistinguishable from a fresh machine.
+ */
+async function getNeonctlAccessToken() {
+    const { path } = resolveConfigFile("credentials.json");
+    const read = inspectCredentials(path);
+    if (read.kind === "absent")
+        return null;
+    if (read.kind === "unusable") {
+        throw new Error(`${read.reason}. Replace it deliberately with \`neon profile create ${DEFAULT_PROFILE} --force\`, or delete the file.`);
+    }
+    // `neon init` has no profile selection — it reads the default credential and refuses
+    // when one is named, so `DEFAULT` is the only profile this can ever be about.
+    const credential = interpretCredentials(read.credentials, {
+        path,
+        profile: DEFAULT_PROFILE,
+    });
+    if (credential.kind === "api_key")
+        return credential.apiKey;
+    const token = read.credentials.access_token;
+    return typeof token === "string" && token.trim() !== "" ? token : null;
+}