neon 4.6.0 → 4.8.0

package/README.md

@@ -256,14 +256,14 @@ The Neon CLI supports autocompletion, which you can configure in a few easy step
 `link` resolves what it can and **verifies every identifier you pass** before writing, so a `.neon` is never left half-written or pointing at something that doesn't exist:
 
 - **org** is inferred from the project (so `--project-id` alone is enough); it's omitted only when the project has no organization (personal account).
-- **project** is taken from `--project-id` (or chosen interactively / via `--agent`).
-- **branch** is left to an explicit [`neon checkout <branch>`](#checkout) — `link` never silently pins a project's default branch (that would make later commands quietly target, say, production). It only records a branch when you pass `--branch`, when one is already pinned for the same project (preserved), when you pick one in the interactive picker, or for a freshly **created** project (whose single branch is unambiguous).
+- **project** is taken from `--project-id` (or chosen interactively).
+- **branch** is taken from `--branch`, an existing pin for the same project, or the project's branch list: one branch is pinned automatically; several prompt in a TTY, pin the default with `-y`, or stay unpinned for [`neon checkout <branch>`](#checkout). A project with no branches is linked without a pin and says so.
 
 When a branch ends up pinned, `link` also runs [`env pull`](#env-pull) so the branch's Neon env vars (`DATABASE_URL`, …) land in a local `.env`. With no branch pinned there is nothing to pull, so `link` instead nudges you to run `neon checkout`. Pass `--no-env-pull` to skip the pull (for example when injecting env at runtime with `neon-env run` or `neon dev`).
 
 > **Migrating from `set-context`?** `set-context` is **deprecated** in favor of `link` (see [below](#set-context-is-deprecated)). It still works exactly as before for now (a raw write), it just prints a deprecation warning. The `.neon` `branchId` field is also superseded by `branch` (which stores the branch **name** when known); old `branchId` files are still read and are upgraded to `branch` the next time `link`/`checkout` writes the context.
 
-There are three modes:
+There are two modes:
 
 **Interactive (default)** — guided prompts for humans:
 
@@ -282,22 +282,34 @@ Linked .neon:
 
 When you link an **existing** project that has more than one branch, the interactive flow adds a
 final step to pick which branch to pin — the same `＋ Create a new branch…` + list selector used by
-`neon checkout` (a single-branch project is pinned automatically, no prompt). Non-interactive
-`link --project-id …` does **not** prompt or default a branch; it links org + project and leaves
-branch selection to `neon checkout`:
+`neon checkout` (a single-branch project is pinned automatically, no prompt):
 
 ```bash
+$ neon link
 ? Which organization would you like to link? › Personal Org (org-abc123)
 ? Which project would you like to link? › my-app (polished-snowflake-12345678)
 ? Which branch would you like to link? › [default] main (br-main-branch-87654321)
 ```
 
+`link --project-id …` skips org and project. One branch is pinned with no prompt. Several branches
+in a TTY show the branch prompt; `-y` pins the default; no TTY leaves the pin empty for
+`neon checkout`:
+
+```bash
+$ neon link --project-id polished-snowflake-12345678
+? Which branch would you like to link? › [default] main (br-main-branch-87654321)
+```
+
 **Non-interactive (flags or `--params` JSON)** — for scripts and CI:
 
 ```bash
-# Link to an existing project (org is inferred from the project; no branch pinned)
+# Link to an existing project (org is inferred). Pins the only branch;
+# several branches prompt in a TTY, or stay unpinned without one.
 neon link --project-id polished-snowflake-12345678
 
+# Same, pin the project's default branch when several exist
+neon link --project-id polished-snowflake-12345678 -y
+
 # Same, but also pin a branch (name or id — resolved and stored as its name)
 neon link --project-id polished-snowflake-12345678 --branch main
 
@@ -322,64 +334,21 @@ neon link --no-checks --org-id org-abc123 --project-id polished-snowflake-123456
 
 Every supplied identifier is checked before anything is written, with actionable errors — e.g. `Project '…' not found`, `You don't have access to project '…'`, `Organization '…' not found, or your API key doesn't have access to it`, `Project '…' belongs to organization 'A', not 'B'`, or `Branch '…' not found in project '…'. Available branches: …`.
 
-**Agent mode (`--agent`)** — a JSON state machine designed for AI coding assistants. Each invocation returns a single JSON object with a `status` discriminator describing the next step, the available options, and the exact follow-up command to run.
+**Agents and scripts (no TTY):** List, then link. `neon link --help` prints the same recipe.
 
 ```bash
-$ neon link --agent
-{
-  "status": "needs_org",
-  "instruction": "Ask the user which of these 2 organizations they want to link the current directory to. After they pick one, re-run the next_command_template with the chosen --org-id value.",
-  "options": [
-    { "id": "org-abc123", "name": "Personal Org" },
-    { "id": "org-team",   "name": "Team Org" }
-  ],
-  "next_command_template": "neon link --agent --org-id <org_id>"
-}
-
-$ neon link --agent --org-id org-abc123
-{
-  "status": "needs_project",
-  "instruction": "Ask the user whether to link to one of these 1 existing projects (use next_command_template with --project-id) or create a new project (use create_option.next_command_template).",
-  "options": [
-    { "id": "polished-snowflake-12345678", "name": "my-app" }
-  ],
-  "create_option": {
-    "instruction": "To create a new project, ask the user for a project name. The region can be omitted to receive a follow-up needs_project_details response that lists available regions.",
-    "next_command_template": "neon link --agent --org-id org-abc123 --project-name <name> --region-id <region_id>"
-  },
-  "next_command_template": "neon link --agent --org-id org-abc123 --project-id <project_id>"
-}
-
-$ neon link --agent --org-id org-abc123 --project-id polished-snowflake-12345678
-{
-  "status": "linked",
-  "context_file": "/path/to/cwd/.neon",
-  "context": {
-    "orgId": "org-abc123",
-    "projectId": "polished-snowflake-12345678"
-  },
-  "project": { "id": "polished-snowflake-12345678" },
-  "message": "Linked /path/to/cwd/.neon to project polished-snowflake-12345678 (org org-abc123). No branch pinned — run `neon checkout <branch>` (omit the branch to list options) to pin one and pull its env vars."
-}
+neon orgs list --output json
+neon projects list --org-id <org-id> --output json
+neon link --project-id <project-id> [--branch <name> | -y]
+neon link --org-id <org-id> --project-name <name> --region-id aws-us-east-2
 ```
 
-The `linked` response omits `branch` unless one was pinned (via `--branch`, an existing pin, or project creation); pass `--branch <name|id>` to include it. The agent flow also handles project creation: if the agent sends `--project-name` without `--region-id`, the next response is `needs_project_details` with the list of supported regions.
-
-**Organization-scoped API keys** (those created at the organization level rather than the user level) cannot list user organizations or call the regions endpoint. `link` handles this transparently:
+Organization-scoped API keys cannot list user organizations (`orgs list`) or call the regions endpoint:
 
-- If the API key is org-scoped and at least one project already exists in the org, the CLI auto-detects the `org_id` from the first project. In interactive mode it prints an informational message; in `--agent` mode it skips straight to `needs_project`.
-- If the API key is org-scoped and no projects exist yet, `--agent` returns a `needs_org` response with `options: []` and an instruction telling the user to find their org ID in the Neon Console. Interactive mode prints an error pointing to `--org-id`.
-- When the regions endpoint is not allowed, `link` falls back to a built-in static region list.
-
-**Agent error contract**: any unexpected failure in `--agent` mode is reported as JSON to stdout with exit code 1, so agents can always parse the response:
-
-```json
-{
-  "status": "error",
-  "code": "CLIENT_ERROR",
-  "message": "user has no access to projects"
-}
-```
+- Pass `--org-id` (Neon Console → Settings) or `--project-id` (org is inferred from the project).
+- If the key is org-scoped and at least one project already exists, interactive `link` auto-detects the org from the first project and prints an informational message.
+- If no projects exist yet, interactive `link` errors pointing at `--org-id`.
+- When the regions endpoint is not allowed, interactive create falls back to a built-in static region list. Non-interactive create already requires `--region-id`.
 
 **Offline writes (`--no-checks`)** — write the `.neon` with no API calls at all: no org inference, no existence/access verification, no env pull. Because nothing can be resolved offline, it requires both `--org-id` and `--project-id` (`--branch` optional, stored verbatim). Handy for scripted/CI setups or re-creating a `.neon` from values you already trust:
 
@@ -395,7 +364,7 @@ How today's `set-context` uses map onto `link`:
 
 | `set-context` (deprecated)              | Recommended `link` equivalent                                                 |
 | --------------------------------------- | ----------------------------------------------------------------------------- |
-| `neon set-context --project-id <id>` | `neon link --project-id <id>` (infers org + verifies; branch via checkout) |
+| `neon set-context --project-id <id>` | `neon link --project-id <id>` (infers org + verifies; pins the only branch) |
 | `neon set-context --org-id <id>`     | `neon link --org-id <id>`                                                  |
 | `neon set-context --branch-id <id>`  | `neon link --branch <name\|id>`                                            |
 | `neon set-context` (clear)           | `neon link --clear`                                                        |
@@ -700,7 +669,9 @@ When a package cannot be bundled — a native addon with no esbuild loader, or a
 
 ## Scaffold a project (`bootstrap`)
 
-`neon bootstrap` copies a Neon starter template into a new (or current) directory — conceptually like `degit`, but it only pulls from a small set of templates we maintain in the public [`neondatabase/examples`](https://github.com/neondatabase/examples) repo. It requires no Neon login: it just downloads files from GitHub.
+`neon bootstrap` copies a Neon starter template into a new (or current) directory — conceptually like `degit`, but it only pulls from a small set of templates we maintain in the public [`neondatabase/examples`](https://github.com/neondatabase/examples) repo. The template copy needs no Neon login: it downloads files from GitHub.
+
+After scaffolding, an interactive terminal offers agent tooling (the Neon plugin, or skills and MCP separately — never both) and then `neon link`. `--default` / `-y` skips the template, install, git, and agent pickers, then runs `link --yes`. `link --yes` still asks for a project unless one is already linked. `--no-agent-setup` and `--no-link` skip those. Non-interactive without `--default` prints next steps and does not install, set up agents, or link.
 
 Pass a target directory (or `.` for the current one). In an interactive terminal you pick the template from a list; in CI / non-interactive contexts pass `--template <id>`.
 
@@ -708,7 +679,7 @@ Pass a target directory (or `.` for the current one). In an interactive terminal
 # Pick a template interactively and scaffold it into ./my-app
 $ neon bootstrap my-app
 
-# Scaffold a specific template into the current directory (no prompts)
+# Scaffold a specific template into the current directory (skips the template picker)
 $ neon bootstrap . --template hono
 
 # List templates
@@ -720,64 +691,28 @@ $ neon bootstrap --list-templates --output json
 
 The target directory must be empty unless you pass `--force` (a lone `.git` is ignored, so a freshly `git init`ed folder is fine). Symlinks and executable bits in the template are preserved.
 
-## Set up a project for your coding agent (`init`)
+## Set up a project (`init`)
 
-`neon init` wires an existing project up to Neon: it signs you in, installs the Neon MCP server and agent skills into your editor, adds the Neon Local Connect extension for VS Code and Cursor, creates or picks a project, writes `DATABASE_URL` into `.env`, and offers to scaffold migrations.
+`neon init` sets up this directory for Neon.
 
-```bash
-$ neon init
-```
-
-Run in a terminal it prompts you through those steps. This is what the retired `neon-init` package used to do; `npx neon init` replaces it.
+An empty directory (nothing except `.git`) runs `neon bootstrap .` and stops. With `-y` that is `neon bootstrap . --default`. Bootstrap handles scaffolding, agent tooling, and linking.
 
-Two side effects worth knowing before you run it. It **installs or upgrades `neon` globally**, with whichever package manager invoked it — the flow drives Neon by shelling out to the CLI rather than calling the API in-process. And it **writes `.neon`** in the project directory, the same context file `neon link` and `neon checkout` use.
+An existing app installs agent tooling, then `neon link` unless `.neon` already has a projectId, then `neon config init`. Interactive `config init` opens the services picker; `-y` uses `--services none` (starter policy).
 
-### Agent mode
-
-`--agent` turns the same flow into a state machine an AI coding assistant drives. It prints **one JSON object on stdout** and nothing else: a phase response carrying a `status` and a `nextAction` telling the agent what to do next — usually another `neon init` invocation, spelled out as a `command`. The two read-only steps, `status` and `finalize`, return a snapshot instead.
+In an interactive terminal it offers one of: the Neon plugin (`neon plugins`), skills and MCP separately (`neon skills`, then `neon mcp`), or skip agent setup. It never runs plugin and skills+MCP together.
 
 ```bash
-$ neon init --agent --data '{"step":"status"}'
-{
-  "auth": { "authenticated": true },
-  "tooling": { "mcpServer": { "configured": true, "scope": "global" }, "skills": { "installed": false, "scope": null } },
-  "project": { "databaseUrl": false },
-  "migrations": { "tool": "prisma", "hasMigrations": false },
-  "recommendations": [
-    { "priority": "high", "message": "No DATABASE_URL found in .env", "command": "neon init --agent --data '{\"step\":\"db\"}'" },
-    { "priority": "medium", "message": "Neon agent skills not detected in this project", "command": "neon init --agent --data '{\"step\":\"skills\",\"install\":true}'" },
-    { "priority": "medium", "message": "prisma detected but no migrations found", "command": "neon init --agent --data '{\"step\":\"migrations\"}'" }
-  ]
-}
+$ neon init
+$ neon init -y
 ```
 
-`--agent` is implied when stdin is not a TTY and a known agent is detected from the environment (Claude Code, Codex, Cline, Cursor, VS Code, Windsurf).
-
-`--data` takes a JSON object whose `step` selects the phase: `auth`, `db`, `setup`, `getting-started`, `mcp`, `skills`, `migrations`, `neon-auth`, `status`, or `finalize`. Remaining keys are that phase's options. Without `--data`, the orchestrator picks the next phase itself. An unrecognised `step` is refused with the full list.
-
-**Failures are JSON too**, so an agent never has to distinguish "it broke" from "it returned nothing":
-
-```bash
-$ neon init --agent --data '{not json'
-{
-  "success": false,
-  "error": "Invalid JSON in --data flag at position 1. Expected a JSON object."
-}
-$ echo $?
-1
-```
+`-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. Existing app: plugin when a project-level plugin agent is detected (Cursor, Claude Code, Codex); otherwise skills and MCP. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
 
-That message reports where parsing stopped and nothing more. `--data` carries whatever you put in it, and the JSON parser's own message quotes a window of the input, so echoing either would put a connection string or an API key on stdout.
+`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to `bootstrap`, `--yes` to `link`, and `--services none` to `config init`. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
 
-**One exception to "JSON on stdout".** Credentials are resolved before any command runs, so a failure in that step — an unknown `--profile` or `NEON_PROFILE`, `--api-key` and `--profile` together, a `credentials.json` that cannot be read, or an OS keyring item that cannot be read — prints `ERROR: …` on stderr, leaves stdout empty, and exits 1. Treat a non-zero exit with empty stdout as a credential problem and read stderr.
+A failed step stops the rest. `--profile` and `--config-dir` are forwarded to each child. `--output json` and `--output yaml` are refused; the commands init runs print their own output.
 
-| Option | |
-| --- | --- |
-| `--agent`, `-a` | Emit the JSON state machine instead of prompting |
-| `--data <json>` | Route to one phase, with that phase's options |
-| `--skip-migrations` | Leave the migrations phase out of the flow |
-| `--preview` | Enable preview features (scaffolding a project from a template) |
-| `--profile <name>` | Run as that stored account. See [Which credential an invocation uses](#which-credential-an-invocation-uses). |
+`skills` needs Node.js 22.20 or newer. See [`bootstrap`](#scaffold-a-project-bootstrap), [`plugins`](#install-the-neon-plugin-plugins), [`skills`](#install-neon-agent-skills-skills), [`link`](#linking-a-project), and [`mcp`](#install-the-neon-mcp-server-mcp) for what those commands write.
 
 ## Install the Neon MCP server (`mcp`)
 
@@ -1159,7 +1094,7 @@ When both are only environment variables the key wins, which keeps a CI pipeline
 
 `neon auth` and the `profile` subcommands are outside all of this, because they read the same flags to mean something else: `neon auth --profile work` names where to write a credential, and `neon profile create work --api-key …` names one to store.
 
-`neon init` follows the same profile selection: `--profile` and `NEON_PROFILE` pick the stored account. Every `npx neon` it runs, and every command it tells an agent to run (`npx neon …`, `neon init --agent …`), includes `--profile <name>` when a profile was named by `--profile` or `NEON_PROFILE`, and `--config-dir <path>` when you passed `--config-dir`; nothing is added when those were not set. It still ignores `--api-key` and `NEON_API_KEY` for its own credential read and runs as that stored profile (`DEFAULT` when a key was named with no profile). Those keys are also not written onto the emitted commands — putting a key in agent JSON would print it. An ambient `NEON_API_KEY` is inherited by the subprocesses.
+`neon init` forwards `--profile` and `--config-dir` to the commands it runs. An explicit `--api-key` is passed to those children through `NEON_API_KEY`, not argv.
 
 ## API keys (`api-keys`)
 
@@ -1256,8 +1191,8 @@ Id   Name      Project         Created At            Last Used At          Last
 | open                                                                       |                                                                                                              | Open the linked project in Console |
 | config                                                                     | `init`, `status`, `plan`, `apply`                                                                            | Drive a branch from `neon.ts`      |
 | deploy                                                                     |                                                                                                              | Alias for `config apply`           |
-| bootstrap                                                                  |                                                                                                              | Scaffold a project from a template |
-| init                                                                       |                                                                                                              | Set up a project for a coding agent |
+| bootstrap                                                                  |                                                                                                              | Scaffold a template, then agent tooling and link |
+| init                                                                       |                                                                                                              | Empty dir: bootstrap. Existing: agents, link, neon.ts |
 | mcp                                                                        |                                                                                                              | Install the Neon MCP server         |
 | plugins                                                                    |                                                                                                              | Install the Neon plugin             |
 | skills                                                                     | `update`                                                                                                     | Install Neon agent skills           |

package/dist/_chunks/{auth_selection-ktL6uoEe.js → auth_selection-pitMFzDe.js}

@@ -1,4 +1,4 @@
-import "./profiles-D95AeZ5v.js";
+import "./profiles-CvnFEQyd.js";
 //#region ../../internals/cli-core/dist/auth_selection.js
 /**
 * # Which credential an invocation authenticates with

package/dist/_chunks/{credential_io-B1JxWELN.js → credential_io-YeAxg9Xn.js}

@@ -1,6 +1,6 @@
 import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { o as isOwnedCredentialPath } from "./paths-g3DRqJiD.js";
-import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-D95AeZ5v.js";
+import { a as isOwnedCredentialPath } from "./paths-DMq0Lt7a.js";
+import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-CvnFEQyd.js";
 import { tryLoadKeyring } from "../keyring.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { dirname } from "node:path";

package/dist/_chunks/{paths-g3DRqJiD.js → paths-DMq0Lt7a.js}

@@ -148,4 +148,4 @@ const isOwnedCredentialPath = (configDirectory, file) => {
 	return legacy !== void 0 && isInsideConfigDir(legacy, file);
 };
 //#endregion
-export { isInsideConfigDir as a, defaultDir as i, configDir as n, isOwnedCredentialPath as o, credentialsPath as r, resolveConfigFile as s, CREDENTIALS_FILE as t };
+export { isOwnedCredentialPath as a, isInsideConfigDir as i, credentialsPath as n, resolveConfigFile as o, defaultDir as r, CREDENTIALS_FILE as t };

package/dist/_chunks/{profiles-D95AeZ5v.js → profiles-CvnFEQyd.js}

@@ -1,5 +1,5 @@
 import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { i as defaultDir, r as credentialsPath, s as resolveConfigFile } from "./paths-g3DRqJiD.js";
+import { n as credentialsPath, o as resolveConfigFile, r as defaultDir } from "./paths-DMq0Lt7a.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 //#region ../../internals/cli-core/dist/cli_config.js

package/dist/analytics.js

@@ -1,9 +1,9 @@
-import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-B1JxWELN.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-YeAxg9Xn.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { getApiClient, isNeonApiError } from "./api.js";
-import { r as credentialsPath } from "./_chunks/paths-g3DRqJiD.js";
+import { n as credentialsPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 import { getAuthContext } from "./auth_context.js";
 import { isCurrentBranchProbe } from "./context.js";

package/dist/auth_context.js

@@ -1,4 +1,4 @@
-import { o as isOwnedCredentialPath } from "./_chunks/paths-g3DRqJiD.js";
+import { a as isOwnedCredentialPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 //#region src/auth_context.ts
 const locationFromContext = (context) => {

package/dist/commands/auth.js

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-B1JxWELN.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-YeAxg9Xn.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
-import { o as isOwnedCredentialPath } from "../_chunks/paths-g3DRqJiD.js";
+import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
 import { setAuthContext } from "../auth_context.js";
 import { currentContextFile, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
-import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-D95AeZ5v.js";
+import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { auth, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsPath, readClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
@@ -220,10 +220,17 @@ const ensureAuth = async (props) => {
 	if (isMcpOauth(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
+	if (props._[0] === "init") {
+		selectCredential({
+			...credentialInputs(),
+			profileFlag: props.profile
+		});
+		log.debug("init: skipping global auth; child commands authenticate");
+		return;
+	}
 	if (isClaimCommand(props)) return;
 	const isLocalDev = props._[0] === "dev";
 	const isBootstrap = props._[0] === "bootstrap";
-	const isInit = props._[0] === "init";
 	const isMcp = isMcpCommand(props);
 	if (props._[0] === "auth") {
 		props.apiClient = getApiClient({
@@ -334,10 +341,6 @@ const ensureAuth = async (props) => {
 		log.debug("bootstrap: no usable credentials; continuing without auth");
 		return;
 	}
-	if (isInit) {
-		log.debug("init: skipping global auth; init manages its own auth flow");
-		return;
-	}
 	if (isMcp) {
 		log.debug("mcp: no usable credentials; minting requires auth or --oauth");
 		return;

package/dist/commands/bootstrap.js

@@ -2,9 +2,12 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { writer } from "../writer.js";
 import { FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
+import { spawnCliChild } from "../init/child.js";
+import { projectContextFile } from "../init/plan.js";
+import { runScaffoldFollowUp } from "../init/tooling.js";
 import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
@@ -19,7 +22,7 @@ var bootstrap_exports = /* @__PURE__ */ __exportAll({
 });
 const removedAgent = () => `\`${getCliName()} bootstrap --agent\` was removed. List templates with \`${getCliName()} bootstrap --list-templates --output json\`. Scaffold with \`${getCliName()} bootstrap <directory> --template <id>\` or \`${getCliName()} bootstrap <directory> --default\`.`;
 const command = "bootstrap [directory]";
-const describe = "Scaffold a new project from a Neon starter template";
+const describe = "Scaffold a new project from a Neon starter template, then install agent tooling and link a Neon project";
 const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").positional("directory", {
 	describe: "Directory to scaffold into. Use \".\" for the current directory. Omit to be prompted.",
 	type: "string"
@@ -45,7 +48,7 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 	},
 	default: {
 		alias: "y",
-		describe: "Quick start: scaffold the default template (or --template) and run the usual setup (install dependencies, git init) without prompting. Linking is left to you since it needs a project choice.",
+		describe: "Quick start: scaffold the default template (or --template), then install, git, agent tooling, and link --yes. Skips those pickers; link --yes still asks for a project unless one is already linked",
 		type: "boolean",
 		default: false
 	},
@@ -63,8 +66,13 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 		describe: `Run \`${getCliName()} link\` in the scaffolded directory after installing. In interactive mode this is offered as a prompt; use --no-link to skip without being asked.`,
 		type: "boolean",
 		default: true
+	},
+	"agent-setup": {
+		type: "boolean",
+		default: true,
+		describe: "After scaffolding, install the Neon plugin or skills and MCP. Use --no-agent-setup to skip"
 	}
-}).example("$0 bootstrap my-app", "Create ./my-app from an interactively chosen template").example("$0 bootstrap . --template hono", "Scaffold the Hono template into the current directory").example("$0 bootstrap my-app --default", "Quick start: scaffold the default template and run setup without prompting").example("$0 bootstrap --list-templates --output json", "Print the template catalog as JSON").check((argv) => {
+}).example("$0 bootstrap my-app", "Create ./my-app from an interactively chosen template").example("$0 bootstrap . --template hono", "Scaffold the Hono template into the current directory").example("$0 bootstrap my-app --default", "Skip the pickers; link --yes still asks for a project unless one is already linked").example("$0 bootstrap --list-templates --output json", "Print the template catalog as JSON").check((argv) => {
 	if (argv.agent === true) throw new Error(removedAgent());
 	return true;
 }).strict();
@@ -163,12 +171,6 @@ const resolveTargetDir = async (props, interactive, template) => {
 	return resolve(process.cwd(), dir === "." ? "" : dir);
 };
 const defaultDirName = (template) => template.source.subdir.split("/").pop() || template.id;
-/**
-* Download and materialize the template into `targetDir`. The actual
-* download/extract/write lives in `src/init/bootstrap.ts`, shared with `neon init`
-* (exec-bit and symlink fidelity, graceful symlink fallback); here we just
-* frame it with progress logging. Returns the number of files written.
-*/
 const scaffold = async (template, targetDir) => {
 	log.info("Fetching template \"%s\" from GitHub…", template.id);
 	const filesWritten = await scaffoldTemplate(template, targetDir, { onWarn: (message) => {
@@ -198,16 +200,33 @@ const runPostScaffoldSteps = async (props, targetDir, interactive) => {
 		installed = await runCommand(pm, installArgs(pm), targetDir);
 	}
 	if (props.git && !isGitRepo(targetDir) && await confirm("Initialize a git repository?")) await initGitRepo(targetDir);
-	if (props.link) {
-		if (!installed && hasNeonConfig(targetDir)) log.info(`Skipping the Neon link step: \`${getCliName()} link\` reads this project's neon.ts to pull env vars, which needs its dependencies. Run \`${formatInstallCommand(pm)}\`, then \`${getCliName()} link\`.`);
-		else if (await confirm(`Link this project to a Neon project now? (runs ${getCliName()} link)`)) {
-			await runNeonLink(props, targetDir);
-			printNextSteps(targetDir, pm, {
-				installed,
-				suggestLink: false
-			});
-			return;
-		}
+	const skipLink = shouldSkipLinkForDeps(targetDir, installed);
+	if (props.link && skipLink) logSkippedLink(pm);
+	const kids = bootstrapChildren(props, targetDir);
+	await runScaffoldFollowUp({
+		cwd: targetDir,
+		yes: false,
+		skipAgentSetup: props.agentSetup === false,
+		shouldLink: false,
+		linkYes: false,
+		...kids,
+		...props.pickAgentSetup ? { pickAgentSetup: props.pickAgentSetup } : {},
+		...props.hasProjectPlugins ? { hasProjectPlugins: props.hasProjectPlugins } : {}
+	});
+	if (props.link && !skipLink && await confirm(`Link this project to a Neon project now? (runs ${getCliName()} link)`)) {
+		await runScaffoldFollowUp({
+			cwd: targetDir,
+			yes: false,
+			skipAgentSetup: true,
+			shouldLink: true,
+			linkYes: false,
+			...kids
+		});
+		printNextSteps(targetDir, pm, {
+			installed,
+			suggestLink: false
+		});
+		return;
 	}
 	printNextSteps(targetDir, pm, {
 		installed,
@@ -215,20 +234,27 @@ const runPostScaffoldSteps = async (props, targetDir, interactive) => {
 	});
 };
 const installPrompt = (inferred) => inferred ? `Install dependencies with ${inferred}?` : "Install dependencies?";
-/**
-* `--default` quick start: run install + git init without prompting, honoring
-* --no-install / --no-git. Linking is intentionally skipped — it needs an
-* org/project choice we can't make non-interactively — so we point at it in the
-* closing hint instead.
-*/
+/** `link --yes` still asks for a project unless one is already linked. */
 const runDefaultSteps = async (props, targetDir, pm) => {
-	log.info("Quick start (--default): running setup without prompting.");
+	log.info("Quick start (--default): skipping the template, install, git, and agent pickers. link --yes still asks for a project unless one is already linked.");
 	let installed = false;
 	if (props.install) installed = await runCommand(pm, installArgs(pm), targetDir);
 	if (props.git && !isGitRepo(targetDir)) await initGitRepo(targetDir);
+	const skipLink = shouldSkipLinkForDeps(targetDir, installed);
+	if (props.link && skipLink) logSkippedLink(pm);
+	await runScaffoldFollowUp({
+		cwd: targetDir,
+		yes: true,
+		skipAgentSetup: props.agentSetup === false,
+		shouldLink: props.link && !skipLink,
+		linkYes: true,
+		...bootstrapChildren(props, targetDir),
+		...props.pickAgentSetup ? { pickAgentSetup: props.pickAgentSetup } : {},
+		...props.hasProjectPlugins ? { hasProjectPlugins: props.hasProjectPlugins } : {}
+	});
 	printNextSteps(targetDir, pm, {
 		installed,
-		suggestLink: true
+		suggestLink: !(props.link && !skipLink)
 	});
 };
 const isGitRepo = (dir) => existsSync(join(dir, ".git"));
@@ -239,6 +265,24 @@ const NEON_CONFIG_FILENAMES = [
 	"neon.mjs"
 ];
 const hasNeonConfig = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)));
+const shouldSkipLinkForDeps = (dir, installed) => !installed && hasNeonConfig(dir);
+const logSkippedLink = (pm) => {
+	log.info(`Skipping the Neon link step: \`${getCliName()} link\` reads this project's neon.ts to pull env vars, which needs its dependencies. Run \`${formatInstallCommand(pm)}\`, then \`${getCliName()} link\`.`);
+};
+const bootstrapChildren = (props, targetDir) => {
+	const explicitKey = props.profile ? "" : credentialInputs().apiKeyFlag;
+	return {
+		run: props.run ?? spawnCliChild,
+		forward: {
+			...props.configDir ? { configDir: props.configDir } : {},
+			...props.profile ? { profile: props.profile } : {},
+			apiHost: props.apiHost,
+			contextFile: projectContextFile(targetDir, props.contextFile),
+			...props.analytics === false ? { analytics: false } : {}
+		},
+		...explicitKey ? { authEnv: { NEON_API_KEY: explicitKey } } : {}
+	};
+};
 /**
 * Initialize a git repository in the scaffolded directory. Just `git init` — we
 * deliberately don't auto-commit, both to avoid failing on a machine with no
@@ -279,21 +323,6 @@ const selectPackageManager = async () => {
 	});
 	return pm ?? "npm";
 };
-/**
-* Re-invoke this same CLI as `neon link` inside the scaffolded directory, so the
-* new project's `.neon` context (and pulled `.env`) land in the right place and
-* link's own interactive picker drives org/project/branch selection. Re-execing
-* (rather than calling the handler in-process) keeps link running with `cwd` set
-* to the target dir, which is where its env pull writes.
-*/
-const runNeonLink = async (props, targetDir) => {
-	const args = [process.argv[1], "link"];
-	if (props.configDir) args.push("--config-dir", props.configDir);
-	if (props.profile) args.push("--profile", props.profile);
-	args.push("--api-host", props.apiHost, "--output", props.output);
-	const explicitKey = props.profile ? "" : credentialInputs().apiKeyFlag;
-	await runCommand(process.execPath, args, targetDir, explicitKey ? { NEON_API_KEY: explicitKey } : void 0);
-};
 const printScaffolded = (template, targetDir) => {
 	log.info("");
 	log.info("Done. Scaffolded \"%s\" into %s.", template.title, isCurrentDir(targetDir) ? "the current directory" : displayDir(targetDir));

package/dist/commands/claim.js

@@ -5,7 +5,7 @@ import { applyContext, contextBranch, ensureGitignored, readContextFile } from "
 import { declaredNeonServices } from "../config_services.js";
 import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, writeClaimableCredentials } from "../claimable/state.js";
 import { writer } from "../writer.js";

package/dist/commands/env.js

@@ -19,8 +19,7 @@ var env_exports = /* @__PURE__ */ __exportAll({
 	command: () => "env",
 	describe: () => describe,
 	handler: () => handler,
-	pull: () => pull,
-	renderAgentPullNote: () => renderAgentPullNote
+	pull: () => pull
 });
 const command = "env";
 const describe = "Manage a branch's Neon env variables locally";
@@ -229,8 +228,7 @@ const pickSelectedVars = (vars, selectedKeys) => {
 * On by default; `--no-env-pull` opts out (e.g. when env is injected at runtime via
 * `neon-env run` / `neon dev`, or to keep secrets out of the working tree). The pin is the
 * command's primary effect and has already succeeded by the time this runs, so a pull failure
-* degrades to a warning rather than failing the command. Returns what happened so
-* `link --agent` can fold an accurate note into its JSON message.
+* degrades to a warning rather than failing the command.
 */
 const autoPullEnvAfterPin = async (props) => {
 	if (!props.envPull) {
@@ -250,21 +248,6 @@ Run \`${getCliName()} env pull\` once resolved (e.g. \`${getCliName()} deploy\`
 	}
 };
 /**
-* Render the one-line env-pull note appended to `link --agent`'s JSON `message`, so an agent
-* reading the structured output knows whether its branch env is already on disk.
-*/
-const renderAgentPullNote = (result) => {
-	switch (result.status) {
-		case "written": {
-			const credential = result.credential?.issued ? ` Issued a new branch credential, so ${result.credential.keys.join(", ")} changed.` : "";
-			return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.${credential}`;
-		}
-		case "empty": return " No Neon env vars to pull for this branch yet.";
-		case "skipped": return ` Skipped env pull (--no-env-pull); run \`${getCliName()} env pull\` later, or inject env at runtime with \`neon-env run -- <your dev command>\`.`;
-		case "failed": return ` Could not pull env vars (${result.message}); run \`${getCliName()} env pull\` once resolved.`;
-	}
-};
-/**
 * Keep only the recognized Neon variables from the resolved set, so a stray inherited
 * value never lands in the user's `.env` file. (Today `resolveNeonEnvVars` only emits Neon
 * vars, but filtering keeps the contract explicit and future-proof.)
@@ -278,4 +261,4 @@ const pickNeonVars = (vars) => {
 	return out;
 };
 //#endregion
-export { ENV_PULL_SKIPPED_HINT, autoPullEnvAfterPin, builder, command, describe, handler, pull, renderAgentPullNote, env_exports as t };
+export { ENV_PULL_SKIPPED_HINT, autoPullEnvAfterPin, builder, command, describe, handler, pull, env_exports as t };