workos 0.15.1 → 0.16.0

package/dist/commands/login.js

@@ -1,4 +1,4 @@
-import open from 'opn';
+import open from 'open';
 import chalk from 'chalk';
 import clack from '../utils/clack.js';
 import { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';
@@ -11,7 +11,7 @@ import { formatWorkOSCommand } from '../utils/command-invocation.js';
 import { autoInstallSkills } from './install-skill.js';
 import { isJsonMode } from '../utils/output.js';
 import { isAgentMode, isCiMode } from '../utils/interaction-mode.js';
-import { exitWithAuthRequired } from '../utils/exit-codes.js';
+import { ExitCode, exitWithAuthRequired, exitWithCode } from '../utils/exit-codes.js';
 import { requestDeviceCode, pollForToken, DeviceAuthTimeoutError } from '../lib/device-auth.js';
 import { observeHostFailure } from '../lib/host-probe.js';
 /**
@@ -118,7 +118,7 @@ export async function runLogin() {
     catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
         clack.log.error(`Failed to start authentication: ${msg}`);
-        process.exit(1);
+        exitWithCode(ExitCode.GENERAL_ERROR);
     }
     clack.log.info(`\nOpen this URL in your browser:\n`);
     console.log(`  ${deviceAuth.verification_uri}`);
@@ -178,7 +178,7 @@ export async function runLogin() {
             const msg = error instanceof Error ? error.message : String(error);
             clack.log.error(`Authentication error: ${msg}`);
         }
-        process.exit(1);
+        exitWithCode(ExitCode.GENERAL_ERROR);
     }
 }
 //# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,IAAI,aAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC1E,sEAAsE;YACtE,+CAA+C;YAC/C,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;YAAS,CAAC;QACT,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE9D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG;YAC/B,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACzC,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACvC,CAAC;QAED,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,8CAA8C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,uDAAuD,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,YAAY,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxE,OAAO,CAAC,6CAA6C,CAAC,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,aAAa,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,oBAAoB,CAClB,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,gBAAgB,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,UAAU,CAAC,yBAAyB;YAC5C,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;YACxD,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAExE,eAAe,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,YAAY,UAAU,CAAC,CAAC;QAE3D,MAAM,WAAW,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,uBAAuB,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC","sourcesContent":["import open from 'opn';\nimport chalk from 'chalk';\nimport clack from '../utils/clack.js';\nimport { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';\nimport { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';\nimport { refreshAccessToken } from '../lib/token-refresh-client.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { fetchStagingCredentials } from '../lib/staging-api.js';\nimport { getConfig, saveConfig } from '../lib/config-store.js';\nimport type { CliConfig } from '../lib/config-store.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { autoInstallSkills } from './install-skill.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { isAgentMode, isCiMode } from '../utils/interaction-mode.js';\nimport { exitWithAuthRequired } from '../utils/exit-codes.js';\nimport { requestDeviceCode, pollForToken, DeviceAuthTimeoutError } from '../lib/device-auth.js';\nimport { observeHostFailure } from '../lib/host-probe.js';\n\n/**\n * Best-effort skill install after a successful auth-login.\n *\n * Mirrors the install.ts hook copy, but wraps `autoInstallSkills` in its own\n * try/catch AND a 30s timeout so a skill install hang (e.g. blocked filesystem\n * call) never blocks login completion. Login already succeeded by the time\n * this runs — the user having a working session is the contract that must hold.\n *\n * Extracted from runLogin so it can be unit-tested without standing up the\n * device-auth polling loop.\n */\nexport const SKILL_INSTALL_TIMEOUT_MS = 30 * 1000;\n\nexport async function installSkillsAfterLogin(): Promise<void> {\n  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const timeout = new Promise<null>((resolve) => {\n      timeoutHandle = setTimeout(() => resolve(null), SKILL_INSTALL_TIMEOUT_MS);\n      // Don't keep the event loop alive on this timer — process should exit\n      // immediately if everything else has resolved.\n      timeoutHandle.unref?.();\n    });\n    const result = await Promise.race([autoInstallSkills(), timeout]);\n    if (result && !isJsonMode()) {\n      const skillWord = result.skills.length === 1 ? 'skill' : 'skills';\n      clack.log.info(`Installed ${result.skills.length} WorkOS ${skillWord} for ${result.agents.join(', ')}.`);\n    }\n  } catch {\n    // Skill install must never fail login.\n  } finally {\n    if (timeoutHandle) clearTimeout(timeoutHandle);\n  }\n}\n\n/**\n * Auto-provision a staging environment after login.\n *\n * Fetches staging credentials using the access token, then saves them\n * as a \"staging\" environment in the config store. Non-fatal — logs a\n * hint on failure instead of throwing.\n */\nexport async function provisionStagingEnvironment(accessToken: string): Promise<boolean> {\n  try {\n    const staging = await fetchStagingCredentials(accessToken);\n\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    const isFirst = Object.keys(config.environments).length === 0;\n\n    config.environments['staging'] = {\n      name: 'staging',\n      type: 'sandbox',\n      apiKey: staging.apiKey,\n      clientId: staging.clientId,\n    };\n\n    if (isFirst || !config.activeEnvironment) {\n      config.activeEnvironment = 'staging';\n    }\n\n    saveConfig(config);\n    logInfo('[login] Staging environment auto-provisioned');\n    return true;\n  } catch (error) {\n    logError('[login] Failed to auto-provision staging environment:', error instanceof Error ? error.message : error);\n    return false;\n  }\n}\n\nexport async function runLogin(): Promise<void> {\n  const clientId = getCliAuthClientId();\n\n  // Check if already logged in with valid token\n  if (getAccessToken()) {\n    const creds = getCredentials();\n    console.log(chalk.green(`Already logged in as ${creds?.email ?? 'unknown'}`));\n    console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n    return;\n  }\n\n  // Try to refresh if we have expired credentials with a refresh token\n  const existingCreds = getCredentials();\n  if (existingCreds?.refreshToken && isTokenExpired(existingCreds)) {\n    try {\n      const authkitDomain = getAuthkitDomain();\n      const result = await refreshAccessToken(authkitDomain, clientId);\n      if (result.accessToken && result.expiresAt) {\n        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n        logInfo('[login] Session refreshed via refresh token');\n        console.log(chalk.green(`Already logged in as ${existingCreds.email ?? 'unknown'}`));\n        console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n        return;\n      }\n    } catch {\n      // Refresh failed, proceed with fresh login\n    }\n  }\n\n  if (isCiMode()) {\n    exitWithAuthRequired(\n      'Browser authentication is not available in CI mode. Set WORKOS_API_KEY or configure credentials before running in CI.',\n    );\n  }\n\n  const authkitDomain = getAuthkitDomain();\n\n  clack.log.step('Starting authentication...');\n\n  let deviceAuth;\n  try {\n    deviceAuth = await requestDeviceCode({ clientId, authkitDomain });\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    clack.log.error(`Failed to start authentication: ${msg}`);\n    process.exit(1);\n  }\n\n  clack.log.info(`\\nOpen this URL in your browser:\\n`);\n  console.log(`  ${deviceAuth.verification_uri}`);\n  console.log(`\\nEnter code: ${deviceAuth.user_code}\\n`);\n\n  try {\n    await open(deviceAuth.verification_uri_complete, { wait: false });\n    if (isAgentMode()) {\n      clack.log.info('Browser launch attempted. If it did not open on the host, use the manual URL and code above.');\n    } else {\n      clack.log.info('Browser opened automatically');\n    }\n  } catch (error) {\n    observeHostFailure('browser-launch', error, {\n      operation: 'open',\n      target: deviceAuth.verification_uri_complete,\n      label: 'auth login browser',\n    });\n    clack.log.info('Could not open browser — open the URL above manually.');\n  }\n\n  const spinner = clack.spinner();\n  spinner.start('Waiting for authentication...');\n\n  try {\n    const result = await pollForToken(deviceAuth.device_code, {\n      clientId,\n      authkitDomain,\n      interval: deviceAuth.interval,\n    });\n\n    const expiresInSec = Math.round((result.expiresAt - Date.now()) / 1000);\n\n    saveCredentials({\n      accessToken: result.accessToken,\n      expiresAt: result.expiresAt,\n      userId: result.userId,\n      email: result.email,\n      refreshToken: result.refreshToken,\n    });\n\n    spinner.stop('Authentication successful!');\n    clack.log.success(`Logged in as ${result.email || result.userId}`);\n    clack.log.info(`Token expires in ${expiresInSec} seconds`);\n\n    const provisioned = await provisionStagingEnvironment(result.accessToken);\n    if (provisioned) {\n      clack.log.success('Staging environment configured automatically');\n    } else {\n      clack.log.info(chalk.dim('Run `workos env add` to configure an environment manually'));\n    }\n\n    await installSkillsAfterLogin();\n  } catch (error) {\n    if (error instanceof DeviceAuthTimeoutError) {\n      spinner.stop('Authentication timed out');\n      clack.log.error('Authentication timed out. Please try again.');\n    } else {\n      spinner.stop('Authentication failed');\n      const msg = error instanceof Error ? error.message : String(error);\n      clack.log.error(`Authentication error: ${msg}`);\n    }\n    process.exit(1);\n  }\n}\n"]}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,IAAI,aAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC1E,sEAAsE;YACtE,+CAA+C;YAC/C,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;YAAS,CAAC;QACT,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE9D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG;YAC/B,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACzC,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACvC,CAAC;QAED,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,8CAA8C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,uDAAuD,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,YAAY,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxE,OAAO,CAAC,6CAA6C,CAAC,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,aAAa,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,oBAAoB,CAClB,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QAC1D,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,gBAAgB,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,UAAU,CAAC,yBAAyB;YAC5C,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;YACxD,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAExE,eAAe,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,YAAY,UAAU,CAAC,CAAC;QAE3D,MAAM,WAAW,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,uBAAuB,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import open from 'open';\nimport chalk from 'chalk';\nimport clack from '../utils/clack.js';\nimport { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';\nimport { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';\nimport { refreshAccessToken } from '../lib/token-refresh-client.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { fetchStagingCredentials } from '../lib/staging-api.js';\nimport { getConfig, saveConfig } from '../lib/config-store.js';\nimport type { CliConfig } from '../lib/config-store.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { autoInstallSkills } from './install-skill.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { isAgentMode, isCiMode } from '../utils/interaction-mode.js';\nimport { ExitCode, exitWithAuthRequired, exitWithCode } from '../utils/exit-codes.js';\nimport { requestDeviceCode, pollForToken, DeviceAuthTimeoutError } from '../lib/device-auth.js';\nimport { observeHostFailure } from '../lib/host-probe.js';\n\n/**\n * Best-effort skill install after a successful auth-login.\n *\n * Mirrors the install.ts hook copy, but wraps `autoInstallSkills` in its own\n * try/catch AND a 30s timeout so a skill install hang (e.g. blocked filesystem\n * call) never blocks login completion. Login already succeeded by the time\n * this runs — the user having a working session is the contract that must hold.\n *\n * Extracted from runLogin so it can be unit-tested without standing up the\n * device-auth polling loop.\n */\nexport const SKILL_INSTALL_TIMEOUT_MS = 30 * 1000;\n\nexport async function installSkillsAfterLogin(): Promise<void> {\n  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const timeout = new Promise<null>((resolve) => {\n      timeoutHandle = setTimeout(() => resolve(null), SKILL_INSTALL_TIMEOUT_MS);\n      // Don't keep the event loop alive on this timer — process should exit\n      // immediately if everything else has resolved.\n      timeoutHandle.unref?.();\n    });\n    const result = await Promise.race([autoInstallSkills(), timeout]);\n    if (result && !isJsonMode()) {\n      const skillWord = result.skills.length === 1 ? 'skill' : 'skills';\n      clack.log.info(`Installed ${result.skills.length} WorkOS ${skillWord} for ${result.agents.join(', ')}.`);\n    }\n  } catch {\n    // Skill install must never fail login.\n  } finally {\n    if (timeoutHandle) clearTimeout(timeoutHandle);\n  }\n}\n\n/**\n * Auto-provision a staging environment after login.\n *\n * Fetches staging credentials using the access token, then saves them\n * as a \"staging\" environment in the config store. Non-fatal — logs a\n * hint on failure instead of throwing.\n */\nexport async function provisionStagingEnvironment(accessToken: string): Promise<boolean> {\n  try {\n    const staging = await fetchStagingCredentials(accessToken);\n\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    const isFirst = Object.keys(config.environments).length === 0;\n\n    config.environments['staging'] = {\n      name: 'staging',\n      type: 'sandbox',\n      apiKey: staging.apiKey,\n      clientId: staging.clientId,\n    };\n\n    if (isFirst || !config.activeEnvironment) {\n      config.activeEnvironment = 'staging';\n    }\n\n    saveConfig(config);\n    logInfo('[login] Staging environment auto-provisioned');\n    return true;\n  } catch (error) {\n    logError('[login] Failed to auto-provision staging environment:', error instanceof Error ? error.message : error);\n    return false;\n  }\n}\n\nexport async function runLogin(): Promise<void> {\n  const clientId = getCliAuthClientId();\n\n  // Check if already logged in with valid token\n  if (getAccessToken()) {\n    const creds = getCredentials();\n    console.log(chalk.green(`Already logged in as ${creds?.email ?? 'unknown'}`));\n    console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n    return;\n  }\n\n  // Try to refresh if we have expired credentials with a refresh token\n  const existingCreds = getCredentials();\n  if (existingCreds?.refreshToken && isTokenExpired(existingCreds)) {\n    try {\n      const authkitDomain = getAuthkitDomain();\n      const result = await refreshAccessToken(authkitDomain, clientId);\n      if (result.accessToken && result.expiresAt) {\n        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n        logInfo('[login] Session refreshed via refresh token');\n        console.log(chalk.green(`Already logged in as ${existingCreds.email ?? 'unknown'}`));\n        console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n        return;\n      }\n    } catch {\n      // Refresh failed, proceed with fresh login\n    }\n  }\n\n  if (isCiMode()) {\n    exitWithAuthRequired(\n      'Browser authentication is not available in CI mode. Set WORKOS_API_KEY or configure credentials before running in CI.',\n    );\n  }\n\n  const authkitDomain = getAuthkitDomain();\n\n  clack.log.step('Starting authentication...');\n\n  let deviceAuth;\n  try {\n    deviceAuth = await requestDeviceCode({ clientId, authkitDomain });\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    clack.log.error(`Failed to start authentication: ${msg}`);\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n\n  clack.log.info(`\\nOpen this URL in your browser:\\n`);\n  console.log(`  ${deviceAuth.verification_uri}`);\n  console.log(`\\nEnter code: ${deviceAuth.user_code}\\n`);\n\n  try {\n    await open(deviceAuth.verification_uri_complete, { wait: false });\n    if (isAgentMode()) {\n      clack.log.info('Browser launch attempted. If it did not open on the host, use the manual URL and code above.');\n    } else {\n      clack.log.info('Browser opened automatically');\n    }\n  } catch (error) {\n    observeHostFailure('browser-launch', error, {\n      operation: 'open',\n      target: deviceAuth.verification_uri_complete,\n      label: 'auth login browser',\n    });\n    clack.log.info('Could not open browser — open the URL above manually.');\n  }\n\n  const spinner = clack.spinner();\n  spinner.start('Waiting for authentication...');\n\n  try {\n    const result = await pollForToken(deviceAuth.device_code, {\n      clientId,\n      authkitDomain,\n      interval: deviceAuth.interval,\n    });\n\n    const expiresInSec = Math.round((result.expiresAt - Date.now()) / 1000);\n\n    saveCredentials({\n      accessToken: result.accessToken,\n      expiresAt: result.expiresAt,\n      userId: result.userId,\n      email: result.email,\n      refreshToken: result.refreshToken,\n    });\n\n    spinner.stop('Authentication successful!');\n    clack.log.success(`Logged in as ${result.email || result.userId}`);\n    clack.log.info(`Token expires in ${expiresInSec} seconds`);\n\n    const provisioned = await provisionStagingEnvironment(result.accessToken);\n    if (provisioned) {\n      clack.log.success('Staging environment configured automatically');\n    } else {\n      clack.log.info(chalk.dim('Run `workos env add` to configure an environment manually'));\n    }\n\n    await installSkillsAfterLogin();\n  } catch (error) {\n    if (error instanceof DeviceAuthTimeoutError) {\n      spinner.stop('Authentication timed out');\n      clack.log.error('Authentication timed out. Please try again.');\n    } else {\n      spinner.stop('Authentication failed');\n      const msg = error instanceof Error ? error.message : String(error);\n      clack.log.error(`Authentication error: ${msg}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}

package/dist/commands/migrations.d.ts

@@ -1,2 +1,2 @@
 export declare function getMigrationsPassthroughArgs(rawArgs: string[]): string[];
-export declare function runMigrations(args: string[], apiKey?: string): Promise<void>;
+export declare function runMigrations(args: string[], apiKey?: string, apiBaseUrl?: string): Promise<void>;

package/dist/commands/migrations.js

@@ -35,10 +35,13 @@ export function getMigrationsPassthroughArgs(rawArgs) {
     }
     return passthrough;
 }
-export async function runMigrations(args, apiKey) {
+export async function runMigrations(args, apiKey, apiBaseUrl) {
     if (apiKey) {
         process.env.WORKOS_SECRET_KEY = apiKey;
     }
+    if (apiBaseUrl) {
+        process.env.WORKOS_API_URL = apiBaseUrl;
+    }
     const { program } = (await import('@workos/migrations/dist/cli/index.js'));
     program.name('workos migrations');
     await program.parseAsync(args, { from: 'user' });

package/dist/commands/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/commands/migrations.ts"],"names":[],"mappings":"AAAA,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,CAAC,WAAW,EAAE,IAAI,CAAC;IACnB,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAC7B,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,QAAQ,EAAE,IAAI,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAAC,OAAiB;IAC5D,IAAI,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,aAAa,GAAG,CAAC,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,MAAe;IACjE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAKxE,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC","sourcesContent":["const workosOnlyMigrationsFlags = new Map([\n  ['--api-key', true],\n  ['--insecure-storage', false],\n  ['--json', false],\n  ['--mode', true],\n]);\n\nexport function getMigrationsPassthroughArgs(rawArgs: string[]): string[] {\n  let migrationsIdx = rawArgs.indexOf('migrations');\n\n  for (let i = 0; i < rawArgs.length; i++) {\n    const arg = rawArgs[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    if (arg === 'migrations') {\n      migrationsIdx = i;\n      break;\n    }\n  }\n\n  const after = rawArgs.slice(migrationsIdx + 1);\n  const passthrough: string[] = [];\n\n  for (let i = 0; i < after.length; i++) {\n    const arg = after[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    passthrough.push(arg);\n  }\n\n  return passthrough;\n}\n\nexport async function runMigrations(args: string[], apiKey?: string): Promise<void> {\n  if (apiKey) {\n    process.env.WORKOS_SECRET_KEY = apiKey;\n  }\n\n  const { program } = (await import('@workos/migrations/dist/cli/index.js')) as {\n    program: {\n      name(str: string): unknown;\n      parseAsync(argv: string[], options?: { from: 'user' }): Promise<unknown>;\n    };\n  };\n\n  program.name('workos migrations');\n  await program.parseAsync(args, { from: 'user' });\n}\n"]}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/commands/migrations.ts"],"names":[],"mappings":"AAAA,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,CAAC,WAAW,EAAE,IAAI,CAAC;IACnB,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAC7B,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,QAAQ,EAAE,IAAI,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAAC,OAAiB;IAC5D,IAAI,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,aAAa,GAAG,CAAC,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,MAAe,EAAE,UAAmB;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;IAC1C,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAKxE,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC","sourcesContent":["const workosOnlyMigrationsFlags = new Map([\n  ['--api-key', true],\n  ['--insecure-storage', false],\n  ['--json', false],\n  ['--mode', true],\n]);\n\nexport function getMigrationsPassthroughArgs(rawArgs: string[]): string[] {\n  let migrationsIdx = rawArgs.indexOf('migrations');\n\n  for (let i = 0; i < rawArgs.length; i++) {\n    const arg = rawArgs[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    if (arg === 'migrations') {\n      migrationsIdx = i;\n      break;\n    }\n  }\n\n  const after = rawArgs.slice(migrationsIdx + 1);\n  const passthrough: string[] = [];\n\n  for (let i = 0; i < after.length; i++) {\n    const arg = after[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    passthrough.push(arg);\n  }\n\n  return passthrough;\n}\n\nexport async function runMigrations(args: string[], apiKey?: string, apiBaseUrl?: string): Promise<void> {\n  if (apiKey) {\n    process.env.WORKOS_SECRET_KEY = apiKey;\n  }\n  if (apiBaseUrl) {\n    process.env.WORKOS_API_URL = apiBaseUrl;\n  }\n\n  const { program } = (await import('@workos/migrations/dist/cli/index.js')) as {\n    program: {\n      name(str: string): unknown;\n      parseAsync(argv: string[], options?: { from: 'user' }): Promise<unknown>;\n    };\n  };\n\n  program.name('workos migrations');\n  await program.parseAsync(args, { from: 'user' });\n}\n"]}

package/dist/commands/telemetry.d.ts

@@ -0,0 +1,3 @@
+export declare function runTelemetryOptOut(): Promise<void>;
+export declare function runTelemetryOptIn(): Promise<void>;
+export declare function runTelemetryStatus(): Promise<void>;

package/dist/commands/telemetry.js

@@ -0,0 +1,88 @@
+import chalk from 'chalk';
+import { envTelemetryOverride, getTelemetrySource, isTelemetryEnabled, isTelemetryOptedOut, setTelemetryOptedOut, } from '../lib/preferences.js';
+import { isJsonMode, outputJson, exitWithError } from '../utils/output.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
+/**
+ * Persist an opt-out/opt-in change, surfacing a clear error if the write fails
+ * (read-only FS, permission denied). Unlike the read path, the command path
+ * must NOT swallow a write failure — otherwise the user believes their
+ * preference persisted when it did not.
+ */
+function persistOptedOut(value) {
+    try {
+        setTelemetryOptedOut(value);
+    }
+    catch {
+        exitWithError({
+            code: 'internal_error',
+            message: `Could not save telemetry preference to disk. Your preference was NOT persisted.`,
+        });
+    }
+}
+export async function runTelemetryOptOut() {
+    const alreadyOptedOut = isTelemetryOptedOut();
+    persistOptedOut(true);
+    if (isJsonMode()) {
+        outputJson({ status: 'ok', optedOut: true, alreadyOptedOut });
+        return;
+    }
+    if (alreadyOptedOut) {
+        console.log(chalk.green('Telemetry collection is already opted out.'));
+    }
+    else {
+        console.log(chalk.green('Telemetry collection disabled. No further events will be sent.'));
+    }
+    console.log(chalk.dim(`Re-enable any time with \`${formatWorkOSCommand('telemetry opt-in')}\`.`));
+}
+export async function runTelemetryOptIn() {
+    const wasOptedOut = isTelemetryOptedOut();
+    persistOptedOut(false);
+    if (isJsonMode()) {
+        outputJson({ status: 'ok', optedOut: false, alreadyOptedIn: !wasOptedOut });
+        return;
+    }
+    if (wasOptedOut) {
+        console.log(chalk.green('Telemetry collection re-enabled.'));
+    }
+    else {
+        console.log(chalk.green('Telemetry collection is already enabled.'));
+    }
+    console.log(chalk.dim(`Opt out any time with \`${formatWorkOSCommand('telemetry opt-out')}\`.`));
+}
+function describeSource(source) {
+    switch (source) {
+        case 'env':
+            return 'WORKOS_TELEMETRY environment variable';
+        case 'preference':
+            return 'saved preference';
+        case 'default':
+            return 'default';
+    }
+}
+export async function runTelemetryStatus() {
+    const enabled = isTelemetryEnabled();
+    const optedOut = isTelemetryOptedOut();
+    const source = getTelemetrySource();
+    const override = envTelemetryOverride();
+    if (isJsonMode()) {
+        outputJson({
+            enabled,
+            optedOut,
+            source,
+            envOverride: override ?? null,
+        });
+        return;
+    }
+    const stateLine = enabled
+        ? chalk.green('Telemetry collection is enabled.')
+        : chalk.yellow('Telemetry collection is disabled.');
+    console.log(stateLine);
+    console.log(chalk.dim(`Source: ${describeSource(source)}.`));
+    if (enabled) {
+        console.log(chalk.dim(`Opt out with \`${formatWorkOSCommand('telemetry opt-out')}\`.`));
+    }
+    else {
+        console.log(chalk.dim(`Re-enable with \`${formatWorkOSCommand('telemetry opt-in')}\`.`));
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/commands/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/commands/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC;QACH,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,iFAAiF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;IAC9C,eAAe,CAAC,IAAI,CAAC,CAAC;IAEtB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,mBAAmB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB;IAC7C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,uCAAuC,CAAC;QACjD,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IAExC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC;YACT,OAAO;YACP,QAAQ;YACR,MAAM;YACN,WAAW,EAAE,QAAQ,IAAI,IAAI;SAC9B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO;QACvB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,mBAAmB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC","sourcesContent":["import chalk from 'chalk';\nimport {\n  envTelemetryOverride,\n  getTelemetrySource,\n  isTelemetryEnabled,\n  isTelemetryOptedOut,\n  setTelemetryOptedOut,\n  type TelemetrySource,\n} from '../lib/preferences.js';\nimport { isJsonMode, outputJson, exitWithError } from '../utils/output.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\n/**\n * Persist an opt-out/opt-in change, surfacing a clear error if the write fails\n * (read-only FS, permission denied). Unlike the read path, the command path\n * must NOT swallow a write failure — otherwise the user believes their\n * preference persisted when it did not.\n */\nfunction persistOptedOut(value: boolean): void {\n  try {\n    setTelemetryOptedOut(value);\n  } catch {\n    exitWithError({\n      code: 'internal_error',\n      message: `Could not save telemetry preference to disk. Your preference was NOT persisted.`,\n    });\n  }\n}\n\nexport async function runTelemetryOptOut(): Promise<void> {\n  const alreadyOptedOut = isTelemetryOptedOut();\n  persistOptedOut(true);\n\n  if (isJsonMode()) {\n    outputJson({ status: 'ok', optedOut: true, alreadyOptedOut });\n    return;\n  }\n\n  if (alreadyOptedOut) {\n    console.log(chalk.green('Telemetry collection is already opted out.'));\n  } else {\n    console.log(chalk.green('Telemetry collection disabled. No further events will be sent.'));\n  }\n  console.log(chalk.dim(`Re-enable any time with \\`${formatWorkOSCommand('telemetry opt-in')}\\`.`));\n}\n\nexport async function runTelemetryOptIn(): Promise<void> {\n  const wasOptedOut = isTelemetryOptedOut();\n  persistOptedOut(false);\n\n  if (isJsonMode()) {\n    outputJson({ status: 'ok', optedOut: false, alreadyOptedIn: !wasOptedOut });\n    return;\n  }\n\n  if (wasOptedOut) {\n    console.log(chalk.green('Telemetry collection re-enabled.'));\n  } else {\n    console.log(chalk.green('Telemetry collection is already enabled.'));\n  }\n  console.log(chalk.dim(`Opt out any time with \\`${formatWorkOSCommand('telemetry opt-out')}\\`.`));\n}\n\nfunction describeSource(source: TelemetrySource): string {\n  switch (source) {\n    case 'env':\n      return 'WORKOS_TELEMETRY environment variable';\n    case 'preference':\n      return 'saved preference';\n    case 'default':\n      return 'default';\n  }\n}\n\nexport async function runTelemetryStatus(): Promise<void> {\n  const enabled = isTelemetryEnabled();\n  const optedOut = isTelemetryOptedOut();\n  const source = getTelemetrySource();\n  const override = envTelemetryOverride();\n\n  if (isJsonMode()) {\n    outputJson({\n      enabled,\n      optedOut,\n      source,\n      envOverride: override ?? null,\n    });\n    return;\n  }\n\n  const stateLine = enabled\n    ? chalk.green('Telemetry collection is enabled.')\n    : chalk.yellow('Telemetry collection is disabled.');\n  console.log(stateLine);\n  console.log(chalk.dim(`Source: ${describeSource(source)}.`));\n\n  if (enabled) {\n    console.log(chalk.dim(`Opt out with \\`${formatWorkOSCommand('telemetry opt-out')}\\`.`));\n  } else {\n    console.log(chalk.dim(`Re-enable with \\`${formatWorkOSCommand('telemetry opt-in')}\\`.`));\n  }\n}\n"]}

package/dist/commands/uninstall-skill.js

@@ -6,6 +6,7 @@ import chalk from 'chalk';
 import { logError, logInfo, logWarn } from '../utils/debug.js';
 import { exitWithError, isJsonMode, outputJson } from '../utils/output.js';
 import { createAgents, detectAgents, discoverSkills, getSkillsDir } from './install-skill.js';
+import { ExitCode, exitWithCode } from '../utils/exit-codes.js';
 export function findInstalledSkills(knownSkills, agent) {
     return knownSkills.filter((name) => existsSync(join(agent.globalSkillsDir, name, 'SKILL.md')));
 }
@@ -89,7 +90,7 @@ export async function runUninstallSkill(options) {
     if (isJsonMode()) {
         outputJson({ removed, skipped, failed });
         if (failed.length > 0) {
-            process.exit(1);
+            exitWithCode(ExitCode.GENERAL_ERROR);
         }
         return;
     }
@@ -109,7 +110,7 @@ export async function runUninstallSkill(options) {
         for (const r of failed) {
             console.log(`  ${r.skill} ← ${r.agent}: ${chalk.dim(r.error)}`);
         }
-        process.exit(1);
+        exitWithCode(ExitCode.GENERAL_ERROR);
     }
     console.log(chalk.green('\nDone!'));
 }

package/dist/commands/uninstall-skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"uninstall-skill.js","sourceRoot":"","sources":["../../src/commands/uninstall-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAOhH,MAAM,UAAU,mBAAmB,CAAC,WAAqB,EAAE,KAAkB;IAC3E,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,KAAkB;IAElB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,2BAA2B,SAAS,SAAS,KAAK,CAAC,WAAW,OAAO,SAAS,GAAG,EAAE,OAAO,CAAC,CAAC;QACrG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA8B;IACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IAEjC,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACpD,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,sCAAsC,SAAS,4GAA4G;SACrK,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEzD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,4BAA4B,CAAC;QAC7F,OAAO,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,OAAO,sBAAsB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAE7G,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,mDAAmD,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,6BAA6B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,yCAAyC,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,2CAA2C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CACL,sBAAsB,EACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,aAAa,EACb,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClD,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAMR,EAAE,CAAC;IAER,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,WAAW;gBACxB,OAAO,EAAE,KAAK;gBACd,GAAG,MAAM;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,WAAW,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,oBAAoB,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { existsSync } from 'fs';\nimport { rm } from 'fs/promises';\nimport { homedir } from 'os';\nimport { join } from 'path';\nimport chalk from 'chalk';\nimport { logError, logInfo, logWarn } from '../utils/debug.js';\nimport { exitWithError, isJsonMode, outputJson } from '../utils/output.js';\nimport { createAgents, detectAgents, discoverSkills, getSkillsDir, type AgentConfig } from './install-skill.js';\n\nexport interface UninstallSkillOptions {\n  skill?: string[];\n  agent?: string[];\n}\n\nexport function findInstalledSkills(knownSkills: string[], agent: AgentConfig): string[] {\n  return knownSkills.filter((name) => existsSync(join(agent.globalSkillsDir, name, 'SKILL.md')));\n}\n\nexport async function uninstallSkill(\n  skillName: string,\n  agent: AgentConfig,\n): Promise<{ success: boolean; error?: string }> {\n  const targetDir = join(agent.globalSkillsDir, skillName);\n  try {\n    await rm(targetDir, { recursive: true, force: true });\n    return { success: true };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    logError(`Failed to remove skill \"${skillName}\" for ${agent.displayName} at ${targetDir}:`, message);\n    return { success: false, error: message };\n  }\n}\n\nexport async function runUninstallSkill(options: UninstallSkillOptions): Promise<void> {\n  const home = homedir();\n  const agents = createAgents(home);\n  const skillsDir = getSkillsDir();\n\n  let knownSkills: string[];\n  try {\n    knownSkills = await discoverSkills(skillsDir);\n  } catch (error) {\n    logError('Failed to read skills directory:', error);\n    exitWithError({\n      code: 'SKILLS_DIR_READ_FAILED',\n      message: `Could not read skills directory at ${skillsDir}. Your WorkOS CLI installation may be corrupted. Try reinstalling with \\`npm install -g @workos-inc/cli\\`.`,\n    });\n  }\n\n  const targetAgents = detectAgents(agents, options.agent);\n\n  if (targetAgents.length === 0) {\n    const message = options.agent ? 'Specified agents not found.' : 'No coding agents detected.';\n    logWarn(message, 'Supported agents:', Object.keys(agents).join(', '));\n    exitWithError({\n      code: 'NO_AGENTS_FOUND',\n      message: `${message} Supported agents: ${Object.keys(agents).join(', ')}`,\n    });\n  }\n\n  const targetSkillNames = options.skill ? knownSkills.filter((s) => options.skill!.includes(s)) : knownSkills;\n\n  if (options.skill) {\n    const unrecognized = options.skill.filter((s) => !knownSkills.includes(s));\n    if (unrecognized.length > 0) {\n      logWarn('Unrecognized skill names requested for uninstall:', unrecognized);\n      if (!isJsonMode()) {\n        console.warn(chalk.yellow(`Unknown skills (ignored): ${unrecognized.join(', ')}`));\n      }\n    }\n  }\n\n  if (options.skill && targetSkillNames.length === 0) {\n    logError('No matching skills found. Known skills:', knownSkills.join(', '));\n    exitWithError({\n      code: 'SKILL_NOT_FOUND',\n      message: `No matching skills found. Known skills: ${knownSkills.join(', ')}`,\n    });\n  }\n\n  logInfo(\n    'Uninstalling skills:',\n    targetSkillNames.join(', '),\n    'for agents:',\n    targetAgents.map((a) => a.displayName).join(', '),\n  );\n\n  if (!isJsonMode()) {\n    console.log(chalk.bold('\\nUninstalling skills...\\n'));\n  }\n\n  const results: Array<{\n    skill: string;\n    agent: string;\n    success: boolean;\n    skipped: boolean;\n    error?: string;\n  }> = [];\n\n  for (const skill of targetSkillNames) {\n    for (const agent of targetAgents) {\n      const installed = findInstalledSkills([skill], agent);\n      if (installed.length === 0) {\n        results.push({ skill, agent: agent.displayName, success: true, skipped: true });\n        continue;\n      }\n      const result = await uninstallSkill(skill, agent);\n      results.push({\n        skill,\n        agent: agent.displayName,\n        skipped: false,\n        ...result,\n      });\n    }\n  }\n\n  const removed = results.filter((r) => r.success && !r.skipped);\n  const skipped = results.filter((r) => r.skipped);\n  const failed = results.filter((r) => !r.success);\n\n  if (isJsonMode()) {\n    outputJson({ removed, skipped, failed });\n    if (failed.length > 0) {\n      process.exit(1);\n    }\n    return;\n  }\n\n  if (removed.length > 0) {\n    logInfo(`Removed ${removed.length} skill(s)`);\n    console.log(chalk.green(`✓ Removed ${removed.length} skill(s):\\n`));\n    for (const r of removed) {\n      console.log(`  ${chalk.cyan(r.skill)} ← ${chalk.dim(r.agent)}`);\n    }\n  }\n\n  if (skipped.length > 0 && removed.length === 0 && failed.length === 0) {\n    console.log(chalk.dim('No WorkOS skills were installed.'));\n  }\n\n  if (failed.length > 0) {\n    logError(`Failed to remove ${failed.length} skill(s)`);\n    console.log(chalk.red(`\\n✗ Failed to remove ${failed.length}:\\n`));\n    for (const r of failed) {\n      console.log(`  ${r.skill} ← ${r.agent}: ${chalk.dim(r.error)}`);\n    }\n    process.exit(1);\n  }\n\n  console.log(chalk.green('\\nDone!'));\n}\n"]}
+{"version":3,"file":"uninstall-skill.js","sourceRoot":"","sources":["../../src/commands/uninstall-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AAChH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAOhE,MAAM,UAAU,mBAAmB,CAAC,WAAqB,EAAE,KAAkB;IAC3E,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,KAAkB;IAElB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,2BAA2B,SAAS,SAAS,KAAK,CAAC,WAAW,OAAO,SAAS,GAAG,EAAE,OAAO,CAAC,CAAC;QACrG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA8B;IACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IAEjC,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACpD,aAAa,CAAC;YACZ,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,sCAAsC,SAAS,4GAA4G;SACrK,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEzD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,4BAA4B,CAAC;QAC7F,OAAO,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,OAAO,sBAAsB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAE7G,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,mDAAmD,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,6BAA6B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,yCAAyC,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,2CAA2C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CACL,sBAAsB,EACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC3B,aAAa,EACb,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClD,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAMR,EAAE,CAAC;IAER,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,WAAW;gBACxB,OAAO,EAAE,KAAK;gBACd,GAAG,MAAM;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvC,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,WAAW,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,oBAAoB,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { existsSync } from 'fs';\nimport { rm } from 'fs/promises';\nimport { homedir } from 'os';\nimport { join } from 'path';\nimport chalk from 'chalk';\nimport { logError, logInfo, logWarn } from '../utils/debug.js';\nimport { exitWithError, isJsonMode, outputJson } from '../utils/output.js';\nimport { createAgents, detectAgents, discoverSkills, getSkillsDir, type AgentConfig } from './install-skill.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\n\nexport interface UninstallSkillOptions {\n  skill?: string[];\n  agent?: string[];\n}\n\nexport function findInstalledSkills(knownSkills: string[], agent: AgentConfig): string[] {\n  return knownSkills.filter((name) => existsSync(join(agent.globalSkillsDir, name, 'SKILL.md')));\n}\n\nexport async function uninstallSkill(\n  skillName: string,\n  agent: AgentConfig,\n): Promise<{ success: boolean; error?: string }> {\n  const targetDir = join(agent.globalSkillsDir, skillName);\n  try {\n    await rm(targetDir, { recursive: true, force: true });\n    return { success: true };\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    logError(`Failed to remove skill \"${skillName}\" for ${agent.displayName} at ${targetDir}:`, message);\n    return { success: false, error: message };\n  }\n}\n\nexport async function runUninstallSkill(options: UninstallSkillOptions): Promise<void> {\n  const home = homedir();\n  const agents = createAgents(home);\n  const skillsDir = getSkillsDir();\n\n  let knownSkills: string[];\n  try {\n    knownSkills = await discoverSkills(skillsDir);\n  } catch (error) {\n    logError('Failed to read skills directory:', error);\n    exitWithError({\n      code: 'SKILLS_DIR_READ_FAILED',\n      message: `Could not read skills directory at ${skillsDir}. Your WorkOS CLI installation may be corrupted. Try reinstalling with \\`npm install -g @workos-inc/cli\\`.`,\n    });\n  }\n\n  const targetAgents = detectAgents(agents, options.agent);\n\n  if (targetAgents.length === 0) {\n    const message = options.agent ? 'Specified agents not found.' : 'No coding agents detected.';\n    logWarn(message, 'Supported agents:', Object.keys(agents).join(', '));\n    exitWithError({\n      code: 'NO_AGENTS_FOUND',\n      message: `${message} Supported agents: ${Object.keys(agents).join(', ')}`,\n    });\n  }\n\n  const targetSkillNames = options.skill ? knownSkills.filter((s) => options.skill!.includes(s)) : knownSkills;\n\n  if (options.skill) {\n    const unrecognized = options.skill.filter((s) => !knownSkills.includes(s));\n    if (unrecognized.length > 0) {\n      logWarn('Unrecognized skill names requested for uninstall:', unrecognized);\n      if (!isJsonMode()) {\n        console.warn(chalk.yellow(`Unknown skills (ignored): ${unrecognized.join(', ')}`));\n      }\n    }\n  }\n\n  if (options.skill && targetSkillNames.length === 0) {\n    logError('No matching skills found. Known skills:', knownSkills.join(', '));\n    exitWithError({\n      code: 'SKILL_NOT_FOUND',\n      message: `No matching skills found. Known skills: ${knownSkills.join(', ')}`,\n    });\n  }\n\n  logInfo(\n    'Uninstalling skills:',\n    targetSkillNames.join(', '),\n    'for agents:',\n    targetAgents.map((a) => a.displayName).join(', '),\n  );\n\n  if (!isJsonMode()) {\n    console.log(chalk.bold('\\nUninstalling skills...\\n'));\n  }\n\n  const results: Array<{\n    skill: string;\n    agent: string;\n    success: boolean;\n    skipped: boolean;\n    error?: string;\n  }> = [];\n\n  for (const skill of targetSkillNames) {\n    for (const agent of targetAgents) {\n      const installed = findInstalledSkills([skill], agent);\n      if (installed.length === 0) {\n        results.push({ skill, agent: agent.displayName, success: true, skipped: true });\n        continue;\n      }\n      const result = await uninstallSkill(skill, agent);\n      results.push({\n        skill,\n        agent: agent.displayName,\n        skipped: false,\n        ...result,\n      });\n    }\n  }\n\n  const removed = results.filter((r) => r.success && !r.skipped);\n  const skipped = results.filter((r) => r.skipped);\n  const failed = results.filter((r) => !r.success);\n\n  if (isJsonMode()) {\n    outputJson({ removed, skipped, failed });\n    if (failed.length > 0) {\n      exitWithCode(ExitCode.GENERAL_ERROR);\n    }\n    return;\n  }\n\n  if (removed.length > 0) {\n    logInfo(`Removed ${removed.length} skill(s)`);\n    console.log(chalk.green(`✓ Removed ${removed.length} skill(s):\\n`));\n    for (const r of removed) {\n      console.log(`  ${chalk.cyan(r.skill)} ← ${chalk.dim(r.agent)}`);\n    }\n  }\n\n  if (skipped.length > 0 && removed.length === 0 && failed.length === 0) {\n    console.log(chalk.dim('No WorkOS skills were installed.'));\n  }\n\n  if (failed.length > 0) {\n    logError(`Failed to remove ${failed.length} skill(s)`);\n    console.log(chalk.red(`\\n✗ Failed to remove ${failed.length}:\\n`));\n    for (const r of failed) {\n      console.log(`  ${r.skill} ← ${r.agent}: ${chalk.dim(r.error)}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n\n  console.log(chalk.green('\\nDone!'));\n}\n"]}

package/dist/commands/vault-run.d.ts

@@ -0,0 +1,13 @@
+export interface SecretMapping {
+    envVar: string;
+    vaultName: string;
+}
+export interface VaultRunOptions {
+    secrets: string[];
+    command: string[];
+    env?: string;
+    dryRun?: boolean;
+}
+export declare function parseSecretMappings(secrets: string[]): SecretMapping[];
+export declare function fetchSecrets(mappings: SecretMapping[], apiKey: string, baseUrl?: string): Promise<Map<string, string>>;
+export declare function runVaultRun(options: VaultRunOptions, flagApiKey?: string): Promise<number | void>;

package/dist/commands/vault-run.js

@@ -0,0 +1,194 @@
+import { spawn } from 'node:child_process';
+import chalk from 'chalk';
+import { createWorkOSClient } from '../lib/workos-client.js';
+import { createApiErrorHandler } from '../lib/api-error-handler.js';
+import { isJsonMode, outputJson, exitWithError } from '../utils/output.js';
+import { formatTable } from '../utils/table.js';
+import { SPAWN_OPTS, IS_WINDOWS } from '../utils/platform.js';
+const handleApiError = createApiErrorHandler('Vault');
+export function parseSecretMappings(secrets) {
+    if (!secrets || secrets.length === 0) {
+        exitWithError({
+            code: 'missing_secrets',
+            message: 'At least one --secret ENV=name mapping is required',
+        });
+    }
+    const result = [];
+    const seen = new Set();
+    for (const raw of secrets) {
+        const eqIndex = raw.indexOf('=');
+        if (eqIndex <= 0 || eqIndex === raw.length - 1) {
+            exitWithError({
+                code: 'invalid_secret_format',
+                message: `Invalid secret mapping '${raw}'. Expected format: ENV_VAR=vault-name`,
+            });
+        }
+        const envVar = raw.slice(0, eqIndex);
+        const vaultName = raw.slice(eqIndex + 1);
+        if (seen.has(envVar)) {
+            exitWithError({
+                code: 'duplicate_env_var',
+                message: `Duplicate environment variable '${envVar}' in --secret mappings`,
+            });
+        }
+        seen.add(envVar);
+        result.push({ envVar, vaultName });
+    }
+    return result;
+}
+export async function fetchSecrets(mappings, apiKey, baseUrl) {
+    const client = createWorkOSClient(apiKey, baseUrl);
+    const entries = await Promise.all(mappings.map(async ({ envVar, vaultName }) => {
+        let obj;
+        try {
+            obj = await client.sdk.vault.readObjectByName(vaultName);
+        }
+        catch (error) {
+            return handleApiError(error, vaultName);
+        }
+        if (typeof obj.value !== 'string') {
+            exitWithError({
+                code: 'vault_value_missing',
+                message: `Vault object '${vaultName}' has no readable value`,
+            });
+        }
+        return [envVar, obj.value];
+    }));
+    return new Map(entries);
+}
+async function resolveRunApiKey(envName, flagApiKey) {
+    if (!envName) {
+        const { resolveApiKey } = await import('../lib/api-key.js');
+        return resolveApiKey({ apiKey: flagApiKey });
+    }
+    const { getConfig } = await import('../lib/config-store.js');
+    const config = getConfig();
+    const env = config?.environments[envName];
+    if (!env || !env.apiKey) {
+        exitWithError({
+            code: 'env_not_found',
+            message: `Environment '${envName}' not found or has no API key. Run 'workos env list' to see available environments.`,
+        });
+    }
+    return env.apiKey;
+}
+async function resolveRunBaseUrl(envName) {
+    if (envName) {
+        const { getConfig } = await import('../lib/config-store.js');
+        const config = getConfig();
+        const env = config?.environments[envName];
+        // Use the named env's endpoint, or the default. Never fall through to
+        // the active env's endpoint -- that would send the wrong API key to
+        // the wrong host when active != selected.
+        return env?.endpoint ?? 'https://api.workos.com';
+    }
+    const { resolveApiBaseUrl } = await import('../lib/api-key.js');
+    return resolveApiBaseUrl();
+}
+function printDryRun(mappings, envName) {
+    if (isJsonMode()) {
+        outputJson({
+            dryRun: true,
+            env: envName ?? null,
+            mappings: mappings.map(({ envVar, vaultName }) => ({ envVar, vaultName })),
+        });
+        return;
+    }
+    console.log(chalk.dim('Dry run (no secrets will be fetched and no child process will be spawned).'));
+    if (envName)
+        console.log(chalk.dim(`Environment: ${envName}`));
+    console.log();
+    const rows = mappings.map(({ envVar, vaultName }) => [envVar, vaultName]);
+    console.log(formatTable([{ header: 'Environment Variable' }, { header: 'Vault Object' }], rows));
+}
+function spawnChild(command, args, childEnv) {
+    return new Promise((resolve, reject) => {
+        let child;
+        try {
+            child = spawn(command, args, {
+                stdio: 'inherit',
+                env: childEnv,
+                ...SPAWN_OPTS,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Unknown error';
+            exitWithError({
+                code: 'spawn_failed',
+                message: `Failed to start: ${command}: ${message}`,
+            });
+        }
+        child.on('error', (err) => {
+            try {
+                const code = err.code;
+                if (code === 'ENOENT') {
+                    exitWithError({ code: 'command_not_found', message: `Command not found: ${command}` });
+                }
+                exitWithError({ code: 'spawn_error', message: `Failed to start: ${command}: ${err.message}` });
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        const forward = (signal) => {
+            if (!child.killed)
+                child.kill(signal);
+        };
+        process.once('SIGINT', () => forward('SIGINT'));
+        process.once('SIGTERM', () => forward('SIGTERM'));
+        if (IS_WINDOWS) {
+            process.once('SIGBREAK', () => forward('SIGINT'));
+        }
+        child.on('exit', (code, signal) => {
+            if (signal) {
+                const num = signalToNumber(signal);
+                resolve(num ? 128 + num : 1);
+            }
+            else {
+                resolve(code ?? 0);
+            }
+        });
+    });
+}
+function signalToNumber(signal) {
+    const map = {
+        SIGHUP: 1,
+        SIGINT: 2,
+        SIGQUIT: 3,
+        SIGKILL: 9,
+        SIGTERM: 15,
+    };
+    return map[signal] ?? 0;
+}
+export async function runVaultRun(options, flagApiKey) {
+    const mappings = parseSecretMappings(options.secrets);
+    if (options.dryRun) {
+        printDryRun(mappings, options.env);
+        return;
+    }
+    if (!options.command || options.command.length === 0) {
+        exitWithError({
+            code: 'missing_command',
+            message: 'No command specified. Usage: workos vault run --secret ENV=name -- command',
+        });
+    }
+    const apiKey = await resolveRunApiKey(options.env, flagApiKey);
+    const baseUrl = await resolveRunBaseUrl(options.env);
+    const secretValues = await fetchSecrets(mappings, apiKey, baseUrl);
+    // Metadata to stderr so the child process owns stdout.
+    if (isJsonMode()) {
+        console.error(JSON.stringify({
+            status: 'ok',
+            message: 'Injected secrets into child process',
+            env: options.env ?? null,
+            injected: mappings.map(({ envVar, vaultName }) => ({ envVar, vaultName })),
+        }));
+    }
+    const childEnv = { ...process.env };
+    for (const [envVar, value] of secretValues) {
+        childEnv[envVar] = value;
+    }
+    const [cmd, ...args] = options.command;
+    return spawnChild(cmd, args, childEnv);
+}
+//# sourceMappingURL=vault-run.js.map

package/dist/commands/vault-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-run.js","sourceRoot":"","sources":["../../src/commands/vault-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;AActD,MAAM,UAAU,mBAAmB,CAAC,OAAiB;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,aAAa,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,2BAA2B,GAAG,wCAAwC;aAChF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEzC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,aAAa,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mCAAmC,MAAM,wBAAwB;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEjB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAyB,EACzB,MAAc,EACd,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAA6B,EAAE;QACtE,IAAI,GAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClC,aAAa,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,iBAAiB,SAAS,yBAAyB;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAA2B,EAAE,UAAmB;IAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,gBAAgB,OAAO,qFAAqF;SACtH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAA2B;IAC1D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAC1C,sEAAsE;QACtE,oEAAoE;QACpE,0CAA0C;QAC1C,OAAO,GAAG,EAAE,QAAQ,IAAI,wBAAwB,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChE,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB,EAAE,OAAgB;IAC9D,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC;YACT,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,OAAO,IAAI,IAAI;YACpB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC,CAAC;IACrG,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAc,EAAE,QAA2B;IAC9E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC3B,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,QAAQ;gBACb,GAAG,UAAU;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,aAAa,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oBAAoB,OAAO,KAAK,OAAO,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;gBACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,OAAO,EAAE,EAAE,CAAC,CAAC;gBACzF,CAAC;gBACD,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAsB;IAC5C,MAAM,GAAG,GAA2B;QAClC,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,EAAE;KACZ,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAwB,EAAE,UAAmB;IAC7E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,aAAa,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,4EAA4E;SACtF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnE,uDAAuD;IACvD,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,qCAAqC;YAC9C,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;YACxB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;SAC3E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3C,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IACvC,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC","sourcesContent":["import { spawn, type ChildProcess } from 'node:child_process';\nimport chalk from 'chalk';\nimport { createWorkOSClient } from '../lib/workos-client.js';\nimport { createApiErrorHandler } from '../lib/api-error-handler.js';\nimport { isJsonMode, outputJson, exitWithError } from '../utils/output.js';\nimport { formatTable } from '../utils/table.js';\nimport { SPAWN_OPTS, IS_WINDOWS } from '../utils/platform.js';\n\nconst handleApiError = createApiErrorHandler('Vault');\n\nexport interface SecretMapping {\n  envVar: string;\n  vaultName: string;\n}\n\nexport interface VaultRunOptions {\n  secrets: string[];\n  command: string[];\n  env?: string;\n  dryRun?: boolean;\n}\n\nexport function parseSecretMappings(secrets: string[]): SecretMapping[] {\n  if (!secrets || secrets.length === 0) {\n    exitWithError({\n      code: 'missing_secrets',\n      message: 'At least one --secret ENV=name mapping is required',\n    });\n  }\n\n  const result: SecretMapping[] = [];\n  const seen = new Set<string>();\n\n  for (const raw of secrets) {\n    const eqIndex = raw.indexOf('=');\n    if (eqIndex <= 0 || eqIndex === raw.length - 1) {\n      exitWithError({\n        code: 'invalid_secret_format',\n        message: `Invalid secret mapping '${raw}'. Expected format: ENV_VAR=vault-name`,\n      });\n    }\n\n    const envVar = raw.slice(0, eqIndex);\n    const vaultName = raw.slice(eqIndex + 1);\n\n    if (seen.has(envVar)) {\n      exitWithError({\n        code: 'duplicate_env_var',\n        message: `Duplicate environment variable '${envVar}' in --secret mappings`,\n      });\n    }\n    seen.add(envVar);\n\n    result.push({ envVar, vaultName });\n  }\n\n  return result;\n}\n\nexport async function fetchSecrets(\n  mappings: SecretMapping[],\n  apiKey: string,\n  baseUrl?: string,\n): Promise<Map<string, string>> {\n  const client = createWorkOSClient(apiKey, baseUrl);\n\n  const entries = await Promise.all(\n    mappings.map(async ({ envVar, vaultName }): Promise<[string, string]> => {\n      let obj: { value?: unknown };\n      try {\n        obj = await client.sdk.vault.readObjectByName(vaultName);\n      } catch (error) {\n        return handleApiError(error, vaultName);\n      }\n      if (typeof obj.value !== 'string') {\n        exitWithError({\n          code: 'vault_value_missing',\n          message: `Vault object '${vaultName}' has no readable value`,\n        });\n      }\n      return [envVar, obj.value];\n    }),\n  );\n\n  return new Map(entries);\n}\n\nasync function resolveRunApiKey(envName: string | undefined, flagApiKey?: string): Promise<string> {\n  if (!envName) {\n    const { resolveApiKey } = await import('../lib/api-key.js');\n    return resolveApiKey({ apiKey: flagApiKey });\n  }\n\n  const { getConfig } = await import('../lib/config-store.js');\n  const config = getConfig();\n  const env = config?.environments[envName];\n  if (!env || !env.apiKey) {\n    exitWithError({\n      code: 'env_not_found',\n      message: `Environment '${envName}' not found or has no API key. Run 'workos env list' to see available environments.`,\n    });\n  }\n  return env.apiKey;\n}\n\nasync function resolveRunBaseUrl(envName: string | undefined): Promise<string> {\n  if (envName) {\n    const { getConfig } = await import('../lib/config-store.js');\n    const config = getConfig();\n    const env = config?.environments[envName];\n    // Use the named env's endpoint, or the default. Never fall through to\n    // the active env's endpoint -- that would send the wrong API key to\n    // the wrong host when active != selected.\n    return env?.endpoint ?? 'https://api.workos.com';\n  }\n  const { resolveApiBaseUrl } = await import('../lib/api-key.js');\n  return resolveApiBaseUrl();\n}\n\nfunction printDryRun(mappings: SecretMapping[], envName?: string): void {\n  if (isJsonMode()) {\n    outputJson({\n      dryRun: true,\n      env: envName ?? null,\n      mappings: mappings.map(({ envVar, vaultName }) => ({ envVar, vaultName })),\n    });\n    return;\n  }\n\n  console.log(chalk.dim('Dry run (no secrets will be fetched and no child process will be spawned).'));\n  if (envName) console.log(chalk.dim(`Environment: ${envName}`));\n  console.log();\n  const rows = mappings.map(({ envVar, vaultName }) => [envVar, vaultName]);\n  console.log(formatTable([{ header: 'Environment Variable' }, { header: 'Vault Object' }], rows));\n}\n\nfunction spawnChild(command: string, args: string[], childEnv: NodeJS.ProcessEnv): Promise<number> {\n  return new Promise((resolve, reject) => {\n    let child: ChildProcess;\n    try {\n      child = spawn(command, args, {\n        stdio: 'inherit',\n        env: childEnv,\n        ...SPAWN_OPTS,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : 'Unknown error';\n      exitWithError({\n        code: 'spawn_failed',\n        message: `Failed to start: ${command}: ${message}`,\n      });\n    }\n\n    child.on('error', (err) => {\n      try {\n        const code = (err as NodeJS.ErrnoException).code;\n        if (code === 'ENOENT') {\n          exitWithError({ code: 'command_not_found', message: `Command not found: ${command}` });\n        }\n        exitWithError({ code: 'spawn_error', message: `Failed to start: ${command}: ${err.message}` });\n      } catch (e) {\n        reject(e);\n      }\n    });\n\n    const forward = (signal: NodeJS.Signals) => {\n      if (!child.killed) child.kill(signal);\n    };\n    process.once('SIGINT', () => forward('SIGINT'));\n    process.once('SIGTERM', () => forward('SIGTERM'));\n    if (IS_WINDOWS) {\n      process.once('SIGBREAK', () => forward('SIGINT'));\n    }\n\n    child.on('exit', (code, signal) => {\n      if (signal) {\n        const num = signalToNumber(signal);\n        resolve(num ? 128 + num : 1);\n      } else {\n        resolve(code ?? 0);\n      }\n    });\n  });\n}\n\nfunction signalToNumber(signal: NodeJS.Signals): number {\n  const map: Record<string, number> = {\n    SIGHUP: 1,\n    SIGINT: 2,\n    SIGQUIT: 3,\n    SIGKILL: 9,\n    SIGTERM: 15,\n  };\n  return map[signal] ?? 0;\n}\n\nexport async function runVaultRun(options: VaultRunOptions, flagApiKey?: string): Promise<number | void> {\n  const mappings = parseSecretMappings(options.secrets);\n\n  if (options.dryRun) {\n    printDryRun(mappings, options.env);\n    return;\n  }\n\n  if (!options.command || options.command.length === 0) {\n    exitWithError({\n      code: 'missing_command',\n      message: 'No command specified. Usage: workos vault run --secret ENV=name -- command',\n    });\n  }\n\n  const apiKey = await resolveRunApiKey(options.env, flagApiKey);\n  const baseUrl = await resolveRunBaseUrl(options.env);\n  const secretValues = await fetchSecrets(mappings, apiKey, baseUrl);\n\n  // Metadata to stderr so the child process owns stdout.\n  if (isJsonMode()) {\n    console.error(\n      JSON.stringify({\n        status: 'ok',\n        message: 'Injected secrets into child process',\n        env: options.env ?? null,\n        injected: mappings.map(({ envVar, vaultName }) => ({ envVar, vaultName })),\n      }),\n    );\n  }\n\n  const childEnv: NodeJS.ProcessEnv = { ...process.env };\n  for (const [envVar, value] of secretValues) {\n    childEnv[envVar] = value;\n  }\n\n  const [cmd, ...args] = options.command;\n  return spawnChild(cmd, args, childEnv);\n}\n"]}

package/dist/commands/vault.d.ts

@@ -5,8 +5,8 @@ export interface VaultListOptions {
     order?: string;
 }
 export declare function runVaultList(options: VaultListOptions, apiKey: string, baseUrl?: string): Promise<void>;
-export declare function runVaultGet(id: string, apiKey: string, baseUrl?: string): Promise<void>;
-export declare function runVaultGetByName(name: string, apiKey: string, baseUrl?: string): Promise<void>;
+export declare function runVaultGet(id: string, decrypt: boolean, apiKey: string, baseUrl?: string): Promise<void>;
+export declare function runVaultGetByName(name: string, decrypt: boolean, apiKey: string, baseUrl?: string): Promise<void>;
 export interface VaultCreateOptions {
     name: string;
     value: string;
@@ -22,3 +22,4 @@ export declare function runVaultUpdate(options: VaultUpdateOptions, apiKey: stri
 export declare function runVaultDelete(id: string, apiKey: string, baseUrl?: string): Promise<void>;
 export declare function runVaultDescribe(id: string, apiKey: string, baseUrl?: string): Promise<void>;
 export declare function runVaultListVersions(id: string, apiKey: string, baseUrl?: string): Promise<void>;
+export declare function readValueFromStdin(): Promise<string>;