workos 0.18.0 → 0.19.0

package/dist/lib/telemetry-notice.d.ts

@@ -1,13 +1,13 @@
 /**
  * First-run telemetry notice.
  *
- * Prints a one-time, stderr-only box telling the user that anonymous CLI usage
- * telemetry is being collected and how to turn it off. Shown at most once ever
- * (backed by the persisted `noticeShownAt` timestamp in preferences.json), only
- * in interactive human mode, and never on the machine-readable path.
+ * Prints a one-time, stderr-only notice telling the user that anonymous CLI
+ * usage telemetry is being collected and how to turn it off. Shown at most once
+ * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),
+ * only in interactive human mode, and never on the machine-readable path.
  *
  * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,
- * a `!isJsonMode()` gate, the shared renderStderrBox helper, and a never-throws
+ * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws
  * contract so it can never block command execution. The one structural
  * difference is persistence — this notice writes `noticeShownAt` the first time
  * it actually displays so it never re-shows across runs.

package/dist/lib/telemetry-notice.js

@@ -1,20 +1,20 @@
 /**
  * First-run telemetry notice.
  *
- * Prints a one-time, stderr-only box telling the user that anonymous CLI usage
- * telemetry is being collected and how to turn it off. Shown at most once ever
- * (backed by the persisted `noticeShownAt` timestamp in preferences.json), only
- * in interactive human mode, and never on the machine-readable path.
+ * Prints a one-time, stderr-only notice telling the user that anonymous CLI
+ * usage telemetry is being collected and how to turn it off. Shown at most once
+ * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),
+ * only in interactive human mode, and never on the machine-readable path.
  *
  * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,
- * a `!isJsonMode()` gate, the shared renderStderrBox helper, and a never-throws
+ * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws
  * contract so it can never block command execution. The one structural
  * difference is persistence — this notice writes `noticeShownAt` the first time
  * it actually displays so it never re-shows across runs.
  */
 import chalk from 'chalk';
 import { isJsonMode } from '../utils/output.js';
-import { renderStderrBox } from '../utils/box.js';
+import { renderStderrNotice } from '../utils/box.js';
 import { formatWorkOSCommand } from '../utils/command-invocation.js';
 import { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';
 import { markStartupNoticeShown } from './startup-notice-gate.js';
@@ -38,8 +38,7 @@ export function maybeShowTelemetryNotice() {
         if (isNoticeShown())
             return; // already shown once, ever
         const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));
-        const inner = ` ${chalk.cyan('ℹ')} WorkOS collects anonymous CLI usage telemetry. Run ${optOut} to disable it. `;
-        renderStderrBox(inner, chalk.cyan);
+        renderStderrNotice(`${chalk.cyan('ℹ')} ${chalk.dim('Anonymous CLI usage telemetry is on.')} ${chalk.dim('Disable:')} ${optOut}`);
         // Set the per-session guard and persist ONLY after a successful render, so a
         // render failure (caught below) lets a later command in this process retry
         // rather than silently suppressing the notice for the rest of the session.

package/dist/lib/telemetry-notice.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry-notice.js","sourceRoot":"","sources":["../../src/lib/telemetry-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,IAAI,gBAAgB;YAAE,OAAO;QAC7B,IAAI,UAAU,EAAE;YAAE,OAAO,CAAC,mEAAmE;QAC7F,IAAI,mBAAmB,EAAE;YAAE,OAAO,CAAC,wCAAwC;QAC3E,IAAI,aAAa,EAAE;YAAE,OAAO,CAAC,2BAA2B;QAExD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,MAAM,kBAAkB,CAAC;QACjH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,gBAAgB,GAAG,IAAI,CAAC;QACxB,eAAe,EAAE,CAAC;QAClB,6EAA6E;QAC7E,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,yBAAyB;IACvC,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * First-run telemetry notice.\n *\n * Prints a one-time, stderr-only box telling the user that anonymous CLI usage\n * telemetry is being collected and how to turn it off. Shown at most once ever\n * (backed by the persisted `noticeShownAt` timestamp in preferences.json), only\n * in interactive human mode, and never on the machine-readable path.\n *\n * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,\n * a `!isJsonMode()` gate, the shared renderStderrBox helper, and a never-throws\n * contract so it can never block command execution. The one structural\n * difference is persistence — this notice writes `noticeShownAt` the first time\n * it actually displays so it never re-shows across runs.\n */\n\nimport chalk from 'chalk';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrBox } from '../utils/box.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\n\nlet shownThisSession = false;\n\n/**\n * Show the first-run telemetry notice if it has never been displayed.\n *\n * Gate order is load-bearing: every suppression check runs BEFORE\n * markNoticeShown(), so a non-human first run (--json / piped / CI) never\n * consumes the one-time display. The flag is set only when the box is actually\n * rendered, so a real human eventually sees it. Never throws.\n */\nexport function maybeShowTelemetryNotice(): void {\n  try {\n    if (shownThisSession) return;\n    if (isJsonMode()) return; // suppress in --json / non-TTY / CI (output auto-switches to json)\n    if (isTelemetryOptedOut()) return; // already opted out — nothing to inform\n    if (isNoticeShown()) return; // already shown once, ever\n\n    const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));\n    const inner = ` ${chalk.cyan('ℹ')} WorkOS collects anonymous CLI usage telemetry. Run ${optOut} to disable it. `;\n    renderStderrBox(inner, chalk.cyan);\n    // Set the per-session guard and persist ONLY after a successful render, so a\n    // render failure (caught below) lets a later command in this process retry\n    // rather than silently suppressing the notice for the rest of the session.\n    shownThisSession = true;\n    markNoticeShown();\n    // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n    markStartupNoticeShown();\n  } catch {\n    // Never block command execution.\n  }\n}\n\n/** Reset session state (for testing). */\nexport function resetTelemetryNoticeState(): void {\n  shownThisSession = false;\n}\n"]}
+{"version":3,"file":"telemetry-notice.js","sourceRoot":"","sources":["../../src/lib/telemetry-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,IAAI,gBAAgB;YAAE,OAAO;QAC7B,IAAI,UAAU,EAAE;YAAE,OAAO,CAAC,mEAAmE;QAC7F,IAAI,mBAAmB,EAAE;YAAE,OAAO,CAAC,wCAAwC;QAC3E,IAAI,aAAa,EAAE;YAAE,OAAO,CAAC,2BAA2B;QAExD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACpE,kBAAkB,CAChB,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,EAAE,CAC7G,CAAC;QACF,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,gBAAgB,GAAG,IAAI,CAAC;QACxB,eAAe,EAAE,CAAC;QAClB,6EAA6E;QAC7E,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,yBAAyB;IACvC,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * First-run telemetry notice.\n *\n * Prints a one-time, stderr-only notice telling the user that anonymous CLI\n * usage telemetry is being collected and how to turn it off. Shown at most once\n * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),\n * only in interactive human mode, and never on the machine-readable path.\n *\n * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,\n * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws\n * contract so it can never block command execution. The one structural\n * difference is persistence — this notice writes `noticeShownAt` the first time\n * it actually displays so it never re-shows across runs.\n */\n\nimport chalk from 'chalk';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\n\nlet shownThisSession = false;\n\n/**\n * Show the first-run telemetry notice if it has never been displayed.\n *\n * Gate order is load-bearing: every suppression check runs BEFORE\n * markNoticeShown(), so a non-human first run (--json / piped / CI) never\n * consumes the one-time display. The flag is set only when the box is actually\n * rendered, so a real human eventually sees it. Never throws.\n */\nexport function maybeShowTelemetryNotice(): void {\n  try {\n    if (shownThisSession) return;\n    if (isJsonMode()) return; // suppress in --json / non-TTY / CI (output auto-switches to json)\n    if (isTelemetryOptedOut()) return; // already opted out — nothing to inform\n    if (isNoticeShown()) return; // already shown once, ever\n\n    const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));\n    renderStderrNotice(\n      `${chalk.cyan('ℹ')} ${chalk.dim('Anonymous CLI usage telemetry is on.')} ${chalk.dim('Disable:')} ${optOut}`,\n    );\n    // Set the per-session guard and persist ONLY after a successful render, so a\n    // render failure (caught below) lets a later command in this process retry\n    // rather than silently suppressing the notice for the rest of the session.\n    shownThisSession = true;\n    markNoticeShown();\n    // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n    markStartupNoticeShown();\n  } catch {\n    // Never block command execution.\n  }\n}\n\n/** Reset session state (for testing). */\nexport function resetTelemetryNoticeState(): void {\n  shownThisSession = false;\n}\n"]}

package/dist/lib/unclaimed-env-provision.js

@@ -7,11 +7,12 @@
  */
 import chalk from 'chalk';
 import { provisionUnclaimedEnvironment, UnclaimedEnvApiError } from './unclaimed-env-api.js';
-import { getConfig, saveConfig, getActiveEnvironment } from './config-store.js';
+import { getConfig, saveConfig, getActiveEnvironment, freshEnvKey } from './config-store.js';
 import { writeCredentialsEnv } from './env-writer.js';
 import { logInfo, logError } from '../utils/debug.js';
-import { renderStderrBox } from '../utils/box.js';
-import clack from '../utils/clack.js';
+import { renderStderrNotice } from '../utils/box.js';
+import ui from '../utils/ui.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
 /**
  * Try to provision an unclaimed environment. Non-fatal — returns true on success,
  * false on any failure.
@@ -36,27 +37,29 @@ export async function tryProvisionUnclaimedEnv(options) {
             envVars[key] = options.redirectUri;
         }
         writeCredentialsEnv(options.installDir, envVars);
-        // Save to config store (after .env.local succeeds)
+        // Save to config store (after .env.local succeeds). A fresh key so a repeated
+        // provision never clobbers an earlier env's claim token (unrecoverable — it
+        // lives only in this config).
         const config = getConfig() ?? { environments: {} };
-        config.environments['unclaimed'] = {
-            name: 'unclaimed',
+        const key = freshEnvKey(config, 'unclaimed');
+        config.environments[key] = {
+            name: key,
             type: 'unclaimed',
             apiKey: result.apiKey,
             clientId: result.clientId,
             claimToken: result.claimToken,
         };
-        config.activeEnvironment = 'unclaimed';
+        config.activeEnvironment = key;
         saveConfig(config);
         // Verify config persisted — critical for `workos env claim` in a later process
         const readBack = getActiveEnvironment();
         if (!readBack || readBack.type !== 'unclaimed') {
             logError('[unclaimed-env-provision] Config read-back failed after save — claim token may not persist');
-            clack.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');
+            ui.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');
             return false;
         }
         logInfo('[unclaimed-env-provision] Unclaimed environment provisioned and saved');
-        const inner = ` ✓ ${chalk.green('Environment provisioned')} — Run ${chalk.cyan('workos env claim')} to keep it. `;
-        renderStderrBox(inner, chalk.green);
+        renderStderrNotice(`${chalk.green('✓')} ${chalk.bold('Environment provisioned')} ${chalk.dim('— credentials saved to your project')}`, `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to link it to your account.')}`);
         return true;
     }
     catch (error) {
@@ -64,12 +67,12 @@ export async function tryProvisionUnclaimedEnv(options) {
         logError('[unclaimed-env-provision] Failed:', message);
         if (error instanceof UnclaimedEnvApiError) {
             if (error.statusCode === 429) {
-                clack.log.warn('WorkOS is busy, falling back to login...');
+                ui.log.warn('WorkOS is busy, falling back to login...');
             }
         }
         else {
             // Non-API errors (filesystem, keyring) are unexpected — surface to user
-            clack.log.warn(`Could not set up environment: ${message}. Falling back to login...`);
+            ui.log.warn(`Could not set up environment: ${message}. Falling back to login...`);
         }
         return false;
     }

package/dist/lib/unclaimed-env-provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"unclaimed-env-provision.js","sourceRoot":"","sources":["../../src/lib/unclaimed-env-provision.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,MAAM,mBAAmB,CAAC;AAUtC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqC;IAClF,IAAI,CAAC;QACH,OAAO,CAAC,yEAAyE,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,MAAM,6BAA6B,EAAE,CAAC;QAErD,iFAAiF;QACjF,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,MAAM,CAAC,QAAQ;YACjC,kBAAkB,EAAE,MAAM,CAAC,UAAU;SACtC,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEjD,mDAAmD;QACnD,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG;YACjC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC;QACvC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/C,QAAQ,CAAC,4FAA4F,CAAC,CAAC;YACvG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,uEAAuE,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC;QAClH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,4BAA4B,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Unclaimed environment provisioning helper.\n *\n * Calls the unclaimed env API, saves credentials to config store as type 'unclaimed',\n * and returns whether provisioning succeeded. Non-fatal — wraps everything in\n * try/catch so install flow can fall back to login.\n */\n\nimport chalk from 'chalk';\nimport { provisionUnclaimedEnvironment, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { getConfig, saveConfig, getActiveEnvironment } from './config-store.js';\nimport type { CliConfig } from './config-store.js';\nimport { writeCredentialsEnv } from './env-writer.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { renderStderrBox } from '../utils/box.js';\nimport clack from '../utils/clack.js';\n\nexport interface UnclaimedEnvProvisionOptions {\n  installDir: string;\n  /** Redirect URI key name varies by framework */\n  redirectUriKey?: string;\n  /** Redirect URI value */\n  redirectUri?: string;\n}\n\n/**\n * Try to provision an unclaimed environment. Non-fatal — returns true on success,\n * false on any failure.\n *\n * On success:\n * - Saves environment to config store as type 'unclaimed'\n * - Sets it as active environment\n * - Writes credentials (including cookie password and claim token) to .env.local\n */\nexport async function tryProvisionUnclaimedEnv(options: UnclaimedEnvProvisionOptions): Promise<boolean> {\n  try {\n    logInfo('[unclaimed-env-provision] Attempting unclaimed environment provisioning');\n\n    const result = await provisionUnclaimedEnvironment();\n\n    // Write .env.local first — if this fails, config stays clean (no orphan entries)\n    const envVars: Record<string, string> = {\n      WORKOS_API_KEY: result.apiKey,\n      WORKOS_CLIENT_ID: result.clientId,\n      WORKOS_CLAIM_TOKEN: result.claimToken,\n    };\n\n    if (options.redirectUri) {\n      const key = options.redirectUriKey ?? 'WORKOS_REDIRECT_URI';\n      envVars[key] = options.redirectUri;\n    }\n\n    writeCredentialsEnv(options.installDir, envVars);\n\n    // Save to config store (after .env.local succeeds)\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    config.environments['unclaimed'] = {\n      name: 'unclaimed',\n      type: 'unclaimed',\n      apiKey: result.apiKey,\n      clientId: result.clientId,\n      claimToken: result.claimToken,\n    };\n    config.activeEnvironment = 'unclaimed';\n    saveConfig(config);\n\n    // Verify config persisted — critical for `workos env claim` in a later process\n    const readBack = getActiveEnvironment();\n    if (!readBack || readBack.type !== 'unclaimed') {\n      logError('[unclaimed-env-provision] Config read-back failed after save — claim token may not persist');\n      clack.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');\n      return false;\n    }\n\n    logInfo('[unclaimed-env-provision] Unclaimed environment provisioned and saved');\n    const inner = ` ✓ ${chalk.green('Environment provisioned')} — Run ${chalk.cyan('workos env claim')} to keep it. `;\n    renderStderrBox(inner, chalk.green);\n\n    return true;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    logError('[unclaimed-env-provision] Failed:', message);\n\n    if (error instanceof UnclaimedEnvApiError) {\n      if (error.statusCode === 429) {\n        clack.log.warn('WorkOS is busy, falling back to login...');\n      }\n    } else {\n      // Non-API errors (filesystem, keyring) are unexpected — surface to user\n      clack.log.warn(`Could not set up environment: ${message}. Falling back to login...`);\n    }\n\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"unclaimed-env-provision.js","sourceRoot":"","sources":["../../src/lib/unclaimed-env-provision.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAUrE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqC;IAClF,IAAI,CAAC;QACH,OAAO,CAAC,yEAAyE,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,MAAM,6BAA6B,EAAE,CAAC;QAErD,iFAAiF;QACjF,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,MAAM,CAAC,QAAQ;YACjC,kBAAkB,EAAE,MAAM,CAAC,UAAU;SACtC,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEjD,8EAA8E;QAC9E,4EAA4E;QAC5E,8BAA8B;QAC9B,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG;YACzB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC;QAC/B,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/C,QAAQ,CAAC,4FAA4F,CAAC,CAAC;YACvG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,uEAAuE,CAAC,CAAC;QACjF,kBAAkB,CAChB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,EAClH,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CACvH,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC7B,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,4BAA4B,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Unclaimed environment provisioning helper.\n *\n * Calls the unclaimed env API, saves credentials to config store as type 'unclaimed',\n * and returns whether provisioning succeeded. Non-fatal — wraps everything in\n * try/catch so install flow can fall back to login.\n */\n\nimport chalk from 'chalk';\nimport { provisionUnclaimedEnvironment, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { getConfig, saveConfig, getActiveEnvironment, freshEnvKey } from './config-store.js';\nimport type { CliConfig } from './config-store.js';\nimport { writeCredentialsEnv } from './env-writer.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport ui from '../utils/ui.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nexport interface UnclaimedEnvProvisionOptions {\n  installDir: string;\n  /** Redirect URI key name varies by framework */\n  redirectUriKey?: string;\n  /** Redirect URI value */\n  redirectUri?: string;\n}\n\n/**\n * Try to provision an unclaimed environment. Non-fatal — returns true on success,\n * false on any failure.\n *\n * On success:\n * - Saves environment to config store as type 'unclaimed'\n * - Sets it as active environment\n * - Writes credentials (including cookie password and claim token) to .env.local\n */\nexport async function tryProvisionUnclaimedEnv(options: UnclaimedEnvProvisionOptions): Promise<boolean> {\n  try {\n    logInfo('[unclaimed-env-provision] Attempting unclaimed environment provisioning');\n\n    const result = await provisionUnclaimedEnvironment();\n\n    // Write .env.local first — if this fails, config stays clean (no orphan entries)\n    const envVars: Record<string, string> = {\n      WORKOS_API_KEY: result.apiKey,\n      WORKOS_CLIENT_ID: result.clientId,\n      WORKOS_CLAIM_TOKEN: result.claimToken,\n    };\n\n    if (options.redirectUri) {\n      const key = options.redirectUriKey ?? 'WORKOS_REDIRECT_URI';\n      envVars[key] = options.redirectUri;\n    }\n\n    writeCredentialsEnv(options.installDir, envVars);\n\n    // Save to config store (after .env.local succeeds). A fresh key so a repeated\n    // provision never clobbers an earlier env's claim token (unrecoverable — it\n    // lives only in this config).\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    const key = freshEnvKey(config, 'unclaimed');\n    config.environments[key] = {\n      name: key,\n      type: 'unclaimed',\n      apiKey: result.apiKey,\n      clientId: result.clientId,\n      claimToken: result.claimToken,\n    };\n    config.activeEnvironment = key;\n    saveConfig(config);\n\n    // Verify config persisted — critical for `workos env claim` in a later process\n    const readBack = getActiveEnvironment();\n    if (!readBack || readBack.type !== 'unclaimed') {\n      logError('[unclaimed-env-provision] Config read-back failed after save — claim token may not persist');\n      ui.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');\n      return false;\n    }\n\n    logInfo('[unclaimed-env-provision] Unclaimed environment provisioned and saved');\n    renderStderrNotice(\n      `${chalk.green('✓')} ${chalk.bold('Environment provisioned')} ${chalk.dim('— credentials saved to your project')}`,\n      `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to link it to your account.')}`,\n    );\n\n    return true;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    logError('[unclaimed-env-provision] Failed:', message);\n\n    if (error instanceof UnclaimedEnvApiError) {\n      if (error.statusCode === 429) {\n        ui.log.warn('WorkOS is busy, falling back to login...');\n      }\n    } else {\n      // Non-API errors (filesystem, keyring) are unexpected — surface to user\n      ui.log.warn(`Could not set up environment: ${message}. Falling back to login...`);\n    }\n\n    return false;\n  }\n}\n"]}

package/dist/lib/unclaimed-warning.js

@@ -11,8 +11,10 @@ import { getActiveEnvironment, isUnclaimedEnvironment, markEnvironmentClaimed }
 import { createClaimNonce, UnclaimedEnvApiError } from './unclaimed-env-api.js';
 import { logError, logInfo } from '../utils/debug.js';
 import { isJsonMode } from '../utils/output.js';
-import { renderStderrBox } from '../utils/box.js';
+import { renderStderrNotice } from '../utils/box.js';
+import { pill } from '../utils/ui.js';
 import { markStartupNoticeShown } from './startup-notice-gate.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
 let warningShownThisSession = false;
 let claimCheckDoneThisSession = false;
 /**
@@ -58,8 +60,7 @@ export async function warnIfUnclaimed() {
             return;
         warningShownThisSession = true;
         if (!isJsonMode()) {
-            const inner = ` ${chalk.yellow('⚠ Unclaimed environment')} — Run ${chalk.cyan('workos env claim')} to keep your data. `;
-            renderStderrBox(inner, chalk.yellow);
+            renderStderrNotice(`${pill('WARN', 'warn')}  ${chalk.bold('Unclaimed environment')} ${chalk.dim('— not linked to your account')}`, `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to save it — its credentials live only on this machine.')}`);
             // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.
             markStartupNoticeShown();
         }

package/dist/lib/unclaimed-warning.js.map

@@ -1 +1 @@
-{"version":3,"file":"unclaimed-warning.js","sourceRoot":"","sources":["../../src/lib/unclaimed-warning.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO;QAEjD,2DAA2D;QAC3D,2EAA2E;QAC3E,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,yBAAyB,GAAG,IAAI,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,wEAAwE,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBACtE,yEAAyE;oBACzE,yDAAyD;oBACzD,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,0DAA0D,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,wEAAwE;gBACxE,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,QAAQ,CAAC,yCAAyC,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvF,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,yCAAyC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,uBAAuB;YAAE,OAAO;QACpC,uBAAuB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;YACxH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,6EAA6E;YAC7E,sBAAsB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yDAAyD;QACzD,QAAQ,CAAC,uCAAuC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,0BAA0B;IACxC,uBAAuB,GAAG,KAAK,CAAC;IAChC,yBAAyB,GAAG,KAAK,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Unclaimed environment warning module.\n *\n * Shows a one-line stderr warning when the active environment is unclaimed.\n * On first run, checks if the environment was claimed externally (e.g. via\n * browser) and updates the local config if so.\n * Never throws — all errors are caught to avoid blocking management commands.\n */\n\nimport chalk from 'chalk';\nimport { getActiveEnvironment, isUnclaimedEnvironment, markEnvironmentClaimed } from './config-store.js';\nimport { createClaimNonce, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { logError, logInfo } from '../utils/debug.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrBox } from '../utils/box.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\n\nlet warningShownThisSession = false;\nlet claimCheckDoneThisSession = false;\n\n/**\n * Show a warning if the active environment is unclaimed.\n * Non-blocking — never throws.\n */\nexport async function warnIfUnclaimed(): Promise<void> {\n  try {\n    const env = getActiveEnvironment();\n    if (!env || !isUnclaimedEnvironment(env)) return;\n\n    // Check once per session if the env was claimed externally\n    // claimToken and clientId guaranteed present by UnclaimedEnvironmentConfig\n    if (!claimCheckDoneThisSession) {\n      claimCheckDoneThisSession = true;\n      try {\n        const result = await createClaimNonce(env.clientId, env.claimToken);\n        if (result.alreadyClaimed) {\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Environment was claimed externally, config updated');\n          return;\n        }\n      } catch (error) {\n        if (error instanceof UnclaimedEnvApiError && error.statusCode === 401) {\n          // 401 likely means the claim token was invalidated after the environment\n          // was claimed. We assume claimed and promote to sandbox.\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Claim token invalid/expired, removed');\n          return;\n        }\n        // Log non-401 errors for diagnostics, then fall through to show warning\n        if (error instanceof UnclaimedEnvApiError) {\n          logError('[unclaimed-warning] Claim check failed:', error.statusCode, error.message);\n        } else {\n          logError('[unclaimed-warning] Claim check failed:', error instanceof Error ? error.message : String(error));\n        }\n      }\n    }\n\n    // Show warning once per session\n    if (warningShownThisSession) return;\n    warningShownThisSession = true;\n\n    if (!isJsonMode()) {\n      const inner = ` ${chalk.yellow('⚠ Unclaimed environment')} — Run ${chalk.cyan('workos env claim')} to keep your data. `;\n      renderStderrBox(inner, chalk.yellow);\n      // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n      markStartupNoticeShown();\n    }\n  } catch (error) {\n    // Never block command execution, but log for diagnostics\n    logError('[unclaimed-warning] Unexpected error:', error instanceof Error ? error.message : String(error));\n  }\n}\n\n/** Reset session state (for testing) */\nexport function resetUnclaimedWarningState(): void {\n  warningShownThisSession = false;\n  claimCheckDoneThisSession = false;\n}\n"]}
+{"version":3,"file":"unclaimed-warning.js","sourceRoot":"","sources":["../../src/lib/unclaimed-warning.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO;QAEjD,2DAA2D;QAC3D,2EAA2E;QAC3E,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,yBAAyB,GAAG,IAAI,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,wEAAwE,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBACtE,yEAAyE;oBACzE,yDAAyD;oBACzD,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,0DAA0D,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,wEAAwE;gBACxE,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,QAAQ,CAAC,yCAAyC,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvF,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,yCAAyC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,uBAAuB;YAAE,OAAO;QACpC,uBAAuB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,kBAAkB,CAChB,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,EAC9G,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,EAAE,CACnJ,CAAC;YACF,6EAA6E;YAC7E,sBAAsB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yDAAyD;QACzD,QAAQ,CAAC,uCAAuC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,0BAA0B;IACxC,uBAAuB,GAAG,KAAK,CAAC;IAChC,yBAAyB,GAAG,KAAK,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Unclaimed environment warning module.\n *\n * Shows a one-line stderr warning when the active environment is unclaimed.\n * On first run, checks if the environment was claimed externally (e.g. via\n * browser) and updates the local config if so.\n * Never throws — all errors are caught to avoid blocking management commands.\n */\n\nimport chalk from 'chalk';\nimport { getActiveEnvironment, isUnclaimedEnvironment, markEnvironmentClaimed } from './config-store.js';\nimport { createClaimNonce, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { logError, logInfo } from '../utils/debug.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport { pill } from '../utils/ui.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nlet warningShownThisSession = false;\nlet claimCheckDoneThisSession = false;\n\n/**\n * Show a warning if the active environment is unclaimed.\n * Non-blocking — never throws.\n */\nexport async function warnIfUnclaimed(): Promise<void> {\n  try {\n    const env = getActiveEnvironment();\n    if (!env || !isUnclaimedEnvironment(env)) return;\n\n    // Check once per session if the env was claimed externally\n    // claimToken and clientId guaranteed present by UnclaimedEnvironmentConfig\n    if (!claimCheckDoneThisSession) {\n      claimCheckDoneThisSession = true;\n      try {\n        const result = await createClaimNonce(env.clientId, env.claimToken);\n        if (result.alreadyClaimed) {\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Environment was claimed externally, config updated');\n          return;\n        }\n      } catch (error) {\n        if (error instanceof UnclaimedEnvApiError && error.statusCode === 401) {\n          // 401 likely means the claim token was invalidated after the environment\n          // was claimed. We assume claimed and promote to sandbox.\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Claim token invalid/expired, removed');\n          return;\n        }\n        // Log non-401 errors for diagnostics, then fall through to show warning\n        if (error instanceof UnclaimedEnvApiError) {\n          logError('[unclaimed-warning] Claim check failed:', error.statusCode, error.message);\n        } else {\n          logError('[unclaimed-warning] Claim check failed:', error instanceof Error ? error.message : String(error));\n        }\n      }\n    }\n\n    // Show warning once per session\n    if (warningShownThisSession) return;\n    warningShownThisSession = true;\n\n    if (!isJsonMode()) {\n      renderStderrNotice(\n        `${pill('WARN', 'warn')}  ${chalk.bold('Unclaimed environment')} ${chalk.dim('— not linked to your account')}`,\n        `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to save it — its credentials live only on this machine.')}`,\n      );\n      // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n      markStartupNoticeShown();\n    }\n  } catch (error) {\n    // Never block command execution, but log for diagnostics\n    logError('[unclaimed-warning] Unexpected error:', error instanceof Error ? error.message : String(error));\n  }\n}\n\n/** Reset session state (for testing) */\nexport function resetUnclaimedWarningState(): void {\n  warningShownThisSession = false;\n  claimCheckDoneThisSession = false;\n}\n"]}

package/dist/lib/validation/security-checks.js

@@ -1,4 +1,5 @@
 import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';
+import { formatWorkOSCommand } from '../../utils/command-invocation.js';
 /**
  * The "security subset" of `workos doctor`'s auth-pattern checks that the
  * installer enforces. These are the patterns that are *unsafe* or *leak secrets*
@@ -99,7 +100,7 @@ export function formatBlockingSecurityError(blocking) {
         '',
         ...lines,
         '',
-        'Fix the issues above (or run `workos doctor` for details and remediation) and re-run the installer.',
+        `Fix the issues above (or run \`${formatWorkOSCommand('doctor')}\` for details and remediation) and re-run the installer.`,
     ].join('\n');
 }
 //# sourceMappingURL=security-checks.js.map

package/dist/lib/validation/security-checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-checks.js","sourceRoot":"","sources":["../../../src/lib/validation/security-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,0BAA0B,GAA2B;IACzD,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,cAAc;IAC9B,gBAAgB,EAAE,gBAAgB;CACnC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,UAAkB;IACpF,MAAM,SAAS,GAAkB;QAC/B,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI;QACrD,OAAO,EAAE,IAAI;KACd,CAAC;IACF,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,WAAW,GAAoB;QACnC,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QAChE,IAAI,EAAE,CAAC,CAAC,WAAW;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA8B;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,uDAAuD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC;AACtJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA8B;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,GAAG,KAAK;QACR,EAAE;QACF,qGAAqG;KACtG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC","sourcesContent":["import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';\nimport type { AuthPatternFinding, FrameworkInfo, EnvironmentInfo, SdkInfo } from '../../doctor/types.js';\nimport type { ValidationIssue } from './types.js';\n\n/**\n * The \"security subset\" of `workos doctor`'s auth-pattern checks that the\n * installer enforces. These are the patterns that are *unsafe* or *leak secrets*\n * (an unsafe GET sign-out, an API key in client env/source, an ungitignored\n * .env). Completeness checks (missing middleware/callback/provider) are\n * intentionally excluded here — `validateInstallation` already covers those, and\n * they carry higher false-positive risk than we want gating install success.\n *\n * Keep in sync with the codes emitted by `src/doctor/checks/auth-patterns.ts`.\n */\nconst SECURITY_FINDING_CODES = new Set<string>([\n  'SIGNOUT_GET_HANDLER',\n  'SIGNOUT_LINK_PREFETCH',\n  'API_KEY_LEAKED_TO_CLIENT',\n  'API_KEY_IN_SOURCE',\n  'ENV_FILE_NOT_GITIGNORED',\n  'MIXED_ENVIRONMENT',\n]);\n\n/** Map an installer integration id to the framework name doctor's checks expect. */\nconst INTEGRATION_FRAMEWORK_NAME: Record<string, string> = {\n  nextjs: 'Next.js',\n  'react-router': 'React Router',\n  'tanstack-start': 'TanStack Start',\n};\n\nexport interface SecurityCheckResult {\n  /** All security-class findings for this install (errors + warnings). */\n  findings: AuthPatternFinding[];\n  /**\n   * Error-severity findings that must block a successful install. Empty when the\n   * install is secure; a non-empty list means install should not report success.\n   */\n  blocking: AuthPatternFinding[];\n}\n\n/**\n * Run the security subset of doctor's auth-pattern checks against an install\n * directory. Pure file inspection — no network — so it is safe to call both\n * inside the installer's self-correction loop and as the final pre-success gate.\n *\n * This closes the install-validate ↔ doctor gap: previously install could report\n * `success: true` while `workos doctor` immediately found a security hole,\n * because neither the retry loop nor `validateInstallation` ran these checks.\n */\nexport async function runInstallSecurityChecks(integration: string, installDir: string): Promise<SecurityCheckResult> {\n  const framework: FrameworkInfo = {\n    name: INTEGRATION_FRAMEWORK_NAME[integration] ?? null,\n    version: null,\n  };\n  // checkAuthPatterns loads .env files itself; these structs only satisfy the\n  // shape its non-Next.js checks read from.\n  const environment: EnvironmentInfo = {\n    apiKeyConfigured: false,\n    apiKeyType: null,\n    clientId: null,\n    redirectUri: null,\n    cookieDomain: null,\n    baseUrl: null,\n  };\n  const sdk: SdkInfo = {\n    name: null,\n    version: null,\n    latest: null,\n    outdated: false,\n    isAuthKit: false,\n    language: 'javascript',\n  };\n\n  const result = await checkAuthPatterns({ installDir }, framework, environment, sdk);\n  const findings = result.findings.filter((f) => SECURITY_FINDING_CODES.has(f.code));\n  const blocking = findings.filter((f) => f.severity === 'error');\n  return { findings, blocking };\n}\n\n/** Convert security findings into ValidationIssues for the emitter/report surfaces. */\nexport function securityFindingsToIssues(findings: AuthPatternFinding[]): ValidationIssue[] {\n  return findings.map((f) => ({\n    type: 'pattern',\n    severity: f.severity,\n    message: f.filePath ? `${f.message} (${f.filePath})` : f.message,\n    hint: f.remediation,\n  }));\n}\n\n/**\n * Build an agent correction prompt from security findings so the installer's\n * self-correction loop fixes them before declaring success. Returns an empty\n * string when there is nothing to correct.\n */\nexport function formatSecurityFindingsForAgent(findings: AuthPatternFinding[]): string {\n  if (findings.length === 0) return '';\n  const lines = findings.map((f) => {\n    const loc = f.filePath ? ` in ${f.filePath}` : '';\n    const fix = f.remediation ? ` Fix: ${f.remediation}` : '';\n    return `- [${f.severity}] ${f.message}${loc}.${fix}`;\n  });\n  return `Security checks found issues that must be fixed:\\n\\n${lines.join('\\n')}\\n\\nApply the fixes above, then make sure the project still builds.`;\n}\n\n/**\n * Build the error message thrown when error-severity security findings survive\n * the installer's retries — the message that turns a silent insecure \"success\"\n * into a visible failure.\n */\nexport function formatBlockingSecurityError(blocking: AuthPatternFinding[]): string {\n  const lines = blocking.map((f) => {\n    const loc = f.filePath ? ` (${f.filePath})` : '';\n    return `  • ${f.code}: ${f.message}${loc}`;\n  });\n  return [\n    'Installation produced insecure code that could not be auto-corrected:',\n    '',\n    ...lines,\n    '',\n    'Fix the issues above (or run `workos doctor` for details and remediation) and re-run the installer.',\n  ].join('\\n');\n}\n"]}
+{"version":3,"file":"security-checks.js","sourceRoot":"","sources":["../../../src/lib/validation/security-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAGzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,0BAA0B,GAA2B;IACzD,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,cAAc;IAC9B,gBAAgB,EAAE,gBAAgB;CACnC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,UAAkB;IACpF,MAAM,SAAS,GAAkB;QAC/B,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI;QACrD,OAAO,EAAE,IAAI;KACd,CAAC;IACF,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,WAAW,GAAoB;QACnC,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QAChE,IAAI,EAAE,CAAC,CAAC,WAAW;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA8B;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,uDAAuD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC;AACtJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA8B;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,GAAG,KAAK;QACR,EAAE;QACF,kCAAkC,mBAAmB,CAAC,QAAQ,CAAC,2DAA2D;KAC3H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC","sourcesContent":["import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';\nimport type { AuthPatternFinding, FrameworkInfo, EnvironmentInfo, SdkInfo } from '../../doctor/types.js';\nimport type { ValidationIssue } from './types.js';\nimport { formatWorkOSCommand } from '../../utils/command-invocation.js';\n\n/**\n * The \"security subset\" of `workos doctor`'s auth-pattern checks that the\n * installer enforces. These are the patterns that are *unsafe* or *leak secrets*\n * (an unsafe GET sign-out, an API key in client env/source, an ungitignored\n * .env). Completeness checks (missing middleware/callback/provider) are\n * intentionally excluded here — `validateInstallation` already covers those, and\n * they carry higher false-positive risk than we want gating install success.\n *\n * Keep in sync with the codes emitted by `src/doctor/checks/auth-patterns.ts`.\n */\nconst SECURITY_FINDING_CODES = new Set<string>([\n  'SIGNOUT_GET_HANDLER',\n  'SIGNOUT_LINK_PREFETCH',\n  'API_KEY_LEAKED_TO_CLIENT',\n  'API_KEY_IN_SOURCE',\n  'ENV_FILE_NOT_GITIGNORED',\n  'MIXED_ENVIRONMENT',\n]);\n\n/** Map an installer integration id to the framework name doctor's checks expect. */\nconst INTEGRATION_FRAMEWORK_NAME: Record<string, string> = {\n  nextjs: 'Next.js',\n  'react-router': 'React Router',\n  'tanstack-start': 'TanStack Start',\n};\n\nexport interface SecurityCheckResult {\n  /** All security-class findings for this install (errors + warnings). */\n  findings: AuthPatternFinding[];\n  /**\n   * Error-severity findings that must block a successful install. Empty when the\n   * install is secure; a non-empty list means install should not report success.\n   */\n  blocking: AuthPatternFinding[];\n}\n\n/**\n * Run the security subset of doctor's auth-pattern checks against an install\n * directory. Pure file inspection — no network — so it is safe to call both\n * inside the installer's self-correction loop and as the final pre-success gate.\n *\n * This closes the install-validate ↔ doctor gap: previously install could report\n * `success: true` while `workos doctor` immediately found a security hole,\n * because neither the retry loop nor `validateInstallation` ran these checks.\n */\nexport async function runInstallSecurityChecks(integration: string, installDir: string): Promise<SecurityCheckResult> {\n  const framework: FrameworkInfo = {\n    name: INTEGRATION_FRAMEWORK_NAME[integration] ?? null,\n    version: null,\n  };\n  // checkAuthPatterns loads .env files itself; these structs only satisfy the\n  // shape its non-Next.js checks read from.\n  const environment: EnvironmentInfo = {\n    apiKeyConfigured: false,\n    apiKeyType: null,\n    clientId: null,\n    redirectUri: null,\n    cookieDomain: null,\n    baseUrl: null,\n  };\n  const sdk: SdkInfo = {\n    name: null,\n    version: null,\n    latest: null,\n    outdated: false,\n    isAuthKit: false,\n    language: 'javascript',\n  };\n\n  const result = await checkAuthPatterns({ installDir }, framework, environment, sdk);\n  const findings = result.findings.filter((f) => SECURITY_FINDING_CODES.has(f.code));\n  const blocking = findings.filter((f) => f.severity === 'error');\n  return { findings, blocking };\n}\n\n/** Convert security findings into ValidationIssues for the emitter/report surfaces. */\nexport function securityFindingsToIssues(findings: AuthPatternFinding[]): ValidationIssue[] {\n  return findings.map((f) => ({\n    type: 'pattern',\n    severity: f.severity,\n    message: f.filePath ? `${f.message} (${f.filePath})` : f.message,\n    hint: f.remediation,\n  }));\n}\n\n/**\n * Build an agent correction prompt from security findings so the installer's\n * self-correction loop fixes them before declaring success. Returns an empty\n * string when there is nothing to correct.\n */\nexport function formatSecurityFindingsForAgent(findings: AuthPatternFinding[]): string {\n  if (findings.length === 0) return '';\n  const lines = findings.map((f) => {\n    const loc = f.filePath ? ` in ${f.filePath}` : '';\n    const fix = f.remediation ? ` Fix: ${f.remediation}` : '';\n    return `- [${f.severity}] ${f.message}${loc}.${fix}`;\n  });\n  return `Security checks found issues that must be fixed:\\n\\n${lines.join('\\n')}\\n\\nApply the fixes above, then make sure the project still builds.`;\n}\n\n/**\n * Build the error message thrown when error-severity security findings survive\n * the installer's retries — the message that turns a silent insecure \"success\"\n * into a visible failure.\n */\nexport function formatBlockingSecurityError(blocking: AuthPatternFinding[]): string {\n  const lines = blocking.map((f) => {\n    const loc = f.filePath ? ` (${f.filePath})` : '';\n    return `  • ${f.code}: ${f.message}${loc}`;\n  });\n  return [\n    'Installation produced insecure code that could not be auto-corrected:',\n    '',\n    ...lines,\n    '',\n    `Fix the issues above (or run \\`${formatWorkOSCommand('doctor')}\\` for details and remediation) and re-run the installer.`,\n  ].join('\\n');\n}\n"]}

package/dist/lib/validation/validator.js

@@ -3,6 +3,7 @@ import { existsSync } from 'fs';
 import { join } from 'path';
 import fg from 'fast-glob';
 import { runBuildValidation } from './build-validator.js';
+import { detectPort } from '../port-detection.js';
 export async function validateInstallation(framework, projectDir, options = {}) {
     const startTime = Date.now();
     const issues = [];
@@ -213,6 +214,29 @@ export async function validateFrameworkSpecific(framework, projectDir) {
     }
     return issues;
 }
+/**
+ * Compares the redirect URI's effective port to the detected dev server port,
+ * for local dev hosts only, and records an error-severity issue on mismatch.
+ * Skips production URIs and placeholder hosts like http://test.
+ */
+function validateRedirectUriPort(url, framework, projectDir, issues) {
+    // Only enforce for local dev hosts; skip production URIs and placeholder
+    // hosts like http://test. Node parses IPv6 hostnames with brackets: [::1].
+    const localHosts = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+    if (!localHosts.has(url.hostname))
+        return;
+    const effectivePort = url.port || (url.protocol === 'https:' ? '443' : '80');
+    const detected = detectPort(framework, projectDir);
+    if (Number(effectivePort) !== detected) {
+        issues.push({
+            type: 'env',
+            severity: 'error',
+            message: `Redirect URI port :${effectivePort} does not match the detected dev server port :${detected}`,
+            hint: `Update the redirect URI to use port :${detected} in .env.local and the WorkOS dashboard ` +
+                `(redirect URI, CORS origin, homepage URL), or change your dev server to run on port ${effectivePort}.`,
+        });
+    }
+}
 /**
  * Validates that the Next.js redirect URI matches an existing callback route.
  *
@@ -237,6 +261,7 @@ async function validateNextjsRedirectUri(projectDir, issues) {
     try {
         const url = new URL(redirectUri);
         callbackPath = url.pathname;
+        validateRedirectUriPort(url, 'nextjs', projectDir, issues);
     }
     catch {
         issues.push({
@@ -272,7 +297,7 @@ async function validateNextjsRedirectUri(projectDir, issues) {
             const actualPath = '/' + existingRoutes[0].replace(/^(src\/)?app\//, '').replace(/\/route\.(ts|tsx|js|jsx)$/, '');
             hint =
                 `Found callback route at ${existingRoutes[0]} but redirect URI points to ${callbackPath}. Either:\n` +
-                    `  1. Change NEXT_PUBLIC_WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\n` +
+                    `  1. Change NEXT_PUBLIC_WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\n` +
                     `  2. Move the route to app/${routePath}/route.ts`;
         }
         issues.push({
@@ -308,6 +333,7 @@ async function validateReactRouterRedirectUri(projectDir, issues) {
     try {
         const url = new URL(redirectUri);
         callbackPath = url.pathname;
+        validateRedirectUriPort(url, 'react-router', projectDir, issues);
     }
     catch {
         issues.push({
@@ -361,7 +387,7 @@ async function validateReactRouterRedirectUri(projectDir, issues) {
                     .replace(/\./g, '/');
             hint =
                 `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\n` +
-                    `  1. Change WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\n` +
+                    `  1. Change WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\n` +
                     `  2. Move the route to app/routes/${dotPath}.tsx`;
         }
         issues.push({
@@ -396,6 +422,7 @@ async function validateTanstackStartRedirectUri(projectDir, issues) {
     try {
         const url = new URL(redirectUri);
         callbackPath = url.pathname;
+        validateRedirectUriPort(url, 'tanstack-start', projectDir, issues);
     }
     catch {
         issues.push({
@@ -433,7 +460,7 @@ async function validateTanstackStartRedirectUri(projectDir, issues) {
                     .replace(/\/index$/, '');
             hint =
                 `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\n` +
-                    `  1. Change WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\n` +
+                    `  1. Change WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\n` +
                     `  2. Move the route to app/routes/${routePath}.tsx`;
         }
         issues.push({