workos 0.18.0 → 0.19.0

package/dist/commands/login.js

@@ -1,82 +1,91 @@
 import open from 'open';
 import chalk from 'chalk';
-import clack from '../utils/clack.js';
+import ui from '../utils/ui.js';
 import { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';
 import { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';
 import { refreshAccessToken } from '../lib/token-refresh-client.js';
 import { logInfo, logError } from '../utils/debug.js';
-import { fetchStagingCredentials } from '../lib/staging-api.js';
-import { getConfig, saveConfig } from '../lib/config-store.js';
+import { fetchStagingCredentials, StagingApiError } from '../lib/staging-api.js';
+import { analytics } from '../utils/analytics.js';
+import { getConfig, saveConfig, getActiveEnvironment, setActiveEnvironment, freshEnvKey } from '../lib/config-store.js';
 import { formatWorkOSCommand } from '../utils/command-invocation.js';
-import { autoInstallSkills } from './install-skill.js';
-import { isJsonMode } from '../utils/output.js';
-import { isAgentMode, isCiMode } from '../utils/interaction-mode.js';
+import { maybeRunSetupAfter } from './setup.js';
+import { isJsonMode, outputJson } from '../utils/output.js';
+import { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';
 import { ExitCode, exitWithAuthRequired, exitWithCode } from '../utils/exit-codes.js';
 import { requestDeviceCode, pollForToken, DeviceAuthTimeoutError } from '../lib/device-auth.js';
 import { observeHostFailure } from '../lib/host-probe.js';
 /**
- * Best-effort skill install after a successful auth-login.
+ * Does the just-authenticated account differ from the account that owns `prior`?
  *
- * Mirrors the install.ts hook copy, but wraps `autoInstallSkills` in its own
- * try/catch AND a 30s timeout so a skill install hang (e.g. blocked filesystem
- * call) never blocks login completion. Login already succeeded by the time
- * this runs — the user having a working session is the contract that must hold.
- *
- * Extracted from runLogin so it can be unit-tested without standing up the
- * device-auth polling loop.
+ * Email comparison wins when both sides have it (human-readable, survives a
+ * clientId reissue); otherwise fall back to clientId. When neither is available
+ * we cannot tell — return false and let the always-on "Now using" line protect
+ * the user.
  */
-export const SKILL_INSTALL_TIMEOUT_MS = 30 * 1000;
-export async function installSkillsAfterLogin() {
-    let timeoutHandle;
-    try {
-        const timeout = new Promise((resolve) => {
-            timeoutHandle = setTimeout(() => resolve(null), SKILL_INSTALL_TIMEOUT_MS);
-            // Don't keep the event loop alive on this timer — process should exit
-            // immediately if everything else has resolved.
-            timeoutHandle.unref?.();
-        });
-        const result = await Promise.race([autoInstallSkills(), timeout]);
-        if (result && !isJsonMode()) {
-            const skillWord = result.skills.length === 1 ? 'skill' : 'skills';
-            clack.log.info(`Installed ${result.skills.length} WorkOS ${skillWord} for ${result.agents.join(', ')}.`);
-        }
-    }
-    catch {
-        // Skill install must never fail login.
-    }
-    finally {
-        if (timeoutHandle)
-            clearTimeout(timeoutHandle);
-    }
+function isMismatch(prior, account, staging) {
+    if (!prior)
+        return false;
+    if (prior.ownerEmail && account.email)
+        return prior.ownerEmail !== account.email;
+    if (prior.clientId)
+        return prior.clientId !== staging.clientId;
+    return false;
 }
 /**
  * Auto-provision a staging environment after login.
  *
- * Fetches staging credentials using the access token, then saves them
- * as a "staging" environment in the config store. Non-fatal — logs a
- * hint on failure instead of throwing.
+ * Fetches staging credentials for the just-authenticated account and stores
+ * them. On a detected cross-account mismatch, the new account's Staging is
+ * written under a DISTINCT key rather than clobbering the active slot, and the
+ * active pointer is left alone — only a login onto an empty config auto-assigns
+ * the active env. Non-fatal — logs a hint on failure instead of throwing.
  */
-export async function provisionStagingEnvironment(accessToken) {
+export async function provisionStagingEnvironment(accessToken, account) {
     try {
         const staging = await fetchStagingCredentials(accessToken);
         const config = getConfig() ?? { environments: {} };
-        const isFirst = Object.keys(config.environments).length === 0;
-        config.environments['staging'] = {
-            name: 'staging',
+        const priorName = config.activeEnvironment;
+        const prior = priorName ? config.environments[priorName] : undefined; // capture BEFORE write
+        const mismatch = isMismatch(prior, account, staging);
+        // Never overwrite a DIFFERENT account's 'staging' slot in place.
+        const stagingSlot = config.environments['staging'];
+        const slotMismatch = isMismatch(stagingSlot, account, staging);
+        const key = slotMismatch ? freshEnvKey(config, 'staging') : 'staging';
+        config.environments[key] = {
+            name: key,
             type: 'sandbox',
             apiKey: staging.apiKey,
             clientId: staging.clientId,
+            ...(account.email && { ownerEmail: account.email }),
+            ownerUserId: account.userId,
         };
-        if (isFirst || !config.activeEnvironment) {
-            config.activeEnvironment = 'staging';
+        // Only auto-assign active when there is NO valid prior active env.
+        if (!prior) {
+            config.activeEnvironment = key;
         }
         saveConfig(config);
-        logInfo('[login] Staging environment auto-provisioned');
-        return true;
+        logInfo('[login] Staging environment provisioned');
+        return {
+            provisioned: true,
+            activeEnvironment: config.activeEnvironment,
+            envName: key,
+            mismatch,
+            priorEnvName: priorName,
+            priorAccount: prior ? { email: prior.ownerEmail, clientId: prior.clientId } : undefined,
+        };
     }
     catch (error) {
-        logError('[login] Failed to auto-provision staging environment:', error instanceof Error ? error.message : error);
-        return false;
+        logError('[login] Failed to provision staging environment:', error instanceof Error ? error.message : error);
+        // Best-effort, but the failure rate of this onboarding step must be visible:
+        // a silent failure here leaves the user with no active environment for every
+        // later command, indistinguishable in telemetry from a healthy setup.
+        analytics.captureException(error instanceof Error ? error : new Error(String(error)), {
+            command: 'auth.login',
+            phase: 'provision-staging',
+            statusCode: error instanceof StagingApiError ? error.statusCode : undefined,
+        });
+        return { provisioned: false, mismatch: false };
     }
 }
 export async function runLogin() {
@@ -101,35 +110,44 @@ export async function runLogin() {
                 console.log(chalk.dim(`Run \`${formatWorkOSCommand('auth logout')}\` to log out`));
                 return;
             }
+            // Refresh returned no token — record why before falling through to fresh
+            // login. A spike here surfaces token revocation / refresh-endpoint outages
+            // that self-heal into a browser login and would otherwise be invisible.
+            analytics.capture('token_refresh_failed', { errorType: result.errorType ?? 'unknown' });
         }
-        catch {
-            // Refresh failed, proceed with fresh login
+        catch (error) {
+            analytics.capture('token_refresh_failed', { errorType: error instanceof Error ? error.name : 'unknown' });
+            // Refresh failed, proceed with fresh login.
         }
     }
     if (isCiMode()) {
         exitWithAuthRequired('Browser authentication is not available in CI mode. Set WORKOS_API_KEY or configure credentials before running in CI.');
     }
     const authkitDomain = getAuthkitDomain();
-    clack.log.step('Starting authentication...');
+    ui.log.step('Starting authentication...');
     let deviceAuth;
     try {
         deviceAuth = await requestDeviceCode({ clientId, authkitDomain });
     }
     catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
-        clack.log.error(`Failed to start authentication: ${msg}`);
+        ui.log.error(`Failed to start authentication: ${msg}`);
+        analytics.captureException(error instanceof Error ? error : new Error(msg), {
+            command: 'auth.login',
+            phase: 'device-code',
+        });
         exitWithCode(ExitCode.GENERAL_ERROR);
     }
-    clack.log.info(`\nOpen this URL in your browser:\n`);
+    ui.log.info(`\nOpen this URL in your browser:\n`);
     console.log(`  ${deviceAuth.verification_uri}`);
     console.log(`\nEnter code: ${deviceAuth.user_code}\n`);
     try {
         await open(deviceAuth.verification_uri_complete, { wait: false });
         if (isAgentMode()) {
-            clack.log.info('Browser launch attempted. If it did not open on the host, use the manual URL and code above.');
+            ui.log.info('Browser launch attempted. If it did not open on the host, use the manual URL and code above.');
         }
         else {
-            clack.log.info('Browser opened automatically');
+            ui.log.info('Browser opened automatically');
         }
     }
     catch (error) {
@@ -138,9 +156,9 @@ export async function runLogin() {
             target: deviceAuth.verification_uri_complete,
             label: 'auth login browser',
         });
-        clack.log.info('Could not open browser — open the URL above manually.');
+        ui.log.info('Could not open browser — open the URL above manually.');
     }
-    const spinner = clack.spinner();
+    const spinner = ui.spinner();
     spinner.start('Waiting for authentication...');
     try {
         const result = await pollForToken(deviceAuth.device_code, {
@@ -157,27 +175,64 @@ export async function runLogin() {
             refreshToken: result.refreshToken,
         });
         spinner.stop('Authentication successful!');
-        clack.log.success(`Logged in as ${result.email || result.userId}`);
-        clack.log.info(`Token expires in ${expiresInSec} seconds`);
-        const provisioned = await provisionStagingEnvironment(result.accessToken);
-        if (provisioned) {
-            clack.log.success('Staging environment configured automatically');
+        ui.log.success(`Logged in as ${result.email || result.userId}`);
+        ui.log.info(`Token expires in ${expiresInSec} seconds`);
+        const account = { email: result.email, userId: result.userId };
+        const provision = await provisionStagingEnvironment(result.accessToken, account);
+        if (isJsonMode()) {
+            outputJson({
+                status: 'ok',
+                account: { email: account.email ?? null, userId: account.userId },
+                activeEnvironment: provision.activeEnvironment ?? null,
+                mismatch: provision.mismatch,
+            });
+        }
+        else if (provision.provisioned) {
+            if (provision.mismatch) {
+                const priorLabel = provision.priorAccount?.email ?? provision.priorAccount?.clientId ?? provision.priorEnvName;
+                if (isPromptAllowed()) {
+                    const answer = await ui.confirm({
+                        message: `You were using ${provision.priorEnvName} (${priorLabel}, a different account). Switch active environment to ${account.email ?? account.userId}'s Staging?`,
+                        initialValue: false, // default: keep current
+                    });
+                    if (!ui.isCancel(answer) && answer && provision.envName) {
+                        setActiveEnvironment(provision.envName);
+                    }
+                }
+                else {
+                    ui.log.warn(`Logged in as ${account.email ?? account.userId}, but the active environment "${provision.priorEnvName}" belongs to a different account (${priorLabel}). Keeping it active. Run \`${formatWorkOSCommand('env switch')}\` to change environments.`);
+                }
+            }
+            const active = getActiveEnvironment();
+            if (active) {
+                ui.log.success(`Now using: ${active.name} (${active.type}) — ${account.email ?? account.userId}`);
+            }
+            else {
+                ui.log.info(chalk.dim(`Run \`${formatWorkOSCommand('env add')}\` to configure an environment manually`));
+            }
         }
         else {
-            clack.log.info(chalk.dim('Run `workos env add` to configure an environment manually'));
+            ui.log.info(chalk.dim(`Run \`${formatWorkOSCommand('env add')}\` to configure an environment manually`));
         }
-        await installSkillsAfterLogin();
+        await maybeRunSetupAfter('login');
     }
     catch (error) {
-        if (error instanceof DeviceAuthTimeoutError) {
-            spinner.stop('Authentication timed out');
-            clack.log.error('Authentication timed out. Please try again.');
+        const isTimeout = error instanceof DeviceAuthTimeoutError;
+        if (isTimeout) {
+            spinner.stop('Authentication timed out', 1);
+            ui.log.error('Authentication timed out. Please try again.');
         }
         else {
-            spinner.stop('Authentication failed');
+            spinner.stop('Authentication failed', 1);
             const msg = error instanceof Error ? error.message : String(error);
-            clack.log.error(`Authentication error: ${msg}`);
+            ui.log.error(`Authentication error: ${msg}`);
         }
+        // Deliver the real cause to telemetry (the command event alone can't
+        // distinguish a timeout from a network/server auth failure).
+        analytics.captureException(error instanceof Error ? error : new Error(String(error)), {
+            command: 'auth.login',
+            phase: isTimeout ? 'timeout' : 'poll',
+        });
         exitWithCode(ExitCode.GENERAL_ERROR);
     }
 }

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,IAAI,aAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC1E,sEAAsE;YACtE,+CAA+C;YAC/C,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,WAAW,SAAS,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;YAAS,CAAC;QACT,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAE9D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG;YAC/B,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACzC,MAAM,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACvC,CAAC;QAED,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,8CAA8C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,uDAAuD,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,YAAY,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxE,OAAO,CAAC,6CAA6C,CAAC,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,aAAa,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,oBAAoB,CAClB,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QAC1D,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,gBAAgB,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,UAAU,CAAC,yBAAyB;YAC5C,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;YACxD,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAExE,eAAe,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,YAAY,UAAU,CAAC,CAAC;QAE3D,MAAM,WAAW,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,uBAAuB,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import open from 'open';\nimport chalk from 'chalk';\nimport clack from '../utils/clack.js';\nimport { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';\nimport { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';\nimport { refreshAccessToken } from '../lib/token-refresh-client.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { fetchStagingCredentials } from '../lib/staging-api.js';\nimport { getConfig, saveConfig } from '../lib/config-store.js';\nimport type { CliConfig } from '../lib/config-store.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { autoInstallSkills } from './install-skill.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { isAgentMode, isCiMode } from '../utils/interaction-mode.js';\nimport { ExitCode, exitWithAuthRequired, exitWithCode } from '../utils/exit-codes.js';\nimport { requestDeviceCode, pollForToken, DeviceAuthTimeoutError } from '../lib/device-auth.js';\nimport { observeHostFailure } from '../lib/host-probe.js';\n\n/**\n * Best-effort skill install after a successful auth-login.\n *\n * Mirrors the install.ts hook copy, but wraps `autoInstallSkills` in its own\n * try/catch AND a 30s timeout so a skill install hang (e.g. blocked filesystem\n * call) never blocks login completion. Login already succeeded by the time\n * this runs — the user having a working session is the contract that must hold.\n *\n * Extracted from runLogin so it can be unit-tested without standing up the\n * device-auth polling loop.\n */\nexport const SKILL_INSTALL_TIMEOUT_MS = 30 * 1000;\n\nexport async function installSkillsAfterLogin(): Promise<void> {\n  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const timeout = new Promise<null>((resolve) => {\n      timeoutHandle = setTimeout(() => resolve(null), SKILL_INSTALL_TIMEOUT_MS);\n      // Don't keep the event loop alive on this timer — process should exit\n      // immediately if everything else has resolved.\n      timeoutHandle.unref?.();\n    });\n    const result = await Promise.race([autoInstallSkills(), timeout]);\n    if (result && !isJsonMode()) {\n      const skillWord = result.skills.length === 1 ? 'skill' : 'skills';\n      clack.log.info(`Installed ${result.skills.length} WorkOS ${skillWord} for ${result.agents.join(', ')}.`);\n    }\n  } catch {\n    // Skill install must never fail login.\n  } finally {\n    if (timeoutHandle) clearTimeout(timeoutHandle);\n  }\n}\n\n/**\n * Auto-provision a staging environment after login.\n *\n * Fetches staging credentials using the access token, then saves them\n * as a \"staging\" environment in the config store. Non-fatal — logs a\n * hint on failure instead of throwing.\n */\nexport async function provisionStagingEnvironment(accessToken: string): Promise<boolean> {\n  try {\n    const staging = await fetchStagingCredentials(accessToken);\n\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    const isFirst = Object.keys(config.environments).length === 0;\n\n    config.environments['staging'] = {\n      name: 'staging',\n      type: 'sandbox',\n      apiKey: staging.apiKey,\n      clientId: staging.clientId,\n    };\n\n    if (isFirst || !config.activeEnvironment) {\n      config.activeEnvironment = 'staging';\n    }\n\n    saveConfig(config);\n    logInfo('[login] Staging environment auto-provisioned');\n    return true;\n  } catch (error) {\n    logError('[login] Failed to auto-provision staging environment:', error instanceof Error ? error.message : error);\n    return false;\n  }\n}\n\nexport async function runLogin(): Promise<void> {\n  const clientId = getCliAuthClientId();\n\n  // Check if already logged in with valid token\n  if (getAccessToken()) {\n    const creds = getCredentials();\n    console.log(chalk.green(`Already logged in as ${creds?.email ?? 'unknown'}`));\n    console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n    return;\n  }\n\n  // Try to refresh if we have expired credentials with a refresh token\n  const existingCreds = getCredentials();\n  if (existingCreds?.refreshToken && isTokenExpired(existingCreds)) {\n    try {\n      const authkitDomain = getAuthkitDomain();\n      const result = await refreshAccessToken(authkitDomain, clientId);\n      if (result.accessToken && result.expiresAt) {\n        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n        logInfo('[login] Session refreshed via refresh token');\n        console.log(chalk.green(`Already logged in as ${existingCreds.email ?? 'unknown'}`));\n        console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n        return;\n      }\n    } catch {\n      // Refresh failed, proceed with fresh login\n    }\n  }\n\n  if (isCiMode()) {\n    exitWithAuthRequired(\n      'Browser authentication is not available in CI mode. Set WORKOS_API_KEY or configure credentials before running in CI.',\n    );\n  }\n\n  const authkitDomain = getAuthkitDomain();\n\n  clack.log.step('Starting authentication...');\n\n  let deviceAuth;\n  try {\n    deviceAuth = await requestDeviceCode({ clientId, authkitDomain });\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    clack.log.error(`Failed to start authentication: ${msg}`);\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n\n  clack.log.info(`\\nOpen this URL in your browser:\\n`);\n  console.log(`  ${deviceAuth.verification_uri}`);\n  console.log(`\\nEnter code: ${deviceAuth.user_code}\\n`);\n\n  try {\n    await open(deviceAuth.verification_uri_complete, { wait: false });\n    if (isAgentMode()) {\n      clack.log.info('Browser launch attempted. If it did not open on the host, use the manual URL and code above.');\n    } else {\n      clack.log.info('Browser opened automatically');\n    }\n  } catch (error) {\n    observeHostFailure('browser-launch', error, {\n      operation: 'open',\n      target: deviceAuth.verification_uri_complete,\n      label: 'auth login browser',\n    });\n    clack.log.info('Could not open browser — open the URL above manually.');\n  }\n\n  const spinner = clack.spinner();\n  spinner.start('Waiting for authentication...');\n\n  try {\n    const result = await pollForToken(deviceAuth.device_code, {\n      clientId,\n      authkitDomain,\n      interval: deviceAuth.interval,\n    });\n\n    const expiresInSec = Math.round((result.expiresAt - Date.now()) / 1000);\n\n    saveCredentials({\n      accessToken: result.accessToken,\n      expiresAt: result.expiresAt,\n      userId: result.userId,\n      email: result.email,\n      refreshToken: result.refreshToken,\n    });\n\n    spinner.stop('Authentication successful!');\n    clack.log.success(`Logged in as ${result.email || result.userId}`);\n    clack.log.info(`Token expires in ${expiresInSec} seconds`);\n\n    const provisioned = await provisionStagingEnvironment(result.accessToken);\n    if (provisioned) {\n      clack.log.success('Staging environment configured automatically');\n    } else {\n      clack.log.info(chalk.dim('Run `workos env add` to configure an environment manually'));\n    }\n\n    await installSkillsAfterLogin();\n  } catch (error) {\n    if (error instanceof DeviceAuthTimeoutError) {\n      spinner.stop('Authentication timed out');\n      clack.log.error('Authentication timed out. Please try again.');\n    } else {\n      spinner.stop('Authentication failed');\n      const msg = error instanceof Error ? error.message : String(error);\n      clack.log.error(`Authentication error: ${msg}`);\n    }\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAExH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAkB1D;;;;;;;GAOG;AACH,SAAS,UAAU,CACjB,KAAoC,EACpC,OAA2B,EAC3B,OAA6B;IAE7B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC;IACjF,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAA2C;IAE3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,uBAAuB;QAC7F,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAErD,iEAAiE;QACjE,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG;YACzB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YACnD,WAAW,EAAE,OAAO,CAAC,MAAM;SAC5B,CAAC;QAEF,mEAAmE;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC;QACjC,CAAC;QAED,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,yCAAyC,CAAC,CAAC;QAEnD,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,OAAO,EAAE,GAAG;YACZ,QAAQ;YACR,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,kDAAkD,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7G,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,SAAS,CAAC,gBAAgB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;YACpF,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,mBAAmB;YAC1B,UAAU,EAAE,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;IAEtC,8CAA8C;IAC9C,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;IACvC,IAAI,aAAa,EAAE,YAAY,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxE,OAAO,CAAC,6CAA6C,CAAC,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,aAAa,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC1G,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,oBAAoB,CAClB,uHAAuH,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE1C,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;YAC1E,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,aAAa;SACrB,CAAC,CAAC;QACH,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,CAAC,SAAS,IAAI,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QAC9G,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,gBAAgB,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,UAAU,CAAC,yBAAyB;YAC5C,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;QACH,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;YACxD,QAAQ;YACR,aAAa;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAExE,eAAe,CAAC;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,YAAY,UAAU,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEjF,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACjE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,IAAI,IAAI;gBACtD,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,IAAI,SAAS,CAAC,YAAY,EAAE,QAAQ,IAAI,SAAS,CAAC,YAAY,CAAC;gBAC/G,IAAI,eAAe,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;wBAC9B,OAAO,EAAE,kBAAkB,SAAS,CAAC,YAAY,KAAK,UAAU,wDAAwD,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,aAAa;wBACpK,YAAY,EAAE,KAAK,EAAE,wBAAwB;qBAC9C,CAAC,CAAC;oBACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;wBACxD,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC1C,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,gBAAgB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,iCAAiC,SAAS,CAAC,YAAY,qCAAqC,UAAU,+BAA+B,mBAAmB,CAAC,YAAY,CAAC,4BAA4B,CAClP,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACpG,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,mBAAmB,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,KAAK,YAAY,sBAAsB,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC;YAC5C,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,qEAAqE;QACrE,6DAA6D;QAC7D,SAAS,CAAC,gBAAgB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;YACpF,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SACtC,CAAC,CAAC;QACH,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import open from 'open';\nimport chalk from 'chalk';\nimport ui from '../utils/ui.js';\nimport { saveCredentials, getCredentials, getAccessToken, isTokenExpired, updateTokens } from '../lib/credentials.js';\nimport { getCliAuthClientId, getAuthkitDomain } from '../lib/settings.js';\nimport { refreshAccessToken } from '../lib/token-refresh-client.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { fetchStagingCredentials, StagingApiError } from '../lib/staging-api.js';\nimport { analytics } from '../utils/analytics.js';\nimport { getConfig, saveConfig, getActiveEnvironment, setActiveEnvironment, freshEnvKey } from '../lib/config-store.js';\nimport type { CliConfig, EnvironmentConfig } from '../lib/config-store.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { maybeRunSetupAfter } from './setup.js';\nimport { isJsonMode, outputJson } from '../utils/output.js';\nimport { isAgentMode, isCiMode, isPromptAllowed } from '../utils/interaction-mode.js';\nimport { ExitCode, exitWithAuthRequired, exitWithCode } from '../utils/exit-codes.js';\nimport { requestDeviceCode, pollForToken, DeviceAuthTimeoutError } from '../lib/device-auth.js';\nimport { observeHostFailure } from '../lib/host-probe.js';\n\n/**\n * Result of a post-login staging provision. Carries enough context for\n * `runLogin` to detect a cross-account switch and decide how to surface it\n * without ever silently repointing the active environment.\n */\nexport interface StagingProvisionResult {\n  provisioned: boolean;\n  /** Active env name AFTER provisioning (unchanged unless there was no prior active env). */\n  activeEnvironment?: string;\n  /** Key the new Staging env was written under ('staging' or a fresh 'staging-N'). */\n  envName?: string;\n  mismatch: boolean;\n  priorEnvName?: string;\n  priorAccount?: { email?: string; clientId?: string };\n}\n\n/**\n * Does the just-authenticated account differ from the account that owns `prior`?\n *\n * Email comparison wins when both sides have it (human-readable, survives a\n * clientId reissue); otherwise fall back to clientId. When neither is available\n * we cannot tell — return false and let the always-on \"Now using\" line protect\n * the user.\n */\nfunction isMismatch(\n  prior: EnvironmentConfig | undefined,\n  account: { email?: string },\n  staging: { clientId: string },\n): boolean {\n  if (!prior) return false;\n  if (prior.ownerEmail && account.email) return prior.ownerEmail !== account.email;\n  if (prior.clientId) return prior.clientId !== staging.clientId;\n  return false;\n}\n\n/**\n * Auto-provision a staging environment after login.\n *\n * Fetches staging credentials for the just-authenticated account and stores\n * them. On a detected cross-account mismatch, the new account's Staging is\n * written under a DISTINCT key rather than clobbering the active slot, and the\n * active pointer is left alone — only a login onto an empty config auto-assigns\n * the active env. Non-fatal — logs a hint on failure instead of throwing.\n */\nexport async function provisionStagingEnvironment(\n  accessToken: string,\n  account: { email?: string; userId: string },\n): Promise<StagingProvisionResult> {\n  try {\n    const staging = await fetchStagingCredentials(accessToken);\n\n    const config: CliConfig = getConfig() ?? { environments: {} };\n\n    const priorName = config.activeEnvironment;\n    const prior = priorName ? config.environments[priorName] : undefined; // capture BEFORE write\n    const mismatch = isMismatch(prior, account, staging);\n\n    // Never overwrite a DIFFERENT account's 'staging' slot in place.\n    const stagingSlot = config.environments['staging'];\n    const slotMismatch = isMismatch(stagingSlot, account, staging);\n    const key = slotMismatch ? freshEnvKey(config, 'staging') : 'staging';\n\n    config.environments[key] = {\n      name: key,\n      type: 'sandbox',\n      apiKey: staging.apiKey,\n      clientId: staging.clientId,\n      ...(account.email && { ownerEmail: account.email }),\n      ownerUserId: account.userId,\n    };\n\n    // Only auto-assign active when there is NO valid prior active env.\n    if (!prior) {\n      config.activeEnvironment = key;\n    }\n\n    saveConfig(config);\n    logInfo('[login] Staging environment provisioned');\n\n    return {\n      provisioned: true,\n      activeEnvironment: config.activeEnvironment,\n      envName: key,\n      mismatch,\n      priorEnvName: priorName,\n      priorAccount: prior ? { email: prior.ownerEmail, clientId: prior.clientId } : undefined,\n    };\n  } catch (error) {\n    logError('[login] Failed to provision staging environment:', error instanceof Error ? error.message : error);\n    // Best-effort, but the failure rate of this onboarding step must be visible:\n    // a silent failure here leaves the user with no active environment for every\n    // later command, indistinguishable in telemetry from a healthy setup.\n    analytics.captureException(error instanceof Error ? error : new Error(String(error)), {\n      command: 'auth.login',\n      phase: 'provision-staging',\n      statusCode: error instanceof StagingApiError ? error.statusCode : undefined,\n    });\n    return { provisioned: false, mismatch: false };\n  }\n}\n\nexport async function runLogin(): Promise<void> {\n  const clientId = getCliAuthClientId();\n\n  // Check if already logged in with valid token\n  if (getAccessToken()) {\n    const creds = getCredentials();\n    console.log(chalk.green(`Already logged in as ${creds?.email ?? 'unknown'}`));\n    console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n    return;\n  }\n\n  // Try to refresh if we have expired credentials with a refresh token\n  const existingCreds = getCredentials();\n  if (existingCreds?.refreshToken && isTokenExpired(existingCreds)) {\n    try {\n      const authkitDomain = getAuthkitDomain();\n      const result = await refreshAccessToken(authkitDomain, clientId);\n      if (result.accessToken && result.expiresAt) {\n        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n        logInfo('[login] Session refreshed via refresh token');\n        console.log(chalk.green(`Already logged in as ${existingCreds.email ?? 'unknown'}`));\n        console.log(chalk.dim(`Run \\`${formatWorkOSCommand('auth logout')}\\` to log out`));\n        return;\n      }\n      // Refresh returned no token — record why before falling through to fresh\n      // login. A spike here surfaces token revocation / refresh-endpoint outages\n      // that self-heal into a browser login and would otherwise be invisible.\n      analytics.capture('token_refresh_failed', { errorType: result.errorType ?? 'unknown' });\n    } catch (error) {\n      analytics.capture('token_refresh_failed', { errorType: error instanceof Error ? error.name : 'unknown' });\n      // Refresh failed, proceed with fresh login.\n    }\n  }\n\n  if (isCiMode()) {\n    exitWithAuthRequired(\n      'Browser authentication is not available in CI mode. Set WORKOS_API_KEY or configure credentials before running in CI.',\n    );\n  }\n\n  const authkitDomain = getAuthkitDomain();\n\n  ui.log.step('Starting authentication...');\n\n  let deviceAuth;\n  try {\n    deviceAuth = await requestDeviceCode({ clientId, authkitDomain });\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n    ui.log.error(`Failed to start authentication: ${msg}`);\n    analytics.captureException(error instanceof Error ? error : new Error(msg), {\n      command: 'auth.login',\n      phase: 'device-code',\n    });\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n\n  ui.log.info(`\\nOpen this URL in your browser:\\n`);\n  console.log(`  ${deviceAuth.verification_uri}`);\n  console.log(`\\nEnter code: ${deviceAuth.user_code}\\n`);\n\n  try {\n    await open(deviceAuth.verification_uri_complete, { wait: false });\n    if (isAgentMode()) {\n      ui.log.info('Browser launch attempted. If it did not open on the host, use the manual URL and code above.');\n    } else {\n      ui.log.info('Browser opened automatically');\n    }\n  } catch (error) {\n    observeHostFailure('browser-launch', error, {\n      operation: 'open',\n      target: deviceAuth.verification_uri_complete,\n      label: 'auth login browser',\n    });\n    ui.log.info('Could not open browser — open the URL above manually.');\n  }\n\n  const spinner = ui.spinner();\n  spinner.start('Waiting for authentication...');\n\n  try {\n    const result = await pollForToken(deviceAuth.device_code, {\n      clientId,\n      authkitDomain,\n      interval: deviceAuth.interval,\n    });\n\n    const expiresInSec = Math.round((result.expiresAt - Date.now()) / 1000);\n\n    saveCredentials({\n      accessToken: result.accessToken,\n      expiresAt: result.expiresAt,\n      userId: result.userId,\n      email: result.email,\n      refreshToken: result.refreshToken,\n    });\n\n    spinner.stop('Authentication successful!');\n    ui.log.success(`Logged in as ${result.email || result.userId}`);\n    ui.log.info(`Token expires in ${expiresInSec} seconds`);\n\n    const account = { email: result.email, userId: result.userId };\n    const provision = await provisionStagingEnvironment(result.accessToken, account);\n\n    if (isJsonMode()) {\n      outputJson({\n        status: 'ok',\n        account: { email: account.email ?? null, userId: account.userId },\n        activeEnvironment: provision.activeEnvironment ?? null,\n        mismatch: provision.mismatch,\n      });\n    } else if (provision.provisioned) {\n      if (provision.mismatch) {\n        const priorLabel = provision.priorAccount?.email ?? provision.priorAccount?.clientId ?? provision.priorEnvName;\n        if (isPromptAllowed()) {\n          const answer = await ui.confirm({\n            message: `You were using ${provision.priorEnvName} (${priorLabel}, a different account). Switch active environment to ${account.email ?? account.userId}'s Staging?`,\n            initialValue: false, // default: keep current\n          });\n          if (!ui.isCancel(answer) && answer && provision.envName) {\n            setActiveEnvironment(provision.envName);\n          }\n        } else {\n          ui.log.warn(\n            `Logged in as ${account.email ?? account.userId}, but the active environment \"${provision.priorEnvName}\" belongs to a different account (${priorLabel}). Keeping it active. Run \\`${formatWorkOSCommand('env switch')}\\` to change environments.`,\n          );\n        }\n      }\n      const active = getActiveEnvironment();\n      if (active) {\n        ui.log.success(`Now using: ${active.name} (${active.type}) — ${account.email ?? account.userId}`);\n      } else {\n        ui.log.info(chalk.dim(`Run \\`${formatWorkOSCommand('env add')}\\` to configure an environment manually`));\n      }\n    } else {\n      ui.log.info(chalk.dim(`Run \\`${formatWorkOSCommand('env add')}\\` to configure an environment manually`));\n    }\n\n    await maybeRunSetupAfter('login');\n  } catch (error) {\n    const isTimeout = error instanceof DeviceAuthTimeoutError;\n    if (isTimeout) {\n      spinner.stop('Authentication timed out', 1);\n      ui.log.error('Authentication timed out. Please try again.');\n    } else {\n      spinner.stop('Authentication failed', 1);\n      const msg = error instanceof Error ? error.message : String(error);\n      ui.log.error(`Authentication error: ${msg}`);\n    }\n    // Deliver the real cause to telemetry (the command event alone can't\n    // distinguish a timeout from a network/server auth failure).\n    analytics.captureException(error instanceof Error ? error : new Error(String(error)), {\n      command: 'auth.login',\n      phase: isTimeout ? 'timeout' : 'poll',\n    });\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n"]}

package/dist/commands/logout.js

@@ -1,17 +1,17 @@
-import clack from '../utils/clack.js';
+import ui from '../utils/ui.js';
 import { clearCredentials, hasCredentials, getCredentials } from '../lib/credentials.js';
 export async function runLogout() {
     if (!hasCredentials()) {
-        clack.log.info('Not logged in');
+        ui.log.info('Not logged in');
         return;
     }
     const creds = getCredentials();
     clearCredentials();
     if (creds?.email) {
-        clack.log.success(`Logged out from ${creds.email}`);
+        ui.log.success(`Logged out from ${creds.email}`);
     }
     else {
-        clack.log.success('Logged out successfully');
+        ui.log.success('Logged out successfully');
     }
 }
 //# sourceMappingURL=logout.js.map

package/dist/commands/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,gBAAgB,EAAE,CAAC;IAEnB,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;QACjB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC","sourcesContent":["import clack from '../utils/clack.js';\nimport { clearCredentials, hasCredentials, getCredentials } from '../lib/credentials.js';\n\nexport async function runLogout(): Promise<void> {\n  if (!hasCredentials()) {\n    clack.log.info('Not logged in');\n    return;\n  }\n\n  const creds = getCredentials();\n  clearCredentials();\n\n  if (creds?.email) {\n    clack.log.success(`Logged out from ${creds.email}`);\n  } else {\n    clack.log.success('Logged out successfully');\n  }\n}\n"]}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,gBAAgB,EAAE,CAAC;IAEnB,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["import ui from '../utils/ui.js';\nimport { clearCredentials, hasCredentials, getCredentials } from '../lib/credentials.js';\n\nexport async function runLogout(): Promise<void> {\n  if (!hasCredentials()) {\n    ui.log.info('Not logged in');\n    return;\n  }\n\n  const creds = getCredentials();\n  clearCredentials();\n\n  if (creds?.email) {\n    ui.log.success(`Logged out from ${creds.email}`);\n  } else {\n    ui.log.success('Logged out successfully');\n  }\n}\n"]}

package/dist/commands/mcp.js

@@ -1,16 +1,7 @@
-import clack from '../utils/clack.js';
+import ui from '../utils/ui.js';
 import { outputSuccess, outputJson, outputTable, exitWithError, isJsonMode } from '../utils/output.js';
 import { ExitCode, exitWithCode } from '../utils/exit-codes.js';
-import { createMcpClients, detectMcpClients, MCP_AGENT_KEYS, } from '../lib/mcp-clients.js';
-/** Human phrasing for each outcome (JSON mode emits the raw `outcome` value). */
-const OUTCOME_LABEL = {
-    installed: 'installed',
-    'already-installed': 'already installed',
-    removed: 'removed',
-    'not-installed': 'not installed',
-    skipped: 'skipped',
-    failed: 'failed',
-};
+import { createMcpClients, detectMcpClients, MCP_AGENT_KEYS, MCP_OUTCOME_LABELS, } from '../lib/mcp-clients.js';
 /**
  * Validate `--agent` values against known keys. Unknown values exit with a
  * structured `unknown_agent` error. Returns undefined (no filter) when none
@@ -34,7 +25,7 @@ function reportNoAgents() {
         outputSuccess('No supported coding agents detected', { agents: [] });
     }
     else {
-        clack.log.info('No supported coding agents detected (looked for Claude Code, Codex, Cursor).');
+        ui.log.info('No supported coding agents detected (looked for Claude Code, Codex, Cursor).');
     }
 }
 /**
@@ -47,15 +38,15 @@ function reportResults(message, results) {
     }
     else {
         for (const r of results) {
-            const line = `${r.displayName}: ${OUTCOME_LABEL[r.outcome]}`;
+            const line = `${r.displayName}: ${MCP_OUTCOME_LABELS[r.outcome]}`;
             if (r.outcome === 'failed') {
-                clack.log.error(r.error ? `${line} — ${r.error}` : line);
+                ui.log.error(r.error ? `${line} — ${r.error}` : line);
             }
             else if (r.outcome === 'installed' || r.outcome === 'removed' || r.outcome === 'already-installed') {
-                clack.log.success(line);
+                ui.log.success(line);
             }
             else {
-                clack.log.info(line);
+                ui.log.info(line);
             }
         }
     }

package/dist/commands/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAe/B,iFAAiF;AACjF,MAAM,aAAa,GAA+C;IAChE,SAAS,EAAE,WAAW;IACtB,mBAAmB,EAAE,mBAAmB;IACxC,OAAO,EAAE,SAAS;IAClB,eAAe,EAAE,eAAe;IAChC,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,aAAa,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc;IACrB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,OAA0B;IAChE,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACrG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,aAAa,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA6B,EAAE;IAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,aAAa,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,oEAAoE;IACpE,8DAA8D;IAC9D,mDAAmD;IACnD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACtF,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,WAAW,CACT,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EACvE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC","sourcesContent":["import clack from '../utils/clack.js';\nimport { outputSuccess, outputJson, outputTable, exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport {\n  createMcpClients,\n  detectMcpClients,\n  MCP_AGENT_KEYS,\n  type McpAgentKey,\n  type McpClientResult,\n} from '../lib/mcp-clients.js';\n\n/**\n * `workos mcp install | remove | status` handlers.\n *\n * Thin callers over `lib/mcp-clients.ts`: detect the clients, run the\n * operation, and format the per-agent matrix in both output modes. No prompts\n * (non-TTY-safe by construction) and no auth guard — the WorkOS MCP server is\n * secret-free, so configuring it never needs an API key.\n */\n\nexport interface McpCommandOptions {\n  agent?: string[];\n}\n\n/** Human phrasing for each outcome (JSON mode emits the raw `outcome` value). */\nconst OUTCOME_LABEL: Record<McpClientResult['outcome'], string> = {\n  installed: 'installed',\n  'already-installed': 'already installed',\n  removed: 'removed',\n  'not-installed': 'not installed',\n  skipped: 'skipped',\n  failed: 'failed',\n};\n\n/**\n * Validate `--agent` values against known keys. Unknown values exit with a\n * structured `unknown_agent` error. Returns undefined (no filter) when none\n * were passed, so callers act on all detected agents.\n */\nfunction resolveAgentFilter(agent?: string[]): McpAgentKey[] | undefined {\n  if (!agent || agent.length === 0) return undefined;\n  const unknown = agent.filter((a) => !MCP_AGENT_KEYS.includes(a as McpAgentKey));\n  if (unknown.length > 0) {\n    exitWithError({\n      code: 'unknown_agent',\n      message: `Unknown agent(s): ${unknown.join(', ')}. Supported: ${MCP_AGENT_KEYS.join(', ')}.`,\n    });\n  }\n  return agent as McpAgentKey[];\n}\n\n/** Zero detected agents: same message + exit 0 for both install and remove. */\nfunction reportNoAgents(): void {\n  if (isJsonMode()) {\n    outputSuccess('No supported coding agents detected', { agents: [] });\n  } else {\n    clack.log.info('No supported coding agents detected (looked for Claude Code, Codex, Cursor).');\n  }\n}\n\n/**\n * Emit the per-agent matrix, then exit non-zero if any agent failed. The full\n * matrix is always emitted first so partial success is still fully reported.\n */\nfunction reportResults(message: string, results: McpClientResult[]): void {\n  if (isJsonMode()) {\n    outputSuccess(message, { agents: results });\n  } else {\n    for (const r of results) {\n      const line = `${r.displayName}: ${OUTCOME_LABEL[r.outcome]}`;\n      if (r.outcome === 'failed') {\n        clack.log.error(r.error ? `${line} — ${r.error}` : line);\n      } else if (r.outcome === 'installed' || r.outcome === 'removed' || r.outcome === 'already-installed') {\n        clack.log.success(line);\n      } else {\n        clack.log.info(line);\n      }\n    }\n  }\n\n  if (results.some((r) => r.outcome === 'failed')) {\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n\nexport async function runMcpInstall(options: McpCommandOptions = {}): Promise<void> {\n  const filter = resolveAgentFilter(options.agent);\n  const clients = await detectMcpClients(filter);\n  if (clients.length === 0) {\n    reportNoAgents();\n    return;\n  }\n  const results: McpClientResult[] = [];\n  for (const client of clients) {\n    results.push(await client.add());\n  }\n  reportResults('Configured WorkOS MCP server', results);\n}\n\nexport async function runMcpRemove(options: McpCommandOptions = {}): Promise<void> {\n  const filter = resolveAgentFilter(options.agent);\n  const clients = await detectMcpClients(filter);\n  if (clients.length === 0) {\n    reportNoAgents();\n    return;\n  }\n  const results: McpClientResult[] = [];\n  for (const client of clients) {\n    results.push(await client.remove());\n  }\n  reportResults('Removed WorkOS MCP server', results);\n}\n\nexport async function runMcpStatus(): Promise<void> {\n  // Status lists every known agent (not just available ones) with its\n  // availability + install flags, so `createMcpClients()` — not\n  // `detectMcpClients()` — is the right source here.\n  const clients = createMcpClients();\n  const agents = await Promise.all(\n    clients.map(async (client) => {\n      const available = await client.isAvailable();\n      const installed = available ? await client.isInstalled() : false;\n      return { agent: client.key, displayName: client.displayName, available, installed };\n    }),\n  );\n\n  if (isJsonMode()) {\n    outputJson({ data: { agents } });\n    return;\n  }\n\n  outputTable(\n    [{ header: 'Agent' }, { header: 'Available' }, { header: 'Installed' }],\n    agents.map((a) => [a.displayName, a.available ? 'yes' : 'no', a.installed ? 'yes' : 'no']),\n  );\n}\n"]}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAe/B;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,aAAa,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc;IACrB,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,OAA0B;IAChE,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,aAAa,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,WAAW,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3B,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBACrG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,aAAa,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA6B,EAAE;IAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,aAAa,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,oEAAoE;IACpE,8DAA8D;IAC9D,mDAAmD;IACnD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACtF,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,WAAW,CACT,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EACvE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC","sourcesContent":["import ui from '../utils/ui.js';\nimport { outputSuccess, outputJson, outputTable, exitWithError, isJsonMode } from '../utils/output.js';\nimport { ExitCode, exitWithCode } from '../utils/exit-codes.js';\nimport {\n  createMcpClients,\n  detectMcpClients,\n  MCP_AGENT_KEYS,\n  MCP_OUTCOME_LABELS,\n  type McpAgentKey,\n  type McpClientResult,\n} from '../lib/mcp-clients.js';\n\n/**\n * `workos mcp install | remove | status` handlers.\n *\n * Thin callers over `lib/mcp-clients.ts`: detect the clients, run the\n * operation, and format the per-agent matrix in both output modes. No prompts\n * (non-TTY-safe by construction) and no auth guard — the WorkOS MCP server is\n * secret-free, so configuring it never needs an API key.\n */\n\nexport interface McpCommandOptions {\n  agent?: string[];\n}\n\n/**\n * Validate `--agent` values against known keys. Unknown values exit with a\n * structured `unknown_agent` error. Returns undefined (no filter) when none\n * were passed, so callers act on all detected agents.\n */\nfunction resolveAgentFilter(agent?: string[]): McpAgentKey[] | undefined {\n  if (!agent || agent.length === 0) return undefined;\n  const unknown = agent.filter((a) => !MCP_AGENT_KEYS.includes(a as McpAgentKey));\n  if (unknown.length > 0) {\n    exitWithError({\n      code: 'unknown_agent',\n      message: `Unknown agent(s): ${unknown.join(', ')}. Supported: ${MCP_AGENT_KEYS.join(', ')}.`,\n    });\n  }\n  return agent as McpAgentKey[];\n}\n\n/** Zero detected agents: same message + exit 0 for both install and remove. */\nfunction reportNoAgents(): void {\n  if (isJsonMode()) {\n    outputSuccess('No supported coding agents detected', { agents: [] });\n  } else {\n    ui.log.info('No supported coding agents detected (looked for Claude Code, Codex, Cursor).');\n  }\n}\n\n/**\n * Emit the per-agent matrix, then exit non-zero if any agent failed. The full\n * matrix is always emitted first so partial success is still fully reported.\n */\nfunction reportResults(message: string, results: McpClientResult[]): void {\n  if (isJsonMode()) {\n    outputSuccess(message, { agents: results });\n  } else {\n    for (const r of results) {\n      const line = `${r.displayName}: ${MCP_OUTCOME_LABELS[r.outcome]}`;\n      if (r.outcome === 'failed') {\n        ui.log.error(r.error ? `${line} — ${r.error}` : line);\n      } else if (r.outcome === 'installed' || r.outcome === 'removed' || r.outcome === 'already-installed') {\n        ui.log.success(line);\n      } else {\n        ui.log.info(line);\n      }\n    }\n  }\n\n  if (results.some((r) => r.outcome === 'failed')) {\n    exitWithCode(ExitCode.GENERAL_ERROR);\n  }\n}\n\nexport async function runMcpInstall(options: McpCommandOptions = {}): Promise<void> {\n  const filter = resolveAgentFilter(options.agent);\n  const clients = await detectMcpClients(filter);\n  if (clients.length === 0) {\n    reportNoAgents();\n    return;\n  }\n  const results: McpClientResult[] = [];\n  for (const client of clients) {\n    results.push(await client.add());\n  }\n  reportResults('Configured WorkOS MCP server', results);\n}\n\nexport async function runMcpRemove(options: McpCommandOptions = {}): Promise<void> {\n  const filter = resolveAgentFilter(options.agent);\n  const clients = await detectMcpClients(filter);\n  if (clients.length === 0) {\n    reportNoAgents();\n    return;\n  }\n  const results: McpClientResult[] = [];\n  for (const client of clients) {\n    results.push(await client.remove());\n  }\n  reportResults('Removed WorkOS MCP server', results);\n}\n\nexport async function runMcpStatus(): Promise<void> {\n  // Status lists every known agent (not just available ones) with its\n  // availability + install flags, so `createMcpClients()` — not\n  // `detectMcpClients()` — is the right source here.\n  const clients = createMcpClients();\n  const agents = await Promise.all(\n    clients.map(async (client) => {\n      const available = await client.isAvailable();\n      const installed = available ? await client.isInstalled() : false;\n      return { agent: client.key, displayName: client.displayName, available, installed };\n    }),\n  );\n\n  if (isJsonMode()) {\n    outputJson({ data: { agents } });\n    return;\n  }\n\n  outputTable(\n    [{ header: 'Agent' }, { header: 'Available' }, { header: 'Installed' }],\n    agents.map((a) => [a.displayName, a.available ? 'yes' : 'no', a.installed ? 'yes' : 'no']),\n  );\n}\n"]}

package/dist/commands/migrations.js

@@ -1,3 +1,4 @@
+import { getWorkOSCommand } from '../utils/command-invocation.js';
 const workosOnlyMigrationsFlags = new Map([
     ['--api-key', true],
     ['--insecure-storage', false],
@@ -43,7 +44,7 @@ export async function runMigrations(args, apiKey, apiBaseUrl) {
         process.env.WORKOS_API_URL = apiBaseUrl;
     }
     const { program } = (await import('@workos/migrations/dist/cli/index.js'));
-    program.name('workos migrations');
+    program.name(`${getWorkOSCommand()} migrations`);
     await program.parseAsync(args, { from: 'user' });
 }
 //# sourceMappingURL=migrations.js.map

package/dist/commands/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/commands/migrations.ts"],"names":[],"mappings":"AAAA,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,CAAC,WAAW,EAAE,IAAI,CAAC;IACnB,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAC7B,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,QAAQ,EAAE,IAAI,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAAC,OAAiB;IAC5D,IAAI,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,aAAa,GAAG,CAAC,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,MAAe,EAAE,UAAmB;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;IAC1C,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAKxE,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC","sourcesContent":["const workosOnlyMigrationsFlags = new Map([\n  ['--api-key', true],\n  ['--insecure-storage', false],\n  ['--json', false],\n  ['--mode', true],\n]);\n\nexport function getMigrationsPassthroughArgs(rawArgs: string[]): string[] {\n  let migrationsIdx = rawArgs.indexOf('migrations');\n\n  for (let i = 0; i < rawArgs.length; i++) {\n    const arg = rawArgs[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    if (arg === 'migrations') {\n      migrationsIdx = i;\n      break;\n    }\n  }\n\n  const after = rawArgs.slice(migrationsIdx + 1);\n  const passthrough: string[] = [];\n\n  for (let i = 0; i < after.length; i++) {\n    const arg = after[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    passthrough.push(arg);\n  }\n\n  return passthrough;\n}\n\nexport async function runMigrations(args: string[], apiKey?: string, apiBaseUrl?: string): Promise<void> {\n  if (apiKey) {\n    process.env.WORKOS_SECRET_KEY = apiKey;\n  }\n  if (apiBaseUrl) {\n    process.env.WORKOS_API_URL = apiBaseUrl;\n  }\n\n  const { program } = (await import('@workos/migrations/dist/cli/index.js')) as {\n    program: {\n      name(str: string): unknown;\n      parseAsync(argv: string[], options?: { from: 'user' }): Promise<unknown>;\n    };\n  };\n\n  program.name('workos migrations');\n  await program.parseAsync(args, { from: 'user' });\n}\n"]}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/commands/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,CAAC,WAAW,EAAE,IAAI,CAAC;IACnB,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAC7B,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,QAAQ,EAAE,IAAI,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,4BAA4B,CAAC,OAAiB;IAC5D,IAAI,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,aAAa,GAAG,CAAC,CAAC;YAClB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,MAAe,EAAE,UAAmB;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;IAC1C,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAKxE,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC","sourcesContent":["import { getWorkOSCommand } from '../utils/command-invocation.js';\n\nconst workosOnlyMigrationsFlags = new Map([\n  ['--api-key', true],\n  ['--insecure-storage', false],\n  ['--json', false],\n  ['--mode', true],\n]);\n\nexport function getMigrationsPassthroughArgs(rawArgs: string[]): string[] {\n  let migrationsIdx = rawArgs.indexOf('migrations');\n\n  for (let i = 0; i < rawArgs.length; i++) {\n    const arg = rawArgs[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    if (arg === 'migrations') {\n      migrationsIdx = i;\n      break;\n    }\n  }\n\n  const after = rawArgs.slice(migrationsIdx + 1);\n  const passthrough: string[] = [];\n\n  for (let i = 0; i < after.length; i++) {\n    const arg = after[i];\n    const key = arg.split('=')[0];\n    const takesValue = workosOnlyMigrationsFlags.get(key);\n\n    if (takesValue !== undefined) {\n      if (takesValue && !arg.includes('=')) i++;\n      continue;\n    }\n\n    passthrough.push(arg);\n  }\n\n  return passthrough;\n}\n\nexport async function runMigrations(args: string[], apiKey?: string, apiBaseUrl?: string): Promise<void> {\n  if (apiKey) {\n    process.env.WORKOS_SECRET_KEY = apiKey;\n  }\n  if (apiBaseUrl) {\n    process.env.WORKOS_API_URL = apiBaseUrl;\n  }\n\n  const { program } = (await import('@workos/migrations/dist/cli/index.js')) as {\n    program: {\n      name(str: string): unknown;\n      parseAsync(argv: string[], options?: { from: 'user' }): Promise<unknown>;\n    };\n  };\n\n  program.name(`${getWorkOSCommand()} migrations`);\n  await program.parseAsync(args, { from: 'user' });\n}\n"]}

package/dist/commands/seed.js

@@ -3,6 +3,7 @@ import chalk from 'chalk';
 import { parse as parseYaml } from 'yaml';
 import { createWorkOSClient } from '../lib/workos-client.js';
 import { outputJson, outputSuccess, isJsonMode, exitWithError } from '../utils/output.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
 const STATE_FILE = '.workos-seed-state.json';
 function loadState() {
     if (!existsSync(STATE_FILE))
@@ -69,7 +70,7 @@ export function runSeedInit() {
     }
     else {
         console.log(chalk.green(`Created ${DEFAULT_SEED_FILE}`));
-        console.log(chalk.dim('Edit the file, then run: workos seed --file=workos-seed.yml'));
+        console.log(chalk.dim(`Edit the file, then run: ${formatWorkOSCommand('seed --file=workos-seed.yml')}`));
     }
 }
 export async function runSeed(options, apiKey, baseUrl) {
@@ -84,13 +85,13 @@ export async function runSeed(options, apiKey, baseUrl) {
     if (!options.file) {
         return exitWithError({
             code: 'missing_args',
-            message: 'Provide a seed file: workos seed --file=workos-seed.yml\nRun workos seed --init to create an example seed file.',
+            message: `Provide a seed file: ${formatWorkOSCommand('seed --file=workos-seed.yml')}\nRun ${formatWorkOSCommand('seed --init')} to create an example seed file.`,
         });
     }
     if (!existsSync(options.file)) {
         return exitWithError({
             code: 'file_not_found',
-            message: `Seed file not found: ${options.file}. Create workos-seed.yml or run \`workos seed\` without --file for interactive mode.`,
+            message: `Seed file not found: ${options.file}. Create workos-seed.yml or run \`${formatWorkOSCommand('seed')}\` without --file for interactive mode.`,
         });
     }
     const raw = readFileSync(options.file, 'utf-8');
@@ -211,7 +212,7 @@ export async function runSeed(options, apiKey, baseUrl) {
         saveState(state);
         exitWithError({
             code: 'seed_failed',
-            message: `Seed failed: ${error instanceof Error ? error.message : 'Unknown error'}. Partial state saved to ${STATE_FILE}. Run \`workos seed --clean\` to tear down.`,
+            message: `Seed failed: ${error instanceof Error ? error.message : 'Unknown error'}. Partial state saved to ${STATE_FILE}. Run \`${formatWorkOSCommand('seed --clean')}\` to tear down.`,
             details: state,
         });
     }