workos 0.5.4 → 0.7.0

package/dist/doctor/agent-prompt.js

@@ -0,0 +1,67 @@
+export function buildDoctorPrompt(context) {
+    const { language, framework, sdk, environment, existingIssues } = context;
+    const projectContext = [
+        `- Language: ${language.name}`,
+        framework.name
+            ? `- Framework: ${framework.name} ${framework.version ?? ''}${framework.variant ? ` (${framework.variant})` : ''}`
+            : null,
+        sdk.name ? `- SDK: ${sdk.name}${sdk.version ? ` v${sdk.version}` : ''}` : '- SDK: Not installed',
+        `- Environment: ${environment.apiKeyType ?? 'Unknown'}`,
+        environment.baseUrl ? `- Base URL: ${environment.baseUrl}` : null,
+    ]
+        .filter(Boolean)
+        .join('\n');
+    const existingIssuesList = existingIssues.length > 0
+        ? existingIssues.map((i) => `- [${i.severity}] ${i.code}: ${i.message}`).join('\n')
+        : 'None detected.';
+    return `You are a WorkOS integration analyst. Analyze this project and identify potential issues with the WorkOS integration.
+
+## Project Context
+${projectContext}
+
+## WorkOS SDK Knowledge (IMPORTANT — do not contradict this)
+- \`@workos-inc/node\` and \`@workos/node\` work in ANY JavaScript runtime (Node.js, browsers, React Native, Expo, Cloudflare Workers, Deno, Bun). Despite the name, they have NO Node.js-specific API dependencies (no \`node:crypto\`, no \`node:fs\`, etc.).
+- \`@workos-inc/node\` supports PKCE (Proof Key for Code Exchange) for client-side authentication flows. Using it in Expo, React Native, or browser SPAs is the CORRECT and recommended approach.
+- AuthKit SDKs (\`@workos/authkit-nextjs\`, \`@workos/authkit-react-router\`, \`@workos/authkit-react\`, \`@workos/authkit-tanstack-react-start\`, etc.) are framework-specific wrappers around the core SDK that add session management, middleware, and auth providers.
+- Legacy scope \`@workos-inc/*\` and new scope \`@workos/*\` are the same SDKs — the org is migrating package names.
+- For non-JS languages: \`workos-python\`, \`workos-ruby\`, \`workos-go\`, \`workos-java\`, \`workos-php\`, \`WorkOS.net\` are server-side SDKs.
+- Do NOT flag \`@workos-inc/node\` as incompatible with client-side, mobile, or non-Node environments. It is designed for universal JavaScript use.
+
+## Already Detected Issues
+${existingIssuesList}
+
+## Your Task
+1. Analyze the project's WorkOS integration based on the context above
+2. Check for framework-specific anti-patterns
+3. Verify the integration follows WorkOS best practices
+4. Identify potential runtime issues
+
+## Output Format
+Return your analysis as a JSON object wrapped in a markdown code block:
+\`\`\`json
+{
+  "findings": [
+    {
+      "severity": "error | warning | info",
+      "title": "Short description",
+      "detail": "What's wrong and why it matters",
+      "remediation": "How to fix it",
+      "filePath": "path/to/relevant/file"
+    }
+  ],
+  "summary": "One paragraph summary of the integration health"
+}
+\`\`\`
+
+## Rules
+- Do NOT repeat issues already detected (listed above)
+- Do NOT contradict the SDK Knowledge section above. If you think an SDK is incompatible with a runtime, re-read that section first.
+- Only report issues you are confident about. Do NOT speculate about potential problems that might exist — report problems that DO exist based on the project context.
+- Focus on framework-specific patterns the static checks can't catch
+- Be specific — reference actual file paths and line patterns
+- Keep findings actionable — every finding must have a remediation
+- Limit to 3-5 most important findings. Fewer high-quality findings beat many speculative ones.
+- If the integration looks good, return an empty findings array and say so in the summary. Do NOT invent problems.
+- The filePath field is optional — only include it if you found a specific file`;
+}
+//# sourceMappingURL=agent-prompt.js.map

package/dist/doctor/agent-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-prompt.js","sourceRoot":"","sources":["../../src/doctor/agent-prompt.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAE1E,MAAM,cAAc,GAAG;QACrB,eAAe,QAAQ,CAAC,IAAI,EAAE;QAC9B,SAAS,CAAC,IAAI;YACZ,CAAC,CAAC,gBAAgB,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAClH,CAAC,CAAC,IAAI;QACR,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;QAChG,kBAAkB,WAAW,CAAC,UAAU,IAAI,SAAS,EAAE;QACvD,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAClE;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,kBAAkB,GACtB,cAAc,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACnF,CAAC,CAAC,gBAAgB,CAAC;IAEvB,OAAO;;;EAGP,cAAc;;;;;;;;;;;EAWd,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gFAkC4D,CAAC;AACjF,CAAC","sourcesContent":["import type { LanguageInfo, FrameworkInfo, SdkInfo, EnvironmentInfo, Issue } from './types.js';\n\nexport interface AnalysisContext {\n  language: LanguageInfo;\n  framework: FrameworkInfo;\n  sdk: SdkInfo;\n  environment: EnvironmentInfo;\n  existingIssues: Issue[];\n}\n\nexport function buildDoctorPrompt(context: AnalysisContext): string {\n  const { language, framework, sdk, environment, existingIssues } = context;\n\n  const projectContext = [\n    `- Language: ${language.name}`,\n    framework.name\n      ? `- Framework: ${framework.name} ${framework.version ?? ''}${framework.variant ? ` (${framework.variant})` : ''}`\n      : null,\n    sdk.name ? `- SDK: ${sdk.name}${sdk.version ? ` v${sdk.version}` : ''}` : '- SDK: Not installed',\n    `- Environment: ${environment.apiKeyType ?? 'Unknown'}`,\n    environment.baseUrl ? `- Base URL: ${environment.baseUrl}` : null,\n  ]\n    .filter(Boolean)\n    .join('\\n');\n\n  const existingIssuesList =\n    existingIssues.length > 0\n      ? existingIssues.map((i) => `- [${i.severity}] ${i.code}: ${i.message}`).join('\\n')\n      : 'None detected.';\n\n  return `You are a WorkOS integration analyst. Analyze this project and identify potential issues with the WorkOS integration.\n\n## Project Context\n${projectContext}\n\n## WorkOS SDK Knowledge (IMPORTANT — do not contradict this)\n- \\`@workos-inc/node\\` and \\`@workos/node\\` work in ANY JavaScript runtime (Node.js, browsers, React Native, Expo, Cloudflare Workers, Deno, Bun). Despite the name, they have NO Node.js-specific API dependencies (no \\`node:crypto\\`, no \\`node:fs\\`, etc.).\n- \\`@workos-inc/node\\` supports PKCE (Proof Key for Code Exchange) for client-side authentication flows. Using it in Expo, React Native, or browser SPAs is the CORRECT and recommended approach.\n- AuthKit SDKs (\\`@workos/authkit-nextjs\\`, \\`@workos/authkit-react-router\\`, \\`@workos/authkit-react\\`, \\`@workos/authkit-tanstack-react-start\\`, etc.) are framework-specific wrappers around the core SDK that add session management, middleware, and auth providers.\n- Legacy scope \\`@workos-inc/*\\` and new scope \\`@workos/*\\` are the same SDKs — the org is migrating package names.\n- For non-JS languages: \\`workos-python\\`, \\`workos-ruby\\`, \\`workos-go\\`, \\`workos-java\\`, \\`workos-php\\`, \\`WorkOS.net\\` are server-side SDKs.\n- Do NOT flag \\`@workos-inc/node\\` as incompatible with client-side, mobile, or non-Node environments. It is designed for universal JavaScript use.\n\n## Already Detected Issues\n${existingIssuesList}\n\n## Your Task\n1. Analyze the project's WorkOS integration based on the context above\n2. Check for framework-specific anti-patterns\n3. Verify the integration follows WorkOS best practices\n4. Identify potential runtime issues\n\n## Output Format\nReturn your analysis as a JSON object wrapped in a markdown code block:\n\\`\\`\\`json\n{\n  \"findings\": [\n    {\n      \"severity\": \"error | warning | info\",\n      \"title\": \"Short description\",\n      \"detail\": \"What's wrong and why it matters\",\n      \"remediation\": \"How to fix it\",\n      \"filePath\": \"path/to/relevant/file\"\n    }\n  ],\n  \"summary\": \"One paragraph summary of the integration health\"\n}\n\\`\\`\\`\n\n## Rules\n- Do NOT repeat issues already detected (listed above)\n- Do NOT contradict the SDK Knowledge section above. If you think an SDK is incompatible with a runtime, re-read that section first.\n- Only report issues you are confident about. Do NOT speculate about potential problems that might exist — report problems that DO exist based on the project context.\n- Focus on framework-specific patterns the static checks can't catch\n- Be specific — reference actual file paths and line patterns\n- Keep findings actionable — every finding must have a remediation\n- Limit to 3-5 most important findings. Fewer high-quality findings beat many speculative ones.\n- If the integration looks good, return an empty findings array and say so in the summary. Do NOT invent problems.\n- The filePath field is optional — only include it if you found a specific file`;\n}\n"]}

package/dist/doctor/checks/ai-analysis.d.ts

@@ -0,0 +1,9 @@
+import { type AnalysisContext } from '../agent-prompt.js';
+import type { AiAnalysis, AiFinding } from '../types.js';
+export declare function parseAiResponse(text: string): {
+    findings: AiFinding[];
+    summary: string;
+};
+export declare function checkAiAnalysis(context: AnalysisContext, options: {
+    skipAi?: boolean;
+}): Promise<AiAnalysis>;

package/dist/doctor/checks/ai-analysis.js

@@ -0,0 +1,122 @@
+import Anthropic from '@anthropic-ai/sdk';
+import { getLlmGatewayUrl, getAuthkitDomain, getCliAuthClientId, getConfig } from '../../lib/settings.js';
+import { getCredentials, isTokenExpired, updateTokens, diagnoseCredentials } from '../../lib/credentials.js';
+import { refreshAccessToken } from '../../lib/token-refresh-client.js';
+import { buildDoctorPrompt } from '../agent-prompt.js';
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+function startSpinner(message) {
+    let i = 0;
+    const interval = setInterval(() => {
+        process.stderr.write(`\r  ${SPINNER_FRAMES[i++ % SPINNER_FRAMES.length]} ${message}`);
+    }, 80);
+    return {
+        stop: () => {
+            clearInterval(interval);
+            process.stderr.write(`\r${' '.repeat(message.length + 6)}\r`);
+        },
+    };
+}
+export function parseAiResponse(text) {
+    const codeBlockMatch = text.match(/```(?:json)?\s*\n?([\s\S]*?)\n?\s*```/);
+    const jsonStr = codeBlockMatch ? codeBlockMatch[1] : text;
+    try {
+        const parsed = JSON.parse(jsonStr.trim());
+        const findings = Array.isArray(parsed.findings)
+            ? parsed.findings.map((f) => ({
+                severity: (['error', 'warning', 'info'].includes(f.severity) ? f.severity : 'info'),
+                title: String(f.title ?? ''),
+                detail: String(f.detail ?? ''),
+                remediation: String(f.remediation ?? ''),
+                filePath: f.filePath ? String(f.filePath) : undefined,
+            }))
+            : [];
+        return { findings, summary: String(parsed.summary ?? '') };
+    }
+    catch {
+        const jsonMatch = text.match(/\{[\s\S]*"findings"[\s\S]*\}/);
+        if (jsonMatch) {
+            try {
+                const parsed = JSON.parse(jsonMatch[0]);
+                return {
+                    findings: Array.isArray(parsed.findings) ? parsed.findings : [],
+                    summary: String(parsed.summary ?? ''),
+                };
+            }
+            catch {
+                // give up
+            }
+        }
+        return { findings: [], summary: text.slice(0, 500) };
+    }
+}
+async function callModel(prompt, model) {
+    let creds = getCredentials();
+    if (!creds)
+        throw new Error('Not authenticated');
+    if (isTokenExpired(creds)) {
+        if (!creds.refreshToken)
+            throw new Error('Session expired — run `workos login` to re-authenticate');
+        const result = await refreshAccessToken(getAuthkitDomain(), getCliAuthClientId());
+        if (!result.success || !result.accessToken || !result.expiresAt) {
+            throw new Error('Session expired — run `workos login` to re-authenticate');
+        }
+        updateTokens(result.accessToken, result.expiresAt, result.refreshToken);
+        creds = getCredentials();
+    }
+    const client = new Anthropic({
+        baseURL: getLlmGatewayUrl(),
+        apiKey: 'gateway',
+        defaultHeaders: { Authorization: `Bearer ${creds.accessToken}` },
+    });
+    const response = await client.messages.create({
+        model,
+        max_tokens: 2048,
+        messages: [{ role: 'user', content: prompt }],
+    });
+    const text = response.content[0];
+    if (text.type === 'text')
+        return text.text;
+    throw new Error('Unexpected response format');
+}
+export async function checkAiAnalysis(context, options) {
+    const model = getConfig().doctorModel;
+    const skippedResult = (reason) => ({
+        findings: [],
+        summary: '',
+        model,
+        durationMs: 0,
+        skipped: true,
+        skipReason: reason,
+    });
+    if (options.skipAi) {
+        return skippedResult('Skipped (--skip-ai flag)');
+    }
+    const creds = getCredentials();
+    if (!creds) {
+        const diag = diagnoseCredentials();
+        process.stderr.write('\n  [credential-debug]\n');
+        for (const line of diag) {
+            process.stderr.write(`    ${line}\n`);
+        }
+        process.stderr.write('\n');
+        return skippedResult('Not authenticated — run `workos login` for AI-powered analysis');
+    }
+    const startTime = Date.now();
+    const spinner = startSpinner('Analyzing project with AI...');
+    try {
+        const prompt = buildDoctorPrompt(context);
+        const responseText = await callModel(prompt, model);
+        const durationMs = Date.now() - startTime;
+        const { findings, summary } = parseAiResponse(responseText);
+        return { findings, summary, model, durationMs };
+    }
+    catch (error) {
+        const durationMs = Date.now() - startTime;
+        const errMsg = error instanceof Error ? error.message : 'Unknown error';
+        return { ...skippedResult(`Analysis failed: ${errMsg}`), durationMs };
+    }
+    finally {
+        spinner.stop();
+    }
+}
+//# sourceMappingURL=ai-analysis.js.map

package/dist/doctor/checks/ai-analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-analysis.js","sourceRoot":"","sources":["../../../src/doctor/checks/ai-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,oBAAoB,CAAC;AAG7E,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACnD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAGlF;gBACV,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC9B,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBACxC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxC,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;iBACtC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACpD,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEjD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACxE,KAAK,GAAG,cAAc,EAAG,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,OAAO,EAAE,gBAAgB,EAAE;QAC3B,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE;KACjE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC3C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB,EAAE,OAA6B;IAC3F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,WAAW,CAAC;IAEtC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;QACrD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,KAAK;QACL,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC,0BAA0B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,aAAa,CAAC,gEAAgE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACxE,OAAO,EAAE,GAAG,aAAa,CAAC,oBAAoB,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["import Anthropic from '@anthropic-ai/sdk';\nimport { getLlmGatewayUrl, getAuthkitDomain, getCliAuthClientId, getConfig } from '../../lib/settings.js';\nimport { getCredentials, isTokenExpired, updateTokens, diagnoseCredentials } from '../../lib/credentials.js';\nimport { refreshAccessToken } from '../../lib/token-refresh-client.js';\nimport { buildDoctorPrompt, type AnalysisContext } from '../agent-prompt.js';\nimport type { AiAnalysis, AiFinding } from '../types.js';\n\nconst SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];\n\nfunction startSpinner(message: string): { stop: () => void } {\n  let i = 0;\n  const interval = setInterval(() => {\n    process.stderr.write(`\\r  ${SPINNER_FRAMES[i++ % SPINNER_FRAMES.length]} ${message}`);\n  }, 80);\n  return {\n    stop: () => {\n      clearInterval(interval);\n      process.stderr.write(`\\r${' '.repeat(message.length + 6)}\\r`);\n    },\n  };\n}\n\nexport function parseAiResponse(text: string): { findings: AiFinding[]; summary: string } {\n  const codeBlockMatch = text.match(/```(?:json)?\\s*\\n?([\\s\\S]*?)\\n?\\s*```/);\n  const jsonStr = codeBlockMatch ? codeBlockMatch[1] : text;\n\n  try {\n    const parsed = JSON.parse(jsonStr.trim());\n    const findings = Array.isArray(parsed.findings)\n      ? parsed.findings.map((f: Record<string, unknown>) => ({\n          severity: (['error', 'warning', 'info'].includes(f.severity as string) ? f.severity : 'info') as\n            | 'error'\n            | 'warning'\n            | 'info',\n          title: String(f.title ?? ''),\n          detail: String(f.detail ?? ''),\n          remediation: String(f.remediation ?? ''),\n          filePath: f.filePath ? String(f.filePath) : undefined,\n        }))\n      : [];\n    return { findings, summary: String(parsed.summary ?? '') };\n  } catch {\n    const jsonMatch = text.match(/\\{[\\s\\S]*\"findings\"[\\s\\S]*\\}/);\n    if (jsonMatch) {\n      try {\n        const parsed = JSON.parse(jsonMatch[0]);\n        return {\n          findings: Array.isArray(parsed.findings) ? parsed.findings : [],\n          summary: String(parsed.summary ?? ''),\n        };\n      } catch {\n        // give up\n      }\n    }\n    return { findings: [], summary: text.slice(0, 500) };\n  }\n}\n\nasync function callModel(prompt: string, model: string): Promise<string> {\n  let creds = getCredentials();\n  if (!creds) throw new Error('Not authenticated');\n\n  if (isTokenExpired(creds)) {\n    if (!creds.refreshToken) throw new Error('Session expired — run `workos login` to re-authenticate');\n    const result = await refreshAccessToken(getAuthkitDomain(), getCliAuthClientId());\n    if (!result.success || !result.accessToken || !result.expiresAt) {\n      throw new Error('Session expired — run `workos login` to re-authenticate');\n    }\n    updateTokens(result.accessToken, result.expiresAt, result.refreshToken);\n    creds = getCredentials()!;\n  }\n\n  const client = new Anthropic({\n    baseURL: getLlmGatewayUrl(),\n    apiKey: 'gateway',\n    defaultHeaders: { Authorization: `Bearer ${creds.accessToken}` },\n  });\n\n  const response = await client.messages.create({\n    model,\n    max_tokens: 2048,\n    messages: [{ role: 'user', content: prompt }],\n  });\n\n  const text = response.content[0];\n  if (text.type === 'text') return text.text;\n  throw new Error('Unexpected response format');\n}\n\nexport async function checkAiAnalysis(context: AnalysisContext, options: { skipAi?: boolean }): Promise<AiAnalysis> {\n  const model = getConfig().doctorModel;\n\n  const skippedResult = (reason: string): AiAnalysis => ({\n    findings: [],\n    summary: '',\n    model,\n    durationMs: 0,\n    skipped: true,\n    skipReason: reason,\n  });\n\n  if (options.skipAi) {\n    return skippedResult('Skipped (--skip-ai flag)');\n  }\n\n  const creds = getCredentials();\n  if (!creds) {\n    const diag = diagnoseCredentials();\n    process.stderr.write('\\n  [credential-debug]\\n');\n    for (const line of diag) {\n      process.stderr.write(`    ${line}\\n`);\n    }\n    process.stderr.write('\\n');\n    return skippedResult('Not authenticated — run `workos login` for AI-powered analysis');\n  }\n\n  const startTime = Date.now();\n  const spinner = startSpinner('Analyzing project with AI...');\n\n  try {\n    const prompt = buildDoctorPrompt(context);\n    const responseText = await callModel(prompt, model);\n    const durationMs = Date.now() - startTime;\n    const { findings, summary } = parseAiResponse(responseText);\n    return { findings, summary, model, durationMs };\n  } catch (error) {\n    const durationMs = Date.now() - startTime;\n    const errMsg = error instanceof Error ? error.message : 'Unknown error';\n    return { ...skippedResult(`Analysis failed: ${errMsg}`), durationMs };\n  } finally {\n    spinner.stop();\n  }\n}\n"]}

package/dist/doctor/checks/auth-patterns.d.ts

@@ -0,0 +1,2 @@
+import type { AuthPatternInfo, FrameworkInfo, EnvironmentInfo, SdkInfo, DoctorOptions } from '../types.js';
+export declare function checkAuthPatterns(options: DoctorOptions, framework: FrameworkInfo, environment: EnvironmentInfo, sdk: SdkInfo): Promise<AuthPatternInfo>;