From 6ac65e6ac1337b7c62c74a3aa08a4f922dd1a67a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 8 Jul 2026 02:39:22 +0000 Subject: [PATCH] ci(repo): version packages --- .changeset/api-fapi-passthrough.md | 5 --- .changeset/api-ls-path-separator.md | 5 --- .changeset/clack-prompts-migration.md | 5 --- .changeset/fancy-frogs-open.md | 2 - .changeset/fix-oauth-redirect-fapi.md | 5 --- .changeset/free-breads-pick.md | 2 - .changeset/impersonate.md | 5 --- .changeset/init-expo-setup-skill.md | 5 --- .changeset/input-json-explicit-stdin.md | 5 --- .changeset/interactive-instance-picker.md | 5 --- .changeset/next-steps-animation-order.md | 5 --- .changeset/next-steps-gradient-animation.md | 5 --- .changeset/react-router-v8-noexternal.md | 5 --- .changeset/remove-clerk-cli-skill.md | 5 --- .changeset/sandbox-hint-network-failures.md | 5 --- .changeset/silly-files-hear.md | 2 - .changeset/webhooks-listen-v1.md | 9 ---- packages/cli/CHANGELOG.md | 46 +++++++++++++++++++++ packages/cli/package.json | 2 +- 19 files changed, 47 insertions(+), 81 deletions(-) delete mode 100644 .changeset/api-fapi-passthrough.md delete mode 100644 .changeset/api-ls-path-separator.md delete mode 100644 .changeset/clack-prompts-migration.md delete mode 100644 .changeset/fancy-frogs-open.md delete mode 100644 .changeset/fix-oauth-redirect-fapi.md delete mode 100644 .changeset/free-breads-pick.md delete mode 100644 .changeset/impersonate.md delete mode 100644 .changeset/init-expo-setup-skill.md delete mode 100644 .changeset/input-json-explicit-stdin.md delete mode 100644 .changeset/interactive-instance-picker.md delete mode 100644 .changeset/next-steps-animation-order.md delete mode 100644 .changeset/next-steps-gradient-animation.md delete mode 100644 .changeset/react-router-v8-noexternal.md delete mode 100644 .changeset/remove-clerk-cli-skill.md delete mode 100644 .changeset/sandbox-hint-network-failures.md delete mode 100644 .changeset/silly-files-hear.md delete mode 100644 .changeset/webhooks-listen-v1.md diff --git a/.changeset/api-fapi-passthrough.md b/.changeset/api-fapi-passthrough.md deleted file mode 100644 index 26a8c1c2..00000000 --- a/.changeset/api-fapi-passthrough.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk api --fapi` to call an instance's public Frontend API (e.g. `clerk api --fapi /environment --app `). The FAPI host is resolved from the instance's publishable key, and the request is unauthenticated since these endpoints are public, which closes the loop on verifying config changes end to end with the CLI alone. diff --git a/.changeset/api-ls-path-separator.md b/.changeset/api-ls-path-separator.md deleted file mode 100644 index c26dbe8c..00000000 --- a/.changeset/api-ls-path-separator.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Keep a separator between the path and description in `clerk api ls` so long endpoint paths no longer run straight into their summaries. diff --git a/.changeset/clack-prompts-migration.md b/.changeset/clack-prompts-migration.md deleted file mode 100644 index 90ee7da7..00000000 --- a/.changeset/clack-prompts-migration.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Refresh the visual style of prompts, lists, spinners, and intro/outro brackets to use `@clack/prompts`, and make interactive command endings reflect success, failure, or paused cancellation status. diff --git a/.changeset/fancy-frogs-open.md b/.changeset/fancy-frogs-open.md deleted file mode 100644 index a845151c..00000000 --- a/.changeset/fancy-frogs-open.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/.changeset/fix-oauth-redirect-fapi.md b/.changeset/fix-oauth-redirect-fapi.md deleted file mode 100644 index 801b1c92..00000000 --- a/.changeset/fix-oauth-redirect-fapi.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Fix the OAuth provider walkthrough in `clerk deploy` printing the redirect URI on the wrong subdomain. Previously, the walkthrough showed `https://accounts.{domain}/v1/oauth_callback`, but the callback is served by the Frontend API, so pasting the value into a provider console caused `redirect_uri_mismatch`. The walkthrough now prints the instance's `frontend_api_url` (e.g. `https://clerk.{domain}/v1/oauth_callback`), matching the value shown in the Clerk Dashboard. diff --git a/.changeset/free-breads-pick.md b/.changeset/free-breads-pick.md deleted file mode 100644 index a845151c..00000000 --- a/.changeset/free-breads-pick.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/.changeset/impersonate.md b/.changeset/impersonate.md deleted file mode 100644 index 249d80a3..00000000 --- a/.changeset/impersonate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk impersonate` (alias `clerk imp`) to create a short-lived sign-in URL that logs you in as another user, plus `clerk impersonate revoke` to cancel a pending token. Both require `clerk login` and stamp the impersonation with your account for auditing. diff --git a/.changeset/init-expo-setup-skill.md b/.changeset/init-expo-setup-skill.md deleted file mode 100644 index f1e785b7..00000000 --- a/.changeset/init-expo-setup-skill.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -`clerk init` on Expo projects now installs the `clerk-expo` agent skill (Expo/React Native setup) alongside `clerk-expo-patterns`. The framework skill map supports multiple skills per framework. diff --git a/.changeset/input-json-explicit-stdin.md b/.changeset/input-json-explicit-stdin.md deleted file mode 100644 index 912f9195..00000000 --- a/.changeset/input-json-explicit-stdin.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Only read stdin as `--input-json` when `--input-json -` is passed explicitly. Previously any piped stdin was consumed and parsed as the options payload, which broke shell loops (`while read … | clerk …`) and commands that read their own stdin (`cat body.json | clerk api …`) with a confusing `invalid_json` error. diff --git a/.changeset/interactive-instance-picker.md b/.changeset/interactive-instance-picker.md deleted file mode 100644 index 9ed07507..00000000 --- a/.changeset/interactive-instance-picker.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Resolve the instance explicitly instead of silently defaulting to development: interactive flows (`clerk impersonate`, `clerk impersonate revoke`, `clerk users open`, the create wizard, and the application-picker fallback) now ask in human mode whenever the resolved app has more than one instance and no `--instance` flag pins one, and agent mode errors asking for an explicit `--instance` rather than defaulting — so the same command can't resolve a different instance depending on which instances the app happens to have. User lookups that find no match name the searched app and instance in the error, and instances targeted by raw ID are labeled by their environment type so the production impersonation warning always fires. diff --git a/.changeset/next-steps-animation-order.md b/.changeset/next-steps-animation-order.md deleted file mode 100644 index 18b05b09..00000000 --- a/.changeset/next-steps-animation-order.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Print the "Next steps" list before sweeping the highlight across its header, so the animation no longer leaves a lone "Next steps" line that looks hung while the steps are hidden. diff --git a/.changeset/next-steps-gradient-animation.md b/.changeset/next-steps-gradient-animation.md deleted file mode 100644 index d5236292..00000000 --- a/.changeset/next-steps-gradient-animation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Render the "Next steps" header in a dusty mauve and sweep a white reflex highlight across it once after `clerk deploy`, `clerk link`, and `clerk auth login`, then settle on the flat color. The animation only runs on an interactive color terminal and falls back to plain styling when piped, in CI, or when `NO_COLOR` is set. diff --git a/.changeset/react-router-v8-noexternal.md b/.changeset/react-router-v8-noexternal.md deleted file mode 100644 index 1480cac9..00000000 --- a/.changeset/react-router-v8-noexternal.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Fix `clerk init` for React Router v8 projects by adding `@clerk/react-router` to `ssr.noExternal` in the Vite config, preventing dev-mode SSR from failing with "useNavigate() may be used only in the context of a ". diff --git a/.changeset/remove-clerk-cli-skill.md b/.changeset/remove-clerk-cli-skill.md deleted file mode 100644 index 642f301a..00000000 --- a/.changeset/remove-clerk-cli-skill.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": major ---- - -Remove the bundled `clerk skill install` command and install the `clerk-cli` agent skill from the [`clerk/skills`](https://github.com/clerk/skills) repository during `clerk init`. diff --git a/.changeset/sandbox-hint-network-failures.md b/.changeset/sandbox-hint-network-failures.md deleted file mode 100644 index 6464f691..00000000 --- a/.changeset/sandbox-hint-network-failures.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Stop showing the "possible sandboxed run" hint for ordinary network failures (unreachable host, VPN, DNS) in agent mode. The hint now requires a permission-like error before suggesting a sandbox, and is a single line. diff --git a/.changeset/silly-files-hear.md b/.changeset/silly-files-hear.md deleted file mode 100644 index a845151c..00000000 --- a/.changeset/silly-files-hear.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/.changeset/webhooks-listen-v1.md b/.changeset/webhooks-listen-v1.md deleted file mode 100644 index 39678b64..00000000 --- a/.changeset/webhooks-listen-v1.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"clerk": minor ---- - -Add the `clerk webhooks` command group (V1): a PLAPI-free local webhooks toolkit. - -- `clerk webhooks listen` — open a standalone Svix relay tunnel and forward deliveries to a local handler. No auth, no linked project, no backend. `--forward-to` is required. Without `--token`, the banner warns that the auto-generated relay token isn't a guaranteed-stable handle and prints the exact `--token` to pin next time; `--token ` pins an explicit, shareable URL. Flags: `--forward-to` (required), `--token`, `--headers`, `--json`. When `--forward-to` is missing, the usage error prints a runnable example beneath it. -- `clerk webhooks verify` — verify a webhook signature offline (HMAC-SHA256), from a saved `listen` event line (`--delivery`) or the four explicit header values. No network calls. -- `clerk webhooks token` — generate a valid relay token (`c_` + 10 base62 chars) for `listen --token`. Prints the bare token to stdout so it pipes: `clerk webhooks listen --token "$(clerk webhooks token)"`. diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index ad951f06..a9b197b5 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,45 @@ # clerk +## 2.0.0 + +### Major Changes + +- Remove the bundled `clerk skill install` command and install the `clerk-cli` agent skill from the [`clerk/skills`](https://github.com/clerk/skills) repository during `clerk init`. ([#315](https://github.com/clerk/cli/pull/315)) by [@wyattjoh](https://github.com/wyattjoh) + +### Minor Changes + +- Add `clerk api --fapi` to call an instance's public Frontend API (e.g. `clerk api --fapi /environment --app `). The FAPI host is resolved from the instance's publishable key, and the request is unauthenticated since these endpoints are public, which closes the loop on verifying config changes end to end with the CLI alone. ([#345](https://github.com/clerk/cli/pull/345)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- Refresh the visual style of prompts, lists, spinners, and intro/outro brackets to use `@clack/prompts`, and make interactive command endings reflect success, failure, or paused cancellation status. ([#305](https://github.com/clerk/cli/pull/305)) by [@wyattjoh](https://github.com/wyattjoh) + +- Add `clerk impersonate` (alias `clerk imp`) to create a short-lived sign-in URL that logs you in as another user, plus `clerk impersonate revoke` to cancel a pending token. Both require `clerk login` and stamp the impersonation with your account for auditing. ([#373](https://github.com/clerk/cli/pull/373)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- `clerk init` on Expo projects now installs the `clerk-expo` agent skill (Expo/React Native setup) alongside `clerk-expo-patterns`. The framework skill map supports multiple skills per framework. ([#328](https://github.com/clerk/cli/pull/328)) by [@manovotny](https://github.com/manovotny) + +- Render the "Next steps" header in a dusty mauve and sweep a white reflex highlight across it once after `clerk deploy`, `clerk link`, and `clerk auth login`, then settle on the flat color. The animation only runs on an interactive color terminal and falls back to plain styling when piped, in CI, or when `NO_COLOR` is set. ([#322](https://github.com/clerk/cli/pull/322)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- Add the `clerk webhooks` command group (V1): a PLAPI-free local webhooks toolkit. ([#366](https://github.com/clerk/cli/pull/366)) by [@rafa-thayto](https://github.com/rafa-thayto) + + - `clerk webhooks listen` — open a standalone Svix relay tunnel and forward deliveries to a local handler. No auth, no linked project, no backend. `--forward-to` is required. Without `--token`, the banner warns that the auto-generated relay token isn't a guaranteed-stable handle and prints the exact `--token` to pin next time; `--token ` pins an explicit, shareable URL. Flags: `--forward-to` (required), `--token`, `--headers`, `--json`. When `--forward-to` is missing, the usage error prints a runnable example beneath it. + - `clerk webhooks verify` — verify a webhook signature offline (HMAC-SHA256), from a saved `listen` event line (`--delivery`) or the four explicit header values. No network calls. + - `clerk webhooks token` — generate a valid relay token (`c_` + 10 base62 chars) for `listen --token`. Prints the bare token to stdout so it pipes: `clerk webhooks listen --token "$(clerk webhooks token)"`. + +### Patch Changes + +- Keep a separator between the path and description in `clerk api ls` so long endpoint paths no longer run straight into their summaries. ([#340](https://github.com/clerk/cli/pull/340)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- Fix the OAuth provider walkthrough in `clerk deploy` printing the redirect URI on the wrong subdomain. Previously, the walkthrough showed `https://accounts.{domain}/v1/oauth_callback`, but the callback is served by the Frontend API, so pasting the value into a provider console caused `redirect_uri_mismatch`. The walkthrough now prints the instance's `frontend_api_url` (e.g. `https://clerk.{domain}/v1/oauth_callback`), matching the value shown in the Clerk Dashboard. ([#335](https://github.com/clerk/cli/pull/335)) by [@Railly](https://github.com/Railly) + +- Only read stdin as `--input-json` when `--input-json -` is passed explicitly. Previously any piped stdin was consumed and parsed as the options payload, which broke shell loops (`while read … | clerk …`) and commands that read their own stdin (`cat body.json | clerk api …`) with a confusing `invalid_json` error. ([#341](https://github.com/clerk/cli/pull/341)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- Resolve the instance explicitly instead of silently defaulting to development: interactive flows (`clerk impersonate`, `clerk impersonate revoke`, `clerk users open`, the create wizard, and the application-picker fallback) now ask in human mode whenever the resolved app has more than one instance and no `--instance` flag pins one, and agent mode errors asking for an explicit `--instance` rather than defaulting — so the same command can't resolve a different instance depending on which instances the app happens to have. User lookups that find no match name the searched app and instance in the error, and instances targeted by raw ID are labeled by their environment type so the production impersonation warning always fires. ([#373](https://github.com/clerk/cli/pull/373)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- Print the "Next steps" list before sweeping the highlight across its header, so the animation no longer leaves a lone "Next steps" line that looks hung while the steps are hidden. ([#343](https://github.com/clerk/cli/pull/343)) by [@rafa-thayto](https://github.com/rafa-thayto) + +- Fix `clerk init` for React Router v8 projects by adding `@clerk/react-router` to `ssr.noExternal` in the Vite config, preventing dev-mode SSR from failing with "useNavigate() may be used only in the context of a ". ([#374](https://github.com/clerk/cli/pull/374)) by [@manovotny](https://github.com/manovotny) + +- Stop showing the "possible sandboxed run" hint for ordinary network failures (unreachable host, VPN, DNS) in agent mode. The hint now requires a permission-like error before suggesting a sandbox, and is a single line. ([#342](https://github.com/clerk/cli/pull/342)) by [@rafa-thayto](https://github.com/rafa-thayto) + ## 1.5.0 ### Minor Changes @@ -74,6 +114,7 @@ - `clerk init` in agent mode now creates and links a real Clerk application when the user is authenticated, instead of falling back to keyless setup. Keyless still runs in agent mode when the user is not authenticated, but authenticated agent runs leave the project properly linked with real development keys in `.env`. ([#254](https://github.com/clerk/cli/pull/254)) by [@wyattjoh](https://github.com/wyattjoh) - Add `clerk enable` and `clerk disable` top-level commands for toggling features on the linked instance. ([#219](https://github.com/clerk/cli/pull/219)) by [@nicolas-angelo](https://github.com/nicolas-angelo) + - `clerk enable orgs` / `clerk disable orgs` — toggle organizations, with `--force-selection`, `--auto-create`, `--max-members `, and `--domains` on enable. - `clerk enable billing [--for org,user]` / `clerk disable billing [--for org,user]` — toggle billing for organizations and/or users. `--for` defaults to both; enabling for `org` cascades to enabling organizations. Enable also offers to install the `clerk-billing` agent skill (suppress with `--no-skills`). @@ -84,6 +125,7 @@ - Rename the bundled agent skill from `clerk` to `clerk-cli` for more clarity during install. After upgrading, `clerk skill install` (and the install step in `clerk init`) writes the skill to `/skills/clerk-cli/` instead of `/skills/clerk/`. Existing `skills/clerk/` directories from prior installs are left in place; remove them manually if you want to avoid duplicate context. ([#245](https://github.com/clerk/cli/pull/245)) by [@kylemac](https://github.com/kylemac) - Add direct user-management commands to `clerk users`: ([#237](https://github.com/clerk/cli/pull/237)) by [@wyattjoh](https://github.com/wyattjoh) + - `clerk users list` with pagination, query search, repeatable identifier filters (`--email-address`, `--phone-number`, `--username`, `--user-id`, `--external-id`), `--order-by` over Clerk's common user ordering fields, and an application picker when invoked without a linked project, env var, or targeting flag. `--limit` defaults to 100 and accepts 1-250. `--json` (and agent mode) emits `{ data, hasMore }` so callers can paginate without a separate count call; the human-mode table footer surfaces the next `--offset` when more pages are available. The interactive user picker (used by `clerk users open` and other update flows) shows a "More results, refine your search" hint when matches overflow its window. - `clerk users open [user-id]` for opening a user's Clerk dashboard page in the browser, with interactive pickers for the application and the user, plus `--print` for emitting the URL. @@ -182,12 +224,14 @@ - Fix link saving to wrong directory during bootstrap flow. When creating a new project via `clerk init`, the Clerk application link is now correctly saved to the new project directory instead of the parent directory. ([#186](https://github.com/clerk/cli/pull/186)) by [@kylemac](https://github.com/kylemac) - Store macOS credentials in the system Keychain instead of a plaintext file. ([#198](https://github.com/clerk/cli/pull/198)) by [@wyattjoh](https://github.com/wyattjoh) + - Previously, macOS builds silently stored the OAuth token in `~/Library/Application Support/clerk-cli/credentials` because cross-compiled binaries were missing the native Keychain binding. - Run `clerk login` after upgrading so the CLI writes a fresh token into the Keychain and removes the old plaintext file. - Surface the bundled agent skill in `clerk --help` and bare `clerk` output with a tip pointing to `clerk skill install`, so users discover how to give AI coding agents Clerk context. ([#191](https://github.com/clerk/cli/pull/191)) by [@rafa-thayto](https://github.com/rafa-thayto) - Tighten the `clerk init` bootstrap flow: ([#184](https://github.com/clerk/cli/pull/184)) by [@rafa-thayto](https://github.com/rafa-thayto) + - Skip the redundant "Proceed?" scaffold confirmation when bootstrapping a new project (via `--starter` or on an empty directory). The scaffold plan is still previewed; only the now-superfluous prompt is removed since the user already opted in by starting bootstrap. - Print bootstrap next steps (`cd `, ` dev`, etc.) after the optional "Install agent skills?" prompt so they remain the last thing visible when the command finishes. @@ -196,6 +240,7 @@ - Fix `install.sh --install-dir ` so it creates the directory when it does not already exist, matching the behavior of the `~/.local/bin` fallback. ([#202](https://github.com/clerk/cli/pull/202)) by [@wyattjoh](https://github.com/wyattjoh) - Fix `clerk init` prompt flow: ([#175](https://github.com/clerk/cli/pull/175)) by [@rafa-thayto](https://github.com/rafa-thayto) + - When you are signed in (OAuth or `CLERK_PLATFORM_API_KEY`), `clerk init` skips straight to the authenticated flow — no more "Skip authentication for now?" prompt. - When you are not signed in **during bootstrap** (new projects) on a keyless-capable framework, `clerk init` now goes keyless automatically (previously prompted) and points you to `clerk auth login` for later. Re-runs in an existing project still fall through to the authenticated flow so real keys can be pulled. - Keep `clerk init --starter` fully interactive — it no longer fails with "Non-interactive mode requires --framework" when running without `-y`. @@ -205,6 +250,7 @@ - Install the full Clerk core and feature skill sets by default during `clerk init`. Agents now get context for `clerk-custom-ui`, `clerk-backend-api`, `clerk-orgs`, `clerk-testing`, and `clerk-webhooks` in addition to the previous defaults, plus a framework-specific skill when one matches. Pass `--no-skills` to opt out. ([#185](https://github.com/clerk/cli/pull/185)) by [@rafa-thayto](https://github.com/rafa-thayto) - Expand `--verbose` debug output across the CLI and surface silent environment fallbacks. ([#183](https://github.com/clerk/cli/pull/183)) by [@wyattjoh](https://github.com/wyattjoh) + - Every outbound HTTP call (platform API, backend API, OAuth, npm registry) now logs its URL, method, status, and response body on error under `--verbose`. - New debug coverage for the credential store, config file I/O, environment resolution, auth callback server, git detection, framework detection, autolink, and package-manager runner probing. - Warn without `--verbose` when the saved environment is not available in the current binary, instead of silently falling back to production. diff --git a/packages/cli/package.json b/packages/cli/package.json index 6ad444f3..92131d57 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "clerk", - "version": "1.5.0", + "version": "2.0.0", "private": true, "description": "Clerk CLI", "keywords": [