diff --git a/.changeset/auth-paste-back-login.md b/.changeset/auth-paste-back-login.md deleted file mode 100644 index dbf4fce68..000000000 --- a/.changeset/auth-paste-back-login.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Sign in from a machine without a browser: `clerk auth login` now accepts the URL your browser lands on after signing in on another device, pasted back into the terminal. diff --git a/.changeset/clerk-deploy-agent-friendly.md b/.changeset/clerk-deploy-agent-friendly.md deleted file mode 100644 index f06065e6e..000000000 --- a/.changeset/clerk-deploy-agent-friendly.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"clerk": minor ---- - -Let AI agents take a Clerk application to production. - -- `clerk deploy --domain ` in agent mode creates the production instance (or resumes the existing one) without prompting and prints the deploy report. Without `--domain` it stays read-only. In the wizard, `--domain` skips the domain prompt and `--yes` skips the confirmations. -- `clerk deploy --domain` refuses a domain it can't apply: with an existing production instance on another domain it fails with `production_instance_exists`, and while Clerk hasn't returned the existing instance's domain yet it fails with the new `deploy_domain_unchecked`, in agent mode and the wizard alike. A wizard run whose typed domain loses a create race to another run's instance stops the same way, rather than carrying on into that instance's setup. -- `clerk deploy` refuses more hosting providers' domains, both in `--domain` and at the wizard's domain prompt: `*.replit.app`, `*.replit.dev`, `*.onrender.com`, `*.railway.app`, `*.emergent.host`, `*.emergentagent.com`, `*.web.app`, `*.firebaseapp.com`, `*.hosted.app`, `*.workers.dev`, `*.github.io`, `*.lovable.app`, `*.bolt.host`, and `*.base44.app`, alongside `*.vercel.app` and the others it already refused. `clerk deploy` needs a domain whose DNS records you can add. -- A 404 on the production domain's status, in `clerk deploy`, `clerk deploy status`, or the wizard's DNS polling, now fails with `deploy_instance_unresolved` instead of `not_linked` and its advice to re-link the directory. Unless the run just created the instance, the message adds that if the production instance was deleted, `clerk deploy status` reports `not_started` once Clerk stops listing it, and to run `clerk deploy --domain` then. -- The deploy report gains `oauth.setup`: for each provider missing production credentials, the redirect URI, authorized origins, fields, and the `clerk config patch` payload and command that save them. `nextAction` now names the command to run instead of handing off to a human terminal, except for Apple's private key and, when the app uses native-only Sign in with Apple, Apple web credentials, which still go through `clerk deploy` in a terminal. OAuth secrets go into a file outside the project that the user fills in and that is removed afterward. When native-only Sign in with Apple isn't ready in production, Apple is left out of `oauth.setup` so the native fix in `nextAction` isn't buried. Once Clerk's side is complete, `nextAction` says to pipe the production keys into the host's CLI without reading them, and the new `hostSetup` field holds the command for Vercel (with `host`, `label`, `shells`, and `command`), so an agent copies it verbatim from the field instead of out of the sentence. On macOS and Linux, that command and each `oauth.setup` command start with `clerk` only when the `clerk` on PATH resolves to the running binary itself, and otherwise with the running CLI's quoted absolute path (an npm or bun global install puts npm's launcher script on PATH, so it gets the binary's path), so they work when the CLI was started with `npx`. On Windows they keep `clerk`. `hostSetup` is `[]` in every other state. -- `clerk env pull --print` prints `KEY=value` lines to stdout instead of writing an env file, for sending production keys to a hosting provider. It fails without printing anything when Clerk returns no secret key. For an unclaimed accountless app, whose keys exist only on this machine, it prints the secret key alone, with a warning, when no publishable key is found locally. -- `clerk config patch` and `clerk config put` print `[REDACTED]` in place of the value of any key whose name contains `secret` or `private_key` (in any case), in the diff they show before writing and in the response they print after (dry runs included). Values under other keys are printed as before. Both refuse a payload that still holds `[REDACTED]` under such a key, naming each field, so their own output can't be saved over a real secret. Error bodies logged under `--verbose` are not redacted. -- `clerk config patch` and `clerk config put` refuse a payload that still holds an `oauth.setup` placeholder (`` under `client_secret`), naming each such field, and `clerk deploy status` no longer counts such a value as a saved credential. diff --git a/.changeset/cli-feedback-command.md b/.changeset/cli-feedback-command.md deleted file mode 100644 index 8bb37908c..000000000 --- a/.changeset/cli-feedback-command.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk feedback` to report a wrong result, a confusing error, a missing capability or a needed improvement to Clerk. The report is scrubbed, on a best-effort basis, for common secret formats, home-directory paths and email addresses before it is sent over the telemetry channel, `--dry-run` shows exactly what would be sent, and a telemetry opt-out blocks it. diff --git a/.changeset/init-auth-pages-suspense.md b/.changeset/init-auth-pages-suspense.md deleted file mode 100644 index 0667eb5c9..000000000 --- a/.changeset/init-auth-pages-suspense.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Wrap the sign-in and sign-up pages that `clerk init` creates for Next.js App Router apps in ``, so they no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. diff --git a/.changeset/init-relink-guard.md b/.changeset/init-relink-guard.md deleted file mode 100644 index 42cfb0b4f..000000000 --- a/.changeset/init-relink-guard.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -In agent mode, `clerk init --app` no longer silently replaces a link to a different application. Inside a Git repository that link is shared by every project there, so relinking one folder switched them all. `clerk init` now stops, explains what would switch, and asks for `--relink`; with `--json`, it reports an `input-required` status. diff --git a/.changeset/init-route-group-auth-pages.md b/.changeset/init-route-group-auth-pages.md deleted file mode 100644 index fd262114b..000000000 --- a/.changeset/init-route-group-auth-pages.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Skip creating sign-in and sign-up pages in `clerk init` for Next.js App Router apps that already have them inside a route group, such as `app/(marketing)/sign-in/[[...sign-in]]/page.tsx`, instead of adding a second page for the same URL. diff --git a/.changeset/init-starter-header-suspense.md b/.changeset/init-starter-header-suspense.md deleted file mode 100644 index 3cb3891d1..000000000 --- a/.changeset/init-starter-header-suspense.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Wrap the auth header that `clerk init --starter` adds to Next.js App Router layouts in ``, so new apps no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. diff --git a/.changeset/init-template-implies-accountless.md b/.changeset/init-template-implies-accountless.md deleted file mode 100644 index 1b16cba35..000000000 --- a/.changeset/init-template-implies-accountless.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -`clerk init --template ` now implies `--accountless`, so it creates a pre-configured accountless application even when you're signed in or the project is linked, instead of exiting with an error. It still errors with `--login`, `--app`, or a framework without accountless support. diff --git a/.changeset/ios-production-doctor.md b/.changeset/ios-production-doctor.md deleted file mode 100644 index d948fcd62..000000000 --- a/.changeset/ios-production-doctor.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -`clerk doctor` checks an iOS or macOS app's Release build against the production instance: that Release's Bundle ID is registered there with Native API enabled, that its entitlements list the production Associated Domain, and that it configures Clerk with the production publishable key when the key is loaded in a way that can be read without building (otherwise it reports the key as not verified). Without a production instance this is a single note. Run in an Xcode project, `clerk deploy` and `clerk deploy status` now point to `clerk doctor` for this check. diff --git a/.changeset/ios-starter.md b/.changeset/ios-starter.md deleted file mode 100644 index 9f747dd09..000000000 --- a/.changeset/ios-starter.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Create a new iOS or macOS app with `clerk init --starter`: pick iOS (SwiftUI) or macOS (SwiftUI) on a Mac with Xcode, and init writes a SwiftUI Xcode project, then sets up Clerk, the sign-in screen, and native registration. Use `--framework ios` or `--framework macos` with `--name`, `--bundle-id`, and the new `--team-id` to skip the prompts. diff --git a/.changeset/migrate-auth0.md b/.changeset/migrate-auth0.md deleted file mode 100644 index d1caf948b..000000000 --- a/.changeset/migrate-auth0.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export auth0`, and let `clerk migrate import` read Auth0 exports, including the NDJSON file from Auth0's bulk export job. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/migrate-authjs.md b/.changeset/migrate-authjs.md deleted file mode 100644 index d349e4a44..000000000 --- a/.changeset/migrate-authjs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export authjs`, and let `clerk migrate import` read Auth.js exports. The export reads an Auth.js database over `--db-url` (Postgres, MySQL, libsql/Turso or SQLite), finding the user table whether Prisma or Drizzle named it. Auth.js stores no passwords, so imported users sign in with OAuth or an email link, or set a password. The export reads each user's OAuth providers, so the import can offer to turn them on, and warns that Auth.js leaves OAuth users' emails unverified; `--trust-oauth-emails` marks them verified. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/migrate-betterauth.md b/.changeset/migrate-betterauth.md deleted file mode 100644 index d091d08ee..000000000 --- a/.changeset/migrate-betterauth.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export betterauth`, and let `clerk migrate import` read Better Auth exports. The export reads a Better Auth database over `--db-url` (Postgres, MySQL, libsql/Turso or SQLite), including schemas Drizzle generated with snake_case columns or plural tables, and detects plugin columns. Better Auth's scrypt, bcrypt and argon2 passwords carry across when Clerk can verify them; any other is dropped, and that user resets it. Anonymous users are skipped. A user that a source skips, such as Supabase's soft-deleted users, no longer stops the import: it's recorded as skipped, and `--allow-partial` is only for real rejects. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/migrate-export.md b/.changeset/migrate-export.md deleted file mode 100644 index df70f88da..000000000 --- a/.changeset/migrate-export.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export clerk` and `clerk migrate export supabase`, and let `clerk migrate import` take the export's run ID in place of a file and `--source`. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/migrate-firebase.md b/.changeset/migrate-firebase.md deleted file mode 100644 index bef7d6bf1..000000000 --- a/.changeset/migrate-firebase.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export firebase`, and let `clerk migrate import` read Firebase exports with their password hashes. The project's hash parameters come from the export, the `--firebase-*` flags, or `CLERK_FIREBASE_SIGNER_KEY`, `CLERK_FIREBASE_SALT_SEPARATOR`, `CLERK_FIREBASE_ROUNDS` and `CLERK_FIREBASE_MEM_COST`. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/migrate-runs-undo.md b/.changeset/migrate-runs-undo.md deleted file mode 100644 index 2c498fb32..000000000 --- a/.changeset/migrate-runs-undo.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate runs` and `clerk migrate undo`, and let a re-run of `clerk migrate import` continue where a stopped one left off. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. - -Every user an import creates now carries `clerkMigrateRun` (the run's ID) in its `private_metadata`, replacing any value the source had under that key. A re-run reads it to adopt a user whose create was cut off. Nothing removes it afterwards, and your backend can read it. diff --git a/.changeset/migrate-workos.md b/.changeset/migrate-workos.md deleted file mode 100644 index 1232d1da8..000000000 --- a/.changeset/migrate-workos.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk migrate export workos`, and let `clerk migrate import` read WorkOS exports. WorkOS returns no password hashes, so imported users reset their password or sign in with SSO. `clerk init` now also flags a WorkOS install and links the migration guide. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. diff --git a/.changeset/no-ansi-escape-codes-in-agent-mode-output.md b/.changeset/no-ansi-escape-codes-in-agent-mode-output.md deleted file mode 100644 index 232c3d003..000000000 --- a/.changeset/no-ansi-escape-codes-in-agent-mode-output.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": patch ---- - -Print plain text without terminal color codes in agent mode, so AI agents no longer see escape sequences in command output when they run without `--json`. Pass `--mode human` or set `CLERK_MODE=human` to keep colors. Status messages now also honor `NO_COLOR`. diff --git a/.changeset/security-recommendations.md b/.changeset/security-recommendations.md deleted file mode 100644 index cf368c09d..000000000 --- a/.changeset/security-recommendations.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Add `clerk security`: `audit` grades an instance against Clerk's security recommendations, `fix` applies them as one config patch, and `checks` lists the catalog. Agent mode gets the report as JSON with the exact patch per finding. diff --git a/.changeset/starter-agent-json.md b/.changeset/starter-agent-json.md deleted file mode 100644 index 0ca0ac056..000000000 --- a/.changeset/starter-agent-json.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"clerk": minor ---- - -Agents can create iOS and macOS apps end to end with JSON. `clerk init --starter --framework ios --json` (or `macos`) runs non-interactively and reports a missing name, an existing folder, a Bundle ID, or a team as an `input-required` status before anything is written. Every status after the app is written names it and the command that finishes it, and setup that stops after writing reports `setup-interrupted` instead of leaving an agent to retry `--starter`. A new app that would otherwise inherit a parent's or repository's link asks which application to use. diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index cd6ed5207..97b00d13f 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,62 @@ # clerk +## 4.1.0 + +### Minor Changes + +- Sign in from a machine without a browser: `clerk auth login` now accepts the URL your browser lands on after signing in on another device, pasted back into the terminal. ([#513](https://github.com/clerk/cli/pull/513)) by [@wyattjoh](https://github.com/wyattjoh) + +- Let AI agents take a Clerk application to production. ([#550](https://github.com/clerk/cli/pull/550)) by [@shane-kercheval](https://github.com/shane-kercheval) + + - `clerk deploy --domain ` in agent mode creates the production instance (or resumes the existing one) without prompting and prints the deploy report. Without `--domain` it stays read-only. In the wizard, `--domain` skips the domain prompt and `--yes` skips the confirmations. + - `clerk deploy --domain` refuses a domain it can't apply: with an existing production instance on another domain it fails with `production_instance_exists`, and while Clerk hasn't returned the existing instance's domain yet it fails with the new `deploy_domain_unchecked`, in agent mode and the wizard alike. A wizard run whose typed domain loses a create race to another run's instance stops the same way, rather than carrying on into that instance's setup. + - `clerk deploy` refuses more hosting providers' domains, both in `--domain` and at the wizard's domain prompt: `*.replit.app`, `*.replit.dev`, `*.onrender.com`, `*.railway.app`, `*.emergent.host`, `*.emergentagent.com`, `*.web.app`, `*.firebaseapp.com`, `*.hosted.app`, `*.workers.dev`, `*.github.io`, `*.lovable.app`, `*.bolt.host`, and `*.base44.app`, alongside `*.vercel.app` and the others it already refused. `clerk deploy` needs a domain whose DNS records you can add. + - A 404 on the production domain's status, in `clerk deploy`, `clerk deploy status`, or the wizard's DNS polling, now fails with `deploy_instance_unresolved` instead of `not_linked` and its advice to re-link the directory. Unless the run just created the instance, the message adds that if the production instance was deleted, `clerk deploy status` reports `not_started` once Clerk stops listing it, and to run `clerk deploy --domain` then. + - The deploy report gains `oauth.setup`: for each provider missing production credentials, the redirect URI, authorized origins, fields, and the `clerk config patch` payload and command that save them. `nextAction` now names the command to run instead of handing off to a human terminal, except for Apple's private key and, when the app uses native-only Sign in with Apple, Apple web credentials, which still go through `clerk deploy` in a terminal. OAuth secrets go into a file outside the project that the user fills in and that is removed afterward. When native-only Sign in with Apple isn't ready in production, Apple is left out of `oauth.setup` so the native fix in `nextAction` isn't buried. Once Clerk's side is complete, `nextAction` says to pipe the production keys into the host's CLI without reading them, and the new `hostSetup` field holds the command for Vercel (with `host`, `label`, `shells`, and `command`), so an agent copies it verbatim from the field instead of out of the sentence. On macOS and Linux, that command and each `oauth.setup` command start with `clerk` only when the `clerk` on PATH resolves to the running binary itself, and otherwise with the running CLI's quoted absolute path (an npm or bun global install puts npm's launcher script on PATH, so it gets the binary's path), so they work when the CLI was started with `npx`. On Windows they keep `clerk`. `hostSetup` is `[]` in every other state. + - `clerk env pull --print` prints `KEY=value` lines to stdout instead of writing an env file, for sending production keys to a hosting provider. It fails without printing anything when Clerk returns no secret key. For an unclaimed accountless app, whose keys exist only on this machine, it prints the secret key alone, with a warning, when no publishable key is found locally. + - `clerk config patch` and `clerk config put` print `[REDACTED]` in place of the value of any key whose name contains `secret` or `private_key` (in any case), in the diff they show before writing and in the response they print after (dry runs included). Values under other keys are printed as before. Both refuse a payload that still holds `[REDACTED]` under such a key, naming each field, so their own output can't be saved over a real secret. Error bodies logged under `--verbose` are not redacted. + - `clerk config patch` and `clerk config put` refuse a payload that still holds an `oauth.setup` placeholder (`` under `client_secret`), naming each such field, and `clerk deploy status` no longer counts such a value as a saved credential. + +- Add `clerk feedback` to report a wrong result, a confusing error, a missing capability or a needed improvement to Clerk. The report is scrubbed, on a best-effort basis, for common secret formats, home-directory paths and email addresses before it is sent over the telemetry channel, `--dry-run` shows exactly what would be sent, and a telemetry opt-out blocks it. ([#566](https://github.com/clerk/cli/pull/566)) by [@shane-kercheval](https://github.com/shane-kercheval) + +- `clerk init --template ` now implies `--accountless`, so it creates a pre-configured accountless application even when you're signed in or the project is linked, instead of exiting with an error. It still errors with `--login`, `--app`, or a framework without accountless support. ([#572](https://github.com/clerk/cli/pull/572)) by [@manovotny](https://github.com/manovotny) + +- `clerk doctor` checks an iOS or macOS app's Release build against the production instance: that Release's Bundle ID is registered there with Native API enabled, that its entitlements list the production Associated Domain, and that it configures Clerk with the production publishable key when the key is loaded in a way that can be read without building (otherwise it reports the key as not verified). Without a production instance this is a single note. Run in an Xcode project, `clerk deploy` and `clerk deploy status` now point to `clerk doctor` for this check. ([#548](https://github.com/clerk/cli/pull/548)) by [@seanperez29](https://github.com/seanperez29) + +- Create a new iOS or macOS app with `clerk init --starter`: pick iOS (SwiftUI) or macOS (SwiftUI) on a Mac with Xcode, and init writes a SwiftUI Xcode project, then sets up Clerk, the sign-in screen, and native registration. Use `--framework ios` or `--framework macos` with `--name`, `--bundle-id`, and the new `--team-id` to skip the prompts. ([#547](https://github.com/clerk/cli/pull/547)) by [@seanperez29](https://github.com/seanperez29) + +- Add `clerk migrate export auth0`, and let `clerk migrate import` read Auth0 exports, including the NDJSON file from Auth0's bulk export job. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#526](https://github.com/clerk/cli/pull/526)) by [@royanger](https://github.com/royanger) + +- Add `clerk migrate export authjs`, and let `clerk migrate import` read Auth.js exports. The export reads an Auth.js database over `--db-url` (Postgres, MySQL, libsql/Turso or SQLite), finding the user table whether Prisma or Drizzle named it. Auth.js stores no passwords, so imported users sign in with OAuth or an email link, or set a password. The export reads each user's OAuth providers, so the import can offer to turn them on, and warns that Auth.js leaves OAuth users' emails unverified; `--trust-oauth-emails` marks them verified. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#529](https://github.com/clerk/cli/pull/529)) by [@royanger](https://github.com/royanger) + +- Add `clerk migrate export betterauth`, and let `clerk migrate import` read Better Auth exports. The export reads a Better Auth database over `--db-url` (Postgres, MySQL, libsql/Turso or SQLite), including schemas Drizzle generated with snake_case columns or plural tables, and detects plugin columns. Better Auth's scrypt, bcrypt and argon2 passwords carry across when Clerk can verify them; any other is dropped, and that user resets it. Anonymous users are skipped. A user that a source skips, such as Supabase's soft-deleted users, no longer stops the import: it's recorded as skipped, and `--allow-partial` is only for real rejects. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#528](https://github.com/clerk/cli/pull/528)) by [@royanger](https://github.com/royanger) + +- Add `clerk migrate export clerk` and `clerk migrate export supabase`, and let `clerk migrate import` take the export's run ID in place of a file and `--source`. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#524](https://github.com/clerk/cli/pull/524)) by [@royanger](https://github.com/royanger) + +- Add `clerk migrate export firebase`, and let `clerk migrate import` read Firebase exports with their password hashes. The project's hash parameters come from the export, the `--firebase-*` flags, or `CLERK_FIREBASE_SIGNER_KEY`, `CLERK_FIREBASE_SALT_SEPARATOR`, `CLERK_FIREBASE_ROUNDS` and `CLERK_FIREBASE_MEM_COST`. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#525](https://github.com/clerk/cli/pull/525)) by [@royanger](https://github.com/royanger) + +- Add `clerk migrate runs` and `clerk migrate undo`, and let a re-run of `clerk migrate import` continue where a stopped one left off. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#515](https://github.com/clerk/cli/pull/515)) by [@royanger](https://github.com/royanger) + + Every user an import creates now carries `clerkMigrateRun` (the run's ID) in its `private_metadata`, replacing any value the source had under that key. A re-run reads it to adopt a user whose create was cut off. Nothing removes it afterwards, and your backend can read it. + +- Add `clerk migrate export workos`, and let `clerk migrate import` read WorkOS exports. WorkOS returns no password hashes, so imported users reset their password or sign in with SSO. `clerk init` now also flags a WorkOS install and links the migration guide. `clerk migrate` is still experimental and needs `CLERK_EXPERIMENTAL=migrate`. ([#527](https://github.com/clerk/cli/pull/527)) by [@royanger](https://github.com/royanger) + +- Add `clerk security`: `audit` grades an instance against Clerk's security recommendations, `fix` applies them as one config patch, and `checks` lists the catalog. Agent mode gets the report as JSON with the exact patch per finding. ([#478](https://github.com/clerk/cli/pull/478)) by [@dominic-clerk](https://github.com/dominic-clerk) + +- Agents can create iOS and macOS apps end to end with JSON. `clerk init --starter --framework ios --json` (or `macos`) runs non-interactively and reports a missing name, an existing folder, a Bundle ID, or a team as an `input-required` status before anything is written. Every status after the app is written names it and the command that finishes it, and setup that stops after writing reports `setup-interrupted` instead of leaving an agent to retry `--starter`. A new app that would otherwise inherit a parent's or repository's link asks which application to use. ([#583](https://github.com/clerk/cli/pull/583)) by [@seanperez29](https://github.com/seanperez29) + +### Patch Changes + +- Wrap the sign-in and sign-up pages that `clerk init` creates for Next.js App Router apps in ``, so they no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. ([#560](https://github.com/clerk/cli/pull/560)) by [@manovotny](https://github.com/manovotny) + +- In agent mode, `clerk init --app` no longer silently replaces a link to a different application. Inside a Git repository that link is shared by every project there, so relinking one folder switched them all. `clerk init` now stops, explains what would switch, and asks for `--relink`; with `--json`, it reports an `input-required` status. ([#582](https://github.com/clerk/cli/pull/582)) by [@seanperez29](https://github.com/seanperez29) + +- Skip creating sign-in and sign-up pages in `clerk init` for Next.js App Router apps that already have them inside a route group, such as `app/(marketing)/sign-in/[[...sign-in]]/page.tsx`, instead of adding a second page for the same URL. ([#571](https://github.com/clerk/cli/pull/571)) by [@manovotny](https://github.com/manovotny) + +- Wrap the auth header that `clerk init --starter` adds to Next.js App Router layouts in ``, so new apps no longer fail `next build` when Cache Components is enabled, as it is in new `create-next-app` projects. ([#567](https://github.com/clerk/cli/pull/567)) by [@manovotny](https://github.com/manovotny) + +- Print plain text without terminal color codes in agent mode, so AI agents no longer see escape sequences in command output when they run without `--json`. Pass `--mode human` or set `CLERK_MODE=human` to keep colors. Status messages now also honor `NO_COLOR`. ([#534](https://github.com/clerk/cli/pull/534)) by [@royanger](https://github.com/royanger) + ## 4.0.0 ### Major Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index bef0f69aa..fbed4f856 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "clerk", - "version": "4.0.0", + "version": "4.1.0", "private": true, "description": "The official Clerk CLI. Add authentication to your app with npx -y clerk@latest init (Next.js, React Router, Astro, Nuxt, TanStack Start, Expo, and more). No Clerk account needed to start. Manage users, instances, keys, and deploys from the terminal or a coding agent.", "keywords": [