Repository navigation
Fix CLI wizard repeating flags and arguments typed before --wizard - #10529
Merged
tim-smart merged 5 commits intoNov 11, 2026
Merged
Conversation
The wizard prompts for every flag and argument of the selected command, but its starting command line kept everything typed before --wizard, so those values appeared twice and the generated command failed to parse. The starting command line now drops the tokens the parser hands the selected command and keeps subcommand names, inherited flags and global flags. Co-Authored-By: Claude Opus 5.5 <[email protected]>
🦋 Changeset detectedLatest commit: 91a9b4b The changes in this PR will be included in the next version bump. This PR includes changesets to release 34 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Bundle Size AnalysisGenerated from PR build output; treat the content below as untrusted.
|
tim-smart
enabled auto-merge (squash)
November 11, 2026 03:04
Merged
This was referenced Nov 14, 2026
brandhaug
added a commit
to brandhaug/b2b-saas-starter
that referenced
this pull request
Nov 14, 2026
## pnpm-workspace.yaml (default) ## Dependency Updates | Package | From | To | Type | | --- | --- | --- | --- | | `@better-auth/cimd` | 1.7.19 | 1.7.20 | patch | | `@better-auth/mcp` | 1.7.19 | 1.7.20 | patch | | `@better-auth/oauth-provider` | 1.7.19 | 1.7.20 | patch | | `@better-auth/passkey` | 1.7.19 | 1.7.20 | patch | | `@better-auth/sso` | 1.7.19 | 1.7.20 | patch | | `@effect/platform-node` | 4.1.3 | 4.1.4 | patch | | `@effect/sql-d1` | 4.1.3 | 4.1.4 | patch | | `@effect/vitest` | 4.1.3 | 4.1.4 | patch | | `@inlang/paraglide-js` | 3.2.1 | 3.2.2 | patch | | `@react-email/ui` | 6.11.10 | 6.11.11 | patch | | `ai` | 7.0.166 | 7.0.169 | patch | | `better-auth` | 1.7.19 | 1.7.20 | patch | | `effect` | 4.1.3 | 4.1.4 | patch | | `react-email` | 6.11.10 | 6.11.11 | patch | | `seroval` | 1.8.0 | 1.8.1 | patch | ## Release Notes <details> <summary><b>@<!---->better-auth/cimd</b> (1.7.19 → 1.7.20)</summary> > [!IMPORTANT] > **Action required** > > - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the public `https` URL, since discovery and the `iss` parameter no longer rewrite it to `https`. ([#11904](better-auth/better-auth#11904)) ## `@better-auth/oauth-provider` ### Bug Fixes - Fixed `POST /oauth2/public-client-prelogin` with `allowPublicClientPrelogin` to return a client only when its `client_id` matches the signed `oauth_query`, otherwise responding with `401` `invalid_client` ([#12237](better-auth/better-auth#12237)) - Fixed `oauthProviderResourceClient(auth)` defaults to accept issued access tokens when `baseURL` is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs ([#12234](better-auth/better-auth#12234)) - Added an `allowInsecureRedirectUri` option so OAuth provider deployments served over HTTP on private networks can accept `http` redirect URIs ([#11904](better-auth/better-auth#11904)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md) ## `@better-auth/prisma-adapter` ### Bug Fixes - Fixed Prisma adapter `incrementOne` and `update` calls using `mode: "insensitive"` filters to match case-insensitively on PostgreSQL and MongoDB ([#11809](better-auth/better-auth#11809)) - Fixed Prisma adapter queries with `eq null` on MongoDB to also match records where the optional field was never set ([#11806](better-auth/better-auth#11806)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md) ## `@better-auth/core` ### Bug Fixes - Added an `allowInsecureRedirectUri` …[full notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20) </details> <details> <summary><b>@<!---->better-auth/mcp</b> (1.7.19 → 1.7.20)</summary> > [!IMPORTANT] > **Action required** > > - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the public `https` URL, since discovery and the `iss` parameter no longer rewrite it to `https`. ([#11904](better-auth/better-auth#11904)) ## `@better-auth/oauth-provider` ### Bug Fixes - Fixed `POST /oauth2/public-client-prelogin` with `allowPublicClientPrelogin` to return a client only when its `client_id` matches the signed `oauth_query`, otherwise responding with `401` `invalid_client` ([#12237](better-auth/better-auth#12237)) - Fixed `oauthProviderResourceClient(auth)` defaults to accept issued access tokens when `baseURL` is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs ([#12234](better-auth/better-auth#12234)) - Added an `allowInsecureRedirectUri` option so OAuth provider deployments served over HTTP on private networks can accept `http` redirect URIs ([#11904](better-auth/better-auth#11904)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md) ## `@better-auth/prisma-adapter` ### Bug Fixes - Fixed Prisma adapter `incrementOne` and `update` calls using `mode: "insensitive"` filters to match case-insensitively on PostgreSQL and MongoDB ([#11809](better-auth/better-auth#11809)) - Fixed Prisma adapter queries with `eq null` on MongoDB to also match records where the optional field was never set ([#11806](better-auth/better-auth#11806)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md) ## `@better-auth/core` ### Bug Fixes - Added an `allowInsecureRedirectUri` …[full notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20) </details> <details> <summary><b>@<!---->better-auth/oauth-provider</b> (1.7.19 → 1.7.20)</summary> > [!IMPORTANT] > **Action required** > > - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the public `https` URL, since discovery and the `iss` parameter no longer rewrite it to `https`. ([#11904](better-auth/better-auth#11904)) ## `@better-auth/oauth-provider` ### Bug Fixes - Fixed `POST /oauth2/public-client-prelogin` with `allowPublicClientPrelogin` to return a client only when its `client_id` matches the signed `oauth_query`, otherwise responding with `401` `invalid_client` ([#12237](better-auth/better-auth#12237)) - Fixed `oauthProviderResourceClient(auth)` defaults to accept issued access tokens when `baseURL` is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs ([#12234](better-auth/better-auth#12234)) - Added an `allowInsecureRedirectUri` option so OAuth provider deployments served over HTTP on private networks can accept `http` redirect URIs ([#11904](better-auth/better-auth#11904)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md) ## `@better-auth/prisma-adapter` ### Bug Fixes - Fixed Prisma adapter `incrementOne` and `update` calls using `mode: "insensitive"` filters to match case-insensitively on PostgreSQL and MongoDB ([#11809](better-auth/better-auth#11809)) - Fixed Prisma adapter queries with `eq null` on MongoDB to also match records where the optional field was never set ([#11806](better-auth/better-auth#11806)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md) ## `@better-auth/core` ### Bug Fixes - Added an `allowInsecureRedirectUri` …[full notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20) </details> <details> <summary><b>@<!---->better-auth/passkey</b> (1.7.19 → 1.7.20)</summary> > [!IMPORTANT] > **Action required** > > - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the public `https` URL, since discovery and the `iss` parameter no longer rewrite it to `https`. ([#11904](better-auth/better-auth#11904)) ## `@better-auth/oauth-provider` ### Bug Fixes - Fixed `POST /oauth2/public-client-prelogin` with `allowPublicClientPrelogin` to return a client only when its `client_id` matches the signed `oauth_query`, otherwise responding with `401` `invalid_client` ([#12237](better-auth/better-auth#12237)) - Fixed `oauthProviderResourceClient(auth)` defaults to accept issued access tokens when `baseURL` is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs ([#12234](better-auth/better-auth#12234)) - Added an `allowInsecureRedirectUri` option so OAuth provider deployments served over HTTP on private networks can accept `http` redirect URIs ([#11904](better-auth/better-auth#11904)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md) ## `@better-auth/prisma-adapter` ### Bug Fixes - Fixed Prisma adapter `incrementOne` and `update` calls using `mode: "insensitive"` filters to match case-insensitively on PostgreSQL and MongoDB ([#11809](better-auth/better-auth#11809)) - Fixed Prisma adapter queries with `eq null` on MongoDB to also match records where the optional field was never set ([#11806](better-auth/better-auth#11806)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md) ## `@better-auth/core` ### Bug Fixes - Added an `allowInsecureRedirectUri` …[full notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20) </details> <details> <summary><b>@<!---->better-auth/sso</b> (1.7.19 → 1.7.20)</summary> > [!IMPORTANT] > **Action required** > > - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the public `https` URL, since discovery and the `iss` parameter no longer rewrite it to `https`. ([#11904](better-auth/better-auth#11904)) ## `@better-auth/oauth-provider` ### Bug Fixes - Fixed `POST /oauth2/public-client-prelogin` with `allowPublicClientPrelogin` to return a client only when its `client_id` matches the signed `oauth_query`, otherwise responding with `401` `invalid_client` ([#12237](better-auth/better-auth#12237)) - Fixed `oauthProviderResourceClient(auth)` defaults to accept issued access tokens when `baseURL` is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs ([#12234](better-auth/better-auth#12234)) - Added an `allowInsecureRedirectUri` option so OAuth provider deployments served over HTTP on private networks can accept `http` redirect URIs ([#11904](better-auth/better-auth#11904)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md) ## `@better-auth/prisma-adapter` ### Bug Fixes - Fixed Prisma adapter `incrementOne` and `update` calls using `mode: "insensitive"` filters to match case-insensitively on PostgreSQL and MongoDB ([#11809](better-auth/better-auth#11809)) - Fixed Prisma adapter queries with `eq null` on MongoDB to also match records where the optional field was never set ([#11806](better-auth/better-auth#11806)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md) ## `@better-auth/core` ### Bug Fixes - Added an `allowInsecureRedirectUri` …[full notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20) </details> <details> <summary><b>@<!---->effect/platform-node</b> (4.1.3 → 4.1.4)</summary> ### Patch Changes - Updated dependencies [[`f527f90`](Effect-TS/effect@f527f90), [`ee5550a`](Effect-TS/effect@ee5550a), [`7fce132`](Effect-TS/effect@7fce132), [`9116189`](Effect-TS/effect@9116189), [`edb2eaa`](Effect-TS/effect@edb2eaa), [`8176cdb`](Effect-TS/effect@8176cdb), [`3a65e9e`](Effect-TS/effect@3a65e9e), [`fdd319e`](Effect-TS/effect@fdd319e), [`72c3fb4`](Effect-TS/effect@72c3fb4), [`9c41784`](Effect-TS/effect@9c41784)]: - [email protected] - @<!---->effect/[email protected] </details> <details> <summary><b>@<!---->effect/sql-d1</b> (4.1.3 → 4.1.4)</summary> ### Patch Changes - Updated dependencies [[`f527f90`](Effect-TS/effect@f527f90), [`ee5550a`](Effect-TS/effect@ee5550a), [`7fce132`](Effect-TS/effect@7fce132), [`9116189`](Effect-TS/effect@9116189), [`edb2eaa`](Effect-TS/effect@edb2eaa), [`8176cdb`](Effect-TS/effect@8176cdb), [`3a65e9e`](Effect-TS/effect@3a65e9e), [`fdd319e`](Effect-TS/effect@fdd319e), [`72c3fb4`](Effect-TS/effect@72c3fb4), [`9c41784`](Effect-TS/effect@9c41784)]: - [email protected] </details> <details> <summary><b>@<!---->effect/vitest</b> (4.1.3 → 4.1.4)</summary> ### Patch Changes - Updated dependencies [[`f527f90`](Effect-TS/effect@f527f90), [`ee5550a`](Effect-TS/effect@ee5550a), [`7fce132`](Effect-TS/effect@7fce132), [`9116189`](Effect-TS/effect@9116189), [`edb2eaa`](Effect-TS/effect@edb2eaa), [`8176cdb`](Effect-TS/effect@8176cdb), [`3a65e9e`](Effect-TS/effect@3a65e9e), [`fdd319e`](Effect-TS/effect@fdd319e), [`72c3fb4`](Effect-TS/effect@72c3fb4), [`9c41784`](Effect-TS/effect@9c41784)]: - [email protected] </details> <details> <summary><b>better-auth</b> (1.7.19 → 1.7.20)</summary> > [!IMPORTANT] > **Action required** > > - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the public `https` URL, since discovery and the `iss` parameter no longer rewrite it to `https`. ([#11904](better-auth/better-auth#11904)) ## `@better-auth/oauth-provider` ### Bug Fixes - Fixed `POST /oauth2/public-client-prelogin` with `allowPublicClientPrelogin` to return a client only when its `client_id` matches the signed `oauth_query`, otherwise responding with `401` `invalid_client` ([#12237](better-auth/better-auth#12237)) - Fixed `oauthProviderResourceClient(auth)` defaults to accept issued access tokens when `baseURL` is only an origin, by including the auth path in the default issuer, JWKS, and introspection URLs ([#12234](better-auth/better-auth#12234)) - Added an `allowInsecureRedirectUri` option so OAuth provider deployments served over HTTP on private networks can accept `http` redirect URIs ([#11904](better-auth/better-auth#11904)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md) ## `@better-auth/prisma-adapter` ### Bug Fixes - Fixed Prisma adapter `incrementOne` and `update` calls using `mode: "insensitive"` filters to match case-insensitively on PostgreSQL and MongoDB ([#11809](better-auth/better-auth#11809)) - Fixed Prisma adapter queries with `eq null` on MongoDB to also match records where the optional field was never set ([#11806](better-auth/better-auth#11806)) For detailed changes, see [`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md) ## `@better-auth/core` ### Bug Fixes - Added an `allowInsecureRedirectUri` …[full notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20) </details> <details> <summary><b>effect</b> (4.1.3 → 4.1.4)</summary> ### Patch Changes - [#10512](Effect-TS/effect#10512) [`f527f90`](Effect-TS/effect@f527f90) Thanks @<!---->effect-bot! - Add `WorkloadIdentity` helpers for Anthropic and OpenAI authentication, and report OpenAI WebSocket client-transform failures as `AiError` instead of defects. - [#10529](Effect-TS/effect#10529) [`ee5550a`](Effect-TS/effect@ee5550a) Thanks @<!---->only21mil! - Fix CLI `--wizard` generating a command that fails to parse when flags or arguments were already typed for the selected command. - [#9995](Effect-TS/effect#9995) [`7fce132`](Effect-TS/effect@7fce132) Thanks @<!---->tim-smart! - Add the `HttpApi.RedactedNames` annotation for declaring query parameter and header names of an API, group or endpoint to redact in the URL and header attributes of `HttpApiClient` and `HttpApiBuilder` spans, for values that are only sometimes secret. `addHttpApi` treats it like any other annotation, and `user_agent.original` is recorded as is. - [#10537](Effect-TS/effect#10537) [`9116189`](Effect-TS/effect@9116189) Thanks @<!---->effect-bot! - Expose `HttpApiSchema.getResponseEncodingSchema` and `getEncodeToWithHeadersParts` for inspecting buffered response encodings and declared body/header schemas. - [#10521](Effect-TS/effect#10521) [`edb2eaa`](Effect-TS/effect@edb2eaa) Thanks @<!---->gcanti! - Add experimental `closeObjects`, fix JSON Schema composition and examples, and regenerate a smaller OpenRouter client with a boolean workspace-deletion confirmation flag. ### Breaking changes The generated OpenRouter schemas follow the current upstream specification. Some intermediate sche …[full notes](https://github.com/Effect-TS/effect/releases/tag/effect%404.1.4) </details> <details> <summary><b>react-email</b> (6.11.10 → 6.11.11)</summary> ### Patch Changes * 9f75920: Remove the `debounce` dependency. * Updated dependencies \[a126e56] * Updated dependencies \[f147c14] * @<!---->react-email/[email protected] </details> <details> <summary><b>seroval</b> (1.8.0 → 1.8.1)</summary> ### Patch Changes - 0d5c590: `fromJSON` and `fromCrossJSON` now decode a well-known symbol that appears more than once in a value. The second use used to become `undefined`, or failed as a malformed node when it was an object key. A value with two iterables or async iterables, such as `[gen1, gen2]`, hit this. </details> --- *This PR was auto-generated by [catalog-update-action](https://github.com/brandhaug/catalog-update-action).* Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
--wizarduses the typed command line as its starting point, then prompts for every flag and argument of the selected command and appends the answers. Values already typed for that command can appear twice and make the generated command fail when the wizard runs it:notes add sample-note --wizardbuildsnotes add sample-note --tag docs sample-note, which fails withUnexpected positional argument: "sample-note".notes add --tag draft --wizardbuildsnotes add --tag draft --tag docs sample-note, which fails withInvalid value for flag --tag: "2 occurrences". Expected: at most 1 value.Change
The wizard's starting command line now leaves out the tokens the parser hands to the selected command: its own flags, their values, its positional arguments and any operands after
--. Those are exactly what the wizard prompts for again. Everything else typed stays where it was: subcommand names, shared parent flags (before or after the subcommand name) and global flags such as--log-level.Notable decisions:
getSelectedCommandTokens, which shares its context setup withparseArgs), so the two can't disagree about which tokens belong to which command.-abshows as-a -bin the wizard's command line. Numeric aliases use long-option syntax (for example,-s4becomes-s --4) so they are not reinterpreted as negative positional numbers.Verification
packages/effect/test/cli/Command.test.ts, "should replace the selected command's typed flags and arguments with --wizard". It types a global flag, a subcommand, a shared short flag with an inline value, a local flag and a positional, then answers the prompts. Onmainit fails because rerunning the generated command throwsShowHelp. With this change it passes, and the command shown isroot --log-level error child -p=dev --name prompted -- prompted.pnpm test --run packages/effect/test/cli: 490 passed, 2 skipped.pnpm lint,pnpm check,pnpm check-tsc,pnpm jsdocs --checkandpnpm circularpass.notes add --tag <tag> <title>) in a real terminal, typingdocsandsample-noteat the prompts:Before, on
main: the wizard keeps the typedsample-noteand appends the prompted one, so the command fails to parse.After: the typed title is replaced by the prompted one and the command runs.
Not checked: the full test suite, Deno and Bun,
pnpm buildandcheck-dist-types. CI runs those.Two existing behaviors are unchanged and out of scope.
--wizard truestill keeps thetrue. A command's non-shared flags typed before its subcommand name are still rejected, with or without--wizard.Generated with Claude Opus 5.5 in T3 Code Nightly
Maintainer validation
UnknownSubcommand: "-4". Added one public-boundary regression asserting both inherited flags reach the child handler.nix develop -c pnpm test --run packages/effect/test/cli: 490 passed, 5 skipped.nix develop -c pnpm lint-fixandnix develop -c pnpm checkpassed.Closes EFF-3615
Follow-up: wizard leaf positional answers are separated with
--, preserving implicit shared/global boolean bindings when an answer is a boolean literal. A parameterized public-boundary regression covers both flag scopes and failed before the fix.