Skip to content

Fix CLI wizard repeating flags and arguments typed before --wizard - #10529

Merged
tim-smart merged 5 commits into
Effect-TS:mainfrom
only21mil:fix/cli-wizard-repeated-arguments
Nov 11, 2026
Merged

tim-smart merged 5 commits into
Effect-TS:mainfrom
only21mil:fix/cli-wizard-repeated-arguments

Conversation

@only21mil

@only21mil only21mil commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Problem

--wizard uses the typed command line as its starting point, then prompts for every flag and argument of the selected command and appends the answers. Values already typed for that command can appear twice and make the generated command fail when the wizard runs it:

  • notes add sample-note --wizard builds notes add sample-note --tag docs sample-note, which fails with Unexpected positional argument: "sample-note".
  • notes add --tag draft --wizard builds notes add --tag draft --tag docs sample-note, which fails with Invalid value for flag --tag: "2 occurrences". Expected: at most 1 value.

Change

The wizard's starting command line now leaves out the tokens the parser hands to the selected command: its own flags, their values, its positional arguments and any operands after --. Those are exactly what the wizard prompts for again. Everything else typed stays where it was: subcommand names, shared parent flags (before or after the subcommand name) and global flags such as --log-level.

Notable decisions:

  • The wizard still prompts for every parameter of the selected command, as it does today when nothing is typed. It doesn't skip or prefill the ones that were typed.
  • The tokens to drop come from the parser's own subcommand walk (getSelectedCommandTokens, which shares its context setup with parseArgs), so the two can't disagree about which tokens belong to which command.
  • The kept tokens are written back as arguments, so a short-option cluster such as -ab shows as -a -b in the wizard's command line. Numeric aliases use long-option syntax (for example, -s4 becomes -s --4) so they are not reinterpreted as negative positional numbers.

Verification

  • New test in packages/effect/test/cli/Command.test.ts, "should replace the selected command's typed flags and arguments with --wizard". It types a global flag, a subcommand, a shared short flag with an inline value, a local flag and a positional, then answers the prompts. On main it fails because rerunning the generated command throws ShowHelp. With this change it passes, and the command shown is root --log-level error child -p=dev --name prompted -- prompted.
  • pnpm test --run packages/effect/test/cli: 490 passed, 2 skipped.
  • pnpm lint, pnpm check, pnpm check-tsc, pnpm jsdocs --check and pnpm circular pass.
  • I ran a small CLI (notes add --tag <tag> <title>) in a real terminal, typing docs and sample-note at the prompts:

Before, on main: the wizard keeps the typed sample-note and appends the prompted one, so the command fails to parse.

Wizard on main repeats the typed title

After: the typed title is replaced by the prompted one and the command runs.

Wizard with this change runs the command

Not checked: the full test suite, Deno and Bun, pnpm build and check-dist-types. CI runs those.

Two existing behaviors are unchanged and out of scope. --wizard true still keeps the true. A command's non-shared flags typed before its subcommand name are still rejected, with or without --wizard.

Generated with Claude Opus 5.5 in T3 Code Nightly

Maintainer validation

  • Confirmed the numeric-alias regression fails before the correction with UnknownSubcommand: "-4". Added one public-boundary regression asserting both inherited flags reach the child handler.
  • nix develop -c pnpm test --run packages/effect/test/cli: 490 passed, 5 skipped.
  • nix develop -c pnpm lint-fix and nix develop -c pnpm check passed.

Closes EFF-3615

Follow-up: wizard leaf positional answers are separated with --, preserving implicit shared/global boolean bindings when an answer is a boolean literal. A parameterized public-boundary regression covers both flag scopes and failed before the fix.

The wizard prompts for every flag and argument of the selected command,
but its starting command line kept everything typed before --wizard, so
those values appeared twice and the generated command failed to parse.
The starting command line now drops the tokens the parser hands the
selected command and keeps subcommand names, inherited flags and global
flags.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@changeset-bot

changeset-bot Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 91a9b4b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 34 packages
Name Type
effect Patch
@effect/opentelemetry Patch
@effect/vitest Patch
@effect/ai-anthropic Patch
@effect/ai-cloudflare Patch
@effect/ai-openai-compat Patch
@effect/ai-openai Patch
@effect/ai-openrouter Patch
@effect/ai-typesafe Patch
@effect/atom-react Patch
@effect/atom-solid Patch
@effect/atom-vue Patch
@effect/platform-browser Patch
@effect/platform-bun Patch
@effect/platform-cloudflare Patch
@effect/platform-deno Patch
@effect/platform-node-shared Patch
@effect/platform-node Patch
@effect/sql-clickhouse Patch
@effect/sql-d1 Patch
@effect/sql-libsql Patch
@effect/sql-mssql Patch
@effect/sql-mysql2 Patch
@effect/sql-pg Patch
@effect/sql-pglite Patch
@effect/sql-sqlite-bun Patch
@effect/sql-sqlite-do Patch
@effect/sql-sqlite-node Patch
@effect/sql-sqlite-react-native Patch
@effect/sql-sqlite-wasm Patch
@effect/docgen Patch
@effect/doctest Patch
@effect/graphql-generator Patch
@effect/openapi-generator Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name Current Size Previous Size Difference
arbitrary-combinators.ts 39.61 KB 39.61 KB 0.00 KB (0.00%)
basic.ts 7.31 KB 7.31 KB 0.00 KB (0.00%)
batching.ts 11.21 KB 11.21 KB 0.00 KB (0.00%)
brand.ts 7.00 KB 7.00 KB 0.00 KB (0.00%)
cache.ts 11.73 KB 11.73 KB 0.00 KB (0.00%)
config.ts 23.06 KB 23.06 KB 0.00 KB (0.00%)
differ.ts 22.20 KB 22.20 KB 0.00 KB (0.00%)
http-client.ts 27.44 KB 27.44 KB 0.00 KB (0.00%)
http-router.ts 37.34 KB 37.34 KB 0.00 KB (0.00%)
logger.ts 12.19 KB 12.19 KB 0.00 KB (0.00%)
metric.ts 9.64 KB 9.64 KB 0.00 KB (0.00%)
optic.ts 7.21 KB 7.21 KB 0.00 KB (0.00%)
pubsub.ts 16.21 KB 16.21 KB 0.00 KB (0.00%)
queue.ts 13.09 KB 13.09 KB 0.00 KB (0.00%)
schedule.ts 11.99 KB 11.99 KB 0.00 KB (0.00%)
schema-bigdecimal.ts 14.29 KB 14.29 KB 0.00 KB (0.00%)
schema-binary.ts 42.44 KB 42.44 KB 0.00 KB (0.00%)
schema-class.ts 21.96 KB 21.96 KB 0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts 30.56 KB 30.56 KB 0.00 KB (0.00%)
schema-representation-roundtrip.ts 28.22 KB 28.22 KB 0.00 KB (0.00%)
schema-string-transformation.ts 15.54 KB 15.54 KB 0.00 KB (0.00%)
schema-string.ts 12.50 KB 12.50 KB 0.00 KB (0.00%)
schema-template-literal.ts 16.42 KB 16.42 KB 0.00 KB (0.00%)
schema-toArbitrary.ts 39.16 KB 39.16 KB 0.00 KB (0.00%)
schema-toCodeDocument.ts 26.39 KB 26.39 KB 0.00 KB (0.00%)
schema-toCodecJson.ts 21.11 KB 21.11 KB 0.00 KB (0.00%)
schema-toEquivalence.ts 21.28 KB 21.28 KB 0.00 KB (0.00%)
schema-toFormatter.ts 21.37 KB 21.37 KB 0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts 26.38 KB 26.38 KB 0.00 KB (0.00%)
schema-toRepresentation.ts 21.45 KB 21.45 KB 0.00 KB (0.00%)
schema.ts 21.05 KB 21.05 KB 0.00 KB (0.00%)
stm.ts 14.40 KB 14.40 KB 0.00 KB (0.00%)
stream.ts 10.56 KB 10.56 KB 0.00 KB (0.00%)

@tim-smart
tim-smart enabled auto-merge (squash) November 11, 2026 03:04
@tim-smart
tim-smart merged commit ee5550a into Effect-TS:main Nov 11, 2026
15 of 16 checks passed
@effect-bot effect-bot mentioned this pull request Nov 11, 2026
brandhaug added a commit to brandhaug/b2b-saas-starter that referenced this pull request Nov 14, 2026
## pnpm-workspace.yaml (default)

## Dependency Updates

| Package | From | To | Type |
| --- | --- | --- | --- |
| `@better-auth/cimd` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/mcp` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/oauth-provider` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/passkey` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/sso` | 1.7.19 | 1.7.20 | patch |
| `@effect/platform-node` | 4.1.3 | 4.1.4 | patch |
| `@effect/sql-d1` | 4.1.3 | 4.1.4 | patch |
| `@effect/vitest` | 4.1.3 | 4.1.4 | patch |
| `@inlang/paraglide-js` | 3.2.1 | 3.2.2 | patch |
| `@react-email/ui` | 6.11.10 | 6.11.11 | patch |
| `ai` | 7.0.166 | 7.0.169 | patch |
| `better-auth` | 1.7.19 | 1.7.20 | patch |
| `effect` | 4.1.3 | 4.1.4 | patch |
| `react-email` | 6.11.10 | 6.11.11 | patch |
| `seroval` | 1.8.0 | 1.8.1 | patch |

## Release Notes

<details>
<summary><b>@<!---->better-auth/cimd</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/mcp</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/oauth-provider</b> (1.7.19 →
1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/passkey</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/sso</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->effect/platform-node</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- Updated dependencies
[[`f527f90`](Effect-TS/effect@f527f90),
[`ee5550a`](Effect-TS/effect@ee5550a),
[`7fce132`](Effect-TS/effect@7fce132),
[`9116189`](Effect-TS/effect@9116189),
[`edb2eaa`](Effect-TS/effect@edb2eaa),
[`8176cdb`](Effect-TS/effect@8176cdb),
[`3a65e9e`](Effect-TS/effect@3a65e9e),
[`fdd319e`](Effect-TS/effect@fdd319e),
[`72c3fb4`](Effect-TS/effect@72c3fb4),
[`9c41784`](Effect-TS/effect@9c41784)]:
  - [email protected]
  - @<!---->effect/[email protected]

</details>

<details>
<summary><b>@<!---->effect/sql-d1</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- Updated dependencies
[[`f527f90`](Effect-TS/effect@f527f90),
[`ee5550a`](Effect-TS/effect@ee5550a),
[`7fce132`](Effect-TS/effect@7fce132),
[`9116189`](Effect-TS/effect@9116189),
[`edb2eaa`](Effect-TS/effect@edb2eaa),
[`8176cdb`](Effect-TS/effect@8176cdb),
[`3a65e9e`](Effect-TS/effect@3a65e9e),
[`fdd319e`](Effect-TS/effect@fdd319e),
[`72c3fb4`](Effect-TS/effect@72c3fb4),
[`9c41784`](Effect-TS/effect@9c41784)]:
  - [email protected]

</details>

<details>
<summary><b>@<!---->effect/vitest</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- Updated dependencies
[[`f527f90`](Effect-TS/effect@f527f90),
[`ee5550a`](Effect-TS/effect@ee5550a),
[`7fce132`](Effect-TS/effect@7fce132),
[`9116189`](Effect-TS/effect@9116189),
[`edb2eaa`](Effect-TS/effect@edb2eaa),
[`8176cdb`](Effect-TS/effect@8176cdb),
[`3a65e9e`](Effect-TS/effect@3a65e9e),
[`fdd319e`](Effect-TS/effect@fdd319e),
[`72c3fb4`](Effect-TS/effect@72c3fb4),
[`9c41784`](Effect-TS/effect@9c41784)]:
  - [email protected]

</details>

<details>
<summary><b>better-auth</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>effect</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- [#10512](Effect-TS/effect#10512)
[`f527f90`](Effect-TS/effect@f527f90)
Thanks @<!---->effect-bot! - Add `WorkloadIdentity` helpers for
Anthropic and OpenAI authentication, and report OpenAI WebSocket
client-transform failures as `AiError` instead of defects.

- [#10529](Effect-TS/effect#10529)
[`ee5550a`](Effect-TS/effect@ee5550a)
Thanks @<!---->only21mil! - Fix CLI `--wizard` generating a command that
fails to parse when flags or arguments were already typed for the
selected command.

- [#9995](Effect-TS/effect#9995)
[`7fce132`](Effect-TS/effect@7fce132)
Thanks @<!---->tim-smart! - Add the `HttpApi.RedactedNames` annotation
for declaring query parameter and header names of an API, group or
endpoint to redact in the URL and header attributes of `HttpApiClient`
and `HttpApiBuilder` spans, for values that are only sometimes secret.
`addHttpApi` treats it like any other annotation, and
`user_agent.original` is recorded as is.

- [#10537](Effect-TS/effect#10537)
[`9116189`](Effect-TS/effect@9116189)
Thanks @<!---->effect-bot! - Expose
`HttpApiSchema.getResponseEncodingSchema` and
`getEncodeToWithHeadersParts` for inspecting buffered response encodings
and declared body/header schemas.

- [#10521](Effect-TS/effect#10521)
[`edb2eaa`](Effect-TS/effect@edb2eaa)
Thanks @<!---->gcanti! - Add experimental `closeObjects`, fix JSON
Schema composition and examples, and regenerate a smaller OpenRouter
client with a boolean workspace-deletion confirmation flag.
  
  ### Breaking changes
  
The generated OpenRouter schemas follow the current upstream
specification. Some intermediate sche

…[full
notes](https://github.com/Effect-TS/effect/releases/tag/effect%404.1.4)

</details>

<details>
<summary><b>react-email</b> (6.11.10 → 6.11.11)</summary>

### Patch Changes

* 9f75920: Remove the `debounce` dependency.
* Updated dependencies \[a126e56]
* Updated dependencies \[f147c14]
  * @<!---->react-email/[email protected]

</details>

<details>
<summary><b>seroval</b> (1.8.0 → 1.8.1)</summary>

### Patch Changes

- 0d5c590: `fromJSON` and `fromCrossJSON` now decode a well-known symbol
that appears more than once in a value. The second use used to become
`undefined`, or failed as a malformed node when it was an object key. A
value with two iterables or async iterables, such as `[gen1, gen2]`, hit
this.

</details>

---
*This PR was auto-generated by
[catalog-update-action](https://github.com/brandhaug/catalog-update-action).*

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

This branch is waiting to be deployed

1 waiting deployment
fork — 91a9b4ba Waiting Nov 11, 2026 by effect-bot via approval-gate #25878
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants