Authz

.changeset/cli-token-only-auth.md

@@ -0,0 +1,8 @@
+---
+'@walkeros/cli': patch
+---
+
+The CLI authenticates with a token only: create one under Account > Automation
+tokens and set `WALKEROS_TOKEN`. `walkeros auth login`, `logout` and `token` are
+removed, with the stored session and their exports. An old sign-in in the config
+file is no longer read, and `walkeros api` refuses an `Authorization` header.

.changeset/flow-ref-empty-hint.md

@@ -0,0 +1,6 @@
+---
+'@walkeros/core': patch
+---
+
+The error for an empty `$flow` reference names only the setting to fill in; it
+no longer suggests a `walkeros deploy` command.

.changeset/flow-ref-hyphen-names.md

@@ -0,0 +1,7 @@
+---
+'@walkeros/core': patch
+'@walkeros/explorer': patch
+---
+
+`$flow` references now accept flow names with a hyphen, such as
+`$flow.tracking-server.url`.

.changeset/moin-capture-ping.md

@@ -0,0 +1,6 @@
+---
+'@walkeros/core': patch
+---
+
+Tag Mode's loader now hears the app's call on sites that block messages from
+origins they do not know.

.github/workflows/website.yml

@@ -1,17 +1,23 @@
 name: Deploy Website
 
 on:
+  # Skills are published as /skills pages and validated only by this workflow,
+  # so a skills or plugin change alone must build and deploy too.
   push:
     branches: [main]
     paths:
       - 'website/**'
       - 'apps/demos/storybook/**'
+      - 'skills/**'
+      - '.claude-plugin/**'
       - '.github/workflows/website.yml'
   pull_request:
     types: [opened, synchronize, reopened, closed]
     paths:
       - 'website/**'
       - 'apps/demos/storybook/**'
+      - 'skills/**'
+      - '.claude-plugin/**'
       - '.github/workflows/website.yml'
   workflow_dispatch:
     inputs:

apps/explorer/src/utils/__tests__/monaco-walkeros-decorations.test.ts

@@ -72,6 +72,12 @@ describe('findWalkerOSReferences', () => {
     expect(matches[0].name).toBe('server.url');
   });
 
+  it('finds $flow. references to a hyphenated flow name', () => {
+    const matches = findWalkerOSReferences('"$flow.tracking-server.url"');
+    expect(matches).toHaveLength(1);
+    expect(matches[0].name).toBe('tracking-server.url');
+  });
+
   it('finds $flow. prefix only', () => {
     const refs = findWalkerOSReferences('"$flow."');
     expect(refs).toHaveLength(1);

apps/explorer/src/utils/monaco-walkeros-decorations.ts

@@ -1,4 +1,5 @@
 import type { editor } from 'monaco-editor';
+import { REF_FLOW_NAME } from '@walkeros/core';
 import {
   syntaxFunction,
   syntaxKeyword,
@@ -27,7 +28,8 @@ export interface WalkerOSReference {
 // in @walkeros/core, but relaxed here because the decorator scans free-form
 // substrings inside quoted JSON/TS strings rather than whole-string values.
 // Name regex allows trailing dot + optional name/path so that prefix-only
-// typing (e.g. `"$var."`) still lights up for IntelliSense.
+// typing (e.g. `"$var."`) still lights up for IntelliSense. The `$flow` name
+// is REF_FLOW_NAME itself, made optional.
 export const REFERENCE_PATTERNS: Array<{
   type: ReferenceType;
   regex: RegExp;
@@ -52,7 +54,7 @@ export const REFERENCE_PATTERNS: Array<{
   { type: 'store', regex: /\$store\.(\w*)/g, className: 'elb-ref-store' },
   {
     type: 'flow',
-    regex: /\$flow\.(\w*(?:\.[\w.]*)?)/g,
+    regex: new RegExp(`\\$flow\\.((?:${REF_FLOW_NAME})?(?:\\.[\\w.]*)?)`, 'g'),
     className: 'elb-ref-flow',
   },
   { type: 'code', regex: /\$code:/g, className: 'elb-ref-code' },

packages/cli/package.json

@@ -66,7 +66,6 @@
     "fs-extra": "^11.3.2",
     "jsdom": "^29.1.1",
     "npm-package-arg": "^13.0.2",
-    "open": "^11.0.0",
     "pacote": "^21.0.4",
     "picomatch": "^4.0.4",
     "semver": "^7.7.4",

packages/cli/src/__tests__/unit/commands/auth-whoami.test.ts

@@ -1,3 +1,4 @@
+import { NOT_SIGNED_IN } from '../../../commands/api/index.js';
 import { whoami } from '../../../commands/auth/index.js';
 
 describe('whoami', () => {
@@ -24,18 +25,13 @@ describe('whoami', () => {
         auth: new Headers(init?.headers).get('Authorization'),
       };
       return new Response(
-        JSON.stringify({
-          userId: 'usr_1',
-          email: 'test@example.com',
-          projectId: null,
-        }),
+        JSON.stringify({ userId: 'usr_1', email: 'test@example.com' }),
         { status: 200 },
       );
     };
     await expect(whoami()).resolves.toEqual({
       userId: 'usr_1',
       email: 'test@example.com',
-      projectId: null,
     });
     expect(seen).toEqual({
       url: 'https://app.example.test/api/auth/whoami',
@@ -53,4 +49,9 @@ describe('whoami', () => {
       );
     await expect(whoami()).rejects.toThrow('Token expired');
   });
+
+  it('refuses without WALKEROS_TOKEN, with the line the api command prints', async () => {
+    delete process.env.WALKEROS_TOKEN;
+    await expect(whoami()).rejects.toThrow(NOT_SIGNED_IN);
+  });
 });