feat: switch installer to Claude Opus 5.5 and bump @workos/skills to 0.8.0

[nicknisi]

What

• src/cli.config.ts: installer model claude-opus-4-5-20251101 → claude-opus-5-5. The Agent SDK bump this needs landed in chore(deps): bump claude-agent-sdk to 0.3.295 for Opus 5.5 support #261.
• @workos/skills 0.7.3 → 0.8.0. This brings the stale-API fixes and trimmed references from fix: update skills for current SDKs and frontier models skills#53, plus feat: multi-SDK expansion with auto-discovery registry #49 (SDK-aware redirect guidance) and fix: prefer existing middleware.ts over proxy.ts for Next.js 16+ #52 (accountless install).
• Evals:
  • The harness now gates tools like production. It passed every tool in allowedTools, which skips installerCanUseTool. Eval agents could therefore run commands the shipped installer denies, including curl and read-only workos CLI calls (environment list, whoami, authkit redirect-uris list, ...) against the developer's signed-in WorkOS account. I checked the transcripts from the last two runs: they contain only reads, no writes. allowedTools is now [], as in production.
  • The Next.js grader accepts authkitProxy. In authkit-nextjs 4.4, authkitMiddleware is a deprecated alias of authkitProxy, and Opus 5.5 uses the current name.

Decision for review: reliability vs. install time

Both runs below use production tool gating and @workos/skills 0.8.0. That covers 50 scenarios: all JS frameworks plus Python, Ruby, Go, and Elixir. PHP, Laravel, and Kotlin were skipped because their toolchains weren't installed locally.

	Opus 4.5	Opus 5.5
Passed (with retries)	50/50	50/50
First-attempt pass	72.0%	84.0%
Scenario duration p50 / p95	179s / 380s	364s / 534s
TTFT p50	12.3s	13.0s
Tool calls (total)	1,654	2,824
Wall time (concurrency 8)	25m	47m

Per-framework p50 (4.5 → 5.5): nextjs 276→412s, react 166→329s, react-router 191→404s, tanstack-start 371→402s, vanilla-js 199→330s, sveltekit 216→293s, node 138→369s, python 100→467s, ruby 160→522s, go 380→535s, elixir 256→399s.

Opus 5.5 needs fewer self-corrections, but it reads about twice as many files, runs more verification commands, and sometimes spawns subagents. Typical installs take about twice as long. Earlier comparisons, run without production gating, didn't show this gap, so those numbers shouldn't be used.

This is a single run per model, so treat the deltas as directional.

Verification

• bun run test: 3,476 passed. Typecheck, lint, format:check, and build are clean. The bundled skills manifest reports 0.8.0.
• Eval smoke under production gating: the SDK's CAN_USE_TOOL_SHADOWED warning is gone, and workos / curl calls are denied.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Changes the installer default to claude-opus-5-5 and updates @workos/skills to 0.8.0.

• The installer uses Opus 5.5 and WorkOS skills 0.8.0 for integrations.
• Eval agents use the same tool permissions as the installer.
• The Next.js grader recognizes authkitProxy as an AuthKit integration.

No actionable issues were found. No runtime checks were run during this review.

_{Reviews (1) · Last reviewed commit: "test(evals): gate eval tools like produc..." · Reviewed by Greptile}