feat: switch installer to Claude Opus 5.5 and bump @workos/skills to 0.8.0

package.json

@@ -31,7 +31,7 @@
     "@workos/emulate": "^0.14.0",
     "@workos/migrations": "^2.6.0",
     "@workos/openapi-spec": "^0.123.0",
-    "@workos/skills": "0.7.3",
+    "@workos/skills": "0.8.0",
     "chalk": "^6.0.1",
     "diff": "^9.0.0",
     "fast-glob": "^3.3.3",

src/cli.config.ts

@@ -4,7 +4,7 @@ import pkg from '../package.json' with { type: 'json' };
 export const version = pkg.version;
 
 export const config = {
-  model: 'claude-opus-4-5-20251101',
+  model: 'claude-opus-5-5',
   doctorModel: 'claude-haiku-4-5-20251001',
 
   // Production defaults - override via env vars for local dev.

tests/evals/__tests__/agent-executor.spec.ts

@@ -109,8 +109,8 @@ describe('AgentExecutor', () => {
     const [agentRunConfig] = mockRunAgent.mock.calls[0];
     expect(agentRunConfig.workingDirectory).toBe(testDir);
     expect(agentRunConfig.model).toBe('test-model');
-    expect(agentRunConfig.allowedTools).toContain('Skill');
-    expect(agentRunConfig.allowedTools).toContain('Write');
+    // Must match production so every tool call goes through installerCanUseTool
+    expect(agentRunConfig.allowedTools).toEqual([]);
     expect(agentRunConfig.mcpServers).toBeUndefined();
     // Direct mode — no gateway URL
     expect(agentRunConfig.sdkEnv.ANTHROPIC_API_KEY).toBe('sk-ant-test');

tests/evals/agent-executor.ts

@@ -138,7 +138,9 @@ export class AgentExecutor {
     const agentRunConfig: AgentRunConfig = {
       workingDirectory: this.workDir,
       model: process.env.EVAL_MODEL ?? getConfig().model,
-      allowedTools: ['Skill', 'Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep', 'WebFetch'],
+      // Empty like production: listed tools skip installerCanUseTool, which would let
+      // eval agents run commands (e.g. `workos`, `curl`) the shipped installer denies.
+      allowedTools: [],
       sdkEnv,
       claudeExecutablePath: await ensureClaudeCodeExecutable(),
     };

tests/evals/graders/nextjs.grader.ts

@@ -113,8 +113,9 @@ export class NextjsGrader implements Grader {
     const sdkImportChecks = await this.fileGrader.checkFileContains(middlewareFile, ['@workos-inc/authkit-nextjs']);
     checks.push(...sdkImportChecks);
 
-    // Check for authkit integration: authkitMiddleware OR (authkit + handleAuthkitProxy, or its deprecated alias handleAuthkitHeaders)
-    const middlewareChecks = await this.fileGrader.checkFileContains(middlewareFile, ['authkitMiddleware']);
+    // Check for authkit integration: authkitProxy (or its deprecated alias authkitMiddleware)
+    // OR (authkit + handleAuthkitProxy, or its deprecated alias handleAuthkitHeaders)
+    const middlewareChecks = await this.fileGrader.checkFileContains(middlewareFile, [/authkit(Proxy|Middleware)\b/]);
     const composableChecks = await this.fileGrader.checkFileContains(middlewareFile, [
       'authkit(',
       /handleAuthkit(Proxy|Headers)\b/,
@@ -127,10 +128,10 @@ export class NextjsGrader implements Grader {
       name: 'AuthKit middleware integration',
       passed: usesAuthkitMiddleware || usesComposable,
       message: usesAuthkitMiddleware
-        ? 'Uses authkitMiddleware'
+        ? 'Uses authkitProxy/authkitMiddleware'
         : usesComposable
           ? 'Uses authkit() composable with handleAuthkitProxy'
-          : 'Missing authkitMiddleware or authkit() composable integration',
+          : 'Missing authkitProxy/authkitMiddleware or authkit() composable integration',
     };
     checks.push(authkitCheck);