fix(install): configure sandbox application URLs across SDKs

[jasonbarry]

Problem

The installer skipped callback and CORS registration for most SDKs. Expanding setup also exposed legacy paths that could write localhost settings with a production key, replace an existing homepage, mutate two different environments, or report success after callback registration failed.

Changes

• Configure URLs after the agent through one target: the client-ID-matched sandbox dashboard application, or the sandbox API-key-only fallback. Non-Next.js SDKs include CORS in that choice; its origin follows the callback URL, including explicit custom origins.
• Keep production environments read-only, preserve existing dashboard settings, and merge/recheck/read back list mutations. REST homepage writes require an explicit --homepage-url or a matching stored unclaimed environment.
• Fail installation when the callback cannot be registered. Report incomplete additional settings honestly, including independently verified sign-out settings.
• Add documented sign-in paths and generate the appropriate public login route for each SDK. Server SDKs configure Initiate login URI through the selected dashboard application when available.
• For React and vanilla JS, generate /login and configure the explicit bundler-prefixed callback, but leave Initiate login URI unchanged until browser verification. Users should open /login while signed out, confirm automatic sign-in, and then set that URL in the dashboard.
• Remove the client-route AST analyzer and direct Babel dependency. Static source patterns cannot prove that a route is mounted or starts sign-in. Prompts follow app conventions rather than parser-supported syntax. Bounded callback/env checks remain; incomplete scans warn instead of failing installation.
• SvelteKit defaults to port 5173 and /callback, per its README.

Scope

• Independent CI smoke-credential changes moved to ci: distinguish unusable smoke credentials from CLI regressions #251; this PR no longer changes CI.
• Browser-flow verification remains manual. No static check claims to verify authentication behavior.
• Laravel starter-kit callback detection remains out of scope.

Validation

• bun install --frozen-lockfile
• bun run typecheck
• bun run test: 3,116 passed on the final full-suite run. An earlier run failed the untouched skills-repair sibling-protection test; it passed in isolation and on the full rerun without a code change.
• bun run lint
• bun run build
• Independent review of the simplification and retained URL-safety boundaries.
• Live sandbox installer/browser smoke for a React app and a server SDK app. Not run during this revision; local tests do not establish live authentication success.

Original implementation session: https://claude.ai/code/session_018EgeNr2FXXVcJ5o165U5Lx

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds sign-in route configuration to the SDK installer workflow.

The PR appears safe to merge based on this review; no new findings or outstanding previous findings remain.

Summary

The PR moves sandbox URL configuration after agent installation, selects a single WorkOS target, and adds SDK-specific sign-in guidance and bounded client callback checks.

• It preserves existing dashboard settings where possible and reports callback, CORS, sign-out, and initiate-login status separately.
• React and vanilla JS leave the Initiate login URI unchanged pending browser verification.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Prepare local environment] --> B[Agent installs integration]
  B --> C[Validate generated integration]
  C --> D{WorkOS URL target}
  D -->|Matched sandbox dashboard application| E[Merge and verify application URLs]
  D -->|Sandbox API key only| F[Register callback and CORS; conditionally set homepage]
  E --> G[Report verified and pending settings]
  F --> G

Loading

_{Reviews (20) · Last reviewed commit: "ci: rerun checks after retargeting insta..."}