feat: switch installer to Claude Opus 5.5 and bump @workos/skills to 0.8.0 (#265)

* feat: switch installer to Claude Opus 5.5 and bump @workos/skills to 0.8.0

* test(evals): gate eval tools like production and accept authkitProxy

The eval harness passed every tool in allowedTools, which skips
installerCanUseTool. Eval agents could run commands the shipped installer
denies, including curl and read-only workos CLI calls against the
developer's signed-in account. allowedTools is now empty, as in production.

authkit-nextjs 4.4 makes authkitMiddleware a deprecated alias of
authkitProxy; the Next.js grader accepts both.

Author: nicknisi

bun.lock

@@ -31,7 +31,7 @@
     "@workos/emulate": "^0.14.0",
     "@workos/migrations": "^2.6.0",
     "@workos/openapi-spec": "^0.123.0",
-    "@workos/skills": "0.7.3",
+    "@workos/skills": "0.8.0",
     "chalk": "^6.0.1",
     "diff": "^9.0.0",
     "fast-glob": "^3.3.3",

package.json

@@ -4,7 +4,7 @@ import pkg from '../package.json' with { type: 'json' };
 export const version = pkg.version;
 
 export const config = {
-  model: 'claude-opus-4-5-20251101',
+  model: 'claude-opus-5-5',
   doctorModel: 'claude-haiku-4-5-20251001',
 
   // Production defaults - override via env vars for local dev.

src/cli.config.ts

@@ -109,8 +109,8 @@ describe('AgentExecutor', () => {
     const [agentRunConfig] = mockRunAgent.mock.calls[0];
     expect(agentRunConfig.workingDirectory).toBe(testDir);
     expect(agentRunConfig.model).toBe('test-model');
-    expect(agentRunConfig.allowedTools).toContain('Skill');
-    expect(agentRunConfig.allowedTools).toContain('Write');
+    // Must match production so every tool call goes through installerCanUseTool
+    expect(agentRunConfig.allowedTools).toEqual([]);
     expect(agentRunConfig.mcpServers).toBeUndefined();
     // Direct mode — no gateway URL
     expect(agentRunConfig.sdkEnv.ANTHROPIC_API_KEY).toBe('sk-ant-test');

tests/evals/__tests__/agent-executor.spec.ts

@@ -138,7 +138,9 @@ export class AgentExecutor {
     const agentRunConfig: AgentRunConfig = {
       workingDirectory: this.workDir,
       model: process.env.EVAL_MODEL ?? getConfig().model,
-      allowedTools: ['Skill', 'Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep', 'WebFetch'],
+      // Empty like production: listed tools skip installerCanUseTool, which would let
+      // eval agents run commands (e.g. `workos`, `curl`) the shipped installer denies.
+      allowedTools: [],
       sdkEnv,
       claudeExecutablePath: await ensureClaudeCodeExecutable(),
     };

tests/evals/agent-executor.ts

@@ -113,8 +113,9 @@ export class NextjsGrader implements Grader {
     const sdkImportChecks = await this.fileGrader.checkFileContains(middlewareFile, ['@workos-inc/authkit-nextjs']);
     checks.push(...sdkImportChecks);
 
-    // Check for authkit integration: authkitMiddleware OR (authkit + handleAuthkitProxy, or its deprecated alias handleAuthkitHeaders)
-    const middlewareChecks = await this.fileGrader.checkFileContains(middlewareFile, ['authkitMiddleware']);
+    // Check for authkit integration: authkitProxy (or its deprecated alias authkitMiddleware)
+    // OR (authkit + handleAuthkitProxy, or its deprecated alias handleAuthkitHeaders)
+    const middlewareChecks = await this.fileGrader.checkFileContains(middlewareFile, [/authkit(Proxy|Middleware)\b/]);
     const composableChecks = await this.fileGrader.checkFileContains(middlewareFile, [
       'authkit(',
       /handleAuthkit(Proxy|Headers)\b/,
@@ -127,10 +128,10 @@ export class NextjsGrader implements Grader {
       name: 'AuthKit middleware integration',
       passed: usesAuthkitMiddleware || usesComposable,
       message: usesAuthkitMiddleware
-        ? 'Uses authkitMiddleware'
+        ? 'Uses authkitProxy/authkitMiddleware'
         : usesComposable
           ? 'Uses authkit() composable with handleAuthkitProxy'
-          : 'Missing authkitMiddleware or authkit() composable integration',
+          : 'Missing authkitProxy/authkitMiddleware or authkit() composable integration',
     };
     checks.push(authkitCheck);