Several `fetch()` callers in the CLI bypassed `OpenAPI.HEADERS` and skipped
the `HEADERS` env var, causing requests to fail behind auth gateways like
Cloudflare Access (same shape as #6421):
- `pushScript()` `/scripts/create` and `/scripts/create_snapshot` — regressed
in #8936 when the call switched from `wmill.createScript()` (SDK) to a raw
`fetch` for the `skip_if_noop` query param.
- Script preview `/jobs/run/preview_bundle`.
- App dev `/jobs_u/getupdate_sse` SSE stream.
- `wmill docs` `/api/inkeep`.
All four now spread `getHeaders()` and call `detectAuthGatewayChallenge()`
so a Cloudflare/SSO challenge surfaces a clear error instead of an opaque
JSON parse failure.
Adds `test/headers_env_var.test.ts`: spins up an auth-gateway proxy that
403s requests missing `CF-Access-Client-Id` / `CF-Access-Client-Secret` and
otherwise reverse-proxies to the test backend, then runs `wmill sync push`
of a fresh script through the proxy. Negative case (no `HEADERS` env)
verifies the proxy actually gates; positive case asserts every request
including `/scripts/create` reaches the backend with the headers attached.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(cli): address 28 DX friction points across CLI commands
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(cli): regenerate system prompts after help text updates
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): address PR review feedback
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): update removeType tests to match lenient behavior
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): address CE/EE sync friction and improve JSON output
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): revert instance config masking to avoid breaking push flow
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): mask instance secrets by default with interactive prompt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(cli): regenerate system prompts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): use stderr for errors, optimize skipped-files scan, rename --auto to --auto-metadata
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(cli): improve workspace fork lifecycle — delete-fork fallback, list-forks, --workspace override
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): update fork merge instructions to reference all merge methods
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(cli): clarify skipped-files warning comment re DynFSElement traversal
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>