feat: non-TTY mode for agent-friendly CLI

[nicknisi]

Summary

The WorkOS CLI currently assumes a human at a terminal — 26+ interactive prompts (via clack), browser-based OAuth, and chalk-formatted tables make it unusable by coding agents like Claude Code, Codex, or Cursor. Agents must either avoid the CLI entirely or rely on users to copy-paste credentials and command output, defeating the purpose of automation.

This PR adds comprehensive non-TTY support following the gh CLI model: automatic non-TTY detection, structured JSON output, standardized exit codes, and a headless installer adapter. Zero breaking changes for humans — all existing interactive behavior is preserved.

What changed

Core infrastructure

• Output mode system (src/utils/output.ts) — OutputMode resolved once at startup. Auto-detects non-TTY → JSON. Global --json flag for explicit control. Shared helpers: outputJson(), outputSuccess(), outputError(), outputTable(), exitWithError()
• Exit codes (src/utils/exit-codes.ts) — Standardized following gh convention: 0=success, 1=general error, 2=cancelled, 4=auth required
• Environment variables — WORKOS_NO_PROMPT=1 forces non-interactive mode (suppresses all prompts + switches to JSON). WORKOS_FORCE_TTY=1 forces interactive mode even when piped

Management commands (env, organization, user)

• All commands produce structured JSON when piped or with --json flag
• Non-interactive guards for env add (requires name + apiKey args) and env switch (requires name arg)
• List commands return { "data": [...] } with proper empty states
• Structured JSON errors to stderr with error codes
• API keys redacted in env list JSON output (only hasApiKey boolean exposed)
• Added org alias for organization command

Agent-discoverable help

• --help --json outputs machine-readable command tree (commands, options, positionals, types, defaults)
• Subcommand scoping: workos env --help --json returns only the env subtree
• Improved all command descriptions for agent readability

Headless installer

• HeadlessAdapter (src/lib/adapters/headless-adapter.ts) — third adapter alongside CLI and Dashboard. Subscribes to same state machine events, auto-resolves all interactive decisions with sensible defaults
• NDJSON streaming (src/utils/ndjson.ts) — progress events streamed as newline-delimited JSON to stdout (detection, auth, git status, agent progress, validation, completion)
• Flag overrides: --no-branch, --no-commit, --create-pr, --no-git-check
• --api-key and --client-id now visible flags (were hidden)
• Removed non-TTY error block in install command — routes to headless adapter instead

Auth improvements

• Non-TTY auth guard: ensureAuthenticated() exits code 4 instead of opening browser when no TTY
• WORKOS_API_KEY env var respected for management commands (bypasses OAuth)
• resolveApiKey() uses structured error output instead of throwing raw errors
• Stale credential clearing: clearCredentials() called on all refresh failure paths (invalid_grant, network errors, no refresh token). Prevents the loop where expired tokens cause repeated browser opens

Flag naming fix

• Renamed --no-validate option to validate (default: true) so yargs --no-validate negation works correctly with strict mode. Same for --no-branch → branch, --no-commit → commit, --no-git-check → git-check. The --no-* flags still work as before from user perspective.

Environment variables

Variable	Effect
WORKOS_NO_PROMPT=1	Force non-interactive mode + JSON output
WORKOS_FORCE_TTY=1	Force interactive mode even when piped
WORKOS_API_KEY	API key for management commands (bypasses OAuth)

Exit codes

Code	Meaning
0	Success
1	General error
2	Cancelled
4	Authentication required