fix: unbreak non-JS integration install flow (Django, .NET, Kotlin + others) (#125)

* fix: support Django projects end-to-end in workos install

Previously `workos install` crashed with "Could not find package.json"
in any project without a package.json: JS integration detection calls
getPackageDotJson() which exits the process on missing file, killing
the installer before non-JS integrations (Python/Django) got a turn.

- Skip JS integration detection when package.json is missing
- Widen Python detection: match manage.py or requirements.txt with
  django, not just pyproject.toml (via a new optional detect() override
  on FrameworkMetadata, wired to the existing isDjangoProject helper)
- Write credentials to .env (not .env.local) and skip cookie password
  generation for non-JS projects in unclaimed env provisioning
- Gate state-machine configureEnvironment actor on JS-only to prevent
  a second .env.local leak post-detection
- Add Django port/callback defaults (8000, /auth/callback/) so
  detectPort returns the right values for Python

Tests: +8 net covering detection matrix (no-package.json skip,
pyproject.toml, manage.py alone, requirements.txt+django, non-Django
python), python port defaults, and .env vs .env.local selection in
unclaimed provisioning.

* fix: broaden non-JS integration detection, add port defaults for all languages

Beyond the Django fixes in the previous commit, several other non-JS
integrations had parallel problems that would bite the next user with a
.NET, Kotlin, or non-trivial project layout.

- .NET detection was completely broken: manifestFile '*.csproj' went
  through existsSync() which does literal-filename matching, so it never
  matched. Now uses globExists() from language-detection.ts (which has
  the right logic but wasn't wired up anywhere).
- Kotlin detection only matched build.gradle.kts (Kotlin DSL). Now also
  matches build.gradle (Groovy DSL) and pom.xml (Maven) via the existing
  detectKotlin() helper, which already had Gradle Groovy support.
  Extended it to cover Maven too.
- Port defaults added for ruby (3000), php (8000), php-laravel (8000),
  go (8080), dotnet (5000), elixir (4000), kotlin (8080). Previously all
  fell back to DEFAULT_PORT=3000, which is wrong for every one of them.
- ensureGitignore() now also writes .env to .gitignore for non-JS
  projects (previously only handled .env.local for JS).

Exported globExists() and detectKotlin() from language-detection.ts so
the integrations can share them. detectLanguage() itself still isn't
called anywhere in the install path — that's a larger cleanup for later.

* feat: parse dev-server port from config for .NET, Phoenix, Spring Boot, Rails

Follow-up to the hardcoded ecosystem defaults. These four languages have a
canonical config file where the dev server port lives; parse it so we don't
misconfigure redirect URIs when the user has customized the port.

- .NET: Properties/launchSettings.json → profiles[*].applicationUrl
- Phoenix: config/dev.exs or config/runtime.exs → port: NNNN
- Spring Boot: src/main/resources/application.{properties,yml} → server.port
- Rails: config/puma.rb → port ENV.fetch("PORT") { N } or literal port N

Falls back to the ecosystem default when the file is missing or malformed.

Python (Django), Go, plain PHP, and Laravel are unchanged — none has a
canonical config file; ports are CLI args or hardcoded in source.

* refactor: delete dead language-detection.ts, inline helpers into callers

detectLanguage() and its LANGUAGE_DETECTORS table were never called from
the install path. globExists() and detectKotlin() were the only pieces
still used after wiring up the dotnet/kotlin detect() overrides — both
are caller-specific enough to inline:

- dotnet/index.ts gets hasCsproj() (6 lines, readdirSync + endsWith)
- kotlin/index.ts gets isKotlinProject() (handles kts, gradle, pom.xml)
- The Language type moves into framework-config.ts where it is consumed

Net: one fewer module, no lost functionality.

Author: nicknisi

src/cli.config.ts

@@ -57,6 +57,38 @@ export const config = {
       port: 5173,
       callbackPath: '/callback',
     },
+    python: {
+      port: 8000,
+      callbackPath: '/auth/callback/',
+    },
+    ruby: {
+      port: 3000,
+      callbackPath: '/auth/callback',
+    },
+    php: {
+      port: 8000,
+      callbackPath: '/auth/callback',
+    },
+    phpLaravel: {
+      port: 8000,
+      callbackPath: '/auth/callback',
+    },
+    go: {
+      port: 8080,
+      callbackPath: '/auth/callback',
+    },
+    dotnet: {
+      port: 5000,
+      callbackPath: '/auth/callback',
+    },
+    elixir: {
+      port: 4000,
+      callbackPath: '/auth/callback',
+    },
+    kotlin: {
+      port: 8080,
+      callbackPath: '/auth/callback',
+    },
   },
 
   legacy: {

src/integrations/dotnet/index.ts

@@ -1,7 +1,16 @@
 /* .NET (ASP.NET Core) integration — auto-discovered by registry */
+import { readdirSync } from 'node:fs';
 import type { FrameworkConfig } from '../../lib/framework-config.js';
 import type { InstallerOptions } from '../../utils/types.js';
 import { enableDebugLogs } from '../../utils/debug.js';
+
+function hasCsproj(installDir: string): boolean {
+  try {
+    return readdirSync(installDir).some((f) => f.endsWith('.csproj'));
+  } catch {
+    return false;
+  }
+}
 import { SPINNER_MESSAGE } from '../../lib/framework-config.js';
 import { getOrAskForWorkOSCredentials } from '../../utils/clack-utils.js';
 import { analytics } from '../../utils/analytics.js';
@@ -22,6 +31,8 @@ export const config: FrameworkConfig = {
     priority: 35,
     packageManager: 'dotnet',
     manifestFile: '*.csproj',
+    // existsSync cannot glob, so match any *.csproj in the install dir.
+    detect: (options) => hasCsproj(options.installDir),
   },
 
   detection: {

src/integrations/kotlin/index.ts

@@ -1,8 +1,31 @@
 /* Kotlin (Spring Boot) integration — auto-discovered by registry */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import type { FrameworkConfig } from '../../lib/framework-config.js';
 import type { InstallerOptions } from '../../utils/types.js';
 import { enableDebugLogs } from '../../utils/debug.js';
 
+function hasKotlinContent(path: string, pattern: RegExp): boolean {
+  try {
+    return pattern.test(readFileSync(path, 'utf-8'));
+  } catch {
+    return false;
+  }
+}
+
+function isKotlinProject(installDir: string): boolean {
+  const kts = join(installDir, 'build.gradle.kts');
+  if (existsSync(kts) && hasKotlinContent(kts, /org\.jetbrains\.kotlin|kotlin\(/)) return true;
+
+  const gradle = join(installDir, 'build.gradle');
+  if (existsSync(gradle) && hasKotlinContent(gradle, /kotlin/)) return true;
+
+  const pom = join(installDir, 'pom.xml');
+  if (existsSync(pom) && hasKotlinContent(pom, /kotlin/i)) return true;
+
+  return false;
+}
+
 export const config: FrameworkConfig = {
   metadata: {
     name: 'Kotlin (Spring Boot)',
@@ -14,6 +37,8 @@ export const config: FrameworkConfig = {
     priority: 40,
     packageManager: 'gradle',
     manifestFile: 'build.gradle.kts',
+    // Also match Groovy DSL (build.gradle) and Maven (pom.xml) Kotlin projects.
+    detect: (options) => isKotlinProject(options.installDir),
   },
 
   detection: {

src/integrations/python/index.ts

@@ -99,6 +99,7 @@ export const config: FrameworkConfig = {
     priority: 60,
     packageManager: 'pip',
     manifestFile: 'pyproject.toml',
+    detect: (options: Pick<InstallerOptions, 'installDir'>) => isDjangoProject(options.installDir),
     gatherContext: async (options: InstallerOptions) => {
       const pkgMgr = detectPythonPackageManager(options.installDir);
       return {

src/lib/env-writer.ts

@@ -3,29 +3,31 @@ import { join } from 'path';
 import { parseEnvFile } from '../utils/env-parser.js';
 
 const ENV_LOCAL_COVERING_PATTERNS = ['.env.local', '.env*.local', '.env*'];
+const ENV_COVERING_PATTERNS = ['.env', '.env*'];
 
 /**
- * Ensure .env.local is in .gitignore.
+ * Ensure the given env filename is in .gitignore.
  * Creates .gitignore if it doesn't exist.
  * No-ops if a covering pattern is already present.
  */
-function ensureGitignore(installDir: string): void {
+function ensureGitignore(installDir: string, filename: '.env' | '.env.local'): void {
   const gitignorePath = join(installDir, '.gitignore');
+  const coveringPatterns = filename === '.env' ? ENV_COVERING_PATTERNS : ENV_LOCAL_COVERING_PATTERNS;
 
   if (!existsSync(gitignorePath)) {
-    writeFileSync(gitignorePath, '.env.local\n');
+    writeFileSync(gitignorePath, `${filename}\n`);
     return;
   }
 
   const content = readFileSync(gitignorePath, 'utf-8');
   const lines = content.split('\n').map((line) => line.trim());
 
-  if (lines.some((line) => ENV_LOCAL_COVERING_PATTERNS.includes(line))) {
+  if (lines.some((line) => coveringPatterns.includes(line))) {
     return;
   }
 
   const separator = content.endsWith('\n') ? '' : '\n';
-  writeFileSync(gitignorePath, `${content}${separator}.env.local\n`);
+  writeFileSync(gitignorePath, `${content}${separator}${filename}\n`);
 }
 
 interface EnvVars {
@@ -76,7 +78,40 @@ export function writeEnvLocal(installDir: string, envVars: Partial<EnvVars>): vo
     .map(([key, value]) => `${key}=${value}`)
     .join('\n');
 
-  ensureGitignore(installDir);
+  ensureGitignore(installDir, '.env.local');
+
+  writeFileSync(envPath, content + '\n');
+}
+
+/**
+ * Write WorkOS credentials to the appropriate env file for the project.
+ * Picks `.env.local` for JS projects (package.json present) or `.env` for
+ * everything else (Python/Django, Ruby/Rails, Go, ...). Skips cookie password
+ * generation outside the JS branch — non-JS SDKs don't use it.
+ *
+ * Used by pre-detection flows that write credentials before the framework
+ * integration is known (unclaimed env provisioning).
+ */
+export function writeCredentialsEnv(installDir: string, envVars: Partial<EnvVars>): void {
+  const hasPackageJson = existsSync(join(installDir, 'package.json'));
+  if (hasPackageJson) {
+    writeEnvLocal(installDir, envVars);
+    return;
+  }
+
+  const envPath = join(installDir, '.env');
+  let existingEnv: Record<string, string> = {};
+  if (existsSync(envPath)) {
+    const content = readFileSync(envPath, 'utf-8');
+    existingEnv = parseEnvFile(content);
+  }
+
+  const merged = { ...existingEnv, ...envVars };
+  const content = Object.entries(merged)
+    .map(([key, value]) => `${key}=${value}`)
+    .join('\n');
+
+  ensureGitignore(installDir, '.env');
 
   writeFileSync(envPath, content + '\n');
 }

src/lib/framework-config.ts

@@ -1,5 +1,9 @@
 import type { InstallerOptions } from '../utils/types.js';
-import type { Language } from './language-detection.js';
+
+/**
+ * Supported programming languages for framework integrations.
+ */
+export type Language = 'javascript' | 'python' | 'ruby' | 'php' | 'go' | 'kotlin' | 'dotnet' | 'elixir';
 
 /**
  * Configuration interface for framework-specific agent integrations.
@@ -60,6 +64,14 @@ export interface FrameworkMetadata {
 
   /** Primary manifest file (e.g., 'pyproject.toml', 'Gemfile'). Optional for JS integrations. */
   manifestFile?: string;
+
+  /**
+   * Optional custom detection override for non-JS integrations. When present,
+   * the registry calls this instead of falling back to `manifestFile` existence.
+   * Use when a single manifest file isn't enough (e.g., Django projects may
+   * use `manage.py` + `requirements.txt` without a `pyproject.toml`).
+   */
+  detect?: (options: Pick<InstallerOptions, 'installDir'>) => boolean | Promise<boolean>;
 }
 
 /**