v0.18.1-internal.1

First internal team release. Internal Windows and WSL2/Linux evaluation release, based on published v0.18.1.

This build adds internal-release readiness fixes on top of v0.18.1:

• Release packaging now derives the release-notes filename from the workspace version (root Cargo.toml) instead of a hardcoded path, so the packaged notes always match the shipped binary.
• The server upgrade command family now reports failures with non-zero exit codes; ayx server upgrade apply is clearly marked simulation-only in its output.
• Preview scaffolds under ayx tools workspace * are labeled as preview.
• Secret redaction in error output is hardened.
• The temporary MongoDB password file used by ayx server MongoDB subcommands now gets Windows ACL hardening.
• The global --no-input flag is now enforced for all confirmation prompts.
• ayx onboard --output json now emits clean JSON on stdout.
• ayx one workspace admins now answers correctly: it calls the dedicated GET /v4/workspaces/{workspaceId}/admins endpoint instead of the people list (which silently ignores the admin filter). Live-verified.
• ayx telemetry jobs running|history|top no longer fail with a parse error against the live job library (numeric ids are now tolerated). Live-verified.
• Envelope redaction no longer wipes credential metadata keys (access_token_present, token_endpoint_url, doctor claims summaries), so ayx one doctor auth diagnostics are readable again — while secret values themselves are redacted more aggressively than before.

Demo-relevant surface

ayx one workflows, ayx one connections, ayx one scheduling, ayx one job-groups, ayx one workspace, and ayx telemetry jobs have been live-validated against a real Alteryx One workspace: the env-gated live smoke suite passes 75/75 with zero skips on the reference tenant.

First-time setup

1. Extract the platform artifact, put the included ayx/ayx.exe on your PATH, and run ayx onboard.

2. Paste the Alteryx One workspace URL when prompted.

3. Choose Log in now.

4. Enter the emailed one-time passcode and workspace password. After a successful interactive login, accept the default Save this workspace password securely for future logins? [Y/n] prompt if this profile should reuse the password on future logins.

5. Verify the connection:

   ayx one auth status
   ayx one workspace current

Credentials use the operating-system secure store by default. Plaintext profile storage is an explicit, affirmative fallback and should not be used for ordinary internal workspaces.

Recovery

Do not automatically retry a login when the CLI says an OTP send or PAT mint may have committed. Preserve the profile and inspect the redacted error. If a fresh login is required, use the independently characterized Legacy flow:

ayx one login --auth-flow legacy

Do not send OTPs, passwords, tokens, profile files, or keyring exports with a support report. Include the version, operating system, command, rollout selection, and redacted error text instead.

Platform scope

This internal release is a target-platform evaluation build for native Windows and WSL2/Linux. Apple/macOS validation and distribution are deferred.