| name | sync-credentials |
| description | Sync credential IDs from the live n8n instance. Two modes — list (default) reports IDs + TypeScript snippets, fix-workflows rewrites stale credential IDs in local `.workflow.ts` files by joining on credential name. Use after n8n migration, when setting up a new instance, or in response to a credential-freshness auto-reaction signal. |
| argument-hint | [--dry-run] [--fix-workflows] |
| user-invocable | true |
| allowed-tools | Bash(node:*), Bash(npx:*) |
Sync Credentials from n8n Instance
All work happens in scripts/ (colocated). The skill body is short on purpose — the scripts are the source of truth.
Modes
Default — list live credentials
node "$CLAUDE_PLUGIN_ROOT/skills/sync-credentials/scripts/list.js"
Prints a table of all credentials on the active n8n instance plus ready-to-paste TypeScript snippets. Read-only.
--fix-workflows — rewrite stale credential IDs
node "$CLAUDE_PLUGIN_ROOT/skills/sync-credentials/scripts/fix-workflows.js" [--dry-run] [--all-projects]
Walks workflows/**/*.workflow.ts, finds every credentials: { <type>: { id: '…', name: '…' } } block, joins by credential name against the live instance filtered to the workspace-pinned project, and rewrites the id value where the live ID differs from the local one. Order of id / name inside the block is tolerated; type mismatches and orphans are reported and NOT auto-rewritten.
Project scoping (default): credentials owned by projects other than the active workspace project are dropped from the candidate pool. This prevents cross-project ID injection that would push fine but fail at runtime ("credential not accessible"). Use --all-projects to disable the filter (rare).
Add --dry-run to preview without writing files.
This is what the SessionStart credential-freshness auto-reaction triggers:
AUTOPILOT_ACTION_REQUIRED: /n8n-autopilot:sync-credentials --fix-workflows
Companion scripts
scripts/list.js — fetches credentials via npx n8nac credential list --json, prints table + snippetsscripts/fix-workflows.js — the rewrite logic. Self-contained Node script, tolerant block-parsing regex, surgical id: replacement inside each matched block (never global), conflict + orphan reporting.
Prerequisites
- n8nac workspace bound. Check via
npx n8nac workspace status --json. If not bound, run npx n8nac setup --mode connect-existing first.
- At least one credential configured on the live instance (or create one via
npx n8nac credentials ensure <recipeId> from the shared recipe catalogue).
Error Handling
n8nac credential list fails → script exits 1 with a hint to check workspace status.- No
.workflow.ts files → script exits 2 with a hint.
- Type mismatch (workflow says
openAiApi, live credential with that name is openRouterApi) → reported as conflict, NOT rewritten.
- Duplicate name on instance (same credential name appears twice live) → reported as conflict, NOT rewritten — user must rename one on the instance.
- Orphan (workflow references a name that does not exist on live instance) → reported, NOT rewritten — user creates the credential or removes the reference.
When to auto-trigger this skill
The SessionStart hook scripts/check-credential-freshness.sh (plugin-wide, not in this skill folder — it is a generic plugin hook) emits the auto-reaction line above when it detects local workflow files referencing credential IDs that do not exist on the live instance. Run with --fix-workflows in that case — list alone does not resolve the underlying problem.
