feat: consume skills from @workos/skills package (#88)

* feat: consume skills from @workos/skills package instead of local files

Replace the CLI's bundled skill files with the @workos/skills npm
package as the single source of truth. Reference content is now
injected directly into the agent prompt, eliminating the Skill tool
round-trip for faster execution.

- Add @workos/skills as dependency
- Update buildIntegrationPrompt to read reference markdown from the
  package and inject into prompt (replaces "use the X skill" pattern)
- Remove Skill from allowedTools — no longer needed
- Update plugin loading to point to @workos/skills package
- Update getSkillsDir() to delegate to the package
- Delete skills/ directory (17 skill files)
- Delete .claude-plugin/ directory (plugin identity from package)
- Remove skills and .claude-plugin from package.json files array

* docs: add Do/Don't and PR checklist to CLAUDE.md

* refactor: use async getReference helper from @workos/skills

* chore: use published @workos/skills@0.2.1 instead of local link

* fix: remove unused getPackageRoot import

* chore: formatting

* fix: correct return type for async buildIntegrationPrompt

* fix: inject reference content in non-JS integrations instead of Skill tool

Update dotnet, elixir, go, python, and ruby custom run() functions
to read and inject reference content from @workos/skills, matching
the pattern used by buildIntegrationPrompt. This fixes the Skill
tool being unavailable since it was removed from allowedTools.

* test: add guard against Skill tool references in integrations

Scans all integration index.ts files to ensure none tell the agent
to invoke a skill. Also verifies allowedTools excludes Skill.
Prevents regression if new integrations copy old patterns.

* fix: build env var list dynamically and remove credentials from prompts

- buildIntegrationPrompt now builds the env var list based on
  config.environment.requiresApiKey instead of always listing
  WORKOS_API_KEY (fixes misleading prompt for React SPA)
- Remove raw API key and client ID values from dotnet and ruby
  prompts to prevent credential leakage into log files

* chore: formatting

* fix: address Copilot review feedback

- Update stale comment in dotnet (credentials no longer in prompt)
- Fix ruby prompt to not claim env vars are pre-configured
- Strengthen guard test regex to match escaped backticks

* fix: include authkit-base reference alongside framework-specific reference

The switch from skill invocation to direct injection dropped the base
template that provides task ordering, decision trees, verification
checklists, and error recovery patterns. Load both workos-authkit-base
and the framework-specific reference to restore the full context.

* fix: use @workos/skills@0.2.2

* chore: formatting

Author: nicknisi

.claude-plugin/plugin.json

@@ -47,3 +47,28 @@ pnpm typecheck    # Type check
 1. Create `src/commands/{resource}.ts` + `{resource}.spec.ts` (follow patterns in `organization.ts`)
 2. Register in `src/bin.ts` and update `src/utils/help-json.ts` command registry
 3. Include JSON mode tests in spec file
+
+## Do / Don't
+
+**Do:**
+
+- Follow the adapter pattern (`CLI`, `Dashboard`, `Headless`) in `src/integrations/` when adding framework installers
+- Use `InstallerEventEmitter` for state machine events -- see existing adapters for examples
+- Add both human and JSON output modes -- check `OutputMode` usage in `src/bin.ts`
+- Follow existing command patterns in `src/commands/organization.ts` when adding resource commands
+- Write `.spec.ts` tests alongside every command file
+
+**Don't:**
+
+- Use Node-specific sync APIs (crypto, fs sync) unless necessary
+- Use npm or yarn -- pnpm only
+- Skip JSON mode tests in spec files
+- Forget to wire up new frameworks in `src/run.ts` switch statement
+
+## PR Checklist
+
+- [ ] `pnpm build` passes
+- [ ] `pnpm test` passes
+- [ ] `pnpm typecheck` passes
+- [ ] Conventional Commit message format used (`feat:`, `fix:`, `feat!:` for breaking)
+- [ ] New commands include JSON mode support and tests

CLAUDE.md

@@ -26,8 +26,6 @@
   },
   "files": [
     "dist",
-    ".claude-plugin",
-    "skills",
     "package.json",
     "README.md"
   ],
@@ -43,6 +41,7 @@
     "@clack/prompts": "1.0.1",
     "@napi-rs/keyring": "^1.2.0",
     "@workos-inc/node": "^8.7.0",
+    "@workos/skills": "0.2.2",
     "chalk": "^5.6.2",
     "diff": "^8.0.3",
     "fast-glob": "^3.3.3",