#86)

* feat: add uninstall-skill command to remove installed skills from coding agents

Mirrors install-skill with --list, --skill, and --agent flags.
Detects installed skills by scanning agent directories for known
WorkOS skill names, ensuring user-created skills are never removed.

* fix: add process.exit(0) to install-skill and uninstall-skill commands

The auth system keeps the event loop alive after command completion.
Other commands (install, doctor) already call process.exit(0) explicitly.

* fix: add JSON mode, logging, and error handling to uninstall-skill command

- Add structured JSON output for --list, results, and errors (isJsonMode/outputJson/exitWithError)
- Add project logging (logError/logInfo/logWarn) for Sentry and session logs
- Wrap discoverSkills in try-catch with actionable error message
- Warn on unrecognized --skill names instead of silently ignoring
- Replace redundant existsSync pre-check with findInstalledSkills
- Remove process.exit(0) from install-skill and uninstall-skill handlers in bin.ts
- Add orchestrator tests for --skill filter and JSON mode tests
- Consolidate duplicate fs import and add globalSkillsDir nonexistent test

* feat!: refactor skills commands into `workos skills` subcommand group

BREAKING CHANGE: `workos install-skill` and `workos uninstall-skill` are
replaced by `workos skills install`, `workos skills uninstall`, and
`workos skills list`.

- Restructure as `skills` subcommand group using registerSubcommand
- Extract `--list` flags into dedicated `workos skills list` command
  that shows both available and installed skills per agent
- Remove withAuth from skills commands (no API calls needed)
- Add list-skills.ts with JSON mode support
- Add list-skills.spec.ts with human and JSON output tests
- Update help-json.ts command registry to nested structure

* chore: formatting

- Replace top-level login/logout with auth subcommand group
- Replace install-skill with skills subcommand group
- Update framework count from 5 to 15 with all integration names
- Fix example to use `workos install --integration` (not global flag)

* feat: consume skills from @workos/skills package instead of local files

Replace the CLI's bundled skill files with the @workos/skills npm
package as the single source of truth. Reference content is now
injected directly into the agent prompt, eliminating the Skill tool
round-trip for faster execution.

- Add @workos/skills as dependency
- Update buildIntegrationPrompt to read reference markdown from the
  package and inject into prompt (replaces "use the X skill" pattern)
- Remove Skill from allowedTools — no longer needed
- Update plugin loading to point to @workos/skills package
- Update getSkillsDir() to delegate to the package
- Delete skills/ directory (17 skill files)
- Delete .claude-plugin/ directory (plugin identity from package)
- Remove skills and .claude-plugin from package.json files array

* docs: add Do/Don't and PR checklist to CLAUDE.md

* refactor: use async getReference helper from @workos/skills

* chore: use published @workos/[email protected] instead of local link

* fix: remove unused getPackageRoot import

* chore: formatting

* fix: correct return type for async buildIntegrationPrompt

* fix: inject reference content in non-JS integrations instead of Skill tool

Update dotnet, elixir, go, python, and ruby custom run() functions
to read and inject reference content from @workos/skills, matching
the pattern used by buildIntegrationPrompt. This fixes the Skill
tool being unavailable since it was removed from allowedTools.

* test: add guard against Skill tool references in integrations

Scans all integration index.ts files to ensure none tell the agent
to invoke a skill. Also verifies allowedTools excludes Skill.
Prevents regression if new integrations copy old patterns.

* fix: build env var list dynamically and remove credentials from prompts

- buildIntegrationPrompt now builds the env var list based on
  config.environment.requiresApiKey instead of always listing
  WORKOS_API_KEY (fixes misleading prompt for React SPA)
- Remove raw API key and client ID values from dotnet and ruby
  prompts to prevent credential leakage into log files

* chore: formatting

* fix: address Copilot review feedback

- Update stale comment in dotnet (credentials no longer in prompt)
- Fix ruby prompt to not claim env vars are pre-configured
- Strengthen guard test regex to match escaped backticks

* fix: include authkit-base reference alongside framework-specific reference

The switch from skill invocation to direct injection dropped the base
template that provides task ordering, decision trees, verification
checklists, and error recovery patterns. Load both workos-authkit-base
and the framework-specific reference to restore the full context.

* fix: use @workos/[email protected]

* chore: formatting

The base template references node_modules, JS lockfiles, and
AuthKitProvider — misleading for PHP, PHP-Laravel, and Kotlin
which also use runAgentInstaller. Skip the base for non-JS
integrations and omit the General Guidelines section entirely.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>