Ported from origin/main 97b9d9a into the carved layout. Two hunks: the
never-pass-credentials-in-code IMPORTANT blockquote after the automatic/manual
choose block in index.md, and the anti-hardcoding Common-Mistakes row in
integrate.md.
Ported from origin/main d1b1985 into the carved layout. The claims example used
IDTokenClaimsValidation().validate() — an internal validation helper, not a
public claims API. Replace with credentialsManager.user (UserInfo?) plus a
JWTDecode manual-decode example. Lands in the swift api-reference.md leaf.
Ported from origin/main a3e0db8 into the carved layout. Three hunks: the
quick-start IMPORTANT note in index.md, the anti-hardcoding Common-Mistakes row
in integrate.md, and the api-reference.md replacement of the literal-credential
getInstance("CLIENT_ID","DOMAIN") variant with strings.xml-only guidance.
Ported from origin/main 7e9ce86 into the carved layout. Both logout samples
(quick-start in index.md, detailed in integrate.md) had onSuccess(result: Void)
under a Callback<Void?, ...> type parameter — the nullability mismatch fails
Kotlin compilation.
Ported from origin/main b472904 into the carved layout. Two hunks: the
runtimeConfig comment lands in the hub index.md's nuxt.config.ts block; the
anti-hardcoding Common-Mistakes row lands in integrate.md (where the mistakes
table now lives after the split).
Ported from origin/main e295fd6 into the carved layout. The stray ')' after the
packageId assignment survived on this branch (predates the fix); it lives in the
hub index.md logout snippet, not a leaf.
Ported from origin/main 3002420 into the carved reference layout. express-jwt is
a pure-rename group (single index.md == the old flat file), so main's post-fix
content applies wholesale.
The merged rosters now carry the same members as main; reorder them to
main's sequence so the diff is limited to the loop consolidation, not a
spurious reordering.
Same redundancy as the framework loops: the index-only and grouped
feature loops both asserted only that feature-<name>/index.md exists.
Collapse to one EXPECTED_FEATURES roster (organizations stays separate
for its line-count check).
The index-only and grouped framework loops asserted the identical
condition (framework-<name>/index.md exists); neither verified a leaf,
so the split distinguished nothing the script checks. Collapse to one
EXPECTED_FRAMEWORKS roster. Real hub/leaf structure is enforced by
check_router_reachability.py.
The callout restated what each Step 4 intent block already emits
(explicit references/{name}/index.md paths) and what each index.md's
own '## Choose your task' section conveys on arrival. Migration-era
scaffolding; trimming it lightens the always-loaded router.
The go hub carried standalone ## Install SDK and ## Configure .env
sections predating this feature; the relocated ## Quick start repeats both
verbatim (Steps 1 and 3). Drop the duplicates so go matches the swift
template shape (Critical rules → Prerequisites → When NOT to Use →
Quick start → Choose your task). Final-review Minor finding.
Relocate orientation front-matter up from guide.md into the hub index.md
for feature-branding, feature-custom-domains, and feature-acul, matching
the pre-v2 SKILL.md standalone shape. The detailed capability/phase
playbooks stay in guide.md; dispatch rows unchanged.
- branding: moved Capabilities, Prompt style, Plan mode, Verify-in-browser,
Key Concepts, Prerequisites, capability dispatch entries, Common
Mistakes, References (boundary: first # Capability H1). Rewrote stale
SKILL.md cross-refs to hub-index prose.
- custom-domains: moved Overview, Interaction style, Error-code triage,
Capabilities, Key Concepts, Prerequisites, Common Mistakes (boundary:
## Advanced, keeping MCD/certs/DNS-playbook depth in guide.md).
- acul: moved Reference Hierarchy, auth0-acul-samples Architecture,
Prerequisites (boundary: ## Phase 0); removed a pre-existing duplicate
Prerequisites block; rewrote same-file refs that became cross-file.
Relocate each framework leaf group's Quick Start Workflow up from
integrate.md into the hub index.md as `## Quick start`, so the hub is
immediately actionable without a second read. Depth (setup variants,
Common Mistakes, pattern catalog) stays in integrate.md. Dispatch tables
unchanged; same-file cross-refs rewritten to prose role references to
preserve the leaf-sink rule.
Groups: react, android, go, php, php-api, expo, ionic-angular,
ionic-vue, java-mvc, aspnetcore-auth (Blazor/Razor variants retained in
integrate.md), nuxt (Quick Setup + Built-in Routes + Composables moved;
Protecting Routes depth retained).
Reduce leaf sprawl: fold setup.md, patterns.md, and the tiny mfa.md into
integrate.md (Setup / Integration Patterns / MFA sections), keeping only the
API/config lookup (api-reference.md) and the eval-required migration.md as
separate leaves. Lossless — every section, code block, and table preserved;
in-file cross-references rewritten from 'this group's X leaf' to 'the X
section below'. Hub dispatch updated: feature:mfa now routes to integrate.md.
Target shape for all leaf groups: index.md + 2 content leaves (+migration
where the SDK has a major-version upgrade). Proof case for the rest.
The hub's only machine-followable pointer to patterns.md labelled it
'advanced route-protection / session-store patterns', which reads as
optional — so an agent doing a quickstart with a protected page didn't load
patterns.md and missed the page-level definePageMeta middleware it needed.
Relabel the pointer to name definePageMeta/page protection explicitly and
note integrate.md covers only baseline global/server middleware. Keeps the
pre-v2 design (definePageMeta stays out of the primary integrate path,
reachable via the hub) while closing the discoverability gap.
The framework-nuxt leaf-group carve moved route-protection, session-store,
and advanced-example content into patterns.md, but integrate.md still said
'see the ... section below' — the content is no longer below. Restore the
pre-v2 'secondary, reachable via pointer' design (definePageMeta was always
in a separate route-protection leaf, never the primary path) by pointing at
'this group's patterns guide' instead, matching the other leaf groups'
convention. The hub index.md already routes advanced seekers to patterns.md.
Also drop the stale 'Common Examples' label (no such section post-carve).
The proof-case swift group was carved before the document-section leaf axis
was standardized. Two structural issues fixed:
- index.md folded the whole Setup Guide into the hub -> extracted to setup.md;
index.md is now a lean 47-line hub (rules + prereqs + when-not + dispatch)
matching react/android.
- integrate.md was three concatenated docs (Integration + API Reference &
Testing + Integration Patterns) plus a stray migration-flavored Common
Mistakes tail -> split into integrate.md / api-reference.md / patterns.md;
the migration tail moved into migration.md.
Lossless: 82 code fences in = 82 out; all API tables and pattern sections
preserved. Hub dispatch adds setup/api-reference/patterns 'Then, as needed'
rows. Reachability + routing-evals + 50 unit tests + validate-skill.sh pass.
The #144 merge modified flat reference files this branch had already split
into hub+leaf groups (modify/delete conflicts). The delete side was committed
in the merge (3b6ddaf) but the manual ports into the leaf files were left
uncommitted. Commit them: your-*.com placeholders -> RFC-2606 example.com forms
in go/patterns, react/patterns, php-api/integrate, aspnetcore-auth/patterns,
expo/patterns, java-mvc/api-reference.
Warn that user export files contain password hashes/PII (don't commit,
keep out of CI logs, delete after import) and that --json user command
output/import payloads expose profiles and password hashes.
* docs(auth0): harden API test-token examples against inline-token leaks
Mirror the framework-go.md token-isolation pattern across the API framework
references: capture test tokens into a shell variable and reference $TOKEN in curl instead of pasting raw values inline,
which leak into shell history and terminal scrollback. Also narrow the fastify
/api/profile response to return only the fields the client needs instead of the
whole decoded token (which exposes all claims, custom namespaces, and metadata).
Files: framework-fastify-api.md, framework-aspnetcore-api.md,
framework-fastapi-api.md, framework-springboot-api.md, framework-express-jwt.md
Replace lowercase-hyphen secret placeholder values with the
<YOUR_...> angle-bracket convention used elsewhere in the skill so
naive secret scanners don't flag them as exposed literals.
- framework-java-mvc.md: AUTH0_CLIENT_SECRET placeholders -> <YOUR_CLIENT_SECRET>
- tooling-terraform.md: auth0_client_secret -> <YOUR_M2M_CLIENT_SECRET>
Env-read and variable-reference lines untouched.
* fix(auth0): harden against security-scan false positives
The v2.0 re-architecture (#137) triggered a critical finding on the
Agent Trust Hub / Socket / Snyk scans. This addresses the actionable,
scan-scoped surface without removing legitimate behavior.
Placeholder URLs
- Replace registrable placeholder hostnames (your-api.com,
your-production-domain.com, your-app.com, your-spa-domain.com,
your-web-app.com, your-domain.com) with RFC-2606 example.com forms
across references/*.md. Kills the "malicious URL" finding
(your-production-domain.com) and pre-empts future URL-reputation hits.
Matches the skill's already-dominant `api.example.com` convention.
.auth0.com domain placeholders and client-id/secret tokens are left
as-is: not registrable / not URLs, so not a scanner surface.
Move the behavioral eval harness out of the skill dir
- Socket flagged tests/behavioral/graders.mjs (reads .env, pipes source
into the local `claude` CLI via execa). That's a dev-only test grader,
but it sits inside per-skill scan scope. Move tests/ -> repo-root
evals/ so the executable harness is no longer bundled with the skill
consumers install. Fix run-evals.mjs path resolution, the routing
checker's routing-cases.json lookup, the README, and the AGENTS.md
layout doc.
skillsaw: exempt template-routed reference families
- framework-*.md / tooling-*.md are routed only via the
`references/framework-{framework}.md` / `tooling-{tooling}.md`
placeholder templates, which skillsaw's literal-scan
agentskill-unreferenced-files rule can't resolve. Co-located tests
were previously (accidentally) satisfying that reachability; moving
them out exposed it. Their reachability is properly enforced by
scripts/check_router_reachability.py, so exempt the two template-routed
families in .skillsaw.yaml. feature-*/pattern-* orphan detection stays.
Verified: skillsaw --strict (0/0, grade A), check_router_reachability,
check_routing_evals, and run-evals --dry-run (17 case files) all pass.
* fix(auth0): keep load_cases skill-dir-relative for unit tests
The previous commit hardcoded routing-cases.json to repo-root evals/,
which broke scripts/test_check_routing_evals.py — the unit tests build a
self-contained temp skill with its own tests/routing-cases.json and rely
on load_cases(skill_dir) reading from that dir.
Prefer a skill-local tests/routing-cases.json when present (unit tests),
fall back to repo-root evals/routing-cases.json otherwise (production,
after the harness move). Both the pytest suite (10/10) and the real
check pass.
* chore(auth0): bump plugin + skill version to 2.0.1
Patch bump for the security-scan hardening: placeholder-URL cleanup,
eval harness move out of the skill dir, and the skillsaw template-route
exemption. No new routes or breaking changes. Updates all six plugin/
marketplace manifests and SKILL.md frontmatter in lockstep.
Frederik Prijck