[nicknisi]

What

A pass over the skills for current frontier models (Opus 4.5 / 5.5), in two commits.

1. fix: correct stale SDK APIs in skill references (f0c6715)

Every claim below was checked against the published SDKs (node 11.0.0, authkit-nextjs 4.4.0, widgets 1.20.0, Ruby gem 10.4.0, workos-go v6.5.0, com.workos:workos 7.4.0, @workos/openapi-spec 0.123.0).

File	Was	Now
authkit-nextjs	"Always return via handleAuthkitHeaders()"	handleAuthkitProxy (handleAuthkitHeaders is a deprecated alias)
radar	"no workos.radar.* namespace"	Node v11 has createAttempt / updateAttempt / addListEntry / removeListEntry
directory-sync, management	workos.webhooks.verifyEvent (doesn't exist)	constructEvent
go, widgets/go	workos-go/v4	workos-go/v6
ruby, sso, widgets/ruby	module-level calls, config.key	gem 7+ WorkOS.client.*, config.api_key, widgets.create_token; note for gems below 7
kotlin, widgets/java	com.workos:workos-kotlin:4.18.1 (not on Maven Central), builder API	com.workos:workos 7.x, AuthKitAuthorizationUrlOptions, widgets.createToken
migrate-standalone-sso	clientId requirement reversed	getProfileAndToken requires it; authenticateWithCode falls back to the client's
migrate-*	hash list	pbkdf2 is kept (the API accepts it), ssha256 added, and a note that Node's PasswordHashType omits both
widgets	<UserManagement />	<UsersManagement />, plus the WorkOsWidgets provider, peer deps, and authToken

2. refactor: prune skill references for current models (dde8efd)

Net about −2,900 lines. Removed: STOP/BLOCKING/CRITICAL/ALL MUST PASS banners, package-manager and framework detection trees, generic error-recovery tables, duplicated checklists, and long code blocks the agent copied verbatim. Kept: WorkOS-specific gotchas, env vars, security rules, doc URLs, and every string the tests assert. The 9 backend references now share one short shape (setup / gotchas / existing auth).

Installer prompt size for Next.js (base + nextjs + setup): 41.2 KB → 28.2 KB. Backend references went from about 6 KB to about 2 KB each.

Out of scope, flagged for follow-up:

• Widgets architecture. The skill teaches custom UIs over /_widgets plus an 11k-line spec and bundled parser, instead of the shipped components. I only fixed names here.
• Backend logout. The backend references clear only the local session; they don't end the AuthKit session. This was already the case before this PR.
• Webhook timeout. events.md said 5s and directory-sync said 10s, and the docs give no number. Both now say "quickly".

Verification

• pnpm test: 386 passed; pnpm format:check and pnpm lint are clean. One test now splits on the renumbered Next.js steps (## Step 4: instead of ## Step 6b:).
• Every relative link and #anchor resolves.
• CLI installer evals: the 34 JS scenarios, with this branch's plugins swapped into the CLI's @workos/skills. Requires chore(deps): bump claude-agent-sdk to 0.3.295 for Opus 5.5 support cli#261 (SDK bump for Opus 5.5) and test(evals): accept handleAuthkitProxy and app-owned AuthKitProvider modules cli#262, which accepts handleAuthkitProxy.

	Opus 4.5 before	Opus 4.5 after	Opus 5.5 before	Opus 5.5 after
Passed	34/34	34/34	32/34¹	34/34
First-attempt pass	64.7%	73.5%	76.5%	85.3%
Duration p50 / p95	177s / 298s	142s / 208s	164s / 249s	167s / 293s
TTFT p50	8.7s	13.1s	6.1s	7.1s
Tool calls (total)	1047	996	1178	1074

¹ Both failures were grader false negatives, fixed in workos/cli#262.

One run per model per condition, so treat the deltas as directional.

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; the remaining Radar evaluation mismatch is non-blocking.

Findings

1.  Correct Radar answers lose points ▶

Fix with agent prompt

### Issue 1
plugins/workos/skills/workos/references/workos-radar.md:undefined-22
The guide now recommends `workos.radar.updateAttempt`, but `scripts/eval/cases/radar.yaml` still lists that exact method under `hallucinations`. `scoreOutput()` uses that list, so an answer following the updated guide gets marked as an invented API and loses points. Update the Radar cases' methods, parameters, and flow expectations alongside this SDK correction.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates WorkOS SDK examples and shortens the skill references for coding agents.

• Corrects webhook, Radar, Ruby, Go, JVM, and packaged widget API guidance.
• Keeps shared AuthKit URL and flow checks and updates the Next.js test’s section names.
• nicknisi deferred replacing the custom widget architecture and ending backend AuthKit sessions because both are existing behavior outside this pass.
• nicknisi replaced conflicting webhook timeout numbers with “quickly” because the docs provide no limit.

_{Reviews (2) · Last reviewed commit: "fix: align eval cases with corrected API..." · Reviewed by Greptile}

[greptile-apps]

Correct Radar answers lose points

The guide now recommends workos.radar.updateAttempt, but scripts/eval/cases/radar.yaml still lists that exact method under hallucinations. scoreOutput() uses that list, so an answer following the updated guide gets marked as an invented API and loses points. Update the Radar cases' methods, parameters, and flow expectations alongside this SDK correction.

Prompt To Fix With AI

This is a comment left during a code review.
Path: plugins/workos/skills/workos/references/workos-radar.md
Line: 22

Comment:
**Correct Radar answers lose points**

The guide now recommends `workos.radar.updateAttempt`, but `scripts/eval/cases/radar.yaml` still lists that exact method under `hallucinations`. `scoreOutput()` uses that list, so an answer following the updated guide gets marked as an invented API and loses points. Update the Radar cases' methods, parameters, and flow expectations alongside this SDK correction.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.