@ekanos/cli 0.3.5 → 0.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekanos/cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "The Ekanos partner toolchain CLI: scaffold, validate, and test an Ekanos integration against the published @ekanos packages. Agent-native — every verb speaks JSON with a stable exit-code taxonomy.",
   "keywords": [
     "cli",
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@ekanos/integration-schema": "0.5.0",
+    "@ekanos/integration-schema": "0.6.0",
     "esbuild": "0.28.1",
     "picocolors": "1.1.1"
   },

package/templates/AGENTS.md.tmpl

@@ -358,10 +358,11 @@ your handler with the values the user actually typed.
 
 Build widget UI from `@ekanos/ui` — the published slice of the host design
 system. Available modules (import individually, e.g. `@ekanos/ui/button`):
-`alert`, `badge`, `button`, `card`, `dialog`, `dropdown-menu`, `form`, `icon`,
-`if`, `input`, `label`, `select`, `separator`, `skeleton`, `spinner`,
-`switch`, `textarea`, `tooltip`, `trans`, `utils` (the `cn()` helper),
-`ai-prompt-input`, plus the stylesheets `styles.css` / `tokens.css` /
+`alert`, `badge`, `button`, `card`, `confirm-dialog`, `dialog`,
+`dropdown-menu`, `empty-note`, `form`, `icon`, `if`, `input`, `label`,
+`search-field`, `select`, `sheet`, `separator`, `skeleton`, `spinner`,
+`switch`, `table`, `tabs`, `textarea`, `tooltip`, `trans`, `utils` (the
+`cn()` helper), `ai-prompt-input`, plus the stylesheets `styles.css` / `tokens.css` /
 `theme.css` / `base.css`. Icons are Font Awesome glyph names via
 `@ekanos/ui/icon`. This generated shell loads Font Awesome **Free**
 (`@fortawesome/fontawesome-free`) — a much smaller set than the Pro kit Ekanos
@@ -427,6 +428,13 @@ who answers `/api/integrations/<slug>/…`:
   declared scopes, copy the keys) derived from the declaration plus the
   entry's `oauth.setup` (console link, provider-specific notes — WRITE these
   for every OAuth integration), then a form that saves the keys server-side.
+  Check the provider's docs for how its token endpoint wants client
+  authentication: the default, HTTP Basic, is wrong for some providers
+  (LinkedIn accepts only the secret in the form body). Set
+  `oauth.provider.tokenAuthMethod: 'client_secret_post'` for those; omit it
+  for Basic (`'client_secret_basic'`). A `<slug>_oauth_error=provider_error`
+  means the provider itself sent the user back with an error other than
+  `access_denied`; read the harness log for its `error_description`.
   Then Connect, and `onTokens` runs on the server. The connection is
   memory-only — a dev-server restart means one more Connect. **Never take a
   user's client id, secret or token through chat or write one into a file;

package/templates/package.json.tmpl

@@ -11,12 +11,12 @@
     "prepare": "node scripts/setup-hooks.mjs"
   },
   "dependencies": {
-    "@ekanos/sdk": "^0.5.0",
-    "@ekanos/ui": "^0.5.0"
+    "@ekanos/sdk": "^0.6.0",
+    "@ekanos/ui": "^0.6.0"
   },
   "devDependencies": {
-    "@ekanos/cli": "^0.3.5",
-    "@ekanos/harness": "^0.4.1",
+    "@ekanos/cli": "^0.3.6",
+    "@ekanos/harness": "^0.4.3",
     "@hookform/resolvers": "^5.2.2",
     "@tailwindcss/postcss": "^4.3.3",
     "@tanstack/react-query": "^5.101.4",

package/templates/skills/build-integration/references/oauth-setup.md

@@ -33,7 +33,11 @@ live: { default: 'live' },
 Find `consoleUrl` and the notes in the provider's docs during Phase 2
 (research) — the "create an app" / "register an application" page. Write
 what the CONSOLE calls things, not what the declaration calls them; the
-harness already prints the declared secret names beside each field. The
+harness already prints the declared secret names beside each field. Also
+read the provider's docs for how its token endpoint authenticates the client:
+the default is HTTP Basic (`'client_secret_basic'`), but a provider that wants
+`client_id` and `client_secret` in the form body (LinkedIn) needs
+`provider.tokenAuthMethod: 'client_secret_post'` in the declaration. The
 harness derives the rest — provider host, redirect URI, scopes, PKCE — from
 `defineIntegration({ oauth })`, so do not repeat those in `notes`.
 
@@ -67,9 +71,13 @@ opens with a **Local OAuth** panel:
   connected" is expected — say so instead of debugging.
 - `<slug>_oauth_error=<code>` on the return URL is the transport's
   vocabulary: `not_configured` = a key is still missing (check the panel's
-  badges), `denied` = the user cancelled at the provider, `exchange_failed` =
-  the provider rejected the exchange (wrong redirect URI or secret, or the
-  token host missing from `egress`), `save_failed` = your `onTokens` threw
+  badges), `denied` = the user cancelled at the provider, `provider_error` =
+  the provider sent the user back with an error other than `access_denied`
+  (the dev-server log has its `error` and `error_description`),
+  `exchange_failed` = the provider rejected the exchange (wrong redirect URI
+  or secret, the wrong `tokenAuthMethod`, or the token host missing from
+  `egress`; the log line carries the provider's redacted response body),
+  `save_failed` = your `onTokens` threw
   (read the dev-server log). Fix the cause; do not retry blindly.
 - Widgets read the connection through `useOAuthWidgetGate` / the storage
   route. If they show "Connect" after a successful loop, check `onActivate`