@se-studio/skills 1.6.7 → 1.6.9

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.6.9
+
+### Patch Changes
+
+- 34a8a7f: Stop rotating hosted MCP refresh tokens on `/oauth/token`. Grok retries and parallel sessions were hitting `invalid_refresh_token` after the 1-hour access JWT expired. Include `refresh_token_expires_in` (30 days) on token responses.
+
+## 1.6.8
+
+### Patch Changes
+
+- d74ec5c: Document Figma-as-absolute-gospel for new UI work in site-workflows-agent-session (until the user overrides).
+
 ## 1.6.7
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.6.7",
+  "version": "1.6.9",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/skills/contentful-cms-core/SKILL.md

@@ -62,8 +62,13 @@ cms-edit open --id 4xKj2abcDef
 
 # Home page (slug is 'index')
 cms-edit open --page-slug /
+
+# Include template menu/footer/nav (default open skips site chrome)
+cms-edit open --include-chrome --page-slug /pricing
 ```
 
+`open` / `peek` fetch the page (or article) tree and the template entry, but **not** template `menu` / `footer` / navigation. Edit nav with `nav open`. Pass `--include-chrome` only when you need those trees.
+
 **Flat lookup flags:** provide **exactly one** primary flag per `open` / `resolve` / `nav open`. See `cms-edit help lookup`. Run `cms-edit index sync` so catalog types resolve from the local index.
 
 ### Step 2: Read the snapshot

package/skills/contentful-cms-setup/SKILL.md

@@ -87,7 +87,7 @@ Do **not** register a local `mcpServers.cms-edit` entry in Claude Desktop — us
 → Confirm the user was invited to the Contentful space and is signing in with the correct account. In Grok, use `/mcps` → press `i` (not just toggle). Confirm config URL ends with `/api/mcp`.
 
 **Grok: Failed to get tools after auth / auth required**
-→ MCP refresh succeeded but the CMA cache is missing **or Contentful rejected it**. cms-edit **3.5.3+** deletes the dead cache and returns `invalid_token` so Grok re-runs Contentful sign-in. If it still loops, delete the server’s entry in `~/.grok/mcp_credentials.json`, then `/mcps` → `i` and complete Contentful sign-in.
+→ On Vercel look for `[cms-edit:oauth] auth_failure`. `invalid_refresh_token` means the MCP refresh UUID is gone (rotation + parallel Grok sessions); cms-edit **3.6.1+** keeps the same refresh token. `missing_contentful_token` / `invalid_contentful_token` means the CMA cache is missing or Contentful rejected it — **3.5.3+** deletes the dead cache and returns `invalid_token` so Grok re-runs Contentful sign-in. If it still loops, delete the server’s entry in `~/.grok/mcp_credentials.json`, then `/mcps` → `i` and complete Contentful sign-in.
 
 **Grok browser flashes and closes**
 → Usually a redirect_uri mismatch before cms-edit v2.7.7+; upgrade the hosted deployment and retry OAuth.

package/skills/contentful-cms-sync-schema/SKILL.md

@@ -87,6 +87,7 @@ Standard order when diff shows these gaps:
 | 5 | `15-add-slug-regexp-validation.js` | Slug format validation |
 | 6 | `17-add-article-authors.js` | `article.authors` array + backfill from `author` |
 | 7 | `21-add-article-bottom-content.js` | `article.bottomContent` array (idempotent; clones `content` link types) |
+| 8 | `25-add-meta-field.js` | Optional Long text `meta` JSON bag on template/page/article/tag/person and related types. Idempotent. Unused until filled. |
 
 Site-specific (run only when diff shows missing field **and** app uses it):
 

package/skills/site-workflows-agent-session/SKILL.md

@@ -212,6 +212,22 @@ Record `cms_session: <feature-slug>` in manifest when doing CMS work.
 - **Do not** edit `se-core-product` unless placement is `core` and user approves mode switch
 - Consume `@se-studio/*` from npm — not monorepo workspace links
 
+### Figma is absolute gospel (new designs)
+
+**Until the user explicitly says otherwise**, when implementing or polishing UI from a Figma file or node:
+
+| Do | Do not |
+|----|--------|
+| Treat the named Figma node as the **source of truth** for structure, spacing, type, colour, radii, alignment, and control patterns | “Improve”, normalize, or restyle away from the comps to match older site patterns |
+| Pull design context / screenshots from the owned Figma file before coding or “fixing” visuals | Prefer CMS draft copy, prior app screenshots, or memory of the live site over the comps |
+| Match **pixel-faithfully** (including pills vs checkboxes/radios, hug vs full-width CTAs, card fills) | Ship “close enough” and wait for the user to notice |
+| If Figma conflicts with an existing component or token, **follow Figma** and note the deviation | Silently keep the old pattern because it is already in the codebase |
+| Verify in the browser against the Figma node (desktop + mobile when both exist) | Declare done from a single screenshot that does not match the node |
+
+**Override:** Only diverge when the user clearly says so in the current conversation (e.g. “ignore Figma for the button”, “use site chrome instead”). Until that override, Figma wins.
+
+**Related skills:** `site-workflows-figma-design-snapshot` / `site-workflows-apply-design-snapshot` for token sync; Figma MCP `get_design_context` for node-level implementation.
+
 ### Blocked work
 
 If manifest has `blocked_on: "@se-studio/foo@1.2.3"`, do not push customer `develop` until npm publish is confirmed. Update manifest when unblocked.