@se-studio/skills 1.6.8 → 1.6.10

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.6.10
+
+### Patch Changes
+
+- 41cfadb: Allow agents to merge customer production only for cms-edit-only diffs (host package / editor-pack), one site at a time with a live health check.
+
+## 1.6.9
+
+### Patch Changes
+
+- 34a8a7f: Stop rotating hosted MCP refresh tokens on `/oauth/token`. Grok retries and parallel sessions were hitting `invalid_refresh_token` after the 1-hour access JWT expired. Include `refresh_token_expires_in` (30 days) on token responses.
+
 ## 1.6.8
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.6.8",
+  "version": "1.6.10",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/cms-edit-prod-merge.md

@@ -0,0 +1,35 @@
+# cms-edit-only production merge
+
+The **only** agent exception to “no production git”. Marketing site source, core `main`, and Vercel CLI deploys stay human-only.
+
+## When it applies
+
+All of the following must be true:
+
+1. The user asked to ship **hosted cms-edit** (host package bump, editor-pack-only, or continue a cms-edit host rollout).
+2. Any required `@se-studio/contentful-cms` version is **already on npm**.
+3. The merge is **customer** `develop` → that site’s production branch (`main`, HSD **`production`**). Never `se-core-product` `main`.
+4. `git diff --name-only origin/<productionBranch>...origin/develop` is **only**:
+   - `cms-edit/**`
+   - root `package.json` and/or `pnpm-lock.yaml` (and `pnpm-workspace.yaml` only if it already listed the package)
+5. Those package/lock changes are **only** `@se-studio/contentful-cms` (plus lockfile transitives). No `src/`, `apps/` marketing, smoke, server-config, or other dependency bumps.
+6. Merge **one customer repo at a time**. Wait for that repo’s cms-edit Vercel **production** deployment **Ready**. Then check live `https://<host>/api/health`: `ok`, `cmsEdit.version` matches npm, `redis` and `oauth` checks ok. Probe `/.well-known/oauth-authorization-server` (200). **Stop at the first failure.**
+
+## How to merge
+
+From the **develop** checkout (not `productionPath`):
+
+```bash
+git fetch origin
+git diff --name-only origin/<productionBranch>...origin/develop   # must pass the path gate
+gh pr create --base <productionBranch> --head develop --title "cms-edit: <version or editor-pack>"
+# or ff-only merge via gh
+```
+
+Do **not** use HSD `production-hsd-website` (or any `productionPath`) as the working tree. Do **not** run `pnpm cms-edit:deploy`, `vercel deploy`, or `./scripts/deploy-cms-edit-host.sh`.
+
+## After a successful host
+
+Reconnect Grok `/mcps` → `i` is an editor step if OAuth tokens were dead — not a substitute for the health check.
+
+If the diff is not cms-edit-only, **stop and hand off** — no production merge.

package/references/agent-session/customer-agents-block.md

@@ -6,9 +6,8 @@ Default mode for this repo: **site-first**.
 
 ### Branch policy
 
-- Agents may commit and push **`develop`** and **`feature/*`** only.
-- **Never** push to `main`, `master`, `production`, or any production branch — **human-only** for all customer sites.
-- Do **not** ship from a production checkout (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`). Use the develop checkout only.
+- Agents may commit and push **`develop`** and **`feature/*`**. Customer production (`main`, HSD `production`) only when the **cms-edit-only** gate passes (`se-core-product` `packages/skills/references/agent-session/cms-edit-prod-merge.md`).
+- **Never** merge marketing `src/` to production. **Never** ship from a production checkout (e.g. HSD `production-hsd-website`). Use the develop checkout only.
 - Prefer **draft PRs** to `develop` over direct pushes when `gh` is available.
 
 ### Core vs customer placement
@@ -56,4 +55,4 @@ Never hand-edit `package.json` dependency versions.
 
 ### Production handoff
 
-When ready for production, agents **stop** and deliver a handoff note — they do not merge to `main` / `production` or promote Vercel/Netlify. Production promotion is always **human-only**. See skill Step 8.
+When **marketing** work is ready, agents **stop** and hand off. **cms-edit-only** host rollouts may merge `develop` → production one site at a time (health-check, stop at first failure). No `vercel deploy`. See skill Step 7–8 and `cms-edit-prod-merge.md`.

package/skills/contentful-cms-setup/SKILL.md

@@ -87,7 +87,7 @@ Do **not** register a local `mcpServers.cms-edit` entry in Claude Desktop — us
 → Confirm the user was invited to the Contentful space and is signing in with the correct account. In Grok, use `/mcps` → press `i` (not just toggle). Confirm config URL ends with `/api/mcp`.
 
 **Grok: Failed to get tools after auth / auth required**
-→ MCP refresh succeeded but the CMA cache is missing **or Contentful rejected it**. cms-edit **3.5.3+** deletes the dead cache and returns `invalid_token` so Grok re-runs Contentful sign-in. If it still loops, delete the server’s entry in `~/.grok/mcp_credentials.json`, then `/mcps` → `i` and complete Contentful sign-in.
+→ On Vercel look for `[cms-edit:oauth] auth_failure`. `invalid_refresh_token` means the MCP refresh UUID is gone (rotation + parallel Grok sessions); cms-edit **3.6.1+** keeps the same refresh token. `missing_contentful_token` / `invalid_contentful_token` means the CMA cache is missing or Contentful rejected it — **3.5.3+** deletes the dead cache and returns `invalid_token` so Grok re-runs Contentful sign-in. If it still loops, delete the server’s entry in `~/.grok/mcp_credentials.json`, then `/mcps` → `i` and complete Contentful sign-in.
 
 **Grok browser flashes and closes**
 → Usually a redirect_uri mismatch before cms-edit v2.7.7+; upgrade the hosted deployment and retry OAuth.

package/skills/site-workflows-agent-session/SKILL.md

@@ -5,7 +5,7 @@ description: "Start and manage agent work sessions across se-core-product and cu
 
 # Agent session workflow
 
-Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge/promote to `main` / production (all customer sites + core) — agents stop at handoff.
+Orchestrates **where** to work, **where code belongs**, and **how to isolate parallel features**. **Humans only** merge marketing production and core `main` — except **cms-edit-only** customer merges (reference `cms-edit-prod-merge.md`).
 
 **Registry:** [`packages/skills/references/agent-session/projects.registry.json`](../../references/agent-session/projects.registry.json) — repo paths, `worktreesRoot`, `productionPath` / `productionBranch`, integration branches, hosted MCP keys.
 
@@ -57,12 +57,12 @@ feature/<scope>/<short-slug>
 
 Integration branches (agents push feature branches here via PR or merge — **never production**):
 
-| Repo type | Integration branch | Production (human-only) |
-|-----------|-------------------|-------------------------|
-| `se-core-product` | `dev` | `main` |
-| Customer sites | `develop` (or registry override) | Usually `main`; HSD uses branch **`production`** and checkout `productionPath` |
+| Repo type | Integration branch | Production |
+|-----------|-------------------|------------|
+| `se-core-product` | `dev` | `main` — **never** agent |
+| Customer sites | `develop` (or registry override) | Usually `main`; HSD **`production`**. Marketing: human-only. **cms-edit-only:** agents may merge — see below |
 
-**Never** push, merge, or promote registry `productionBranch` / work in `productionPath`. Agent work uses `path` (develop checkout) only.
+**Never** work in `productionPath`. Agent work uses `path` (develop checkout) only.
 
 ---
 
@@ -253,8 +253,9 @@ Agents may push to:
 
 - `dev` / `develop` (via feature branch merge or direct if user prefers)
 - `feature/*` branches
+- Customer production (`main`, HSD `production`) **only** when the [cms-edit-only gate](../../references/agent-session/cms-edit-prod-merge.md) passes
 
-Agents must **never** push to `main`, `master`, `production`, or any registry `productionBranch`. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
+Agents must **never** push **se-core-product** `main`, or customer production when the diff is not cms-edit-only. Agents must **never** ship from a registry `productionPath` (e.g. HSD `~/source/customers/hopskipdrive/production-hsd-website`).
 
 **Preferred:** open a **draft PR** targeting the integration branch:
 
@@ -268,7 +269,7 @@ If `gh` is unavailable or user prefers direct push, push `feature/*` and note in
 
 ## Step 8 — Handoff (production-ready)
 
-When work is ready for human review / production promotion, **stop** — do not merge to `main`, `production`, or any production branch. **Production promotion is human-only** for core and every customer site.
+When **marketing** work is ready for production, **stop** — do not merge to `main` / `production`. **Exception:** cms-edit-only (Step 7 + [`cms-edit-prod-merge.md`](../../references/agent-session/cms-edit-prod-merge.md)) — merge one customer repo at a time, wait for cms-edit host Ready, verify `/api/health`, stop at the first failure.
 
 1. Set manifest `status: ready_for_review`
 2. Deliver handoff using template below
@@ -300,9 +301,9 @@ When work is ready for human review / production promotion, **stop** — do not
 2. <customer pnpm update @se-studio/...>
 3. <customer PR>
 
-### Production (human-only)
-Ready for you to merge to production (`main` or site `productionBranch`) / promote Vercel.
-Agent will not push production or use productionPath checkouts.
+### Production
+Marketing: human-only (`main` or site `productionBranch`).
+cms-edit-only: agent may merge per `cms-edit-prod-merge.md` (not `productionPath`, not `vercel deploy`).
 ```
 
 ---
@@ -341,7 +342,7 @@ Agent must load this skill, write manifest (with `worktree` path), run placement
 
 ## Quick reference — project keys
 
-| key | Integration | Production (human-only) | Type |
+| key | Integration | Production | Type |
 |-----|-------------|-------------------------|------|
 | `se-core-product` | `dev` | `main` | core monorepo |
 | `se2026` | `develop` | `main` | customer |

package/skills/site-workflows-new-project/SKILL.md

@@ -116,7 +116,7 @@ One feature = one `feature/<scope>/<slug>` branch. **Git worktree required** for
 
 ### Production handoff
 
-Agents stop at handoff — they do not merge to `main` / production or promote production deploys. Human-only. See skill `site-workflows-agent-session` Step 8.
+Agents stop at handoff for **marketing** production. cms-edit-only host merges: see `site-workflows-agent-session` and `cms-edit-prod-merge.md`.
 
 ## CMS editing (cms-edit)
 

package/skills/site-workflows-stale-files-cleanup/SKILL.md

@@ -19,7 +19,7 @@ Remove **dead weight** from an SE Studio site repo without changing product beha
 
 **Default:** Plan mode first — present a classified audit table before deleting anything.
 
-**Never:** push to `main`/`master`/`production` or promote production (human-only for all customer sites); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
+**Never:** push marketing production or use production checkouts (cms-edit-only gate is in `cms-edit-prod-merge.md`); delete `docs/cms-editor/` or committed `cms-edit/*/editor-pack/` without explicit user request; fix Dependabot alerts unless the user asks.
 
 ---
 
@@ -153,7 +153,7 @@ pnpm validate   # or repo-specific validate from AGENTS.md
 
 Commit on integration branch only. Suggested message: `chore: remove stale scripts, docs, and tooling`.
 
-Hand off production promotion to the human — never push `main` / `production` or use production checkouts to ship.
+Hand off **marketing** production. Do not use production checkouts. cms-edit-only: `cms-edit-prod-merge.md`.
 
 ---