[nicknisi]

Why

The CLI installer pastes these references into its agent's prompt. When I trimmed them in #53, the backend references were reduced to "follow the README". The SDK READMEs are thin (the Go README has no usage examples at all), so agents spent several calls per install reading SDK source to find method names and signatures.

What

Each backend reference (Node, Python, Ruby, Go, PHP, Laravel, Kotlin, Elixir, .NET) now has a compact Call shapes block, checked against the latest published SDK. Each file states the version it was checked against. The block covers:

• client setup from env
• AuthKit authorization URL
• code exchange
• session handling (sealed sessions where the SDK has them)
• logout

Corrections that came out of checking:

• Logout now ends the AuthKit session through the SDK's logout URL. Before, every backend reference only cleared the local session.
• Node: sealSession goes inside session: { sealSession, cookiePassword }. The old top-level placement is silently ignored (factory-*.mjs checks session?.sealSession).
• Go: Provider: "authkit" is required. The SDK errors if Provider, ConnectionID, and OrganizationID are all empty. Logout needs the sid claim from the access token, and the SDK has no JWT decoder.
• PHP: provider takes the enum value. The cookie password must be base64 that decodes to exactly 32 bytes (sodium secretbox).
• Python: the cookie password is used directly as a Fernet key, so an arbitrary string fails. authenticate_with_code has no seal_session option; use seal_session_from_auth_response.
• Laravel: the package ships no controllers, routes, or middleware, and requires PHP ≥ 8.2 and Laravel 12/13.
• WORKOS_COOKIE_PASSWORD and WORKOS_REDIRECT_URI are added where the gotchas referred to them but .env didn't list them.

Verification

• pnpm test: 574 passed. Format is clean.
• CLI installer evals with these references (fix(installer): give the agent its rules, unbreak non-JS installs, and run evals through the real installer cli#266): all 50 scenarios pass on both Opus 4.5 and 5.5.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; both previous findings are addressed.

Summary

The PR restores SDK call examples across nine backend references. The latest changes address both previous findings:

• Backend references show agents the SDK calls for AuthKit sign-in and sessions.
• Backend sign-out guidance now sends users to the AuthKit logout URL.

No new actionable issues were found in the changes since the previous review.

_{Reviews (2) · Last reviewed commit: "fix: Laravel logout survives expired tok..." · Reviewed by Greptile}