feat: add WorkOS plugin

[saoudrizwan]

WorkOS

Adds a WorkOS plugin for Cline users building enterprise identity flows. The plugin helps Cline answer and implement WorkOS AuthKit, SSO/SAML, Directory Sync, RBAC, FGA, MFA, Vault, Audit Logs, Admin Portal, Pipes, Feature Flags, Radar, Events, Custom Domains, CLI lifecycle, API reference, and migration workflows without guessing CLI commands or dashboard paths.

Cline Primitives

• Skills: workos is the main router skill. It maps WorkOS questions and implementation tasks to bundled reference files for framework-specific AuthKit setup, backend SDKs, WorkOS features, API references, management commands, and migrations from providers like Auth0, Clerk, Cognito, Firebase, Supabase, Stytch, Descope, and Better Auth.
• Skills: workos-widgets guides WorkOS widget implementation for User Management, User Profile, Admin Portal SSO Connection, and Admin Portal Domain Verification. It includes stack detection, token strategy guidance, widget endpoint references, and a bundled OpenAPI query helper for schema lookup.
• Rules: workos:safety tells Cline to treat API keys, client secrets, cookies, session tokens, widget access tokens, webhook secrets, and exported user data as sensitive. It also requires explicit confirmation before mutating WorkOS organizations, users, roles, permissions, connections, directories, feature flags, webhooks, or production configuration.

Requirements

Live WorkOS implementation work requires the user to provide the relevant WorkOS account access and credentials, commonly WORKOS_API_KEY, WORKOS_CLIENT_ID, cookie/session secrets, webhook secrets, or widget token material.

The plugin does not register an MCP server, start background services, install dependencies, call WorkOS APIs, or write MCP settings at install time. WorkOS CLI use remains a runtime action. When Cline runs the CLI, the skills steer it toward WORKOS_MODE=agent and --json where parsing is needed, while host-sensitive auth flows can be handed back to the user’s shell if the Cline environment is not trusted for that operation.

Trust Boundaries

The bundled WorkOS references are intended to reduce hallucinated WorkOS commands and dashboard paths. The plugin pushes Cline toward verified CLI help output, bundled reference files, and current WorkOS docs when current docs are needed.

Widget implementation can change application auth surfaces and user-management behavior, so the plugin keeps installer and mutation flows approval-gated and encourages manual integration from the bundled framework references when the user does not want Cline to run the WorkOS installer.

[saoudrizwan]

Closing this plugin PR for now because this cleanup pass is limiting plugin marketplace PRs to plugins that only bundle MCP servers and/or skills. This PR includes additional plugin primitive(s): rules.

Those primitives may still be useful, but we are keeping this batch scoped to MCP and skill distribution.