From 54d40c39623bdd4f8f88cd43393eb894ea87d948 Mon Sep 17 00:00:00 2001 From: Rishikesh Balaji Date: Thu, 24 Sep 2026 14:35:14 -0700 Subject: [PATCH 1/2] docs(skills): require generated clients to forward the user JWT A hand-rolled resource client that only sets MAJOR_JWT_TOKEN is rejected on resource calls. App code must use the generated client. cron.json is not a scheduler. --- plugins/major-build/skills/app-builder/SKILL.md | 12 +++++++++++- plugins/major-build/skills/using-connectors/SKILL.md | 2 ++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/plugins/major-build/skills/app-builder/SKILL.md b/plugins/major-build/skills/app-builder/SKILL.md index b10711e..96ccf51 100644 --- a/plugins/major-build/skills/app-builder/SKILL.md +++ b/plugins/major-build/skills/app-builder/SKILL.md @@ -73,7 +73,17 @@ Two playbooks — use the relevant one before you start: ## Recurring work -Apps no longer carry their own crons. For recurring work against an app's API, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node. +Apps no longer carry their own crons. `cron.json` is not read. For recurring work against an app's API, load the `workflow-builder` skill and build a workflow with a cron trigger and an `app_call` node. + +## Calling go-api from app code + +Do not construct `PostgresResourceClient`, `SlackResourceClient`, `createProxyFetch`, or any other resource client by hand. Import the generated client in `clients/`. It already copies the incoming `x-major-user-jwt`. + +A resource call to go-api without `x-major-user-jwt` will be rejected. A hand-rolled client that only sets `MAJOR_JWT_TOKEN` fails, including from a webhook or a workflow `app_call`. + +A webhook route and a workflow `app_call` are real requests. Ingress has already set `x-major-user-jwt`. `headers()` works there. Do not drop `getHeaders` so those routes can run. + +`MAJOR_JWT_TOKEN` alone is only for the runner and for code that is not inside a request. `current-build` and the error reporter keep using it. ## LLM calls from app code diff --git a/plugins/major-build/skills/using-connectors/SKILL.md b/plugins/major-build/skills/using-connectors/SKILL.md index 61928ce..7123aa0 100644 --- a/plugins/major-build/skills/using-connectors/SKILL.md +++ b/plugins/major-build/skills/using-connectors/SKILL.md @@ -7,6 +7,8 @@ description: Use for ANY operation against a connected resource or connector — The organization's connectors are _resources_ — external services (databases, APIs, storage, etc.) the agent and its apps reach through Major's secure clients and MCP tools. Every connector is used the same way: find the resource, read its context docs, then follow that connector's reference in this skill. +Examples that construct a client with only `majorJwtToken: process.env.MAJOR_JWT_TOKEN` are for a script outside a request. App code imports the generated client in `clients/`. A resource call to go-api without `x-major-user-jwt` will be rejected. A webhook route and a workflow `app_call` already have that header. + ## Step 1: List available resources Call `mcp__resources__list_resources` to get the resources you have access to, with their `resourceId`, type, and `subtype`. From 2a9ce5bf7d24a5c542bc78ebe579f66c696cec63 Mon Sep 17 00:00:00 2001 From: Rishikesh Balaji Date: Thu, 24 Sep 2026 14:39:36 -0700 Subject: [PATCH 2/2] docs(skills): do not excuse hand-rolled resource clients The using-connectors skill is for app code. Drop the sentence that treated MAJOR_JWT_TOKEN-only clients as a valid script pattern. --- plugins/major-build/skills/using-connectors/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/major-build/skills/using-connectors/SKILL.md b/plugins/major-build/skills/using-connectors/SKILL.md index 7123aa0..921f726 100644 --- a/plugins/major-build/skills/using-connectors/SKILL.md +++ b/plugins/major-build/skills/using-connectors/SKILL.md @@ -7,7 +7,7 @@ description: Use for ANY operation against a connected resource or connector — The organization's connectors are _resources_ — external services (databases, APIs, storage, etc.) the agent and its apps reach through Major's secure clients and MCP tools. Every connector is used the same way: find the resource, read its context docs, then follow that connector's reference in this skill. -Examples that construct a client with only `majorJwtToken: process.env.MAJOR_JWT_TOKEN` are for a script outside a request. App code imports the generated client in `clients/`. A resource call to go-api without `x-major-user-jwt` will be rejected. A webhook route and a workflow `app_call` already have that header. +App code imports the generated client in `clients/`. Do not construct a client with only `majorJwtToken`. A resource call to go-api without `x-major-user-jwt` will be rejected. A webhook route and a workflow `app_call` already have that header. ## Step 1: List available resources