@superglue/cli 1.1.216 → 1.1.218

package/dist/skills/superglue/SKILL.md

@@ -147,7 +147,9 @@ Systems are derived: a connection namespace is derived from existing connections
 
 Removed commands (`sg system create`, `edit`, `credentials`, and `search-docs`) return a deprecation error with `sg update` and replacement guidance. Removed system API endpoints return HTTP 410 with the same guidance. Run `sg update`, then use connection commands; use `sg system find --id <id>` for system knowledge. Legacy `/credentials` API aliases remain available with deprecation headers.
 
-1. Read the relevant tool's namespace first, then inspect existing namespaces with `sg system find <query>` and the connections you can access under one with `sg system connection list --system-id <id>`. Reuse that exact id, even when other users' connections are hidden. For a new namespace, use the template id, not its display name. Without a template, choose a descriptive id. Keep account labels in connection names; separate namespaces when tools need distinct services or environments.
+Match accessible owned and shared connections to the requested account, tenant, and environment, even across different system IDs. Respect an explicit connection choice or request for separate access. Otherwise, prefer suitable existing access; ask only when the account or connection choice is unclear. Defaults apply within one system ID and do not establish authentication or suitability.
+
+1. Read the relevant tool's namespace first, then inspect existing namespaces with `sg system find <query>`. List accessible connections in each candidate namespace with `sg system connection list --system-id <id>`. Reuse an existing id for the same logical service; preserve IDs referenced by saved tools. For a new namespace, use the template id, not its display name. Without a template, choose a descriptive id. Keep account labels in connection names; separate namespaces when tools need distinct services or environments.
 2. Save your connection under the id: `sg system connection set --system-id <id> --url "..." --credentials '{...}' --authentication '{"type":"api_key"}'`. `--authentication` or `--oauth-app-id` is required when creating a connection; use `{"type":"none"}` for unauthenticated systems. Use the saved connection's returned `systemId` in later commands, tool steps, and placeholders.
 3. For OAuth: discover reusable apps with `sg system oauth-apps [--system-id <id>]` and link one with `--oauth-app-id <id>`. When several apps fit, ask the user which one to use. A new client ID and secret creates a reusable org app automatically, including default scopes. Otherwise add the client config with `--authentication '{"type":"oauth2",...}'`, then `sg system oauth --system-id <id> [--scopes "..."]` opens a browser flow. Omit `--scopes` to use saved connection scopes. Supply it to replace the set, including more or fewer scopes; `--scopes ""` requests none. Overrides are saved on the connection and do not change app defaults. User approves → tokens saved to your connection
 4. For private systems: `--tunnel-id <id>` binds a Secure Gateway tunnel to the connection

package/dist/skills/superglue/references/access-rules.md

@@ -9,7 +9,7 @@ interface ResourceGrant {
   roleId: string;
   resourceRef: "<kind>:<encodedId>" | "<kind>:*"; // kind: tool | credential | playbook | artifact | file | project
   permissions: Array<"viewer" | "editor">;
-  source: "access_rule" | "ownership" | "share";
+  source: "access_rule" | "ownership" | "share" | "project"; // project: computed from project access, never stored
   grantedByUserId?: string;
   revokedAt?: Date;
   revokedByUserId?: string;
@@ -99,7 +99,7 @@ Sharing supports saved tools, connections, projects, playbooks, artifacts, and f
 - Recipients can remove their own direct share, including connection shares, without editor access.
 - Sharing a tool shares only the tool. The recipient still needs a connection for every system id it references.
 - Sharing playbooks does not cascade to their tools or connections.
-- Project sharing can include manageable current members when requested. It does not share future members or revoke member shares later.
+- Access to a project gives the same access (viewer or editor) to every resource attached to it. Removing the resource from the project, removing the project access, or archiving the project removes that access. Anyone with access to a project, including viewers, can attach a resource they can share. Project editors and people who can share a resource can remove it from the project.
 
 ## Auto-Grant On Resource Creation
 

package/dist/skills/superglue/references/superglue-info.md

@@ -76,7 +76,7 @@ If a customer's system requires IP allowlisting for firewall rules, security gro
 
 Use this section as the source of truth for high-level web app navigation. Do not invent UI locations that are not listed here.
 
-Brain contains context-source setup, playbooks, artifacts, and files. Capabilities contains tools, connections, MCP servers, and schedules; tools are project-attachable, the others configure execution. A system is only the system ID that groups connections and tool steps. Projects are managed separately and group selected context and capabilities without changing RBAC.
+Brain contains context-source setup, playbooks, artifacts, and files. Capabilities contains tools, connections, MCP servers, and schedules; tools are project-attachable, the others configure execution. A system is only the system ID that groups connections and tool steps. Projects are managed separately and group selected context and capabilities. People with project access get the same access to its attached resources.
 
 The persistent left sidebar contains these top-level items:
 
@@ -99,7 +99,7 @@ The persistent left sidebar contains these top-level items:
   - **API Keys** (`/api-keys`) — API key management.
   - **Settings** (`/settings`) — appearance and agent memory notes for every user; organization settings for admins.
 
-The right panel's **Project plan** tab shows the selected project's tasks; with a project selected, `/projects` opens it. **New project** in the project switcher starts agent-assisted project planning; projects are created only through the agent. Project detail pages (`/projects/{projectId}`) have **Tasks**, **Resources**, and **Sessions** tabs. **Tasks** filters by label and assignee; each project has its own task labels. Projects support sharing, archive, and deletion; resource permissions remain separate.
+The right panel's **Project plan** tab shows the selected project's tasks; with a project selected, `/projects` opens it. **New project** in the project switcher starts agent-assisted project planning; projects are created only through the agent. Project detail pages (`/projects/{projectId}`) have **Tasks**, **Resources**, and **Sessions** tabs. **Tasks** filters by label and assignee; each project has its own task labels. Projects support sharing, archive, and deletion; people with project access get the same access to its attached resources.
 
 Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user's name and email, lists the user's organizations and pending invitations, and contains **Sign Out**. Selecting an organization switches to it.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superglue/cli",
-  "version": "1.1.216",
+  "version": "1.1.218",
   "bin": {
     "sg": "./dist/cli.js"
   },

package/skills/superglue/SKILL.md

@@ -147,7 +147,9 @@ Systems are derived: a connection namespace is derived from existing connections
 
 Removed commands (`sg system create`, `edit`, `credentials`, and `search-docs`) return a deprecation error with `sg update` and replacement guidance. Removed system API endpoints return HTTP 410 with the same guidance. Run `sg update`, then use connection commands; use `sg system find --id <id>` for system knowledge. Legacy `/credentials` API aliases remain available with deprecation headers.
 
-1. Read the relevant tool's namespace first, then inspect existing namespaces with `sg system find <query>` and the connections you can access under one with `sg system connection list --system-id <id>`. Reuse that exact id, even when other users' connections are hidden. For a new namespace, use the template id, not its display name. Without a template, choose a descriptive id. Keep account labels in connection names; separate namespaces when tools need distinct services or environments.
+Match accessible owned and shared connections to the requested account, tenant, and environment, even across different system IDs. Respect an explicit connection choice or request for separate access. Otherwise, prefer suitable existing access; ask only when the account or connection choice is unclear. Defaults apply within one system ID and do not establish authentication or suitability.
+
+1. Read the relevant tool's namespace first, then inspect existing namespaces with `sg system find <query>`. List accessible connections in each candidate namespace with `sg system connection list --system-id <id>`. Reuse an existing id for the same logical service; preserve IDs referenced by saved tools. For a new namespace, use the template id, not its display name. Without a template, choose a descriptive id. Keep account labels in connection names; separate namespaces when tools need distinct services or environments.
 2. Save your connection under the id: `sg system connection set --system-id <id> --url "..." --credentials '{...}' --authentication '{"type":"api_key"}'`. `--authentication` or `--oauth-app-id` is required when creating a connection; use `{"type":"none"}` for unauthenticated systems. Use the saved connection's returned `systemId` in later commands, tool steps, and placeholders.
 3. For OAuth: discover reusable apps with `sg system oauth-apps [--system-id <id>]` and link one with `--oauth-app-id <id>`. When several apps fit, ask the user which one to use. A new client ID and secret creates a reusable org app automatically, including default scopes. Otherwise add the client config with `--authentication '{"type":"oauth2",...}'`, then `sg system oauth --system-id <id> [--scopes "..."]` opens a browser flow. Omit `--scopes` to use saved connection scopes. Supply it to replace the set, including more or fewer scopes; `--scopes ""` requests none. Overrides are saved on the connection and do not change app defaults. User approves → tokens saved to your connection
 4. For private systems: `--tunnel-id <id>` binds a Secure Gateway tunnel to the connection

package/skills/superglue/references/access-rules.md

@@ -9,7 +9,7 @@ interface ResourceGrant {
   roleId: string;
   resourceRef: "<kind>:<encodedId>" | "<kind>:*"; // kind: tool | credential | playbook | artifact | file | project
   permissions: Array<"viewer" | "editor">;
-  source: "access_rule" | "ownership" | "share";
+  source: "access_rule" | "ownership" | "share" | "project"; // project: computed from project access, never stored
   grantedByUserId?: string;
   revokedAt?: Date;
   revokedByUserId?: string;
@@ -99,7 +99,7 @@ Sharing supports saved tools, connections, projects, playbooks, artifacts, and f
 - Recipients can remove their own direct share, including connection shares, without editor access.
 - Sharing a tool shares only the tool. The recipient still needs a connection for every system id it references.
 - Sharing playbooks does not cascade to their tools or connections.
-- Project sharing can include manageable current members when requested. It does not share future members or revoke member shares later.
+- Access to a project gives the same access (viewer or editor) to every resource attached to it. Removing the resource from the project, removing the project access, or archiving the project removes that access. Anyone with access to a project, including viewers, can attach a resource they can share. Project editors and people who can share a resource can remove it from the project.
 
 ## Auto-Grant On Resource Creation
 

package/skills/superglue/references/superglue-info.md

@@ -76,7 +76,7 @@ If a customer's system requires IP allowlisting for firewall rules, security gro
 
 Use this section as the source of truth for high-level web app navigation. Do not invent UI locations that are not listed here.
 
-Brain contains context-source setup, playbooks, artifacts, and files. Capabilities contains tools, connections, MCP servers, and schedules; tools are project-attachable, the others configure execution. A system is only the system ID that groups connections and tool steps. Projects are managed separately and group selected context and capabilities without changing RBAC.
+Brain contains context-source setup, playbooks, artifacts, and files. Capabilities contains tools, connections, MCP servers, and schedules; tools are project-attachable, the others configure execution. A system is only the system ID that groups connections and tool steps. Projects are managed separately and group selected context and capabilities. People with project access get the same access to its attached resources.
 
 The persistent left sidebar contains these top-level items:
 
@@ -99,7 +99,7 @@ The persistent left sidebar contains these top-level items:
   - **API Keys** (`/api-keys`) — API key management.
   - **Settings** (`/settings`) — appearance and agent memory notes for every user; organization settings for admins.
 
-The right panel's **Project plan** tab shows the selected project's tasks; with a project selected, `/projects` opens it. **New project** in the project switcher starts agent-assisted project planning; projects are created only through the agent. Project detail pages (`/projects/{projectId}`) have **Tasks**, **Resources**, and **Sessions** tabs. **Tasks** filters by label and assignee; each project has its own task labels. Projects support sharing, archive, and deletion; resource permissions remain separate.
+The right panel's **Project plan** tab shows the selected project's tasks; with a project selected, `/projects` opens it. **New project** in the project switcher starts agent-assisted project planning; projects are created only through the agent. Project detail pages (`/projects/{projectId}`) have **Tasks**, **Resources**, and **Sessions** tabs. **Tasks** filters by label and assignee; each project has its own task labels. Projects support sharing, archive, and deletion; people with project access get the same access to its attached resources.
 
 Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user's name and email, lists the user's organizations and pending invitations, and contains **Sign Out**. Selecting an organization switches to it.