@superglue/cli 1.1.219 → 1.1.221

package/dist/skills/superglue/SKILL.md

@@ -229,12 +229,12 @@ sg project label create --project <projectId> --name "Blocked" --color "#ef4444"
 sg project task edit --project <projectId> --id <taskId> --labels blocked
 ```
 
-- `sg project task list` returns tasks in board order with each task's `position`. Add `--full` for descriptions and attachments.
+- `sg project task list` returns tasks in board order with each task's `position`. Add `--full` for descriptions.
 - A new task, or a status change without `--position`, goes to the end of its column. Other edits keep the order.
 - `sg project task edit` changes only the given fields. `--clear-due-date`, `--unassign`, and `--clear-labels` clear those fields.
 - Labels belong to one project. `--labels` takes comma-separated label IDs from `sg project label list` and replaces the task's labels. `sg project task list --label <ids>` returns tasks with any of those labels.
 - `sg project label create` derives the label ID from the name; without `--color` it picks the first unused palette color. `sg project label edit` renames or recolors a label and keeps its ID. `sg project label delete` removes the label from every task; the agent module cannot delete labels.
-- `--resource-refs` replaces the attachment list. Task attachments also join the project.
+- Tasks have no attachments. Name the files a task needs in its description; files link to projects only.
 - Tasks cannot be deleted from the CLI. Archived projects reject task writes.
 
 ---
@@ -385,16 +385,16 @@ Attach files with repeatable `--file key=path`. Reference in payloads with `file
 
 **Request step fields** (HTTP, Postgres, MSSQL, Redis, MongoDB, FTP/SFTP, SMB) — see protocol-specific references for full details:
 
-| Field         | Type   | Description                                                              |
-| ------------- | ------ | ------------------------------------------------------------------------ |
-| `type`        | string | `"request"` (default, can be omitted)                                    |
-| `systemId`    | string | Optional. Links system credentials for `<<systemId_credKey>>` resolution |
-| `url`         | string | Full URL with `<<variable>>` placeholders. Required.                     |
-| `method`      | string | HTTP method (HTTP only)                                                  |
-| `headers`     | object | HTTP headers with credential placeholders (HTTP only)                    |
-| `queryParams` | object | URL query parameters (HTTP only)                                         |
-| `body`        | string | Request body / DB query / Redis command / file operation                 |
-| `pagination`  | object | Auto-pagination config (HTTP only, see `sg skill http`)                  |
+| Field         | Type   | Description                                                        |
+| ------------- | ------ | ------------------------------------------------------------------ |
+| `type`        | string | `"request"` (default, can be omitted)                              |
+| `systemId`    | string | Optional. Resolves connection secrets as `<<systemId_secretName>>` |
+| `url`         | string | Full URL with `<<variable>>` placeholders. Required.               |
+| `method`      | string | HTTP method (HTTP only)                                            |
+| `headers`     | object | HTTP headers with credential placeholders (HTTP only)              |
+| `queryParams` | object | URL query parameters (HTTP only)                                   |
+| `body`        | string | Request body / DB query / Redis command / file operation           |
+| `pagination`  | object | Auto-pagination config (HTTP only, see `sg skill http`)            |
 
 **Transform step fields:**
 
@@ -423,8 +423,8 @@ All step config fields (url, headers, body, queryParams) support `<<expression>>
 <<userId>>             payload inputs
 <<currentItem>>        whole current loop item
 <<page>> <<offset>> <<cursor>> <<limit>> <<pageSize>>   pagination variables
-<<systemId_api_key>>   system credentials (namespaced: systemId_credKey)
-<<systemId_url>>       system base URLs (namespaced: systemId_url)
+<<systemId_api_key>>   connection secrets (namespaced: systemId_secretName)
+<<systemId_url>>       connection base URLs (namespaced: systemId_url)
 <<sg_auth_email>>      email of the user triggering this run (in scheduled runs: the schedule creator)
 <<sg_auth_jwt>>        short-lived signed JWT proving the identity of the user triggering this run; receivers verify it against superglue's outbound JWKS endpoint (/api/auth/outbound-jwks on the web app origin)
 ```
@@ -485,7 +485,7 @@ sourceData = {
 - State gives at-least-once execution with progress tracking, never exactly-once: crashes, concurrent-run conflicts, and state resets all cause re-processing, which re-executes side effects. Steps that write to external systems MUST be replay-safe — upsert by a stable external id or pass an idempotency key — or duplicates will land in the target system.
 - Keep set-valued keys bounded (e.g. keep only the most recent ~1,000 ids): an unbounded set eventually exceeds the 64KB value limit, which rejects the tool's entire state write on every run.
 - Never copy credential values into state — state is stored unencrypted and readable by anyone with read access to the tool.
-- Inspect current state via `sg tool state get <toolId>` (values matching known system credentials are masked); reset it via `sg tool state reset <toolId>`. A reset wins over in-flight runs: their updates to pre-reset keys are discarded as conflicts; only keys they newly add are kept.
+- Inspect current state via `sg tool state get <toolId>` (values matching known connection secrets are masked); reset it via `sg tool state reset <toolId>`. A reset wins over in-flight runs: their updates to pre-reset keys are discarded as conflicts; only keys they newly add are kept.
 - Set state deliberately via `sg tool state set <toolId> --state '<json>'` (or `--state-file`) — a full replace, subject to the same key and size limits. To test warm-state behavior without touching real state, pass `--state-fixture '<json>'` (or `--state-fixture-file`) to `sg tool run`: it seeds `sourceData.persistedState` for that run and the run never saves state changes. Side effects still execute, including `tool:` chain webhooks — a chained tool runs for real against its own real state.
 
 ### Naming Rules — Avoiding Key Collisions
@@ -495,7 +495,7 @@ Everything in `sourceData` shares ONE flat namespace. Saving a tool rejects payl
 - `__files__`, `currentItem`, `persistedState`, `sg_auth_email`, `sg_auth_jwt` — injected by the runtime
 - `page`, `offset`, `cursor`, `limit`, `pageSize` — rejected only when the tool has a paginated step, because they would shadow the live pagination counters; on non-paginated tools they are allowed but discouraged (a later edit that adds pagination will force a rename)
 - the tool's own step ids — the step result overwrites a same-named payload key
-- anything starting with `<systemId>_` for a system the tool uses — the entire prefix is reserved for namespaced credentials (`<systemId>_<credKey>`, `<systemId>_url`), even names that don't match an existing credential, because credentials added to the system later would silently shadow the input
+- anything starting with `<systemId>_` for a system the tool uses — the entire prefix is reserved for namespaced secrets (`<systemId>_<secretName>`, `<systemId>_url`), even names that don't match an existing secret, because secrets added to a connection later would silently shadow the input
 
 Safe naming: payload inputs get specific, domain-flavored names (`customerId`, `reportMonth`, `maxResults` — prefer `maxResults` over `limit` even on non-paginated tools, and never prefix an input with a referenced system's id); step ids are verb-prefixed camelCase (`fetchUsers`) and distinct from every payload key. If the user asks for an input named like a reserved key, use a safe alternative and explain why.
 

package/dist/skills/superglue/references/access-rules.md

@@ -1,13 +1,13 @@
 # Access Rules (RBAC)
 
-On superglue, roles define active resource grants for tools, credentials, playbooks, artifacts, files, and projects. Systems are not a resource: a system id is a plain string on connections and tool steps. Users can have multiple roles. Roles and access rules are only available on enterprise organizations.
+On superglue, roles define active resource grants for tools, credentials, playbooks, files, and projects. Files include uploads and agent-written HTML documents and spreadsheets. Systems are not a resource: a system id is a plain string on connections and tool steps. Users can have multiple roles. Roles and access rules are only available on enterprise organizations.
 
 ## Data Model
 
 ```typescript
 interface ResourceGrant {
   roleId: string;
-  resourceRef: "<kind>:<encodedId>" | "<kind>:*"; // kind: tool | credential | playbook | artifact | file | project
+  resourceRef: "<kind>:<encodedId>" | "<kind>:*"; // kind: tool | credential | playbook | file | project
   permissions: Array<"viewer" | "editor">;
   source: "access_rule" | "ownership" | "share" | "project"; // project: computed from project access, never stored
   grantedByUserId?: string;
@@ -83,13 +83,13 @@ Users can also have additional custom roles on top of their base role. Custom ro
 Personal roles are per-user containers for ownership and user-targeted share grants.
 
 - Each user can have at most one personal role.
-- Ownership grants are added automatically when a user creates a tool, connection, playbook, artifact, file, or project.
+- Ownership grants are added automatically when a user creates a tool, connection, playbook, file, or project.
 - Personal role grants are unioned with the user's other roles.
 - Ordinary role edits preserve personal roles and their ownership/share grants.
 
 ## Sharing Semantics
 
-Sharing supports saved tools, connections, projects, playbooks, artifacts, and files.
+Sharing supports saved tools, connections, projects, playbooks, and files.
 
 - Targets are organization users or roles. The admin role and personal roles cannot be role targets.
 - User-targeted shares live on personal roles; role-targeted shares live on the selected role.
@@ -99,7 +99,7 @@ Sharing supports saved tools, connections, projects, playbooks, artifacts, and f
 - Recipients can remove their own direct share, including connection shares, without editor access.
 - Sharing a tool shares only the tool. The recipient still needs a connection for every system id it references.
 - Sharing playbooks does not cascade to their tools or connections.
-- Access to a project gives the same access (viewer or editor) to every resource attached to it. Removing the resource from the project, removing the project access, or archiving the project removes that access. Anyone with access to a project, including viewers, can attach a resource they can share. Project editors and people who can share a resource can remove it from the project.
+- Access to a project gives the same access (viewer or editor) to every file and tool linked to it. Removing the file or tool from the project, removing the project access, or archiving the project removes that access. Anyone with access to a project, including viewers, can link a file or tool they can share. Project editors and people who can share a file or tool can remove it from the project. Playbooks and connections are never shared through projects.
 
 ## Auto-Grant On Resource Creation
 

package/dist/skills/superglue/references/graphql.md

@@ -26,7 +26,7 @@ GraphQL APIs use HTTP POST under the hood. This skill covers the GraphQL-specifi
 | `method`   | yes      | Always `POST`                                          |
 | `headers`  | yes      | Must include `Content-Type: application/json` and auth |
 | `body`     | yes      | JSON string with `query` and optional `variables`      |
-| `systemId` | no       | Links system credentials and URL                       |
+| `systemId` | no       | Resolves connection secrets and URL                    |
 
 ### Body Format
 

package/dist/skills/superglue/references/http.md

@@ -27,7 +27,7 @@ All fields support `<<variable>>` and `<<(sourceData) => ...>>` expressions.
 | `queryParams` | no       | Key-value pairs appended to URL                                                                              |
 | `body`        | no       | Stripped for GET/HEAD/DELETE/OPTIONS                                                                         |
 | `pagination`  | no       | See Pagination section                                                                                       |
-| `systemId`    | no       | Links system credentials and URL. Omit for public APIs                                                       |
+| `systemId`    | no       | Resolves connection secrets and URL. Omit for public APIs                                                    |
 
 For APIs that require the same query key multiple times, use an array value:
 `{ metadataHeaders: ["From", "Subject"] }` -> `?metadataHeaders=From&metadataHeaders=Subject`.

package/dist/skills/superglue/references/mongodb.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON: single operation object or array of operations           |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON: single operation object or array of operations     |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/dist/skills/superglue/references/mssql.md

@@ -21,11 +21,11 @@ Configure the connection URL based on the selected connection's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON string with `query` and optional `params`                 |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON string with `query` and optional `params`           |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/dist/skills/superglue/references/odbc.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON string with `query` and optional `params`                 |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON string with `query` and optional `params`           |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/dist/skills/superglue/references/postgres.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON string with `query` and optional `params`                 |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON string with `query` and optional `params`           |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/dist/skills/superglue/references/redis.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON: single command object or array for pipeline              |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON: single command object or array for pipeline        |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/dist/skills/superglue/references/sftp-smb.md

@@ -21,11 +21,11 @@ Configure the connection URL based on the selected connection's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON: single operation object or array for batch               |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON: single operation object or array for batch         |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Formats
 

package/dist/skills/superglue/references/superglue-info.md

@@ -76,16 +76,12 @@ If a customer's system requires IP allowlisting for firewall rules, security gro
 
 Use this section as the source of truth for high-level web app navigation. Do not invent UI locations that are not listed here.
 
-Brain contains context-source setup, playbooks, artifacts, and files. Capabilities contains tools, connections, MCP servers, and schedules; tools are project-attachable, the others configure execution. A system is only the system ID that groups connections and tool steps. Projects are managed separately and group selected context and capabilities. People with project access get the same access to its attached resources.
+Brain contains context-source setup, project folders, playbooks, and files. Files include uploads and the artifacts and spreadsheets that agents write; a file can belong to several projects. Capabilities contains tools, connections, MCP servers, and schedules; tools can be linked to projects, the others configure execution. A system is only the system ID that groups connections and tool steps. Projects are managed separately; a project links brain files and tools, and people with project access get the same access to them; playbooks are org-wide.
 
 The persistent left sidebar contains these top-level items:
 
-- The project switcher and session list — always visible at the top. The project switcher selects one project or **All projects**. The selection sets which sessions the list shows, whether the right panel shows a project plan, and which project new sessions start in. With a project selected, the list shows only that project's sessions. With **All projects**, the list shows all sessions, each labeled with its project, and new sessions start at the organization level without a project. Choosing an item in the switcher starts a new session there. The switcher footer has **New project**, which starts agent-assisted project planning; with a project selected, it also opens the project page, pins or unpins the project, and archives it. **New session** starts a session in the selected project. When a project is selected and the user opens a session from another project, the selection changes to that project. `/` opens a new session in the selected project; saved sessions open `/agents/{sessionId}`. Archived projects and their sessions are hidden. A briefing run appears here after the user opens it from the briefing email or **View last briefing**.
-- **Brain** — expandable group for context and focused work:
-  - **Setup** (`/brain`) — context-source connections that use only the current user's personal credentials.
-  - **Playbooks** (`/playbooks`, detail at `/playbooks/{playbookId}`) — reusable guidance for recurring work. Built-in and custom playbooks share one grid; built-ins are labeled and can be duplicated.
-  - **Artifacts** (`/artifacts`, detail at `/artifacts/{artifactId}`) — interactive outputs.
-  - **Files** (`/files`) — uploaded source material.
+- The project switcher and session list — always visible at the top. The switcher selects one project or **All projects**, which scopes the session list and new sessions; `/` starts a session and `/agents/{sessionId}` opens a saved one. New projects are planned with the agent.
+- **Brain** (`/brain`) — a file drive: the managed **Documentation** (system documentation and scraped pages) and **Playbooks** folders, one folder per project (`/brain/projects/{projectId}`), and files in no project. Files open at `/brain/files/{fileId}` and playbooks at `/brain/playbooks/{playbookId}`. Users upload files and drag them onto project folders to link them. **Setup** (`/brain/setup`) connects context sources with the user's own credentials.
 - **Capabilities** — expandable group for connected and executable resources:
   - **Tools** (`/tools`, detail at `/tools/{toolId}`) — saved tools; opens the tool playground for editing, testing, and running.
   - **Connections** (`/connections`, detail at `/connections/{connectionId}`) — connections to external services, grouped by system id, with secret status per connection; yours and the ones shared with you. A system ID is a namespace derived from existing connections; no system record is created. API keys are not managed here.
@@ -99,11 +95,11 @@ The persistent left sidebar contains these top-level items:
   - **API Keys** (`/api-keys`) — API key management.
   - **Settings** (`/settings`) — appearance and agent memory notes for every user; organization settings for admins.
 
-The right panel's **Project plan** tab shows the selected project's tasks; with a project selected, `/projects` opens it. **New project** in the project switcher starts agent-assisted project planning; projects are created only through the agent. Project detail pages (`/projects/{projectId}`) have **Tasks**, **Resources**, and **Sessions** tabs. **Tasks** filters by label and assignee; each project has its own task labels. Projects support sharing, archive, and deletion; people with project access get the same access to its attached resources.
+The right panel's **Project plan** tab shows the selected project's tasks; with a project selected, `/projects` opens it. **New project** in the project switcher starts agent-assisted project planning; projects are created only through the agent. A project's page is its Brain folder (`/brain/projects/{projectId}`), with **Files** (the default) and **Tasks** tabs. **Tasks** filters by label and assignee; each project has its own task labels. Projects support sharing, archive, and deletion; people with project access get the same access to its linked files.
 
 Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user's name and email, lists the user's organizations and pending invitations, and contains **Sign Out**. Selecting an organization switches to it.
 
-After onboarding, while no context source is connected, a banner at the top of every page except Brain offers to connect email. **Set up** opens **Brain > Setup** (`/brain`), and the close button hides the banner for 7 days in that browser.
+While a brain setup step is open, a banner at the top of **Brain** links to **Brain > Setup** (`/brain/setup`), and the close button hides it for 7 days in that browser.
 
 When cloud billing is enabled, Trial organizations see **Upgrade Plan** in the sidebar, which opens a 15-minute call booking page. The app shows no pricing. For Pro and Team organizations, admins see **Manage Plan** in the organization menu, which opens the Stripe portal. Enterprise organizations see neither. Do not quote prices. For pricing questions, point users to **Upgrade Plan** to book a call. There is no separate Billing page.
 
@@ -113,7 +109,7 @@ When cloud billing is enabled, Trial organizations see **Upgrade Plan** in the s
 
 - **Appearance** — light, dark, or system theme.
 - **Organization** — organization name.
-- **Design system** (`/settings/design-system`) — the brand every artifact follows: colors, fonts, logos, guidelines, HTML, Word, and PowerPoint templates, reference documents, and an import from the company website.
+- **Design system** (`/settings/design-system`) — the brand every document follows: colors, fonts, logos, guidelines, HTML, Word, and PowerPoint templates, reference documents, and an import from the company website.
 - **Run settings** — run preferences: draft/single-step run visibility, run result storage, member run visibility, and delete-all-runs.
 - **Notifications** — run-alert channels for Slack and email (on failure, success, completion, or daily/weekly summaries). Slack setup opens `/settings/notifications/slack`; email setup opens `/settings/notifications/email`.
 - **Agent memory** (`/settings#settings-memory`) — every user adds, edits, and deletes their personal and organization memory notes; admins also turn agent memory on or off.
@@ -128,7 +124,7 @@ When cloud billing is enabled, Trial organizations see **Upgrade Plan** in the s
 1. **Validate** tool structure (id, steps array, URLs on request steps)
 2. **For each step in order:**
    a. Build aggregated data: `{ ...originalPayload, ...previousStepResults }`
-   b. Resolve system credentials (refresh OAuth if needed), namespace as `systemId_key`
+   b. Resolve connection secrets (refresh OAuth if needed), namespace as `systemId_secretName`
    c. Run `dataSelector` → object means single execution, array means loop
    d. For each item: merge `currentItem` into input and execute
    e. Wrap result: `{ currentItem, data, success }`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superglue/cli",
-  "version": "1.1.219",
+  "version": "1.1.221",
   "bin": {
     "sg": "./dist/cli.js"
   },

package/skills/superglue/SKILL.md

@@ -229,12 +229,12 @@ sg project label create --project <projectId> --name "Blocked" --color "#ef4444"
 sg project task edit --project <projectId> --id <taskId> --labels blocked
 ```
 
-- `sg project task list` returns tasks in board order with each task's `position`. Add `--full` for descriptions and attachments.
+- `sg project task list` returns tasks in board order with each task's `position`. Add `--full` for descriptions.
 - A new task, or a status change without `--position`, goes to the end of its column. Other edits keep the order.
 - `sg project task edit` changes only the given fields. `--clear-due-date`, `--unassign`, and `--clear-labels` clear those fields.
 - Labels belong to one project. `--labels` takes comma-separated label IDs from `sg project label list` and replaces the task's labels. `sg project task list --label <ids>` returns tasks with any of those labels.
 - `sg project label create` derives the label ID from the name; without `--color` it picks the first unused palette color. `sg project label edit` renames or recolors a label and keeps its ID. `sg project label delete` removes the label from every task; the agent module cannot delete labels.
-- `--resource-refs` replaces the attachment list. Task attachments also join the project.
+- Tasks have no attachments. Name the files a task needs in its description; files link to projects only.
 - Tasks cannot be deleted from the CLI. Archived projects reject task writes.
 
 ---
@@ -385,16 +385,16 @@ Attach files with repeatable `--file key=path`. Reference in payloads with `file
 
 **Request step fields** (HTTP, Postgres, MSSQL, Redis, MongoDB, FTP/SFTP, SMB) — see protocol-specific references for full details:
 
-| Field         | Type   | Description                                                              |
-| ------------- | ------ | ------------------------------------------------------------------------ |
-| `type`        | string | `"request"` (default, can be omitted)                                    |
-| `systemId`    | string | Optional. Links system credentials for `<<systemId_credKey>>` resolution |
-| `url`         | string | Full URL with `<<variable>>` placeholders. Required.                     |
-| `method`      | string | HTTP method (HTTP only)                                                  |
-| `headers`     | object | HTTP headers with credential placeholders (HTTP only)                    |
-| `queryParams` | object | URL query parameters (HTTP only)                                         |
-| `body`        | string | Request body / DB query / Redis command / file operation                 |
-| `pagination`  | object | Auto-pagination config (HTTP only, see `sg skill http`)                  |
+| Field         | Type   | Description                                                        |
+| ------------- | ------ | ------------------------------------------------------------------ |
+| `type`        | string | `"request"` (default, can be omitted)                              |
+| `systemId`    | string | Optional. Resolves connection secrets as `<<systemId_secretName>>` |
+| `url`         | string | Full URL with `<<variable>>` placeholders. Required.               |
+| `method`      | string | HTTP method (HTTP only)                                            |
+| `headers`     | object | HTTP headers with credential placeholders (HTTP only)              |
+| `queryParams` | object | URL query parameters (HTTP only)                                   |
+| `body`        | string | Request body / DB query / Redis command / file operation           |
+| `pagination`  | object | Auto-pagination config (HTTP only, see `sg skill http`)            |
 
 **Transform step fields:**
 
@@ -423,8 +423,8 @@ All step config fields (url, headers, body, queryParams) support `<<expression>>
 <<userId>>             payload inputs
 <<currentItem>>        whole current loop item
 <<page>> <<offset>> <<cursor>> <<limit>> <<pageSize>>   pagination variables
-<<systemId_api_key>>   system credentials (namespaced: systemId_credKey)
-<<systemId_url>>       system base URLs (namespaced: systemId_url)
+<<systemId_api_key>>   connection secrets (namespaced: systemId_secretName)
+<<systemId_url>>       connection base URLs (namespaced: systemId_url)
 <<sg_auth_email>>      email of the user triggering this run (in scheduled runs: the schedule creator)
 <<sg_auth_jwt>>        short-lived signed JWT proving the identity of the user triggering this run; receivers verify it against superglue's outbound JWKS endpoint (/api/auth/outbound-jwks on the web app origin)
 ```
@@ -485,7 +485,7 @@ sourceData = {
 - State gives at-least-once execution with progress tracking, never exactly-once: crashes, concurrent-run conflicts, and state resets all cause re-processing, which re-executes side effects. Steps that write to external systems MUST be replay-safe — upsert by a stable external id or pass an idempotency key — or duplicates will land in the target system.
 - Keep set-valued keys bounded (e.g. keep only the most recent ~1,000 ids): an unbounded set eventually exceeds the 64KB value limit, which rejects the tool's entire state write on every run.
 - Never copy credential values into state — state is stored unencrypted and readable by anyone with read access to the tool.
-- Inspect current state via `sg tool state get <toolId>` (values matching known system credentials are masked); reset it via `sg tool state reset <toolId>`. A reset wins over in-flight runs: their updates to pre-reset keys are discarded as conflicts; only keys they newly add are kept.
+- Inspect current state via `sg tool state get <toolId>` (values matching known connection secrets are masked); reset it via `sg tool state reset <toolId>`. A reset wins over in-flight runs: their updates to pre-reset keys are discarded as conflicts; only keys they newly add are kept.
 - Set state deliberately via `sg tool state set <toolId> --state '<json>'` (or `--state-file`) — a full replace, subject to the same key and size limits. To test warm-state behavior without touching real state, pass `--state-fixture '<json>'` (or `--state-fixture-file`) to `sg tool run`: it seeds `sourceData.persistedState` for that run and the run never saves state changes. Side effects still execute, including `tool:` chain webhooks — a chained tool runs for real against its own real state.
 
 ### Naming Rules — Avoiding Key Collisions
@@ -495,7 +495,7 @@ Everything in `sourceData` shares ONE flat namespace. Saving a tool rejects payl
 - `__files__`, `currentItem`, `persistedState`, `sg_auth_email`, `sg_auth_jwt` — injected by the runtime
 - `page`, `offset`, `cursor`, `limit`, `pageSize` — rejected only when the tool has a paginated step, because they would shadow the live pagination counters; on non-paginated tools they are allowed but discouraged (a later edit that adds pagination will force a rename)
 - the tool's own step ids — the step result overwrites a same-named payload key
-- anything starting with `<systemId>_` for a system the tool uses — the entire prefix is reserved for namespaced credentials (`<systemId>_<credKey>`, `<systemId>_url`), even names that don't match an existing credential, because credentials added to the system later would silently shadow the input
+- anything starting with `<systemId>_` for a system the tool uses — the entire prefix is reserved for namespaced secrets (`<systemId>_<secretName>`, `<systemId>_url`), even names that don't match an existing secret, because secrets added to a connection later would silently shadow the input
 
 Safe naming: payload inputs get specific, domain-flavored names (`customerId`, `reportMonth`, `maxResults` — prefer `maxResults` over `limit` even on non-paginated tools, and never prefix an input with a referenced system's id); step ids are verb-prefixed camelCase (`fetchUsers`) and distinct from every payload key. If the user asks for an input named like a reserved key, use a safe alternative and explain why.
 

package/skills/superglue/references/access-rules.md

@@ -1,13 +1,13 @@
 # Access Rules (RBAC)
 
-On superglue, roles define active resource grants for tools, credentials, playbooks, artifacts, files, and projects. Systems are not a resource: a system id is a plain string on connections and tool steps. Users can have multiple roles. Roles and access rules are only available on enterprise organizations.
+On superglue, roles define active resource grants for tools, credentials, playbooks, files, and projects. Files include uploads and agent-written HTML documents and spreadsheets. Systems are not a resource: a system id is a plain string on connections and tool steps. Users can have multiple roles. Roles and access rules are only available on enterprise organizations.
 
 ## Data Model
 
 ```typescript
 interface ResourceGrant {
   roleId: string;
-  resourceRef: "<kind>:<encodedId>" | "<kind>:*"; // kind: tool | credential | playbook | artifact | file | project
+  resourceRef: "<kind>:<encodedId>" | "<kind>:*"; // kind: tool | credential | playbook | file | project
   permissions: Array<"viewer" | "editor">;
   source: "access_rule" | "ownership" | "share" | "project"; // project: computed from project access, never stored
   grantedByUserId?: string;
@@ -83,13 +83,13 @@ Users can also have additional custom roles on top of their base role. Custom ro
 Personal roles are per-user containers for ownership and user-targeted share grants.
 
 - Each user can have at most one personal role.
-- Ownership grants are added automatically when a user creates a tool, connection, playbook, artifact, file, or project.
+- Ownership grants are added automatically when a user creates a tool, connection, playbook, file, or project.
 - Personal role grants are unioned with the user's other roles.
 - Ordinary role edits preserve personal roles and their ownership/share grants.
 
 ## Sharing Semantics
 
-Sharing supports saved tools, connections, projects, playbooks, artifacts, and files.
+Sharing supports saved tools, connections, projects, playbooks, and files.
 
 - Targets are organization users or roles. The admin role and personal roles cannot be role targets.
 - User-targeted shares live on personal roles; role-targeted shares live on the selected role.
@@ -99,7 +99,7 @@ Sharing supports saved tools, connections, projects, playbooks, artifacts, and f
 - Recipients can remove their own direct share, including connection shares, without editor access.
 - Sharing a tool shares only the tool. The recipient still needs a connection for every system id it references.
 - Sharing playbooks does not cascade to their tools or connections.
-- Access to a project gives the same access (viewer or editor) to every resource attached to it. Removing the resource from the project, removing the project access, or archiving the project removes that access. Anyone with access to a project, including viewers, can attach a resource they can share. Project editors and people who can share a resource can remove it from the project.
+- Access to a project gives the same access (viewer or editor) to every file and tool linked to it. Removing the file or tool from the project, removing the project access, or archiving the project removes that access. Anyone with access to a project, including viewers, can link a file or tool they can share. Project editors and people who can share a file or tool can remove it from the project. Playbooks and connections are never shared through projects.
 
 ## Auto-Grant On Resource Creation
 

package/skills/superglue/references/graphql.md

@@ -26,7 +26,7 @@ GraphQL APIs use HTTP POST under the hood. This skill covers the GraphQL-specifi
 | `method`   | yes      | Always `POST`                                          |
 | `headers`  | yes      | Must include `Content-Type: application/json` and auth |
 | `body`     | yes      | JSON string with `query` and optional `variables`      |
-| `systemId` | no       | Links system credentials and URL                       |
+| `systemId` | no       | Resolves connection secrets and URL                    |
 
 ### Body Format
 

package/skills/superglue/references/http.md

@@ -27,7 +27,7 @@ All fields support `<<variable>>` and `<<(sourceData) => ...>>` expressions.
 | `queryParams` | no       | Key-value pairs appended to URL                                                                              |
 | `body`        | no       | Stripped for GET/HEAD/DELETE/OPTIONS                                                                         |
 | `pagination`  | no       | See Pagination section                                                                                       |
-| `systemId`    | no       | Links system credentials and URL. Omit for public APIs                                                       |
+| `systemId`    | no       | Resolves connection secrets and URL. Omit for public APIs                                                    |
 
 For APIs that require the same query key multiple times, use an array value:
 `{ metadataHeaders: ["From", "Subject"] }` -> `?metadataHeaders=From&metadataHeaders=Subject`.

package/skills/superglue/references/mongodb.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON: single operation object or array of operations           |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON: single operation object or array of operations     |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/skills/superglue/references/mssql.md

@@ -21,11 +21,11 @@ Configure the connection URL based on the selected connection's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON string with `query` and optional `params`                 |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON string with `query` and optional `params`           |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/skills/superglue/references/odbc.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON string with `query` and optional `params`                 |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON string with `query` and optional `params`           |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/skills/superglue/references/postgres.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON string with `query` and optional `params`                 |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON string with `query` and optional `params`           |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/skills/superglue/references/redis.md

@@ -19,11 +19,11 @@ Configure the connection URL based on the selected credential's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON: single command object or array for pipeline              |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON: single command object or array for pipeline        |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Format
 

package/skills/superglue/references/sftp-smb.md

@@ -21,11 +21,11 @@ Configure the connection URL based on the selected connection's secrets — use
 
 ### Fields
 
-| Field      | Required | Notes                                                          |
-| ---------- | -------- | -------------------------------------------------------------- |
-| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
-| `body`     | yes      | JSON: single operation object or array for batch               |
-| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+| Field      | Required | Notes                                                    |
+| ---------- | -------- | -------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders     |
+| `body`     | yes      | JSON: single operation object or array for batch         |
+| `systemId` | no       | Resolves connection secrets as `<<systemId_secretName>>` |
 
 ### URL Formats