@superglue/cli 1.1.270 → 1.1.272

package/dist/skills/superglue/SKILL.md

@@ -587,6 +587,8 @@ Basic auth auto-encodes: if the value after `Basic ` isn't already base64, the e
 
 **Credential lifecycle:**
 
+OAuth saves provider metadata from both the callback and token response automatically, including company IDs and instance URLs. Ordinary field names become connection secrets, such as `realmId` or `instance_url`; use their `<<systemId_secretName>>` placeholders before asking the user for these values. The `oauth_metadata` secret holds the metadata as JSON under `callback` and `tokenResponse`, including nested fields and names that cannot be secret names. For example, `<<(data) => JSON.parse(data.my_api_oauth_metadata).tokenResponse.team.id>>` reads a nested team ID. Refresh preserves omitted metadata and updates fields the provider returns. Callback data cannot replace OAuth tokens or client configuration.
+
 - Pass all secret values via `--credentials '{"api_key":"...","client_secret":"..."}'` on create/edit
 - Use `sg system connection set --system-id <id> --credentials '{...}'` to save secrets on the current API-key user's connection
 - Use `sg system connection get --system-id <id>` to inspect the current user's secret names and whether each has a non-empty value; secret values are never returned

package/dist/skills/superglue/references/http.md

@@ -34,7 +34,7 @@ For APIs that require the same query key multiple times, use an array value:
 
 ## Authentication
 
-Saved tool steps never inject credentials: place auth headers explicitly with `<<systemId_credentialKey>>` placeholders. `sg system call` adds the `Authorization` header itself for `oauth2` (Bearer), `basic_auth` (Basic), and `api_key` (Bearer) systems; pass your own header only when the API expects a different one.
+Saved tool steps never inject credentials: place auth headers explicitly with `<<systemId_credentialKey>>` placeholders.
 
 ```javascript
 // Bearer token (including OAuth — token refresh is automatic, the step header is not)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superglue/cli",
-  "version": "1.1.270",
+  "version": "1.1.272",
   "bin": {
     "sg": "./dist/cli.js"
   },

package/skills/superglue/SKILL.md

@@ -587,6 +587,8 @@ Basic auth auto-encodes: if the value after `Basic ` isn't already base64, the e
 
 **Credential lifecycle:**
 
+OAuth saves provider metadata from both the callback and token response automatically, including company IDs and instance URLs. Ordinary field names become connection secrets, such as `realmId` or `instance_url`; use their `<<systemId_secretName>>` placeholders before asking the user for these values. The `oauth_metadata` secret holds the metadata as JSON under `callback` and `tokenResponse`, including nested fields and names that cannot be secret names. For example, `<<(data) => JSON.parse(data.my_api_oauth_metadata).tokenResponse.team.id>>` reads a nested team ID. Refresh preserves omitted metadata and updates fields the provider returns. Callback data cannot replace OAuth tokens or client configuration.
+
 - Pass all secret values via `--credentials '{"api_key":"...","client_secret":"..."}'` on create/edit
 - Use `sg system connection set --system-id <id> --credentials '{...}'` to save secrets on the current API-key user's connection
 - Use `sg system connection get --system-id <id>` to inspect the current user's secret names and whether each has a non-empty value; secret values are never returned

package/skills/superglue/references/http.md

@@ -34,7 +34,7 @@ For APIs that require the same query key multiple times, use an array value:
 
 ## Authentication
 
-Saved tool steps never inject credentials: place auth headers explicitly with `<<systemId_credentialKey>>` placeholders. `sg system call` adds the `Authorization` header itself for `oauth2` (Bearer), `basic_auth` (Basic), and `api_key` (Bearer) systems; pass your own header only when the API expects a different one.
+Saved tool steps never inject credentials: place auth headers explicitly with `<<systemId_credentialKey>>` placeholders.
 
 ```javascript
 // Bearer token (including OAuth — token refresh is automatic, the step header is not)