@superglue/cli 1.1.30 → 1.1.31

package/dist/skills/superglue/SKILL.md

@@ -5,7 +5,7 @@ description: "Build, test, deploy and integrate superglue tools via the sg CLI a
 
 # superglue CLI (`sg`) — Agent Reference
 
-This file is the entry point for operating superglue via the `sg` CLI. It covers setup, tool building, tool editing, system management, running tools, and deployment via SDK/REST/webhooks.
+This file is the entry point for operating superglue via the `sg` CLI. It covers setup, tool building, tool editing, system management, running tools, schedules, and deployment via SDK/REST/webhooks.
 
 For protocol-specific details (HTTP, databases, Redis, file servers, GraphQL), file handling, access rules, SDK integration, and general superglue information, run `sg skill <topic>` (linked throughout and listed at the bottom).
 
@@ -77,7 +77,7 @@ The CLI will not work until configured with an API key. The endpoint defaults to
 sg init
 ```
 
-Prompts for: API key (required — get one at https://app.superglue.cloud/admin?view=api-keys), API endpoint, web endpoint (for OAuth callbacks), output mode (`stdout` or `stdout+file`), and config location (project-local `.superglue/config.json` vs global `~/.superglue/config.json`). Verifies the connection before saving.
+Prompts for: API key (required — get one at https://app.superglue.cloud/api-keys), API endpoint, web endpoint (for OAuth callbacks), output mode (`stdout` or `stdout+file`), and config location (project-local `.superglue/config.json` vs global `~/.superglue/config.json`). Verifies the connection before saving.
 
 **Non-interactive (CI, agents):**
 
@@ -103,11 +103,11 @@ Verify with `sg system list` — should return a list (possibly empty) without e
 
 Set during `sg init` or via `SUPERGLUE_CLI_PRESET` env var. Stored in `config.json` as `"preset"`.
 
-| Preset    | Description                                                                      |
-| --------- | -------------------------------------------------------------------------------- |
-| `runner`  | Run saved tools by ID only. Read-only lookups. No building/editing               |
-| `builder` | Runner + build/edit/save tools, call systems, manage MCP servers. No system CRUD |
-| `admin`   | Full access (default)                                                            |
+| Preset    | Description                                                                                    |
+| --------- | ---------------------------------------------------------------------------------------------- |
+| `runner`  | Run saved tools by ID only. Read-only lookups. No building/editing                             |
+| `builder` | Runner + build/edit/save tools, call systems, manage MCP servers and schedules. No system CRUD |
+| `admin`   | Full access (default)                                                                          |
 
 Blocked commands print a clear error showing the current preset and how to change it.
 
@@ -185,6 +185,26 @@ Auth modes:
 
 If `sg mcp ...` returns "MCP server management is not available", the target instance or plan does not support named MCP server management. The default all-tools MCP endpoint may still be usable at `<api-endpoint>/mcp`.
 
+### Creating/Editing Tool Schedules
+
+Schedules run saved tools on cron expressions. Use 5-field cron syntax and an IANA timezone.
+
+```bash
+sg schedule list
+sg schedule list --tool <toolId>
+sg schedule create --tool daily_report --cron "0 9 * * 1-5" --timezone UTC
+sg schedule edit --tool daily_report --id <scheduleId> --disabled
+sg schedule edit --tool daily_report --id <scheduleId> --cron "0 8 * * *" --timezone UTC
+```
+
+Optional flags:
+
+- `--payload '{"key":"value"}'` or `--payload-file payload.json` sets the scheduled run payload.
+- `--webhook-url <url>` posts results to a webhook after success.
+- `--tool-chain <toolId>` runs another saved tool after success.
+- `--retries <n>` and `--timeout <ms>` set request options.
+- `--clear-webhook` removes the webhook/tool-chain success action during edit.
+
 ---
 
 ## Reference
@@ -193,27 +213,29 @@ If `sg mcp ...` returns "MCP server management is not available", the target ins
 
 Agents familiar with the web tool names can map them directly to CLI commands:
 
-| Web agent tool                                   | CLI command                                   | Notes                                                              |
-| ------------------------------------------------ | --------------------------------------------- | ------------------------------------------------------------------ |
-| `build_tool`                                     | `sg tool build --config '{...}'`              | CLI is not AI-powered — you provide the full JSON config           |
-| `edit_tool`                                      | `sg tool edit --tool <id> --patches '[...]'`  | JSON Patch (RFC 6902). Use `--draft <id>` for drafts               |
-| `run_tool`                                       | `sg tool run --tool <id>` / `--draft <id>`    | Add `--include-step-results` to inspect per-step data              |
-| `save_tool`                                      | `sg tool save --draft <draftId>`              | Persists a draft to the database                                   |
-| `run_command` with `vfs` for `/org/tools/`       | `sg tool find --id <id>` / `sg tool find <q>` | Full config with `--id`, compact search with a query string        |
-| `create_system`                                  | `sg system create --name "..." --url "..."`   | Use `--template <id>` when available                               |
-| `edit_system`                                    | `sg system edit --id <id> ...`                | Supports `--env dev\|prod`                                         |
-| `run_command` with `vfs` for `/org/systems/`     | `sg system find <query>` / `--id <id>`        | Returns `storedCredentials` and system URL                         |
-| Credentials VFS / user-owned credentials         | `sg system credentials get/set/clear`         | Manage current user's credentials for user-owned systems           |
-| `call_system`                                    | `sg system call --url "..." --system-id <id>` | Authenticated ad-hoc calls for testing / schema introspection      |
-| `run_command search`                             | `sg system search-docs --system-id <id> -k`   | Targeted keyword search over ingested system docs                  |
-| `authenticate_oauth`                             | `sg system oauth --system-id <id> [--scopes]` | Opens browser flow. Supports `--grant-type client_credentials` too |
-| `run_command` with `vfs` for `/org/runs/`        | `sg run list` / `sg run get <runId>`          | Filter `list` by `--tool`, `--status`, `--source`, `--limit`       |
-| `run_command` with `vfs` for `/org/mcp-servers/` | `sg mcp list` / `sg mcp find --id <id>`       | Returns endpoint, auth mode, selected tool IDs, and client config  |
-| `create_mcp_server`                              | `sg mcp create --name <n> --tool <id>`        | Creates a named MCP endpoint for selected saved tools              |
-| `edit_mcp_server`                                | `sg mcp edit --id <id> ...`                   | Edits name, auth mode, description, or selected tool IDs           |
-| (no direct equivalent)                           | `sg init`, `sg update`, `sg skill`            | CLI-specific setup, updater, and this reference system             |
-
-Web-agent-only concepts with no CLI equivalent: `run_command`'s virtual filesystem (CLI uses concrete `sg` subcommands), `create_schedule`/`edit_schedule` (manage schedules via web app or REST API), `authenticate_oauth`'s dedicated MCP `authenticate` tool (CLI uses `sg system oauth`).
+| Web agent tool                                   | CLI command                                    | Notes                                                              |
+| ------------------------------------------------ | ---------------------------------------------- | ------------------------------------------------------------------ |
+| `build_tool`                                     | `sg tool build --config '{...}'`               | CLI is not AI-powered — you provide the full JSON config           |
+| `edit_tool`                                      | `sg tool edit --tool <id> --patches '[...]'`   | JSON Patch (RFC 6902). Use `--draft <id>` for drafts               |
+| `run_tool`                                       | `sg tool run --tool <id>` / `--draft <id>`     | Add `--include-step-results` to inspect per-step data              |
+| `save_tool`                                      | `sg tool save --draft <draftId>`               | Persists a draft to the database                                   |
+| `run_command` with `vfs` for `/org/tools/`       | `sg tool find --id <id>` / `sg tool find <q>`  | Full config with `--id`, compact search with a query string        |
+| `create_system`                                  | `sg system create --name "..." --url "..."`    | Use `--template <id>` when available                               |
+| `edit_system`                                    | `sg system edit --id <id> ...`                 | Supports `--env dev\|prod`                                         |
+| `run_command` with `vfs` for `/org/systems/`     | `sg system find <query>` / `--id <id>`         | Returns `storedCredentials` and system URL                         |
+| Credentials VFS / user-owned credentials         | `sg system credentials get/set/clear`          | Manage current user's credentials for user-owned systems           |
+| `call_system`                                    | `sg system call --url "..." --system-id <id>`  | Authenticated ad-hoc calls for testing / schema introspection      |
+| `run_command search`                             | `sg system search-docs --system-id <id> -k`    | Targeted keyword search over ingested system docs                  |
+| `authenticate_oauth`                             | `sg system oauth --system-id <id> [--scopes]`  | Opens browser flow. Supports `--grant-type client_credentials` too |
+| `run_command` with `vfs` for `/org/runs/`        | `sg run list` / `sg run get <runId>`           | Filter `list` by `--tool`, `--status`, `--source`, `--limit`       |
+| `run_command` with `vfs` for `/org/mcp-servers/` | `sg mcp list` / `sg mcp find --id <id>`        | Returns endpoint, auth mode, selected tool IDs, and client config  |
+| `create_mcp_server`                              | `sg mcp create --name <n> --tool <id>`         | Creates a named MCP endpoint for selected saved tools              |
+| `edit_mcp_server`                                | `sg mcp edit --id <id> ...`                    | Edits name, auth mode, description, or selected tool IDs           |
+| `create_schedule`                                | `sg schedule create --tool <id> --cron <expr>` | Creates a cron schedule for a saved tool                           |
+| `edit_schedule`                                  | `sg schedule edit --tool <id> --id <schedule>` | Updates, enables, or disables an existing schedule                 |
+| (no direct equivalent)                           | `sg init`, `sg update`, `sg skill`             | CLI-specific setup, updater, and this reference system             |
+
+Web-agent-only concepts with no CLI equivalent: `run_command`'s virtual filesystem (CLI uses concrete `sg` subcommands), `authenticate_oauth`'s dedicated MCP `authenticate` tool (CLI uses `sg system oauth`).
 
 ### Command Reference
 

package/dist/skills/superglue/references/http.md

@@ -19,15 +19,15 @@ All fields support `<<variable>>` and `<<(sourceData) => ...>>` expressions.
 
 ### Fields
 
-| Field         | Required | Notes                                                   |
-| ------------- | -------- | ------------------------------------------------------- |
-| `url`         | yes      | Prefer `<<systemId_url>>/path` over hardcoded base URLs |
-| `method`      | yes      | `GET`, `POST`, `PUT`, `DELETE`, `PATCH`                 |
-| `headers`     | no       | Auth headers, content type, custom headers              |
-| `queryParams` | no       | Key-value pairs appended to URL                         |
-| `body`        | no       | Stripped for GET/HEAD/DELETE/OPTIONS                    |
-| `pagination`  | no       | See Pagination section                                  |
-| `systemId`    | no       | Links system credentials and URL. Omit for public APIs  |
+| Field         | Required | Notes                                                                                                        |
+| ------------- | -------- | ------------------------------------------------------------------------------------------------------------ |
+| `url`         | yes      | Use `<<systemId_url>>` for the base; join with exactly one `/` (the system's `url` may or may not end in `/` |
+| `method`      | yes      | `GET`, `POST`, `PUT`, `DELETE`, `PATCH`                                                                      |
+| `headers`     | no       | Auth headers, content type, custom headers                                                                   |
+| `queryParams` | no       | Key-value pairs appended to URL                                                                              |
+| `body`        | no       | Stripped for GET/HEAD/DELETE/OPTIONS                                                                         |
+| `pagination`  | no       | See Pagination section                                                                                       |
+| `systemId`    | no       | Links system credentials and URL. Omit for public APIs                                                       |
 
 For APIs that require the same query key multiple times, use an array value:
 `{ metadataHeaders: ["From", "Subject"] }` -> `?metadataHeaders=From&metadataHeaders=Subject`.
@@ -237,7 +237,8 @@ When an HTTP step downloads a file (PDF, CSV, binary response), set `outputFile:
 
 ## Common Pitfalls
 
-- Hardcoding base URLs that match the system's base URL instead of using `<<systemId_url>>`. Check with `sg system call` what format the URL is and if it contains e.g. a trailing slash.
+- Hardcoding base URLs instead of using `<<systemId_url>>`.
+- Wrong slash at the `<<systemId_url>>` join. The placeholder resolves to the system's `url` exactly as stored, which may or may not end in `/`. Read the `url` shown by `sg system find` and write the path so there is exactly one `/` between base and path: against a base with no trailing slash, `<<systemId_url>>crm/v3/...` becomes a broken host (`https://api.hubapi.comcrm/...`) that silently hits the wrong server; against a base ending in `/`, a leading `/` produces `//`.
 - Forgetting auth headers entirely — nothing is injected automatically, including for OAuth systems (only token refresh is automatic)
 - Forgetting `outputFile: true` on steps that download files the user wants
 - Putting pagination variables in the config but not setting a `pagination` block, or vice versa

package/dist/skills/superglue/references/superglue-info.md

@@ -22,7 +22,7 @@ API, SDK, CLI, and webhook usage require an **API key**. MCP clients can use OAu
 
 MCP authentication is separate from API/SDK/CLI setup. For MCP OAuth, dynamic client registration, Langdock setup, and named server permissions, use the MCP documentation.
 
-Users can generate and manage API keys in **My Credentials -> superglue API keys**. The API endpoint is displayed on the same page.
+Users can generate and manage API keys on the standalone **API Keys** page (`/api-keys`).
 
 ## Interfaces
 
@@ -36,13 +36,13 @@ Users can generate and manage API keys in **My Credentials -> superglue API keys
 
 Tools can be triggered via webhook: `POST {apiEndpoint}/v1/hooks/{toolId}?token={apiKey}`
 
-On superglue Cloud, the API endpoint is `https://api.superglue.cloud`. Self-hosted and enterprise deployments use their own API endpoint — users can find theirs under My Credentials -> superglue API keys.
+On superglue Cloud, the API endpoint is `https://api.superglue.cloud`. Self-hosted and enterprise deployments use their own API endpoint from deployment configuration.
 
 ### OAuth Callback URL
 
 OAuth flows require a callback URL: `{appEndpoint}/api/auth/callback`
 
-On superglue Cloud, the app endpoint is `https://app.superglue.cloud`. Self-hosted and enterprise deployments use their own app URL. If a user doesn't know their endpoints, they can check the browser URL bar for the app endpoint, and My Credentials -> superglue API keys for the API endpoint.
+On superglue Cloud, the app endpoint is `https://app.superglue.cloud`. Self-hosted and enterprise deployments use their own app URL. If a user doesn't know their endpoints, they can check the browser URL bar for the app endpoint and deployment configuration for the API endpoint.
 
 ## Web App UI Layout
 
@@ -53,18 +53,25 @@ The persistent left sidebar contains these top-level items:
 - **Agent** (`/`) — primary AI chat assistant for building and debugging tools and systems.
 - **Tools** (`/tools`, detail at `/tools/{toolId}`) — saved tools; opens the tool playground for editing, testing, and running.
 - **Systems** (`/systems`, detail at `/systems/{systemId}`) — connected external systems with credentials and documentation.
-- **My Credentials** (`/credentials`) — credential management. The **My Credentials** section is for personal user-owned system credentials; the **superglue API keys** section is for API keys. Admins and members open it inside the normal app shell from the sidebar.
+- **My Credentials** (`/credentials`) — personal credential management for systems configured to use user-owned credentials. Admins and members open it inside the normal app shell from the sidebar. API keys are not managed here.
 - **Runs** (`/runs`, detail at `/runs/{runId}`) — execution history for full, draft, and single-step tool runs. Runs is a top-level sidebar item, not a Control Panel sub-item.
 - **Control Panel** (`/admin`) — expandable group for organization and account administration:
   - **Overview** (`/admin`) — dashboard summary, including failed-run and schedule summaries.
   - **Landscape** (`/landscape`) — graph overview of tools, systems, and their connections.
   - **Schedules** (`/admin?view=schedules`) — scheduled and recurring tool runs.
   - **Access Rules** (`/admin/access`) — role and access-rule configuration; visible to admins on paid tiers. Use the access-rules reference for RBAC behavior, base roles, and personal roles.
-  - **Organization** (`/admin?view=organization`) — visible on paid tiers, tabbed page: **Members** (members, invites, role assignment; management actions admin-gated), **Settings** (`?tab=settings`, admin-only: organization name and logo, run preferences like draft/single-step run visibility, run result storage, member run visibility, and delete-all-runs), and **Notifications** (`?tab=notifications`, admin-only: failure-alert channels for Slack and email).
+  - **Organization** (`/organization`) — visible on paid tiers as a standalone page without tabs. It shows members, invitations, role assignment, and member-management actions; management actions are admin-gated.
   - **MCP Servers** (`/admin?view=mcp-servers`) — manage and export named MCP server endpoints. Use the MCP documentation for behavior, permissions, and client setup.
-  - **Notifications** (`/admin?view=notifications`) — failure-alert channels; shown as a Control Panel sub-item only on the free tier. On paid tiers this lives in the Organization page's Notifications tab instead.
 
-Below the navigation, the sidebar shows the organization switcher and Sign Out. Depending on the plan, it also shows **Upgrade Plan** or **Subscription**; Subscription opens the external Stripe billing portal. There is no standalone Settings, Profile, or in-app Billing page.
+Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user email and menu items for **API Keys** (`/api-keys`), **Settings** (`/settings`, admin-only), **Switch organization**, and **Sign Out**. Depending on the plan, the sidebar also shows **Upgrade Plan** or **Subscription**; Subscription opens the external Stripe billing portal. There is no separate in-app Billing page.
+
+**API Keys** (`/api-keys`) is a standalone page with a simple own-key editor for superglue API keys used by API, SDK, CLI, webhook, and non-OAuth MCP clients. Org users can create, copy, and delete their own keys.
+
+**Settings** (`/settings`) is an admin-only standalone page with distinct sections:
+
+- **Organization** — organization name and organization logo settings.
+- **Run Settings** — run preferences: draft/single-step run visibility, run result storage, member run visibility, and delete-all-runs.
+- **Notifications** — failure-alert channels for Slack and email. Slack setup opens `/settings/notifications/slack`; email setup opens `/settings/notifications/email`.
 
 ## Internals
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superglue/cli",
-  "version": "1.1.30",
+  "version": "1.1.31",
   "bin": {
     "sg": "./dist/cli.js"
   },

package/skills/superglue/SKILL.md

@@ -5,7 +5,7 @@ description: "Build, test, deploy and integrate superglue tools via the sg CLI a
 
 # superglue CLI (`sg`) — Agent Reference
 
-This file is the entry point for operating superglue via the `sg` CLI. It covers setup, tool building, tool editing, system management, running tools, and deployment via SDK/REST/webhooks.
+This file is the entry point for operating superglue via the `sg` CLI. It covers setup, tool building, tool editing, system management, running tools, schedules, and deployment via SDK/REST/webhooks.
 
 For protocol-specific details (HTTP, databases, Redis, file servers, GraphQL), file handling, access rules, SDK integration, and general superglue information, run `sg skill <topic>` (linked throughout and listed at the bottom).
 
@@ -77,7 +77,7 @@ The CLI will not work until configured with an API key. The endpoint defaults to
 sg init
 ```
 
-Prompts for: API key (required — get one at https://app.superglue.cloud/admin?view=api-keys), API endpoint, web endpoint (for OAuth callbacks), output mode (`stdout` or `stdout+file`), and config location (project-local `.superglue/config.json` vs global `~/.superglue/config.json`). Verifies the connection before saving.
+Prompts for: API key (required — get one at https://app.superglue.cloud/api-keys), API endpoint, web endpoint (for OAuth callbacks), output mode (`stdout` or `stdout+file`), and config location (project-local `.superglue/config.json` vs global `~/.superglue/config.json`). Verifies the connection before saving.
 
 **Non-interactive (CI, agents):**
 
@@ -103,11 +103,11 @@ Verify with `sg system list` — should return a list (possibly empty) without e
 
 Set during `sg init` or via `SUPERGLUE_CLI_PRESET` env var. Stored in `config.json` as `"preset"`.
 
-| Preset    | Description                                                                      |
-| --------- | -------------------------------------------------------------------------------- |
-| `runner`  | Run saved tools by ID only. Read-only lookups. No building/editing               |
-| `builder` | Runner + build/edit/save tools, call systems, manage MCP servers. No system CRUD |
-| `admin`   | Full access (default)                                                            |
+| Preset    | Description                                                                                    |
+| --------- | ---------------------------------------------------------------------------------------------- |
+| `runner`  | Run saved tools by ID only. Read-only lookups. No building/editing                             |
+| `builder` | Runner + build/edit/save tools, call systems, manage MCP servers and schedules. No system CRUD |
+| `admin`   | Full access (default)                                                                          |
 
 Blocked commands print a clear error showing the current preset and how to change it.
 
@@ -185,6 +185,26 @@ Auth modes:
 
 If `sg mcp ...` returns "MCP server management is not available", the target instance or plan does not support named MCP server management. The default all-tools MCP endpoint may still be usable at `<api-endpoint>/mcp`.
 
+### Creating/Editing Tool Schedules
+
+Schedules run saved tools on cron expressions. Use 5-field cron syntax and an IANA timezone.
+
+```bash
+sg schedule list
+sg schedule list --tool <toolId>
+sg schedule create --tool daily_report --cron "0 9 * * 1-5" --timezone UTC
+sg schedule edit --tool daily_report --id <scheduleId> --disabled
+sg schedule edit --tool daily_report --id <scheduleId> --cron "0 8 * * *" --timezone UTC
+```
+
+Optional flags:
+
+- `--payload '{"key":"value"}'` or `--payload-file payload.json` sets the scheduled run payload.
+- `--webhook-url <url>` posts results to a webhook after success.
+- `--tool-chain <toolId>` runs another saved tool after success.
+- `--retries <n>` and `--timeout <ms>` set request options.
+- `--clear-webhook` removes the webhook/tool-chain success action during edit.
+
 ---
 
 ## Reference
@@ -193,27 +213,29 @@ If `sg mcp ...` returns "MCP server management is not available", the target ins
 
 Agents familiar with the web tool names can map them directly to CLI commands:
 
-| Web agent tool                                   | CLI command                                   | Notes                                                              |
-| ------------------------------------------------ | --------------------------------------------- | ------------------------------------------------------------------ |
-| `build_tool`                                     | `sg tool build --config '{...}'`              | CLI is not AI-powered — you provide the full JSON config           |
-| `edit_tool`                                      | `sg tool edit --tool <id> --patches '[...]'`  | JSON Patch (RFC 6902). Use `--draft <id>` for drafts               |
-| `run_tool`                                       | `sg tool run --tool <id>` / `--draft <id>`    | Add `--include-step-results` to inspect per-step data              |
-| `save_tool`                                      | `sg tool save --draft <draftId>`              | Persists a draft to the database                                   |
-| `run_command` with `vfs` for `/org/tools/`       | `sg tool find --id <id>` / `sg tool find <q>` | Full config with `--id`, compact search with a query string        |
-| `create_system`                                  | `sg system create --name "..." --url "..."`   | Use `--template <id>` when available                               |
-| `edit_system`                                    | `sg system edit --id <id> ...`                | Supports `--env dev\|prod`                                         |
-| `run_command` with `vfs` for `/org/systems/`     | `sg system find <query>` / `--id <id>`        | Returns `storedCredentials` and system URL                         |
-| Credentials VFS / user-owned credentials         | `sg system credentials get/set/clear`         | Manage current user's credentials for user-owned systems           |
-| `call_system`                                    | `sg system call --url "..." --system-id <id>` | Authenticated ad-hoc calls for testing / schema introspection      |
-| `run_command search`                             | `sg system search-docs --system-id <id> -k`   | Targeted keyword search over ingested system docs                  |
-| `authenticate_oauth`                             | `sg system oauth --system-id <id> [--scopes]` | Opens browser flow. Supports `--grant-type client_credentials` too |
-| `run_command` with `vfs` for `/org/runs/`        | `sg run list` / `sg run get <runId>`          | Filter `list` by `--tool`, `--status`, `--source`, `--limit`       |
-| `run_command` with `vfs` for `/org/mcp-servers/` | `sg mcp list` / `sg mcp find --id <id>`       | Returns endpoint, auth mode, selected tool IDs, and client config  |
-| `create_mcp_server`                              | `sg mcp create --name <n> --tool <id>`        | Creates a named MCP endpoint for selected saved tools              |
-| `edit_mcp_server`                                | `sg mcp edit --id <id> ...`                   | Edits name, auth mode, description, or selected tool IDs           |
-| (no direct equivalent)                           | `sg init`, `sg update`, `sg skill`            | CLI-specific setup, updater, and this reference system             |
-
-Web-agent-only concepts with no CLI equivalent: `run_command`'s virtual filesystem (CLI uses concrete `sg` subcommands), `create_schedule`/`edit_schedule` (manage schedules via web app or REST API), `authenticate_oauth`'s dedicated MCP `authenticate` tool (CLI uses `sg system oauth`).
+| Web agent tool                                   | CLI command                                    | Notes                                                              |
+| ------------------------------------------------ | ---------------------------------------------- | ------------------------------------------------------------------ |
+| `build_tool`                                     | `sg tool build --config '{...}'`               | CLI is not AI-powered — you provide the full JSON config           |
+| `edit_tool`                                      | `sg tool edit --tool <id> --patches '[...]'`   | JSON Patch (RFC 6902). Use `--draft <id>` for drafts               |
+| `run_tool`                                       | `sg tool run --tool <id>` / `--draft <id>`     | Add `--include-step-results` to inspect per-step data              |
+| `save_tool`                                      | `sg tool save --draft <draftId>`               | Persists a draft to the database                                   |
+| `run_command` with `vfs` for `/org/tools/`       | `sg tool find --id <id>` / `sg tool find <q>`  | Full config with `--id`, compact search with a query string        |
+| `create_system`                                  | `sg system create --name "..." --url "..."`    | Use `--template <id>` when available                               |
+| `edit_system`                                    | `sg system edit --id <id> ...`                 | Supports `--env dev\|prod`                                         |
+| `run_command` with `vfs` for `/org/systems/`     | `sg system find <query>` / `--id <id>`         | Returns `storedCredentials` and system URL                         |
+| Credentials VFS / user-owned credentials         | `sg system credentials get/set/clear`          | Manage current user's credentials for user-owned systems           |
+| `call_system`                                    | `sg system call --url "..." --system-id <id>`  | Authenticated ad-hoc calls for testing / schema introspection      |
+| `run_command search`                             | `sg system search-docs --system-id <id> -k`    | Targeted keyword search over ingested system docs                  |
+| `authenticate_oauth`                             | `sg system oauth --system-id <id> [--scopes]`  | Opens browser flow. Supports `--grant-type client_credentials` too |
+| `run_command` with `vfs` for `/org/runs/`        | `sg run list` / `sg run get <runId>`           | Filter `list` by `--tool`, `--status`, `--source`, `--limit`       |
+| `run_command` with `vfs` for `/org/mcp-servers/` | `sg mcp list` / `sg mcp find --id <id>`        | Returns endpoint, auth mode, selected tool IDs, and client config  |
+| `create_mcp_server`                              | `sg mcp create --name <n> --tool <id>`         | Creates a named MCP endpoint for selected saved tools              |
+| `edit_mcp_server`                                | `sg mcp edit --id <id> ...`                    | Edits name, auth mode, description, or selected tool IDs           |
+| `create_schedule`                                | `sg schedule create --tool <id> --cron <expr>` | Creates a cron schedule for a saved tool                           |
+| `edit_schedule`                                  | `sg schedule edit --tool <id> --id <schedule>` | Updates, enables, or disables an existing schedule                 |
+| (no direct equivalent)                           | `sg init`, `sg update`, `sg skill`             | CLI-specific setup, updater, and this reference system             |
+
+Web-agent-only concepts with no CLI equivalent: `run_command`'s virtual filesystem (CLI uses concrete `sg` subcommands), `authenticate_oauth`'s dedicated MCP `authenticate` tool (CLI uses `sg system oauth`).
 
 ### Command Reference
 

package/skills/superglue/references/http.md

@@ -19,15 +19,15 @@ All fields support `<<variable>>` and `<<(sourceData) => ...>>` expressions.
 
 ### Fields
 
-| Field         | Required | Notes                                                   |
-| ------------- | -------- | ------------------------------------------------------- |
-| `url`         | yes      | Prefer `<<systemId_url>>/path` over hardcoded base URLs |
-| `method`      | yes      | `GET`, `POST`, `PUT`, `DELETE`, `PATCH`                 |
-| `headers`     | no       | Auth headers, content type, custom headers              |
-| `queryParams` | no       | Key-value pairs appended to URL                         |
-| `body`        | no       | Stripped for GET/HEAD/DELETE/OPTIONS                    |
-| `pagination`  | no       | See Pagination section                                  |
-| `systemId`    | no       | Links system credentials and URL. Omit for public APIs  |
+| Field         | Required | Notes                                                                                                        |
+| ------------- | -------- | ------------------------------------------------------------------------------------------------------------ |
+| `url`         | yes      | Use `<<systemId_url>>` for the base; join with exactly one `/` (the system's `url` may or may not end in `/` |
+| `method`      | yes      | `GET`, `POST`, `PUT`, `DELETE`, `PATCH`                                                                      |
+| `headers`     | no       | Auth headers, content type, custom headers                                                                   |
+| `queryParams` | no       | Key-value pairs appended to URL                                                                              |
+| `body`        | no       | Stripped for GET/HEAD/DELETE/OPTIONS                                                                         |
+| `pagination`  | no       | See Pagination section                                                                                       |
+| `systemId`    | no       | Links system credentials and URL. Omit for public APIs                                                       |
 
 For APIs that require the same query key multiple times, use an array value:
 `{ metadataHeaders: ["From", "Subject"] }` -> `?metadataHeaders=From&metadataHeaders=Subject`.
@@ -237,7 +237,8 @@ When an HTTP step downloads a file (PDF, CSV, binary response), set `outputFile:
 
 ## Common Pitfalls
 
-- Hardcoding base URLs that match the system's base URL instead of using `<<systemId_url>>`. Check with `sg system call` what format the URL is and if it contains e.g. a trailing slash.
+- Hardcoding base URLs instead of using `<<systemId_url>>`.
+- Wrong slash at the `<<systemId_url>>` join. The placeholder resolves to the system's `url` exactly as stored, which may or may not end in `/`. Read the `url` shown by `sg system find` and write the path so there is exactly one `/` between base and path: against a base with no trailing slash, `<<systemId_url>>crm/v3/...` becomes a broken host (`https://api.hubapi.comcrm/...`) that silently hits the wrong server; against a base ending in `/`, a leading `/` produces `//`.
 - Forgetting auth headers entirely — nothing is injected automatically, including for OAuth systems (only token refresh is automatic)
 - Forgetting `outputFile: true` on steps that download files the user wants
 - Putting pagination variables in the config but not setting a `pagination` block, or vice versa

package/skills/superglue/references/superglue-info.md

@@ -22,7 +22,7 @@ API, SDK, CLI, and webhook usage require an **API key**. MCP clients can use OAu
 
 MCP authentication is separate from API/SDK/CLI setup. For MCP OAuth, dynamic client registration, Langdock setup, and named server permissions, use the MCP documentation.
 
-Users can generate and manage API keys in **My Credentials -> superglue API keys**. The API endpoint is displayed on the same page.
+Users can generate and manage API keys on the standalone **API Keys** page (`/api-keys`).
 
 ## Interfaces
 
@@ -36,13 +36,13 @@ Users can generate and manage API keys in **My Credentials -> superglue API keys
 
 Tools can be triggered via webhook: `POST {apiEndpoint}/v1/hooks/{toolId}?token={apiKey}`
 
-On superglue Cloud, the API endpoint is `https://api.superglue.cloud`. Self-hosted and enterprise deployments use their own API endpoint — users can find theirs under My Credentials -> superglue API keys.
+On superglue Cloud, the API endpoint is `https://api.superglue.cloud`. Self-hosted and enterprise deployments use their own API endpoint from deployment configuration.
 
 ### OAuth Callback URL
 
 OAuth flows require a callback URL: `{appEndpoint}/api/auth/callback`
 
-On superglue Cloud, the app endpoint is `https://app.superglue.cloud`. Self-hosted and enterprise deployments use their own app URL. If a user doesn't know their endpoints, they can check the browser URL bar for the app endpoint, and My Credentials -> superglue API keys for the API endpoint.
+On superglue Cloud, the app endpoint is `https://app.superglue.cloud`. Self-hosted and enterprise deployments use their own app URL. If a user doesn't know their endpoints, they can check the browser URL bar for the app endpoint and deployment configuration for the API endpoint.
 
 ## Web App UI Layout
 
@@ -53,18 +53,25 @@ The persistent left sidebar contains these top-level items:
 - **Agent** (`/`) — primary AI chat assistant for building and debugging tools and systems.
 - **Tools** (`/tools`, detail at `/tools/{toolId}`) — saved tools; opens the tool playground for editing, testing, and running.
 - **Systems** (`/systems`, detail at `/systems/{systemId}`) — connected external systems with credentials and documentation.
-- **My Credentials** (`/credentials`) — credential management. The **My Credentials** section is for personal user-owned system credentials; the **superglue API keys** section is for API keys. Admins and members open it inside the normal app shell from the sidebar.
+- **My Credentials** (`/credentials`) — personal credential management for systems configured to use user-owned credentials. Admins and members open it inside the normal app shell from the sidebar. API keys are not managed here.
 - **Runs** (`/runs`, detail at `/runs/{runId}`) — execution history for full, draft, and single-step tool runs. Runs is a top-level sidebar item, not a Control Panel sub-item.
 - **Control Panel** (`/admin`) — expandable group for organization and account administration:
   - **Overview** (`/admin`) — dashboard summary, including failed-run and schedule summaries.
   - **Landscape** (`/landscape`) — graph overview of tools, systems, and their connections.
   - **Schedules** (`/admin?view=schedules`) — scheduled and recurring tool runs.
   - **Access Rules** (`/admin/access`) — role and access-rule configuration; visible to admins on paid tiers. Use the access-rules reference for RBAC behavior, base roles, and personal roles.
-  - **Organization** (`/admin?view=organization`) — visible on paid tiers, tabbed page: **Members** (members, invites, role assignment; management actions admin-gated), **Settings** (`?tab=settings`, admin-only: organization name and logo, run preferences like draft/single-step run visibility, run result storage, member run visibility, and delete-all-runs), and **Notifications** (`?tab=notifications`, admin-only: failure-alert channels for Slack and email).
+  - **Organization** (`/organization`) — visible on paid tiers as a standalone page without tabs. It shows members, invitations, role assignment, and member-management actions; management actions are admin-gated.
   - **MCP Servers** (`/admin?view=mcp-servers`) — manage and export named MCP server endpoints. Use the MCP documentation for behavior, permissions, and client setup.
-  - **Notifications** (`/admin?view=notifications`) — failure-alert channels; shown as a Control Panel sub-item only on the free tier. On paid tiers this lives in the Organization page's Notifications tab instead.
 
-Below the navigation, the sidebar shows the organization switcher and Sign Out. Depending on the plan, it also shows **Upgrade Plan** or **Subscription**; Subscription opens the external Stripe billing portal. There is no standalone Settings, Profile, or in-app Billing page.
+Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user email and menu items for **API Keys** (`/api-keys`), **Settings** (`/settings`, admin-only), **Switch organization**, and **Sign Out**. Depending on the plan, the sidebar also shows **Upgrade Plan** or **Subscription**; Subscription opens the external Stripe billing portal. There is no separate in-app Billing page.
+
+**API Keys** (`/api-keys`) is a standalone page with a simple own-key editor for superglue API keys used by API, SDK, CLI, webhook, and non-OAuth MCP clients. Org users can create, copy, and delete their own keys.
+
+**Settings** (`/settings`) is an admin-only standalone page with distinct sections:
+
+- **Organization** — organization name and organization logo settings.
+- **Run Settings** — run preferences: draft/single-step run visibility, run result storage, member run visibility, and delete-all-runs.
+- **Notifications** — failure-alert channels for Slack and email. Slack setup opens `/settings/notifications/slack`; email setup opens `/settings/notifications/email`.
 
 ## Internals