@superglue/cli 1.1.31 → 1.1.33

package/skills/superglue/references/mssql.md

@@ -13,7 +13,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
 
@@ -93,46 +93,46 @@ mssql://<<my_db_user>>:<<my_db_password>>@<<my_db_host>>:<<my_db_port>>/<<my_db_
 
 ### Windows Authentication (NTLM)
 
-For on-prem SQL Servers that only accept Windows domain logins (no SQL auth), store these credential keys on the system:
+For on-prem SQL Servers that only accept Windows domain logins (no SQL auth), add secrets with these names to the credential:
 
-| Credential Key | Required | Notes                                                 |
-| -------------- | -------- | ----------------------------------------------------- |
-| `authType`     | yes      | `ntlm`                                                |
-| `domain`       | yes      | Windows domain (e.g. `CORP`)                          |
-| `user`         | yes      | Windows username (also accepts `username`, or in URL) |
-| `password`     | yes      | Windows password (or in URL)                          |
+| Secret Name | Required | Notes                                                 |
+| ----------- | -------- | ----------------------------------------------------- |
+| `authType`  | yes      | `ntlm`                                                |
+| `domain`    | yes      | Windows domain (e.g. `CORP`)                          |
+| `user`      | yes      | Windows username (also accepts `username`, or in URL) |
+| `password`  | yes      | Windows password (or in URL)                          |
 
 ```
 URL:  mssql://<<sys_user>>:<<sys_password>>@<<sys_host>>:<<sys_port>>/<<sys_database>>
-Credentials: { authType: "ntlm", domain, user, password, host, port, database }
+Secrets: { authType: "ntlm", domain, user, password, host, port, database }
 ```
 
 Alternatively, pass the domain as a `?domain=CORP` query parameter on the URL — any URL with a `domain` set authenticates via NTLM. Kerberos-only environments are not supported; ask the DBA to permit NTLM or create a SQL login.
 
 ### Azure Active Directory Authentication
 
-For Azure AD auth, store the following credential keys on the system alongside the standard connection fields:
+For Azure AD auth, add secrets with the following names to the credential alongside the standard connection fields:
 
 **Entra ID User + Password** — authenticates as an Azure AD user. Requires an Azure app registration.
 
-| Credential Key | Required | Notes                                                  |
-| -------------- | -------- | ------------------------------------------------------ |
-| `authType`     | yes      | `azure-active-directory-password`                      |
-| `clientId`     | yes      | Application (client) ID from Azure app registration    |
-| `tenantId`     | no       | Directory (tenant) ID                                  |
-| `user`         | yes      | Azure AD username (also accepts `username`, or in URL) |
-| `password`     | yes      | Azure AD password (or in URL)                          |
+| Secret Name | Required | Notes                                                  |
+| ----------- | -------- | ------------------------------------------------------ |
+| `authType`  | yes      | `azure-active-directory-password`                      |
+| `clientId`  | yes      | Application (client) ID from Azure app registration    |
+| `tenantId`  | no       | Directory (tenant) ID                                  |
+| `user`      | yes      | Azure AD username (also accepts `username`, or in URL) |
+| `password`  | yes      | Azure AD password (or in URL)                          |
 
-`user` and `password` can be stored as credentials or embedded in the URL — values resolved into the URL take precedence; stored credentials only fill gaps the URL omits.
+`user` and `password` can be stored as secrets or embedded in the URL — values resolved into the URL take precedence; stored secrets only fill gaps the URL omits.
 
 ```
 URL:  mssql://<<sys_user>>:<<sys_password>>@myserver.database.windows.net:1433/mydb
-Credentials: { authType, clientId, tenantId, user, password, host, port, database }
+Secrets: { authType, clientId, tenantId, user, password, host, port, database }
 ```
 
 **Service Principal** — authenticates as an Azure AD application. No user/password needed in the URL.
 
-| Credential Key | Required | Notes                                             |
+| Secret Name    | Required | Notes                                             |
 | -------------- | -------- | ------------------------------------------------- |
 | `authType`     | yes      | `azure-active-directory-service-principal-secret` |
 | `clientId`     | yes      | Application (client) ID                           |
@@ -141,7 +141,7 @@ Credentials: { authType, clientId, tenantId, user, password, host, port, databas
 
 ```
 URL:  mssql://myserver.database.windows.net:1433/mydb
-Credentials: { authType, clientId, clientSecret, tenantId, host, port, database }
+Secrets: { authType, clientId, clientSecret, tenantId, host, port, database }
 ```
 
 The runtime authenticates entirely via the service principal credentials — no user or password is needed in the URL.
@@ -245,7 +245,7 @@ Default retries from server config. On final failure, error includes query text
 When an MSSQL step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes the query text and params in the error. Check for syntax errors, missing columns, or type mismatches.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
 3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access. Verify with the user that the credentials have the required grants.
 4. **Check Azure-specific issues** — if connecting to Azure SQL:
    - Confirm the client IP is allowed in the Azure SQL firewall rules

package/skills/superglue/references/odbc.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
 
@@ -185,7 +185,7 @@ For other ODBC-backed databases, look up the database/driver-specific error code
 When an ODBC step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes a truncated query preview in the error. Check for syntax errors, missing columns, or type mismatches.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
 3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access. Verify with the user that the credentials have the required grants.
 4. **Check driver availability** — if the error mentions "driver not found", the `DRIVER` query parameter does not match any registered driver in `/etc/odbcinst.ini`. Verify the driver name is correct and the driver is installed in the Docker image.
 5. **Test the query directly** — use `sg system call` with a simplified version of the query to isolate whether the issue is the query itself, the parameters, or the connection.

package/skills/superglue/references/postgres.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
 
@@ -148,7 +148,7 @@ Default retries from server config. On final failure, error includes query text
 When a PostgreSQL step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes the query text and params in the error. Check for syntax errors, missing columns, or type mismatches.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
 3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access to the database, schema, or table. Verify with the user that the credentials have the required grants.
 4. **Test the query directly** — use `sg system call` with a simplified version of the query to isolate whether the issue is the query itself, the parameters, or the connection.
 5. **Check for SSL/TLS issues** — if the error mentions SSL or handshake failure, check the SSL / TLS section above. For non-localhost servers that don't support SSL, add `?sslmode=disable` to the URL. For servers that require SSL, add `?sslmode=require`.

package/skills/superglue/references/redis.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for Redis steps.
 
@@ -133,7 +133,7 @@ Default retries from server config. On final failure, error includes command and
 When a Redis step fails:
 
 1. **Read the error message** — superglue includes the command and args in the error. Check for unknown commands, wrong argument counts, or type errors (e.g. running a list command on a string key).
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a simple `PING` command via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test with a simple `PING` command via `sg system call`.
 3. **Check connectivity and access** — connection refused errors typically mean the Redis server is unreachable or requires TLS (`rediss://`). AUTH errors mean the password is wrong or the user lacks access.
 4. **Check key types** — Redis commands are type-specific. Running `GET` on a hash key or `HGETALL` on a string key returns a `WRONGTYPE` error. Use `TYPE` command via `sg system call` to check a key's type before building.
 5. **Verify TLS requirements** — if the error mentions connection reset or handshake failure, try switching between `redis://` and `rediss://`.

package/skills/superglue/references/sftp-smb.md

@@ -13,7 +13,7 @@ FTP, SFTP, and SMB share an identical operation interface. Only the URL protocol
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for file server steps.
 
@@ -128,7 +128,7 @@ Single operation returns the result directly. Array of operations returns an arr
 
 **FTP/FTPS:** uses `basic-ftp`. FTPS uses TLS with `rejectUnauthorized: false`. Connection timeout configurable.
 
-**SMB:** uses `@tryjsky/v9u-smb2`. Connection lifecycle: create client (with share, domain, credentials), execute operations, disconnect. Entire operation wrapped in a timeout race. For private systems via Secure Gateway, the host is `tunnelId.tunnel` (e.g. `my_tunnel.tunnel`).
+**SMB:** uses `@tryjsky/v9u-smb2`. Connection lifecycle: create client (with share, domain, credentials), execute operations, disconnect.
 
 ### Retry Behavior
 
@@ -152,10 +152,10 @@ When the user wants to **download** a file fetched via SFTP/SMB/FTP, set `output
 When a file server step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes the operations list in the error. Check for typos in paths, missing fields, or unsupported operations.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a simple `list` operation on the base path via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test with a simple `list` operation on the base path via `sg system call`.
 3. **Check path resolution** — if you get "file not found", verify the path is relative to the URL base path, not an absolute filesystem path. Use `list` on the parent directory to see what files exist.
 4. **Check permissions** — permission denied errors mean the user account lacks read/write access to the target path. Verify with the user that the account has the required grants.
 5. **Check protocol-specific issues:**
-   - **SFTP**: if the error mentions authentication, verify whether the server expects password or private key auth. If using private key, ensure `privateKey` and `passphrase` are stored as system credentials.
+   - **SFTP**: if the error mentions authentication, verify whether the server expects password or private key auth. If using private key, ensure `privateKey` and `passphrase` are stored as secrets in the credential.
    - **FTP/FTPS**: if the connection fails, try switching between `ftp://` and `ftps://` — some servers require TLS, others don't support it.
-   - **SMB**: verify the share name is correct (first path segment). If using domain auth, ensure the domain is included in the URL or stored as a credential. Check that the SMB port (445) is accessible.
+   - **SMB**: verify the share name is correct (first path segment). If using domain auth, ensure the domain is included in the URL or stored as a secret. Check that the SMB port (445) is accessible.

package/skills/superglue/references/superglue-info.md

@@ -7,18 +7,26 @@ superglue is an open-source, AI-native integration platform that builds and runs
 Developed by superglue (Y Combinator W25), founded by Adina Görres and Stefan Faistenauer in 2025, based in Munich and San Francisco.
 
 - Website: https://superglue.ai
-- Documentation: https://docs.superglue.cloud
+- Documentation: https://superglue.ai/docs/
 - GitHub: https://github.com/superglue-ai/superglue
 
 If the user is asking general questions (not building):
 
 - Company/team/pricing → https://superglue.ai/
-- Product/features → https://docs.superglue.cloud/getting-started/introduction
+- Product/features → https://superglue.ai/docs/getting-started/introduction/
 - Open-source/code → https://github.com/superglue-ai/superglue
 
+## Cloud Usage Tiers
+
+- Cloud tiers are **Trial**, **Pro**, **Team**, and **Enterprise**; billing-enabled apps expose upgrades through the in-app **Upgrade Plan** button, not a separate Billing page.
+- **Trial** includes 1M input tokens and 100 runs lifetime; **Pro** is €59/$69 per month with 3M input tokens/user/month and 3,000 runs/user/month.
+- **Team** is €99/$119 per seat/month with 5M input tokens/user/month and 5,000 runs/user/month; Team includes organization management, activity tracking, and custom MCP servers.
+- **Enterprise** is custom-priced with unlimited usage limits by default, enterprise access controls, and self-hosting/on-prem options.
+- These cloud tier details do not apply to self-hosted or enterprise deployment setups.
+
 ## Authentication
 
-API, SDK, CLI, and webhook usage require an **API key**. MCP clients can use OAuth when supported, or API keys for non-interactive setup. Self-hosted deployments also need the API/MCP endpoint URL. There are no workspace IDs, project IDs, or other identifiers.
+API, SDK, and webhook usage require an **API key**. The CLI should use browser OAuth via `sg login`; headless/API-key CLI auth is available through environment variables, flags, or `config.json` for CI and legacy automation. MCP clients can use OAuth when supported, or API keys for non-interactive setup. Self-hosted deployments also need the API/MCP endpoint URL. There are no workspace IDs, project IDs, or other identifiers.
 
 MCP authentication is separate from API/SDK/CLI setup. For MCP OAuth, dynamic client registration, Langdock setup, and named server permissions, use the MCP documentation.
 
@@ -27,10 +35,10 @@ Users can generate and manage API keys on the standalone **API Keys** page (`/ap
 ## Interfaces
 
 - **Web app** — primary UI for building, testing, and managing tools and systems
-- **TypeScript/Python SDK** — https://docs.superglue.cloud/sdk/overview
-- **REST API** — https://docs.superglue.cloud/api-reference/
-- **MCP Server** — https://docs.superglue.cloud/mcp/using-the-mcp
-- **CLI** — `npm install -g @superglue/cli` — https://docs.superglue.cloud/getting-started/cli-skills
+- **TypeScript/Python SDK** — https://superglue.ai/docs/sdk/overview/
+- **REST API** — https://superglue.ai/docs/api/
+- **MCP Server** — https://superglue.ai/docs/mcp/using-the-mcp/
+- **CLI** — `npm install -g @superglue/cli` — https://superglue.ai/docs/getting-started/cli-skills/
 
 ### Webhook Triggers
 
@@ -44,6 +52,10 @@ OAuth flows require a callback URL: `{appEndpoint}/api/auth/callback`
 
 On superglue Cloud, the app endpoint is `https://app.superglue.cloud`. Self-hosted and enterprise deployments use their own app URL. If a user doesn't know their endpoints, they can check the browser URL bar for the app endpoint and deployment configuration for the API endpoint.
 
+### Cloud Networking
+
+If a customer's system requires IP allowlisting for firewall rules, security groups, or vendor access controls, superglue Cloud outbound requests come from `34.234.12.178` and `18.198.191.215`. These IPs apply to superglue Cloud only; self-hosted and enterprise deployments use deployment-specific networking.
+
 ## Web App UI Layout
 
 Use this section as the source of truth for high-level web app navigation. Do not invent UI locations that are not listed here.
@@ -53,7 +65,7 @@ The persistent left sidebar contains these top-level items:
 - **Agent** (`/`) — primary AI chat assistant for building and debugging tools and systems.
 - **Tools** (`/tools`, detail at `/tools/{toolId}`) — saved tools; opens the tool playground for editing, testing, and running.
 - **Systems** (`/systems`, detail at `/systems/{systemId}`) — connected external systems with credentials and documentation.
-- **My Credentials** (`/credentials`) — personal credential management for systems configured to use user-owned credentials. Admins and members open it inside the normal app shell from the sidebar. API keys are not managed here.
+- **Credentials** (`/credentials`) — manage the credentials you own for each system, and the credentials shared with you. Admins and members open it inside the normal app shell from the sidebar. API keys are not managed here.
 - **Runs** (`/runs`, detail at `/runs/{runId}`) — execution history for full, draft, and single-step tool runs. Runs is a top-level sidebar item, not a Control Panel sub-item.
 - **Control Panel** (`/admin`) — expandable group for organization and account administration:
   - **Overview** (`/admin`) — dashboard summary, including failed-run and schedule summaries.
@@ -63,9 +75,9 @@ The persistent left sidebar contains these top-level items:
   - **Organization** (`/organization`) — visible on paid tiers as a standalone page without tabs. It shows members, invitations, role assignment, and member-management actions; management actions are admin-gated.
   - **MCP Servers** (`/admin?view=mcp-servers`) — manage and export named MCP server endpoints. Use the MCP documentation for behavior, permissions, and client setup.
 
-Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user email and menu items for **API Keys** (`/api-keys`), **Settings** (`/settings`, admin-only), **Switch organization**, and **Sign Out**. Depending on the plan, the sidebar also shows **Upgrade Plan** or **Subscription**; Subscription opens the external Stripe billing portal. There is no separate in-app Billing page.
+Below the navigation, the sidebar shows the current organization menu. Opening it shows the signed-in user email and menu items for **API Keys** (`/api-keys`), **Settings** (`/settings`, admin-only), **Switch organization**, and **Sign Out**. When billing is enabled, the sidebar also shows **Upgrade Plan** for non-enterprise organizations; it opens the in-app upgrade flow. There is no separate in-app Billing page.
 
-**API Keys** (`/api-keys`) is a standalone page with a simple own-key editor for superglue API keys used by API, SDK, CLI, webhook, and non-OAuth MCP clients. Org users can create, copy, and delete their own keys.
+**API Keys** (`/api-keys`) is a standalone page with a simple own-key editor for superglue API keys used by API, SDK, CLI headless/API-key auth, webhook, and non-OAuth MCP clients. Org users can create, copy, and delete their own keys.
 
 **Settings** (`/settings`) is an admin-only standalone page with distinct sections:
 
@@ -98,7 +110,8 @@ Steps are routed to execution strategies by protocol (first match wins):
 3. PostgreSQL → URL starts with `postgres://` or `postgresql://`
 4. MSSQL/Azure SQL → URL starts with `mssql://` or `sqlserver://`
 5. Redis → URL starts with `redis://` or `rediss://`
-6. FTP/SFTP → URL starts with `ftp://`, `ftps://`, or `sftp://`
-7. SMB → URL starts with `smb://`
+6. MongoDB → URL starts with `mongodb://` or `mongodb+srv://`
+7. FTP/SFTP → URL starts with `ftp://`, `ftps://`, or `sftp://`
+8. SMB → URL starts with `smb://`
 
 All user-provided JS (data selectors, transforms, stop conditions) runs in an isolated Deno sandbox.