shepherd-onboard 0.1.8 → 0.1.9

package/README.md

@@ -12,6 +12,7 @@ npx -y shepherd-onboard@latest agent
 
 The command prints the exact prompt the agent should follow, then the exact follow-up commands to open Shepherd WorkOS login/signup, open source auth, open Granola's API key page, finalize, start cloud raw polling/backfills, and install local Messages sync.
 The agent prompt tells coding agents to ask short selection questions first: existing/new org, sources to connect, and Messages skip/provide-handle. Account creation/relinking always starts with Shepherd WorkOS auth.
+Existing-organization joins are verified from Shepherd login and company email domain; the typed org name is not trusted by itself.
 
 ## Human Terminal One-liner
 
@@ -25,6 +26,7 @@ The command:
 - asks for name, organization, and an optional local Messages handle
 - creates or reuses the Shepherd customer account from the WorkOS-authenticated email
 - creates or reuses the organization, including case-insensitive and close-name matches
+- only reuses an existing organization when the authenticated account is allowed to join it
 - opens Google Workspace authorization for Gmail, Drive, Docs, and Calendar consent
 - opens Slack authorization
 - opens the Granola desktop app to Settings -> Connectors -> API keys

package/bin/shepherd-onboard.js

@@ -553,6 +553,7 @@ function printAgentContract() {
       "Ask whether they are joining an existing organization or creating a new one.",
       "Run Shepherd WorkOS login/signup before source setup. Do not ask whether they already have an account.",
       "Collect Full name and Organization name as direct text prompts after those choices. The email comes from WorkOS auth.",
+      "Tell the user Shepherd verifies existing-org joins from the authenticated WorkOS account and company email domain. The typed org name is not trusted by itself.",
       "Ask Messages as a selectable choice: Skip Messages, or Provide handle.",
       "If the user chooses Provide handle, ask for the phone number or Apple ID email.",
     ],
@@ -600,6 +601,7 @@ function printAgentContract() {
       "--granola-api-key \"<granola_key>\" if Granola is being connected",
     ],
     statusCommand: `${command} agent --status`,
+    orgSecurity: "Existing organizations are only reused when Shepherd can verify the authenticated user belongs there, for example by an existing Shepherd account/membership or matching non-personal company email domain. Similar spelling helps match verified orgs, but cannot attach an unverified user to someone else's org.",
     expectedResult: "Cloud sources start raw polling/backfill in the customer-facing Shepherd environment. Local Messages starts via a macOS LaunchAgent when run on macOS. Downstream wiki, memory, and summary compilers remain outside this onboarding flow.",
     granolaApiKeyCommand: `${command} granola-api-keys`,
     granolaApiKeyPath: "Granola desktop app -> Settings -> Connectors -> API keys",
@@ -623,6 +625,8 @@ Start with selection questions to determine intent:
 2. Sources: Google Workspace (Gmail/Drive/Docs/Calendar), Slack, Granola, Messages. Allow multi-select if your interface supports it.
 3. Messages, if selected: Skip Messages, or Provide handle.
 
+When discussing existing orgs, keep it short: Shepherd verifies the join from their Shepherd login and company email domain. The org name they type is not trusted by itself.
+
 Before source setup, always run:
   ${payload.loginCommand}
 
@@ -635,7 +639,7 @@ Ask the user for:
 
 Do not ask for their email separately. Use the email returned by WorkOS auth.
 
-If they are joining an existing org, ask for the org name they believe they belong to. Shepherd will auto-match similar/case-different org names.
+If they are joining an existing org, ask for the org name they believe they belong to. Shepherd will match similar/case-different org names only when the authenticated account is allowed to join that org. Otherwise it creates or uses a separate org.
 
 Then run:
   ${payload.startCommand}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shepherd-onboard",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Customer-facing Shepherd raw sync onboarding CLI",
   "type": "module",
   "bin": {