feat: code-to-cloud next-steps prompts, and connector settings links in the skills

CHANGELOG.md

@@ -3,6 +3,8 @@
 ## 1.3.0
 
 - The connect flow and `login` now send usage events to StackGuardian when an install starts, when you sign in and when it completes, so we can see where installs stop. They are tied to a random ID on your machine and carry your organization and region, never the key or the grant token. Sending adds at most two seconds to a run. Set `DO_NOT_TRACK=1` or `SG_NO_TELEMETRY=1` to turn them off. See "Usage analytics" in the README.
+- The prompts suggested in "Next steps" start from your own code: deploy the Terraform in the current repository, create an OpenTofu workflow that waits for your approval, run an Ansible playbook as a workflow, and find out why a deployment failed. Before, they suggested summarizing your security posture, deploying a library template and upgrading template versions.
+- When your organization has no cloud or git connector for what you're deploying, the `sg-create-workflow`, `sg-create-stack` and `sg-update-workflow` skills give you a link to the connector settings page for your organization and region, and wait while you add one. They no longer suggest continuing in a different organization. The workflow-groups link now points to your region's dashboard too; before, it always pointed to the Europe dashboard.
 
 ## 1.2.0
 

skills/sg-create-stack/SKILL.md

@@ -65,7 +65,8 @@ step (Step F).
      silently create a mistyped group on stack create — that is why the tool
      refuses an unknown group unless this flag is set.
    - **Browse in the dev portal**: share the workflow-groups page —
-     `https://app.stackguardian.io/orchestrator/orgs/<org>?tab=workflowGroups`.
+     `https://<dashboard>/orchestrator/orgs/<org>?tab=workflowGroups`
+     (`<dashboard>` and `<org>` as in **No connector yet**).
    This step is mandatory — never call `create_stack` without a
    user-confirmed group.
 2. Ask the user for:
@@ -82,8 +83,8 @@ The dashboard offers these **stack-wide** (applied to every workflow) or
 
 1. Cloud connector: skip if none is needed (omit `deployment`). Otherwise
    find connectors via
-   `search_orchestrator_resources(resourceTypes=['INTEGRATION.CLOUD'])` and
-   build `deployment = {"connectorId": "/integrations/<id>"}` — only
+   `search_orchestrator_resources(resourceTypes=['INTEGRATION.CLOUD'])` (if
+   none fits, see **No connector yet**) and build `deployment = {"connectorId": "/integrations/<id>"}` — only
    `connectorId` is required; the kind is resolved live. A per-workflow
    connector goes in that workflow's entry as `workflows[].deployment` and
    overrides the stack-wide one for that workflow only. Omitting both keeps
@@ -158,6 +159,28 @@ workflow with `create_workflow_run` in the order the stack's Actions define
 (each `data.workflows[].SubResourceId` is the id those tools take; ask
 before running — `action` is required there and always a user decision).
 
+## No connector yet
+
+Connectors can't be created with the MCP tools. When a connector search returns
+nothing, or nothing for the cloud account or git host the user needs, stop and
+give the user the settings page as a markdown link, so they can click through,
+then wait until they say the connector is added:
+
+- Cloud: `[Add a cloud connector](https://<dashboard>/orchestrator/orgs/<org>/settings/cloud-providers)`
+- Git: `[Add a git connector](https://<dashboard>/orchestrator/orgs/<org>/settings/vcs-providers)`
+
+`<org>` is what follows `/orgs/` in `source.filters.orgId` of any search
+response (`/orgs/acme` → `acme`). `<dashboard>` is `app.stackguardian.io` for
+Europe or `us.stackguardian.io` for the United States: match the region of the
+StackGuardian MCP server URL (`api.app.stackguardian.io` or
+`api.us.stackguardian.io`), and give both links if you can't tell. When the
+user confirms, search again.
+
+Never work around a missing connector by switching to another StackGuardian
+organization or MCP server, even one that has a matching connector. A
+different organization has different credentials, policies and people; switch
+only when the user explicitly asks for that organization.
+
 ## Error handling (teaching errors)
 
 On error, present the offered options and re-call — do not guess:

skills/sg-create-workflow/SKILL.md

@@ -62,7 +62,8 @@ into the other:
    - **Private**: the platform needs credentials to clone. List the org's
      VCS connectors with
      `search_orchestrator_resources(resourceTypes=['INTEGRATION.VCS'])`,
-     present them (name + provider kind), and pass the pick as
+     present them (name + provider kind; if there is none, see **No
+     connector yet**), and pass the pick as
      `source.gitAuthRef="/integrations/<id>"` (use the full
      `/integrationgroups/<group>/integrations/<id>` form if the connector is
      group-managed or the tool reports an ambiguity with `candidates`).
@@ -98,7 +99,8 @@ into the other:
    - **Create a new group**: pass `createNewWorkflowGroup=true` ONLY when the
      user explicitly asks for a brand-new group.
    - **Browse in the dev portal**: share the workflow-groups page —
-     `https://app.stackguardian.io/orchestrator/orgs/<org>?tab=workflowGroups`.
+     `https://<dashboard>/orchestrator/orgs/<org>?tab=workflowGroups`
+     (`<dashboard>` and `<org>` as in **No connector yet**).
    This step is mandatory — never call `create_workflow` without a
    user-confirmed `wfGrp`.
    **Nested groups are accepted** — `PROD/eu-central-1` is a real group that
@@ -121,6 +123,7 @@ into the other:
    `deployment.connectorKind` unless a returned error asks for it. Find
    connectors via
    `search_orchestrator_resources(resourceTypes=['INTEGRATION.CLOUD'])`.
+   If none fits, see **No connector yet**.
 2. Ask whether to add environment variables. Collect each as
    `{varName, textValue}` (plain text) or `{varName, secretId}` where
    `secretId` is a `/secrets/<name>` vault reference — exactly one of the
@@ -300,6 +303,28 @@ parameter entirely otherwise (its defaults still apply omitted):
 Confirm a plain-language summary of everything collected with the user, then
 call `create_workflow` with all parameters.
 
+## No connector yet
+
+Connectors can't be created with the MCP tools. When a connector search returns
+nothing, or nothing for the cloud account or git host the user needs, stop and
+give the user the settings page as a markdown link, so they can click through,
+then wait until they say the connector is added:
+
+- Cloud: `[Add a cloud connector](https://<dashboard>/orchestrator/orgs/<org>/settings/cloud-providers)`
+- Git: `[Add a git connector](https://<dashboard>/orchestrator/orgs/<org>/settings/vcs-providers)`
+
+`<org>` is what follows `/orgs/` in `source.filters.orgId` of any search
+response (`/orgs/acme` → `acme`). `<dashboard>` is `app.stackguardian.io` for
+Europe or `us.stackguardian.io` for the United States: match the region of the
+StackGuardian MCP server URL (`api.app.stackguardian.io` or
+`api.us.stackguardian.io`), and give both links if you can't tell. When the
+user confirms, search again.
+
+Never work around a missing connector by switching to another StackGuardian
+organization or MCP server, even one that has a matching connector. A
+different organization has different credentials, policies and people; switch
+only when the user explicitly asks for that organization.
+
 ## Error handling (teaching errors)
 
 The tool validates live and returns actionable errors instead of opaque 400s.

skills/sg-update-workflow/SKILL.md

@@ -80,9 +80,10 @@ Ask the user what they want to change, then build ONLY those parameters:
   either way.)
 - **Cloud connector** (`deployment`) — `{"connectorId": "/integrations/<id>"}`.
   Find connectors via
-  `search_orchestrator_resources(resourceTypes=['INTEGRATION.CLOUD'])`. The
-  connector's kind is resolved live; the workflow's existing deploy-profile name
-  is kept unless you pass `deployment.profileName`.
+  `search_orchestrator_resources(resourceTypes=['INTEGRATION.CLOUD'])`; if
+  none fits, see **No connector yet**. The connector's kind is resolved live;
+  the workflow's existing deploy-profile name is kept unless you pass
+  `deployment.profileName`.
 - **Environment variables** (`environmentVariables`) — a list of
   `{varName, textValue}` or `{varName, secretId}` entries. These are UPSERTED by
   name: entries you pass add or replace matching vars; every existing var you
@@ -203,6 +204,28 @@ Summarize, in plain language, exactly what will change (and note that everything
 else stays the same). On confirmation, call `update_workflow` with `wfGrp`,
 `resourceName`, the optional `stack`, and only the fields being changed.
 
+## No connector yet
+
+Connectors can't be created with the MCP tools. When a connector search returns
+nothing, or nothing for the cloud account or git host the user needs, stop and
+give the user the settings page as a markdown link, so they can click through,
+then wait until they say the connector is added:
+
+- Cloud: `[Add a cloud connector](https://<dashboard>/orchestrator/orgs/<org>/settings/cloud-providers)`
+- Git: `[Add a git connector](https://<dashboard>/orchestrator/orgs/<org>/settings/vcs-providers)`
+
+`<org>` is what follows `/orgs/` in `source.filters.orgId` of any search
+response (`/orgs/acme` → `acme`). `<dashboard>` is `app.stackguardian.io` for
+Europe or `us.stackguardian.io` for the United States: match the region of the
+StackGuardian MCP server URL (`api.app.stackguardian.io` or
+`api.us.stackguardian.io`), and give both links if you can't tell. When the
+user confirms, search again.
+
+Never work around a missing connector by switching to another StackGuardian
+organization or MCP server, even one that has a matching connector. A
+different organization has different credentials, policies and people; switch
+only when the user explicitly asks for that organization.
+
 ## Error handling (teaching errors)
 
 Present the offered options and re-call — don't guess:

src/sg/commands.ts

@@ -634,10 +634,10 @@ export async function runConnect(
 }
 
 const SUGGESTED_PROMPTS = [
-  "Summarize my StackGuardian security posture and top misconfigurations",
-  "Why did my latest workflow run fail? Show me the logs",
-  "Create a workflow from a marketplace template for an S3 bucket",
-  "Upgrade my workflows that use an outdated template version",
+  "Deploy the Terraform in this repo and show me the plan before apply",
+  "Create an OpenTofu workflow for this repo that waits for my approval",
+  "Run our Ansible playbook as a StackGuardian workflow",
+  "Why did my latest deployment fail? Show me the logs",
 ];
 
 /** Agent pick, server entry, skills and the closing note: everything after the credential. */