[pull] main from supermemoryai:main

apps/docs/changelog/developer-platform.mdx

@@ -6,6 +6,10 @@ description: "API updates, new endpoints, and SDK releases"
 
 API updates, new endpoints, SDK releases, and developer-focused features.
 
+## April 13, 2026
+
+- **Google Drive scoped sync:** New connections default to a **hosted folder/file picker** after OAuth; only chosen items sync. Use `metadata.syncScope: "full"` to sync the whole Drive. Import jobs **skip** scoped connections until a selection exists.
+
 ## March 18, 2026
 
 - **Supermemory CLI:** New command-line tool for managing memories, documents, profiles, tags, connectors, and API keys directly from the terminal.

apps/docs/changelog/overview.mdx

@@ -3,6 +3,14 @@ title: "Changelog"
 description: "New updates and improvements to Supermemory"
 ---
 
+<Update label="April 13, 2026" tags={["Integrations", "API"]}>
+
+### Google Drive: scoped sync by default
+
+New Google Drive connections default to **folder and file** scope: after OAuth, users complete a hosted picker; only selected items sync. Set `metadata.syncScope` to `"full"` on connection creation to sync the entire Drive without the picker. Scoped connections without a saved selection are skipped by import jobs until setup is finished.
+
+</Update>
+
 <Update label="March 18, 2026" tags={["API", "SDK", "Console", "CLI"]}>
 
 ### Supermemory CLI

apps/docs/connectors/google-drive.mdx

@@ -6,6 +6,18 @@ icon: "google-drive"
 
 Connect Google Drive to sync documents into your Supermemory knowledge base with OAuth authentication and custom app support.
 
+## Sync scope
+
+**Default for new connections:** after OAuth, the user completes a **folder and file** picker (Google Docs, Sheets, Slides, and PDFs). Only items they select are synced and updated until they change the selection (for example from the Supermemory console).
+
+**Whole Drive:** set `metadata.syncScope` to `"full"` when creating the connection so the entire Drive syncs without the picker.
+
+**Explicit scoped mode:** set `metadata.syncScope` to `"selected"` for the picker flow, or rely on the default for new connects.
+
+<Note>
+If you use scoped sync and the user has not finished the picker yet, **scheduled or manual import may skip that connection** until a selection is saved on the connection.
+</Note>
+
 ## Quick Setup
 
 ### 1. Create Google Drive Connection
@@ -25,7 +37,8 @@ Connect Google Drive to sync documents into your Supermemory knowledge base with
       documentLimit: 3000,
       metadata: {
         source: 'google-drive',
-        department: 'engineering'
+        department: 'engineering',
+        syncScope: 'selected'
       }
     });
 
@@ -48,7 +61,8 @@ Connect Google Drive to sync documents into your Supermemory knowledge base with
         document_limit=3000,
         metadata={
             'source': 'google-drive',
-            'department': 'engineering'
+            'department': 'engineering',
+            'syncScope': 'selected',
         }
     )
 
@@ -68,16 +82,21 @@ Connect Google Drive to sync documents into your Supermemory knowledge base with
         "documentLimit": 3000,
         "metadata": {
           "source": "google-drive",
-          "department": "engineering"
+          "department": "engineering",
+          "syncScope": "selected"
         }
       }'
     ```
   </Tab>
 </Tabs>
 
+<Note>
+For **whole Drive** sync, include `"syncScope": "full"` in `metadata` on the same `POST /v3/connections/google-drive` request instead of `"selected"`.
+</Note>
+
 ### 2. Handle OAuth Callback
 
-After user grants permissions, Google redirects to your callback URL. The connection is automatically established.
+After the user grants permissions, Google redirects through Supermemory to finish the connection. With **scoped** sync (`syncScope` omitted or `"selected"`), the user is sent to Supermemory’s **hosted file and folder picker**; they must complete that step before imports run. With **`syncScope: "full"`**, Supermemory redirects to your `redirectUrl` (or returns connection details) **without** the picker. You can open the picker again later for an existing connection (Supermemory console, or `POST /v3/connections/{connectionId}/google-drive/hosted-picker` with an authenticated admin session).
 
 ### 3. Check Connection Status
 

apps/mcp/src/index.ts

@@ -114,12 +114,18 @@ const handleMcpRequest = async (c: Context<{ Bindings: Bindings }>) => {
 	const token = authHeader?.replace(/^Bearer\s+/i, "")
 	const containerTag = c.req.header("x-sm-project")
 	const apiUrl = c.env.API_URL || DEFAULT_API_URL
-
-	const reqHost = c.req.header("x-forwarded-host") || c.req.header("host") || ""
-	const reqProto = c.req.header("x-forwarded-proto") || "https"
-	const resourceMetadataUrl = reqHost
-		? `${reqProto}://${reqHost}/.well-known/oauth-protected-resource`
-		: "/.well-known/oauth-protected-resource"
+	const mcpURL =
+		c.env.API_URL === "http://localhost:8787"
+			? "http://localhost:8788"
+			: "https://mcp.supermemory.ai"
+
+	// TODO: commented out because this might be issue with auth
+	//const reqHost = c.req.header("x-forwarded-host") || c.req.header("host") || ""
+	//const reqProto = c.req.header("x-forwarded-proto") || "https"
+	//const resourceMetadataUrl = reqHost
+	//	? `${reqProto}://${reqHost}/.well-known/oauth-protected-resource`
+	//	: "/.well-known/oauth-protected-resource"
+	const resourceMetadataUrl = `${mcpURL}/.well-known/oauth-protected-resource`
 
 	if (!token) {
 		return new Response("Unauthorized", {