Update to Walla

Changed files

.codex-plugin/plugin.json →

skills/walla/SKILL.md →

skills/walla/references/custom-fields.md →

skills/walla/references/forms.md →

skills/walla/references/responses-and-automations.md →

skills/walla/references/responses-and-automations.md

--- before
+++ after
@@ -21,15 +21,16 @@
 1. Proceed only when the user explicitly asks to send Walla responses to a webhook or external server.
 2. Read `get_published_form` for real field and choice-option IDs. Read `branch-logic` when conditions are needed.
 3. Call `create_automation` with one webhook action. Email and Google Sheets automations are dashboard-only in this MCP version.
-4. Use an HTTPS endpoint supplied or approved by the user. Do not invent endpoints or send response data to an unrelated service.
+4. Use a public endpoint that the user supplied or approved, and prefer HTTPS. The server rejects private, loopback, and internal hosts. Do not invent endpoints or send response data to an unrelated service.
 5. For a custom body, use Walla mentions such as `@[Label]{{res:<fieldId>}}`, `@[Label]{{hidden:<key>}}`, `@[Response]{{responseKey}}`, `@[Customer]{{customerKey}}`, `@[Form]{{projectKey}}`, or `@[Time]{{timestamp}}`.
-6. Report that the new automation is inactive. Do not enable it unless the user asks.
+6. The default payload includes the response's hidden-field values (values captured from URL query parameters). Set `includeHiddenFields: false` when the user does not want to send them. This setting does not change a custom body.
+7. Report that the new automation is inactive. Do not enable it unless the user asks.
 
 ## Update or enable an automation
 
 1. Get the automation ID and current state from `list_automations`.
 2. Use `update_automation` only for a simple single-route webhook automation. Leave multiple routes and email or Sheets actions for the dashboard.
-3. Send only the fields the user asked to change. An empty custom `body` resets delivery to the default full-response payload; omitting it preserves the current body.
+3. Send only the fields the user asked to change. An empty custom `body` resets delivery to the default full-response payload; omitting it preserves the current body. Omitting `includeHiddenFields` or `conditions` also preserves the current setting, but `conditions: []` or `null` makes the automation fire on every response.
 4. Before setting `isActive: true`, ensure the request explicitly asks to enable delivery. Tell the user that new responses will start going to the configured endpoint immediately.
 5. Verify the result with `list_automations`.