@faable/faable 4.18.1 → 4.18.2

package/dist/api/FaableApi.js

@@ -5,6 +5,16 @@ import { create_base_client } from './base_client.js';
 // method (a reset mid-flight means the request was not processed).
 const RESET_CODES = new Set(['ECONNRESET', 'EPIPE']);
 const RETRY_DELAY_MS = 300;
+// The api's 401 codes that mean the credential itself is dead (api
+// `lib/api_error.ts`). No code at all is an old api or the auth layer: treated
+// as dead too, like before.
+const CREDENTIAL_ERRORS = new Set([
+    'unauthorized',
+    'invalid_token',
+    'invalid_apikey',
+    'apikey_expired'
+]);
+const is_credential_error = (code) => !code || CREDENTIAL_ERRORS.has(code);
 const is_connection_reset = (e) => e.isAxiosError &&
     !e.response &&
     (RESET_CODES.has(e.code ?? '') || e.message.includes('socket hang up'));
@@ -86,8 +96,14 @@ class FaableApi {
                 const url = e.config?.url || '';
                 if (res) {
                     // Uniform handling for an expired/invalid session across every
-                    // command, regardless of which endpoint returned the 401.
-                    if (res.status === 401) {
+                    // command, regardless of which endpoint returned the 401. Only
+                    // for a dead credential: the api also answers 401 to a valid one
+                    // that may not do this (`team_or_scope_required`,
+                    // `secrets_access_denied`…), and telling that caller to log in
+                    // again sent them in circles (backlog §374).
+                    if (res.status === 401 &&
+                        is_credential_error(res.data?.error_code ??
+                            res.data?.code)) {
                         // With an API key there is no session to renew: the key itself
                         // is wrong or was revoked (the hosted MCP server runs on keys).
                         const by_key = !!process.env.FAABLE_API_KEY && !process.env.FAABLE_TOKEN;
@@ -236,8 +252,14 @@ class FaableApi {
     async uploadDeploymentLogs(deployment_id, body) {
         return data(this.client.post(`/deployment/${deployment_id}/logs`, body, { timeout: 60_000, maxBodyLength: Infinity, maxContentLength: Infinity }));
     }
-    async getAppSecrets(app_id) {
-        return firstPage(data(this.client.get(`/secret/${app_id}`)));
+    // With the app's project as `x-faable-project`: a user token carries no
+    // project, and the api refuses secrets to a context without one
+    // (`secrets_access_denied`) — `secrets list` failed for every `faable login`
+    // user (backlog §374).
+    async getAppSecrets(app_id, team) {
+        return firstPage(data(this.client.get(`/secret/${app_id}`, {
+            headers: projectHeader(team)
+        })));
     }
     // Replace the app's whole secret set (the endpoint deletes and recreates).
     // This is the only mutation path that triggers an immediate restart of the
@@ -393,4 +415,4 @@ class FaableApi {
     }
 }
 
-export { FaableApi, projectHeader };
+export { FaableApi, is_credential_error, projectHeader };

package/dist/commands/deploy/inspect/list.js

@@ -1,5 +1,6 @@
 import { requireApi } from '../../../api/context.js';
-import { fetch_page, print_json, print, more_hint, list_options } from '../../../lib/listing.js';
+import { requireProject } from '../../../api/project.js';
+import { print_json, print, more_hint, list_options, fetch_page } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
 import { phase_badge } from './format.js';
 
@@ -10,8 +11,21 @@ const apps_list = {
     handler: async (args) => {
         const ctx = await requireApi();
         // Scoped to the active project when there is one (--project,
-        // FAABLE_PROJECT, `faable project use`); every app you can see otherwise.
-        const page = await fetch_page(p => ctx.api.listApps(p), args);
+        // FAABLE_PROJECT, `faable project use`); every app you can see otherwise —
+        // which the api only allows a token with a global scope. Anyone else gets
+        // `team_or_scope_required`: then, like `whoami`, the only project they
+        // belong to, or an error that says how to pick one (backlog §374).
+        const list = () => fetch_page(p => ctx.api.listApps(p), args);
+        let page;
+        try {
+            page = await list();
+        }
+        catch (e) {
+            if (ctx.api.project || e?.code !== 'team_or_scope_required')
+                throw e;
+            ctx.api.project = (await requireProject(ctx.api)).id;
+            page = await list();
+        }
         if (args.json)
             return print_json(page);
         if (page.data.length === 0) {

package/dist/commands/deploy/inspect/logs.js

@@ -61,12 +61,16 @@ const logs = {
         const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
         const app = await ctx.api.getApp(app_id);
         if (args.build) {
-            // Build output lives on the deployment. Default to the newest one —
-            // exactly what you want after a red `faable deploy`.
+            // Build output lives on the deployment. Default to the newest one that
+            // was not cancelled — exactly what you want after a red `faable deploy`.
+            // A cancelled redeploy usually never built: picking it answered 404 to
+            // "why did my build fail?" (backlog §374). Only cancelled ones: the
+            // newest anyway.
             let deployment_id = args.deployment;
             if (!deployment_id) {
                 const deployments = await ctx.api.listDeployments(app_id, app.team);
-                deployment_id = deployments[0]?.id;
+                deployment_id = (deployments.find(d => d.status?.phase !== 'CANCELED') ??
+                    deployments[0])?.id;
                 if (!deployment_id) {
                     if (args.json) {
                         return print_json({

package/dist/commands/deploy/secrets/list.js

@@ -25,7 +25,8 @@ const secrets_list = {
     handler: async (args) => {
         const ctx = await requireApi();
         const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
-        const secrets = await ctx.api.getAppSecrets(app_id);
+        const app = await ctx.api.getApp(app_id);
+        const secrets = await ctx.api.getAppSecrets(app_id, app.team);
         // The whole set in one response (the api doesn't page secrets). Values
         // stay masked unless --show, in JSON as on screen.
         if (args.json) {

package/dist/commands/deploy/secrets/rm.js

@@ -34,7 +34,7 @@ const secrets_rm = {
         // remaining set first — this also rejects unknown names and secrets
         // inherited from the team profile.
         const app = await ctx.api.getApp(app_id);
-        const secrets = await ctx.api.getAppSecrets(app_id);
+        const secrets = await ctx.api.getAppSecrets(app_id, app.team);
         const remaining = remove_app_secret(secrets, args.name);
         const go = await confirm({
             message: `Remove secret "${args.name}" from ${app_id}?`,

package/dist/commands/deploy/secrets/set.js

@@ -111,7 +111,7 @@ const secrets_set = {
         // getApp also validates access to the app and provides the team the
         // batch endpoint requires as request context.
         const app = await ctx.api.getApp(app_id);
-        const existing = await ctx.api.getAppSecrets(app_id);
+        const existing = await ctx.api.getAppSecrets(app_id, app.team);
         const merged = merge_app_secrets(existing, parsed);
         await ctx.api.createSecretsBatch(app.id, app.team, merged);
         const current = new Map(existing

package/dist/mcp/tools.js

@@ -233,7 +233,7 @@ const TOOLS = [
     {
         name: 'get_build_logs',
         title: 'Read build logs',
-        description: 'The build output of a deployment — the first thing to read when a deploy failed and the user asks why. The cause is usually at the end. Without `deployment`, the newest one.',
+        description: 'The build output of a deployment — the first thing to read when a deploy failed and the user asks why. The cause is usually at the end. Without `deployment`, the newest one that was not cancelled.',
         input: {
             app,
             project,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.18.1",
+  "version": "4.18.2",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",