@faable/faable 4.5.0 → 4.5.2

package/dist/api/FaableApi.js

@@ -88,9 +88,14 @@ class FaableApi {
                     // Uniform handling for an expired/invalid session across every
                     // command, regardless of which endpoint returned the 401.
                     if (res.status === 401) {
-                        const expired = new Error('Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
+                        // With an API key there is no session to renew: the key itself
+                        // is wrong or was revoked (the hosted MCP server runs on keys).
+                        const by_key = !!process.env.FAABLE_API_KEY && !process.env.FAABLE_TOKEN;
+                        const expired = new Error(by_key
+                            ? 'This Faable API key is invalid or was revoked. Create a new one in the dashboard (project settings → API Keys).'
+                            : 'Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
                         expired.status = 401;
-                        expired.code = 'session_expired';
+                        expired.code = by_key ? 'apikey_invalid' : 'session_expired';
                         throw expired;
                     }
                     const serverMessage = res.data?.message || res.statusText || 'Unknown Error';
@@ -227,8 +232,12 @@ class FaableApi {
     async updateApp(app_id, params) {
         return data(this.client.post(`/app/${app_id}`, params));
     }
-    async linkRepository(app_id, params) {
-        return data(this.client.post(`/app/${app_id}/link-repository`, params));
+    // Team pinned via header: the api answers 400 team_required without it
+    // (it needs the project to check the plan and the repository guard).
+    async linkRepository(app_id, params, team) {
+        return data(this.client.post(`/app/${app_id}/link-repository`, params, {
+            headers: projectHeader(team)
+        }));
     }
     // Organizations/accounts where the Faable GitHub App is installed.
     async listGithubInstallations() {
@@ -259,11 +268,11 @@ class FaableApi {
     }
     // Build and deploy the current head of the deploy branch server-side —
     // the same path a push webhook takes, same-commit dedupe included.
-    async deployNow(app_id) {
+    async deployNow(app_id, team) {
         return data(
         // deployment_id: the build this call started (api ≥ the release that
         // added it; absent from older ones).
-        this.client.post(`/app/${app_id}/deploy`));
+        this.client.post(`/app/${app_id}/deploy`, undefined, { headers: projectHeader(team) }));
     }
     // Rebuild a failed deployment from its recorded source (CAS manifest or
     // git ref). The API enforces the guards: failed phase only, never older

package/dist/commands/deploy/apps/create.js

@@ -81,7 +81,7 @@ const apps_create = {
                 linked = await api.linkRepository(app.id, {
                     repository,
                     ...(args.branch ? { github_branch: args.branch } : {})
-                });
+                }, app.team);
             }
             catch (err) {
                 await api.deleteApp(app.id, app.team).catch(() => {
@@ -102,7 +102,7 @@ const apps_create = {
         let first_deploy = null;
         if (repository && args.deploy && linked.deploy_trigger === 'webhook') {
             try {
-                const started = await api.deployNow(app.id);
+                const started = await api.deployNow(app.id, app.team);
                 first_deploy = {
                     commit: started.commit,
                     branch: started.branch,

package/dist/commands/deploy/inspect/trigger.js

@@ -20,7 +20,7 @@ const trigger = {
         const app = await ctx.api.getApp(app_id);
         // Takes the exact same path a git push would (same-commit dedupe
         // included) — the API answers with an actionable refusal otherwise.
-        const result = await ctx.api.deployNow(app_id);
+        const result = await ctx.api.deployNow(app_id, app.team);
         if (args.json)
             return print_json({ app_id, ...result });
         log.info(`🚀 Building ${result.commit.slice(0, 7)} (${result.branch}) of ${app.name} server-side${result.deployment_id ? ` as ${result.deployment_id}` : ''}.`);

package/dist/commands/link/index.js

@@ -77,7 +77,7 @@ const link = {
         // access to the repository before persisting the link.
         let linked;
         try {
-            linked = await api.linkRepository(selectedApp.id, { repository: gitUrl });
+            linked = await api.linkRepository(selectedApp.id, { repository: gitUrl }, selectedApp.team);
         }
         catch (err) {
             const code = err?.code;

package/dist/mcp/http.js

@@ -15,14 +15,14 @@ import { TOOLS } from './tools.js';
 // Streamable HTTP, stateless: every POST /mcp builds a server and a transport
 // for that one request, so any instance can answer anything. The caller
 // authenticates with a Faable API key (dashboard → project settings → API
-// keys). ⚠️ A key acts with its OWNER's access, not only on the project it was
-// created in (arch/deploy/mcp-cli-gaps.md) — /mcp/<project> is how a caller
-// narrows it. Each tool call runs the CLI as a child
+// keys). A key belongs to the project it was created in, and the api holds it
+// there (api 2.199.2, backlog §302): it never acts as its owner nor reaches
+// another project. Each tool call runs the CLI as a child
 // with THAT key in its environment and an empty HOME of its own — two
 // callers' credentials never meet in one process, and the key is never
 // logged.
 //
-//   POST /mcp              everything the key's owner can see
+//   POST /mcp              the key's project
 //   POST /mcp/<project>    pinned to one project (id, name or slug)
 //   ?mode=write            also the reversible writes
 //   ?readonly=1            reads only — not even deploy_app
@@ -151,7 +151,7 @@ const llms_txt = (base = PUBLIC_URL) => [
     '',
     '> Connects Claude, Cursor and any MCP client to Faable Deploy: read apps, deployments, build and runtime logs, traffic and domains, and deploy — without leaving the editor.',
     '',
-    `Endpoint: ${base}/mcp (Streamable HTTP). Authenticate with a Faable API key: \`Authorization: Bearer <key>\` (create one in the dashboard, project settings → API keys). The key acts with its owner's access; connect to \`${base}/mcp/<project>\` to keep every call in one project.`,
+    `Endpoint: ${base}/mcp (Streamable HTTP). Authenticate with a Faable API key: \`Authorization: Bearer <key>\` (create one in the dashboard, project settings → API keys). The key belongs to one project and only acts there.`,
     '',
     `- \`${base}/mcp/<project>\` pins every call to one project.`,
     '- `?mode=write` adds the reversible writes (create apps, set secrets, add domains, retry or cancel builds, change deploy settings). Nothing destructive is exposed.',

package/dist/mcp/server.js

@@ -32,6 +32,7 @@ const NEXT_STEP = {
     session_expired: 'The Faable session expired. Ask the user to run `faable login` in a terminal, then retry.',
     account_suspended: 'This Faable account is suspended; the user should contact support@faable.com.',
     apikey_session: 'The user is logged in with an API key; this needs `faable login` without --apikey.',
+    apikey_invalid: 'The API key this server was given is invalid or was revoked. The user needs a new one from the dashboard (project settings → API Keys).',
     not_found: 'Check the id or name — list_apps / list_deployments show what exists.',
     forbidden: 'This session has no access there — check the project (list_projects).',
     app_required: 'Pass `app` (id, name or slug).',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",