@faable/faable 4.5.1 → 4.5.2

package/dist/api/FaableApi.js

@@ -88,9 +88,14 @@ class FaableApi {
                     // Uniform handling for an expired/invalid session across every
                     // command, regardless of which endpoint returned the 401.
                     if (res.status === 401) {
-                        const expired = new Error('Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
+                        // With an API key there is no session to renew: the key itself
+                        // is wrong or was revoked (the hosted MCP server runs on keys).
+                        const by_key = !!process.env.FAABLE_API_KEY && !process.env.FAABLE_TOKEN;
+                        const expired = new Error(by_key
+                            ? 'This Faable API key is invalid or was revoked. Create a new one in the dashboard (project settings → API Keys).'
+                            : 'Your Faable session has expired or is invalid. Run `faable login` to sign in again.', { cause: error });
                         expired.status = 401;
-                        expired.code = 'session_expired';
+                        expired.code = by_key ? 'apikey_invalid' : 'session_expired';
                         throw expired;
                     }
                     const serverMessage = res.data?.message || res.statusText || 'Unknown Error';

package/dist/mcp/http.js

@@ -15,14 +15,14 @@ import { TOOLS } from './tools.js';
 // Streamable HTTP, stateless: every POST /mcp builds a server and a transport
 // for that one request, so any instance can answer anything. The caller
 // authenticates with a Faable API key (dashboard → project settings → API
-// keys). ⚠️ A key acts with its OWNER's access, not only on the project it was
-// created in (arch/deploy/mcp-cli-gaps.md) — /mcp/<project> is how a caller
-// narrows it. Each tool call runs the CLI as a child
+// keys). A key belongs to the project it was created in, and the api holds it
+// there (api 2.199.2, backlog §302): it never acts as its owner nor reaches
+// another project. Each tool call runs the CLI as a child
 // with THAT key in its environment and an empty HOME of its own — two
 // callers' credentials never meet in one process, and the key is never
 // logged.
 //
-//   POST /mcp              everything the key's owner can see
+//   POST /mcp              the key's project
 //   POST /mcp/<project>    pinned to one project (id, name or slug)
 //   ?mode=write            also the reversible writes
 //   ?readonly=1            reads only — not even deploy_app
@@ -151,7 +151,7 @@ const llms_txt = (base = PUBLIC_URL) => [
     '',
     '> Connects Claude, Cursor and any MCP client to Faable Deploy: read apps, deployments, build and runtime logs, traffic and domains, and deploy — without leaving the editor.',
     '',
-    `Endpoint: ${base}/mcp (Streamable HTTP). Authenticate with a Faable API key: \`Authorization: Bearer <key>\` (create one in the dashboard, project settings → API keys). The key acts with its owner's access; connect to \`${base}/mcp/<project>\` to keep every call in one project.`,
+    `Endpoint: ${base}/mcp (Streamable HTTP). Authenticate with a Faable API key: \`Authorization: Bearer <key>\` (create one in the dashboard, project settings → API keys). The key belongs to one project and only acts there.`,
     '',
     `- \`${base}/mcp/<project>\` pins every call to one project.`,
     '- `?mode=write` adds the reversible writes (create apps, set secrets, add domains, retry or cancel builds, change deploy settings). Nothing destructive is exposed.',

package/dist/mcp/server.js

@@ -32,6 +32,7 @@ const NEXT_STEP = {
     session_expired: 'The Faable session expired. Ask the user to run `faable login` in a terminal, then retry.',
     account_suspended: 'This Faable account is suspended; the user should contact support@faable.com.',
     apikey_session: 'The user is logged in with an API key; this needs `faable login` without --apikey.',
+    apikey_invalid: 'The API key this server was given is invalid or was revoked. The user needs a new one from the dashboard (project settings → API Keys).',
     not_found: 'Check the id or name — list_apps / list_deployments show what exists.',
     forbidden: 'This session has no access there — check the project (list_projects).',
     app_required: 'Pass `app` (id, name or slug).',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.5.1",
+  "version": "4.5.2",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",