@getxflow/cli 0.14.1 → 0.15.0

package/dist/bin.js

@@ -265,6 +265,9 @@ function nudgeSkill() {
 }
 async function main() {
     const args = (0, args_1.parseArgs)(process.argv.slice(2));
+    // Decided here rather than in each command: the header of --project, the nudges and
+    // every progress line are written on the way to a payload that has to stand alone.
+    (0, ui_1.setQuiet)((0, args_1.flagBool)(args, 'json'));
     if ((0, args_1.flagBool)(args, 'version')) {
         (0, ui_1.out)(version_1.CLI_VERSION);
         return 0;
@@ -275,7 +278,7 @@ async function main() {
     }
     // The update command says it better itself, and the min-version refusal already
     // carries the same advice in its hint.
-    let quiet = args.words[0] === 'update';
+    let nudgeCovered = args.words[0] === 'update';
     try {
         (0, flags_1.checkFlags)(args);
         await run(args);
@@ -283,38 +286,38 @@ async function main() {
     }
     catch (e) {
         if (e instanceof api_1.ApiError) {
-            (0, ui_1.fail)(e.message);
+            (0, ui_1.fatal)(e.message);
             if (e.limit)
-                (0, ui_1.note)((0, ui_1.dim)(`  ${(0, limits_1.limitLine)(e.limit)}`));
+                (0, ui_1.fatalNote)((0, ui_1.dim)(`  ${(0, limits_1.limitLine)(e.limit)}`));
             if (e.hint)
-                (0, ui_1.note)((0, ui_1.dim)(`  ${e.hint}`));
+                (0, ui_1.fatalNote)((0, ui_1.dim)(`  ${e.hint}`));
             if (e.code === 'not_found') {
                 // XFLOW_TOKEN is taken as given and no organization is looked for, so a
                 // project of another one answers "not found" with nothing else to say.
                 if (process.env.XFLOW_TOKEN?.trim()) {
-                    (0, ui_1.note)((0, ui_1.dim)('  XFLOW_TOKEN is set: it is the key of one organization and is used as it comes, so a project of another one is not found'));
+                    (0, ui_1.fatalNote)((0, ui_1.dim)('  XFLOW_TOKEN is set: it is the key of one organization and is used as it comes, so a project of another one is not found'));
                 }
                 else if ((0, credentials_1.anyMultipleOrgs)()) {
-                    (0, ui_1.note)((0, ui_1.dim)('  Several organizations are signed in: the answer may live in another one, see xflow org'));
+                    (0, ui_1.fatalNote)((0, ui_1.dim)('  Several organizations are signed in: the answer may live in another one, see xflow org'));
                 }
             }
-            quiet = quiet || e.code === 'outdated_cli';
+            nudgeCovered = nudgeCovered || e.code === 'outdated_cli';
             return 1;
         }
         if (e instanceof errors_1.CliError || e instanceof config_1.ConfigError || e instanceof zip_1.ZipError) {
-            (0, ui_1.fail)(e.message);
+            (0, ui_1.fatal)(e.message);
             const hint = e instanceof errors_1.CliError ? e.hint : undefined;
             if (hint)
-                (0, ui_1.note)((0, ui_1.dim)(`  ${hint}`));
+                (0, ui_1.fatalNote)((0, ui_1.dim)(`  ${hint}`));
             return 1;
         }
-        (0, ui_1.fail)(e instanceof Error ? e.message : String(e));
+        (0, ui_1.fatal)(e instanceof Error ? e.message : String(e));
         if (process.env.XFLOW_DEBUG && e instanceof Error && e.stack)
-            (0, ui_1.note)((0, ui_1.dim)(e.stack));
+            (0, ui_1.fatalNote)((0, ui_1.dim)(e.stack));
         return 1;
     }
     finally {
-        if (!quiet)
+        if (!nudgeCovered)
             nudge();
         // Not behind the same flag: a copy out of step with the running package stays wrong
         // whatever the command was, and when the package itself is the problem this steps
@@ -325,6 +328,6 @@ async function main() {
 main().then((code) => {
     process.exitCode = code;
 }, (e) => {
-    (0, ui_1.fail)(e instanceof Error ? e.message : String(e));
+    (0, ui_1.fatal)(e instanceof Error ? e.message : String(e));
     process.exitCode = 1;
 });

package/dist/commands/connections.js

@@ -6,7 +6,6 @@ exports.connectionsUnlink = connectionsUnlink;
 exports.connectionsCall = connectionsCall;
 const api_1 = require("../api");
 const args_1 = require("../args");
-const config_1 = require("../config");
 const errors_1 = require("../errors");
 const json_arg_1 = require("../json-arg");
 const session_1 = require("../session");
@@ -107,11 +106,10 @@ async function connectionsUnlink(args) {
     if (!target) {
         throw new errors_1.CliError('A connection is required', 'For example: xflow connections unlink YANDEX_METRIKA');
     }
-    const { root, config } = (0, config_1.requireProject)();
-    const client = (0, session_1.connect)(config);
+    const { projectId, client, root } = await (0, session_1.projectTarget)(args);
     // The alias is what the code of the functions knows, and it wins: it is the
     // most precise of the three, since it names the link and not just the account.
-    const data = await (0, api_1.apiJson)(client, endpoint(config.projectId));
+    const data = await (0, api_1.apiJson)(client, endpoint(projectId));
     const byAlias = data.connections.find((item) => item.alias !== null && item.alias === target.toUpperCase());
     const row = byAlias ?? resolve(data.connections, target);
     if (!row.alias) {
@@ -119,17 +117,27 @@ async function connectionsUnlink(args) {
         return;
     }
     // The platform does not see the sources, so this check lives here. Without it
-    // the unlink is silent and the breakage shows up one deploy later.
-    const needed = (0, env_1.referencedByFunctions)(root).needed;
-    const inUse = row.env
-        .map((name) => ({ name, users: needed.get(name) ?? [] }))
-        .filter((entry) => entry.users.length > 0);
-    if (inUse.length > 0 && !(0, args_1.flagBool)(args, 'force')) {
-        (0, ui_1.fail)(`The functions of this project read the variables of ${row.alias}:`);
-        (0, ui_1.table)(inUse.map((entry) => [entry.name, entry.users.join(', ')]));
-        throw new errors_1.CliError('They would lose these variables on the next deploy', 'Repeat with --force if that is intended');
+    // the unlink is silent and the breakage shows up one deploy later. Named by id
+    // there is no folder to read: the link is still removed, since leaving it in
+    // place with no way to remove it is the worse of the two, and the names that go
+    // are printed instead of the functions that would miss them.
+    if (root === null) {
+        if (row.env.length > 0) {
+            (0, ui_1.note)(`Which functions read ${row.env.join(', ')} is not known here: that answer is in functions/`);
+        }
     }
-    const result = await (0, api_1.apiJson)(client, `${endpoint(config.projectId)}?connection_id=${encodeURIComponent(row.id)}`, { method: 'DELETE' });
+    else {
+        const needed = (0, env_1.referencedByFunctions)(root).needed;
+        const inUse = row.env
+            .map((name) => ({ name, users: needed.get(name) ?? [] }))
+            .filter((entry) => entry.users.length > 0);
+        if (inUse.length > 0 && !(0, args_1.flagBool)(args, 'force')) {
+            (0, ui_1.fail)(`The functions of this project read the variables of ${row.alias}:`);
+            (0, ui_1.table)(inUse.map((entry) => [entry.name, entry.users.join(', ')]));
+            throw new errors_1.CliError('They would lose these variables on the next deploy', 'Repeat with --force if that is intended');
+        }
+    }
+    const result = await (0, api_1.apiJson)(client, `${endpoint(projectId)}?connection_id=${encodeURIComponent(row.id)}`, { method: 'DELETE' });
     if (!result.removed) {
         (0, ui_1.note)(`${row.label} is not linked to this project`);
         return;
@@ -178,11 +186,14 @@ function shownHeaders(headers) {
  *
  * Request headers are not filtered: there are a few, they are yours, and seeing them is how
  * a {NAME} the connection does not have shows itself.
+ *
+ * The refusal writes it with the refusal, which is why the line is a parameter: --json keeps
+ * nothing but the payload, and a call that never produced one would lose the address too.
  */
-function showRequest(request) {
-    (0, ui_1.note)((0, ui_1.dim)(`  ${request.method} ${request.url}`));
+function showRequest(request, write = ui_1.note) {
+    write((0, ui_1.dim)(`  ${request.method} ${request.url}`));
     for (const [name, value] of Object.entries(request.headers))
-        (0, ui_1.note)((0, ui_1.dim)(`  ${name}: ${value}`));
+        write((0, ui_1.dim)(`  ${name}: ${value}`));
 }
 /** Headers typed as JSON. Values may carry {NAME} placeholders, the platform fills those in. */
 function headerArg(args) {
@@ -253,7 +264,7 @@ async function connectionsCall(args) {
         // Before the refusal itself, in the order of the answer: what went out, then what came of
         // it. Only the other side's refusals carry it, the rest never assembled an address.
         if (e instanceof api_1.ApiError && e.request)
-            showRequest(e.request);
+            showRequest(e.request, ui_1.fatalNote);
         throw e;
     }
     if ((0, args_1.flagBool)(args, 'json')) {

package/dist/commands/db.js

@@ -189,7 +189,8 @@ async function dbQuery(args) {
         body: { sql, limit: (0, args_1.flagNumber)(args, 'limit') },
         timeoutMs: 60_000,
     });
-    // The whole values, machine-readable, on stdout alone: the notes go to stderr.
+    // The whole values, machine-readable, and the only thing printed: --json silences
+    // the human lines, so stdout is the payload and nothing else.
     if ((0, args_1.flagBool)(args, 'json')) {
         (0, ui_1.out)(JSON.stringify({
             schema: data.schema,

package/dist/commands/skills.js

@@ -18,7 +18,9 @@ const ui_1 = require("../ui");
 const AGENTS = [
     { id: 'claude', label: 'Claude Code', project: ['.claude', 'skills'], global: ['.claude', 'skills'] },
     { id: 'cursor', label: 'Cursor', project: ['.agents', 'skills'], global: ['.cursor', 'skills'], rule: true },
-    { id: 'codex', label: 'Codex', project: ['.agents', 'skills'], global: ['.codex', 'skills'] },
+    // Codex calls ~/.codex/skills a deprecated location kept for backward compatibility;
+    // the user skills of every agent that shares the format live in ~/.agents/skills.
+    { id: 'codex', label: 'Codex', project: ['.agents', 'skills'], global: ['.agents', 'skills'], legacyGlobal: ['.codex', 'skills'] },
     { id: 'copilot', label: 'GitHub Copilot', project: ['.agents', 'skills'], global: ['.copilot', 'skills'] },
     { id: 'gemini', label: 'Gemini CLI', project: ['.agents', 'skills'], global: ['.gemini', 'skills'] },
     { id: 'opencode', label: 'OpenCode', project: ['.agents', 'skills'], global: ['.config', 'opencode', 'skills'] },
@@ -198,6 +200,10 @@ function copyPaths(base) {
     if ((0, update_1.classifyPath)(__dirname) !== 'checkout') {
         for (const agent of AGENTS)
             add(skillPath(base, agent, true), false);
+        for (const agent of AGENTS) {
+            if (agent.legacyGlobal)
+                add((0, node_path_1.join)((0, node_os_1.homedir)(), ...agent.legacyGlobal, 'xflow', 'SKILL.md'), false);
+        }
     }
     return paths;
 }

package/dist/flags.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KNOWN = void 0;
+exports.WORKING_COPY = exports.KNOWN = void 0;
 exports.checkFlags = checkFlags;
 const args_1 = require("./args");
 const errors_1 = require("./errors");
@@ -19,10 +19,12 @@ const help_1 = require("./help");
  *
  * `--project` is a flag like any other here, and it is written against a command
  * only when that command can answer without the working copy. The ones that cannot
- * (deploy, pull, status, db migrate, env check, env set, connections unlink) have
- * a folder to stand in, and naming a project they cannot read would be a lie.
+ * have a folder to stand in, and naming a project they cannot read would be a lie;
+ * they are listed in WORKING_COPY below, each with what it reads from that folder.
  * `db status` sits halfway: named by id it answers with the applied history alone,
- * without the comparison against migrations/.
+ * without the comparison against migrations/. `connections unlink` sits there too:
+ * by id it removes the link without the check of what reads the variables, because
+ * a link that can be made without a folder has to be removable without one.
  *
  * flags-sync.test.ts holds this table against the code: a flag listed here has to
  * be read by the handler of its command, and a flag the handler reads has to be
@@ -60,7 +62,7 @@ exports.KNOWN = {
     connections: ['project'],
     'connections list': ['project'],
     'connections link': ['as', 'project'],
-    'connections unlink': ['force'],
+    'connections unlink': ['force', 'project'],
     'connections call': ['method', 'data', 'data-file', 'header', 'json', 'project'],
     schedules: ['project'],
     'schedules list': ['project'],
@@ -87,6 +89,26 @@ exports.KNOWN = {
     deployments: ['project'],
     update: [],
 };
+/**
+ * What each of those commands reads from the working copy, in its own words.
+ *
+ * `has no flag --project` alone leaves the reader one dead end short of the answer:
+ * the next try, without the flag, ends at the missing xflow.json, and neither line
+ * tells a rule from an oversight. Naming the file the command would have to read
+ * does, and it also says when the errand needs no folder at all.
+ *
+ * Keys are the commands KNOWN keeps `--project` from, and flags.test.ts holds the
+ * two lists against each other: a command that later gains the flag has to lose its
+ * line here, or a refusal nobody prints any more stays behind as a lie.
+ */
+exports.WORKING_COPY = {
+    deploy: 'it sends the sources next to it',
+    pull: 'it writes the sources next to it',
+    status: 'it compares the folder with the revision on the platform',
+    'db migrate': 'it applies the files of migrations/',
+    'env check': 'it looks for the variables the code of the functions reads',
+    'env set': 'it names the functions that need a deploy for the value to arrive',
+};
 /** Answered everywhere: both are handled before the command runs. */
 const GLOBAL = new Set(['help', 'version']);
 /**
@@ -118,6 +140,15 @@ function commandOf(words) {
     }
     return Object.hasOwn(exports.KNOWN, first) ? first : null;
 }
+function hintFor(command, flag, allowed, page) {
+    const reads = exports.WORKING_COPY[command];
+    if (flag === 'project' && reads !== undefined) {
+        return `It works in the project folder: ${reads}. Which commands take --project: xflow help project`;
+    }
+    return allowed.length > 0
+        ? `It takes ${allowed.map((name) => `--${name}`).join(', ')}. What each one does: ${page}`
+        : `It takes no flags. What it does: ${page}`;
+}
 function checkFlags(args) {
     const command = commandOf(args.words);
     if (command === null)
@@ -131,9 +162,7 @@ function checkFlags(args) {
         if (GLOBAL.has(name))
             continue;
         if (!allowed.includes(name)) {
-            throw new errors_1.CliError(`xflow ${command} has no flag --${name}`, allowed.length > 0
-                ? `It takes ${allowed.map((flag) => `--${flag}`).join(', ')}. What each one does: ${page}`
-                : `It takes no flags. What it does: ${page}`);
+            throw new errors_1.CliError(`xflow ${command} has no flag --${name}`, hintFor(command, name, allowed, page));
         }
         // The value went missing, so the flag arrived as a bare switch. Left alone it
         // would mean the default, which is never what the person typing it wanted.

package/dist/help.js

@@ -154,15 +154,17 @@ no working copy of its own:
 
 Which commands: ${(0, ui_1.bold)('db status')}, ${(0, ui_1.bold)('db query')}, ${(0, ui_1.bold)('db schema')}, ${(0, ui_1.bold)('functions list')},
 ${(0, ui_1.bold)('functions invoke')}, ${(0, ui_1.bold)('functions logs')}, ${(0, ui_1.bold)('logs')}, ${(0, ui_1.bold)('env')}, ${(0, ui_1.bold)('env rm')},
-${(0, ui_1.bold)('connections')}, ${(0, ui_1.bold)('connections link')}, ${(0, ui_1.bold)('schedules')}, ${(0, ui_1.bold)('schedules set')},
-${(0, ui_1.bold)('schedules rm')}, ${(0, ui_1.bold)('storage ls')}, ${(0, ui_1.bold)('storage push')}, ${(0, ui_1.bold)('storage rm')},
-${(0, ui_1.bold)('deployments')}, ${(0, ui_1.bold)('publish')}, ${(0, ui_1.bold)('rollback')}. ${(0, ui_1.bold)('db status')} answers with less
-under the flag: the applied history alone, because comparing it against the local
-${(0, ui_1.bold)('migrations/')} directory needs the folder.
+${(0, ui_1.bold)('connections')}, ${(0, ui_1.bold)('connections link')}, ${(0, ui_1.bold)('connections unlink')}, ${(0, ui_1.bold)('schedules')},
+${(0, ui_1.bold)('schedules set')}, ${(0, ui_1.bold)('schedules rm')}, ${(0, ui_1.bold)('storage ls')}, ${(0, ui_1.bold)('storage push')},
+${(0, ui_1.bold)('storage rm')}, ${(0, ui_1.bold)('deployments')}, ${(0, ui_1.bold)('publish')}, ${(0, ui_1.bold)('rollback')}. Two of them
+answer with less under the flag: ${(0, ui_1.bold)('db status')} gives the applied history alone,
+because comparing it against the local ${(0, ui_1.bold)('migrations/')} directory needs the folder,
+and ${(0, ui_1.bold)('connections unlink')} removes the link without naming the functions that read
+its variables, for the same reason.
 
 The rest cannot answer without the working copy and have nothing to do with an id
 instead: ${(0, ui_1.bold)('deploy')}, ${(0, ui_1.bold)('pull')}, ${(0, ui_1.bold)('status')}, ${(0, ui_1.bold)('db migrate')}, ${(0, ui_1.bold)('env check')},
-${(0, ui_1.bold)('env set')}, ${(0, ui_1.bold)('connections unlink')}. They answer about the files next to them, so
+${(0, ui_1.bold)('env set')}. They answer about the files next to them, so
 they keep asking for a folder. ${(0, ui_1.bold)('projects get')} and ${(0, ui_1.bold)('link')} take no flag either:
 they name the project by its id as an argument.
 
@@ -381,7 +383,10 @@ of the same service under one name; then the command prints their identifiers an
 for one of those instead of guessing.
 
 ${(0, ui_1.bold)('unlink')} refuses while a function still reads one of the variables and names
-those functions; ${(0, ui_1.bold)('--force')} goes through anyway.
+those functions; ${(0, ui_1.bold)('--force')} goes through anyway. Seeing them needs the sources,
+so under ${(0, ui_1.bold)('--project')} there is no such check: the link goes, and the variables
+that go with it are printed instead. Both commands take the flag, because an account
+linked to a service project without a folder has to be removable the same way.
 
 Variables are named after the alias: an OAuth connection called ${(0, ui_1.bold)('YANDEX_METRIKA')}
 gives ${(0, ui_1.bold)('YANDEX_METRIKA_TOKEN')}, a key-based one gives a variable per field. They

package/dist/session.js

@@ -129,6 +129,10 @@ function isProjectId(value) {
  * rollback and deployments look for the organization of an unbound folder,
  * everything else takes the key it resolves to. Named by id there is no binding
  * to lean on, so the search always happens.
+ *
+ * `root` is that folder, and null when the id was named: a command that reads the
+ * sources for a check of its own then knows the check is not available rather than
+ * running it against whatever folder the caller happened to stand in.
  */
 async function projectTarget(args, options) {
     const named = (0, args_1.flagString)(args, 'project');
@@ -136,12 +140,13 @@ async function projectTarget(args, options) {
         if (!isProjectId(named)) {
             throw new errors_1.CliError(`--project takes a project id, got "${named}"`, 'The ids: xflow projects list');
         }
-        // Unconditional: the flag is the only place the id is typed by hand, and a
-        // wrong one answers 404 on a read and works on a write.
+        // Echoed back on every human run: the flag is the only place the id is typed by
+        // hand, and a wrong one answers 404 on a read and works on a write. Under --json
+        // the line is silenced with the rest, where the payload is the whole answer.
         (0, ui_1.note)((0, ui_1.dim)(`  Project ${named} (--project)`));
-        return { projectId: named, client: await connectProject(named, null) };
+        return { projectId: named, client: await connectProject(named, null), root: null };
     }
     const { root, config } = (0, config_1.requireProject)();
     const client = options?.probe === true ? await connectProject(config.projectId, root, config) : connect(config);
-    return { projectId: config.projectId, client };
+    return { projectId: config.projectId, client, root };
 }

package/dist/ui.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dim = exports.bold = void 0;
+exports.setQuiet = setQuiet;
 exports.out = out;
 exports.note = note;
 exports.step = step;
 exports.ok = ok;
 exports.warn = warn;
 exports.fail = fail;
+exports.fatal = fatal;
+exports.fatalNote = fatalNote;
 exports.table = table;
 exports.formatBytes = formatBytes;
 exports.formatAge = formatAge;
@@ -15,10 +18,22 @@ exports.confirmWord = confirmWord;
 const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
 /**
- * All CLI output. Data goes to stdout, progress and warnings to stderr,
- * so `xflow pull > file` captures data only.
+ * All CLI output. A run that succeeds writes to stdout and nothing else; stderr
+ * carries the exit path alone (`fatal` below) and the questions, which need a
+ * terminal anyway.
+ *
+ * Progress used to go to stderr, to keep stdout clean under a pipe. PowerShell 5.1
+ * turns every stderr line of a native program into an ErrorRecord, so a successful
+ * command came out red and threw under `$ErrorActionPreference = 'Stop'`. The pipe
+ * is served by `--json` instead: it silences the human lines rather than moving
+ * them aside, and the payload is then the whole of stdout.
  */
 const color = process.stdout.isTTY === true && !process.env.NO_COLOR;
+/** Set by --json: the payload on stdout is the whole answer, and nobody reads the rest. */
+let quiet = false;
+function setQuiet(on) {
+    quiet = on;
+}
 function paint(code, text) {
     return color ? `\u001b[${code}m${text}\u001b[0m` : text;
 }
@@ -33,7 +48,9 @@ function out(line = '') {
     process.stdout.write(`${line}\n`);
 }
 function note(line = '') {
-    process.stderr.write(`${line}\n`);
+    if (quiet)
+        return;
+    process.stdout.write(`${line}\n`);
 }
 function step(message) {
     note((0, exports.dim)(`→ ${message}`));
@@ -47,6 +64,19 @@ function warn(message) {
 function fail(message) {
     note(red(`✗ ${message}`));
 }
+/**
+ * The exit path: what comes with a non-zero code. The only lines still written to
+ * stderr, and never silenced by --json, because a caller reading the payload has to
+ * see why there is none. `fail` above is the same red mark inside a report that ends
+ * well, `xflow env check` for one, and stays with the rest of it on stdout.
+ */
+function fatal(message) {
+    process.stderr.write(`${red(`✗ ${message}`)}\n`);
+}
+/** A line belonging to the failure just announced: the hint, the limit, the stack. */
+function fatalNote(line) {
+    process.stderr.write(`${line}\n`);
+}
 /** Column-aligned rows, no header. */
 function table(rows) {
     if (rows.length === 0)
@@ -118,8 +148,8 @@ function offerBrowser(url) {
 /** Dangerous-action confirmation: type the exact word. Unavailable without a TTY. */
 async function confirmWord(question, expected) {
     if (!process.stdin.isTTY) {
-        fail('Confirmation is only possible in an interactive terminal');
-        note((0, exports.dim)('  In CI this is the right behaviour: a version conflict has to fail the build rather than overwrite what the platform holds'));
+        fatal('Confirmation is only possible in an interactive terminal');
+        fatalNote((0, exports.dim)('  In CI this is the right behaviour: a version conflict has to fail the build rather than overwrite what the platform holds'));
         return false;
     }
     const rl = (0, node_readline_1.createInterface)({ input: process.stdin, output: process.stderr });

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.14.1';
+exports.CLI_VERSION = '0.15.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -24,7 +24,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.14.1. They travel inside the package, so the copy
+These instructions ship with xflow CLI 0.15.0. They travel inside the package, so the copy
 you are reading can be older than the CLI answering your commands, and nothing about that
 is visible in the text itself.
 
@@ -263,7 +263,9 @@ logged, so an empty output means the function never crashed, not that logging is
 The body has to be JSON and the CLI checks it before calling. In PowerShell the double
 quotes never reach the CLI: `--data '{"a":1}'` arrives as `{a:1}`, so escape them
 (`--data '{\"a\":1}'`) or pass a file. This is a shell habit, not a bug in the function, and
-it bites `--payload` of a schedule the same way.
+it bites `--payload` of a schedule the same way. A command that worked writes nothing to
+stderr, so a red line in PowerShell means it really failed; `--json` prints the payload and
+nothing else.
 
 From the app, call a function through `src/lib/xflow.ts`:
 `await xflow.functions.invoke('send-mail', { body: { to } })`. It carries the credentials
@@ -360,8 +362,10 @@ unavailable: the account you need is often connected already, one link away.
 
 `xflow connections link "Яндекс Метрика" --as YANDEX_METRIKA` is that link and
 `xflow connections unlink YANDEX_METRIKA` undoes it; `xflow help connections` has the
-naming rules and the flags. Unlink refuses while a function still reads one of the
-variables and names those functions, so read that list before reaching for `--force`.
+naming rules and the flags. In the project folder unlink reads `functions/` and refuses
+while a function still reads one of the variables, naming those functions, so read that
+list before reaching for `--force`. Under `--project` there is no folder to read: it
+prints the variables that go and removes the link.
 
 Linking needs the `connections:link` right on the key, and only accounts granted to the
 owner of the key personally can be linked at all; the same right covers calling an unlinked