@getxflow/cli 1.1.0 → 1.2.0

package/README.md

@@ -31,7 +31,6 @@ else's code belongs next to it.
 | `logs` | browser errors from the released application |
 | `projects list` / `projects get` | projects of the organization and the application addresses |
 | `skills` | platform instructions for an AI agent ([Agent Skills](https://agentskills.io) format) |
-| `mcp install` | connect the agent to the platform directly, without a terminal |
 | `update` | update the CLI itself, and the skill that ships inside it |
 
 Help for one command: `xflow help <command>`.
@@ -42,9 +41,5 @@ OpenClaw pick up on their own when a task touches XFlow. Your `AGENTS.md` and `C
 left alone. The description ships inside the package and shares its version, so `xflow update`
 brings both.
 
-`xflow mcp install` connects the agent to the platform directly: the database, migrations,
-functions, schedules, variables and versions become its tools, with no command output to parse.
-Code, builds and releases stay in the CLI.
-
 The key is stored in `~/.xflow/credentials.json`, the project configuration in `xflow.json`.
 For CI, pass the key in the `XFLOW_TOKEN` variable.

package/dist/args.js

@@ -17,12 +17,10 @@ exports.BOOLEAN_FLAGS = new Set([
     'version',
     'global',
     'refresh',
-    'no-push',
     'all',
     'dry-run',
     'allow-destructive',
     'allow-removals',
-    'show-token',
 ]);
 function parseArgs(argv) {
     const words = [];

package/dist/bin.js

@@ -20,7 +20,6 @@ const db_1 = require("./commands/db");
 const env_1 = require("./commands/env");
 const functions_1 = require("./commands/functions");
 const logs_1 = require("./commands/logs");
-const mcp_1 = require("./commands/mcp");
 const org_1 = require("./commands/org");
 const schedules_1 = require("./commands/schedules");
 const skills_1 = require("./commands/skills");
@@ -93,12 +92,6 @@ async function run(args) {
         case 'skills':
             await (0, skills_1.skills)(rest);
             return;
-        case 'mcp':
-            if (second === undefined || second === 'install') {
-                await (0, mcp_1.mcpInstall)(rest);
-                return;
-            }
-            throw new errors_1.CliError(`Unknown command: mcp ${second}`, 'Available: install');
         case 'functions':
             if (second === 'invoke') {
                 await (0, functions_1.functionsInvoke)(rest);

package/dist/commands/connections.js

@@ -143,10 +143,10 @@ async function connectionsUnlink(args) {
         const inUse = row.env
             .map((name) => ({ name, users: needed.get(name) ?? [] }))
             .filter((entry) => entry.users.length > 0);
-        if (inUse.length > 0 && !(0, args_1.flagBool)(args, 'force')) {
+        if (inUse.length > 0 && !(0, args_1.flagBool)(args, 'yes')) {
             (0, ui_1.fail)(`The functions of this project read the variables of ${row.alias}:`);
             (0, ui_1.table)(inUse.map((entry) => [entry.name, entry.users.join(', ')]));
-            throw new errors_1.CliError('They would lose these variables on the next deploy', 'Repeat with --force if that is intended');
+            throw new errors_1.CliError('They would lose these variables on the next deploy', 'Repeat with --yes if that is intended');
         }
     }
     const result = await (0, api_1.apiJson)(client, `${endpoint(projectId)}?connection_id=${encodeURIComponent(row.id)}`, { method: 'DELETE' });

package/dist/commands/db.js

@@ -296,19 +296,21 @@ async function dbMove(args) {
     const { projectId, client } = await (0, session_1.projectTarget)(args);
     const path = `/api/v1/projects/${projectId}/db/move`;
     let place;
+    // The platform takes the project name as the yes; --yes looks it up.
+    const confirm = (0, args_1.flagBool)(args, 'yes')
+        ? (await (0, api_1.apiJson)(client, `/api/v1/projects/${projectId}`)).name
+        : undefined;
     try {
         place = await (0, api_1.apiJson)(client, path, {
             method: 'POST',
-            body: { to, confirm: (0, args_1.flagString)(args, 'confirm') },
+            body: { to, confirm },
             timeoutMs: 60_000,
         });
     }
     catch (e) {
         // Said in the words of this command: the flag, and the name that goes in it.
         if (e instanceof api_1.ApiError && e.code === 'confirm_required') {
-            const found = await projectDatabase(client, projectId).catch(() => null);
-            const name = found?.database?.name ?? '<project name>';
-            throw new errors_1.CliError(e.message, `To move it: xflow db move --to "${to}" --confirm "${name}"`);
+            throw new errors_1.CliError(e.message, `To move it: xflow db move --to "${to}" --yes`);
         }
         throw e;
     }

package/dist/commands/deploy.js

@@ -10,7 +10,6 @@ const api_1 = require("../api");
 const args_1 = require("../args");
 const config_1 = require("../config");
 const errors_1 = require("../errors");
-const prompt_1 = require("../prompt");
 const session_1 = require("../session");
 const tree_1 = require("../tree");
 const ui_1 = require("../ui");
@@ -49,9 +48,8 @@ async function waitForBuild(client, base, started) {
     throw new errors_1.CliError('The build is taking longer than expected', `To check the state: xflow deployments. Build ${started.deploy_id}`);
 }
 /**
- * Start the build, asking before anything is destroyed. Removing a cloud function
- * cannot be undone, so the platform refuses such a deploy until the caller says yes,
- * and the question is asked here, before it starts.
+ * Start the build. Removing a cloud function cannot be undone, so the platform
+ * refuses such a deploy until --allow-removals says yes.
  */
 async function startBuild(client, base, revision, allowRemovals, comment) {
     const path = `${base}/builds`;
@@ -63,22 +61,9 @@ async function startBuild(client, base, revision, allowRemovals, comment) {
             reportIssues(e);
         if (!(e instanceof api_1.ApiError) || e.code !== 'confirm_required')
             throw e;
-        const removing = e.removing ?? [];
-        if (removing.length === 0)
+        if (!e.removing?.length)
             throw e;
-        // No terminal (CI, an agent): the flag is the only way to say yes.
-        if (process.stdin.isTTY !== true || process.stderr.isTTY !== true) {
-            throw new errors_1.CliError(e.message, `${REMOVAL_IS_FINAL}. If that is intended, retry with --allow-removals. If it is not, bring the functions/<name>/index.ts directories back`);
-        }
-        (0, ui_1.warn)(`Gone from the sources, the deploy would remove them: ${removing.join(', ')}`);
-        (0, ui_1.note)((0, ui_1.dim)(`  ${REMOVAL_IS_FINAL}`));
-        const answer = await (0, prompt_1.select)('Remove them from the cloud?', [
-            { label: 'No, stop here', hint: 'bring the functions/<name>/index.ts directories back' },
-            { label: 'Yes, remove and deploy', hint: removing.join(', ') },
-        ]);
-        if (answer !== 1)
-            throw new errors_1.CliError('The deploy did not start', 'Nothing was removed');
-        return (0, api_1.apiJson)(client, path, { method: 'POST', body: { revision, allow_removals: true, comment } });
+        throw new errors_1.CliError(e.message, `${REMOVAL_IS_FINAL}. If that is intended, retry with --allow-removals. If it is not, bring the functions/<name>/index.ts directories back`);
     }
 }
 /** Keep in sync with lib/version-comment.ts on the platform. */
@@ -187,19 +172,10 @@ async function deployTarget(target, args, comment, revision) {
         await (0, api_1.apiJson)(client, `${base}/builds?check=plan`);
         if (target.kind === 'app' && target.projectRoot)
             await warnUndeployedRoot(client, target.projectRoot, target.projectId);
-        if ((0, args_1.flagBool)(args, 'no-push')) {
-            const server = await (0, sources_1.latestRevision)(client, base);
-            if (!server)
-                throw new errors_1.CliError('The server holds no sources', 'Repeat without --no-push, so that the sources go up first');
-            revision = server.revision;
-            (0, ui_1.warn)(`Sources not sent (--no-push), the build runs from revision ${revision}`);
-        }
-        else {
-            const stream = target.kind === 'app'
-                ? { kind: 'app', root: target.root, appId: target.appId }
-                : { kind: 'project', root: target.root, projectId: target.projectId };
-            revision = (await (0, sources_1.pushSources)(stream, client, { force: (0, args_1.flagBool)(args, 'force') })).revision;
-        }
+        const stream = target.kind === 'app'
+            ? { kind: 'app', root: target.root, appId: target.appId }
+            : { kind: 'project', root: target.root, projectId: target.projectId };
+        revision = (await (0, sources_1.pushSources)(stream, client, { force: (0, args_1.flagBool)(args, 'force') })).revision;
         if (target.kind === 'project')
             await (0, db_1.migrateBeforeDeploy)(client, target.root, target.projectId);
     }

package/dist/commands/functions.js

@@ -24,7 +24,7 @@ async function functionsList(args) {
         fn.last_called_at ? `called ${(0, ui_1.formatAge)(fn.last_called_at)}` : 'never called',
         fn.last_error_at ? `failed ${(0, ui_1.formatAge)(fn.last_error_at)}` : '',
     ]));
-    (0, ui_1.note)((0, ui_1.dim)('  callers: the app folders and page names allowed to call it (functions in the root xflow.json)'));
+    (0, ui_1.note)((0, ui_1.dim)('  callers: the app folders allowed to call it (functions in the root xflow.json)'));
     (0, ui_1.note)((0, ui_1.dim)('  open: a caller is public, so anyone on the internet can call it; no callers: a workflow'));
     (0, ui_1.note)((0, ui_1.dim)(`  Webhooks and other functions call ${functions[0].url.replace(/\/[^/]+$/, '/<name>')} with a key`));
 }

package/dist/commands/org.js

@@ -9,7 +9,6 @@ const credentials_1 = require("../credentials");
 const errors_1 = require("../errors");
 const session_1 = require("../session");
 const ui_1 = require("../ui");
-const mcp_1 = require("./mcp");
 function label(org) {
     return org.name ?? org.organizationId;
 }
@@ -75,16 +74,10 @@ function orgSwitch(args) {
     (0, ui_1.ok)(`Active organization: "${label(target)}"`);
     const root = (0, config_1.findProjectRoot)();
     if (root) {
-        // The agent entry of a project folder belongs to the folder's organization,
-        // so the switch leaves it alone.
         const boundId = (0, config_1.readState)(root).organizationId;
         if (boundId && boundId !== target.organizationId) {
             const bound = orgs.find((org) => org.organizationId === boundId);
             (0, ui_1.note)((0, ui_1.dim)(`  This folder is bound to "${bound ? label(bound) : boundId}": commands here stay in it`));
         }
-        return;
-    }
-    if ((0, mcp_1.refreshAgentKey)({ apiUrl, token: target.token })) {
-        (0, ui_1.note)((0, ui_1.dim)('  The agent key here is rewritten: restart the agent session to pick it up'));
     }
 }

package/dist/commands/pages.js

@@ -99,7 +99,6 @@ async function pagesCreate(args) {
     (0, ui_1.ok)(`Page "${result.page.title}" is live: ${result.file_count} file(s), ${(0, ui_1.formatBytes)(result.size_bytes)}`);
     (0, ui_1.out)(result.page.url);
     (0, ui_1.note)((0, ui_1.dim)(`  Anyone with the address sees it within seconds. The next version: xflow pages deploy ${result.page.slug} <path>`));
-    (0, ui_1.note)((0, ui_1.dim)(`  A backend for it: name "${result.page.slug}" in functions.<name>.callers of a project, xflow deploy functions, then fetch /_fn/<name>`));
 }
 function contentTypeOf(upload) {
     return upload.kind === 'zip' ? 'application/zip' : 'text/html';

package/dist/commands/skills.js

@@ -13,7 +13,6 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const args_1 = require("../args");
 const errors_1 = require("../errors");
-const prompt_1 = require("../prompt");
 const update_1 = require("./update");
 const ui_1 = require("../ui");
 const AGENTS = [
@@ -322,30 +321,6 @@ function listAgents(base) {
     (0, ui_1.note)((0, ui_1.dim)('  * installed. Columns: id, agent, in the project, in the home folder'));
     (0, ui_1.note)((0, ui_1.dim)('  Install without questions: xflow skills --agent <id,id> [--global]'));
 }
-async function pick(globalFlag) {
-    let global = globalFlag;
-    if (!globalFlag) {
-        const scope = await (0, prompt_1.select)('Where to install the xflow skill', [
-            { label: 'This project', hint: process.cwd() },
-            { label: 'Globally', hint: 'home folder, visible to every project' },
-        ]);
-        if (scope === null)
-            return null;
-        global = scope === 1;
-    }
-    const base = process.cwd();
-    const present = AGENTS.map((agent) => installed(base, agent, global));
-    const anyPresent = present.includes(true);
-    const defaults = global ? DEFAULT_GLOBAL : DEFAULT_PROJECT;
-    const picked = await (0, prompt_1.multiSelect)('Which agents get the skill', AGENTS.map((agent, i) => ({
-        label: agent.label,
-        hint: pathLabel(agent, global) + (present[i] ? ', installed' : ''),
-        checked: anyPresent ? present[i] : defaults.includes(agent.id),
-    })));
-    if (picked === null || picked.length === 0)
-        return null;
-    return { ids: picked.map((i) => AGENTS[i].id), global };
-}
 async function skills(args) {
     const sub = args.words[0];
     if (sub === 'list') {
@@ -365,7 +340,9 @@ async function skills(args) {
     if (sub !== undefined) {
         throw new errors_1.CliError(`Unknown command: skills ${sub}`, 'Available: xflow skills [list]');
     }
-    let global = (0, args_1.flagBool)(args, 'global');
+    // --yes stays in older install lines; there is nothing left to say yes to.
+    (0, args_1.flagBool)(args, 'yes');
+    const global = (0, args_1.flagBool)(args, 'global');
     const agentFlag = (0, args_1.flagString)(args, 'agent');
     if (args.flags.agent !== undefined && agentFlag === undefined) {
         throw new errors_1.CliError('The --agent flag needs a value', 'For example: --agent claude,cursor. The ids: xflow skills list');
@@ -382,15 +359,6 @@ async function skills(args) {
             throw new errors_1.CliError(unknown.length > 0 ? `Unknown agent: ${unknown.join(', ')}` : 'No agents named', 'The ids: xflow skills list');
         }
     }
-    else if (process.stdin.isTTY === true && process.stderr.isTTY === true && !(0, args_1.flagBool)(args, 'yes')) {
-        const picked = await pick(global);
-        if (picked === null) {
-            (0, ui_1.note)((0, ui_1.dim)('  nothing chosen, nothing changed'));
-            return;
-        }
-        ids = picked.ids;
-        global = picked.global;
-    }
     else {
         ids = defaultIds(process.cwd(), global);
     }

package/dist/commands/sources.js

@@ -22,6 +22,8 @@ const zip_1 = require("../zip");
 const ui_1 = require("../ui");
 /** Server cap, checked locally to fail before uploading. Keep in sync with the server. */
 const MAX_ARCHIVE_BYTES = 10 * 1024 * 1024;
+/** Keep in sync with KEEP_REVISIONS in lib/project-sources/revisions.ts. */
+const KEPT_REVISIONS = 10;
 /** Where a stream lives on the platform: the same routes under two prefixes. */
 function streamPath(target) {
     return target.kind === 'app' ? `/api/v1/apps/${target.appId}` : `/api/v1/projects/${target.projectId}`;
@@ -68,34 +70,9 @@ async function latestRevision(client, base) {
     const { revisions } = await (0, api_1.apiJson)(client, `${base}/revisions`);
     return revisions[0] ?? null;
 }
-/** Show what --force would overwrite and ask for confirmation by the name of the project or app. */
-async function confirmForce(client, base, server, local) {
-    const { name } = await (0, api_1.apiJson)(client, base);
-    (0, ui_1.note)('');
-    (0, ui_1.warn)(`The server holds revision ${server.revision} from ${(0, ui_1.formatAge)(server.created_at)}, ${server.file_count} files`);
-    try {
-        const info = await (0, api_1.apiJson)(client, `${base}/pull`);
-        const serverPaths = new Set((0, zip_1.dropDirectoryEntries)((0, zip_1.zipRead)(await (0, api_1.downloadUrl)(info.download_url))).map((e) => e.path));
-        const localPaths = new Set(local.map((f) => f.path));
-        const disappearing = [...serverPaths].filter((p) => !localPaths.has(p));
-        if (disappearing.length > 0) {
-            (0, ui_1.note)(`  Files that will disappear (${disappearing.length}):`);
-            for (const path of disappearing.slice(0, 20))
-                (0, ui_1.note)((0, ui_1.dim)(`    ${path}`));
-            if (disappearing.length > 20)
-                (0, ui_1.note)((0, ui_1.dim)(`    …and ${disappearing.length - 20} more`));
-        }
-        else {
-            (0, ui_1.note)((0, ui_1.dim)('  No files disappear, but the contents of the server revision are replaced by yours'));
-        }
-    }
-    catch {
-        (0, ui_1.warn)('Could not read the server copy: the list of disappearing files is unavailable');
-    }
-    (0, ui_1.note)('');
-    const confirmed = await (0, ui_1.confirmWord)('The server revision will be replaced by the contents of this folder. Anything newer on the platform goes away, and it cannot be recovered from here.', name);
-    if (!confirmed)
-        throw new errors_1.CliError('Cancelled');
+/** How the stream is named on the command line: `xflow pull functions`, `xflow deploy apps/shop`. */
+function streamWord(stream) {
+    return stream.kind === 'app' ? `${config_1.APPS_DIR}/${(0, node_path_1.basename)(stream.root)}` : 'functions';
 }
 /** The first step of deploy: sources of one stream go up as a revision before the build. */
 async function pushSources(stream, client, options) {
@@ -113,12 +90,10 @@ async function pushSources(stream, client, options) {
         // Asked before the upload, so a doomed archive never leaves the machine.
         if (relation === 'diverged' && !options.force) {
             throw new errors_1.CliError(`The server holds revision ${server.revision}, and this folder does not stand on it`, 'Someone deployed before you, or this folder worked on a different project. ' +
-                'Fetch the server copy alongside and compare: xflow pull --into ./server-copy');
+                'Fetch the server copy alongside and compare: xflow pull --into ./server-copy. ' +
+                `To build what the server holds as it is: xflow deploy ${streamWord(stream)} --revision ${server.revision} -m "..."`);
         }
-        if (options.force) {
-            await confirmForce(client, base, server, tree.files);
-        }
-        else if (relation === 'unrecorded') {
+        if (!options.force && relation === 'unrecorded') {
             (0, ui_1.warn)(`This folder has no record of the server revision: the code goes up on top of revision ${server.revision}`);
         }
     }
@@ -134,6 +109,10 @@ async function pushSources(stream, client, options) {
         (0, ui_1.ok)(`No changes, revision ${result.revision}`);
     else
         (0, ui_1.ok)(`Revision ${result.revision}: ${result.file_count} files, ${(0, ui_1.formatBytes)(result.size_bytes)}`);
+    if (options.force && server && result.status === 'created') {
+        (0, ui_1.warn)(`Revision ${server.revision} is no longer the latest; it is kept while it is among the last ${KEPT_REVISIONS}`);
+        (0, ui_1.note)((0, ui_1.dim)(`  Get it back: xflow pull ${streamWord(stream)} --revision ${server.revision} --into ./server-copy`));
+    }
     return { revision: result.revision, status: result.status };
 }
 /**

package/dist/flags.js

@@ -53,8 +53,6 @@ exports.KNOWN = {
     'apps list': ['json', 'project'],
     'apps add': ['name', 'color'],
     skills: ['refresh', 'global', 'agent', 'yes'],
-    mcp: ['show-token'],
-    'mcp install': ['show-token'],
     functions: ['project'],
     'functions list': ['project'],
     'functions invoke': ['data', 'data-file', 'method', 'project'],
@@ -69,7 +67,7 @@ exports.KNOWN = {
     connections: ['project'],
     'connections list': ['project'],
     'connections link': ['as', 'project'],
-    'connections unlink': ['force', 'project'],
+    'connections unlink': ['yes', 'project'],
     'connections call': ['method', 'data', 'data-file', 'header', 'json', 'project'],
     schedules: ['project'],
     'schedules list': ['project'],
@@ -82,7 +80,7 @@ exports.KNOWN = {
     'db schema': ['project'],
     'db query': ['json', 'project'],
     'db migrate': ['dry-run', 'allow-destructive'],
-    'db move': ['to', 'confirm', 'project'],
+    'db move': ['to', 'yes', 'project'],
     storage: ['json', 'project'],
     'storage ls': ['json', 'project'],
     'storage list': ['json', 'project'],
@@ -100,7 +98,7 @@ exports.KNOWN = {
     status: [],
     dev: [],
     pull: ['into', 'force', 'revision'],
-    deploy: ['no-push', 'force', 'allow-removals', 'message', 'revision', 'project', 'app'],
+    deploy: ['force', 'allow-removals', 'message', 'revision', 'project', 'app'],
     publish: ['app'],
     rollback: ['app'],
     deployments: ['project', 'app'],
@@ -147,7 +145,6 @@ const NAMESPACES = new Set([
     'db',
     'storage',
     'pages',
-    'mcp',
 ]);
 /** The command these words name, as far as the table knows it. */
 function commandOf(words) {

package/dist/help.js

@@ -48,7 +48,6 @@ ${(0, ui_1.bold)('Getting started')}
   xflow link <id>                 link this folder to a project, an empty one gets the whole project
   xflow dev                       in an app folder: run it on 127.0.0.1:3000, functions included
   xflow skills                    pick the agents that get the platform instructions
-  xflow mcp install               give the agent platform access without a terminal
 
 ${(0, ui_1.bold)('Sources')}
   xflow status                    what is on the server and how the local copies differ
@@ -87,7 +86,7 @@ ${(0, ui_1.bold)('Functions')}
   xflow connections               connected accounts the project can use, and their variables
   xflow connections link <name> --as ALIAS
                                   give the functions the credentials of an account
-  xflow connections unlink <ALIAS> [--force]
+  xflow connections unlink <ALIAS> [--yes]
                                   take them away again
 
 ${(0, ui_1.bold)('Database')}
@@ -97,7 +96,7 @@ ${(0, ui_1.bold)('Database')}
   xflow db query 'select ...'     read data, in a read-only transaction
   xflow db migrate [--dry-run] [--allow-destructive]
                                   apply the migrations from migrations/*.sql
-  xflow db move --to <server> --confirm <database>
+  xflow db move --to <server> --yes
                                   move the project database to another server
 
 ${(0, ui_1.bold)('Pages')}
@@ -160,10 +159,6 @@ the platform. A folder bound to an organization is not affected, its commands
 stay in its own organization: two projects of two organizations in two terminals
 work without switching anything.
 
-Outside a project folder the switch also rewrites the key in the agent config
-(see ${(0, ui_1.bold)('xflow mcp')}) when an xflow entry already exists there; a running agent
-session picks the new key up only after a restart.
-
 A project id is unique across the whole platform, so "project not found" under
 the wrong organization can never touch somebody else's project. When that error
 names a project you know exists, the key is simply from another organization:
@@ -301,11 +296,10 @@ build it and upload what the build writes. Dot entries are skipped. At most 5 MB
 unpacked and 1000 files.
 
 The page is public, so a file holding a secret key is refused whole: every visitor would read
-it. A page that needs a backend (a form, a lookup) calls ${(0, ui_1.bold)('/_fn/<name>')} on its own address,
-and only a function whose callers in the root xflow.json of its project name the page answers:
-add the page name there and run ${(0, ui_1.bold)('xflow deploy functions')}. The page has to exist first.
-Such a function is open to the whole internet. Search engines are asked not to index pages,
-so do not promise SEO.
+it. A page has no backend: a form or a lookup belongs in an app with access "anyone". The one
+key a page may hold is a function key, and it opens that function to every visitor: an HTML
+form can post to its webhook address with ${(0, ui_1.bold)('?key=')}, while fetch cannot read the answer
+(no CORS). Search engines are asked not to index pages, so do not promise SEO.
 
 ${(0, ui_1.bold)('Deleting is final.')} The address goes empty and every version of the page is gone: there
 is no undo and no copy on the platform side. The name stays reserved for the organization, so
@@ -347,7 +341,7 @@ will work.`,
                                    one, 300 at most; --json prints the values whole)
   xflow db query <file>.sql        the same, the query read from a file
   xflow db migrate                 store the project root, then apply migrations/*.sql
-  xflow db move --to <server> --confirm <project name>
+  xflow db move --to <server> --yes
                                    move the project database to another server
 
 Every project has exactly one database of its own, shared by all of its apps and functions,
@@ -362,7 +356,7 @@ ${(0, ui_1.bold)('move')} takes the database of this project to another server o
 ${(0, ui_1.bold)('platform')} or an own server by name (or id, when two share a name). The platform copies
 the tables, switches the functions of the project and removes the old copy; nothing needs a
 deploy. While it copies, the apps read data but cannot save anything new, usually for a
-couple of minutes, which is why ${(0, ui_1.bold)('--confirm')} takes the project name. It also needs the
+couple of minutes, which is why it asks for ${(0, ui_1.bold)('--yes')}. It also needs the
 right to move databases on the key: off by default, only its owner turns it on, in the
 platform settings where the key permissions live. The command follows the move to the end;
 stopping it does not stop the move, and ${(0, ui_1.bold)('xflow db status')} shows where it stands. A move
@@ -519,7 +513,7 @@ of the same service under one name; then the command prints their identifiers an
 for one of those instead of guessing.
 
 ${(0, ui_1.bold)('unlink')} refuses while a function still reads one of the variables and names
-those functions; ${(0, ui_1.bold)('--force')} goes through anyway. Seeing them needs the sources,
+those functions; ${(0, ui_1.bold)('--yes')} goes through anyway. Seeing them needs the sources,
 so under ${(0, ui_1.bold)('--project')} there is no such check: the link goes, and the variables
 that go with it are printed instead. Both commands take the flag, because an account
 linked to a service project without a folder has to be removable the same way.
@@ -618,14 +612,14 @@ of the project runs the new code the moment it finishes; there is no publish ste
 
 Who may call a function is its callers, in the root xflow.json:
 
-  { "projectId": "…", "functions": { "book-slot": { "callers": ["zapis", "clinic-landing"] } } }
+  { "projectId": "…", "functions": { "book-slot": { "callers": ["zapis"] } } }
 
-A caller is an app folder of this project (apps/zapis is "zapis") or the name of a page of
-the organization. A function nobody lists has no callers: a workflow, woken by a schedule,
-by a service holding a key a person issued, or by ${(0, ui_1.bold)('invoke')}. ${(0, ui_1.bold)('open')} in the list means a
-caller is public (a page, or an app anyone with the link opens), so anyone on the internet
-can call it. The address in the note under the table is for webhooks and other functions,
-with a key; apps and pages call ${(0, ui_1.bold)('/_fn/<name>')} on their own address.
+A caller is an app folder of this project (apps/zapis is "zapis"); pages are static and call
+nothing. A function nobody lists has no callers: a workflow, woken by a schedule, by a service
+holding a key a person issued, or by ${(0, ui_1.bold)('invoke')}. ${(0, ui_1.bold)('open')} in the list means a caller is an app
+anyone with the link opens, so anyone on the internet can call it. The address in the note
+under the table is for webhooks and other functions, with a key; apps call ${(0, ui_1.bold)('/_fn/<name>')} on
+their own address.
 
 ${(0, ui_1.bold)('invoke')} calls it as the person who owns the key: the platform checks the role, gives
 the function a one-minute ticket and calls it itself, so the function sees
@@ -643,24 +637,6 @@ Prints the body of the answer and nothing else, so it goes straight into a pipe
 (${(0, ui_1.bold)('| jq')}, ${(0, ui_1.bold)('| python')}). A non-zero exit code on 4xx and 5xx: in CI such a call has to fail the step. A
 refusal of the guard names its reason in the body (${(0, ui_1.bold)('not_bound')}, ${(0, ui_1.bold)('no_access')},
 ${(0, ui_1.bold)('functions_stopped')}); for a crash the hint points at ${(0, ui_1.bold)('xflow functions logs <name>')}.`,
-    mcp: `${(0, ui_1.bold)('xflow mcp install')}: connect the agent to the platform directly
-
-Writes the MCP server into the configuration of a client that has its own connect
-command: today that is Claude Code, and for the rest the command prints what to enter
-by hand. After that the agent runs the platform without a terminal: it inspects the
-database, applies migrations, calls functions, sets schedules, publishes app builds, reads
-logs. The commands stay: code, builds and functions deploys are still done by the CLI,
-because pushing sources through MCP means filling the agent context and spending your money.
-
-The command takes the access key from your own login and does not print it: usually
-the agent runs this command itself, and everything printed lands in its context and in
-the chat history.
-
-  --show-token    print the key anyway (not while under an agent)
-
-There is one key per person per organization and its scope is not narrowed: the agent
-sees every project of the organization and names the one it needs. It takes the
-project from the ${(0, ui_1.bold)('project_id')} argument, not from your folder, which it cannot see.`,
     skills: `${(0, ui_1.bold)('xflow skills')}: platform instructions for an AI agent
 
 An agent has no way to know about XFlow: the platform is not in its training. The
@@ -670,16 +646,12 @@ down on their own for the common agents, so this command exists to pick tools
 precisely. Refreshing after a CLI update is not your job any more: the skill and the
 CLI ship as one version, and ${(0, ui_1.bold)('xflow update')} rewrites the copies you already have.
 
-Run in a terminal, it asks two questions: where (this project, or the home folder,
-which makes the skill visible in every project) and for which agents. Copies that are
-already installed come pre-selected and are updated in place. Without a terminal, in
-CI or when an agent runs the command, there are no questions: the defaults plus every
-already installed copy are refreshed.
+Without flags it installs for Claude Code, Cursor and Codex in this project (globally:
+Claude Code, Codex and the shared folder) and refreshes every copy already installed.
 
   xflow skills list               the agents, their folders and what is installed
-  --agent claude,cursor           exact agents, no questions asked
+  --agent claude,cursor           exact agents instead of the defaults
   --global                        the home folder instead of the project
-  --yes                           no questions: defaults plus what is installed
   --refresh                       rewrite the copies that exist, create none
 
 The format is shared (agentskills.io) and inside a project most tools read the shared
@@ -731,7 +703,6 @@ apps never go in one run, because a change of functions reaches every app at onc
 
   -m <text>          the version comment, required: one short line in the language the
                      user speaks, saying what changed (--message is the long form)
-  --no-push          do not send sources, build from the latest server revision
   --revision <N>     run a revision the platform already holds: that is how the functions
                      come back (xflow deployments functions lists them)
   --project <id>     with --revision only: the functions of that project, no folder needed
@@ -747,12 +718,12 @@ ignore field of xflow.json.
 If the server holds a revision newer than the one you worked from, the sources are
 rejected and the build does not start. That means somebody deployed before you: fetch
 their changes alongside (${(0, ui_1.bold)('xflow pull --into ./server-copy')}), merge them in git on
-your side, and retry. A folder with no record of the server revision (a fresh clone, a CI
+your side, and retry; or build what the server holds as it is with ${(0, ui_1.bold)('--revision <N>')}, the
+refusal names the number. A folder with no record of the server revision (a fresh clone, a CI
 checkout) is not rejected: its first deploy goes on top of the current revision and says
-so, the check applies from the next one. ${(0, ui_1.bold)('--force')} overwrites the server revision, and before that the
-CLI shows whose work you are about to destroy and asks for confirmation by typing the
-project name. In a non-interactive run (CI, an agent) there is no way to confirm: a
-version conflict has to fail the build rather than silently destroy somebody else's work.
+so, the check applies from the next one. ${(0, ui_1.bold)('--force')} sends this folder over the server revision
+anyway. The overwritten revision is not lost at once: it stays in the history while it is among
+the last 10, and the deploy prints the ${(0, ui_1.bold)('xflow pull --revision <N>')} line that brings it back.
 
 The platform builds, in a clean sandbox on one Node version for everybody. Before that the
 sources are checked: what breaks silently (the platform files, the calls in the entry point,
@@ -770,9 +741,8 @@ internet now. A change that touches data and screens goes in this order: the fun
 changes nobody deployed.
 
 A function gone from the sources would be deleted from the cloud along with its keys and
-schedules, and that is final. So the deploy does not start at all until you say yes. In a terminal the CLI names the functions
-and asks; without one (CI, an agent) it stops and ${(0, ui_1.bold)('--allow-removals')} is the only way
-to agree. If the sources hold no functions at all while the cloud holds several, nothing
+schedules, and that is final. So the deploy does not start at all: it names the functions and stops, and ${(0, ui_1.bold)('--allow-removals')}
+is the way to agree. If the sources hold no functions at all while the cloud holds several, nothing
 is deleted and nothing is asked: that looks like a directory which never made it (a
 ${(0, ui_1.bold)('functions/')} line in .xflowignore) rather than a decision.
 

package/dist/limits.js

@@ -15,6 +15,7 @@ const DENIAL_LABELS = {
     limit_builds_concurrent: 'builds running at once',
     limit_seats: 'people in the organization',
     limit_schedule_interval: 'schedule frequency',
+    limit_schedules: 'schedules in the organization',
     db_write_locked: 'database volume, writes are off',
     plan_no_schedules: 'schedules',
     subscription_blocked: 'the subscription is unpaid',
@@ -38,6 +39,7 @@ const QUOTA_ORDER = [
     'connections',
     'pages',
     'functions',
+    'schedules',
     'people',
     'database_mb',
     'files_mb',
@@ -49,6 +51,7 @@ const QUOTA_LABELS = {
     connections: 'Active connections',
     pages: 'Public pages',
     functions: 'Cloud functions',
+    schedules: 'Schedules',
     people: 'People',
     database_mb: 'Database',
     files_mb: 'Files',

package/dist/template.js

@@ -13,7 +13,7 @@ const README = `# %NAME%
 A project on XFlow: one database, cloud functions and the apps that use them.
 
 \`\`\`
-xflow.json          projectId, and which apps and pages may call each function
+xflow.json          projectId, and which apps may call each function
 package.json        dependencies of the functions
 functions/<name>/   cloud functions, shared by every app
 migrations/         the database of the project