@getxflow/cli 1.1.1 → 1.2.1

package/README.md

@@ -6,9 +6,8 @@ CLI for the [XFlow](https://getxflow.com) platform: source sync, builds and rele
 npm i -g @getxflow/cli
 xflow login
 xflow init my-app
-cd my-app && npm install
+cd my-app/apps/my-app && npm install && xflow dev
 xflow deploy -m "First version"
-xflow publish
 ```
 
 Requires Node 20+. The package has no dependencies: it holds an access key, and nobody
@@ -31,7 +30,6 @@ else's code belongs next to it.
 | `logs` | browser errors from the released application |
 | `projects list` / `projects get` | projects of the organization and the application addresses |
 | `skills` | platform instructions for an AI agent ([Agent Skills](https://agentskills.io) format) |
-| `mcp install` | connect the agent to the platform directly, without a terminal |
 | `update` | update the CLI itself, and the skill that ships inside it |
 
 Help for one command: `xflow help <command>`.
@@ -42,9 +40,5 @@ OpenClaw pick up on their own when a task touches XFlow. Your `AGENTS.md` and `C
 left alone. The description ships inside the package and shares its version, so `xflow update`
 brings both.
 
-`xflow mcp install` connects the agent to the platform directly: the database, migrations,
-functions, schedules, variables and versions become its tools, with no command output to parse.
-Code, builds and releases stay in the CLI.
-
 The key is stored in `~/.xflow/credentials.json`, the project configuration in `xflow.json`.
 For CI, pass the key in the `XFLOW_TOKEN` variable.

package/dist/args.js

@@ -17,12 +17,10 @@ exports.BOOLEAN_FLAGS = new Set([
     'version',
     'global',
     'refresh',
-    'no-push',
     'all',
     'dry-run',
     'allow-destructive',
     'allow-removals',
-    'show-token',
 ]);
 function parseArgs(argv) {
     const words = [];

package/dist/bin.js

@@ -20,7 +20,6 @@ const db_1 = require("./commands/db");
 const env_1 = require("./commands/env");
 const functions_1 = require("./commands/functions");
 const logs_1 = require("./commands/logs");
-const mcp_1 = require("./commands/mcp");
 const org_1 = require("./commands/org");
 const schedules_1 = require("./commands/schedules");
 const skills_1 = require("./commands/skills");
@@ -93,12 +92,6 @@ async function run(args) {
         case 'skills':
             await (0, skills_1.skills)(rest);
             return;
-        case 'mcp':
-            if (second === undefined || second === 'install') {
-                await (0, mcp_1.mcpInstall)(rest);
-                return;
-            }
-            throw new errors_1.CliError(`Unknown command: mcp ${second}`, 'Available: install');
         case 'functions':
             if (second === 'invoke') {
                 await (0, functions_1.functionsInvoke)(rest);

package/dist/commands/auth.js

@@ -79,6 +79,7 @@ async function awaitConfirmation(client, start) {
         const others = (0, credentials_1.listOrgs)(client.apiUrl).length - 1;
         if (others > 0)
             (0, ui_1.note)((0, ui_1.dim)(`  ${others} more stored: xflow org`));
+        (0, ui_1.note)((0, ui_1.dim)('  Documentation: https://docs.getxflow.com'));
         return;
     }
 }

package/dist/commands/connections.js

@@ -70,7 +70,7 @@ async function connectionsList(args) {
     const data = await (0, api_1.apiJson)(client, endpoint(projectId));
     if (data.connections.length === 0) {
         (0, ui_1.note)('No connections you can use in this organization');
-        (0, ui_1.note)((0, ui_1.dim)('  Somebody connects an account first: platform settings, Connectors'));
+        (0, ui_1.note)((0, ui_1.dim)('  Somebody connects an account first: Integrations in the xflow sidebar'));
         return;
     }
     (0, ui_1.table)(data.connections.map((row) => [
@@ -143,10 +143,10 @@ async function connectionsUnlink(args) {
         const inUse = row.env
             .map((name) => ({ name, users: needed.get(name) ?? [] }))
             .filter((entry) => entry.users.length > 0);
-        if (inUse.length > 0 && !(0, args_1.flagBool)(args, 'force')) {
+        if (inUse.length > 0 && !(0, args_1.flagBool)(args, 'yes')) {
             (0, ui_1.fail)(`The functions of this project read the variables of ${row.alias}:`);
             (0, ui_1.table)(inUse.map((entry) => [entry.name, entry.users.join(', ')]));
-            throw new errors_1.CliError('They would lose these variables on the next deploy', 'Repeat with --force if that is intended');
+            throw new errors_1.CliError('They would lose these variables on the next deploy', 'Repeat with --yes if that is intended');
         }
     }
     const result = await (0, api_1.apiJson)(client, `${endpoint(projectId)}?connection_id=${encodeURIComponent(row.id)}`, { method: 'DELETE' });

package/dist/commands/db.js

@@ -296,19 +296,21 @@ async function dbMove(args) {
     const { projectId, client } = await (0, session_1.projectTarget)(args);
     const path = `/api/v1/projects/${projectId}/db/move`;
     let place;
+    // The platform takes the project name as the yes; --yes looks it up.
+    const confirm = (0, args_1.flagBool)(args, 'yes')
+        ? (await (0, api_1.apiJson)(client, `/api/v1/projects/${projectId}`)).name
+        : undefined;
     try {
         place = await (0, api_1.apiJson)(client, path, {
             method: 'POST',
-            body: { to, confirm: (0, args_1.flagString)(args, 'confirm') },
+            body: { to, confirm },
             timeoutMs: 60_000,
         });
     }
     catch (e) {
         // Said in the words of this command: the flag, and the name that goes in it.
         if (e instanceof api_1.ApiError && e.code === 'confirm_required') {
-            const found = await projectDatabase(client, projectId).catch(() => null);
-            const name = found?.database?.name ?? '<project name>';
-            throw new errors_1.CliError(e.message, `To move it: xflow db move --to "${to}" --confirm "${name}"`);
+            throw new errors_1.CliError(e.message, `To move it: xflow db move --to "${to}" --yes`);
         }
         throw e;
     }

package/dist/commands/deploy.js

@@ -10,7 +10,6 @@ const api_1 = require("../api");
 const args_1 = require("../args");
 const config_1 = require("../config");
 const errors_1 = require("../errors");
-const prompt_1 = require("../prompt");
 const session_1 = require("../session");
 const tree_1 = require("../tree");
 const ui_1 = require("../ui");
@@ -49,9 +48,8 @@ async function waitForBuild(client, base, started) {
     throw new errors_1.CliError('The build is taking longer than expected', `To check the state: xflow deployments. Build ${started.deploy_id}`);
 }
 /**
- * Start the build, asking before anything is destroyed. Removing a cloud function
- * cannot be undone, so the platform refuses such a deploy until the caller says yes,
- * and the question is asked here, before it starts.
+ * Start the build. Removing a cloud function cannot be undone, so the platform
+ * refuses such a deploy until --allow-removals says yes.
  */
 async function startBuild(client, base, revision, allowRemovals, comment) {
     const path = `${base}/builds`;
@@ -63,22 +61,9 @@ async function startBuild(client, base, revision, allowRemovals, comment) {
             reportIssues(e);
         if (!(e instanceof api_1.ApiError) || e.code !== 'confirm_required')
             throw e;
-        const removing = e.removing ?? [];
-        if (removing.length === 0)
+        if (!e.removing?.length)
             throw e;
-        // No terminal (CI, an agent): the flag is the only way to say yes.
-        if (process.stdin.isTTY !== true || process.stderr.isTTY !== true) {
-            throw new errors_1.CliError(e.message, `${REMOVAL_IS_FINAL}. If that is intended, retry with --allow-removals. If it is not, bring the functions/<name>/index.ts directories back`);
-        }
-        (0, ui_1.warn)(`Gone from the sources, the deploy would remove them: ${removing.join(', ')}`);
-        (0, ui_1.note)((0, ui_1.dim)(`  ${REMOVAL_IS_FINAL}`));
-        const answer = await (0, prompt_1.select)('Remove them from the cloud?', [
-            { label: 'No, stop here', hint: 'bring the functions/<name>/index.ts directories back' },
-            { label: 'Yes, remove and deploy', hint: removing.join(', ') },
-        ]);
-        if (answer !== 1)
-            throw new errors_1.CliError('The deploy did not start', 'Nothing was removed');
-        return (0, api_1.apiJson)(client, path, { method: 'POST', body: { revision, allow_removals: true, comment } });
+        throw new errors_1.CliError(e.message, `${REMOVAL_IS_FINAL}. If that is intended, retry with --allow-removals. If it is not, bring the functions/<name>/index.ts directories back`);
     }
 }
 /** Keep in sync with lib/version-comment.ts on the platform. */
@@ -187,19 +172,10 @@ async function deployTarget(target, args, comment, revision) {
         await (0, api_1.apiJson)(client, `${base}/builds?check=plan`);
         if (target.kind === 'app' && target.projectRoot)
             await warnUndeployedRoot(client, target.projectRoot, target.projectId);
-        if ((0, args_1.flagBool)(args, 'no-push')) {
-            const server = await (0, sources_1.latestRevision)(client, base);
-            if (!server)
-                throw new errors_1.CliError('The server holds no sources', 'Repeat without --no-push, so that the sources go up first');
-            revision = server.revision;
-            (0, ui_1.warn)(`Sources not sent (--no-push), the build runs from revision ${revision}`);
-        }
-        else {
-            const stream = target.kind === 'app'
-                ? { kind: 'app', root: target.root, appId: target.appId }
-                : { kind: 'project', root: target.root, projectId: target.projectId };
-            revision = (await (0, sources_1.pushSources)(stream, client, { force: (0, args_1.flagBool)(args, 'force') })).revision;
-        }
+        const stream = target.kind === 'app'
+            ? { kind: 'app', root: target.root, appId: target.appId }
+            : { kind: 'project', root: target.root, projectId: target.projectId };
+        revision = (await (0, sources_1.pushSources)(stream, client, { force: (0, args_1.flagBool)(args, 'force') })).revision;
         if (target.kind === 'project')
             await (0, db_1.migrateBeforeDeploy)(client, target.root, target.projectId);
     }

package/dist/commands/org.js

@@ -9,7 +9,6 @@ const credentials_1 = require("../credentials");
 const errors_1 = require("../errors");
 const session_1 = require("../session");
 const ui_1 = require("../ui");
-const mcp_1 = require("./mcp");
 function label(org) {
     return org.name ?? org.organizationId;
 }
@@ -75,16 +74,10 @@ function orgSwitch(args) {
     (0, ui_1.ok)(`Active organization: "${label(target)}"`);
     const root = (0, config_1.findProjectRoot)();
     if (root) {
-        // The agent entry of a project folder belongs to the folder's organization,
-        // so the switch leaves it alone.
         const boundId = (0, config_1.readState)(root).organizationId;
         if (boundId && boundId !== target.organizationId) {
             const bound = orgs.find((org) => org.organizationId === boundId);
             (0, ui_1.note)((0, ui_1.dim)(`  This folder is bound to "${bound ? label(bound) : boundId}": commands here stay in it`));
         }
-        return;
-    }
-    if ((0, mcp_1.refreshAgentKey)({ apiUrl, token: target.token })) {
-        (0, ui_1.note)((0, ui_1.dim)('  The agent key here is rewritten: restart the agent session to pick it up'));
     }
 }

package/dist/commands/projects.js

@@ -95,7 +95,7 @@ async function init(args) {
         (0, ui_1.note)((0, ui_1.dim)(`  Its database goes to the own server "${project.server.name}"`));
     (0, ui_1.out)('');
     (0, ui_1.out)(`  ${(0, ui_1.bold)('Next:')}`);
-    (0, ui_1.out)(`    cd ${(0, node_path_1.basename)(target)} && npm install          # functions`);
+    (0, ui_1.out)(`    cd ${(0, node_path_1.basename)(target)}`);
     if (folder) {
         (0, ui_1.out)(`    cd ${config_1.APPS_DIR}/${folder} && npm install && xflow dev   # the app on 127.0.0.1:3000`);
         (0, ui_1.out)(`    xflow deploy ${config_1.APPS_DIR}/${folder} -m "First version"`);

package/dist/commands/skills.js

@@ -13,7 +13,6 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const args_1 = require("../args");
 const errors_1 = require("../errors");
-const prompt_1 = require("../prompt");
 const update_1 = require("./update");
 const ui_1 = require("../ui");
 const AGENTS = [
@@ -322,30 +321,6 @@ function listAgents(base) {
     (0, ui_1.note)((0, ui_1.dim)('  * installed. Columns: id, agent, in the project, in the home folder'));
     (0, ui_1.note)((0, ui_1.dim)('  Install without questions: xflow skills --agent <id,id> [--global]'));
 }
-async function pick(globalFlag) {
-    let global = globalFlag;
-    if (!globalFlag) {
-        const scope = await (0, prompt_1.select)('Where to install the xflow skill', [
-            { label: 'This project', hint: process.cwd() },
-            { label: 'Globally', hint: 'home folder, visible to every project' },
-        ]);
-        if (scope === null)
-            return null;
-        global = scope === 1;
-    }
-    const base = process.cwd();
-    const present = AGENTS.map((agent) => installed(base, agent, global));
-    const anyPresent = present.includes(true);
-    const defaults = global ? DEFAULT_GLOBAL : DEFAULT_PROJECT;
-    const picked = await (0, prompt_1.multiSelect)('Which agents get the skill', AGENTS.map((agent, i) => ({
-        label: agent.label,
-        hint: pathLabel(agent, global) + (present[i] ? ', installed' : ''),
-        checked: anyPresent ? present[i] : defaults.includes(agent.id),
-    })));
-    if (picked === null || picked.length === 0)
-        return null;
-    return { ids: picked.map((i) => AGENTS[i].id), global };
-}
 async function skills(args) {
     const sub = args.words[0];
     if (sub === 'list') {
@@ -365,7 +340,9 @@ async function skills(args) {
     if (sub !== undefined) {
         throw new errors_1.CliError(`Unknown command: skills ${sub}`, 'Available: xflow skills [list]');
     }
-    let global = (0, args_1.flagBool)(args, 'global');
+    // --yes stays in older install lines; there is nothing left to say yes to.
+    (0, args_1.flagBool)(args, 'yes');
+    const global = (0, args_1.flagBool)(args, 'global');
     const agentFlag = (0, args_1.flagString)(args, 'agent');
     if (args.flags.agent !== undefined && agentFlag === undefined) {
         throw new errors_1.CliError('The --agent flag needs a value', 'For example: --agent claude,cursor. The ids: xflow skills list');
@@ -382,15 +359,6 @@ async function skills(args) {
             throw new errors_1.CliError(unknown.length > 0 ? `Unknown agent: ${unknown.join(', ')}` : 'No agents named', 'The ids: xflow skills list');
         }
     }
-    else if (process.stdin.isTTY === true && process.stderr.isTTY === true && !(0, args_1.flagBool)(args, 'yes')) {
-        const picked = await pick(global);
-        if (picked === null) {
-            (0, ui_1.note)((0, ui_1.dim)('  nothing chosen, nothing changed'));
-            return;
-        }
-        ids = picked.ids;
-        global = picked.global;
-    }
     else {
         ids = defaultIds(process.cwd(), global);
     }

package/dist/commands/sources.js

@@ -22,6 +22,8 @@ const zip_1 = require("../zip");
 const ui_1 = require("../ui");
 /** Server cap, checked locally to fail before uploading. Keep in sync with the server. */
 const MAX_ARCHIVE_BYTES = 10 * 1024 * 1024;
+/** Keep in sync with KEEP_REVISIONS in lib/project-sources/revisions.ts. */
+const KEPT_REVISIONS = 10;
 /** Where a stream lives on the platform: the same routes under two prefixes. */
 function streamPath(target) {
     return target.kind === 'app' ? `/api/v1/apps/${target.appId}` : `/api/v1/projects/${target.projectId}`;
@@ -68,34 +70,9 @@ async function latestRevision(client, base) {
     const { revisions } = await (0, api_1.apiJson)(client, `${base}/revisions`);
     return revisions[0] ?? null;
 }
-/** Show what --force would overwrite and ask for confirmation by the name of the project or app. */
-async function confirmForce(client, base, server, local) {
-    const { name } = await (0, api_1.apiJson)(client, base);
-    (0, ui_1.note)('');
-    (0, ui_1.warn)(`The server holds revision ${server.revision} from ${(0, ui_1.formatAge)(server.created_at)}, ${server.file_count} files`);
-    try {
-        const info = await (0, api_1.apiJson)(client, `${base}/pull`);
-        const serverPaths = new Set((0, zip_1.dropDirectoryEntries)((0, zip_1.zipRead)(await (0, api_1.downloadUrl)(info.download_url))).map((e) => e.path));
-        const localPaths = new Set(local.map((f) => f.path));
-        const disappearing = [...serverPaths].filter((p) => !localPaths.has(p));
-        if (disappearing.length > 0) {
-            (0, ui_1.note)(`  Files that will disappear (${disappearing.length}):`);
-            for (const path of disappearing.slice(0, 20))
-                (0, ui_1.note)((0, ui_1.dim)(`    ${path}`));
-            if (disappearing.length > 20)
-                (0, ui_1.note)((0, ui_1.dim)(`    …and ${disappearing.length - 20} more`));
-        }
-        else {
-            (0, ui_1.note)((0, ui_1.dim)('  No files disappear, but the contents of the server revision are replaced by yours'));
-        }
-    }
-    catch {
-        (0, ui_1.warn)('Could not read the server copy: the list of disappearing files is unavailable');
-    }
-    (0, ui_1.note)('');
-    const confirmed = await (0, ui_1.confirmWord)('The server revision will be replaced by the contents of this folder. Anything newer on the platform goes away, and it cannot be recovered from here.', name);
-    if (!confirmed)
-        throw new errors_1.CliError('Cancelled');
+/** How the stream is named on the command line: `xflow pull functions`, `xflow deploy apps/shop`. */
+function streamWord(stream) {
+    return stream.kind === 'app' ? `${config_1.APPS_DIR}/${(0, node_path_1.basename)(stream.root)}` : 'functions';
 }
 /** The first step of deploy: sources of one stream go up as a revision before the build. */
 async function pushSources(stream, client, options) {
@@ -113,12 +90,10 @@ async function pushSources(stream, client, options) {
         // Asked before the upload, so a doomed archive never leaves the machine.
         if (relation === 'diverged' && !options.force) {
             throw new errors_1.CliError(`The server holds revision ${server.revision}, and this folder does not stand on it`, 'Someone deployed before you, or this folder worked on a different project. ' +
-                'Fetch the server copy alongside and compare: xflow pull --into ./server-copy');
+                'Fetch the server copy alongside and compare: xflow pull --into ./server-copy. ' +
+                `To build what the server holds as it is: xflow deploy ${streamWord(stream)} --revision ${server.revision} -m "..."`);
         }
-        if (options.force) {
-            await confirmForce(client, base, server, tree.files);
-        }
-        else if (relation === 'unrecorded') {
+        if (!options.force && relation === 'unrecorded') {
             (0, ui_1.warn)(`This folder has no record of the server revision: the code goes up on top of revision ${server.revision}`);
         }
     }
@@ -134,6 +109,10 @@ async function pushSources(stream, client, options) {
         (0, ui_1.ok)(`No changes, revision ${result.revision}`);
     else
         (0, ui_1.ok)(`Revision ${result.revision}: ${result.file_count} files, ${(0, ui_1.formatBytes)(result.size_bytes)}`);
+    if (options.force && server && result.status === 'created') {
+        (0, ui_1.warn)(`Revision ${server.revision} is no longer the latest; it is kept while it is among the last ${KEPT_REVISIONS}`);
+        (0, ui_1.note)((0, ui_1.dim)(`  Get it back: xflow pull ${streamWord(stream)} --revision ${server.revision} --into ./server-copy`));
+    }
     return { revision: result.revision, status: result.status };
 }
 /**

package/dist/flags.js

@@ -53,8 +53,6 @@ exports.KNOWN = {
     'apps list': ['json', 'project'],
     'apps add': ['name', 'color'],
     skills: ['refresh', 'global', 'agent', 'yes'],
-    mcp: ['show-token'],
-    'mcp install': ['show-token'],
     functions: ['project'],
     'functions list': ['project'],
     'functions invoke': ['data', 'data-file', 'method', 'project'],
@@ -69,7 +67,7 @@ exports.KNOWN = {
     connections: ['project'],
     'connections list': ['project'],
     'connections link': ['as', 'project'],
-    'connections unlink': ['force', 'project'],
+    'connections unlink': ['yes', 'project'],
     'connections call': ['method', 'data', 'data-file', 'header', 'json', 'project'],
     schedules: ['project'],
     'schedules list': ['project'],
@@ -82,7 +80,7 @@ exports.KNOWN = {
     'db schema': ['project'],
     'db query': ['json', 'project'],
     'db migrate': ['dry-run', 'allow-destructive'],
-    'db move': ['to', 'confirm', 'project'],
+    'db move': ['to', 'yes', 'project'],
     storage: ['json', 'project'],
     'storage ls': ['json', 'project'],
     'storage list': ['json', 'project'],
@@ -100,7 +98,7 @@ exports.KNOWN = {
     status: [],
     dev: [],
     pull: ['into', 'force', 'revision'],
-    deploy: ['no-push', 'force', 'allow-removals', 'message', 'revision', 'project', 'app'],
+    deploy: ['force', 'allow-removals', 'message', 'revision', 'project', 'app'],
     publish: ['app'],
     rollback: ['app'],
     deployments: ['project', 'app'],
@@ -147,7 +145,6 @@ const NAMESPACES = new Set([
     'db',
     'storage',
     'pages',
-    'mcp',
 ]);
 /** The command these words name, as far as the table knows it. */
 function commandOf(words) {

package/dist/help.js

@@ -48,7 +48,6 @@ ${(0, ui_1.bold)('Getting started')}
   xflow link <id>                 link this folder to a project, an empty one gets the whole project
   xflow dev                       in an app folder: run it on 127.0.0.1:3000, functions included
   xflow skills                    pick the agents that get the platform instructions
-  xflow mcp install               give the agent platform access without a terminal
 
 ${(0, ui_1.bold)('Sources')}
   xflow status                    what is on the server and how the local copies differ
@@ -87,7 +86,7 @@ ${(0, ui_1.bold)('Functions')}
   xflow connections               connected accounts the project can use, and their variables
   xflow connections link <name> --as ALIAS
                                   give the functions the credentials of an account
-  xflow connections unlink <ALIAS> [--force]
+  xflow connections unlink <ALIAS> [--yes]
                                   take them away again
 
 ${(0, ui_1.bold)('Database')}
@@ -97,7 +96,7 @@ ${(0, ui_1.bold)('Database')}
   xflow db query 'select ...'     read data, in a read-only transaction
   xflow db migrate [--dry-run] [--allow-destructive]
                                   apply the migrations from migrations/*.sql
-  xflow db move --to <server> --confirm <database>
+  xflow db move --to <server> --yes
                                   move the project database to another server
 
 ${(0, ui_1.bold)('Pages')}
@@ -132,7 +131,8 @@ ${(0, ui_1.bold)('Environment')}
   XFLOW_TOKEN                     access key (for CI, instead of xflow login)
   XFLOW_API_URL                   platform address when it is not app.getxflow.com
 
-More about one command: xflow help <command>`);
+More about one command: xflow help <command>
+Documentation: https://docs.getxflow.com (for agents: https://docs.getxflow.com/llms.txt)`);
 }
 const TOPICS = {
     org: `${(0, ui_1.bold)('xflow org')}: several organizations, one terminal
@@ -160,10 +160,6 @@ the platform. A folder bound to an organization is not affected, its commands
 stay in its own organization: two projects of two organizations in two terminals
 work without switching anything.
 
-Outside a project folder the switch also rewrites the key in the agent config
-(see ${(0, ui_1.bold)('xflow mcp')}) when an xflow entry already exists there; a running agent
-session picks the new key up only after a restart.
-
 A project id is unique across the whole platform, so "project not found" under
 the wrong organization can never touch somebody else's project. When that error
 names a project you know exists, the key is simply from another organization:
@@ -346,7 +342,7 @@ will work.`,
                                    one, 300 at most; --json prints the values whole)
   xflow db query <file>.sql        the same, the query read from a file
   xflow db migrate                 store the project root, then apply migrations/*.sql
-  xflow db move --to <server> --confirm <project name>
+  xflow db move --to <server> --yes
                                    move the project database to another server
 
 Every project has exactly one database of its own, shared by all of its apps and functions,
@@ -361,7 +357,7 @@ ${(0, ui_1.bold)('move')} takes the database of this project to another server o
 ${(0, ui_1.bold)('platform')} or an own server by name (or id, when two share a name). The platform copies
 the tables, switches the functions of the project and removes the old copy; nothing needs a
 deploy. While it copies, the apps read data but cannot save anything new, usually for a
-couple of minutes, which is why ${(0, ui_1.bold)('--confirm')} takes the project name. It also needs the
+couple of minutes, which is why it asks for ${(0, ui_1.bold)('--yes')}. It also needs the
 right to move databases on the key: off by default, only its owner turns it on, in the
 platform settings where the key permissions live. The command follows the move to the end;
 stopping it does not stop the move, and ${(0, ui_1.bold)('xflow db status')} shows where it stands. A move
@@ -518,7 +514,7 @@ of the same service under one name; then the command prints their identifiers an
 for one of those instead of guessing.
 
 ${(0, ui_1.bold)('unlink')} refuses while a function still reads one of the variables and names
-those functions; ${(0, ui_1.bold)('--force')} goes through anyway. Seeing them needs the sources,
+those functions; ${(0, ui_1.bold)('--yes')} goes through anyway. Seeing them needs the sources,
 so under ${(0, ui_1.bold)('--project')} there is no such check: the link goes, and the variables
 that go with it are printed instead. Both commands take the flag, because an account
 linked to a service project without a folder has to be removable the same way.
@@ -642,24 +638,6 @@ Prints the body of the answer and nothing else, so it goes straight into a pipe
 (${(0, ui_1.bold)('| jq')}, ${(0, ui_1.bold)('| python')}). A non-zero exit code on 4xx and 5xx: in CI such a call has to fail the step. A
 refusal of the guard names its reason in the body (${(0, ui_1.bold)('not_bound')}, ${(0, ui_1.bold)('no_access')},
 ${(0, ui_1.bold)('functions_stopped')}); for a crash the hint points at ${(0, ui_1.bold)('xflow functions logs <name>')}.`,
-    mcp: `${(0, ui_1.bold)('xflow mcp install')}: connect the agent to the platform directly
-
-Writes the MCP server into the configuration of a client that has its own connect
-command: today that is Claude Code, and for the rest the command prints what to enter
-by hand. After that the agent runs the platform without a terminal: it inspects the
-database, applies migrations, calls functions, sets schedules, publishes app builds, reads
-logs. The commands stay: code, builds and functions deploys are still done by the CLI,
-because pushing sources through MCP means filling the agent context and spending your money.
-
-The command takes the access key from your own login and does not print it: usually
-the agent runs this command itself, and everything printed lands in its context and in
-the chat history.
-
-  --show-token    print the key anyway (not while under an agent)
-
-There is one key per person per organization and its scope is not narrowed: the agent
-sees every project of the organization and names the one it needs. It takes the
-project from the ${(0, ui_1.bold)('project_id')} argument, not from your folder, which it cannot see.`,
     skills: `${(0, ui_1.bold)('xflow skills')}: platform instructions for an AI agent
 
 An agent has no way to know about XFlow: the platform is not in its training. The
@@ -669,16 +647,12 @@ down on their own for the common agents, so this command exists to pick tools
 precisely. Refreshing after a CLI update is not your job any more: the skill and the
 CLI ship as one version, and ${(0, ui_1.bold)('xflow update')} rewrites the copies you already have.
 
-Run in a terminal, it asks two questions: where (this project, or the home folder,
-which makes the skill visible in every project) and for which agents. Copies that are
-already installed come pre-selected and are updated in place. Without a terminal, in
-CI or when an agent runs the command, there are no questions: the defaults plus every
-already installed copy are refreshed.
+Without flags it installs for Claude Code, Cursor and Codex in this project (globally:
+Claude Code, Codex and the shared folder) and refreshes every copy already installed.
 
   xflow skills list               the agents, their folders and what is installed
-  --agent claude,cursor           exact agents, no questions asked
+  --agent claude,cursor           exact agents instead of the defaults
   --global                        the home folder instead of the project
-  --yes                           no questions: defaults plus what is installed
   --refresh                       rewrite the copies that exist, create none
 
 The format is shared (agentskills.io) and inside a project most tools read the shared
@@ -730,7 +704,6 @@ apps never go in one run, because a change of functions reaches every app at onc
 
   -m <text>          the version comment, required: one short line in the language the
                      user speaks, saying what changed (--message is the long form)
-  --no-push          do not send sources, build from the latest server revision
   --revision <N>     run a revision the platform already holds: that is how the functions
                      come back (xflow deployments functions lists them)
   --project <id>     with --revision only: the functions of that project, no folder needed
@@ -746,12 +719,12 @@ ignore field of xflow.json.
 If the server holds a revision newer than the one you worked from, the sources are
 rejected and the build does not start. That means somebody deployed before you: fetch
 their changes alongside (${(0, ui_1.bold)('xflow pull --into ./server-copy')}), merge them in git on
-your side, and retry. A folder with no record of the server revision (a fresh clone, a CI
+your side, and retry; or build what the server holds as it is with ${(0, ui_1.bold)('--revision <N>')}, the
+refusal names the number. A folder with no record of the server revision (a fresh clone, a CI
 checkout) is not rejected: its first deploy goes on top of the current revision and says
-so, the check applies from the next one. ${(0, ui_1.bold)('--force')} overwrites the server revision, and before that the
-CLI shows whose work you are about to destroy and asks for confirmation by typing the
-project name. In a non-interactive run (CI, an agent) there is no way to confirm: a
-version conflict has to fail the build rather than silently destroy somebody else's work.
+so, the check applies from the next one. ${(0, ui_1.bold)('--force')} sends this folder over the server revision
+anyway. The overwritten revision is not lost at once: it stays in the history while it is among
+the last 10, and the deploy prints the ${(0, ui_1.bold)('xflow pull --revision <N>')} line that brings it back.
 
 The platform builds, in a clean sandbox on one Node version for everybody. Before that the
 sources are checked: what breaks silently (the platform files, the calls in the entry point,
@@ -769,9 +742,8 @@ internet now. A change that touches data and screens goes in this order: the fun
 changes nobody deployed.
 
 A function gone from the sources would be deleted from the cloud along with its keys and
-schedules, and that is final. So the deploy does not start at all until you say yes. In a terminal the CLI names the functions
-and asks; without one (CI, an agent) it stops and ${(0, ui_1.bold)('--allow-removals')} is the only way
-to agree. If the sources hold no functions at all while the cloud holds several, nothing
+schedules, and that is final. So the deploy does not start at all: it names the functions and stops, and ${(0, ui_1.bold)('--allow-removals')}
+is the way to agree. If the sources hold no functions at all while the cloud holds several, nothing
 is deleted and nothing is asked: that looks like a directory which never made it (a
 ${(0, ui_1.bold)('functions/')} line in .xflowignore) rather than a decision.
 

package/dist/limits.js

@@ -15,6 +15,7 @@ const DENIAL_LABELS = {
     limit_builds_concurrent: 'builds running at once',
     limit_seats: 'people in the organization',
     limit_schedule_interval: 'schedule frequency',
+    limit_schedules: 'schedules in the organization',
     db_write_locked: 'database volume, writes are off',
     plan_no_schedules: 'schedules',
     subscription_blocked: 'the subscription is unpaid',
@@ -38,6 +39,7 @@ const QUOTA_ORDER = [
     'connections',
     'pages',
     'functions',
+    'schedules',
     'people',
     'database_mb',
     'files_mb',
@@ -49,6 +51,7 @@ const QUOTA_LABELS = {
     connections: 'Active connections',
     pages: 'Public pages',
     functions: 'Cloud functions',
+    schedules: 'Schedules',
     people: 'People',
     database_mb: 'Database',
     files_mb: 'Files',

package/dist/ui.js

@@ -14,7 +14,6 @@ exports.table = table;
 exports.formatBytes = formatBytes;
 exports.formatAge = formatAge;
 exports.offerBrowser = offerBrowser;
-exports.confirmWord = confirmWord;
 const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
 /**
@@ -147,21 +146,3 @@ function offerBrowser(url) {
     });
     return () => rl.close();
 }
-/** Dangerous-action confirmation: type the exact word. Unavailable without a TTY. */
-async function confirmWord(question, expected) {
-    if (!process.stdin.isTTY) {
-        fatal('Confirmation is only possible in an interactive terminal');
-        fatalNote((0, exports.dim)('  In CI this is the right behaviour: a version conflict has to fail the build rather than overwrite what the platform holds'));
-        return false;
-    }
-    const rl = (0, node_readline_1.createInterface)({ input: process.stdin, output: process.stderr });
-    try {
-        const answer = await new Promise((resolve) => {
-            rl.question(`${question}\n  Type "${expected}" to confirm: `, resolve);
-        });
-        return answer.trim() === expected;
-    }
-    finally {
-        rl.close();
-    }
-}

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '1.1.1';
+exports.CLI_VERSION = '1.2.1';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "CLI for the XFlow platform: projects with apps, functions and a database; source sync, deployment and publishing",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -21,9 +21,13 @@ memory. If a command is not in the help output, it does not exist: guessing flag
 pointless. The CLI prints a hint with almost every error, read it in full, it usually
 contains the fix.
 
+The public documentation, in Russian, goes deeper than this file: its table of contents is
+https://docs.getxflow.com/llms.txt, every page has a Markdown copy. Read the page you need
+instead of guessing; give the person https://docs.getxflow.com when they ask how something works.
+
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 1.1.1, so the copy you are reading can be older than
+These instructions ship with xflow CLI 1.2.1, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -110,7 +114,7 @@ One folder per project, apps in subfolders:
 
 The organization runs on a plan with limits: apps, functions, pages, active connections,
 people in the organization, database and file storage, function minutes, builds per month and at once, schedules
-and how often they may run, and which access levels an app may have. Most are finite; a plan
+(one count for all projects of the organization) and how often they may run, and which access levels an app may have. Most are finite; a plan
 may leave one uncapped, and then `whoami` prints `no limit` instead of a ceiling.
 `xflow whoami` prints every one of them next to what is used, and the rights of your own key
 with them: destroying data in a migration, deleting files from storage, moving a database and
@@ -122,7 +126,7 @@ halfway through the work into a sentence said before it starts.
 - Function minutes are shared by the whole organization: every app, page and schedule spends
   them. When they run out, every function of the organization stops (`functions_stopped`).
 - An unpaid plan stops the functions at once, and five days later freezes the organization:
-  every command except `xflow whoami`, and every MCP tool, answers `subscription_blocked`,
+  every command except `xflow whoami` answers `subscription_blocked`,
   apps and pages show a "suspended" page. Nothing is deleted and no code fixes it: tell the
   person that the owner pays the invoice in the organization settings, section «Тариф» (Plan).
 - The cap on how long one function call may run is written into the function when it is
@@ -133,8 +137,7 @@ halfway through the work into a sentence said before it starts.
   once: fan out in batches of that size, never all items of a list in parallel.
 
 A limit refusal is not a bad request. The CLI prints a line starting with `Plan limit:`, the
-API answers `code: "forbidden"` with a `limit` object (`code`, `used`, `limit`), MCP tools
-carry the same field. Retrying, renaming or rewriting the code changes nothing: tell the user
+API answers `code: "forbidden"` with a `limit` object (`code`, `used`, `limit`). Retrying, renaming or rewriting the code changes nothing: tell the user
 what ran out and stop, only the owner lifts it. A schedule refused for running too often is one
 of these too, not a bad cron string: the minimum interval comes from the plan, never guess it.
 
@@ -172,8 +175,9 @@ deployed.
   by their number.
 - `xflow status` says how the local copies differ from the server. A deploy rejected before
   the build starts means the server holds a revision this folder has never seen: fetch it next
-  to yours (`xflow pull --into ./server-copy`), merge in git, deploy again. `--force` destroys
-  that work. A folder with no record of the server revision (a fresh clone, a CI checkout) is
+  to yours (`xflow pull --into ./server-copy`), merge in git, deploy again. `--force` sends this
+  folder over it anyway; the overwritten revision is kept while it is among the last 10, and the
+  deploy prints the `xflow pull --revision <N>` line that brings it back. A folder with no record of the server revision (a fresh clone, a CI checkout) is
   not rejected: its first deploy goes on top and says so.
 - A deploy that would delete functions gone from the sources refuses until somebody agrees;
   `--allow-removals` is the only way past it without a terminal. Reaching for it to get a
@@ -475,7 +479,7 @@ marked `available, not linked`. Check it before telling anyone a service is unav
 `xflow connections link "Яндекс Метрика" --as YANDEX_METRIKA` is that link and
 `xflow connections unlink YANDEX_METRIKA` undoes it; `xflow help connections` has the naming
 rules. In the project folder unlink refuses while a function still reads one of the variables,
-naming those functions, so read that list before reaching for `--force`.
+naming those functions, so read that list before reaching for `--yes`.
 
 Linking needs the `connections:link` right on the key, and only accounts granted to the owner
 of the key personally can be linked at all. A key cannot grant it to itself: ask the person.
@@ -508,6 +512,9 @@ nothing undoes that: ask the person first when the endpoint is not clearly a rea
 and exactly one of day-of-month / day-of-week must be `?`. A run reaches the handler as a POST
 with `event.xflow.caller === 'schedule'`, and `--payload '{"mode":"full"}'` (or
 `--payload-file body.json`) is its body. The function has to be deployed first.
+A schedule is the function plus its cron: `set` with the same pair only changes the payload, a
+new cron is one more schedule next to the old one. The plan caps the count for the whole
+organization, so take the old one off with `xflow schedules rm report "<old cron>"`.
 
 ```
 xflow env set SMTP_PASSWORD=...                 # secrets first: values ride the next deploy
@@ -556,7 +563,7 @@ the person, no command does it. Check with `--dry-run`.
 An organization can have own database servers. `xflow db list` names the server of each project
 database (`platform` is the common one) and the own servers with the room used.
 - A new project with its database on a chosen server: `xflow init --server <name>`.
-- An existing one: `xflow db move --to <name> --confirm <project name>`. Writes close while it
+- An existing one: `xflow db move --to <name> --yes`. Writes close while it
   copies, usually a couple of minutes; the platform switches the functions itself. It needs the
   right to move databases, off on the key by default: refused for the right, say what should move
   where and why, and the person turns it on or moves it in the «Базы данных» (Databases) section.
@@ -655,7 +662,6 @@ the address opens it, without signing in.
   anything else simply leaks.
 - Search engines are asked not to index pages or apps: do not promise SEO.
 - The tab icon is the platform's on every page: do not spend a request on a favicon of your own.
-- The MCP `pages` tool uploads one self-contained HTML document up to 150 KB.
 - A page is deleted by whoever made it, or by the owner of the organization. Switching a page
   off for a while is for a person, in the platform interface.
 
@@ -674,18 +680,6 @@ A key has its owner's level in each project. With view-only access reading works
 get`, logs, `db query`, `pull`), and every change fails with `Your access to this project is
 view-only`. That is not a bug to work around: tell the person, edit access is theirs to ask for.
 
-## Direct access without the terminal
-
-The platform also exposes an MCP server, connected with `xflow mcp install`. When its tools are
-available, prefer them for control-plane work: project state, database schema and read-only
-queries, migrations, function logs and invocations, schedules, variables, app builds and
-publish. They say explicitly when a result is truncated.
-
-Anything that depends on the working copy stays in the CLI: sending sources, building apps and
-deploying functions (`xflow deploy`), creating projects and apps (`xflow init`,
-`xflow apps add`). The tools cannot see your folder. Access levels, function keys, money and
-people are set by a person in the web interface.
-
 ## Do not
 
 - Deploy with `--force` without checking `xflow status` first.

package/dist/commands/mcp.js

@@ -1,100 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.refreshAgentKey = refreshAgentKey;
-exports.mcpInstall = mcpInstall;
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
-const api_1 = require("../api");
-const args_1 = require("../args");
-const config_1 = require("../config");
-const session_1 = require("../session");
-const spawn_1 = require("../spawn");
-const ui_1 = require("../ui");
-/** Clients with their own server-add command. */
-const CLIENTS = [
-    {
-        binary: 'claude',
-        label: 'Claude Code',
-        args: (url, token) => [
-            'mcp',
-            'add',
-            '--transport',
-            'http',
-            'xflow',
-            url,
-            '--header',
-            `Authorization: Bearer ${token}`,
-        ],
-        // Re-running must update the entry, not fail on it.
-        reset: ['mcp', 'remove', 'xflow', '-s', 'local'],
-        // Succeeds only when an xflow entry is visible from this folder.
-        probe: ['mcp', 'get', 'xflow'],
-    },
-];
-// Output is captured, not inherited: clients may echo the added header together
-// with the key.
-function hasBinary(binary) {
-    return (0, spawn_1.run)(binary, ['--version']).status === 0;
-}
-/**
- * Rewrite the key in clients that already hold an xflow entry visible from this
- * folder. Entries are never created here: that stays with xflow mcp install.
- */
-function refreshAgentKey(client) {
-    const url = `${client.apiUrl.replace(/\/+$/, '')}/api/mcp`;
-    let updated = false;
-    for (const target of CLIENTS) {
-        if (!hasBinary(target.binary))
-            continue;
-        if ((0, spawn_1.run)(target.binary, [...target.probe]).status !== 0)
-            continue;
-        (0, spawn_1.run)(target.binary, [...target.reset]);
-        if ((0, spawn_1.run)(target.binary, target.args(url, client.token)).status === 0)
-            updated = true;
-    }
-    return updated;
-}
-async function mcpInstall(args) {
-    // The server covers the organization: the command works outside a project folder too.
-    const root = (0, config_1.findProjectRoot)();
-    const client = (0, session_1.connect)(root ? (0, config_1.readConfig)(root) : undefined);
-    const url = `${client.apiUrl.replace(/\/+$/, '')}/api/mcp`;
-    const identity = await (0, api_1.apiJson)(client, '/api/v1/me');
-    (0, ui_1.out)(`${(0, ui_1.bold)('MCP server')} ${url}`);
-    (0, ui_1.note)((0, ui_1.dim)(`  Organization: ${identity.organization.name ?? 'unnamed'}`));
-    (0, ui_1.note)((0, ui_1.dim)('  The key covers the whole organization: the agent names the project itself'));
-    let found = 0;
-    let installed = 0;
-    for (const target of CLIENTS) {
-        if (!hasBinary(target.binary))
-            continue;
-        found++;
-        (0, ui_1.step)(`Writing into ${target.label}`);
-        (0, spawn_1.run)(target.binary, [...target.reset]);
-        const result = (0, spawn_1.run)(target.binary, target.args(url, client.token));
-        if (result.status === 0) {
-            installed++;
-            (0, ui_1.ok)(`${target.label}: the xflow server is connected`);
-        }
-        else {
-            const reason = `${result.stderr ?? ''}${result.stdout ?? ''}`.trim();
-            (0, ui_1.note)(`${target.label}: the command exited with an error`);
-            if (reason)
-                (0, ui_1.out)((0, ui_1.dim)(`  ${reason.split(client.token).join('<key>').split('\n').slice(0, 5).join('\n  ')}`));
-        }
-    }
-    if (installed === 0) {
-        (0, ui_1.note)(found === 0 ? 'Found no client with its own connect command.' : 'Add the server by hand:');
-        (0, ui_1.out)(`  type: HTTP (streamable)`);
-        (0, ui_1.out)(`  address: ${url}`);
-        (0, ui_1.out)(`  header: Authorization: Bearer <key>`);
-    }
-    if ((0, args_1.flagBool)(args, 'show-token')) {
-        (0, ui_1.out)('');
-        (0, ui_1.out)(`${(0, ui_1.bold)('Key')} ${client.token}`);
-        (0, ui_1.note)((0, ui_1.dim)('  Do not leave it in the chat with the agent'));
-    }
-    else {
-        (0, ui_1.note)((0, ui_1.dim)(`  The key lives in ${(0, node_path_1.join)((0, node_os_1.homedir)(), '.xflow', 'credentials.json')} and is not printed`));
-    }
-}

package/dist/prompt.js

@@ -1,113 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.multiSelect = multiSelect;
-exports.select = select;
-const node_readline_1 = require("node:readline");
-const errors_1 = require("./errors");
-const ui_1 = require("./ui");
-function render(lines, first) {
-    const up = first || lines.length === 1 ? '' : `[${lines.length - 1}A`;
-    process.stderr.write(`${up}\r${lines.map((line) => `${line}`).join('\n')}`);
-}
-function listen(onKey) {
-    if (process.stdin.isTTY !== true) {
-        throw new errors_1.CliError('An interactive prompt needs a terminal', 'Pass the choice through flags instead');
-    }
-    (0, node_readline_1.emitKeypressEvents)(process.stdin);
-    const wasRaw = process.stdin.isRaw === true;
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stderr.write('[?25l');
-    const handler = (_, key) => {
-        if (key)
-            onKey(key);
-    };
-    process.stdin.on('keypress', handler);
-    return () => {
-        process.stdin.off('keypress', handler);
-        process.stdin.setRawMode(wasRaw);
-        process.stdin.pause();
-        process.stderr.write('[?25h\n');
-    };
-}
-const isConfirm = (key) => key.name === 'return' || key.name === 'enter';
-const isCancel = (key) => key.name === 'escape' || (key.ctrl === true && key.name === 'c');
-/** Checkbox list. Resolves with the picked indexes, or null when cancelled. */
-function multiSelect(title, choices) {
-    return new Promise((resolve) => {
-        let cursor = 0;
-        let first = true;
-        const checked = choices.map((choice) => choice.checked === true);
-        const draw = () => {
-            render([
-                (0, ui_1.bold)(title),
-                ...choices.map((choice, i) => {
-                    const hint = choice.hint ? `  ${(0, ui_1.dim)(choice.hint)}` : '';
-                    return `${i === cursor ? '>' : ' '} ${checked[i] ? '[x]' : '[ ]'} ${choice.label}${hint}`;
-                }),
-                (0, ui_1.dim)('  up/down move, space toggle, enter confirm, esc cancel'),
-            ], first);
-            first = false;
-        };
-        const stop = listen((key) => {
-            if (key.name === 'up')
-                cursor = (cursor + choices.length - 1) % choices.length;
-            else if (key.name === 'down')
-                cursor = (cursor + 1) % choices.length;
-            else if (key.name === 'space')
-                checked[cursor] = !checked[cursor];
-            else if (isConfirm(key)) {
-                stop();
-                resolve(checked.flatMap((on, i) => (on ? [i] : [])));
-                return;
-            }
-            else if (isCancel(key)) {
-                stop();
-                resolve(null);
-                return;
-            }
-            else
-                return;
-            draw();
-        });
-        draw();
-    });
-}
-/** Radio list. Resolves with the picked index, or null when cancelled. */
-function select(title, choices) {
-    return new Promise((resolve) => {
-        let cursor = 0;
-        let first = true;
-        const draw = () => {
-            render([
-                (0, ui_1.bold)(title),
-                ...choices.map((choice, i) => {
-                    const hint = choice.hint ? `  ${(0, ui_1.dim)(choice.hint)}` : '';
-                    return `${i === cursor ? '>' : ' '} ${choice.label}${hint}`;
-                }),
-                (0, ui_1.dim)('  up/down move, enter confirm, esc cancel'),
-            ], first);
-            first = false;
-        };
-        const stop = listen((key) => {
-            if (key.name === 'up')
-                cursor = (cursor + choices.length - 1) % choices.length;
-            else if (key.name === 'down')
-                cursor = (cursor + 1) % choices.length;
-            else if (isConfirm(key)) {
-                stop();
-                resolve(cursor);
-                return;
-            }
-            else if (isCancel(key)) {
-                stop();
-                resolve(null);
-                return;
-            }
-            else
-                return;
-            draw();
-        });
-        draw();
-    });
-}