@wavespeed/cli 0.2.3 → 0.2.5

package/dist/commands/auth.js

@@ -33,6 +33,10 @@ async function readClipboardKey() {
 async function validateKey(apiKey, baseUrl) {
     // The platform doesn't expose a dedicated /whoami yet, so we ping a known
     // authenticated endpoint and treat anything that isn't 401/403 as "key works".
+    // Note this proves the key is live, not that it can run models: /balance is
+    // deliberately open to every key regardless of the creator's org role, so a
+    // Billing-created key logs in here and only fails at `run`, which now
+    // surfaces the API's explanation of why.
     let res = null;
     try {
         res = await fetch(`${baseUrl}/api/v3/balance`, {

package/dist/lib/api.js

@@ -47,7 +47,7 @@ export async function fetchModels(opts = {}) {
         headers: { Authorization: `Bearer ${apiKey}` },
     });
     if (!res.ok) {
-        throw new Error(`GET /api/v3/models failed: ${res.status} ${res.statusText}`);
+        throw await httpError(res, 'GET', '/api/v3/models');
     }
     const json = (await res.json());
     if (json.code !== 200) {
@@ -72,10 +72,29 @@ function authHeaders() {
         throw new Error('No API key configured. Run `wavespeed login`.');
     return { Authorization: `Bearer ${apiKey}` };
 }
+// Non-2xx responses still carry the platform's error envelope, and for
+// permission failures that body is the whole point: it names the role that
+// created the key and a role whose key would work. Throwing only the status
+// line turned every 403 into an unactionable "403 Forbidden".
+async function httpError(res, method, path) {
+    let detail = '';
+    try {
+        const body = (await res.json());
+        if (body?.message) {
+            detail = body.error_code ? `${body.message} [${body.error_code}]` : body.message;
+        }
+    }
+    catch {
+        /* non-JSON body (gateway error page, empty response) — fall back below */
+    }
+    if (detail)
+        return new Error(detail);
+    return new Error(`${method} ${path} failed: ${res.status} ${res.statusText}`);
+}
 async function apiGet(path) {
     const res = await fetch(`${getBaseUrl()}${path}`, { headers: authHeaders() });
     if (!res.ok)
-        throw new Error(`GET ${path} failed: ${res.status} ${res.statusText}`);
+        throw await httpError(res, 'GET', path);
     const json = (await res.json());
     if (json.code !== 200)
         throw new Error(json.message || `API returned code ${json.code}`);
@@ -88,7 +107,7 @@ async function apiPost(path, body) {
         body: JSON.stringify(body),
     });
     if (!res.ok)
-        throw new Error(`POST ${path} failed: ${res.status} ${res.statusText}`);
+        throw await httpError(res, 'POST', path);
     const json = (await res.json());
     if (json.code !== 200)
         throw new Error(json.message || `API returned code ${json.code}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wavespeed/cli",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "WaveSpeed CLI — one command to run any WaveSpeed AI model from your terminal.",
   "publishConfig": {
     "access": "public"
@@ -56,7 +56,7 @@
     "conf": "^13.0.0",
     "open": "^10.1.0",
     "ora": "^8.1.0",
-    "wavespeed": "^0.2.1"
+    "wavespeed": "^0.2.6"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",