fix(cloud): Trigger.dev connect takes one No restrictions key, no project ref

[justinhelmer]

polylane cloud connect --provider triggerdev now takes one Trigger.dev environment key created with the "No restrictions" preset and nothing else: the --project-ref flag and its prompt are gone, and a refused key prints the API's own refusal text. Without this the CLI still coaches users toward a flag and key shapes the API no longer accepts.

Why: nominal#3423 made Trigger.dev one "No restrictions" key per environment, refusing every other preset and dropping the project ref, so the CLI's retry-with---project-ref path and its "restricted keys on Pro" copy describe a contract that no longer exists. Closes cli#107, the patch the Switchboard ship run could not push (switchboard#1459).

Where to look

1. The instruction copy is one constant shared by the interactive prompt and the headless hint: create the key in the environment to monitor with "No restrictions", other presets are refused, prod and staging each connect as their own account.
2. The connect call sends workspaceId, provider and apiKey and nothing else; the project-ref retry helper and the --project-ref flag, help row and example are deleted. ⚠ The deployed API spec still advertises an optional projectRef, so the generated client accepts the smaller body either way.
3. The failure line prints failures[].response when the API sent one, falling back to message; the "Polylane needs a key created with the 'No restrictions' preset" sentence comes from there verbatim.
4. Its tests pin the verbatim response and the fallback, and the flag test pins that --api-key exists and --project-ref does not.

Feedback wanted: Is failure.response ?? failure.message the right precedence for every provider's failure list, or should the response only replace the message for Trigger.dev?

Risk: Low: one provider's connect path in a CLI. A user with a saved --project-ref in a script gets an unknown-flag error instead of a silent no-op. Roll back by reverting the single commit.

Verified: npm run typecheck, npm run lint and npm test (537/537) green locally at this head; README and docs carry no --project-ref or restricted-preset mention to update. Live connect against the deployed API is human-gated on nominal#3423 reaching prod.

Decisions (2)

• Print failures[].response for every provider, not only Trigger.dev. The failure list is one shape for all providers and response is the field the API fills with the human sentence; a provider that leaves it empty falls back to message unchanged, so no other provider's output moves.
• Delete the project-ref retry rather than keep it dormant. The API no longer answers a "project ref required" 400, so the branch would be dead code that a future reader has to prove unreachable; the flag goes with it so --help tells the truth.

Validation (5 criteria)

Criterion	Proof
A failure entry with response prints it verbatim after "Couldn't connect :"	test/cloud-connect-triggerdev.test.ts::surfaces the API's refusal from failures[].response verbatim
A failure entry without response prints message	test/cloud-connect-triggerdev.test.ts::falls back to the failure message when the API sent no response text
--api-key is a flag and --project-ref is not	test/cloud-connect-triggerdev.test.ts::takes only --api-key: the project ref comes from the key, so no --project-ref flag exists
No caller of the deleted helper or flag remains	npm run typecheck and npm run lint clean at dd8a1d3
Live polylane cloud connect --provider triggerdev --api-key <restricted key> prints the API's "No restrictions" refusal	human-gated: needs nominal#3423 deployed to the target stage

For agents

The commit is the Switchboard ship run's patch (Slack thread https://coreplanelabs.slack.com/archives/C0BRRHKFLCB/p1789763033761049, also inline on cli#107) applied with git am onto main at v0.2.39; the blob ids of both changed files match the patch's index line (6e9f450, 626f87a). The run could not push because its credential is scoped to coreplanelabs/nominal (switchboard#1459). No generated files changed; src/generated/ is gitignored and rebuilt by npm run codegen before typecheck.

🤖 Generated with Claude Code

[coreplane-switchboard]

LGTM: Clean removal of the project-ref path with the refusal surfaced verbatim; matches the deployed API (failures[].response exists in the spec, projectRef stays optional) — one nit on empty-string response.

Note

Approved · head dd8a1d3 · 1 finding: 1 nit

Severity	Finding	Where
nit	F1 response ?? message prints an empty line when the API sends response: "" — || would fall back	src/commands/cloud/connect.ts:273

Full review

F1: nominal's connect routers fill failures[].response with (e as Error).message, which can in principle be an empty string; response ?? message then prints the empty response instead of falling back. response || message (or a trim() check) closes that hole. Not worth blocking on.

On the PR's open question: response ?? message for every provider looks right — turso, convex, clickhouse and triggerdev all populate response with the upstream error text, which is strictly more informative than the generic "There was an error when connecting an account." message it replaces.

Two facts I verified against the deployed API spec (api.polylane.com/v1/doc): the failures entry already carries optional response: string, so failure.response typechecks against regenerated src/generated; and projectRef is still an optional body field, so the smaller request body is accepted while nominal#3423's spec change catches up. The deleted test suite covered only the deleted connectTriggerdev helper and is fully replaced by the new printConnectSuccess and flag tests — verification intact.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). A repo admin enabled this via the auto-approve workflow.

[justinhelmer]

Re F1 (nit, response ?? message on an empty-string response): valid, and skipped under the review gate in force (minor): this round has no finding at or above minor, so nothing is changed and the PR stays at head dd8a1d3. If a later round opens the gate, F1 gets folded in with it.