@cursor/july 0.1.109 → 0.1.112

package/dist/internal/cli-deploy.js

@@ -1,6 +1,6 @@
 /**
  * `agent-sdk deploy | deployments | deployment | stop | delete | rotate-token |
- * rotate-pod-credential | secrets set|list|unset` — Heroku-style deploys
+ * secrets set|list|unset` — Heroku-style deploys
  * onto Cursor's managed agent-serve hosting.
  *
  * All intelligence is server-side (backend/server/src/agentServe/); these
@@ -161,17 +161,22 @@ export function cmdDeploy(options) {
         for (const target of targets) {
             manifests.push(yield readDeployManifest(target.dir));
         }
-        if (manifests.every((manifest) => manifest.architecture === "v2")) {
+        if (manifests.every(manifest => manifest.architecture === "v2")) {
             return deployAgentsdkApplication(ctx, options, targets, {
-                hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+                // `persistent` is per child agent, like `agentPath`: each release
+                // component carries its own.
+                componentPersistent: Object.fromEntries(targets.map((target, index) => { var _a; return [
+                    target.slug,
+                    ((_a = manifests[index]) === null || _a === void 0 ? void 0 : _a.persistent) === true,
+                ]; })),
+                hasScmChannels: manifests.some(manifest => manifest.hasScmChannels),
                 declaredSecretNames: [
-                    ...new Set(manifests.flatMap((manifest) => { var _a; var _b; return (_b = (_a = manifest.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; })),
+                    ...new Set(manifests.flatMap(manifest => { var _a; var _b; return (_b = (_a = manifest.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; })),
                 ],
-                hasDeploymentsChannels: manifests.some((manifest) => manifest.hasDeploymentsChannels),
+                hasDeploymentsChannels: manifests.some(manifest => manifest.hasDeploymentsChannels),
             });
         }
-        if (!ctx.json &&
-            manifests.some((manifest) => manifest.architecture === "v2")) {
+        if (!ctx.json && manifests.some(manifest => manifest.architecture === "v2")) {
             ctx.err(`warning: agents under this parent mix architectures; deploying each separately (v2 children become standalone single-component applications).\n`);
         }
         // --path is per-agent (relative to the repo root). When deploying several
@@ -264,7 +269,7 @@ function resolveDeployTargets(options, ctx) {
         }
         // Deploy slugs are lowercase-only; normalize directory names the same way
         // single-agent deploy does so MixedCase child dirs still deploy.
-        children = children.flatMap((child) => {
+        children = children.flatMap(child => {
             const slug = slugFromDirectoryName(basename(child.dir));
             if (slug === undefined) {
                 return [];
@@ -312,13 +317,13 @@ function resolveDeployTargets(options, ctx) {
         // Multiple children.
         if (options.all === true) {
             if (!ctx.json) {
-                ctx.err(`Deploying all ${children.length} agents under ${basename(dir)}: ${children.map((c) => c.slug).join(", ")}.\n`);
+                ctx.err(`Deploying all ${children.length} agents under ${basename(dir)}: ${children.map(c => c.slug).join(", ")}.\n`);
             }
             return [...children];
         }
         if (options.slug !== undefined) {
             const wanted = options.slug.toLowerCase();
-            const match = children.find((child) => child.slug === wanted);
+            const match = children.find(child => child.slug === wanted);
             if (match === undefined) {
                 ctx.err(`No agent "${options.slug}" under ${dir}.\n` +
                     formatAgentList(children) +
@@ -337,7 +342,7 @@ function resolveDeployTargets(options, ctx) {
             }
             return [...children];
         }
-        const chooser = (_b = options.chooseTargets) !== null && _b !== void 0 ? _b : ((agents) => { var _a, _b; return promptChooseDeployTargets(agents, {
+        const chooser = (_b = options.chooseTargets) !== null && _b !== void 0 ? _b : (agents => { var _a, _b; return promptChooseDeployTargets(agents, {
             err: ctx.err,
             stdin: (_a = options.stdin) !== null && _a !== void 0 ? _a : process.stdin,
             interactive: ctx.json !== true &&
@@ -413,7 +418,7 @@ export function promptChooseDeployTargets(agents, options) {
             asIndex <= agents.length) {
             return [agents[asIndex - 1]];
         }
-        const bySlug = agents.find((agent) => agent.slug.toLowerCase() === answer);
+        const bySlug = agents.find(agent => agent.slug.toLowerCase() === answer);
         if (bySlug !== undefined) {
             return [bySlug];
         }
@@ -485,7 +490,7 @@ function deployOne(ctx, options, target, extras) {
                 ...((_f = options.allowDomains) !== null && _f !== void 0 ? _f : []),
             ]),
         ];
-        const publicRoutePaths = ((_g = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIds) !== null && _g !== void 0 ? _g : []).map((channelId) => `/v1/channels/${channelId}`);
+        const publicRoutePaths = ((_g = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIds) !== null && _g !== void 0 ? _g : []).map(channelId => `/v1/channels/${channelId}`);
         if (!ctx.json && (manifest === null || manifest === void 0 ? void 0 : manifest.httpChannelPublicEndpoint) === true) {
             ctx.err(`warning: publicEndpoint() on the built-in HTTP channel has no effect on hosting — only custom channels (/v1/channels/…) can be public; the session API always requires the alias token.\n`);
         }
@@ -497,14 +502,15 @@ function deployOne(ctx, options, target, extras) {
         const deadSecretChannels = (_h = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIdsWithDeadSecretPolicies) !== null && _h !== void 0 ? _h : [];
         if (!ctx.json && deadSecretChannels.length > 0) {
             ctx.err(`warning: ${deadSecretChannels
-                .map((channelId) => `/v1/channels/${channelId}`)
+                .map(channelId => `/v1/channels/${channelId}`)
                 .join(", ")}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`);
         }
         if ((manifest === null || manifest === void 0 ? void 0 : manifest.architecture) === "v2") {
             if (!ctx.json) {
-                ctx.err("  architecture: v2\n");
+                ctx.err(`  architecture: v2${manifest.persistent ? " (persistent)" : ""}\n`);
             }
             return deployOneAgentsdk(ctx, extras, {
+                persistent: manifest.persistent,
                 slug,
                 gitRepoUrl,
                 gitRef,
@@ -590,7 +596,7 @@ function deployOne(ctx, options, target, extras) {
             // Paste-ready webhook URLs: these subtrees skip the alias token, so
             // the channel handler must verify deliveries (webhook signatures).
             deployedPublicRoutes
-                .map((path) => `  public:      ${aliasUrl}${path} (no alias token)\n`)
+                .map(path => `  public:      ${aliasUrl}${path} (no alias token)\n`)
                 .join(""));
         yield runPostDeployConnectorAuth(ctx, options, {
             slug,
@@ -640,21 +646,24 @@ function deployAgentsdkApplication(ctx, options, targets, declarations) {
                 return 1;
             }
         }
-        const components = targets.map((target) => ({
+        const components = targets.map(target => ({
             componentKey: target.slug,
             agentPath: [parentPath, basename(target.dir)]
                 .filter((part) => part !== undefined && part !== "")
                 .join("/"),
+            persistent: declarations.componentPersistent[target.slug] === true,
         }));
         if (!ctx.json) {
             ctx.err(`Deploying "${slug}" as one v2 application with ${targets.length} components (slug from the parent directory name).\n` +
                 `  architecture: v2\n` +
                 `  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
                 components
-                    .map((component) => { var _a; return `  component: ${component.componentKey} (${(_a = component.agentPath) !== null && _a !== void 0 ? _a : "."})\n`; })
+                    .map(component => { var _a; return `  component: ${component.componentKey} (${(_a = component.agentPath) !== null && _a !== void 0 ? _a : "."})${component.persistent ? " persistent" : ""}\n`; })
                     .join(""));
         }
         return deployOneAgentsdk(ctx, undefined, {
+            // Multi-component: the flag travels on each component instead.
+            persistent: false,
             slug,
             gitRepoUrl,
             gitRef,
@@ -680,14 +689,14 @@ function deployOneAgentsdk(ctx, extras, args) {
         const componentsLine = args.components === undefined
             ? ""
             : `  components:  ${args.components
-                .map((component) => component.componentKey)
+                .map(component => component.componentKey)
                 .join(", ")}\n`;
         if (args.multiTenant && !ctx.json) {
             ctx.err("  multi-tenant: existing product\n");
         }
         let accepted;
         try {
-            accepted = yield ctx.client.deployAgentkit(Object.assign({ teamId: ctx.teamId, slug, gitRepoUrl: args.gitRepoUrl, gitRef: args.gitRef, agentPath: args.agentPath, components: args.components, repositories: args.repositories }, (args.multiTenant ? { multiTenant: true } : {})));
+            accepted = yield ctx.client.deployAgentkit(Object.assign(Object.assign({ teamId: ctx.teamId, slug, gitRepoUrl: args.gitRepoUrl, gitRef: args.gitRef, agentPath: args.agentPath, components: args.components, repositories: args.repositories }, (args.multiTenant ? { multiTenant: true } : {})), { persistent: args.persistent }));
         }
         catch (error) {
             return renderApiError(error, ctx.err, {
@@ -739,7 +748,7 @@ function deployOneAgentsdk(ctx, extras, args) {
             (args.components === undefined
                 ? ""
                 : `  components:   ${args.components
-                    .map((component) => component.componentKey)
+                    .map(component => component.componentKey)
                     .join(", ")}\n`) +
             (detail.repositories === undefined || !watchesRepositories
                 ? ""
@@ -830,36 +839,37 @@ function readDeployManifest(dir) {
         // diagnostics (e.g. agent/storage.ts on architecture v2) would only be
         // refused later by `serve` inside the hosted build, wasting a bake.
         if (hasErrorDiagnostics(project)) {
-            throw new Error(`Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(project.diagnostics.filter((d) => d.severity === "error"))}`);
+            throw new Error(`Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(project.diagnostics.filter(d => d.severity === "error"))}`);
         }
         return {
             hosting: project.agent.hosting,
             architecture: project.agent.architecture,
-            cursorAccountConnections: project.agent.connections.flatMap((connection) => isCursorAccountTransport(connection.transport)
+            persistent: project.agent.persistent === true,
+            cursorAccountConnections: project.agent.connections.flatMap(connection => isCursorAccountTransport(connection.transport)
                 ? [{ name: connection.name, servers: connection.transport.servers }]
                 : []),
             publicChannelIds: project.channels
-                .filter((channel) => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
-                .map((channel) => channel.id),
+                .filter(channel => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
+                .map(channel => channel.id),
             publicChannelIdsWithDeadSecretPolicies: project.channels
-                .filter((channel) => {
+                .filter(channel => {
                 var _a;
                 const auth = (_a = channel.definition.auth) !== null && _a !== void 0 ? _a : [];
                 return (auth.some(isPublicEndpointPolicy) &&
-                    auth.some((policy) => {
+                    auth.some(policy => {
                         var _a;
                         const kind = (_a = catchAuthDeclaration(policy)) === null || _a === void 0 ? void 0 : _a.kind;
                         return kind !== undefined && kind !== "public";
                     }));
             })
-                .map((channel) => channel.id),
+                .map(channel => channel.id),
             httpChannelPublicEndpoint: ((_a = project.httpChannel.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy),
-            hasScmChannels: project.channels.some((channel) => {
+            hasScmChannels: project.channels.some(channel => {
                 var _a;
                 const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
                 return kind === "github" || kind === "origin";
             }),
-            hasDeploymentsChannels: project.channels.some((channel) => { var _a; return ((_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind) === "deployments"; }),
+            hasDeploymentsChannels: project.channels.some(channel => { var _a; return ((_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind) === "deployments"; }),
         };
     });
 }
@@ -874,7 +884,7 @@ function warnMissingSecrets(ctx, slug, declared, set) {
     const setNames = new Set(set !== null && set !== void 0 ? set : []);
     // Platform-managed names (CURSOR_*, hosted storage) are injected by the
     // control plane and never appear in secrets list — do not warn on them.
-    const missing = declared.filter((name) => !setNames.has(name) && !isReservedSecretName(name));
+    const missing = declared.filter(name => !setNames.has(name) && !isReservedSecretName(name));
     if (missing.length === 0) {
         return;
     }
@@ -897,21 +907,50 @@ export function cmdDeployments(options) {
         catch (error) {
             return renderApiError(error, ctx.err);
         }
+        let applications = [];
+        try {
+            applications = yield ctx.client.listAgentkitDeployments({
+                teamId: ctx.teamId,
+            });
+        }
+        catch (error) {
+            // Older control planes 404 this route; keep listing v1.
+            if (!(error instanceof DeployApiError && error.status === 404)) {
+                return renderApiError(error, ctx.err);
+            }
+        }
         if (ctx.json) {
-            ctx.out(`${JSON.stringify({ deployments }, null, 2)}\n`);
+            // Empty v2 list keeps `{ deployments }` for v1-only parsers.
+            ctx.out(`${JSON.stringify(applications.length === 0
+                ? { deployments }
+                : { deployments, applications }, null, 2)}\n`);
             return 0;
         }
-        if (deployments.length === 0) {
+        if (deployments.length === 0 && applications.length === 0) {
             ctx.out(`No deployments on team ${ctx.teamId}. Create one with \`${CLI} deploy\`.\n`);
             return 0;
         }
-        ctx.out(`${renderTable(["SLUG", "STATUS", "GEN", "KIND", "UPDATED"], deployments.map((d) => { var _a; return [
-            d.slug,
-            d.status,
-            String(d.generation),
-            d.deploymentKind,
-            (_a = d.desiredUpdatedAt) !== null && _a !== void 0 ? _a : "",
-        ]; }))}\n`);
+        ctx.out(`${renderTable(["SLUG", "ARCH", "STATUS", "GEN", "KIND", "UPDATED"], [
+            ...deployments.map(d => { var _a; return [
+                d.slug,
+                "v1",
+                d.status,
+                String(d.generation),
+                d.deploymentKind,
+                (_a = d.desiredUpdatedAt) !== null && _a !== void 0 ? _a : "",
+            ]; }),
+            ...applications.map(application => { var _a; return [
+                application.slug,
+                "v2",
+                application.status,
+                "-",
+                "application",
+                (_a = application.deployments
+                    .map(row => row.desiredUpdatedAt)
+                    .sort()
+                    .at(-1)) !== null && _a !== void 0 ? _a : "",
+            ]; }),
+        ])}\n`);
         return 0;
     });
 }
@@ -1054,14 +1093,42 @@ function renderAgentkitDeploymentStatus(ctx, detail) {
 export function cmdStop(slug, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
+        var _b;
         if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} stop <slug> [--team <id>] [--json] [--no-wait]\n`);
+            ((_b = options.err) !== null && _b !== void 0 ? _b : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} stop <slug> [--team <id>] [--json] [--no-wait]\n`);
             return 1;
         }
         const ctx = yield prepare(options);
         if (typeof ctx === "number") {
             return ctx;
         }
+        if (options.global === true) {
+            try {
+                const accepted = yield ctx.client.setAgentkitGlobalSuspension({
+                    teamId: ctx.teamId,
+                    slug,
+                    suspended: true,
+                    cancelRuns: options.cancelRuns,
+                });
+                if (ctx.json) {
+                    ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+                    return ((_a = accepted.cancellation) === null || _a === void 0 ? void 0 : _a.failed) === 0 ||
+                        accepted.cancellation === undefined
+                        ? 0
+                        : 1;
+                }
+                ctx.out(accepted.cancellation === undefined
+                    ? `Globally stopped ${slug} (team ${ctx.teamId}); existing runs were not canceled.\n`
+                    : `Globally stopped ${slug} (team ${ctx.teamId}).\n`);
+                if (accepted.cancellation !== undefined) {
+                    return writeCancellationStarted(ctx, accepted.cancellation, slug);
+                }
+                return 0;
+            }
+            catch (error) {
+                return renderApiError(error, ctx.err);
+            }
+        }
         // Stop takes only a slug, so there is no manifest to dispatch on (unlike
         // deploy). The v2 agentsdk control plane goes first: v1 endpoints refuse
         // `architecture: "v2"` slugs with a 409 rather than a 404, so v1-first
@@ -1070,12 +1137,20 @@ export function cmdStop(slug, options) {
         let architecture = "v2";
         let accepted;
         try {
-            accepted = yield ctx.client.stopAgentkit({ teamId: ctx.teamId, slug });
+            accepted = yield ctx.client.stopAgentkit({
+                teamId: ctx.teamId,
+                slug,
+                cancelRuns: options.cancelRuns,
+            });
         }
         catch (error) {
             if (!(error instanceof DeployApiError) || error.status !== 404) {
                 return renderApiError(error, ctx.err);
             }
+            if (options.cancelRuns === true) {
+                ctx.err(`Canceling active runs while stopping is supported only for Agent SDK v2 deployments.\n`);
+                return 1;
+            }
             try {
                 accepted = yield ctx.client.stopDeployment({ teamId: ctx.teamId, slug });
                 architecture = "v1";
@@ -1084,6 +1159,7 @@ export function cmdStop(slug, options) {
                 return renderApiError(v1Error, ctx.err);
             }
         }
+        const cancellation = "cancellation" in accepted ? accepted.cancellation : undefined;
         if (ctx.noWait) {
             if (ctx.json) {
                 ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
@@ -1091,7 +1167,7 @@ export function cmdStop(slug, options) {
             else {
                 ctx.out(`Stop accepted for ${slug} (status: ${accepted.status}).\n`);
             }
-            return 0;
+            return (cancellation === null || cancellation === void 0 ? void 0 : cancellation.failed) === 0 || cancellation === undefined ? 0 : 1;
         }
         let detail;
         try {
@@ -1109,6 +1185,162 @@ export function cmdStop(slug, options) {
         else {
             ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
         }
+        if (cancellation !== undefined) {
+            return writeCancellationStarted(ctx, cancellation, slug);
+        }
+        return 0;
+    });
+}
+function writeCancellationStarted(ctx, cancellation, slug) {
+    ctx.out(`Started cancellation across ${cancellation.batchesStarted} deployment batch(es).\n`);
+    if (cancellation.sessionsMarkedFailed !== undefined) {
+        ctx.out(`Marked ${cancellation.sessionsMarkedFailed} factory session(s) failed.\n`);
+    }
+    if (cancellation.failed > 0) {
+        ctx.err(`Failed to start ${cancellation.failed} cancellation batch(es); retry with \`${CLI} cancel-runs ${slug}\`.\n`);
+        return 1;
+    }
+    return 0;
+}
+export function cmdStart(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "" || options.global !== true) {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} start <slug> --global [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        try {
+            const accepted = yield ctx.client.setAgentkitGlobalSuspension({
+                teamId: ctx.teamId,
+                slug,
+                suspended: false,
+            });
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Globally resumed ${slug} (team ${ctx.teamId}).\n`);
+            }
+            return 0;
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+    });
+}
+export function cmdCancelRuns(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} cancel-runs <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let result;
+        try {
+            result = yield ctx.client.cancelAgentkitRuns({
+                teamId: ctx.teamId,
+                slug,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Started cancellation across ${result.batchesStarted} deployment batch(es).\n`);
+            if (result.sessionsMarkedFailed !== undefined) {
+                ctx.out(`Marked ${result.sessionsMarkedFailed} factory session(s) failed.\n`);
+            }
+        }
+        if (result.failed > 0) {
+            ctx.err(`Failed to start ${result.failed} cancellation batch(es).\n`);
+            return 1;
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// event-repos <slug> --repo <owner/name>...
+// ============================================================================
+export function cmdEventRepos(slug, repositories, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} event-repos <slug> --repo <owner/name>... [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let configured;
+        try {
+            configured = yield ctx.client.setAgentkitEventRepositories({
+                teamId: ctx.teamId,
+                slug,
+                repositories,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ repositories: configured }, null, 2)}\n`);
+        }
+        else if (configured.length === 0) {
+            ctx.out(`${slug} now watches no repositories.\n`);
+        }
+        else {
+            ctx.out(`${slug} now watches ${configured.join(", ")}.\n`);
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// upgrade <slug>
+// ============================================================================
+/** Release ids are uuids; anything else the user typed is a version. */
+const RELEASE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function cmdUpgrade(args, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const { slug, release } = args;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text)))(`Usage: ${CLI} upgrade <slug> [--release <id|version>] [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const selector = (_b = release === null || release === void 0 ? void 0 : release.trim()) !== null && _b !== void 0 ? _b : "";
+        let releaseId;
+        try {
+            releaseId = yield ctx.client.upgradeAgentkitInstall(Object.assign({ teamId: ctx.teamId, slug }, (selector === ""
+                ? {}
+                : RELEASE_ID_RE.test(selector)
+                    ? { releaseId: selector }
+                    : { version: selector })));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ releaseId }, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`${slug} now runs release ${releaseId}.\n`);
+        }
         return 0;
     });
 }
@@ -1191,15 +1423,21 @@ export function cmdRotateToken(slug, options) {
         }
         let aliasToken;
         try {
-            yield rejectV2ForLegacyCommand({
+            const architecture = yield deploymentArchitecture({
                 client: ctx.client,
                 teamId: ctx.teamId,
                 slug,
             });
-            aliasToken = yield ctx.client.rotateAliasToken({
-                teamId: ctx.teamId,
-                slug,
-            });
+            aliasToken =
+                architecture === "v2"
+                    ? yield ctx.client.rotateAgentsdkAliasToken({
+                        teamId: ctx.teamId,
+                        slug,
+                    })
+                    : yield ctx.client.rotateAliasToken({
+                        teamId: ctx.teamId,
+                        slug,
+                    });
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -1213,44 +1451,6 @@ export function cmdRotateToken(slug, options) {
     });
 }
 // ============================================================================
-// rotate-pod-credential <slug>
-// ============================================================================
-export function cmdRotatePodCredential(slug, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (slug === undefined || slug === "") {
-            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} rotate-pod-credential <slug> [--team <id>]\n`);
-            return 1;
-        }
-        const ctx = yield prepare(options);
-        if (typeof ctx === "number") {
-            return ctx;
-        }
-        let podCredentialMaskedKey;
-        try {
-            yield rejectV2ForLegacyCommand({
-                client: ctx.client,
-                teamId: ctx.teamId,
-                slug,
-            });
-            podCredentialMaskedKey = yield ctx.client.rotatePodCredential({
-                teamId: ctx.teamId,
-                slug,
-            });
-        }
-        catch (error) {
-            return renderApiError(error, ctx.err);
-        }
-        if (ctx.json) {
-            ctx.out(`${JSON.stringify({ podCredentialMaskedKey }, null, 2)}\n`);
-            return 0;
-        }
-        ctx.out(`Rotated the pod credential for ${slug}: ${podCredentialMaskedKey}\n` +
-            `The running pod keeps the old credential until the next deploy — run \`${CLI} deploy --slug ${slug}\` to apply it.\n`);
-        return 0;
-    });
-}
-// ============================================================================
 // secrets set|list|unset
 // ============================================================================
 function secretDeploymentArchitecture(ctx, slug) {
@@ -1285,7 +1485,7 @@ export function cmdSecretsSet(slug, specs, options) {
             }
             parsed.push(eq === -1 ? { name } : { name, value: spec.slice(eq + 1) });
         }
-        const hasArgvValues = parsed.some((entry) => entry.value !== undefined);
+        const hasArgvValues = parsed.some(entry => entry.value !== undefined);
         if (hasArgvValues && options.fromArgv !== true) {
             usageErr(`Refusing NAME=VALUE on argv (shows up in shell history and agent-captured terminals).\n` +
                 `Pass names only:\n` +
@@ -1311,8 +1511,9 @@ export function cmdSecretsSet(slug, specs, options) {
             });
         }
         let secretNames;
+        let architecture;
         try {
-            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            architecture = yield secretDeploymentArchitecture(ctx, slug);
             secretNames =
                 architecture === "v2"
                     ? yield ctx.client.setAgentkitSecrets({
@@ -1335,7 +1536,9 @@ export function cmdSecretsSet(slug, specs, options) {
         }
         ctx.out(`Set ${secrets.length} secret${secrets.length === 1 ? "" : "s"} on ${slug}.\n` +
             `Secrets now set: ${secretNames.join(", ")}\n` +
-            `The engine picks them up on its next deploy.\n`);
+            (architecture === "v2"
+                ? `The next task picks them up; no redeploy is required.\n`
+                : `The engine picks them up on its next deploy.\n`));
         return 0;
     });
 }
@@ -1369,7 +1572,7 @@ export function cmdSecretsList(slug, options) {
             ctx.out(`No secrets set on ${slug}. Add one with \`${CLI} secrets set ${slug} NAME\`.\n`);
             return 0;
         }
-        ctx.out(`${renderTable(["NAME", "CREATED"], secrets.map((secret) => [secret.name, secret.createdAt]))}\n`);
+        ctx.out(`${renderTable(["NAME", "CREATED"], secrets.map(secret => [secret.name, secret.createdAt]))}\n`);
         return 0;
     });
 }
@@ -1420,7 +1623,7 @@ export function cmdSecretsUnset(slug, name, options) {
  */
 function createSecretValueReader(stdin, err) {
     if (stdin.isTTY === true) {
-        return (name) => promptHidden(stdin, err, `Value for ${name}: `);
+        return name => promptHidden(stdin, err, `Value for ${name}: `);
     }
     const readLine = createLineReader(stdin);
     return (name) => __awaiter(this, void 0, void 0, function* () {
@@ -1431,19 +1634,46 @@ function createSecretValueReader(stdin, err) {
         return line;
     });
 }
-/** Raw-mode hidden prompt: echoes nothing, supports backspace and Ctrl-C. */
+/** Longest mask run drawn while typing a secret; the count carries the rest. */
+const SECRET_MASK_MAX_WIDTH = 24;
+/**
+ * One line of typing feedback for the hidden prompt. Echoing the value would
+ * leak it, so the line carries a bounded mask plus the exact character count —
+ * enough to see that keystrokes, backspaces, and pasted values landed. The
+ * mask is clamped to the terminal width so the redraw stays on one line.
+ */
+function renderSecretPromptLine(prompt, length, dim) {
+    var _a;
+    const count = `${length} char${length === 1 ? "" : "s"}`;
+    const room = ((_a = process.stderr.columns) !== null && _a !== void 0 ? _a : 80) - prompt.length - count.length - 2;
+    const maskWidth = Math.max(0, Math.min(length, SECRET_MASK_MAX_WIDTH, room));
+    // `·` over `•`: the rest of the CLI's progress output already uses it, and
+    // fonts that ship no bullet glyph draw a tofu box in its place.
+    const mask = "·".repeat(maskWidth);
+    const body = mask === "" ? count : `${mask} ${count}`;
+    return `\r\u001b[2K${prompt}${dim(body)}`;
+}
+/**
+ * Raw-mode hidden prompt: never echoes the value, redraws a mask + character
+ * count as it is typed, supports backspace and Ctrl-C.
+ */
 function promptHidden(stdin, err, prompt) {
     return new Promise((resolvePromise, reject) => {
         var _a;
-        err(prompt);
+        const { dim } = stderrPalette();
+        let value = "";
+        const draw = () => {
+            err(renderSecretPromptLine(prompt, value.length, dim));
+        };
+        draw();
         (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, true);
         stdin.resume();
-        let value = "";
         const cleanup = () => {
             var _a;
             stdin.off("data", onData);
             (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, false);
             stdin.pause();
+            draw();
             err("\n");
         };
         const onData = (chunk) => {
@@ -1465,6 +1695,8 @@ function promptHidden(stdin, err, prompt) {
                 }
                 value += ch;
             }
+            // One redraw per chunk keeps a pasted value from flooding the terminal.
+            draw();
         };
         stdin.on("data", onData);
     });
@@ -1502,7 +1734,7 @@ export function createLineReader(stream) {
         drain();
     });
     stream.resume();
-    return () => new Promise((resolvePromise) => {
+    return () => new Promise(resolvePromise => {
         waiters.push(resolvePromise);
         drain();
     });
@@ -1681,7 +1913,7 @@ function renderApiError(error, err, context) {
     throw error;
 }
 function renderTable(header, rows) {
-    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => { var _a; return ((_a = row[i]) !== null && _a !== void 0 ? _a : "").length; })));
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map(row => { var _a; return ((_a = row[i]) !== null && _a !== void 0 ? _a : "").length; })));
     const renderRow = (row) => row
         .map((cell, i) => { var _a; return cell.padEnd((_a = widths[i]) !== null && _a !== void 0 ? _a : 0); })
         .join("  ")