@cursor/july 0.1.109 → 0.1.112

package/src/internal/cli-deploy.ts

@@ -1,6 +1,6 @@
 /**
  * `agent-sdk deploy | deployments | deployment | stop | delete | rotate-token |
- * rotate-pod-credential | secrets set|list|unset` — Heroku-style deploys
+ * secrets set|list|unset` — Heroku-style deploys
  * onto Cursor's managed agent-serve hosting.
  *
  * All intelligence is server-side (backend/server/src/agentServe/); these
@@ -26,8 +26,10 @@ import {
 import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import { readDeployTemplate } from "./cursor-agent-template.js";
 import {
+  type AgentkitCancelRunsResult,
   type AgentkitDeployAccepted,
   type AgentkitDeployComponent,
+  type AgentkitDeploymentListItem,
   type AgentkitDeployStatus,
   type AgentkitStopAccepted,
   AgentServeDeployClient,
@@ -98,6 +100,10 @@ export interface DeployCliOptions {
   team?: string;
   json?: boolean;
   noWait?: boolean;
+  /** v2 stop: also request cancellation for every active session run. */
+  cancelRuns?: boolean;
+  /** Globally suspend a multi-tenant application without canceling runs. */
+  global?: boolean;
   apiKey?: string;
   /**
    * deploy `--repo <url>`: https git repo the control plane builds from.
@@ -332,23 +338,28 @@ export async function cmdDeploy(options: DeployCliOptions): Promise<number> {
   for (const target of targets) {
     manifests.push(await readDeployManifest(target.dir));
   }
-  if (manifests.every((manifest) => manifest.architecture === "v2")) {
+  if (manifests.every(manifest => manifest.architecture === "v2")) {
     return deployAgentsdkApplication(ctx, options, targets, {
-      hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+      // `persistent` is per child agent, like `agentPath`: each release
+      // component carries its own.
+      componentPersistent: Object.fromEntries(
+        targets.map((target, index) => [
+          target.slug,
+          manifests[index]?.persistent === true,
+        ])
+      ),
+      hasScmChannels: manifests.some(manifest => manifest.hasScmChannels),
       declaredSecretNames: [
         ...new Set(
-          manifests.flatMap((manifest) => manifest.hosting?.secretNames ?? [])
+          manifests.flatMap(manifest => manifest.hosting?.secretNames ?? [])
         ),
       ],
       hasDeploymentsChannels: manifests.some(
-        (manifest) => manifest.hasDeploymentsChannels
+        manifest => manifest.hasDeploymentsChannels
       ),
     });
   }
-  if (
-    !ctx.json &&
-    manifests.some((manifest) => manifest.architecture === "v2")
-  ) {
+  if (!ctx.json && manifests.some(manifest => manifest.architecture === "v2")) {
     ctx.err(
       `warning: agents under this parent mix architectures; deploying each separately (v2 children become standalone single-component applications).\n`
     );
@@ -453,7 +464,7 @@ async function resolveDeployTargets(
   }
   // Deploy slugs are lowercase-only; normalize directory names the same way
   // single-agent deploy does so MixedCase child dirs still deploy.
-  children = children.flatMap((child) => {
+  children = children.flatMap(child => {
     const slug = slugFromDirectoryName(basename(child.dir));
     if (slug === undefined) {
       return [];
@@ -513,7 +524,7 @@ async function resolveDeployTargets(
   if (options.all === true) {
     if (!ctx.json) {
       ctx.err(
-        `Deploying all ${children.length} agents under ${basename(dir)}: ${children.map((c) => c.slug).join(", ")}.\n`
+        `Deploying all ${children.length} agents under ${basename(dir)}: ${children.map(c => c.slug).join(", ")}.\n`
       );
     }
     return [...children];
@@ -521,7 +532,7 @@ async function resolveDeployTargets(
 
   if (options.slug !== undefined) {
     const wanted = options.slug.toLowerCase();
-    const match = children.find((child) => child.slug === wanted);
+    const match = children.find(child => child.slug === wanted);
     if (match === undefined) {
       ctx.err(
         `No agent "${options.slug}" under ${dir}.\n` +
@@ -548,7 +559,7 @@ async function resolveDeployTargets(
 
   const chooser =
     options.chooseTargets ??
-    ((agents) =>
+    (agents =>
       promptChooseDeployTargets(agents, {
         err: ctx.err,
         stdin: options.stdin ?? process.stdin,
@@ -638,7 +649,7 @@ export async function promptChooseDeployTargets(
   ) {
     return [agents[asIndex - 1]!];
   }
-  const bySlug = agents.find((agent) => agent.slug.toLowerCase() === answer);
+  const bySlug = agents.find(agent => agent.slug.toLowerCase() === answer);
   if (bySlug !== undefined) {
     return [bySlug];
   }
@@ -729,7 +740,7 @@ async function deployOne(
     ]),
   ];
   const publicRoutePaths = (manifest?.publicChannelIds ?? []).map(
-    (channelId) => `/v1/channels/${channelId}`
+    channelId => `/v1/channels/${channelId}`
   );
   if (!ctx.json && manifest?.httpChannelPublicEndpoint === true) {
     ctx.err(
@@ -748,7 +759,7 @@ async function deployOne(
   if (!ctx.json && deadSecretChannels.length > 0) {
     ctx.err(
       `warning: ${deadSecretChannels
-        .map((channelId) => `/v1/channels/${channelId}`)
+        .map(channelId => `/v1/channels/${channelId}`)
         .join(
           ", "
         )}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`
@@ -757,9 +768,12 @@ async function deployOne(
 
   if (manifest?.architecture === "v2") {
     if (!ctx.json) {
-      ctx.err("  architecture: v2\n");
+      ctx.err(
+        `  architecture: v2${manifest.persistent ? " (persistent)" : ""}\n`
+      );
     }
     return deployOneAgentsdk(ctx, extras, {
+      persistent: manifest.persistent,
       slug,
       gitRepoUrl,
       gitRef,
@@ -875,7 +889,7 @@ async function deployOne(
       // Paste-ready webhook URLs: these subtrees skip the alias token, so
       // the channel handler must verify deliveries (webhook signatures).
       deployedPublicRoutes
-        .map((path) => `  public:      ${aliasUrl}${path} (no alias token)\n`)
+        .map(path => `  public:      ${aliasUrl}${path} (no alias token)\n`)
         .join("")
   );
 
@@ -899,6 +913,8 @@ async function deployAgentsdkApplication(
   options: DeployCliOptions,
   targets: readonly DeployTarget[],
   declarations: {
+    /** Per child slug: `persistent: true` on that agent's manifest. */
+    componentPersistent: Record<string, boolean>;
     hasScmChannels: boolean;
     declaredSecretNames: string[];
     hasDeploymentsChannels: boolean;
@@ -946,11 +962,12 @@ async function deployAgentsdkApplication(
     }
   }
 
-  const components: AgentkitDeployComponent[] = targets.map((target) => ({
+  const components: AgentkitDeployComponent[] = targets.map(target => ({
     componentKey: target.slug,
     agentPath: [parentPath, basename(target.dir)]
       .filter((part): part is string => part !== undefined && part !== "")
       .join("/"),
+    persistent: declarations.componentPersistent[target.slug] === true,
   }));
 
   if (!ctx.json) {
@@ -960,14 +977,16 @@ async function deployAgentsdkApplication(
         `  source: ${gitRepoUrl}${gitRef === undefined ? "" : ` @ ${gitRef}`}\n` +
         components
           .map(
-            (component) =>
-              `  component: ${component.componentKey} (${component.agentPath ?? "."})\n`
+            component =>
+              `  component: ${component.componentKey} (${component.agentPath ?? "."})${component.persistent ? " persistent" : ""}\n`
           )
           .join("")
     );
   }
 
   return deployOneAgentsdk(ctx, undefined, {
+    // Multi-component: the flag travels on each component instead.
+    persistent: false,
     slug,
     gitRepoUrl,
     gitRef,
@@ -1004,6 +1023,11 @@ async function deployOneAgentsdk(
     hasDeploymentsChannels?: boolean;
     /** Redeploy an existing Cursor-managed product. */
     multiTenant: boolean;
+    /**
+     * `persistent: true` in a single agent's manifest. Multi-component
+     * deploys pass `false` here and flag each component instead.
+     */
+    persistent: boolean;
   }
 ): Promise<number> {
   const { slug } = args;
@@ -1011,7 +1035,7 @@ async function deployOneAgentsdk(
     args.components === undefined
       ? ""
       : `  components:  ${args.components
-          .map((component) => component.componentKey)
+          .map(component => component.componentKey)
           .join(", ")}\n`;
   if (args.multiTenant && !ctx.json) {
     ctx.err("  multi-tenant: existing product\n");
@@ -1027,6 +1051,7 @@ async function deployOneAgentsdk(
       components: args.components,
       repositories: args.repositories,
       ...(args.multiTenant ? { multiTenant: true } : {}),
+      persistent: args.persistent,
     });
   } catch (error) {
     return renderApiError(error, ctx.err, {
@@ -1088,7 +1113,7 @@ async function deployOneAgentsdk(
       (args.components === undefined
         ? ""
         : `  components:   ${args.components
-            .map((component) => component.componentKey)
+            .map(component => component.componentKey)
             .join(", ")}\n`) +
       (detail.repositories === undefined || !watchesRepositories
         ? ""
@@ -1196,6 +1221,7 @@ async function runPostDeployConnectorAuth(
 interface DeployManifest {
   hosting: AgentHostingOptions | undefined;
   architecture: AgentArchitecture | undefined;
+  persistent: boolean;
   /** `cursorAccount` connections declared by the agent. */
   cursorAccountConnections: Array<{
     name: string;
@@ -1245,44 +1271,45 @@ async function readDeployManifest(dir: string): Promise<DeployManifest> {
   if (hasErrorDiagnostics(project)) {
     throw new Error(
       `Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(
-        project.diagnostics.filter((d) => d.severity === "error")
+        project.diagnostics.filter(d => d.severity === "error")
       )}`
     );
   }
   return {
     hosting: project.agent.hosting,
     architecture: project.agent.architecture,
-    cursorAccountConnections: project.agent.connections.flatMap((connection) =>
+    persistent: project.agent.persistent === true,
+    cursorAccountConnections: project.agent.connections.flatMap(connection =>
       isCursorAccountTransport(connection.transport)
         ? [{ name: connection.name, servers: connection.transport.servers }]
         : []
     ),
     publicChannelIds: project.channels
-      .filter((channel) =>
+      .filter(channel =>
         (channel.definition.auth ?? []).some(isPublicEndpointPolicy)
       )
-      .map((channel) => channel.id),
+      .map(channel => channel.id),
     publicChannelIdsWithDeadSecretPolicies: project.channels
-      .filter((channel) => {
+      .filter(channel => {
         const auth = channel.definition.auth ?? [];
         return (
           auth.some(isPublicEndpointPolicy) &&
-          auth.some((policy) => {
+          auth.some(policy => {
             const kind = catchAuthDeclaration(policy)?.kind;
             return kind !== undefined && kind !== "public";
           })
         );
       })
-      .map((channel) => channel.id),
+      .map(channel => channel.id),
     httpChannelPublicEndpoint: (project.httpChannel.auth ?? []).some(
       isPublicEndpointPolicy
     ),
-    hasScmChannels: project.channels.some((channel) => {
+    hasScmChannels: project.channels.some(channel => {
       const kind = channel.definition.meta?.kind;
       return kind === "github" || kind === "origin";
     }),
     hasDeploymentsChannels: project.channels.some(
-      (channel) => channel.definition.meta?.kind === "deployments"
+      channel => channel.definition.meta?.kind === "deployments"
     ),
   };
 }
@@ -1304,7 +1331,7 @@ function warnMissingSecrets(
   // Platform-managed names (CURSOR_*, hosted storage) are injected by the
   // control plane and never appear in secrets list — do not warn on them.
   const missing = declared.filter(
-    (name) => !setNames.has(name) && !isReservedSecretName(name)
+    name => !setNames.has(name) && !isReservedSecretName(name)
   );
   if (missing.length === 0) {
     return;
@@ -1332,11 +1359,31 @@ export async function cmdDeployments(
   } catch (error) {
     return renderApiError(error, ctx.err);
   }
+  let applications: AgentkitDeploymentListItem[] = [];
+  try {
+    applications = await ctx.client.listAgentkitDeployments({
+      teamId: ctx.teamId,
+    });
+  } catch (error) {
+    // Older control planes 404 this route; keep listing v1.
+    if (!(error instanceof DeployApiError && error.status === 404)) {
+      return renderApiError(error, ctx.err);
+    }
+  }
   if (ctx.json) {
-    ctx.out(`${JSON.stringify({ deployments }, null, 2)}\n`);
+    // Empty v2 list keeps `{ deployments }` for v1-only parsers.
+    ctx.out(
+      `${JSON.stringify(
+        applications.length === 0
+          ? { deployments }
+          : { deployments, applications },
+        null,
+        2
+      )}\n`
+    );
     return 0;
   }
-  if (deployments.length === 0) {
+  if (deployments.length === 0 && applications.length === 0) {
     ctx.out(
       `No deployments on team ${ctx.teamId}. Create one with \`${CLI} deploy\`.\n`
     );
@@ -1344,14 +1391,28 @@ export async function cmdDeployments(
   }
   ctx.out(
     `${renderTable(
-      ["SLUG", "STATUS", "GEN", "KIND", "UPDATED"],
-      deployments.map((d) => [
-        d.slug,
-        d.status,
-        String(d.generation),
-        d.deploymentKind,
-        d.desiredUpdatedAt ?? "",
-      ])
+      ["SLUG", "ARCH", "STATUS", "GEN", "KIND", "UPDATED"],
+      [
+        ...deployments.map(d => [
+          d.slug,
+          "v1",
+          d.status,
+          String(d.generation),
+          d.deploymentKind,
+          d.desiredUpdatedAt ?? "",
+        ]),
+        ...applications.map(application => [
+          application.slug,
+          "v2",
+          application.status,
+          "-",
+          "application",
+          application.deployments
+            .map(row => row.desiredUpdatedAt)
+            .sort()
+            .at(-1) ?? "",
+        ]),
+      ]
     )}\n`
   );
   return 0;
@@ -1537,6 +1598,34 @@ export async function cmdStop(
   if (typeof ctx === "number") {
     return ctx;
   }
+  if (options.global === true) {
+    try {
+      const accepted = await ctx.client.setAgentkitGlobalSuspension({
+        teamId: ctx.teamId,
+        slug,
+        suspended: true,
+        cancelRuns: options.cancelRuns,
+      });
+      if (ctx.json) {
+        ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+        return accepted.cancellation?.failed === 0 ||
+          accepted.cancellation === undefined
+          ? 0
+          : 1;
+      }
+      ctx.out(
+        accepted.cancellation === undefined
+          ? `Globally stopped ${slug} (team ${ctx.teamId}); existing runs were not canceled.\n`
+          : `Globally stopped ${slug} (team ${ctx.teamId}).\n`
+      );
+      if (accepted.cancellation !== undefined) {
+        return writeCancellationStarted(ctx, accepted.cancellation, slug);
+      }
+      return 0;
+    } catch (error) {
+      return renderApiError(error, ctx.err);
+    }
+  }
   // Stop takes only a slug, so there is no manifest to dispatch on (unlike
   // deploy). The v2 agentsdk control plane goes first: v1 endpoints refuse
   // `architecture: "v2"` slugs with a 409 rather than a 404, so v1-first
@@ -1545,11 +1634,21 @@ export async function cmdStop(
   let architecture: "v1" | "v2" = "v2";
   let accepted: StopAccepted | AgentkitStopAccepted;
   try {
-    accepted = await ctx.client.stopAgentkit({ teamId: ctx.teamId, slug });
+    accepted = await ctx.client.stopAgentkit({
+      teamId: ctx.teamId,
+      slug,
+      cancelRuns: options.cancelRuns,
+    });
   } catch (error) {
     if (!(error instanceof DeployApiError) || error.status !== 404) {
       return renderApiError(error, ctx.err);
     }
+    if (options.cancelRuns === true) {
+      ctx.err(
+        `Canceling active runs while stopping is supported only for Agent SDK v2 deployments.\n`
+      );
+      return 1;
+    }
     try {
       accepted = await ctx.client.stopDeployment({ teamId: ctx.teamId, slug });
       architecture = "v1";
@@ -1557,13 +1656,15 @@ export async function cmdStop(
       return renderApiError(v1Error, ctx.err);
     }
   }
+  const cancellation =
+    "cancellation" in accepted ? accepted.cancellation : undefined;
   if (ctx.noWait) {
     if (ctx.json) {
       ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
     } else {
       ctx.out(`Stop accepted for ${slug} (status: ${accepted.status}).\n`);
     }
-    return 0;
+    return cancellation?.failed === 0 || cancellation === undefined ? 0 : 1;
   }
   let detail: DeploymentDetail | AgentkitDeployStatus;
   try {
@@ -1583,6 +1684,189 @@ export async function cmdStop(
   } else {
     ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
   }
+  if (cancellation !== undefined) {
+    return writeCancellationStarted(ctx, cancellation, slug);
+  }
+  return 0;
+}
+
+function writeCancellationStarted(
+  ctx: { out: (text: string) => void; err: (text: string) => void },
+  cancellation: AgentkitCancelRunsResult,
+  slug: string
+): number {
+  ctx.out(
+    `Started cancellation across ${cancellation.batchesStarted} deployment batch(es).\n`
+  );
+  if (cancellation.sessionsMarkedFailed !== undefined) {
+    ctx.out(
+      `Marked ${cancellation.sessionsMarkedFailed} factory session(s) failed.\n`
+    );
+  }
+  if (cancellation.failed > 0) {
+    ctx.err(
+      `Failed to start ${cancellation.failed} cancellation batch(es); retry with \`${CLI} cancel-runs ${slug}\`.\n`
+    );
+    return 1;
+  }
+  return 0;
+}
+
+export async function cmdStart(
+  slug: string | undefined,
+  options: DeployCliOptions
+): Promise<number> {
+  if (slug === undefined || slug === "" || options.global !== true) {
+    (options.err ?? ((t: string) => void process.stderr.write(t)))(
+      `Usage: ${CLI} start <slug> --global [--team <id>] [--json]\n`
+    );
+    return 1;
+  }
+  const ctx = await prepare(options);
+  if (typeof ctx === "number") {
+    return ctx;
+  }
+  try {
+    const accepted = await ctx.client.setAgentkitGlobalSuspension({
+      teamId: ctx.teamId,
+      slug,
+      suspended: false,
+    });
+    if (ctx.json) {
+      ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+    } else {
+      ctx.out(`Globally resumed ${slug} (team ${ctx.teamId}).\n`);
+    }
+    return 0;
+  } catch (error) {
+    return renderApiError(error, ctx.err);
+  }
+}
+
+export async function cmdCancelRuns(
+  slug: string | undefined,
+  options: DeployCliOptions
+): Promise<number> {
+  if (slug === undefined || slug === "") {
+    (options.err ?? ((text: string) => void process.stderr.write(text)))(
+      `Usage: ${CLI} cancel-runs <slug> [--team <id>] [--json]\n`
+    );
+    return 1;
+  }
+  const ctx = await prepare(options);
+  if (typeof ctx === "number") {
+    return ctx;
+  }
+  let result: AgentkitCancelRunsResult;
+  try {
+    result = await ctx.client.cancelAgentkitRuns({
+      teamId: ctx.teamId,
+      slug,
+    });
+  } catch (error) {
+    return renderApiError(error, ctx.err);
+  }
+  if (ctx.json) {
+    ctx.out(`${JSON.stringify(result, null, 2)}\n`);
+  } else {
+    ctx.out(
+      `Started cancellation across ${result.batchesStarted} deployment batch(es).\n`
+    );
+    if (result.sessionsMarkedFailed !== undefined) {
+      ctx.out(
+        `Marked ${result.sessionsMarkedFailed} factory session(s) failed.\n`
+      );
+    }
+  }
+  if (result.failed > 0) {
+    ctx.err(`Failed to start ${result.failed} cancellation batch(es).\n`);
+    return 1;
+  }
+  return 0;
+}
+
+// ============================================================================
+// event-repos <slug> --repo <owner/name>...
+// ============================================================================
+
+export async function cmdEventRepos(
+  slug: string | undefined,
+  repositories: string[],
+  options: DeployCliOptions
+): Promise<number> {
+  if (slug === undefined || slug === "") {
+    (options.err ?? ((text: string) => void process.stderr.write(text)))(
+      `Usage: ${CLI} event-repos <slug> --repo <owner/name>... [--team <id>] [--json]\n`
+    );
+    return 1;
+  }
+  const ctx = await prepare(options);
+  if (typeof ctx === "number") {
+    return ctx;
+  }
+  let configured: string[];
+  try {
+    configured = await ctx.client.setAgentkitEventRepositories({
+      teamId: ctx.teamId,
+      slug,
+      repositories,
+    });
+  } catch (error) {
+    return renderApiError(error, ctx.err);
+  }
+  if (ctx.json) {
+    ctx.out(`${JSON.stringify({ repositories: configured }, null, 2)}\n`);
+  } else if (configured.length === 0) {
+    ctx.out(`${slug} now watches no repositories.\n`);
+  } else {
+    ctx.out(`${slug} now watches ${configured.join(", ")}.\n`);
+  }
+  return 0;
+}
+
+// ============================================================================
+// upgrade <slug>
+// ============================================================================
+
+/** Release ids are uuids; anything else the user typed is a version. */
+const RELEASE_ID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export async function cmdUpgrade(
+  args: { slug: string | undefined; release: string | undefined },
+  options: DeployCliOptions
+): Promise<number> {
+  const { slug, release } = args;
+  if (slug === undefined || slug === "") {
+    (options.err ?? ((text: string) => void process.stderr.write(text)))(
+      `Usage: ${CLI} upgrade <slug> [--release <id|version>] [--team <id>] [--json]\n`
+    );
+    return 1;
+  }
+  const ctx = await prepare(options);
+  if (typeof ctx === "number") {
+    return ctx;
+  }
+  const selector = release?.trim() ?? "";
+  let releaseId: string;
+  try {
+    releaseId = await ctx.client.upgradeAgentkitInstall({
+      teamId: ctx.teamId,
+      slug,
+      ...(selector === ""
+        ? {}
+        : RELEASE_ID_RE.test(selector)
+          ? { releaseId: selector }
+          : { version: selector }),
+    });
+  } catch (error) {
+    return renderApiError(error, ctx.err);
+  }
+  if (ctx.json) {
+    ctx.out(`${JSON.stringify({ releaseId }, null, 2)}\n`);
+  } else {
+    ctx.out(`${slug} now runs release ${releaseId}.\n`);
+  }
   return 0;
 }
 
@@ -1670,15 +1954,21 @@ export async function cmdRotateToken(
   }
   let aliasToken: string;
   try {
-    await rejectV2ForLegacyCommand({
+    const architecture = await deploymentArchitecture({
       client: ctx.client,
       teamId: ctx.teamId,
       slug,
     });
-    aliasToken = await ctx.client.rotateAliasToken({
-      teamId: ctx.teamId,
-      slug,
-    });
+    aliasToken =
+      architecture === "v2"
+        ? await ctx.client.rotateAgentsdkAliasToken({
+            teamId: ctx.teamId,
+            slug,
+          })
+        : await ctx.client.rotateAliasToken({
+            teamId: ctx.teamId,
+            slug,
+          });
   } catch (error) {
     return renderApiError(error, ctx.err);
   }
@@ -1692,49 +1982,6 @@ export async function cmdRotateToken(
   return 0;
 }
 
-// ============================================================================
-// rotate-pod-credential <slug>
-// ============================================================================
-
-export async function cmdRotatePodCredential(
-  slug: string | undefined,
-  options: DeployCliOptions
-): Promise<number> {
-  if (slug === undefined || slug === "") {
-    (options.err ?? ((t: string) => void process.stderr.write(t)))(
-      `Usage: ${CLI} rotate-pod-credential <slug> [--team <id>]\n`
-    );
-    return 1;
-  }
-  const ctx = await prepare(options);
-  if (typeof ctx === "number") {
-    return ctx;
-  }
-  let podCredentialMaskedKey: string;
-  try {
-    await rejectV2ForLegacyCommand({
-      client: ctx.client,
-      teamId: ctx.teamId,
-      slug,
-    });
-    podCredentialMaskedKey = await ctx.client.rotatePodCredential({
-      teamId: ctx.teamId,
-      slug,
-    });
-  } catch (error) {
-    return renderApiError(error, ctx.err);
-  }
-  if (ctx.json) {
-    ctx.out(`${JSON.stringify({ podCredentialMaskedKey }, null, 2)}\n`);
-    return 0;
-  }
-  ctx.out(
-    `Rotated the pod credential for ${slug}: ${podCredentialMaskedKey}\n` +
-      `The running pod keeps the old credential until the next deploy — run \`${CLI} deploy --slug ${slug}\` to apply it.\n`
-  );
-  return 0;
-}
-
 // ============================================================================
 // secrets set|list|unset
 // ============================================================================
@@ -1778,7 +2025,7 @@ export async function cmdSecretsSet(
     }
     parsed.push(eq === -1 ? { name } : { name, value: spec.slice(eq + 1) });
   }
-  const hasArgvValues = parsed.some((entry) => entry.value !== undefined);
+  const hasArgvValues = parsed.some(entry => entry.value !== undefined);
   if (hasArgvValues && options.fromArgv !== true) {
     usageErr(
       `Refusing NAME=VALUE on argv (shows up in shell history and agent-captured terminals).\n` +
@@ -1811,8 +2058,9 @@ export async function cmdSecretsSet(
   }
 
   let secretNames: string[];
+  let architecture: "v1" | "v2";
   try {
-    const architecture = await secretDeploymentArchitecture(ctx, slug);
+    architecture = await secretDeploymentArchitecture(ctx, slug);
     secretNames =
       architecture === "v2"
         ? await ctx.client.setAgentkitSecrets({
@@ -1835,7 +2083,9 @@ export async function cmdSecretsSet(
   ctx.out(
     `Set ${secrets.length} secret${secrets.length === 1 ? "" : "s"} on ${slug}.\n` +
       `Secrets now set: ${secretNames.join(", ")}\n` +
-      `The engine picks them up on its next deploy.\n`
+      (architecture === "v2"
+        ? `The next task picks them up; no redeploy is required.\n`
+        : `The engine picks them up on its next deploy.\n`)
   );
   return 0;
 }
@@ -1877,7 +2127,7 @@ export async function cmdSecretsList(
   ctx.out(
     `${renderTable(
       ["NAME", "CREATED"],
-      secrets.map((secret) => [secret.name, secret.createdAt])
+      secrets.map(secret => [secret.name, secret.createdAt])
     )}\n`
   );
   return 0;
@@ -1936,10 +2186,10 @@ function createSecretValueReader(
   err: (text: string) => void
 ): (name: string) => Promise<string> {
   if (stdin.isTTY === true) {
-    return (name) => promptHidden(stdin, err, `Value for ${name}: `);
+    return name => promptHidden(stdin, err, `Value for ${name}: `);
   }
   const readLine = createLineReader(stdin);
-  return async (name) => {
+  return async name => {
     const line = await readLine();
     if (line === undefined) {
       throw new DeployApiError(
@@ -1951,21 +2201,54 @@ function createSecretValueReader(
   };
 }
 
-/** Raw-mode hidden prompt: echoes nothing, supports backspace and Ctrl-C. */
+/** Longest mask run drawn while typing a secret; the count carries the rest. */
+const SECRET_MASK_MAX_WIDTH = 24;
+
+/**
+ * One line of typing feedback for the hidden prompt. Echoing the value would
+ * leak it, so the line carries a bounded mask plus the exact character count —
+ * enough to see that keystrokes, backspaces, and pasted values landed. The
+ * mask is clamped to the terminal width so the redraw stays on one line.
+ */
+function renderSecretPromptLine(
+  prompt: string,
+  length: number,
+  dim: (text: string) => string
+): string {
+  const count = `${length} char${length === 1 ? "" : "s"}`;
+  const room =
+    (process.stderr.columns ?? 80) - prompt.length - count.length - 2;
+  const maskWidth = Math.max(0, Math.min(length, SECRET_MASK_MAX_WIDTH, room));
+  // `·` over `•`: the rest of the CLI's progress output already uses it, and
+  // fonts that ship no bullet glyph draw a tofu box in its place.
+  const mask = "·".repeat(maskWidth);
+  const body = mask === "" ? count : `${mask} ${count}`;
+  return `\r\u001b[2K${prompt}${dim(body)}`;
+}
+
+/**
+ * Raw-mode hidden prompt: never echoes the value, redraws a mask + character
+ * count as it is typed, supports backspace and Ctrl-C.
+ */
 function promptHidden(
   stdin: SecretInputStream,
   err: (text: string) => void,
   prompt: string
 ): Promise<string> {
   return new Promise((resolvePromise, reject) => {
-    err(prompt);
+    const { dim } = stderrPalette();
+    let value = "";
+    const draw = (): void => {
+      err(renderSecretPromptLine(prompt, value.length, dim));
+    };
+    draw();
     stdin.setRawMode?.(true);
     stdin.resume();
-    let value = "";
     const cleanup = (): void => {
       stdin.off("data", onData);
       stdin.setRawMode?.(false);
       stdin.pause();
+      draw();
       err("\n");
     };
     const onData = (chunk: Buffer | string): void => {
@@ -1987,6 +2270,8 @@ function promptHidden(
         }
         value += ch;
       }
+      // One redraw per chunk keeps a pasted value from flooding the terminal.
+      draw();
     };
     stdin.on("data", onData);
   });
@@ -2030,7 +2315,7 @@ export function createLineReader(
   stream.resume();
 
   return () =>
-    new Promise((resolvePromise) => {
+    new Promise(resolvePromise => {
       waiters.push(resolvePromise);
       drain();
     });
@@ -2261,7 +2546,7 @@ function renderApiError(
 
 function renderTable(header: string[], rows: string[][]): string {
   const widths = header.map((h, i) =>
-    Math.max(h.length, ...rows.map((row) => (row[i] ?? "").length))
+    Math.max(h.length, ...rows.map(row => (row[i] ?? "").length))
   );
   const renderRow = (row: string[]): string =>
     row