bdy 1.23.14-dev-target-commands → 1.23.14-dev

package/distTs/README.md

@@ -0,0 +1,181 @@
+# Buddy CLI (`bdy`)
+
+Work seamlessly with [Buddy](https://buddy.works) from the command line.
+
+`bdy` is Buddy's official command-line interface for managing CI/CD pipelines, agents, tests, artifacts, sandboxes, distributions, and more — straight from your terminal.
+
+📚 Full documentation: https://buddy.works/docs/cli/getting-started
+
+## Installation
+
+### npm (recommended)
+
+Requires Node.js 14+.
+
+```bash
+# macOS / Linux
+sudo npm i -g bdy
+
+# Windows
+npm i -g bdy
+```
+
+### Homebrew (macOS)
+
+```bash
+brew tap buddy/bdy
+brew install bdy
+```
+
+### APT (Linux x64 / ARM64)
+
+```bash
+sudo apt-get update && sudo apt-get install -y software-properties-common
+sudo gpg --homedir /tmp --no-default-keyring --keyring /usr/share/keyrings/buddy.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys eb39332e766364ca6220e8dc631c5a16310cc0ad
+echo "deb [arch=amd64 signed-by=/usr/share/keyrings/buddy.gpg] https://es.buddy.works/bdy/apt-repo prod main" | sudo tee /etc/apt/sources.list.d/buddy.list > /dev/null
+sudo apt-get update && sudo apt-get install -y bdy
+```
+
+> On ARM64, replace `arch=amd64` with `arch=arm64` in the `echo` command above.
+
+### Chocolatey (Windows)
+
+```powershell
+choco install bdy --pre
+```
+
+### Direct download
+
+Prebuilt binaries are available for macOS (Apple Silicon), Linux (x64/ARM64), and Windows (x64) on the [installation page](https://buddy.works/docs/cli/getting-started).
+
+### Verify & update
+
+```bash
+bdy version          # show current and latest version
+sudo npm i -g bdy    # update (or use your package manager's upgrade command)
+```
+
+## Authentication
+
+A [Buddy account](https://buddy.works) is required to use the CLI.
+
+Log in interactively:
+
+```bash
+bdy login
+```
+
+New to Buddy? Create an account from the CLI:
+
+```bash
+bdy register
+```
+
+### Linking a project
+
+Once logged in, link a directory to a Buddy project:
+
+```bash
+mkdir my-proj
+cd my-proj
+bdy proj link
+```
+
+After linking, every `bdy` command run from this directory is executed against the linked project — no need to pass the project name each time.
+
+Check who you're logged in as, or log out:
+
+```bash
+bdy whoami
+bdy logout
+```
+
+### Tokens & non-interactive login
+
+For CI/CD pipelines and non-browser environments, authenticate with a [personal access token](https://buddy.works/docs/api/getting-started/oauth2/personal-access-token):
+
+```bash
+bdy login --token <token>
+```
+
+The login command accepts the following options:
+
+| Option | Description | Environment variable |
+| --- | --- | --- |
+| `--token <token>` | Personal access token | `BUDDY_TOKEN` |
+| `--api <url>` | API URL for On-Premises installations | `BUDDY_API_ENDPOINT` |
+| `--region <region>` | Region: `us`, `eu`, or `as` | `BUDDY_REGION` |
+| `-w, --workspace <domain>` | Workspace URL handle | `BUDDY_WORKSPACE` |
+
+Each option can be supplied as a flag or via its environment variable — handy for pipelines and headless setups:
+
+```bash
+export BUDDY_TOKEN=<token>
+export BUDDY_WORKSPACE=<your-workspace>
+bdy login
+```
+
+## Agent integration (plugin & skills)
+
+The [Buddy Plugin](https://github.com/buddy/buddy-plugin) lets coding agents deploy applications, expose local services, and manage infrastructure on Buddy. It bundles a consolidated skill covering sandboxes, artifacts, tunnels, domains, distributions, and pipelines, plus two commands:
+
+- `/deploy [name] [path]` — deploy a static site or server application
+- `/expose [port]` — open a tunnel to a locally running service
+
+Make sure the CLI is installed first (`sudo npm install -g bdy`), then:
+
+**Claude Code** — install the plugin (commands + skills):
+
+```bash
+claude plugin marketplace add buddy/buddy-plugin
+claude plugin install buddy@buddy-plugin
+```
+
+**Other agents** — install the skills only:
+
+```bash
+npx skills add buddy/buddy-plugin
+```
+
+Then authenticate and link your project:
+
+```bash
+bdy login
+cd your-project
+bdy proj link
+```
+
+The plugin auto-detects your project type: static sites generate versioned artifacts with public URLs, while server applications deploy to sandboxes with HTTPS endpoints. Monorepos can deploy multiple applications, each getting its own URL and endpoint.
+
+## Commands
+
+| Command | Description |
+| --- | --- |
+| `bdy login` / `sign-in` | Log in to Buddy |
+| `bdy register` / `sign-up` | Register a new Buddy account |
+| `bdy whoami` | Check login information |
+| `bdy logout` | Log out from Buddy |
+| `bdy workspace` / `ws` | Manage workspaces |
+| `bdy project` / `proj` | Manage projects |
+| `bdy pipeline` / `pip` | Interact with the pipeline service |
+| `bdy artifact` / `art` | Interact with the artifact service |
+| `bdy sandbox` / `sb` | Interact with sandboxes |
+| `bdy agent` | Install and run `bdy` as an OS service (Windows, macOS, Linux) |
+| `bdy tunnel` | Manage tunnel configuration |
+| `bdy crawl` | Manage web crawls (Markdown, HTML, PNG/JPEG screenshots; suite linking) |
+| `bdy tests` | Manage unit tests and visual regression (Storybook, URL captures, runners) |
+| `bdy domain` | Manage zones used in distribution routes |
+| `bdy distro` | Manage distributions |
+| `bdy api` | Contact the Buddy API directly |
+| `bdy update` / `version` | Show version and update the CLI |
+
+Run any command with `-h` / `--help` for detailed usage:
+
+```bash
+bdy --help
+bdy pipeline --help
+```
+
+## Feedback
+
+Found a bug or have a feature request? Let us know through [Buddy support](https://buddy.works/support) or the [documentation](https://buddy.works/docs/cli/getting-started).

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.23.14-dev-target-commands",
+  "version": "1.23.14-dev",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",
@@ -53,7 +53,7 @@
     "@fastify/cors": "11.2.0",
     "@inquirer/prompts": "8.5.2",
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@puppeteer/browsers": "2.13.0",
+    "@puppeteer/browsers": "3.2.0",
     "@scalar/json-magic": "0.12.16",
     "@scalar/openapi-parser": "0.28.7",
     "@scalar/openapi-types": "0.9.1",
@@ -81,7 +81,7 @@
     "picomatch": "4.0.4",
     "pino": "10.3.1",
     "punycode": "2.3.1",
-    "puppeteer-core": "23.11.1",
+    "puppeteer-core": "25.6.0",
     "range-parser": "1.2.1",
     "socket.io-client": "4.8.3",
     "ssh2": "1.17.0",

package/distTs/src/agent/manager.js

@@ -161,6 +161,10 @@ class AgentManagerClass {
             }
             const current = (0, utils_1.getVersion)();
             const latest = await (0, utils_1.getLatestVersion)();
+            // Equality only, deliberately not "is latest newer": this runs on an explicit remote
+            // update action, whose meaning is "match what the channel publishes". Refusing an
+            // older latest would take away the only rollback the fleet has - moving the channel
+            // pointer back after a bad release.
             if (!latest || latest === '0.0.0' || latest === current) {
                 logger_1.default.info((0, texts_1.LOG_AGENT_UPDATE_NOT_NEEDED)(current));
                 // Nothing to do is not a failure, and showing it as one would make an update of
@@ -174,12 +178,15 @@ class AgentManagerClass {
             // - this is the value that stays behind if the restart never lands.
             this.agent?.reportUpdateStatus(tunnel_1.TUNNEL_AGENT_UPDATE_STATUS.STARTED);
             this.agent?.flushUpdateStatus();
-            const target = latest.match(/^\d+\.\d+\.\d+/);
+            // getLatestVersion already refuses a version it cannot parse, so this is belt and
+            // braces - kept because the download url is built from the triple, and shipping a
+            // malformed one would fail much further away from the cause.
+            const target = (0, utils_1.parseVersion)(latest);
             if (!target) {
                 logger_1.default.error(texts_1.LOG_AGENT_UPDATE_FAILED);
                 return report(tunnel_1.TUNNEL_AGENT_UPDATE_STATUS.FAILED);
             }
-            const swapped = await this.system.swapBinaryToVersion(target[0]);
+            const swapped = await this.system.swapBinaryToVersion(target.version);
             if (!swapped) {
                 logger_1.default.error((0, texts_1.LOG_AGENT_UPDATE_BINARY_INVALID)(latest));
                 return report(tunnel_1.TUNNEL_AGENT_UPDATE_STATUS.FAILED);

package/distTs/src/api/client.js

@@ -86,9 +86,8 @@ class ApiClient {
         }
         return false;
     }
-    async request({ method = 'GET', path, query, body = null, headers = {}, parseResponseBody = false, rawResponseBody = false, rawResponse = false, httpUrlEncoded = false, tryRefreshingToken = true, }) {
-        if (!headers)
-            headers = {};
+    async request(args) {
+        const { method = 'GET', path, query, body = null, headers = {}, parseResponseBody = false, rawResponseBody = false, rawResponse = false, httpUrlEncoded = false, tryRefreshingToken = true, } = args;
         if (this.token && !headers.authorization) {
             headers.authorization = `Bearer ${this.token}`;
         }
@@ -176,15 +175,12 @@ class ApiClient {
                 const success = await this.tryRefreshToken();
                 if (success) {
                     delete headers.authorization;
+                    // Retry with the complete original args (an explicit field list
+                    // once silently dropped `query` here); only the mutated headers
+                    // and the refresh guard are overridden.
                     return await this.request({
-                        method,
-                        path,
-                        body,
+                        ...args,
                         headers,
-                        parseResponseBody,
-                        rawResponseBody,
-                        rawResponse,
-                        httpUrlEncoded,
                         tryRefreshingToken: false,
                     });
                 }
@@ -253,6 +249,12 @@ class ApiClient {
             }
         }
         else if (status === 204) {
+            // A no-content success still honors the raw-output contracts: callers
+            // stream the (empty) body instead of tripping over a null.
+            if (rawResponse)
+                return response;
+            if (rawResponseBody)
+                return responseBody;
             await responseBody.dump();
             return null;
         }
@@ -1251,11 +1253,20 @@ class ApiClient {
                 query += '&';
             query += encodeURIComponent(key) + '=' + encodeURIComponent(value);
         });
-        return await this.request({
+        const resolved = await this.request({
             method: 'GET',
             path: `/workspaces/${encodeURIComponent(workspace)}/identifiers${query}`,
             parseResponseBody: true,
         });
+        // A queried project must itself resolve: for some resources
+        // (environments, artifacts, distributions) the endpoint otherwise falls
+        // back to the workspace resource of the same identifier, silently
+        // answering for a different scope than asked (TARGET_API_REQUIREMENTS.md
+        // p6). project_identifier is present whenever the project exists.
+        if (params.project && !resolved.project_identifier) {
+            throw new Error(texts_1.ERR_PROJECT_NOT_FOUND);
+        }
+        return resolved;
     }
     async resolveIdentifiers(workspace, params) {
         let query = '';

package/distTs/src/command/api/request.js

@@ -159,14 +159,15 @@ const request = async (method, url, options) => {
         output_1.default.exitNormal('');
     }
     else {
-        // setEncoding keeps multibyte characters intact across chunk boundaries,
-        // and newLine=false keeps chunk boundaries out of the payload
+        // setEncoding keeps multibyte characters intact across chunk boundaries;
+        // the response is a 1:1 payload, so it bypasses terminal-kit (whose
+        // formatting corrupts % and ^ sequences, common in URL-encoded data)
         body.setEncoding('utf8');
         body.on('data', (data) => {
-            output_1.default.normal(data, false);
+            output_1.default.data(data, false);
         });
         body.on('close', () => {
-            output_1.default.normal('');
+            output_1.default.data('');
             output_1.default.exitNormal('');
         });
     }

package/distTs/src/command/environment/delete.js

@@ -18,7 +18,8 @@ commandEnvironmentDelete.addHelpText('after', `\nEXAMPLES:${texts_1.EXAMPLE_ENVI
 commandEnvironmentDelete.action(async (identifier, options) => {
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options);
+    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options, 
+    /* strictProject */ true);
     const confirmed = options.force ||
         (await output_1.default.confirm((0, texts_1.TXT_ENVIRONMENT_DELETE_CONFIRM)(identifier)));
     if (!confirmed)

package/distTs/src/command/environment/resolve.js

@@ -11,12 +11,29 @@ const input_1 = __importDefault(require("../../input"));
 // project context from flags/env -> /identifiers -> hash id, exiting on a
 // miss. Without a project the identifier resolves as a workspace
 // environment; with one, along the project line.
-const resolveEnvironmentId = async (client, workspace, identifier, options) => {
+//
+// strictProject is for mutating commands (update/delete): an explicit -p is
+// a statement "the environment of this project", so the resolved environment
+// must actually live there. Without it /identifiers silently falls back to
+// the workspace environment of the same identifier and the write lands on a
+// workspace-wide resource. Reads keep the fallback - that is how workspace
+// environments stay addressable from inside a project context.
+const resolveEnvironmentId = async (client, workspace, identifier, options, strictProject = false) => {
     const project = input_1.default.restApiProject(options.project, true);
-    const { environment_id } = await client.getEnvironmentByIdentifier(workspace, identifier, project);
-    if (!environment_id) {
+    const resolved = await client.getEnvironmentByIdentifier(workspace, identifier, project);
+    // A nonexistent project is rejected by the API client
+    // (getResourceByIdentifier); here only the environment itself can miss.
+    if (!resolved.environment_id) {
         output_1.default.exitError(texts_1.ERR_ENVIRONMENT_NOT_FOUND);
     }
-    return environment_id;
+    if (strictProject && options.project) {
+        const environment = await client.getEnvironment(workspace, resolved.environment_id);
+        // a workspace environment carries no project, so this also fails the
+        // workspace-fallback case
+        if (environment.project?.name !== resolved.project_identifier) {
+            output_1.default.exitError(texts_1.ERR_ENVIRONMENT_NOT_FOUND);
+        }
+    }
+    return resolved.environment_id;
 };
 exports.resolveEnvironmentId = resolveEnvironmentId;

package/distTs/src/command/environment/update.js

@@ -52,7 +52,8 @@ commandEnvironmentUpdate.action(async (identifier, options) => {
         output_1.default.exitError(texts_1.ERR_COMMAND_NO_UPDATE);
     }
     const client = input_1.default.restApiTokenClient();
-    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options);
+    const environment_id = await (0, resolve_1.resolveEnvironmentId)(client, workspace, identifier, options, 
+    /* strictProject */ true);
     const result = await client.updateEnvironment(workspace, environment_id, body);
     output_1.default.exitSuccess((0, texts_1.TXT_ENVIRONMENT_UPDATED)(result.identifier, result.html_url));
 });

package/distTs/src/command/pre.js

@@ -46,14 +46,15 @@ const commandPre = async (_, command) => {
     if (!output_1.default.isTTY() || command.hideVersionUpdate || ['json', 'jsonl'].includes(command.opts()?.format)) {
         return;
     }
-    const newCli = !!command.latestVersion && command.currentVersion !== command.latestVersion;
-    const newAgent = !!command.agentStatus && !!command.latestVersion &&
-        command.agentStatus.version !== command.latestVersion;
-    if ((0, utils_1.isDocker)() && newCli && command.latestVersion) {
-        output_1.default.newCliDockerVersion(command.latestVersion);
-    }
-    else if (newCli && command.latestVersion) {
-        output_1.default.newCliVersion(command.latestVersion);
+    // No truthiness guards on the versions: an empty or unparsable one is never newer
+    const latest = command.latestVersion || '';
+    const newCli = (0, utils_1.isVersionNewer)(latest, command.currentVersion || '');
+    const newAgent = !!command.agentStatus && (0, utils_1.isVersionNewer)(latest, command.agentStatus.version);
+    if ((0, utils_1.isDocker)() && newCli) {
+        output_1.default.newCliDockerVersion(latest);
+    }
+    else if (newCli) {
+        output_1.default.newCliVersion(latest);
     }
     else if (newAgent) {
         output_1.default.newAgentVersion();

package/distTs/src/command/project/get.js

@@ -0,0 +1,18 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const cfg_1 = __importDefault(require("../../tunnel/cfg"));
+const output_1 = __importDefault(require("../../output"));
+const texts_1 = require("../../texts");
+const utils_1 = require("../../utils");
+const commandProjectGet = (0, utils_1.newCommand)('get', texts_1.DESC_COMMAND_PROJECT_GET);
+commandProjectGet.action(async () => {
+    const project = cfg_1.default.getProject();
+    if (!project) {
+        output_1.default.exitError(texts_1.TXT_PROJECT_NONE);
+    }
+    output_1.default.exitNormal(project);
+});
+exports.default = commandProjectGet;

package/distTs/src/command/project/git/credential.js

@@ -60,10 +60,12 @@ commandProjectGitCredential.action(async (action) => {
                     projects.projects[0].html_url.includes(input.host);
         }
         if (myHost) {
-            output_1.default.normal(`protocol=${input.protocol || 'https'}`);
-            output_1.default.normal(`host=${input.host}`);
-            output_1.default.normal(`username=${client.token}`);
-            output_1.default.normal(`password=`);
+            // git credential protocol output - a machine-read payload, so it
+            // bypasses terminal-kit formatting
+            output_1.default.data(`protocol=${input.protocol || 'https'}`);
+            output_1.default.data(`host=${input.host}`);
+            output_1.default.data(`username=${client.token}`);
+            output_1.default.data(`password=`);
         }
     }
     catch {

package/distTs/src/command/project/set.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const cfg_1 = __importDefault(require("../../tunnel/cfg"));
+const output_1 = __importDefault(require("../../output"));
+const texts_1 = require("../../texts");
+const utils_1 = require("../../utils");
+const input_1 = __importDefault(require("../../input"));
+const commandProjectSet = (0, utils_1.newCommand)('set', texts_1.DESC_COMMAND_PROJECT_SET);
+commandProjectSet.option('-w, --workspace <domain>', texts_1.OPTION_REST_API_WORKSPACE);
+commandProjectSet.argument('[project]', texts_1.ARG_COMMAND_PROJECT_NAME);
+commandProjectSet.action(async (project, options) => {
+    output_1.default.handleSignals();
+    const workspace = input_1.default.restApiWorkspace(options.workspace);
+    const client = input_1.default.restApiTokenClient();
+    if (project) {
+        await client.getProject(workspace, project);
+    }
+    else {
+        const response = await client.getProjects(workspace);
+        project = await output_1.default.selectProject(response.projects);
+    }
+    cfg_1.default.setProject(project);
+    if (!project)
+        output_1.default.exitSuccess(texts_1.TXT_PROJECT_SET_CLEARED);
+    else
+        output_1.default.exitSuccess((0, texts_1.TXT_PROJECT_SET_SUCCESS)(project));
+});
+exports.default = commandProjectSet;

package/distTs/src/command/sandbox/exec/command.js

@@ -43,7 +43,7 @@ commandSandboxExecCommand.action(async (identifier, command, options) => {
                     str.forEach((s) => {
                         const json = JSON.parse(s);
                         if (json.data)
-                            output_1.default.normal(json.data);
+                            output_1.default.data(json.data);
                     });
                 }
                 catch {

package/distTs/src/command/sandbox/exec/logs.js

@@ -31,7 +31,7 @@ commandSandboxExecLogs.action(async (identifier, commandId, options) => {
                 str.forEach((s) => {
                     const json = JSON.parse(s);
                     if (json.data)
-                        output_1.default.normal(json.data);
+                        output_1.default.data(json.data);
                 });
             }
             catch {

package/distTs/src/command/sandbox/get/yaml.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../../../utils");
+const texts_1 = require("../../../texts");
+const input_1 = __importDefault(require("../../../input"));
+const output_1 = __importDefault(require("../../../output"));
+const commandSandboxGetYaml = (0, utils_1.newCommand)('yaml', texts_1.DESC_COMMAND_SANDBOX_GET_YAML);
+commandSandboxGetYaml.hideVersionUpdate = true;
+commandSandboxGetYaml.alias('yml');
+commandSandboxGetYaml.option('-w, --workspace <domain>', texts_1.OPTION_REST_API_WORKSPACE);
+commandSandboxGetYaml.option('-p, --project <name>', texts_1.OPTION_REST_API_PROJECT);
+commandSandboxGetYaml.argument('<identifier>', texts_1.OPTION_SANDBOX_IDENTIFIER);
+commandSandboxGetYaml.action(async (identifier, options) => {
+    const workspace = input_1.default.restApiWorkspace(options.workspace);
+    const project = input_1.default.restApiProject(options.project);
+    const client = input_1.default.restApiTokenClient();
+    let result = await client.listSandboxes(workspace, project);
+    const sandboxes = result.sandboxes || [];
+    const found = sandboxes.find((s) => s.identifier === identifier);
+    if (!found) {
+        output_1.default.exitError(texts_1.ERR_SANDBOX_NOT_FOUND);
+    }
+    const sandboxId = found.id;
+    result = await client.getSandboxYaml(workspace, sandboxId);
+    output_1.default.exitNormal(Buffer.from(result.yaml, 'base64').toString('utf8'));
+});
+exports.default = commandSandboxGetYaml;

package/distTs/src/command/target/delete.js

@@ -20,7 +20,8 @@ commandTargetDelete.addHelpText('after', `\nEXAMPLES:${texts_1.EXAMPLE_TARGET_DE
 commandTargetDelete.action(async (identifier, options) => {
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options);
+    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options, 
+    /* strictLine */ true);
     const confirmed = options.force || (await output_1.default.confirm((0, texts_1.TXT_TARGET_DELETE_CONFIRM)(identifier)));
     if (!confirmed)
         output_1.default.exitNormal();

package/distTs/src/command/target/exec/command.js

@@ -17,7 +17,6 @@ commandTargetExecCommand.option('-p, --project <name>', texts_1.OPTION_REST_API_
 commandTargetExecCommand.option('--pipeline <identifier>', texts_1.OPTION_TARGET_PIPELINE);
 commandTargetExecCommand.option('--environment <identifier>', texts_1.OPTION_TARGET_ENVIRONMENT);
 commandTargetExecCommand.option('--async', texts_1.OPTION_TARGET_EXEC_ASYNC);
-commandTargetExecCommand.option('--wait', texts_1.OPTION_TARGET_EXEC_WAIT);
 commandTargetExecCommand.option('--file <path>', texts_1.OPTION_TARGET_EXEC_FILE);
 commandTargetExecCommand.option('--format <text|json>', texts_1.OPTION_FORMAT);
 commandTargetExecCommand.argument('<identifier>', texts_1.OPTION_TARGET_IDENTIFIER);
@@ -42,15 +41,14 @@ commandTargetExecCommand.action(async (identifier, command, options) => {
     }
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options);
+    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options, 
+    /* strictLine */ true);
     let exec = await client.executeTargetCommand(workspace, target_id, {
         command: cmd,
     });
     const execId = exec.execution_id;
     const json = options.format === 'json';
-    // --wait is deprecated (waiting is the default) but still forces sync
-    // when combined with --async.
-    if (options.async && !options.wait) {
+    if (options.async) {
         if (json) {
             output_1.default.json(exec);
         }

package/distTs/src/command/target/scope.js

@@ -10,14 +10,42 @@ const output_1 = __importDefault(require("../../output"));
 const input_1 = __importDefault(require("../../input"));
 // Shared resolve preamble for commands taking a target identifier: line
 // context from flags/env -> /identifiers -> hash id, exiting on a miss.
-const resolveTargetId = async (client, workspace, identifier, options) => {
+//
+// strictLine is for mutating commands (update/delete/exec command): an
+// explicit line flag is a statement "the target of this project/pipeline/
+// environment", yet /identifiers falls back to the workspace target of the
+// same identifier when the requested line exists but does not hold it - the
+// operation would silently land on a workspace-wide resource. Reads keep
+// the fallback (workspace targets stay addressable from a line context).
+const resolveTargetId = async (client, workspace, identifier, options, strictLine = false) => {
     const project = input_1.default.restApiProject(options.project, true);
     const line = input_1.default.targetLine(project, options.pipeline, options.environment);
-    const { target_id } = await client.getTargetByIdentifier(workspace, identifier, line);
-    if (!target_id) {
+    const resolved = await client.getTargetByIdentifier(workspace, identifier, line);
+    if (!resolved.target_id) {
         output_1.default.exitError(texts_1.ERR_TARGET_NOT_FOUND);
     }
-    return target_id;
+    if (strictLine) {
+        const requested = options.pipeline
+            ? utils_1.TARGET_SCOPE.PIPELINE
+            : options.environment
+                ? utils_1.TARGET_SCOPE.ENVIRONMENT
+                : options.project
+                    ? utils_1.TARGET_SCOPE.PROJECT
+                    : null;
+        if (requested) {
+            const target = await client.getTarget(workspace, resolved.target_id);
+            const matches = requested === utils_1.TARGET_SCOPE.PIPELINE
+                ? String(target.pipeline?.id) === String(resolved.pipeline_id)
+                : requested === utils_1.TARGET_SCOPE.ENVIRONMENT
+                    ? target.environment?.id === resolved.environment_id
+                    : (0, exports.targetScopeOf)(target) === utils_1.TARGET_SCOPE.PROJECT &&
+                        target.project?.name === resolved.project_identifier;
+            if (!matches) {
+                output_1.default.exitError(texts_1.ERR_TARGET_NOT_FOUND);
+            }
+        }
+    }
+    return resolved.target_id;
 };
 exports.resolveTargetId = resolveTargetId;
 // Lines the CLI requests per log fetch.
@@ -95,10 +123,12 @@ const resolveTargetScope = async (client, workspace, project, scope, options) =>
         };
         if (project)
             query.project = project;
-        const { environment_id } = await client.getResourceByIdentifier(workspace, query);
-        if (!environment_id)
+        const resolved = await client.getResourceByIdentifier(workspace, query);
+        // a nonexistent project is rejected by getResourceByIdentifier itself
+        if (!resolved.environment_id) {
             output_1.default.exitError(texts_1.ERR_TARGET_ENVIRONMENT_NOT_FOUND);
-        params.environmentId = environment_id;
+        }
+        params.environmentId = resolved.environment_id;
     }
     else if (scope === utils_1.TARGET_SCOPE.PROJECT) {
         params.project = project;

package/distTs/src/command/target/update.js

@@ -21,7 +21,8 @@ commandTargetUpdate.action(async (identifier, options) => {
     const yaml = input_1.default.restApiYaml(options.yaml);
     const workspace = input_1.default.restApiWorkspace(options.workspace);
     const client = input_1.default.restApiTokenClient();
-    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options);
+    const target_id = await (0, scope_1.resolveTargetId)(client, workspace, identifier, options, 
+    /* strictLine */ true);
     const body = {
         yaml: Buffer.from(yaml, 'utf8').toString('base64'),
     };

package/distTs/src/command/version.js

@@ -78,7 +78,7 @@ commandVersion.action(async () => {
     const currVersion = commandVersion.currentVersion || '';
     const lastVersion = commandVersion.latestVersion || '';
     const env = commandVersion.env || '';
-    if (currVersion !== lastVersion) {
+    if ((0, utils_1.isVersionNewer)(lastVersion, currVersion)) {
         const platform = (0, utils_1.getPlatform)();
         const isMac = platform === 'darwin';
         const isWin = platform === 'win32';