deepline 0.1.129 → 0.1.131

package/dist/cli/index.mjs

@@ -160,7 +160,7 @@ configureProxyFromEnv();
 // src/cli/index.ts
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile5 } from "fs/promises";
 import { join as join14 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+import { tmpdir as tmpdir4 } from "os";
 import { Command as Command3 } from "commander";
 
 // src/config.ts
@@ -287,6 +287,15 @@ function sdkCliConfigDir(baseUrl) {
   const home = process.env.HOME?.trim() || homedir();
   return join(home, ".local", "deepline", baseUrlSlug(baseUrl || PROD_URL));
 }
+function sdkCliStateDirPath(baseUrl, homeDir2 = process.env.HOME?.trim() || homedir()) {
+  return join(
+    homeDir2,
+    ".local",
+    "deepline",
+    baseUrlSlug(baseUrl || PROD_URL),
+    "sdk-cli"
+  );
+}
 function sdkCliEnvFilePath(baseUrl) {
   return join(sdkCliConfigDir(baseUrl), ".env");
 }
@@ -381,10 +390,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.129",
+  version: "0.1.131",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.129",
+    latest: "0.1.131",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -534,6 +543,10 @@ var HttpClient = class {
     if (explicit) return explicit;
     try {
       const versionPath = join2(
+        sdkCliStateDirPath(this.config.baseUrl),
+        "skills-version"
+      );
+      const legacyVersionPath = join2(
         process.env.HOME?.trim() || homedir3(),
         ".local",
         "deepline",
@@ -541,8 +554,9 @@ var HttpClient = class {
         "sdk-skills",
         ".version"
       );
-      if (!existsSync2(versionPath)) return null;
-      return this.cleanDiagnosticHeader(readFileSync2(versionPath, "utf-8"));
+      const resolvedPath = existsSync2(versionPath) ? versionPath : legacyVersionPath;
+      if (!existsSync2(resolvedPath)) return null;
+      return this.cleanDiagnosticHeader(readFileSync2(resolvedPath, "utf-8"));
     } catch {
       return null;
     }
@@ -3643,15 +3657,27 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as rea
 import { homedir as homedir4 } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 var CHECK_TIMEOUT_MS = 2e3;
-var COMPAT_CACHE_TTL_MS = 5 * 60 * 1e3;
+var SDK_COMPATIBILITY_CACHE_TTL_MS = 5 * 60 * 1e3;
 function shouldSkipCompatibilityCheck() {
   const value = process.env.DEEPLINE_SKIP_SDK_COMPAT_CHECK?.trim().toLowerCase();
   return value === "1" || value === "true" || value === "yes";
 }
-function compatibilityCachePath() {
-  return join3(homedir4(), ".cache", "deepline", "sdk-compat-cache.json");
+function sdkCompatibilityCachePath(baseUrl, homeDir2 = homedir4()) {
+  return join3(sdkCliStateDirPath(baseUrl, homeDir2), "compat-cache.json");
+}
+function legacySdkCompatibilityCachePath(homeDir2 = homedir4()) {
+  return join3(homeDir2, ".cache", "deepline", "sdk-compat-cache.json");
+}
+function compatibilityCacheKey(baseUrl, command, skillsVersion) {
+  return JSON.stringify({
+    baseUrl: baseUrl.replace(/\/$/, ""),
+    version: SDK_VERSION,
+    apiContract: SDK_API_CONTRACT,
+    command: command?.trim() || null,
+    skillsVersion: skillsVersion ?? null
+  });
 }
-function compatibilityCacheKey(baseUrl, command) {
+function legacyCompatibilityCacheKey(baseUrl, command) {
   return JSON.stringify({
     baseUrl: baseUrl.replace(/\/$/, ""),
     version: SDK_VERSION,
@@ -3659,15 +3685,20 @@ function compatibilityCacheKey(baseUrl, command) {
     command: command?.trim() || null
   });
 }
-function readCachedCompatibility(baseUrl, command) {
+function readCachedCompatibility(baseUrl, command, skillsVersion) {
   try {
-    const path = compatibilityCachePath();
-    if (!existsSync3(path)) {
+    const path = sdkCompatibilityCachePath(baseUrl);
+    const legacyPath = legacySdkCompatibilityCachePath();
+    const useLegacyCache = !existsSync3(path) && existsSync3(legacyPath);
+    const cachePath = useLegacyCache ? legacyPath : path;
+    if (!existsSync3(cachePath)) {
       return null;
     }
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    const entry = parsed.entries?.[compatibilityCacheKey(baseUrl, command)];
-    if (!entry || Date.now() - entry.savedAt > COMPAT_CACHE_TTL_MS) {
+    const parsed = JSON.parse(
+      readFileSync3(cachePath, "utf8")
+    );
+    const entry = parsed.entries?.[compatibilityCacheKey(baseUrl, command, skillsVersion)] ?? (useLegacyCache ? parsed.entries?.[legacyCompatibilityCacheKey(baseUrl, command)] : void 0);
+    if (!entry || Date.now() - entry.savedAt > SDK_COMPATIBILITY_CACHE_TTL_MS) {
       return null;
     }
     return entry.response;
@@ -3675,12 +3706,12 @@ function readCachedCompatibility(baseUrl, command) {
     return null;
   }
 }
-function writeCachedCompatibility(baseUrl, command, response) {
+function writeCachedCompatibility(baseUrl, command, skillsVersion, response) {
   try {
-    const path = compatibilityCachePath();
+    const path = sdkCompatibilityCachePath(baseUrl);
     const existing = existsSync3(path) ? JSON.parse(readFileSync3(path, "utf8")) : {};
     const entries = existing.entries ?? {};
-    entries[compatibilityCacheKey(baseUrl, command)] = {
+    entries[compatibilityCacheKey(baseUrl, command, skillsVersion)] = {
       savedAt: Date.now(),
       response
     };
@@ -3702,6 +3733,9 @@ async function checkSdkCompatibility(baseUrl, options = {}) {
     if (options.command?.trim()) {
       url.searchParams.set("command", options.command.trim());
     }
+    if (options.skillsVersion !== void 0) {
+      url.searchParams.set("skills_version", options.skillsVersion ?? "");
+    }
     const response = await fetch(url, {
       method: "GET",
       headers: {
@@ -3713,12 +3747,21 @@ async function checkSdkCompatibility(baseUrl, options = {}) {
     });
     const data = await response.json().catch(() => null);
     if (data) {
-      writeCachedCompatibility(baseUrl, options.command, data);
+      writeCachedCompatibility(
+        baseUrl,
+        options.command,
+        options.skillsVersion,
+        data
+      );
     }
     return { response: data, error: null };
   } catch (error) {
-    const cached = readCachedCompatibility(baseUrl, options.command);
-    if (cached?.ok === false || cached?.status === "unsupported") {
+    const cached = readCachedCompatibility(
+      baseUrl,
+      options.command,
+      options.skillsVersion
+    );
+    if (cached) {
       return { response: cached, error: null };
     }
     return {
@@ -3754,6 +3797,7 @@ import { hostname } from "os";
 import { dirname as dirname4 } from "path";
 
 // src/cli/utils.ts
+import { createHash } from "crypto";
 import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
@@ -3762,12 +3806,13 @@ import {
   writeFileSync as writeFileSync3
 } from "fs";
 import { mkdir, writeFile } from "fs/promises";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir5, tmpdir, userInfo } from "os";
 import { dirname as dirname3, join as join4, resolve as resolve2 } from "path";
 import * as childProcess from "child_process";
 import { parse } from "csv-parse/sync";
 import { stringify } from "csv-stringify/sync";
 var BROWSER_OPEN_COOLDOWN_MS = 3e4;
+var SAME_URL_BROWSER_OPEN_COOLDOWN_MS = 5 * 6e4;
 var defaultBrowserCommandRunner = childProcess;
 function getAuthedHttpClient() {
   const config = resolveConfig();
@@ -3780,25 +3825,37 @@ async function writeOutputFile(filename, content) {
   await writeFile(fullPath, content, "utf-8");
   return fullPath;
 }
-function browserOpenStateFile() {
-  const homeDir2 = process.env.HOME || homedir5();
-  return join4(
-    homeDir2,
-    ".local",
-    "deepline",
-    "runtime",
-    "state",
-    "browser-open.json"
-  );
+function stableOsUserId() {
+  try {
+    const info = userInfo();
+    if (typeof info.uid === "number") return `uid-${info.uid}`;
+    if (info.username) return `user-${info.username}`;
+  } catch {
+  }
+  return "unknown-user";
+}
+function defaultBrowserOpenStateDir() {
+  return join4(tmpdir(), `deepline-${stableOsUserId()}`, "runtime", "state");
 }
-function claimBrowserOpen(now = Date.now()) {
-  const statePath = browserOpenStateFile();
+function browserOpenStateFile(stateDir = defaultBrowserOpenStateDir()) {
+  return join4(stateDir, "browser-open.json");
+}
+function normalizeBrowserOpenTarget(raw) {
+  return String(raw || "").trim();
+}
+function browserOpenTargetKey(raw) {
+  const normalized = normalizeBrowserOpenTarget(raw);
+  return normalized ? createHash("sha256").update(normalized).digest("hex") : "";
+}
+function claimBrowserOpen(now = Date.now(), stateDir, targetUrl) {
+  const statePath = browserOpenStateFile(stateDir);
   const lockPath = `${statePath}.lock`;
+  const targetKey = browserOpenTargetKey(targetUrl);
   let locked = false;
   try {
-    mkdirSync3(dirname3(statePath), { recursive: true });
+    mkdirSync3(dirname3(statePath), { recursive: true, mode: 448 });
     try {
-      mkdirSync3(lockPath);
+      mkdirSync3(lockPath, { mode: 448 });
       locked = true;
     } catch {
       return false;
@@ -3810,14 +3867,24 @@ function claimBrowserOpen(now = Date.now()) {
       if (typeof value === "number" && Number.isFinite(value)) {
         lastOpenedAt = value;
       }
+      const targetValue = payload.targetKey ?? payload.target_key ?? payload.targetHash ?? payload.target_hash;
+      const lastTargetKey = typeof targetValue === "string" ? targetValue.trim() : "";
+      const cooldownMs = targetKey && targetKey === lastTargetKey ? SAME_URL_BROWSER_OPEN_COOLDOWN_MS : BROWSER_OPEN_COOLDOWN_MS;
+      if (lastOpenedAt > now) {
+        lastOpenedAt = 0;
+      }
+      if (now - lastOpenedAt < cooldownMs) {
+        return false;
+      }
     }
-    if (lastOpenedAt > now) {
-      lastOpenedAt = 0;
-    }
-    if (now - lastOpenedAt < BROWSER_OPEN_COOLDOWN_MS) {
-      return false;
-    }
-    writeFileSync3(statePath, JSON.stringify({ lastOpenedAt: now }), "utf-8");
+    writeFileSync3(
+      statePath,
+      JSON.stringify({
+        lastOpenedAt: now,
+        ...targetKey ? { targetKey } : {}
+      }),
+      { encoding: "utf-8", mode: 384 }
+    );
     return true;
   } catch {
     return true;
@@ -3849,6 +3916,30 @@ function browserAppNameFromBundleId(bundleId) {
   };
   return names[bundleId.toLowerCase()] ?? "";
 }
+function currentOsUsername() {
+  try {
+    return userInfo().username || "";
+  } catch {
+    return "";
+  }
+}
+function readMacosUserHome(runner = defaultBrowserCommandRunner) {
+  const username = currentOsUsername();
+  if (process.platform === "darwin" && username) {
+    try {
+      const output2 = runner.execFileSync(
+        "dscl",
+        [".", "-read", `/Users/${username}`, "NFSHomeDirectory"],
+        { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
+      );
+      const match = String(output2).match(/NFSHomeDirectory:\s*(.+)\s*$/m);
+      const home = match?.[1]?.trim();
+      if (home) return home;
+    } catch {
+    }
+  }
+  return homedir5();
+}
 function readDefaultMacBrowserBundleId(runner = defaultBrowserCommandRunner) {
   try {
     const output2 = runner.execFileSync(
@@ -3858,7 +3949,7 @@ function readDefaultMacBrowserBundleId(runner = defaultBrowserCommandRunner) {
         "json",
         "-o",
         "-",
-        `${homedir5()}/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist`
+        `${readMacosUserHome(runner)}/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist`
       ],
       { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
     );
@@ -4005,7 +4096,7 @@ function openInBrowser(url) {
     if (browserOpeningDisabled()) return;
     const targetUrl = String(url || "").trim();
     if (!targetUrl) return;
-    if (!claimBrowserOpen()) return;
+    if (!claimBrowserOpen(Date.now(), void 0, targetUrl)) return;
     const allowFocus = true;
     if (process.platform === "darwin") {
       openUrlMacos(targetUrl, allowFocus);
@@ -4107,12 +4198,15 @@ function flattenObjectColumns(row) {
       const hasMatchedEnvelope = Object.prototype.hasOwnProperty.call(record, "matched_result") || Object.prototype.hasOwnProperty.call(record, "matchedResult");
       if (hasMatchedEnvelope) {
         flattened[key] = JSON.stringify(record);
+        continue;
       } else {
         const failureMessage = failureMessageFromRecord(record);
         if (failureMessage) {
           flattened[key] = failureMessage;
+          continue;
         } else if (Object.prototype.hasOwnProperty.call(record, "result")) {
           flattened[key] = JSON.stringify(record);
+          continue;
         }
       }
       for (const [nestedKey, nestedValue] of Object.entries(record)) {
@@ -6853,11 +6947,11 @@ import {
   stat,
   writeFile as writeFile3
 } from "fs/promises";
-import { homedir as homedir6, tmpdir } from "os";
+import { homedir as homedir6, tmpdir as tmpdir2 } from "os";
 import { join as join6, resolve as resolve8 } from "path";
 
 // src/cli/commands/play.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import {
   existsSync as existsSync6,
   readFileSync as readFileSync6,
@@ -9488,7 +9582,7 @@ function stageFile(logicalPath, absolutePath) {
   return {
     logicalPath,
     contentBase64: buffer.toString("base64"),
-    contentHash: createHash("sha256").update(buffer).digest("hex"),
+    contentHash: createHash2("sha256").update(buffer).digest("hex"),
     contentType: absolutePath.toLowerCase().endsWith(".csv") ? "text/csv" : absolutePath.toLowerCase().endsWith(".json") ? "application/json" : "application/octet-stream",
     bytes: buffer.byteLength
   };
@@ -14843,9 +14937,7 @@ function renderExecuteStep(command, options = {
   const extractJs = command.extract_js ? `({ row, result, data, raw, pick, extract, extractList, target, get }) => { const input = row; const context = row;
 ${indent(renderJavascriptBody(command.extract_js), 6)}
     }` : "null";
-  const runIfJs = command.run_if_js ? `(row) => { const input = row; const context = row;
-${indent(renderJavascriptBody(command.run_if_js), 6)}
-    }` : "null";
+  const runIfJs = options.nativeRunIf ? "null" : renderRunIfFunction(command) ?? "null";
   const description = command.description ? `,
       description: ${stringLiteral(command.description)}` : "";
   const force = options.force ? `,
@@ -14870,13 +14962,35 @@ ${indent(renderJavascriptBody(command.run_if_js), 6)}
     `}`
   ].join("\n");
 }
+function renderRunIfFunction(command) {
+  return command.run_if_js ? `(row) => { const input = row; const context = row;
+${indent(renderJavascriptBody(command.run_if_js), 6)}
+    }` : null;
+}
+function renderColumnRunIfFunction(command) {
+  if (!command.run_if_js) {
+    return null;
+  }
+  if (command.play) {
+    return `(__dlRawRow) => { const row = __dlPrepareEnrichRow(__dlRawRow, [${stringLiteral(command.alias)}]); const input = row; const context = row;
+${indent(renderJavascriptBody(command.run_if_js), 6)}
+    }`;
+  }
+  return renderRunIfFunction(command);
+}
+function renderCombinedRunIfFunction(precheck, runIfSource) {
+  if (!runIfSource) {
+    return null;
+  }
+  return precheck ? `(row) => { if (${precheck}) return false; return (${runIfSource})(row); }` : runIfSource;
+}
 function renderIdiomaticExecuteStep(command, options) {
   const callId = stringLiteral(commandCallId(command));
   const tool = stringLiteral(command.tool);
   const input2 = renderToolPayloadExpression(command.payload ?? {});
   const getter = getterFromLegacyExtractJs(command.extract_js, command.alias);
   const extraction = getter ? `${renderExtractedValueGetterExpression("result", getter)} ?? null` : "result";
-  const runIfLines = command.run_if_js ? [
+  const runIfLines = command.run_if_js && !options.nativeRunIf ? [
     `  if (`,
     `    !((row: Record<string, any>) => {`,
     `      const input = row;`,
@@ -14910,10 +15024,8 @@ function renderPlayStep(command, options) {
   const callId = stringLiteral(commandCallId(command));
   const playRef = stringLiteral(command.play?.ref ?? command.tool);
   const payload = stableJson(command.payload ?? {});
-  const runIfJs = command.run_if_js ? `(row) => { const input = row; const context = row;
-${indent(renderJavascriptBody(command.run_if_js), 6)}
-    }` : "null";
-  const runIfLines = command.run_if_js ? [
+  const runIfJs = renderRunIfFunction(command) ?? "null";
+  const runIfLines = command.run_if_js && !options.nativeRunIf ? [
     `  const __dlRunIf = ${runIfJs};`,
     `  if (!__dlRunIf(templateRow)) return null;`
   ] : [];
@@ -14937,7 +15049,7 @@ ${indent(renderJavascriptBody(command.run_if_js), 6)}
 }
 function renderInlineJavascriptStep(command, options) {
   const code = typeof command.payload?.code === "string" ? command.payload.code : "return null;";
-  const runIfLines = command.run_if_js ? [
+  const runIfLines = command.run_if_js && !options.nativeRunIf ? [
     `  if (!((row: Record<string, any>) => { const input = row; const context = row;`,
     indent(renderJavascriptBody(command.run_if_js), 4),
     `  })(row as Record<string, any>)) return null;`
@@ -14967,7 +15079,8 @@ function renderColumnStep(alias, resolverSource, options = {}) {
   const resolver = indent(resolverSource, 8);
   const optionFields = [
     ...options.recompute === true ? ["recompute: true"] : [],
-    ...options.recomputeOnError === true ? ["recomputeOnError: true"] : []
+    ...options.recomputeOnError === true ? ["recomputeOnError: true"] : [],
+    ...options.runIfSource ? [`runIf: ${options.runIfSource}`] : []
   ];
   const optionSource = optionFields.length > 0 ? `{ ${optionFields.join(", ")} }` : null;
   return [
@@ -15071,17 +15184,27 @@ function renderWaterfallColumns(command, forceAliases, inlineRunJavascript, idio
     }
     const priorAliases = activeChildren.slice(0, stepIndex).map((prior) => prior.alias);
     const force = forceAliases.has(normalizeAlias(nested.alias));
+    const precheck = priorAliases.length > 0 ? `__dlWaterfallSatisfied(row, ${stableJson(priorAliases)}, ${minResults})` : void 0;
+    const runIfSource = renderCombinedRunIfFunction(
+      precheck,
+      renderColumnRunIfFunction(nested)
+    );
     return renderColumnStep(
       nested.alias,
       renderExecuteStep(nested, {
         force,
-        precheck: priorAliases.length > 0 ? `__dlWaterfallSatisfied(row, ${stableJson(priorAliases)}, ${minResults})` : void 0,
+        precheck,
         legacyEnvelope: Boolean(nested.extract_js),
         inlineRunJavascript,
         idiomaticGetters,
-        waterfallSoftFail: true
+        waterfallSoftFail: true,
+        nativeRunIf: Boolean(runIfSource)
       }),
-      { recompute: force, recomputeOnError: true }
+      {
+        recompute: force,
+        recomputeOnError: true,
+        runIfSource
+      }
     );
   }).filter((line) => line !== null);
   const aliases = activeChildren.map((nested) => nested.alias);
@@ -15132,15 +15255,21 @@ function compileEnrichConfigToPlaySource(config, options = {}) {
       return;
     }
     const force = forceAliases.has(normalizeAlias(command.alias));
+    const runIfSource = renderColumnRunIfFunction(command);
     columnSteps.push(
       renderColumnStep(
         command.alias,
         renderExecuteStep(command, {
           force,
           inlineRunJavascript,
-          idiomaticGetters
+          idiomaticGetters,
+          nativeRunIf: Boolean(runIfSource)
         }),
-        { recompute: force, recomputeOnError: true }
+        {
+          recompute: force,
+          recomputeOnError: true,
+          runIfSource
+        }
       )
     );
   });
@@ -17002,7 +17131,7 @@ async function fetchBackingRowsForCsvExport(input2) {
 function mergeRowsForCsvExport(enrichedRows, options) {
   const rows = dataExportRows(normalizeEnrichRowsForCsvExport(enrichedRows));
   const range = options?.rows;
-  if (range?.rowStart === null || range?.rowStart === void 0) {
+  if (!options?.inPlace && (range?.rowStart === null || range?.rowStart === void 0)) {
     return { rows, preferredColumns: [] };
   }
   if (!options?.sourceCsvPath) {
@@ -17013,9 +17142,15 @@ function mergeRowsForCsvExport(enrichedRows, options) {
   const baseRows = parsedBaseRows.map(
     (row) => ({ ...row })
   );
-  const start = Math.max(0, range.rowStart);
+  const start = Math.max(0, range?.rowStart ?? 0);
   const maxEnd = Math.max(start, baseRows.length - 1);
-  const inclusiveEnd = range.rowEnd === null ? maxEnd : Math.min(maxEnd, range.rowEnd);
+  const inclusiveEnd = range?.rowEnd === null || range?.rowEnd === void 0 ? maxEnd : Math.min(maxEnd, range.rowEnd);
+  const expectedSelectedRows = baseRows.length === 0 ? 0 : Math.max(0, inclusiveEnd - start + 1);
+  if (rows.length < expectedSelectedRows) {
+    throw new Error(
+      `Refusing to write a partial in-place CSV export: the run returned ${rows.length} row(s) for ${expectedSelectedRows} selected source row(s).`
+    );
+  }
   const merged = [...baseRows];
   let selectedIndex = 0;
   for (let rowIndex = start; rowIndex <= inclusiveEnd; rowIndex += 1) {
@@ -17329,7 +17464,7 @@ function registerEnrichCommand(program) {
       forceAliases,
       playName: options.name
     });
-    const tempDir = await mkdtemp(join6(tmpdir(), "deepline-enrich-play-"));
+    const tempDir = await mkdtemp(join6(tmpdir2(), "deepline-enrich-play-"));
     const tempPlay = join6(tempDir, "deepline-enrich.play.ts");
     try {
       await writeFile3(tempPlay, playSource, "utf8");
@@ -17381,7 +17516,8 @@ function registerEnrichCommand(program) {
         client: client2,
         config,
         sourceCsvPath,
-        rows
+        rows,
+        inPlace: Boolean(options.inPlace)
       }) : null;
       const rowsForFailureReport = exportResult?.enrichedDataRows ?? extractCanonicalRowsInfo(status)?.rows ?? [];
       if (options.json) {
@@ -19132,7 +19268,7 @@ import {
   readFileSync as readFileSync9,
   writeFileSync as writeFileSync12
 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
+import { tmpdir as tmpdir3 } from "os";
 import { join as join10, resolve as resolve10 } from "path";
 
 // src/tool-output.ts
@@ -20440,7 +20576,7 @@ function starterScriptJson(script) {
 function seedToolListScript(input2) {
   const stem = safeFileStem(input2.toolId);
   const fileName = `${stem}-workflow-seed-${Date.now()}.play.ts`;
-  const scriptDir = mkdtempSync(join10(tmpdir2(), "deepline-workflow-seed-"));
+  const scriptDir = mkdtempSync(join10(tmpdir3(), "deepline-workflow-seed-"));
   chmodSync(scriptDir, 448);
   const scriptPath = join10(scriptDir, fileName);
   const projectDir = `deepline/projects/${stem}-workflow`;
@@ -20748,7 +20884,7 @@ import { mkdir as mkdir4, readFile as readFile2, writeFile as writeFile4 } from
 import { dirname as dirname9, join as join11, resolve as resolve11 } from "path";
 
 // src/cli/workflow-to-play.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // ../shared_libs/plays/secret-guardrails.ts
 var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)[A-Z0-9_]*)(?:['"]\])?/g;
@@ -20891,7 +21027,7 @@ function sanitizePlayNameSegment(value) {
 }
 function deriveWorkflowPlayName(workflowName) {
   const base = sanitizePlayNameSegment(workflowName) || "workflow";
-  const suffix = createHash2("sha256").update(workflowName).digest("hex").slice(0, 8);
+  const suffix = createHash3("sha256").update(workflowName).digest("hex").slice(0, 8);
   const reserved = suffix.length + 1;
   const allowedBase = Math.max(1, MAX_PLAY_NAME_LENGTH - reserved);
   let name = `${base.slice(0, allowedBase)}_${suffix}`;
@@ -21281,13 +21417,12 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync14
 } from "fs";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir10 } from "os";
 import { dirname as dirname11, isAbsolute as isAbsolute2, join as join13, relative as relative2, resolve as resolve12 } from "path";
 
 // src/cli/skills-sync.ts
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync13 } from "fs";
-import { homedir as homedir10 } from "os";
 import { dirname as dirname10, join as join12 } from "path";
 
 // ../shared_libs/cli/install-commands.json
@@ -21419,20 +21554,15 @@ function readPluginSkillsVersion() {
   }
 }
 function sdkSkillsVersionPath(baseUrl) {
-  const home = process.env.HOME?.trim() || homedir10();
-  return join12(
-    home,
-    ".local",
-    "deepline",
-    baseUrlSlug(baseUrl),
-    "sdk-skills",
-    ".version"
-  );
+  return join12(sdkCliStateDirPath(baseUrl), "skills-version");
 }
-function readLocalSkillsVersion(baseUrl) {
+function legacySdkSkillsVersionPath(baseUrl) {
+  return join12(dirname10(sdkCliStateDirPath(baseUrl)), "sdk-skills", ".version");
+}
+function readSdkSkillsLocalVersion(baseUrl) {
   const pluginVersion = readPluginSkillsVersion();
   if (pluginVersion) return pluginVersion;
-  const path = sdkSkillsVersionPath(baseUrl);
+  const path = existsSync10(sdkSkillsVersionPath(baseUrl)) ? sdkSkillsVersionPath(baseUrl) : legacySdkSkillsVersionPath(baseUrl);
   if (!existsSync10(path)) return "";
   try {
     return readFileSync10(path, "utf-8").trim();
@@ -21642,15 +21772,18 @@ function writeSdkSkillsStatusLine(line) {
   process.stderr.write(`${line}
 `);
 }
-async function syncSdkSkillsIfNeeded(baseUrl) {
+async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
   if (attemptedSync || shouldSkipSkillsSync()) return;
   attemptedSync = true;
   const usingPluginSkills = Boolean(activePluginSkillsDir());
-  const localVersion = readLocalSkillsVersion(baseUrl);
-  const update = await fetchSkillsUpdate(baseUrl, localVersion);
   if (usingPluginSkills) {
     return;
   }
+  const localVersion = readSdkSkillsLocalVersion(baseUrl);
+  const update = options.update === void 0 ? await fetchSkillsUpdate(baseUrl, localVersion) : options.update ? {
+    needsUpdate: options.update.needs_update,
+    remoteVersion: options.update.remote.version
+  } : null;
   if (!update?.needsUpdate || !update.remoteVersion) {
     return;
   }
@@ -21768,7 +21901,7 @@ function inferNpmGlobalPrefixFromEntrypoint(entrypoint) {
 }
 function resolveUpdatePlan(options = {}) {
   const env = options.env ?? process.env;
-  const homeDir2 = options.homeDir ?? homedir11();
+  const homeDir2 = options.homeDir ?? homedir10();
   const entrypoint = options.entrypoint ?? (process.argv[1] ? resolve12(process.argv[1]) : "");
   const sourceRoot = entrypoint ? findRepoBackedSdkRoot(dirname11(entrypoint)) : null;
   if (sourceRoot) {
@@ -21804,7 +21937,7 @@ function autoUpdateFailurePath(plan) {
     return join13(plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
   }
   return join13(
-    homedir11(),
+    homedir10(),
     ".local",
     "deepline",
     "sdk-cli",
@@ -22601,7 +22734,7 @@ function topLevelCommandKnown(program, commandName) {
   );
 }
 async function runPlayRunnerHealthCheck() {
-  const dir = await mkdtemp2(join14(tmpdir3(), "deepline-health-play-"));
+  const dir = await mkdtemp2(join14(tmpdir4(), "deepline-health-play-"));
   const file = join14(dir, "health-check.play.ts");
   try {
     await writeFile5(
@@ -22829,11 +22962,18 @@ Exit codes:
     }
     const baseUrl = autoDetectBaseUrl().replace(/\/$/, "");
     const compatibilityCommand = compatibilityCommandPath(actionCommand) || actionCommand.name();
+    const shouldDeferSkillsSync = shouldDeferSkillsSyncForCommand();
+    const skillsVersion = shouldDeferSkillsSync ? void 0 : readSdkSkillsLocalVersion(baseUrl);
     const compatibility = await traceCliSpan(
       "cli.sdk_compatibility",
-      { baseUrl, command: compatibilityCommand },
+      {
+        baseUrl,
+        command: compatibilityCommand,
+        skillsVersion: skillsVersion ?? null
+      },
       () => checkSdkCompatibility(baseUrl, {
-        command: compatibilityCommand
+        command: compatibilityCommand,
+        skillsVersion
       })
     );
     if (compatibility.error) {
@@ -22859,11 +22999,14 @@ Exit codes:
     if (printStartupPhase) {
       progress?.phase("checking sdk skills");
     }
-    if (!shouldDeferSkillsSyncForCommand()) {
+    if (!shouldDeferSkillsSync) {
+      const skillsUpdate = compatibility.response && Object.prototype.hasOwnProperty.call(compatibility.response, "skills") ? compatibility.response.skills ?? null : void 0;
       await traceCliSpan(
         "cli.sdk_skills_sync",
         { baseUrl },
-        () => syncSdkSkillsIfNeeded(baseUrl)
+        () => syncSdkSkillsIfNeeded(baseUrl, {
+          update: skillsUpdate
+        })
       );
     }
   });