deepline 0.1.147 → 0.1.149

package/dist/bundling-sources/sdk/src/config.ts

@@ -58,6 +58,8 @@ const DEFAULT_TIMEOUT = 60_000;
 const DEFAULT_MAX_RETRIES = 3;
 
 const PROJECT_DEEPLINE_ENV_FILE = '.env.deepline';
+const WORKSPACE_RESTORE_ENV_DIR = '.deepline';
+const WORKSPACE_RESTORE_ENV_FILE = '.env';
 const COWORK_IGNORED_WORKSPACE_DIRS = new Set([
   '.auto-memory',
   '.claude',
@@ -505,6 +507,27 @@ function ensureProjectEnvIsIgnored(dir: string): void {
   writeFileSync(gitignorePath, `${existing}${prefix}${entry}\n`, 'utf-8');
 }
 
+function ensureWorkspaceRestoreEnvIsIgnored(workspaceDir: string): void {
+  const gitignorePath = join(workspaceDir, '.gitignore');
+  const entry = `${WORKSPACE_RESTORE_ENV_DIR}/`;
+  const existing = existsSync(gitignorePath)
+    ? readFileSync(gitignorePath, 'utf-8')
+    : '';
+  const alreadyIgnored = existing
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .some(
+      (line) =>
+        line === entry ||
+        line === `/${entry}` ||
+        line === WORKSPACE_RESTORE_ENV_DIR ||
+        line === `/${WORKSPACE_RESTORE_ENV_DIR}`,
+    );
+  if (alreadyIgnored) return;
+  const prefix = existing && !existing.endsWith('\n') ? '\n' : '';
+  writeFileSync(gitignorePath, `${existing}${prefix}${entry}\n`, 'utf-8');
+}
+
 export function saveProjectDeeplineEnvValues(
   values: EnvValues,
   startDir: string = process.cwd(),
@@ -522,6 +545,32 @@ export function saveProjectDeeplineEnvValues(
   return [filePath];
 }
 
+export function saveCoworkWorkspaceRestoreEnvValues(
+  values: EnvValues,
+  startDir: string = process.cwd(),
+): string[] {
+  if (!isCoworkLikeSandbox()) return [];
+  const target = resolveProjectPinTarget(startDir);
+  if (!target.ok || target.source === 'cwd') return [];
+  const workspaceDir = target.dir;
+  const filePath = join(
+    workspaceDir,
+    WORKSPACE_RESTORE_ENV_DIR,
+    WORKSPACE_RESTORE_ENV_FILE,
+  );
+  const existing = parseEnvFile(filePath);
+  const merged = { ...existing, ...values };
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  ensureWorkspaceRestoreEnvIsIgnored(workspaceDir);
+  const allowedKeys = new Set([HOST_URL_ENV, API_KEY_ENV]);
+  const lines = Object.entries(merged)
+    .filter(([key, value]) => allowedKeys.has(key) && value !== '')
+    .map(([key, value]) => `${key}=${value}`);
+  writeFileSync(filePath, `${lines.join('\n')}\n`, 'utf-8');
+  return [filePath];
+}
+
 export function resolveProjectPinDir(startDir: string = process.cwd()): string {
   const target = resolveProjectPinTarget(startDir);
   if (!target.ok) {

package/dist/bundling-sources/sdk/src/release.ts

@@ -102,10 +102,10 @@ export const SDK_RELEASE = {
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
   // 0.1.111 ships dataset-native tool list getters and result row datasets.
-  version: '0.1.147',
+  version: '0.1.149',
   apiContract: '2026-06-dataset-handle-results-hard-cutover',
   supportPolicy: {
-    latest: '0.1.147',
+    latest: '0.1.149',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.53',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/runtime-pg-driver-neon-serverless.ts

@@ -98,7 +98,6 @@ interface NeonModule {
     query<R = Record<string, unknown>>(
       text: string,
       params?: unknown[],
-      options?: { fullResults?: boolean },
     ): Promise<{ rows: R[] }>;
   };
 }
@@ -186,7 +185,7 @@ export function installNeonServerlessRuntimePoolDriver(): void {
         params?: unknown[],
       ) => {
         const sql = await getSql();
-        return await sql.query<R>(text, params, { fullResults: true });
+        return await sql.query<R>(text, params);
       },
     };
   });

package/dist/cli/index.js

@@ -237,6 +237,8 @@ var PROD_URL = "https://code.deepline.com";
 var DEFAULT_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
 var PROJECT_DEEPLINE_ENV_FILE = ".env.deepline";
+var WORKSPACE_RESTORE_ENV_DIR = ".deepline";
+var WORKSPACE_RESTORE_ENV_FILE = ".env";
 var COWORK_IGNORED_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
   ".auto-memory",
   ".claude",
@@ -551,6 +553,18 @@ function ensureProjectEnvIsIgnored(dir) {
   (0, import_node_fs.writeFileSync)(gitignorePath, `${existing}${prefix}${entry}
 `, "utf-8");
 }
+function ensureWorkspaceRestoreEnvIsIgnored(workspaceDir) {
+  const gitignorePath = (0, import_node_path.join)(workspaceDir, ".gitignore");
+  const entry = `${WORKSPACE_RESTORE_ENV_DIR}/`;
+  const existing = (0, import_node_fs.existsSync)(gitignorePath) ? (0, import_node_fs.readFileSync)(gitignorePath, "utf-8") : "";
+  const alreadyIgnored = existing.split(/\r?\n/).map((line) => line.trim()).some(
+    (line) => line === entry || line === `/${entry}` || line === WORKSPACE_RESTORE_ENV_DIR || line === `/${WORKSPACE_RESTORE_ENV_DIR}`
+  );
+  if (alreadyIgnored) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  (0, import_node_fs.writeFileSync)(gitignorePath, `${existing}${prefix}${entry}
+`, "utf-8");
+}
 function saveProjectDeeplineEnvValues(values, startDir = process.cwd()) {
   const target = resolveProjectPinTarget(startDir);
   if (!target.ok) {
@@ -564,6 +578,27 @@ function saveProjectDeeplineEnvValues(values, startDir = process.cwd()) {
   mergeProjectEnvFile(filePath, values);
   return [filePath];
 }
+function saveCoworkWorkspaceRestoreEnvValues(values, startDir = process.cwd()) {
+  if (!isCoworkLikeSandbox()) return [];
+  const target = resolveProjectPinTarget(startDir);
+  if (!target.ok || target.source === "cwd") return [];
+  const workspaceDir = target.dir;
+  const filePath = (0, import_node_path.join)(
+    workspaceDir,
+    WORKSPACE_RESTORE_ENV_DIR,
+    WORKSPACE_RESTORE_ENV_FILE
+  );
+  const existing = parseEnvFile(filePath);
+  const merged = { ...existing, ...values };
+  const dir = (0, import_node_path.dirname)(filePath);
+  if (!(0, import_node_fs.existsSync)(dir)) (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  ensureWorkspaceRestoreEnvIsIgnored(workspaceDir);
+  const allowedKeys = /* @__PURE__ */ new Set([HOST_URL_ENV, API_KEY_ENV]);
+  const lines = Object.entries(merged).filter(([key, value]) => allowedKeys.has(key) && value !== "").map(([key, value]) => `${key}=${value}`);
+  (0, import_node_fs.writeFileSync)(filePath, `${lines.join("\n")}
+`, "utf-8");
+  return [filePath];
+}
 function resolveProjectPinTarget(startDir = process.cwd()) {
   const nearestFile = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
   if (nearestFile && !isInIgnoredCoworkMount(nearestFile)) {
@@ -620,10 +655,10 @@ var SDK_RELEASE = {
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
   // 0.1.111 ships dataset-native tool list getters and result row datasets.
-  version: "0.1.147",
+  version: "0.1.149",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.147",
+    latest: "0.1.149",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -4693,6 +4728,9 @@ function saveEnvValues(values, baseUrl) {
     ...values[API_KEY_ENV] ? { [API_KEY_ENV]: values[API_KEY_ENV] } : {}
   };
   saveHostEnvValues(baseUrl, filtered);
+  if (filtered[API_KEY_ENV]) {
+    saveCoworkWorkspaceRestoreEnvValues(filtered);
+  }
 }
 async function httpJson(method, url, apiKey, body) {
   const headers = {
@@ -6923,6 +6961,7 @@ Examples:
 var import_node_fs7 = require("fs");
 var import_node_path8 = require("path");
 var CUSTOMER_DB_QUERY_FORMATS = /* @__PURE__ */ new Set(["table", "json", "csv", "markdown"]);
+var CUSTOMER_DB_QUERY_MAX_ROWS = 1e3;
 function parsePositiveInteger(value, flagName) {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
@@ -6930,6 +6969,15 @@ function parsePositiveInteger(value, flagName) {
   }
   return parsed;
 }
+function parseMaxRows(value) {
+  const parsed = parsePositiveInteger(value, "--max-rows");
+  if (parsed > CUSTOMER_DB_QUERY_MAX_ROWS) {
+    throw new Error(
+      `--max-rows must be ${CUSTOMER_DB_QUERY_MAX_ROWS} or less. Add LIMIT/OFFSET to page larger exports.`
+    );
+  }
+  return parsed;
+}
 function formatCell(value) {
   if (value === null || value === void 0) return "";
   const text = typeof value === "object" ? JSON.stringify(value) : String(value);
@@ -7075,7 +7123,7 @@ async function handleDbQuery(args) {
     return 1;
   }
   const maxRowsIndex = args.indexOf("--max-rows");
-  const maxRows = maxRowsIndex >= 0 && args[maxRowsIndex + 1] ? parsePositiveInteger(args[maxRowsIndex + 1], "--max-rows") : void 0;
+  const maxRows = maxRowsIndex >= 0 && args[maxRowsIndex + 1] ? parseMaxRows(args[maxRowsIndex + 1]) : void 0;
   const formatIndex = args.indexOf("--format");
   const format = formatIndex >= 0 ? args[formatIndex + 1]?.trim().toLowerCase() : "";
   if (format && !CUSTOMER_DB_QUERY_FORMATS.has(format)) {
@@ -17029,8 +17077,14 @@ async function writeOutputCsv(outputPath, status, options) {
       rowsInfo
     }).catch(() => null) ?? rowsInfo;
   }
-  assertCompleteRowsForCsvExport(rowsInfo, status, outputPath);
-  const merged = mergeRowsForCsvExport(rowsInfo.rows, options);
+  const allowPartial = options?.allowPartial === true && !rowsInfo.complete && rowsInfo.rows.length > 0 && Boolean(options?.sourceCsvPath);
+  assertCompleteRowsForCsvExport(rowsInfo, status, outputPath, {
+    allowPartial
+  });
+  const merged = mergeRowsForCsvExport(rowsInfo.rows, {
+    ...options,
+    allowPartial
+  });
   const columns = orderEnrichCsvColumns(
     dataExportColumns(merged.rows, [
       ...merged.preferredColumns,
@@ -17050,9 +17104,52 @@ async function writeOutputCsv(outputPath, status, options) {
     enrichedRows: rowsInfo.rows.length,
     rows: merged.rows.length,
     path: (0, import_node_path11.resolve)(outputPath),
+    partial: !rowsInfo.complete,
     enrichedDataRows: rowsInfo.rows
   };
 }
+function isMissingRowsForCsvExportError(error) {
+  return error instanceof Error && (error.message.includes("did not return row-shaped output") || error.message.includes("run returned 0 preview row(s)"));
+}
+async function maybeWriteOutputCsv(input2) {
+  if (!input2.outputPath) return null;
+  try {
+    return await writeOutputCsv(input2.outputPath, input2.status, {
+      client: input2.client,
+      config: input2.config,
+      sourceCsvPath: input2.sourceCsvPath,
+      rows: input2.rows,
+      inPlace: input2.inPlace,
+      allowPartial: input2.capturedResult !== 0
+    });
+  } catch (error) {
+    if (input2.capturedResult !== 0 && isMissingRowsForCsvExportError(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+function enrichOutputJson(exportResult) {
+  if (!exportResult) {
+    return null;
+  }
+  return {
+    sourceCsvRows: exportResult.sourceCsvRows,
+    selectedRows: exportResult.selectedRows,
+    enrichedRows: exportResult.enrichedRows,
+    path: exportResult.path,
+    ...exportResult.partial ? { rows: exportResult.rows, partial: true } : {}
+  };
+}
+async function buildEnrichFailureReport(input2) {
+  return maybeEmitEnrichFailureReport({
+    config: input2.config,
+    rows: input2.rows,
+    rowRange: input2.rowRange,
+    client: input2.client,
+    outputPath: input2.exportResult?.path ?? input2.outputPath ?? null
+  });
+}
 function recordField(value, key) {
   return value && typeof value === "object" && !Array.isArray(value) ? value[key] : void 0;
 }
@@ -17574,10 +17671,7 @@ async function fetchBackingRowsForCsvExport(input2) {
 function mergeRowsForCsvExport(enrichedRows, options) {
   const rows = dataExportRows(normalizeEnrichRowsForCsvExport(enrichedRows));
   const range = options?.rows;
-  if (!options?.inPlace && (range?.rowStart === null || range?.rowStart === void 0)) {
-    return { rows, preferredColumns: [] };
-  }
-  if (!options?.sourceCsvPath) {
+  if (!options?.sourceCsvPath || !options.inPlace && !options.allowPartial && (range?.rowStart === null || range?.rowStart === void 0)) {
     return { rows, preferredColumns: [] };
   }
   const parsedBaseRows = readCsvRows(options.sourceCsvPath);
@@ -17589,7 +17683,7 @@ function mergeRowsForCsvExport(enrichedRows, options) {
   const maxEnd = Math.max(start, baseRows.length - 1);
   const inclusiveEnd = range?.rowEnd === null || range?.rowEnd === void 0 ? maxEnd : Math.min(maxEnd, range.rowEnd);
   const expectedSelectedRows = baseRows.length === 0 ? 0 : Math.max(0, inclusiveEnd - start + 1);
-  if (rows.length < expectedSelectedRows) {
+  if (rows.length < expectedSelectedRows && !options.allowPartial) {
     throw new Error(
       `Refusing to write a partial in-place CSV export: the run returned ${rows.length} row(s) for ${expectedSelectedRows} selected source row(s).`
     );
@@ -17788,10 +17882,13 @@ function mergeLegacyMetadataCell(base, enriched) {
   }
   return void 0;
 }
-function assertCompleteRowsForCsvExport(rowsInfo, status, outputPath) {
+function assertCompleteRowsForCsvExport(rowsInfo, status, outputPath, options = {}) {
   if (rowsInfo.complete) {
     return;
   }
+  if (options.allowPartial) {
+    return;
+  }
   const runId = status && typeof status === "object" && !Array.isArray(status) && typeof status.runId === "string" ? status.runId : null;
   const dataset = rowsInfo.source ?? "result.rows";
   const retry = runId ? ` Retry after the run finalizes its backing dataset with: deepline runs export ${runId} --dataset ${dataset} --out ${outputPath}` : "";
@@ -17947,13 +18044,16 @@ function registerEnrichCommand(program) {
           stdout: captured2.stdout,
           exitCode: captured2.result
         });
-        const exportResult2 = captured2.result === 0 && outputPath ? await writeOutputCsv(outputPath, status2, {
+        const exportResult2 = await maybeWriteOutputCsv({
+          outputPath,
+          status: status2,
+          capturedResult: captured2.result,
           client: client2,
           config,
           sourceCsvPath: input2.sourceCsvPath,
           rows: input2.rows,
           inPlace: Boolean(options.inPlace)
-        }) : null;
+        });
         return { captured: captured2, status: status2, exportResult: exportResult2 };
       };
       const selectedRange = selectedSourceCsvRange(sourceCsvPath, rows);
@@ -18003,9 +18103,16 @@ function registerEnrichCommand(program) {
                   chunks: chunkCount,
                   rows: chunkRows
                 },
-                result: chunk.status
+                result: chunk.status,
+                output: enrichOutputJson(chunk.exportResult)
               });
             } else {
+              if (chunk.exportResult) {
+                process.stderr.write(
+                  `Wrote ${chunk.exportResult.rows} row(s) to ${chunk.exportResult.path}${chunk.exportResult.partial ? " (partial run output)" : ""}
+`
+                );
+              }
               emitPlainBatchRunFailure({
                 chunkIndex,
                 chunkCount,
@@ -18082,23 +18189,46 @@ function registerEnrichCommand(program) {
         json: Boolean(options.json),
         passthroughStdout: !options.json
       });
+      const rowsForFailureReport = exportResult?.enrichedDataRows ?? extractCanonicalRowsInfo(status)?.rows ?? [];
       if (captured.result !== 0) {
+        if (exportResult) {
+          process.stderr.write(
+            `Wrote ${exportResult.rows} row(s) to ${exportResult.path}${exportResult.partial ? " (partial run output)" : ""}
+`
+          );
+        }
+        const failureReport2 = await buildEnrichFailureReport({
+          config,
+          rows: rowsForFailureReport,
+          rowRange: rows,
+          client: client2,
+          exportResult,
+          outputPath
+        });
         if (options.json) {
           printJson({
-            result: status
+            ok: false,
+            run: status,
+            output: enrichOutputJson(exportResult),
+            ...failureReport2 ? {
+              failure_report: {
+                path: failureReport2.path,
+                jobs: failureReport2.jobs.length
+              }
+            } : {}
           });
         }
-        process.exitCode = captured.result;
+        process.exitCode = failureReport2 ? EXIT_SERVER2 : captured.result;
         return;
       }
-      const rowsForFailureReport = exportResult?.enrichedDataRows ?? extractCanonicalRowsInfo(status)?.rows ?? [];
       if (options.json) {
-        const failureReport2 = await maybeEmitEnrichFailureReport({
+        const failureReport2 = await buildEnrichFailureReport({
           config,
           rows: rowsForFailureReport,
           rowRange: rows,
           client: client2,
-          outputPath: exportResult?.path ?? outputPath ?? null
+          exportResult,
+          outputPath
         });
         const run = rewriteEnrichJsonStatus({
           status,
@@ -18110,12 +18240,7 @@ function registerEnrichCommand(program) {
         printJson({
           ok: !failureReport2,
           run,
-          output: exportResult ? {
-            sourceCsvRows: exportResult.sourceCsvRows,
-            selectedRows: exportResult.selectedRows,
-            enrichedRows: exportResult.enrichedRows,
-            path: exportResult.path
-          } : null,
+          output: enrichOutputJson(exportResult),
           ...failureReport2 ? {
             failure_report: {
               path: failureReport2.path,
@@ -19469,16 +19594,17 @@ async function handleOrgSwitch(selection, options) {
   const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
   if (target.is_current) {
     let project_env_paths2 = [];
+    const authValues2 = {
+      [HOST_URL_ENV]: config.baseUrl,
+      [API_KEY_ENV]: config.apiKey
+    };
     if (authTarget.kind === "folder") {
-      project_env_paths2 = saveProjectDeeplineEnvValues({
-        DEEPLINE_HOST_URL: config.baseUrl,
-        DEEPLINE_API_KEY: config.apiKey
-      });
+      project_env_paths2 = saveProjectDeeplineEnvValues(authValues2);
     } else {
-      saveHostEnvValues(config.baseUrl, {
-        DEEPLINE_HOST_URL: config.baseUrl,
-        DEEPLINE_API_KEY: config.apiKey
-      });
+      saveHostEnvValues(config.baseUrl, authValues2);
+    }
+    if (authTarget.kind === "folder") {
+      saveCoworkWorkspaceRestoreEnvValues(authValues2);
     }
     const renderLines2 = [`Already on ${target.name}.`];
     for (const projectPath of project_env_paths2) {
@@ -19527,19 +19653,22 @@ async function handleOrgSwitch(selection, options) {
     org_id: target.org_id
   });
   let project_env_paths = [];
+  const authValues = {
+    [HOST_URL_ENV]: config.baseUrl,
+    [API_KEY_ENV]: switched.api_key
+  };
   if (authTarget.kind === "folder") {
-    project_env_paths = saveProjectDeeplineEnvValues({
-      DEEPLINE_HOST_URL: config.baseUrl,
-      DEEPLINE_API_KEY: switched.api_key
-    });
+    project_env_paths = saveProjectDeeplineEnvValues(authValues);
   } else {
     saveHostEnvValues(config.baseUrl, {
-      DEEPLINE_HOST_URL: config.baseUrl,
-      DEEPLINE_API_KEY: switched.api_key,
+      ...authValues,
       DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
       DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
     });
   }
+  if (authTarget.kind === "folder") {
+    saveCoworkWorkspaceRestoreEnvValues(authValues);
+  }
   const { api_key: _apiKey, ...publicSwitched } = switched;
   const renderLines = [`Switched to ${switched.org_name}.`];
   if (authTarget.kind === "folder") {
@@ -19595,12 +19724,16 @@ async function handleOrgCreate(name, options) {
     api_key: config.apiKey,
     name
   });
+  const authValues = {
+    [HOST_URL_ENV]: config.baseUrl,
+    [API_KEY_ENV]: created.api_key
+  };
   saveHostEnvValues(config.baseUrl, {
-    DEEPLINE_HOST_URL: config.baseUrl,
-    DEEPLINE_API_KEY: created.api_key,
+    ...authValues,
     DEEPLINE_ACTIVE_ORG_ID: created.org_id,
     DEEPLINE_ACTIVE_ORG_NAME: created.org_name
   });
+  saveCoworkWorkspaceRestoreEnvValues(authValues);
   const { api_key: _apiKey, ...publicCreated } = created;
   printCommandEnvelope(
     {
@@ -23314,7 +23447,7 @@ async function runAutomaticUpdatePlan(plan) {
       previousFailure
     };
   }
-  const exitCode = await runUpdatePlan(plan);
+  const exitCode = await runUpdatePlan(plan, { stdio: "stderr" });
   return exitCode === 0 ? { status: "updated", exitCode: 0 } : { status: "failed", exitCode };
 }
 function safeVersionSegment(value) {
@@ -23345,13 +23478,21 @@ function installedPackageVersion(versionDir) {
     return "";
   }
 }
-function runCommand(command, args, env = process.env) {
+function runCommand(command, args, env = process.env, options = {}) {
   return new Promise((resolveExitCode) => {
     const child = (0, import_node_child_process3.spawn)(command, args, {
-      stdio: "inherit",
+      stdio: options.stdio === "stderr" ? ["inherit", "pipe", "pipe"] : "inherit",
       shell: process.platform === "win32",
       env
     });
+    if (options.stdio === "stderr") {
+      child.stdout?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+      });
+    }
     child.on("error", (error) => {
       process.stderr.write(`Failed to start ${command}: ${error.message}
 `);
@@ -23389,7 +23530,7 @@ function writeSidecarLauncher(input2) {
     { encoding: "utf8", mode: 493 }
   );
 }
-async function runPythonSidecarUpdatePlan(plan) {
+async function runPythonSidecarUpdatePlan(plan, options = {}) {
   const versionsDir = (0, import_node_path18.join)(plan.stateDir, "versions");
   const tempDir = (0, import_node_path18.join)(
     versionsDir,
@@ -23411,7 +23552,8 @@ async function runPythonSidecarUpdatePlan(plan) {
       ...NPM_SDK_INSTALL_COMMON_FLAGS,
       plan.packageSpec
     ],
-    env
+    env,
+    options
   );
   if (installExitCode !== 0) {
     (0, import_node_fs15.rmSync)(tempDir, { recursive: true, force: true });
@@ -23484,12 +23626,12 @@ async function runPythonSidecarUpdatePlan(plan) {
   );
   return 0;
 }
-async function runUpdatePlan(plan) {
+async function runUpdatePlan(plan, options = {}) {
   let exitCode = 1;
   if (plan.kind === "npm-global") {
-    exitCode = await runCommand(plan.command, plan.args);
+    exitCode = await runCommand(plan.command, plan.args, process.env, options);
   } else if (plan.kind === "python-sidecar") {
-    exitCode = await runPythonSidecarUpdatePlan(plan);
+    exitCode = await runPythonSidecarUpdatePlan(plan, options);
   }
   if (exitCode === 0) {
     clearAutoUpdateFailure(plan);
@@ -23677,6 +23819,40 @@ function isCi() {
 function shouldSkipSelfUpdate() {
   return envTruthy("DEEPLINE_SKIP_SELF_UPDATE") || envTruthy("DEEPLINE_NO_AUTO_UPDATE") || envTruthy("DEEPLINE_SKIP_SDK_AUTO_UPDATE") || envTruthy("DEEPLINE_DISABLE_AUTO_UPDATE") || isCi();
 }
+function parseSemver(version) {
+  const trimmed = version?.trim();
+  if (!trimmed) return null;
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(
+    trimmed
+  );
+  if (!match) return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ?? ""
+  };
+}
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) {
+    return left.localeCompare(right);
+  }
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] !== b[key]) return a[key] > b[key] ? 1 : -1;
+  }
+  if (a.prerelease === b.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b.prerelease) return -1;
+  return a.prerelease.localeCompare(b.prerelease);
+}
+function isDowngradeAutoUpdateResponse(response) {
+  const target = response?.latest?.trim();
+  const current = response?.current?.trim() || SDK_VERSION;
+  if (!target) return false;
+  return compareSemver(target, current) < 0;
+}
 function relaunchCurrentCommand(plan) {
   return new Promise((resolve13) => {
     const command = plan.kind === "python-sidecar" ? plan.sidecarPath : process.execPath;
@@ -23704,6 +23880,15 @@ async function maybeAutoUpdateAndRelaunch(response) {
   if (!response || !autoUpdate?.should_auto_update || shouldSkipSelfUpdate()) {
     return false;
   }
+  if (isDowngradeAutoUpdateResponse(response)) {
+    const target = response.latest;
+    const current = response.current?.trim() || SDK_VERSION;
+    process.stderr.write(
+      `Deepline SDK/CLI auto-update refused: server advertised older ${target} than current ${current}. Continuing without mutating the CLI.
+`
+    );
+    return false;
+  }
   const packageSpec = response.latest ? `deepline@${response.latest}` : void 0;
   const plan = resolveUpdatePlan({ packageSpec });
   if (plan.kind === "source") {

package/dist/cli/index.mjs

@@ -222,6 +222,8 @@ var PROD_URL = "https://code.deepline.com";
 var DEFAULT_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
 var PROJECT_DEEPLINE_ENV_FILE = ".env.deepline";
+var WORKSPACE_RESTORE_ENV_DIR = ".deepline";
+var WORKSPACE_RESTORE_ENV_FILE = ".env";
 var COWORK_IGNORED_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
   ".auto-memory",
   ".claude",
@@ -536,6 +538,18 @@ function ensureProjectEnvIsIgnored(dir) {
   writeFileSync(gitignorePath, `${existing}${prefix}${entry}
 `, "utf-8");
 }
+function ensureWorkspaceRestoreEnvIsIgnored(workspaceDir) {
+  const gitignorePath = join(workspaceDir, ".gitignore");
+  const entry = `${WORKSPACE_RESTORE_ENV_DIR}/`;
+  const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
+  const alreadyIgnored = existing.split(/\r?\n/).map((line) => line.trim()).some(
+    (line) => line === entry || line === `/${entry}` || line === WORKSPACE_RESTORE_ENV_DIR || line === `/${WORKSPACE_RESTORE_ENV_DIR}`
+  );
+  if (alreadyIgnored) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  writeFileSync(gitignorePath, `${existing}${prefix}${entry}
+`, "utf-8");
+}
 function saveProjectDeeplineEnvValues(values, startDir = process.cwd()) {
   const target = resolveProjectPinTarget(startDir);
   if (!target.ok) {
@@ -549,6 +563,27 @@ function saveProjectDeeplineEnvValues(values, startDir = process.cwd()) {
   mergeProjectEnvFile(filePath, values);
   return [filePath];
 }
+function saveCoworkWorkspaceRestoreEnvValues(values, startDir = process.cwd()) {
+  if (!isCoworkLikeSandbox()) return [];
+  const target = resolveProjectPinTarget(startDir);
+  if (!target.ok || target.source === "cwd") return [];
+  const workspaceDir = target.dir;
+  const filePath = join(
+    workspaceDir,
+    WORKSPACE_RESTORE_ENV_DIR,
+    WORKSPACE_RESTORE_ENV_FILE
+  );
+  const existing = parseEnvFile(filePath);
+  const merged = { ...existing, ...values };
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  ensureWorkspaceRestoreEnvIsIgnored(workspaceDir);
+  const allowedKeys = /* @__PURE__ */ new Set([HOST_URL_ENV, API_KEY_ENV]);
+  const lines = Object.entries(merged).filter(([key, value]) => allowedKeys.has(key) && value !== "").map(([key, value]) => `${key}=${value}`);
+  writeFileSync(filePath, `${lines.join("\n")}
+`, "utf-8");
+  return [filePath];
+}
 function resolveProjectPinTarget(startDir = process.cwd()) {
   const nearestFile = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
   if (nearestFile && !isInIgnoredCoworkMount(nearestFile)) {
@@ -605,10 +640,10 @@ var SDK_RELEASE = {
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
   // 0.1.111 ships dataset-native tool list getters and result row datasets.
-  version: "0.1.147",
+  version: "0.1.149",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.147",
+    latest: "0.1.149",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -4690,6 +4725,9 @@ function saveEnvValues(values, baseUrl) {
     ...values[API_KEY_ENV] ? { [API_KEY_ENV]: values[API_KEY_ENV] } : {}
   };
   saveHostEnvValues(baseUrl, filtered);
+  if (filtered[API_KEY_ENV]) {
+    saveCoworkWorkspaceRestoreEnvValues(filtered);
+  }
 }
 async function httpJson(method, url, apiKey, body) {
   const headers = {
@@ -6920,6 +6958,7 @@ Examples:
 import { writeFileSync as writeFileSync6 } from "fs";
 import { resolve as resolve5 } from "path";
 var CUSTOMER_DB_QUERY_FORMATS = /* @__PURE__ */ new Set(["table", "json", "csv", "markdown"]);
+var CUSTOMER_DB_QUERY_MAX_ROWS = 1e3;
 function parsePositiveInteger(value, flagName) {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
@@ -6927,6 +6966,15 @@ function parsePositiveInteger(value, flagName) {
   }
   return parsed;
 }
+function parseMaxRows(value) {
+  const parsed = parsePositiveInteger(value, "--max-rows");
+  if (parsed > CUSTOMER_DB_QUERY_MAX_ROWS) {
+    throw new Error(
+      `--max-rows must be ${CUSTOMER_DB_QUERY_MAX_ROWS} or less. Add LIMIT/OFFSET to page larger exports.`
+    );
+  }
+  return parsed;
+}
 function formatCell(value) {
   if (value === null || value === void 0) return "";
   const text = typeof value === "object" ? JSON.stringify(value) : String(value);
@@ -7072,7 +7120,7 @@ async function handleDbQuery(args) {
     return 1;
   }
   const maxRowsIndex = args.indexOf("--max-rows");
-  const maxRows = maxRowsIndex >= 0 && args[maxRowsIndex + 1] ? parsePositiveInteger(args[maxRowsIndex + 1], "--max-rows") : void 0;
+  const maxRows = maxRowsIndex >= 0 && args[maxRowsIndex + 1] ? parseMaxRows(args[maxRowsIndex + 1]) : void 0;
   const formatIndex = args.indexOf("--format");
   const format = formatIndex >= 0 ? args[formatIndex + 1]?.trim().toLowerCase() : "";
   if (format && !CUSTOMER_DB_QUERY_FORMATS.has(format)) {
@@ -17046,8 +17094,14 @@ async function writeOutputCsv(outputPath, status, options) {
       rowsInfo
     }).catch(() => null) ?? rowsInfo;
   }
-  assertCompleteRowsForCsvExport(rowsInfo, status, outputPath);
-  const merged = mergeRowsForCsvExport(rowsInfo.rows, options);
+  const allowPartial = options?.allowPartial === true && !rowsInfo.complete && rowsInfo.rows.length > 0 && Boolean(options?.sourceCsvPath);
+  assertCompleteRowsForCsvExport(rowsInfo, status, outputPath, {
+    allowPartial
+  });
+  const merged = mergeRowsForCsvExport(rowsInfo.rows, {
+    ...options,
+    allowPartial
+  });
   const columns = orderEnrichCsvColumns(
     dataExportColumns(merged.rows, [
       ...merged.preferredColumns,
@@ -17067,9 +17121,52 @@ async function writeOutputCsv(outputPath, status, options) {
     enrichedRows: rowsInfo.rows.length,
     rows: merged.rows.length,
     path: resolve8(outputPath),
+    partial: !rowsInfo.complete,
     enrichedDataRows: rowsInfo.rows
   };
 }
+function isMissingRowsForCsvExportError(error) {
+  return error instanceof Error && (error.message.includes("did not return row-shaped output") || error.message.includes("run returned 0 preview row(s)"));
+}
+async function maybeWriteOutputCsv(input2) {
+  if (!input2.outputPath) return null;
+  try {
+    return await writeOutputCsv(input2.outputPath, input2.status, {
+      client: input2.client,
+      config: input2.config,
+      sourceCsvPath: input2.sourceCsvPath,
+      rows: input2.rows,
+      inPlace: input2.inPlace,
+      allowPartial: input2.capturedResult !== 0
+    });
+  } catch (error) {
+    if (input2.capturedResult !== 0 && isMissingRowsForCsvExportError(error)) {
+      return null;
+    }
+    throw error;
+  }
+}
+function enrichOutputJson(exportResult) {
+  if (!exportResult) {
+    return null;
+  }
+  return {
+    sourceCsvRows: exportResult.sourceCsvRows,
+    selectedRows: exportResult.selectedRows,
+    enrichedRows: exportResult.enrichedRows,
+    path: exportResult.path,
+    ...exportResult.partial ? { rows: exportResult.rows, partial: true } : {}
+  };
+}
+async function buildEnrichFailureReport(input2) {
+  return maybeEmitEnrichFailureReport({
+    config: input2.config,
+    rows: input2.rows,
+    rowRange: input2.rowRange,
+    client: input2.client,
+    outputPath: input2.exportResult?.path ?? input2.outputPath ?? null
+  });
+}
 function recordField(value, key) {
   return value && typeof value === "object" && !Array.isArray(value) ? value[key] : void 0;
 }
@@ -17591,10 +17688,7 @@ async function fetchBackingRowsForCsvExport(input2) {
 function mergeRowsForCsvExport(enrichedRows, options) {
   const rows = dataExportRows(normalizeEnrichRowsForCsvExport(enrichedRows));
   const range = options?.rows;
-  if (!options?.inPlace && (range?.rowStart === null || range?.rowStart === void 0)) {
-    return { rows, preferredColumns: [] };
-  }
-  if (!options?.sourceCsvPath) {
+  if (!options?.sourceCsvPath || !options.inPlace && !options.allowPartial && (range?.rowStart === null || range?.rowStart === void 0)) {
     return { rows, preferredColumns: [] };
   }
   const parsedBaseRows = readCsvRows(options.sourceCsvPath);
@@ -17606,7 +17700,7 @@ function mergeRowsForCsvExport(enrichedRows, options) {
   const maxEnd = Math.max(start, baseRows.length - 1);
   const inclusiveEnd = range?.rowEnd === null || range?.rowEnd === void 0 ? maxEnd : Math.min(maxEnd, range.rowEnd);
   const expectedSelectedRows = baseRows.length === 0 ? 0 : Math.max(0, inclusiveEnd - start + 1);
-  if (rows.length < expectedSelectedRows) {
+  if (rows.length < expectedSelectedRows && !options.allowPartial) {
     throw new Error(
       `Refusing to write a partial in-place CSV export: the run returned ${rows.length} row(s) for ${expectedSelectedRows} selected source row(s).`
     );
@@ -17805,10 +17899,13 @@ function mergeLegacyMetadataCell(base, enriched) {
   }
   return void 0;
 }
-function assertCompleteRowsForCsvExport(rowsInfo, status, outputPath) {
+function assertCompleteRowsForCsvExport(rowsInfo, status, outputPath, options = {}) {
   if (rowsInfo.complete) {
     return;
   }
+  if (options.allowPartial) {
+    return;
+  }
   const runId = status && typeof status === "object" && !Array.isArray(status) && typeof status.runId === "string" ? status.runId : null;
   const dataset = rowsInfo.source ?? "result.rows";
   const retry = runId ? ` Retry after the run finalizes its backing dataset with: deepline runs export ${runId} --dataset ${dataset} --out ${outputPath}` : "";
@@ -17964,13 +18061,16 @@ function registerEnrichCommand(program) {
           stdout: captured2.stdout,
           exitCode: captured2.result
         });
-        const exportResult2 = captured2.result === 0 && outputPath ? await writeOutputCsv(outputPath, status2, {
+        const exportResult2 = await maybeWriteOutputCsv({
+          outputPath,
+          status: status2,
+          capturedResult: captured2.result,
           client: client2,
           config,
           sourceCsvPath: input2.sourceCsvPath,
           rows: input2.rows,
           inPlace: Boolean(options.inPlace)
-        }) : null;
+        });
         return { captured: captured2, status: status2, exportResult: exportResult2 };
       };
       const selectedRange = selectedSourceCsvRange(sourceCsvPath, rows);
@@ -18020,9 +18120,16 @@ function registerEnrichCommand(program) {
                   chunks: chunkCount,
                   rows: chunkRows
                 },
-                result: chunk.status
+                result: chunk.status,
+                output: enrichOutputJson(chunk.exportResult)
               });
             } else {
+              if (chunk.exportResult) {
+                process.stderr.write(
+                  `Wrote ${chunk.exportResult.rows} row(s) to ${chunk.exportResult.path}${chunk.exportResult.partial ? " (partial run output)" : ""}
+`
+                );
+              }
               emitPlainBatchRunFailure({
                 chunkIndex,
                 chunkCount,
@@ -18099,23 +18206,46 @@ function registerEnrichCommand(program) {
         json: Boolean(options.json),
         passthroughStdout: !options.json
       });
+      const rowsForFailureReport = exportResult?.enrichedDataRows ?? extractCanonicalRowsInfo(status)?.rows ?? [];
       if (captured.result !== 0) {
+        if (exportResult) {
+          process.stderr.write(
+            `Wrote ${exportResult.rows} row(s) to ${exportResult.path}${exportResult.partial ? " (partial run output)" : ""}
+`
+          );
+        }
+        const failureReport2 = await buildEnrichFailureReport({
+          config,
+          rows: rowsForFailureReport,
+          rowRange: rows,
+          client: client2,
+          exportResult,
+          outputPath
+        });
         if (options.json) {
           printJson({
-            result: status
+            ok: false,
+            run: status,
+            output: enrichOutputJson(exportResult),
+            ...failureReport2 ? {
+              failure_report: {
+                path: failureReport2.path,
+                jobs: failureReport2.jobs.length
+              }
+            } : {}
           });
         }
-        process.exitCode = captured.result;
+        process.exitCode = failureReport2 ? EXIT_SERVER2 : captured.result;
         return;
       }
-      const rowsForFailureReport = exportResult?.enrichedDataRows ?? extractCanonicalRowsInfo(status)?.rows ?? [];
       if (options.json) {
-        const failureReport2 = await maybeEmitEnrichFailureReport({
+        const failureReport2 = await buildEnrichFailureReport({
           config,
           rows: rowsForFailureReport,
           rowRange: rows,
           client: client2,
-          outputPath: exportResult?.path ?? outputPath ?? null
+          exportResult,
+          outputPath
         });
         const run = rewriteEnrichJsonStatus({
           status,
@@ -18127,12 +18257,7 @@ function registerEnrichCommand(program) {
         printJson({
           ok: !failureReport2,
           run,
-          output: exportResult ? {
-            sourceCsvRows: exportResult.sourceCsvRows,
-            selectedRows: exportResult.selectedRows,
-            enrichedRows: exportResult.enrichedRows,
-            path: exportResult.path
-          } : null,
+          output: enrichOutputJson(exportResult),
           ...failureReport2 ? {
             failure_report: {
               path: failureReport2.path,
@@ -19493,16 +19618,17 @@ async function handleOrgSwitch(selection, options) {
   const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
   if (target.is_current) {
     let project_env_paths2 = [];
+    const authValues2 = {
+      [HOST_URL_ENV]: config.baseUrl,
+      [API_KEY_ENV]: config.apiKey
+    };
     if (authTarget.kind === "folder") {
-      project_env_paths2 = saveProjectDeeplineEnvValues({
-        DEEPLINE_HOST_URL: config.baseUrl,
-        DEEPLINE_API_KEY: config.apiKey
-      });
+      project_env_paths2 = saveProjectDeeplineEnvValues(authValues2);
     } else {
-      saveHostEnvValues(config.baseUrl, {
-        DEEPLINE_HOST_URL: config.baseUrl,
-        DEEPLINE_API_KEY: config.apiKey
-      });
+      saveHostEnvValues(config.baseUrl, authValues2);
+    }
+    if (authTarget.kind === "folder") {
+      saveCoworkWorkspaceRestoreEnvValues(authValues2);
     }
     const renderLines2 = [`Already on ${target.name}.`];
     for (const projectPath of project_env_paths2) {
@@ -19551,19 +19677,22 @@ async function handleOrgSwitch(selection, options) {
     org_id: target.org_id
   });
   let project_env_paths = [];
+  const authValues = {
+    [HOST_URL_ENV]: config.baseUrl,
+    [API_KEY_ENV]: switched.api_key
+  };
   if (authTarget.kind === "folder") {
-    project_env_paths = saveProjectDeeplineEnvValues({
-      DEEPLINE_HOST_URL: config.baseUrl,
-      DEEPLINE_API_KEY: switched.api_key
-    });
+    project_env_paths = saveProjectDeeplineEnvValues(authValues);
   } else {
     saveHostEnvValues(config.baseUrl, {
-      DEEPLINE_HOST_URL: config.baseUrl,
-      DEEPLINE_API_KEY: switched.api_key,
+      ...authValues,
       DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
       DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
     });
   }
+  if (authTarget.kind === "folder") {
+    saveCoworkWorkspaceRestoreEnvValues(authValues);
+  }
   const { api_key: _apiKey, ...publicSwitched } = switched;
   const renderLines = [`Switched to ${switched.org_name}.`];
   if (authTarget.kind === "folder") {
@@ -19619,12 +19748,16 @@ async function handleOrgCreate(name, options) {
     api_key: config.apiKey,
     name
   });
+  const authValues = {
+    [HOST_URL_ENV]: config.baseUrl,
+    [API_KEY_ENV]: created.api_key
+  };
   saveHostEnvValues(config.baseUrl, {
-    DEEPLINE_HOST_URL: config.baseUrl,
-    DEEPLINE_API_KEY: created.api_key,
+    ...authValues,
     DEEPLINE_ACTIVE_ORG_ID: created.org_id,
     DEEPLINE_ACTIVE_ORG_NAME: created.org_name
   });
+  saveCoworkWorkspaceRestoreEnvValues(authValues);
   const { api_key: _apiKey, ...publicCreated } = created;
   printCommandEnvelope(
     {
@@ -23353,7 +23486,7 @@ async function runAutomaticUpdatePlan(plan) {
       previousFailure
     };
   }
-  const exitCode = await runUpdatePlan(plan);
+  const exitCode = await runUpdatePlan(plan, { stdio: "stderr" });
   return exitCode === 0 ? { status: "updated", exitCode: 0 } : { status: "failed", exitCode };
 }
 function safeVersionSegment(value) {
@@ -23384,13 +23517,21 @@ function installedPackageVersion(versionDir) {
     return "";
   }
 }
-function runCommand(command, args, env = process.env) {
+function runCommand(command, args, env = process.env, options = {}) {
   return new Promise((resolveExitCode) => {
     const child = spawn3(command, args, {
-      stdio: "inherit",
+      stdio: options.stdio === "stderr" ? ["inherit", "pipe", "pipe"] : "inherit",
       shell: process.platform === "win32",
       env
     });
+    if (options.stdio === "stderr") {
+      child.stdout?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+      });
+    }
     child.on("error", (error) => {
       process.stderr.write(`Failed to start ${command}: ${error.message}
 `);
@@ -23428,7 +23569,7 @@ function writeSidecarLauncher(input2) {
     { encoding: "utf8", mode: 493 }
   );
 }
-async function runPythonSidecarUpdatePlan(plan) {
+async function runPythonSidecarUpdatePlan(plan, options = {}) {
   const versionsDir = join13(plan.stateDir, "versions");
   const tempDir = join13(
     versionsDir,
@@ -23450,7 +23591,8 @@ async function runPythonSidecarUpdatePlan(plan) {
       ...NPM_SDK_INSTALL_COMMON_FLAGS,
       plan.packageSpec
     ],
-    env
+    env,
+    options
   );
   if (installExitCode !== 0) {
     rmSync3(tempDir, { recursive: true, force: true });
@@ -23523,12 +23665,12 @@ async function runPythonSidecarUpdatePlan(plan) {
   );
   return 0;
 }
-async function runUpdatePlan(plan) {
+async function runUpdatePlan(plan, options = {}) {
   let exitCode = 1;
   if (plan.kind === "npm-global") {
-    exitCode = await runCommand(plan.command, plan.args);
+    exitCode = await runCommand(plan.command, plan.args, process.env, options);
   } else if (plan.kind === "python-sidecar") {
-    exitCode = await runPythonSidecarUpdatePlan(plan);
+    exitCode = await runPythonSidecarUpdatePlan(plan, options);
   }
   if (exitCode === 0) {
     clearAutoUpdateFailure(plan);
@@ -23716,6 +23858,40 @@ function isCi() {
 function shouldSkipSelfUpdate() {
   return envTruthy("DEEPLINE_SKIP_SELF_UPDATE") || envTruthy("DEEPLINE_NO_AUTO_UPDATE") || envTruthy("DEEPLINE_SKIP_SDK_AUTO_UPDATE") || envTruthy("DEEPLINE_DISABLE_AUTO_UPDATE") || isCi();
 }
+function parseSemver(version) {
+  const trimmed = version?.trim();
+  if (!trimmed) return null;
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(
+    trimmed
+  );
+  if (!match) return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ?? ""
+  };
+}
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) {
+    return left.localeCompare(right);
+  }
+  for (const key of ["major", "minor", "patch"]) {
+    if (a[key] !== b[key]) return a[key] > b[key] ? 1 : -1;
+  }
+  if (a.prerelease === b.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b.prerelease) return -1;
+  return a.prerelease.localeCompare(b.prerelease);
+}
+function isDowngradeAutoUpdateResponse(response) {
+  const target = response?.latest?.trim();
+  const current = response?.current?.trim() || SDK_VERSION;
+  if (!target) return false;
+  return compareSemver(target, current) < 0;
+}
 function relaunchCurrentCommand(plan) {
   return new Promise((resolve13) => {
     const command = plan.kind === "python-sidecar" ? plan.sidecarPath : process.execPath;
@@ -23743,6 +23919,15 @@ async function maybeAutoUpdateAndRelaunch(response) {
   if (!response || !autoUpdate?.should_auto_update || shouldSkipSelfUpdate()) {
     return false;
   }
+  if (isDowngradeAutoUpdateResponse(response)) {
+    const target = response.latest;
+    const current = response.current?.trim() || SDK_VERSION;
+    process.stderr.write(
+      `Deepline SDK/CLI auto-update refused: server advertised older ${target} than current ${current}. Continuing without mutating the CLI.
+`
+    );
+    return false;
+  }
   const packageSpec = response.latest ? `deepline@${response.latest}` : void 0;
   const plan = resolveUpdatePlan({ packageSpec });
   if (plan.kind === "source") {

package/dist/index.js

@@ -419,10 +419,10 @@ var SDK_RELEASE = {
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
   // 0.1.111 ships dataset-native tool list getters and result row datasets.
-  version: "0.1.147",
+  version: "0.1.149",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.147",
+    latest: "0.1.149",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -349,10 +349,10 @@ var SDK_RELEASE = {
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
   // 0.1.111 ships dataset-native tool list getters and result row datasets.
-  version: "0.1.147",
+  version: "0.1.149",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.147",
+    latest: "0.1.149",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.147",
+  "version": "0.1.149",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {