deepline 0.1.218 → 0.1.220

package/dist/bundling-sources/sdk/src/client.ts

@@ -1568,6 +1568,11 @@ export class DeeplineClient {
         ...(integrationMode ? { integrationMode } : {}),
         ...(testPolicyOverrides ? { testPolicyOverrides } : {}),
       },
+      undefined,
+      // A start can reach the server even when its response is lost or times
+      // out. Retrying this mutation without an idempotency key can create a
+      // second root run, so callers must resolve ambiguous failures explicitly.
+      { maxRetries: 0, exactUrlOnly: true },
     );
     return normalizePlayRunStart(response);
   }

package/dist/bundling-sources/sdk/src/compat.ts

@@ -26,7 +26,7 @@ export type SdkCompatibilityResponse = {
   auto_update?: {
     should_auto_update: boolean;
     required: boolean;
-    reason: 'required' | 'patch_lag' | 'rollback_forced' | null;
+    reason: 'required' | 'deprecated' | 'patch_lag' | 'rollback_forced' | null;
     patch_lag: number | null;
     patch_lag_threshold: number;
     update_command: string;

package/dist/bundling-sources/sdk/src/release.ts

@@ -106,12 +106,14 @@ export const SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: '0.1.218',
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: '0.1.220',
   apiContract: '2026-06-dataset-handle-results-hard-cutover',
   supportPolicy: {
-    latest: '0.1.218',
+    latest: '0.1.220',
     minimumSupported: '0.1.53',
-    deprecatedBelow: '0.1.53',
+    deprecatedBelow: '0.1.219',
     commandMinimumSupported: [
       {
         command: 'enrich',

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -57,6 +57,13 @@ const DAYTONA_INFRASTRUCTURE_RETRY_PATTERN =
   /\b(?:Request failed with status code (?:408|429|500|502|503|504)|ECONNRESET|ECONNREFUSED|ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|fetch failed|socket hang up|Daytona sandbox create failed across|Daytona sandbox create did not complete)\b/i;
 
 type DaytonaExecution = { exitCode: number | null; result: string };
+type DaytonaLookupFailure = {
+  errorName: string;
+  errorCode: string | null;
+  httpStatus: number | null;
+  requestId: string | null;
+  detail: string;
+};
 type DaytonaUploadAttemptTiming = {
   attempt: number;
   sandboxId: string;
@@ -98,6 +105,72 @@ export const daytonaSdkClientFactory = {
   },
 };
 
+function stringProperty(value: unknown, key: string): string | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const candidate = (value as Record<string, unknown>)[key];
+  return typeof candidate === 'string' && candidate.trim()
+    ? candidate.trim()
+    : null;
+}
+
+function numberProperty(value: unknown, key: string): number | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const candidate = (value as Record<string, unknown>)[key];
+  return typeof candidate === 'number' && Number.isFinite(candidate)
+    ? candidate
+    : null;
+}
+
+function redactDaytonaErrorDetail(value: string): string {
+  return value
+    .replace(
+      /authorization\s*[=:]\s*bearer\s+[^\s,;]+/gi,
+      'Authorization=Bearer [redacted]',
+    )
+    .replace(
+      /(authorization\s*[=:]\s*)(?!bearer\s+\[redacted\])[^\s,;]+/gi,
+      '$1[redacted]',
+    )
+    .replace(/(bearer\s+)[^\s,;]+/gi, '$1[redacted]')
+    .replace(
+      /((?:api[_-]?key|token)\s*[=:]\s*)[^\s,;]+/gi,
+      '$1[redacted]',
+    )
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 1_000);
+}
+
+/**
+ * Preserve the actionable shape of a Daytona control-plane failure without
+ * copying credentials or an arbitrarily large upstream response into logs.
+ */
+export function describeDaytonaLookupFailure(
+  error: unknown,
+): DaytonaLookupFailure {
+  const record = error && typeof error === 'object' ? error : null;
+  const response = record ? (record as Record<string, unknown>).response : null;
+  const headers =
+    response && typeof response === 'object'
+      ? (response as Record<string, unknown>).headers
+      : null;
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    errorName: error instanceof Error ? error.name || 'Error' : 'NonErrorThrow',
+    errorCode: stringProperty(record, 'code'),
+    httpStatus:
+      numberProperty(record, 'status') ??
+      numberProperty(record, 'statusCode') ??
+      numberProperty(response, 'status'),
+    requestId:
+      stringProperty(record, 'requestId') ??
+      stringProperty(record, 'request_id') ??
+      stringProperty(headers, 'x-request-id') ??
+      stringProperty(headers, 'x-daytona-request-id'),
+    detail: redactDaytonaErrorDetail(message),
+  };
+}
+
 /**
  * Best-effort deletion of an orphaned Daytona sandbox by id (push-execution B4).
  *
@@ -189,16 +262,16 @@ export async function inspectDetachedDaytonaRunner(input: {
         : { stage: 'result_missing', detail: null },
     };
   } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
+    const failure = describeDaytonaLookupFailure(error);
     console.warn('[play-runner.daytona.detached_inspect_failed]', {
       sandboxId: input.sandboxId,
       cmdId: input.cmdId,
-      error: detail,
+      failure,
     });
     return {
       exitCode: null,
       result: null,
-      diagnosis: { stage: 'sandbox_lookup_failed', detail },
+      diagnosis: { stage: 'sandbox_lookup_failed', detail: failure.detail },
     };
   }
 }

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -10,7 +10,7 @@ const PRIVATE_KEY_RE =
 // example `absurd-key-rotation-check`) and need an assignment context before
 // they are sensitive; HIGH_ENTROPY_ASSIGNMENT_RE handles that case below.
 const COMMON_SECRET_RE =
-  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+  /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 const GENERIC_PREFIXED_SECRET_RE =
   /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 const URL_SECRET_VALUE_RE =

package/dist/cli/index.js

@@ -623,12 +623,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.218",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.220",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.218",
+    latest: "0.1.220",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1364,7 +1366,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
@@ -3053,7 +3055,12 @@ var DeeplineClient = class {
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
-      }
+      },
+      void 0,
+      // A start can reach the server even when its response is lost or times
+      // out. Retrying this mutation without an idempotency key can create a
+      // second root run, so callers must resolve ambiguous failures explicitly.
+      { maxRetries: 0, exactUrlOnly: true }
     );
     return normalizePlayRunStart(response);
   }
@@ -28935,7 +28942,7 @@ async function maybeAutoUpdateAndRelaunch(response) {
   if (plan.kind === "source") {
     return false;
   }
-  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
+  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.reason === "deprecated" ? "is deprecated and will update automatically" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
   process.stderr.write(
     `Deepline SDK/CLI ${label}; running ${plan.manualCommand}
 `

package/dist/cli/index.mjs

@@ -608,12 +608,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.218",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.220",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.218",
+    latest: "0.1.220",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1349,7 +1351,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
@@ -3038,7 +3040,12 @@ var DeeplineClient = class {
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
-      }
+      },
+      void 0,
+      // A start can reach the server even when its response is lost or times
+      // out. Retrying this mutation without an idempotency key can create a
+      // second root run, so callers must resolve ambiguous failures explicitly.
+      { maxRetries: 0, exactUrlOnly: true }
     );
     return normalizePlayRunStart(response);
   }
@@ -28992,7 +28999,7 @@ async function maybeAutoUpdateAndRelaunch(response) {
   if (plan.kind === "source") {
     return false;
   }
-  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
+  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.reason === "deprecated" ? "is deprecated and will update automatically" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
   process.stderr.write(
     `Deepline SDK/CLI ${label}; running ${plan.manualCommand}
 `

package/dist/index.js

@@ -422,12 +422,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.218",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.220",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.218",
+    latest: "0.1.220",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1163,7 +1165,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
@@ -2852,7 +2854,12 @@ var DeeplineClient = class {
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
-      }
+      },
+      void 0,
+      // A start can reach the server even when its response is lost or times
+      // out. Retrying this mutation without an idempotency key can create a
+      // second root run, so callers must resolve ambiguous failures explicitly.
+      { maxRetries: 0, exactUrlOnly: true }
     );
     return normalizePlayRunStart(response);
   }

package/dist/index.mjs

@@ -352,12 +352,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.218",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.220",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.218",
+    latest: "0.1.220",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1093,7 +1095,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
@@ -2782,7 +2784,12 @@ var DeeplineClient = class {
         ...request.profile ? { profile: request.profile } : {},
         ...integrationMode ? { integrationMode } : {},
         ...testPolicyOverrides ? { testPolicyOverrides } : {}
-      }
+      },
+      void 0,
+      // A start can reach the server even when its response is lost or times
+      // out. Retrying this mutation without an idempotency key can create a
+      // second root run, so callers must resolve ambiguous failures explicitly.
+      { maxRetries: 0, exactUrlOnly: true }
     );
     return normalizePlayRunStart(response);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.218",
+  "version": "0.1.220",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {