deepline 0.1.219 → 0.1.221

package/dist/bundling-sources/sdk/src/compat.ts

@@ -26,7 +26,7 @@ export type SdkCompatibilityResponse = {
   auto_update?: {
     should_auto_update: boolean;
     required: boolean;
-    reason: 'required' | 'patch_lag' | 'rollback_forced' | null;
+    reason: 'required' | 'deprecated' | 'patch_lag' | 'rollback_forced' | null;
     patch_lag: number | null;
     patch_lag_threshold: number;
     update_command: string;

package/dist/bundling-sources/sdk/src/release.ts

@@ -106,12 +106,14 @@ export const SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: '0.1.219',
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: '0.1.221',
   apiContract: '2026-06-dataset-handle-results-hard-cutover',
   supportPolicy: {
-    latest: '0.1.219',
+    latest: '0.1.221',
     minimumSupported: '0.1.53',
-    deprecatedBelow: '0.1.53',
+    deprecatedBelow: '0.1.219',
     commandMinimumSupported: [
       {
         command: 'enrich',

package/dist/bundling-sources/sdk/src/types.ts

@@ -997,6 +997,27 @@ export interface PlayCheckResult {
   summary?: string;
   artifactHash?: string | null;
   graphHash?: string | null;
+  /** SHA-256 of the exact source bytes checked by Deepline. */
+  sourceHash?: string | null;
+  /** Enforceable byte budgets measured during cloud preflight. */
+  limits?: {
+    revisionStorage: {
+      usedBytes: number;
+      limitBytes: number;
+      withinLimit: boolean;
+      breakdown: {
+        sourceCodeBytes: number;
+        staticPipelineBytes: number;
+        bindingsBytes: number;
+        descriptionBytes: number;
+      };
+    };
+    bundle: {
+      usedBytes: number;
+      limitBytes: number;
+      withinLimit: boolean;
+    };
+  };
 }
 
 /** Severity of a {@link PlayCheckIssue}. `error` fails the check; `warning` does not. */

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -8741,6 +8741,7 @@ export class PlayContextImpl {
               const httpFailureAttempt = httpFailureAttempts.next({
                 toolId,
                 status: response.status,
+                bodyText: text,
                 transientHttpRetrySafe: retrySafeTransientHttp,
               });
               const failure = classifyToolExecuteHttpFailure({

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -57,6 +57,13 @@ const DAYTONA_INFRASTRUCTURE_RETRY_PATTERN =
   /\b(?:Request failed with status code (?:408|429|500|502|503|504)|ECONNRESET|ECONNREFUSED|ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|fetch failed|socket hang up|Daytona sandbox create failed across|Daytona sandbox create did not complete)\b/i;
 
 type DaytonaExecution = { exitCode: number | null; result: string };
+type DaytonaLookupFailure = {
+  errorName: string;
+  errorCode: string | null;
+  httpStatus: number | null;
+  requestId: string | null;
+  detail: string;
+};
 type DaytonaUploadAttemptTiming = {
   attempt: number;
   sandboxId: string;
@@ -98,6 +105,72 @@ export const daytonaSdkClientFactory = {
   },
 };
 
+function stringProperty(value: unknown, key: string): string | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const candidate = (value as Record<string, unknown>)[key];
+  return typeof candidate === 'string' && candidate.trim()
+    ? candidate.trim()
+    : null;
+}
+
+function numberProperty(value: unknown, key: string): number | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const candidate = (value as Record<string, unknown>)[key];
+  return typeof candidate === 'number' && Number.isFinite(candidate)
+    ? candidate
+    : null;
+}
+
+function redactDaytonaErrorDetail(value: string): string {
+  return value
+    .replace(
+      /authorization\s*[=:]\s*bearer\s+[^\s,;]+/gi,
+      'Authorization=Bearer [redacted]',
+    )
+    .replace(
+      /(authorization\s*[=:]\s*)(?!bearer\s+\[redacted\])[^\s,;]+/gi,
+      '$1[redacted]',
+    )
+    .replace(/(bearer\s+)[^\s,;]+/gi, '$1[redacted]')
+    .replace(
+      /((?:api[_-]?key|token)\s*[=:]\s*)[^\s,;]+/gi,
+      '$1[redacted]',
+    )
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, 1_000);
+}
+
+/**
+ * Preserve the actionable shape of a Daytona control-plane failure without
+ * copying credentials or an arbitrarily large upstream response into logs.
+ */
+export function describeDaytonaLookupFailure(
+  error: unknown,
+): DaytonaLookupFailure {
+  const record = error && typeof error === 'object' ? error : null;
+  const response = record ? (record as Record<string, unknown>).response : null;
+  const headers =
+    response && typeof response === 'object'
+      ? (response as Record<string, unknown>).headers
+      : null;
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    errorName: error instanceof Error ? error.name || 'Error' : 'NonErrorThrow',
+    errorCode: stringProperty(record, 'code'),
+    httpStatus:
+      numberProperty(record, 'status') ??
+      numberProperty(record, 'statusCode') ??
+      numberProperty(response, 'status'),
+    requestId:
+      stringProperty(record, 'requestId') ??
+      stringProperty(record, 'request_id') ??
+      stringProperty(headers, 'x-request-id') ??
+      stringProperty(headers, 'x-daytona-request-id'),
+    detail: redactDaytonaErrorDetail(message),
+  };
+}
+
 /**
  * Best-effort deletion of an orphaned Daytona sandbox by id (push-execution B4).
  *
@@ -189,16 +262,16 @@ export async function inspectDetachedDaytonaRunner(input: {
         : { stage: 'result_missing', detail: null },
     };
   } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
+    const failure = describeDaytonaLookupFailure(error);
     console.warn('[play-runner.daytona.detached_inspect_failed]', {
       sandboxId: input.sandboxId,
       cmdId: input.cmdId,
-      error: detail,
+      failure,
     });
     return {
       exitCode: null,
       result: null,
-      diagnosis: { stage: 'sandbox_lookup_failed', detail },
+      diagnosis: { stage: 'sandbox_lookup_failed', detail: failure.detail },
     };
   }
 }

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -10,7 +10,7 @@ const PRIVATE_KEY_RE =
 // example `absurd-key-rotation-check`) and need an assignment context before
 // they are sensitive; HIGH_ENTROPY_ASSIGNMENT_RE handles that case below.
 const COMMON_SECRET_RE =
-  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+  /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 const GENERIC_PREFIXED_SECRET_RE =
   /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 const URL_SECRET_VALUE_RE =

package/dist/bundling-sources/shared_libs/play-runtime/tool-execute-retry-policy.ts

@@ -5,6 +5,14 @@ import {
 } from './tool-http-errors';
 
 export const TOOL_EXECUTE_TRANSIENT_HTTP_MAX_ATTEMPTS = 2;
+// A provider may need to finish the original request before it can replay the
+// result for this key. With no Retry-After signal, these two polls give the
+// original request ten seconds to finish without repeatedly hammering it.
+export const TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_RETRY_DELAYS_MS = [
+  5_000, 5_000,
+] as const;
+export const TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_MAX_ATTEMPTS =
+  TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_RETRY_DELAYS_MS.length + 1;
 export const TOOL_EXECUTE_RATE_LIMIT_MAX_ATTEMPTS = 8;
 export const TOOL_EXECUTE_BARE_RATE_LIMIT_MAX_ATTEMPTS = 2;
 export const TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS = 3;
@@ -13,6 +21,13 @@ export const TOOL_EXECUTE_RETRY_DELAY_FALLBACK_MS = 1_000;
 export const TOOL_EXECUTE_RETRY_DELAY_MAX_MS = 5_000;
 export const TOOL_EXECUTE_BARE_RATE_LIMIT_BACKPRESSURE_MS = 60_000;
 export const TOOL_EXECUTE_AUTH_SCOPE_CHANGED_CODE = 'AUTH_SCOPE_CHANGED';
+/**
+ * A provider/action-local outcome contract emits this only when a provider has
+ * explicitly said that the same idempotency key is still executing. It is not
+ * a generic HTTP 409 policy.
+ */
+export const TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_CODE =
+  'UPSTREAM_IDEMPOTENCY_IN_PROGRESS';
 
 export class ToolExecuteAuthScopeChangedError extends Error {
   readonly code = TOOL_EXECUTE_AUTH_SCOPE_CHANGED_CODE;
@@ -29,6 +44,7 @@ export type ToolExecuteHttpRetryDecision = {
   attemptCap: number;
   reason:
     | 'rate_limit'
+    | 'idempotency_in_progress'
     | 'retry_safe_transient_5xx'
     | 'unsafe_transient_5xx'
     | 'hard_billing_error'
@@ -49,6 +65,7 @@ export type ToolExecuteHttpFailureAttemptTracker = {
   next(input: {
     toolId: string;
     status: number;
+    bodyText?: string;
     transientHttpRetrySafe?: boolean;
   }): number;
 };
@@ -65,6 +82,29 @@ function parseJsonObject(text: string): Record<string, unknown> | null {
   }
 }
 
+function isIdempotencyInProgressResponse(input: {
+  status: number;
+  bodyText: string;
+}): boolean {
+  if (input.status !== 409) return false;
+  const body = parseJsonObject(input.bodyText);
+  return (
+    body?.code === TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_CODE &&
+    body.error_category === 'idempotency_in_progress'
+  );
+}
+
+function idempotencyInProgressRetryDelayMs(attempt: number): number {
+  return (
+    TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_RETRY_DELAYS_MS[
+      Math.min(
+        Math.max(0, attempt - 1),
+        TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_RETRY_DELAYS_MS.length - 1,
+      )
+    ] ?? TOOL_EXECUTE_RETRY_DELAY_FALLBACK_MS
+  );
+}
+
 export function parseToolExecuteAuthScopeChangedError(input: {
   status: number;
   bodyText: string;
@@ -84,6 +124,7 @@ export function parseToolExecuteAuthScopeChangedError(input: {
 
 function decideToolExecuteHttpRetry(input: {
   status: number;
+  idempotencyInProgress?: boolean;
   hardBillingFailure?: boolean;
   hasRetryAfterHeader?: boolean;
   transientHttpRetrySafe?: boolean;
@@ -110,6 +151,13 @@ function decideToolExecuteHttpRetry(input: {
       reason: 'rate_limit',
     };
   }
+  if (input.idempotencyInProgress) {
+    return {
+      retryable: true,
+      attemptCap: TOOL_EXECUTE_IDEMPOTENCY_IN_PROGRESS_MAX_ATTEMPTS,
+      reason: 'idempotency_in_progress',
+    };
+  }
   if (input.status >= 500 && input.status < 600) {
     if (!input.transientHttpRetrySafe) {
       return {
@@ -137,6 +185,7 @@ export function createToolExecuteHttpFailureAttemptTracker(): ToolExecuteHttpFai
     number
   > = {
     rate_limit: 0,
+    idempotency_in_progress: 0,
     retry_safe_transient_5xx: 0,
     unsafe_transient_5xx: 0,
     hard_billing_error: 0,
@@ -147,6 +196,10 @@ export function createToolExecuteHttpFailureAttemptTracker(): ToolExecuteHttpFai
     next(input) {
       const decision = decideToolExecuteHttpRetry({
         status: input.status,
+        idempotencyInProgress: isIdempotencyInProgressResponse({
+          status: input.status,
+          bodyText: input.bodyText ?? '',
+        }),
         hasRetryAfterHeader: true,
         transientHttpRetrySafe: input.transientHttpRetrySafe === true,
       });
@@ -186,8 +239,10 @@ export function classifyToolExecuteHttpFailure(input: {
   const hasRetryAfterHeader =
     typeof input.retryAfterHeader === 'string' &&
     input.retryAfterHeader.trim().length > 0;
+  const idempotencyInProgress = isIdempotencyInProgressResponse(input);
   const initialRetryDecision = decideToolExecuteHttpRetry({
     status: input.status,
+    idempotencyInProgress,
     hasRetryAfterHeader,
     transientHttpRetrySafe,
   });
@@ -208,6 +263,7 @@ export function classifyToolExecuteHttpFailure(input: {
   const hardBillingFailure = isHardBillingToolHttpError(error);
   const retryDecision = decideToolExecuteHttpRetry({
     status: input.status,
+    idempotencyInProgress,
     hardBillingFailure,
     hasRetryAfterHeader,
     transientHttpRetrySafe,
@@ -238,9 +294,12 @@ export function classifyToolExecuteHttpFailure(input: {
             TOOL_EXECUTE_RETRY_DELAY_FALLBACK_MS * input.attempt,
           ),
         )
-      : retryAfterMs > 0
-        ? Math.min(TOOL_EXECUTE_RETRY_DELAY_MAX_MS, retryAfterMs)
-        : TOOL_EXECUTE_RETRY_DELAY_FALLBACK_MS;
+      : retryDecision.reason === 'idempotency_in_progress' &&
+          !hasRetryAfterHeader
+        ? idempotencyInProgressRetryDelayMs(input.attempt)
+        : retryAfterMs > 0
+          ? Math.min(TOOL_EXECUTE_RETRY_DELAY_MAX_MS, retryAfterMs)
+          : TOOL_EXECUTE_RETRY_DELAY_FALLBACK_MS;
   return {
     ...retryDecision,
     error,

package/dist/cli/index.js

@@ -623,12 +623,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.219",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.221",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.219",
+    latest: "0.1.221",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1364,7 +1366,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
@@ -14646,6 +14648,73 @@ function parsePlayCheckOptions(args) {
   const jsonOutput = argsWantJson(args);
   return { target, jsonOutput };
 }
+function parsePlayPublishOptions(args) {
+  const target = args[0];
+  if (!target) {
+    throw new Error(
+      "Usage: deepline plays publish <play-file.ts|play-name> [--expected-artifact <hash>] [--dry-run] [--latest|--revision-id <id>] [--json]"
+    );
+  }
+  let revisionId;
+  let useLatest = false;
+  let expectedArtifactHash;
+  let dryRun = false;
+  for (let index = 1; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--revision-id") {
+      revisionId = args[++index];
+      if (!revisionId) throw new Error("--revision-id requires a revision id.");
+      continue;
+    }
+    if (arg === "--latest") {
+      useLatest = true;
+      continue;
+    }
+    if (arg === "--expected-artifact") {
+      expectedArtifactHash = args[++index];
+      if (!expectedArtifactHash) {
+        throw new Error("--expected-artifact requires an artifact hash.");
+      }
+      continue;
+    }
+    if (arg.startsWith("--expected-artifact=")) {
+      expectedArtifactHash = arg.slice("--expected-artifact=".length);
+      if (!expectedArtifactHash) {
+        throw new Error("--expected-artifact requires an artifact hash.");
+      }
+      continue;
+    }
+    if (arg === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (arg === "--json") continue;
+    throw new Error(`Unknown plays publish option: ${arg}`);
+  }
+  if (revisionId && useLatest) {
+    throw new Error("Choose only one live target: --latest or --revision-id.");
+  }
+  return {
+    target,
+    revisionId,
+    useLatest,
+    expectedArtifactHash,
+    dryRun,
+    jsonOutput: argsWantJson(args)
+  };
+}
+function formatByteBudget(usedBytes, limitBytes) {
+  return `${usedBytes.toLocaleString()} B / ${limitBytes.toLocaleString()} B`;
+}
+function printPlayCheckLimits(limits) {
+  if (!limits) return;
+  console.log(
+    `  revision storage: ${formatByteBudget(limits.revisionStorage.usedBytes, limits.revisionStorage.limitBytes)}`
+  );
+  console.log(
+    `  bundle: ${formatByteBudget(limits.bundle.usedBytes, limits.bundle.limitBytes)}`
+  );
+}
 function shouldUseLocalOnlyPlayCheck() {
   const value = process.env.DEEPLINE_PLAY_CHECK_LOCAL_ONLY?.trim().toLowerCase();
   return value === "1" || value === "true" || value === "yes" || value === "on";
@@ -14958,7 +15027,11 @@ async function handlePlayCheck(args) {
       );
     } else {
       console.log(`\u2713 ${playName} passed local play check`);
+      console.log(`  source: ${graph.root.artifact.sourceHash.slice(0, 12)}`);
       console.log(`  artifact: ${result2.artifactHash.slice(0, 12)}`);
+      console.log(
+        `  publish: deepline plays publish ${shellQuote2(options.target)} --expected-artifact ${result2.artifactHash}`
+      );
       printToolGetterHints(result2.toolGetterHints);
     }
     return 0;
@@ -15000,6 +15073,15 @@ async function handlePlayCheck(args) {
     if (enrichedResult.artifactHash) {
       console.log(`  artifact: ${enrichedResult.artifactHash.slice(0, 12)}`);
     }
+    if (enrichedResult.sourceHash) {
+      console.log(`  source: ${enrichedResult.sourceHash.slice(0, 12)}`);
+    }
+    printPlayCheckLimits(enrichedResult.limits);
+    if (enrichedResult.artifactHash) {
+      console.log(
+        `  publish: deepline plays publish ${shellQuote2(options.target)} --expected-artifact ${enrichedResult.artifactHash}`
+      );
+    }
     printPlayTriggers(enrichedResult.triggers);
     printRecognizedSummary(enrichedResult.recognized);
     printPlayCheckIssues(enrichedResult.issues, (line) => console.log(line));
@@ -16356,28 +16438,15 @@ async function handlePlayDescribe(args) {
   return 0;
 }
 async function handlePlayPublish(args) {
-  const playName = args[0];
-  if (!playName) {
-    console.error(
-      "Usage: deepline plays publish <play-file.ts|play-name> [--latest|--revision-id <id>] [--json]"
-    );
-    return 1;
-  }
-  let revisionId;
-  let useLatest = false;
-  for (let index = 1; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--revision-id" && args[index + 1]) {
-      revisionId = args[++index];
-    }
-    if (arg === "--latest") {
-      useLatest = true;
-    }
-  }
-  if (revisionId && useLatest) {
-    console.error("Choose only one live target: --latest or --revision-id.");
-    return 1;
+  let options;
+  try {
+    options = parsePlayPublishOptions(args);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 2;
   }
+  const { target: playName, useLatest } = options;
+  let revisionId = options.revisionId;
   const client2 = new DeeplineClient();
   if (isFileTarget(playName)) {
     if (revisionId || useLatest) {
@@ -16394,6 +16463,66 @@ async function handlePlayPublish(args) {
         () => collectBundledPlayGraph((0, import_node_path11.resolve)(playName))
       );
       assertBundledPlayGraphDescriptions(graph);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 1;
+    }
+    const rootPlayName = graph.root.playName ?? extractPlayName(graph.root.sourceCode, graph.root.filePath);
+    const artifactHash = graph.root.artifact.artifactHash;
+    if (options.expectedArtifactHash && options.expectedArtifactHash !== artifactHash) {
+      const result3 = {
+        ok: false,
+        code: "PLAY_ARTIFACT_HASH_MISMATCH",
+        message: "Refusing to publish: the local file no longer produces the artifact checked earlier.",
+        expectedArtifactHash: options.expectedArtifactHash,
+        currentArtifactHash: artifactHash,
+        next: `deepline plays check ${shellQuote2(playName)}`
+      };
+      if (options.jsonOutput) {
+        process.stdout.write(`${JSON.stringify(result3)}
+`);
+      } else {
+        console.error(result3.message);
+        console.error(`  checked artifact: ${result3.expectedArtifactHash}`);
+        console.error(`  current artifact: ${result3.currentArtifactHash}`);
+        console.error(`  run: ${result3.next}`);
+      }
+      return 7;
+    }
+    const dryRun = {
+      ok: true,
+      dryRun: true,
+      name: rootPlayName,
+      sourcePath: graph.root.filePath,
+      sourceHash: graph.root.artifact.sourceHash,
+      artifactHash,
+      graphHash: graph.root.artifact.graphHash,
+      importedPlayCount: Math.max(0, graph.nodes.size - 1),
+      plannedMutation: "register revision and promote it live",
+      expectedArtifactHash: options.expectedArtifactHash ?? null
+    };
+    if (options.dryRun) {
+      if (options.jsonOutput) {
+        process.stdout.write(`${JSON.stringify(dryRun)}
+`);
+      } else {
+        console.log(`Dry run: ${rootPlayName}`);
+        console.log(`  source: ${dryRun.sourceHash}`);
+        console.log(`  artifact: ${dryRun.artifactHash}`);
+        console.log(`  would: ${dryRun.plannedMutation}`);
+      }
+      return 0;
+    }
+    let previousLive = null;
+    try {
+      previousLive = (await client2.getPlay(rootPlayName)).play.liveRevision ?? null;
+    } catch (error) {
+      if (!(error instanceof DeeplineError) || error.statusCode !== 404) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 5;
+      }
+    }
+    try {
       await traceCliSpan(
         "cli.play_publish_compile_manifests",
         { targetKind: "file", nodeCount: graph.nodes.size },
@@ -16408,13 +16537,12 @@ async function handlePlayPublish(args) {
       console.error(error instanceof Error ? error.message : String(error));
       return 1;
     }
-    const rootPlayName = graph.root.playName ?? extractPlayName(graph.root.sourceCode, graph.root.filePath);
     const published = await traceCliSpan(
       "cli.play_publish_register_root",
       {
         targetKind: "file",
         playName: rootPlayName,
-        artifactHash: graph.root.artifact.artifactHash
+        artifactHash
       },
       () => client2.registerPlayArtifact({
         name: rootPlayName,
@@ -16426,17 +16554,63 @@ async function handlePlayPublish(args) {
         publish: true
       })
     );
-    process.stdout.write(
-      `${JSON.stringify({
-        success: true,
-        name: rootPlayName,
-        liveVersion: published.version ?? null,
-        revisionId: published.revisionId ?? null,
-        triggerMetadata: published.triggerMetadata ?? null,
-        triggerBindings: published.triggerBindings ?? []
-      })}
-`
-    );
+    const result2 = {
+      success: true,
+      name: rootPlayName,
+      sourcePath: graph.root.filePath,
+      sourceHash: graph.root.artifact.sourceHash,
+      artifactHash,
+      liveVersion: published.version ?? null,
+      revisionId: published.revisionId ?? null,
+      previousLiveVersion: previousLive?.version ?? null,
+      previousArtifactHash: previousLive?.artifactHash ?? null,
+      sourceBytes: {
+        before: previousLive?.sourceCode ? Buffer.byteLength(previousLive.sourceCode, "utf8") : null,
+        after: Buffer.byteLength(graph.root.sourceCode, "utf8")
+      },
+      triggerMetadata: published.triggerMetadata ?? null,
+      triggerBindings: published.triggerBindings ?? []
+    };
+    if (options.jsonOutput) {
+      process.stdout.write(`${JSON.stringify(result2)}
+`);
+    } else {
+      console.log(
+        `\u2713 Published ${rootPlayName} as v${result2.liveVersion ?? "?"}`
+      );
+      console.log(`  source: ${result2.sourceHash.slice(0, 12)}`);
+      console.log(`  artifact: ${result2.artifactHash.slice(0, 12)}`);
+      if (result2.previousLiveVersion !== null) {
+        console.log(
+          `  previous live: v${result2.previousLiveVersion} (${result2.previousArtifactHash?.slice(0, 12) ?? "unknown artifact"})`
+        );
+      }
+      if (result2.sourceBytes.before !== null) {
+        console.log(
+          `  source bytes: ${result2.sourceBytes.before.toLocaleString()} \u2192 ${result2.sourceBytes.after.toLocaleString()}`
+        );
+      }
+      console.log(
+        `  revisions: deepline plays versions --name ${rootPlayName}`
+      );
+    }
+    return 0;
+  }
+  if (options.expectedArtifactHash) {
+    console.error("--expected-artifact only applies to a local play file.");
+    return 2;
+  }
+  if (options.dryRun) {
+    const result2 = {
+      ok: true,
+      dryRun: true,
+      name: playName,
+      plannedMutation: "promote a saved revision live",
+      revisionId: revisionId ?? null,
+      latest: useLatest
+    };
+    process.stdout.write(`${JSON.stringify(result2)}
+`);
     return 0;
   }
   const resolvedName = parseReferencedPlayTarget2(playName).playName;
@@ -16800,7 +16974,9 @@ Notes:
   Mutates cloud state. For a saved play, --latest or --revision-id promotes an
   existing saved revision live.
   Local .play.ts publishing bundles the file, validates it, saves a revision,
-  and promotes that revision live.
+  and promotes that revision live. Use --expected-artifact with the hash from
+  plays check to refuse publishing bytes that changed after validation.
+  --dry-run bundles only and prints the exact artifact that would be published.
   Running a local file with plays run does not publish it.
 
 Examples:
@@ -16808,27 +16984,40 @@ Examples:
   deepline plays set-live my-play --revision-id <revision-id> --json
   deepline plays set-live my.play.ts --json
   deepline plays publish my.play.ts --json
+  deepline plays check my.play.ts
+  deepline plays publish my.play.ts --expected-artifact <artifact-hash>
+  deepline plays publish my.play.ts --dry-run --json
 `
   );
   addPublishHelp(
     play.command("publish <target>").description(
       "Promote a saved play revision or publish a local play file."
     )
-  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
+  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option(
+    "--expected-artifact <hash>",
+    "Require the local file to produce this checked artifact hash"
+  ).option("--dry-run", "Bundle and show the planned publish without mutation").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
     process.exitCode = await handlePlayPublish([
       target,
       ...options.latest ? ["--latest"] : [],
       ...options.revisionId ? ["--revision-id", options.revisionId] : [],
+      ...options.expectedArtifact ? ["--expected-artifact", options.expectedArtifact] : [],
+      ...options.dryRun ? ["--dry-run"] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
   addPublishHelp(
     play.command("set-live <target>").description("Promote a saved revision or publish a local play file.")
-  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
+  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option(
+    "--expected-artifact <hash>",
+    "Require the local file to produce this checked artifact hash"
+  ).option("--dry-run", "Bundle and show the planned publish without mutation").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
     process.exitCode = await handlePlayPublish([
       target,
       ...options.latest ? ["--latest"] : [],
       ...options.revisionId ? ["--revision-id", options.revisionId] : [],
+      ...options.expectedArtifact ? ["--expected-artifact", options.expectedArtifact] : [],
+      ...options.dryRun ? ["--dry-run"] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
@@ -28940,7 +29129,7 @@ async function maybeAutoUpdateAndRelaunch(response) {
   if (plan.kind === "source") {
     return false;
   }
-  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
+  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.reason === "deprecated" ? "is deprecated and will update automatically" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
   process.stderr.write(
     `Deepline SDK/CLI ${label}; running ${plan.manualCommand}
 `

package/dist/cli/index.mjs

@@ -608,12 +608,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.219",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.221",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.219",
+    latest: "0.1.221",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1349,7 +1351,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
@@ -14675,6 +14677,73 @@ function parsePlayCheckOptions(args) {
   const jsonOutput = argsWantJson(args);
   return { target, jsonOutput };
 }
+function parsePlayPublishOptions(args) {
+  const target = args[0];
+  if (!target) {
+    throw new Error(
+      "Usage: deepline plays publish <play-file.ts|play-name> [--expected-artifact <hash>] [--dry-run] [--latest|--revision-id <id>] [--json]"
+    );
+  }
+  let revisionId;
+  let useLatest = false;
+  let expectedArtifactHash;
+  let dryRun = false;
+  for (let index = 1; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--revision-id") {
+      revisionId = args[++index];
+      if (!revisionId) throw new Error("--revision-id requires a revision id.");
+      continue;
+    }
+    if (arg === "--latest") {
+      useLatest = true;
+      continue;
+    }
+    if (arg === "--expected-artifact") {
+      expectedArtifactHash = args[++index];
+      if (!expectedArtifactHash) {
+        throw new Error("--expected-artifact requires an artifact hash.");
+      }
+      continue;
+    }
+    if (arg.startsWith("--expected-artifact=")) {
+      expectedArtifactHash = arg.slice("--expected-artifact=".length);
+      if (!expectedArtifactHash) {
+        throw new Error("--expected-artifact requires an artifact hash.");
+      }
+      continue;
+    }
+    if (arg === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (arg === "--json") continue;
+    throw new Error(`Unknown plays publish option: ${arg}`);
+  }
+  if (revisionId && useLatest) {
+    throw new Error("Choose only one live target: --latest or --revision-id.");
+  }
+  return {
+    target,
+    revisionId,
+    useLatest,
+    expectedArtifactHash,
+    dryRun,
+    jsonOutput: argsWantJson(args)
+  };
+}
+function formatByteBudget(usedBytes, limitBytes) {
+  return `${usedBytes.toLocaleString()} B / ${limitBytes.toLocaleString()} B`;
+}
+function printPlayCheckLimits(limits) {
+  if (!limits) return;
+  console.log(
+    `  revision storage: ${formatByteBudget(limits.revisionStorage.usedBytes, limits.revisionStorage.limitBytes)}`
+  );
+  console.log(
+    `  bundle: ${formatByteBudget(limits.bundle.usedBytes, limits.bundle.limitBytes)}`
+  );
+}
 function shouldUseLocalOnlyPlayCheck() {
   const value = process.env.DEEPLINE_PLAY_CHECK_LOCAL_ONLY?.trim().toLowerCase();
   return value === "1" || value === "true" || value === "yes" || value === "on";
@@ -14987,7 +15056,11 @@ async function handlePlayCheck(args) {
       );
     } else {
       console.log(`\u2713 ${playName} passed local play check`);
+      console.log(`  source: ${graph.root.artifact.sourceHash.slice(0, 12)}`);
       console.log(`  artifact: ${result2.artifactHash.slice(0, 12)}`);
+      console.log(
+        `  publish: deepline plays publish ${shellQuote2(options.target)} --expected-artifact ${result2.artifactHash}`
+      );
       printToolGetterHints(result2.toolGetterHints);
     }
     return 0;
@@ -15029,6 +15102,15 @@ async function handlePlayCheck(args) {
     if (enrichedResult.artifactHash) {
       console.log(`  artifact: ${enrichedResult.artifactHash.slice(0, 12)}`);
     }
+    if (enrichedResult.sourceHash) {
+      console.log(`  source: ${enrichedResult.sourceHash.slice(0, 12)}`);
+    }
+    printPlayCheckLimits(enrichedResult.limits);
+    if (enrichedResult.artifactHash) {
+      console.log(
+        `  publish: deepline plays publish ${shellQuote2(options.target)} --expected-artifact ${enrichedResult.artifactHash}`
+      );
+    }
     printPlayTriggers(enrichedResult.triggers);
     printRecognizedSummary(enrichedResult.recognized);
     printPlayCheckIssues(enrichedResult.issues, (line) => console.log(line));
@@ -16385,28 +16467,15 @@ async function handlePlayDescribe(args) {
   return 0;
 }
 async function handlePlayPublish(args) {
-  const playName = args[0];
-  if (!playName) {
-    console.error(
-      "Usage: deepline plays publish <play-file.ts|play-name> [--latest|--revision-id <id>] [--json]"
-    );
-    return 1;
-  }
-  let revisionId;
-  let useLatest = false;
-  for (let index = 1; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--revision-id" && args[index + 1]) {
-      revisionId = args[++index];
-    }
-    if (arg === "--latest") {
-      useLatest = true;
-    }
-  }
-  if (revisionId && useLatest) {
-    console.error("Choose only one live target: --latest or --revision-id.");
-    return 1;
+  let options;
+  try {
+    options = parsePlayPublishOptions(args);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 2;
   }
+  const { target: playName, useLatest } = options;
+  let revisionId = options.revisionId;
   const client2 = new DeeplineClient();
   if (isFileTarget(playName)) {
     if (revisionId || useLatest) {
@@ -16423,6 +16492,66 @@ async function handlePlayPublish(args) {
         () => collectBundledPlayGraph(resolve8(playName))
       );
       assertBundledPlayGraphDescriptions(graph);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 1;
+    }
+    const rootPlayName = graph.root.playName ?? extractPlayName(graph.root.sourceCode, graph.root.filePath);
+    const artifactHash = graph.root.artifact.artifactHash;
+    if (options.expectedArtifactHash && options.expectedArtifactHash !== artifactHash) {
+      const result3 = {
+        ok: false,
+        code: "PLAY_ARTIFACT_HASH_MISMATCH",
+        message: "Refusing to publish: the local file no longer produces the artifact checked earlier.",
+        expectedArtifactHash: options.expectedArtifactHash,
+        currentArtifactHash: artifactHash,
+        next: `deepline plays check ${shellQuote2(playName)}`
+      };
+      if (options.jsonOutput) {
+        process.stdout.write(`${JSON.stringify(result3)}
+`);
+      } else {
+        console.error(result3.message);
+        console.error(`  checked artifact: ${result3.expectedArtifactHash}`);
+        console.error(`  current artifact: ${result3.currentArtifactHash}`);
+        console.error(`  run: ${result3.next}`);
+      }
+      return 7;
+    }
+    const dryRun = {
+      ok: true,
+      dryRun: true,
+      name: rootPlayName,
+      sourcePath: graph.root.filePath,
+      sourceHash: graph.root.artifact.sourceHash,
+      artifactHash,
+      graphHash: graph.root.artifact.graphHash,
+      importedPlayCount: Math.max(0, graph.nodes.size - 1),
+      plannedMutation: "register revision and promote it live",
+      expectedArtifactHash: options.expectedArtifactHash ?? null
+    };
+    if (options.dryRun) {
+      if (options.jsonOutput) {
+        process.stdout.write(`${JSON.stringify(dryRun)}
+`);
+      } else {
+        console.log(`Dry run: ${rootPlayName}`);
+        console.log(`  source: ${dryRun.sourceHash}`);
+        console.log(`  artifact: ${dryRun.artifactHash}`);
+        console.log(`  would: ${dryRun.plannedMutation}`);
+      }
+      return 0;
+    }
+    let previousLive = null;
+    try {
+      previousLive = (await client2.getPlay(rootPlayName)).play.liveRevision ?? null;
+    } catch (error) {
+      if (!(error instanceof DeeplineError) || error.statusCode !== 404) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 5;
+      }
+    }
+    try {
       await traceCliSpan(
         "cli.play_publish_compile_manifests",
         { targetKind: "file", nodeCount: graph.nodes.size },
@@ -16437,13 +16566,12 @@ async function handlePlayPublish(args) {
       console.error(error instanceof Error ? error.message : String(error));
       return 1;
     }
-    const rootPlayName = graph.root.playName ?? extractPlayName(graph.root.sourceCode, graph.root.filePath);
     const published = await traceCliSpan(
       "cli.play_publish_register_root",
       {
         targetKind: "file",
         playName: rootPlayName,
-        artifactHash: graph.root.artifact.artifactHash
+        artifactHash
       },
       () => client2.registerPlayArtifact({
         name: rootPlayName,
@@ -16455,17 +16583,63 @@ async function handlePlayPublish(args) {
         publish: true
       })
     );
-    process.stdout.write(
-      `${JSON.stringify({
-        success: true,
-        name: rootPlayName,
-        liveVersion: published.version ?? null,
-        revisionId: published.revisionId ?? null,
-        triggerMetadata: published.triggerMetadata ?? null,
-        triggerBindings: published.triggerBindings ?? []
-      })}
-`
-    );
+    const result2 = {
+      success: true,
+      name: rootPlayName,
+      sourcePath: graph.root.filePath,
+      sourceHash: graph.root.artifact.sourceHash,
+      artifactHash,
+      liveVersion: published.version ?? null,
+      revisionId: published.revisionId ?? null,
+      previousLiveVersion: previousLive?.version ?? null,
+      previousArtifactHash: previousLive?.artifactHash ?? null,
+      sourceBytes: {
+        before: previousLive?.sourceCode ? Buffer.byteLength(previousLive.sourceCode, "utf8") : null,
+        after: Buffer.byteLength(graph.root.sourceCode, "utf8")
+      },
+      triggerMetadata: published.triggerMetadata ?? null,
+      triggerBindings: published.triggerBindings ?? []
+    };
+    if (options.jsonOutput) {
+      process.stdout.write(`${JSON.stringify(result2)}
+`);
+    } else {
+      console.log(
+        `\u2713 Published ${rootPlayName} as v${result2.liveVersion ?? "?"}`
+      );
+      console.log(`  source: ${result2.sourceHash.slice(0, 12)}`);
+      console.log(`  artifact: ${result2.artifactHash.slice(0, 12)}`);
+      if (result2.previousLiveVersion !== null) {
+        console.log(
+          `  previous live: v${result2.previousLiveVersion} (${result2.previousArtifactHash?.slice(0, 12) ?? "unknown artifact"})`
+        );
+      }
+      if (result2.sourceBytes.before !== null) {
+        console.log(
+          `  source bytes: ${result2.sourceBytes.before.toLocaleString()} \u2192 ${result2.sourceBytes.after.toLocaleString()}`
+        );
+      }
+      console.log(
+        `  revisions: deepline plays versions --name ${rootPlayName}`
+      );
+    }
+    return 0;
+  }
+  if (options.expectedArtifactHash) {
+    console.error("--expected-artifact only applies to a local play file.");
+    return 2;
+  }
+  if (options.dryRun) {
+    const result2 = {
+      ok: true,
+      dryRun: true,
+      name: playName,
+      plannedMutation: "promote a saved revision live",
+      revisionId: revisionId ?? null,
+      latest: useLatest
+    };
+    process.stdout.write(`${JSON.stringify(result2)}
+`);
     return 0;
   }
   const resolvedName = parseReferencedPlayTarget2(playName).playName;
@@ -16829,7 +17003,9 @@ Notes:
   Mutates cloud state. For a saved play, --latest or --revision-id promotes an
   existing saved revision live.
   Local .play.ts publishing bundles the file, validates it, saves a revision,
-  and promotes that revision live.
+  and promotes that revision live. Use --expected-artifact with the hash from
+  plays check to refuse publishing bytes that changed after validation.
+  --dry-run bundles only and prints the exact artifact that would be published.
   Running a local file with plays run does not publish it.
 
 Examples:
@@ -16837,27 +17013,40 @@ Examples:
   deepline plays set-live my-play --revision-id <revision-id> --json
   deepline plays set-live my.play.ts --json
   deepline plays publish my.play.ts --json
+  deepline plays check my.play.ts
+  deepline plays publish my.play.ts --expected-artifact <artifact-hash>
+  deepline plays publish my.play.ts --dry-run --json
 `
   );
   addPublishHelp(
     play.command("publish <target>").description(
       "Promote a saved play revision or publish a local play file."
     )
-  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
+  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option(
+    "--expected-artifact <hash>",
+    "Require the local file to produce this checked artifact hash"
+  ).option("--dry-run", "Bundle and show the planned publish without mutation").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
     process.exitCode = await handlePlayPublish([
       target,
       ...options.latest ? ["--latest"] : [],
       ...options.revisionId ? ["--revision-id", options.revisionId] : [],
+      ...options.expectedArtifact ? ["--expected-artifact", options.expectedArtifact] : [],
+      ...options.dryRun ? ["--dry-run"] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
   addPublishHelp(
     play.command("set-live <target>").description("Promote a saved revision or publish a local play file.")
-  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
+  ).option("--latest", "Promote the newest saved revision").option("--revision-id <id>", "Revision to promote").option(
+    "--expected-artifact <hash>",
+    "Require the local file to produce this checked artifact hash"
+  ).option("--dry-run", "Bundle and show the planned publish without mutation").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (target, options) => {
     process.exitCode = await handlePlayPublish([
       target,
       ...options.latest ? ["--latest"] : [],
       ...options.revisionId ? ["--revision-id", options.revisionId] : [],
+      ...options.expectedArtifact ? ["--expected-artifact", options.expectedArtifact] : [],
+      ...options.dryRun ? ["--dry-run"] : [],
       ...options.json ? ["--json"] : []
     ]);
   });
@@ -28997,7 +29186,7 @@ async function maybeAutoUpdateAndRelaunch(response) {
   if (plan.kind === "source") {
     return false;
   }
-  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
+  const label = autoUpdate.reason === "rollback_forced" ? "has a server rollback pending and needs the latest rollback-aware CLI" : autoUpdate.reason === "deprecated" ? "is deprecated and will update automatically" : autoUpdate.required ? "requires an update" : "is more than the supported auto-update lag behind";
   process.stderr.write(
     `Deepline SDK/CLI ${label}; running ${plan.manualCommand}
 `

package/dist/index.d.mts

@@ -945,6 +945,27 @@ interface PlayCheckResult {
     summary?: string;
     artifactHash?: string | null;
     graphHash?: string | null;
+    /** SHA-256 of the exact source bytes checked by Deepline. */
+    sourceHash?: string | null;
+    /** Enforceable byte budgets measured during cloud preflight. */
+    limits?: {
+        revisionStorage: {
+            usedBytes: number;
+            limitBytes: number;
+            withinLimit: boolean;
+            breakdown: {
+                sourceCodeBytes: number;
+                staticPipelineBytes: number;
+                bindingsBytes: number;
+                descriptionBytes: number;
+            };
+        };
+        bundle: {
+            usedBytes: number;
+            limitBytes: number;
+            withinLimit: boolean;
+        };
+    };
 }
 /** Severity of a {@link PlayCheckIssue}. `error` fails the check; `warning` does not. */
 type PlayCheckIssueSeverity = 'error' | 'warning';

package/dist/index.d.ts

@@ -945,6 +945,27 @@ interface PlayCheckResult {
     summary?: string;
     artifactHash?: string | null;
     graphHash?: string | null;
+    /** SHA-256 of the exact source bytes checked by Deepline. */
+    sourceHash?: string | null;
+    /** Enforceable byte budgets measured during cloud preflight. */
+    limits?: {
+        revisionStorage: {
+            usedBytes: number;
+            limitBytes: number;
+            withinLimit: boolean;
+            breakdown: {
+                sourceCodeBytes: number;
+                staticPipelineBytes: number;
+                bindingsBytes: number;
+                descriptionBytes: number;
+            };
+        };
+        bundle: {
+            usedBytes: number;
+            limitBytes: number;
+            withinLimit: boolean;
+        };
+    };
 }
 /** Severity of a {@link PlayCheckIssue}. `error` fails the check; `warning` does not. */
 type PlayCheckIssueSeverity = 'error' | 'warning';

package/dist/index.js

@@ -422,12 +422,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.219",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.221",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.219",
+    latest: "0.1.221",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1163,7 +1165,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;

package/dist/index.mjs

@@ -352,12 +352,14 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.219",
+  // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
+  // automatically without blocking their current command.
+  version: "0.1.221",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.219",
+    latest: "0.1.221",
     minimumSupported: "0.1.53",
-    deprecatedBelow: "0.1.53",
+    deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
       {
         command: "enrich",
@@ -1093,7 +1095,7 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs])[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;

package/dist/viewer/viewer.css

@@ -353,6 +353,17 @@ body {
     border: 1px solid var(--red);
     background: rgba(248,81,73,0.06);
 }
+.tool-detail-toggle {
+    margin-top: 8px;
+    background: var(--bg-tertiary);
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    color: var(--blue);
+    cursor: pointer;
+    font-size: 12px;
+    padding: 4px 8px;
+}
+.tool-detail-toggle:hover { border-color: var(--blue); }
 
 /* Result card */
 .result-card {

package/dist/viewer/viewer.js

@@ -1334,7 +1334,7 @@ function renderTimeline(timeline) {
                 <div class="tool-detail" id="detail-${i}">
                     <div class="tool-detail-section">
                         <div class="label">Input</div>
-                        <pre>${esc(formatInput(e.tool, e.input))}</pre>
+                        ${formatToolInputHtml(e.tool, e.input, i)}
                     </div>
                     ${e.result_content != null ? `<div class="tool-detail-section">
                         <div class="label">Result</div>
@@ -1347,8 +1347,17 @@ function renderTimeline(timeline) {
     return html;
 }
 
+function isShellCommandTool(tool) {
+    const normalized = String(tool || '').toLowerCase().replace(/[^a-z]/g, '');
+    return ['bash', 'exec', 'execcommand', 'runcommand', 'shell'].includes(normalized);
+}
+
+function shellCommand(input) {
+    return input.command || input.cmd || input.CommandLine || null;
+}
+
 function formatInput(tool, input) {
-    if (tool === 'Bash') return input.command || JSON.stringify(input, null, 2);
+    if (isShellCommandTool(tool)) return shellCommand(input) || JSON.stringify(input, null, 2);
     if (tool === 'Write') {
         let s = 'file: ' + (input.file_path || input.path || '') + '\n\n';
         if (input.content != null) s += '--- content ---\n' + String(input.content);
@@ -1364,6 +1373,39 @@ function formatInput(tool, input) {
     return JSON.stringify(input, null, 2);
 }
 
+function isLongShellCommand(command) {
+    return command.length > 600 || command.split('\n').length > 10;
+}
+
+function shellCommandPreview(command) {
+    const lines = command.split('\n');
+    let preview = lines.slice(0, 10).join('\n');
+    if (preview.length > 600) preview = preview.slice(0, 600);
+    return preview + '\n...[full command hidden]';
+}
+
+function formatToolInputHtml(tool, input, entryIndex) {
+    const formatted = formatInput(tool, input);
+    if (!isShellCommandTool(tool) || !isLongShellCommand(formatted)) {
+        return `<pre>${esc(formatted)}</pre>`;
+    }
+    const previewId = `command-preview-${entryIndex}`;
+    const fullId = `command-full-${entryIndex}`;
+    return `<pre id="${previewId}">${esc(shellCommandPreview(formatted))}</pre>
+        <button class="tool-detail-toggle" onclick="toggleCommandInput('${previewId}', '${fullId}', this)">Show full command</button>
+        <pre id="${fullId}" hidden>${esc(formatted)}</pre>`;
+}
+
+function toggleCommandInput(previewId, fullId, toggle) {
+    const preview = document.getElementById(previewId);
+    const full = document.getElementById(fullId);
+    if (!preview || !full) return;
+    const showFull = full.hidden;
+    full.hidden = !showFull;
+    preview.hidden = showFull;
+    toggle.textContent = showFull ? 'Show less' : 'Show full command';
+}
+
 function toggleReasoning(id, toggle) {
     const el = document.getElementById(id);
     const collapsed = el.classList.toggle('collapsed');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.219",
+  "version": "0.1.221",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {