deepline 0.1.239 → 0.1.240

package/dist/bundling-sources/sdk/src/release.ts

@@ -110,10 +110,10 @@ export const SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: '0.1.239',
+  version: '0.1.240',
   apiContract: '2026-06-dataset-handle-results-hard-cutover',
   supportPolicy: {
-    latest: '0.1.239',
+    latest: '0.1.240',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.219',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -5852,6 +5852,10 @@ export class PlayContextImpl {
     for (const wake of waiters) wake();
   }
 
+  private toolBatchDispatcherNowMs(): number {
+    return this.#options.toolBatchDispatcherClock?.nowMs() ?? Date.now();
+  }
+
   private enqueueToolCall(request: ToolCallRequest): void {
     if (this.toolDispatcherFailure != null) {
       const resolver = this.toolCallResolvers.get(request.callId);
@@ -5864,7 +5868,10 @@ export class PlayContextImpl {
     this.toolCallQueue.push(request);
     const batchKey = this.toolBatchCoalesceKey(request);
     if (batchKey && !this.toolBatchQueuedAtByKey.has(batchKey)) {
-      this.toolBatchQueuedAtByKey.set(batchKey, Date.now());
+      this.toolBatchQueuedAtByKey.set(
+        batchKey,
+        this.toolBatchDispatcherNowMs(),
+      );
     }
     this.wakeToolDispatcher();
   }
@@ -5941,15 +5948,26 @@ export class PlayContextImpl {
 
   private waitForToolDispatcherWake(deadlineMs: number | null): Promise<void> {
     return new Promise((resolve) => {
-      let timer: ReturnType<typeof setTimeout> | null = null;
+      let cancelDeadline: (() => void) | null = null;
       const wake = () => {
-        if (timer) clearTimeout(timer);
+        cancelDeadline?.();
+        cancelDeadline = null;
         this.toolDispatcherWakeWaiters.delete(wake);
         resolve();
       };
       this.toolDispatcherWakeWaiters.add(wake);
       if (deadlineMs != null) {
-        timer = setTimeout(wake, Math.max(0, deadlineMs - Date.now()));
+        const delayMs = Math.max(
+          0,
+          deadlineMs - this.toolBatchDispatcherNowMs(),
+        );
+        const clock = this.#options.toolBatchDispatcherClock;
+        if (clock) {
+          cancelDeadline = clock.schedule(delayMs, wake);
+        } else {
+          const timer = setTimeout(wake, delayMs);
+          cancelDeadline = () => clearTimeout(timer);
+        }
       }
     });
   }
@@ -5977,7 +5995,9 @@ export class PlayContextImpl {
           throw this.toolDispatcherFailure;
         }
 
-        const dispatchable = this.takeDispatchableToolCalls(Date.now());
+        const dispatchable = this.takeDispatchableToolCalls(
+          this.toolBatchDispatcherNowMs(),
+        );
         if (dispatchable.requests.length > 0) {
           pass += 1;
           this.log(`  Batch pass ${pass}`);
@@ -6688,8 +6708,8 @@ export class PlayContextImpl {
       rowScopeKey ? `@${rowScopeKey}` : ''
     }`;
     if (rowScope) {
-      const namespaces =
-        rowScope.inlineChildInvocationNamespaces ??= new Set<string>();
+      const namespaces = (rowScope.inlineChildInvocationNamespaces ??=
+        new Set<string>());
       namespaces.add(namespace);
       if (namespaces.size > MAX_INLINE_CHILD_INVOCATIONS_PER_ROW) {
         throw new Error(

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -680,6 +680,14 @@ export interface ContextOptions {
   getBatchOperationStrategy?: (
     operation: string,
   ) => AnyBatchOperationStrategy | null;
+  /**
+   * Internal deterministic clock for fixed-window dispatcher tests. Runtime
+   * adapters omit this and use the system clock.
+   */
+  toolBatchDispatcherClock?: {
+    nowMs: () => number;
+    schedule: (delayMs: number, wake: () => void) => () => void;
+  };
   // How long batchable calls wait for same-key row continuations before
   // dispatching, measured from the first queued item. Defaults to 5ms in
   // production; tests override it to a large value to make coalescing

package/dist/bundling-sources/shared_libs/play-runtime/run-ledger.ts

@@ -1055,7 +1055,12 @@ export function reducePlayRunLedgerEvent(
       if (ignoreNonTerminalAfterStickyTerminal) {
         return withTiming(base);
       }
-      const createdStatus = event.status ?? base.status;
+      // Scheduler wait/resume events own the active lifecycle once a run is
+      // parked. Worker registration can arrive later through an independent
+      // ledger append lane; replaying that older `run.created` fact must not
+      // make an externally-waiting run look active again.
+      const createdStatus =
+        base.status === 'waiting' ? 'waiting' : (event.status ?? base.status);
       return withTiming({
         ...base,
         playName: event.playName ?? base.playName ?? null,
@@ -1075,7 +1080,9 @@ export function reducePlayRunLedgerEvent(
         playName: event.playName ?? base.playName ?? null,
         status: isTerminalPlayRunLedgerStatus(base.status)
           ? base.status
-          : 'running',
+          : base.status === 'waiting'
+            ? 'waiting'
+            : 'running',
         startedAt: base.startedAt ?? occurredAt,
       });
     case 'run.waiting':
@@ -1200,7 +1207,9 @@ export function reducePlayRunLedgerEvent(
         ...base,
         status: isTerminalPlayRunLedgerStatus(base.status)
           ? base.status
-          : 'running',
+          : base.status === 'waiting'
+            ? 'waiting'
+            : 'running',
         startedAt: base.startedAt ?? occurredAt,
         orderedStepIds: appendOrderedStepId(base, event.stepId),
         stepsById: { ...base.stepsById, [event.stepId]: nextStep },

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -32,6 +32,7 @@ export type StagedDaytonaPayload = {
   workDir: string;
   command: string;
   readyPath: string;
+  startAckPath: string;
   outputPath: string;
   exitCodePath: string;
   progressEventPath: string;
@@ -389,6 +390,7 @@ export async function stageDaytonaRunnerPayload(input: {
   const outputPath = `${workDir}/deepline-play-output-${randomUUID()}.log`;
   const exitCodePath = `${workDir}/deepline-play-exit-${randomUUID()}.txt`;
   const readyPath = `${workDir}/deepline-play-ready-${randomUUID()}.json`;
+  const startAckPath = `${workDir}/deepline-play-start-ack-${randomUUID()}.json`;
   const progressEventPath = `${workDir}/deepline-play-progress-${randomUUID()}.jsonl`;
   const runnerTraceEnv =
     process.env.DEEPLINE_RUNTIME_RECEIPT_TRACE === '1'
@@ -401,18 +403,19 @@ export async function stageDaytonaRunnerPayload(input: {
     artifactCodePath,
     artifactSourceMapPath,
     crashPusherPath,
-  })} && DEEPLINE_PLAY_RUNNER_READY_PATH=${shellQuote(readyPath)} DEEPLINE_PLAY_RUNNER_PROGRESS_EVENT_PATH=${shellQuote(progressEventPath)} DEEPLINE_PLAY_RUNNER_STDOUT_EVENT_MODE=compact ${runnerTraceEnv}node ${shellQuote(runnerPath)} ${shellQuote(configPath)}`;
+  })} && DEEPLINE_PLAY_RUNNER_READY_PATH=${shellQuote(readyPath)} DEEPLINE_PLAY_RUNNER_START_ACK_PATH=${shellQuote(startAckPath)} DEEPLINE_PLAY_RUNNER_PROGRESS_EVENT_PATH=${shellQuote(progressEventPath)} DEEPLINE_PLAY_RUNNER_STDOUT_EVENT_MODE=compact ${runnerTraceEnv}node ${shellQuote(runnerPath)} ${shellQuote(configPath)}`;
   // Crash-containment epilogue: runs UNCONDITIONALLY after the runner exits and
   // pushes the parsed (or synthesized) terminal to the gateway so the parked
   // worker wakes within seconds of ANY runner death — process.exit abuse, OOM
   // SIGKILL, or a crash before the in-process push. Idempotent against a
   // successful in-runner push (terminals are first-write-wins).
-  const command = `rm -f ${shellQuote(outputPath)} ${shellQuote(exitCodePath)} ${shellQuote(readyPath)} ${shellQuote(progressEventPath)} ${shellQuote(`${progressEventPath}.*`)}; ( ${runnerCommand} ) > ${shellQuote(outputPath)} 2>&1; code=$?; printf '%s' "$code" > ${shellQuote(exitCodePath)}; node ${shellQuote(crashPusherPath)} ${shellQuote(configPath)} "$code" ${shellQuote(outputPath)} >> ${shellQuote(outputPath)} 2>&1 || true; printf 'deepline runner output captured: %s\\n' ${shellQuote(outputPath)}; exit "$code"`;
+  const command = `rm -f ${shellQuote(outputPath)} ${shellQuote(exitCodePath)} ${shellQuote(readyPath)} ${shellQuote(startAckPath)} ${shellQuote(progressEventPath)} ${shellQuote(`${progressEventPath}.*`)}; ( ${runnerCommand} ) > ${shellQuote(outputPath)} 2>&1; code=$?; printf '%s' "$code" > ${shellQuote(exitCodePath)}; node ${shellQuote(crashPusherPath)} ${shellQuote(configPath)} "$code" ${shellQuote(outputPath)} >> ${shellQuote(outputPath)} 2>&1 || true; printf 'deepline runner output captured: %s\\n' ${shellQuote(outputPath)}; exit "$code"`;
 
   return {
     workDir: input.workDir,
     command,
     readyPath,
+    startAckPath,
     outputPath,
     exitCodePath,
     progressEventPath,

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-session-execution.ts

@@ -1,6 +1,8 @@
 import type { DaytonaSandbox } from './daytona-lifecycle';
 
 export type DetachedDaytonaStartupDiagnostic = {
+  readyMarkerObserved: boolean;
+  startAcknowledgementAttempted: boolean;
   commandFound: boolean;
   exitCode: number | null;
   sessionFound: boolean;
@@ -51,6 +53,8 @@ export async function inspectDetachedDaytonaStartup(input: {
 }): Promise<DetachedDaytonaStartupDiagnostic> {
   const errors: string[] = [];
   const diagnostic: DetachedDaytonaStartupDiagnostic = {
+    readyMarkerObserved: false,
+    startAcknowledgementAttempted: false,
     commandFound: false,
     exitCode: null,
     sessionFound: false,
@@ -119,7 +123,10 @@ export const DAYTONA_RUNNER_READY_TIMEOUT_MS = 60_000;
 const DAYTONA_RUNNER_READY_POLL_MS = 250;
 
 export class DaytonaRunnerInitializationError extends Error {
-  constructor(message: string) {
+  constructor(
+    message: string,
+    readonly startupDiagnostic: DetachedDaytonaStartupDiagnostic,
+  ) {
     super(message);
     this.name = 'DaytonaRunnerInitializationError';
   }
@@ -163,6 +170,7 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
   sessionId: string;
   cmdId: string;
   readyPath: string;
+  startAckPath: string;
   exitCodePath: string;
   timeoutMs?: number;
   pollMs?: number;
@@ -180,6 +188,8 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
   const pollMs = Math.max(1, input.pollMs ?? DAYTONA_RUNNER_READY_POLL_MS);
   const deadline = now() + timeoutMs;
   let markerDiagnosis = 'ready_marker_unavailable';
+  let readyMarkerObserved = false;
+  let startAcknowledgementAttempted = false;
 
   while (now() < deadline) {
     try {
@@ -187,8 +197,21 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
       const parsed = JSON.parse(marker.toString('utf-8')) as {
         ready?: unknown;
       };
-      if (parsed.ready === true) return;
-      markerDiagnosis = 'ready_marker_invalid';
+      if (parsed.ready === true) {
+        readyMarkerObserved = true;
+        startAcknowledgementAttempted = true;
+        try {
+          await input.sandbox.fs.uploadFile(
+            Buffer.from('{"start":true}', 'utf-8'),
+            input.startAckPath,
+          );
+          return;
+        } catch {
+          markerDiagnosis = 'start_ack_unavailable';
+        }
+      } else {
+        markerDiagnosis = 'ready_marker_invalid';
+      }
     } catch {
       markerDiagnosis = 'ready_marker_unavailable';
     }
@@ -201,9 +224,12 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
     cmdId: input.cmdId,
     exitCodePath: input.exitCodePath,
   });
+  diagnostic.readyMarkerObserved = readyMarkerObserved;
+  diagnostic.startAcknowledgementAttempted = startAcknowledgementAttempted;
   const oomIndicated =
     diagnostic.exitCode === 137 || diagnostic.exitCodeFile === 137;
   throw new DaytonaRunnerInitializationError(
-    `RUNTIME_SANDBOX_START_FAILED: Daytona accepted detached command ${input.cmdId} in sandbox ${input.sandbox.id}, but the play runner did not materialize and establish receipt-gateway liveness within ${timeoutMs}ms. Marker diagnosis: ${markerDiagnosis}. Daytona diagnosis: ${JSON.stringify(diagnostic)}. OOM is ${oomIndicated ? 'indicated by exit code 137' : 'not confirmed by the available Daytona evidence'}. The play was stopped and was not retried.`,
+    `RUNTIME_SANDBOX_START_FAILED: Daytona accepted detached command ${input.cmdId} in sandbox ${input.sandbox.id}, but the play runner did not materialize and establish receipt-gateway liveness within ${timeoutMs}ms. Marker diagnosis: ${markerDiagnosis}. Daytona diagnosis: ${JSON.stringify(diagnostic)}. OOM is ${oomIndicated ? 'indicated by exit code 137' : 'not confirmed by the available Daytona evidence'}. The worker will not park this runner; the failed runner was stopped and was not retried in place.`,
+    diagnostic,
   );
 }

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -474,6 +474,27 @@ function isRetryableDaytonaInfrastructureFailure(error: unknown): boolean {
   return DAYTONA_INFRASTRUCTURE_RETRY_PATTERN.test(message);
 }
 
+function isRetryableUnstartedDaytonaRunner(
+  error: unknown,
+): error is DaytonaRunnerInitializationError {
+  if (!(error instanceof DaytonaRunnerInitializationError)) return false;
+  const diagnostic = error.startupDiagnostic;
+  // The ready fence runs before any customer play code. If Daytona accepted
+  // the command but the worker never observed its ready marker, the runner
+  // cannot pass the reverse start-ack fence and customer code cannot begin.
+  // Terminate that sandbox and retry once on a fresh one even when its Node
+  // process is still alive. Do not retry after a start acknowledgement was
+  // attempted (its write outcome may be ambiguous), or after a runner exit.
+  return (
+    diagnostic.commandFound &&
+    diagnostic.sessionFound &&
+    diagnostic.exitCode === null &&
+    diagnostic.exitCodeFile === null &&
+    !diagnostic.readyMarkerObserved &&
+    !diagnostic.startAcknowledgementAttempted
+  );
+}
+
 function prepareDaytonaExecution(
   input: PlayRunnerPrepareInput,
   callbacks: Parameters<PlayRunnerBackend['execute']>[1],
@@ -819,6 +840,7 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
               sessionId: start.sessionId,
               cmdId: start.cmdId,
               readyPath: stagedPayload.readyPath,
+              startAckPath: stagedPayload.startAckPath,
               exitCodePath: stagedPayload.exitCodePath,
             }),
             cancellationPromise,
@@ -868,6 +890,25 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
             onCancel();
             throw new Error(DAYTONA_CANCELLED_ERROR);
           }
+          if (
+            executionAttempt < DAYTONA_RUNTIME_INITIALIZATION_MAX_ATTEMPTS &&
+            isRetryableUnstartedDaytonaRunner(error)
+          ) {
+            emitDaytonaStage(callbacks, config.context, 'execute:retry', {
+              sandboxId: sandboxForAttempt?.id ?? null,
+              attempt: executionAttempt + 1,
+              reason: 'runner_startup_not_live',
+              error: error.message,
+              elapsedMs: Date.now() - startedAt,
+            });
+            if (sandboxForAttempt) {
+              activeAcquiredResource!.billingEndedAt = Date.now();
+              await reportRetiringRuntimeResource(activeAcquiredResource!);
+              sandboxCleanup.stashActiveSandboxForRetry();
+            }
+            acquiredSandboxPromise = sandboxLifecycle.createFreshSandbox();
+            continue;
+          }
           if (
             executionAttempt < DAYTONA_INFRASTRUCTURE_MAX_ATTEMPTS &&
             isRetryableDaytonaInfrastructureFailure(error)

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -2,7 +2,11 @@ export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED_SECRET]';
 
 const BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 const BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-const JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+// Bound each segment so V8 cannot recursively backtrack across a multi-megabyte
+// opaque receipt value that contains no dots. Real executor/provider JWT
+// segments are far smaller; 16 KiB per segment still leaves ample headroom.
+const JWT_RE =
+  /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 const SENSITIVE_FIELD_NAME =

package/dist/cli/index.js

@@ -627,10 +627,10 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
+  version: "0.1.240",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.240",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1371,7 +1371,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;

package/dist/cli/index.mjs

@@ -612,10 +612,10 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
+  version: "0.1.240",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.240",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1356,7 +1356,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;

package/dist/index.js

@@ -426,10 +426,10 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
+  version: "0.1.240",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.240",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1170,7 +1170,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;

package/dist/index.mjs

@@ -356,10 +356,10 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
+  version: "0.1.240",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.240",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1100,7 +1100,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.239",
+  "version": "0.1.240",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {