deepline 0.2.19 → 0.2.21

package/dist/cli/index.mjs

@@ -164,7 +164,7 @@ configureProxyFromEnv();
 
 // src/cli/index.ts
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile6 } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { tmpdir as tmpdir6 } from "os";
 import { Command as Command4 } from "commander";
 
@@ -1030,7 +1030,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.19",
+  version: "0.2.21",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1798,7 +1798,7 @@ function decodeSseFrame(frame) {
   return parsed;
 }
 function sleep(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function withCoworkNetworkHint(message) {
   if (!isCoworkLikeSandbox2() || message.includes(COWORK_NETWORK_HINT)) {
@@ -3100,14 +3100,14 @@ async function* observeRunEvents(options) {
   try {
     for (; ; ) {
       if (queue.length === 0) {
-        const waitForItem = new Promise((resolve18) => {
-          wake = resolve18;
+        const waitForItem = new Promise((resolve19) => {
+          wake = resolve19;
         });
         if (!sawFirstSnapshot) {
           const timedOut = await Promise.race([
             waitForItem.then(() => false),
             new Promise(
-              (resolve18) => setTimeout(() => resolve18(true), OBSERVE_BOOTSTRAP_TIMEOUT_MS)
+              (resolve19) => setTimeout(() => resolve19(true), OBSERVE_BOOTSTRAP_TIMEOUT_MS)
             )
           ]);
           if (timedOut && queue.length === 0) {
@@ -3417,7 +3417,7 @@ function parseEnvTestPolicyOverrides() {
   return normalizeTestPolicyOverrides(parsed, "DEEPLINE_TEST_POLICY_OVERRIDES");
 }
 function sleep2(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function isTransientCompileManifestError(error) {
   if (error instanceof DeeplineError && typeof error.statusCode === "number") {
@@ -6477,6 +6477,10 @@ function collectLocalEnvInfo() {
 function readCsvRows(csvPath) {
   const raw = readFileSync4(resolve2(csvPath), "utf-8");
   return parse(raw, {
+    // `csv-parse` otherwise treats a BOM before an opening quote as a field
+    // value, then rejects the quote as invalid. A UTF-8 BOM is a valid file
+    // prefix and must not become part of the first column name either.
+    bom: true,
     columns: true,
     skip_empty_lines: true
   });
@@ -6959,7 +6963,7 @@ function buildCandidateUrls2(url) {
   }
 }
 function sleep4(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function printDeeplineLogo() {
   if (process.stdout.isTTY && (process.stdout.columns ?? 80) >= 70) {
@@ -15960,27 +15964,6 @@ var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-
 var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
-var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
-var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN = /^bootstrap-[0-9a-f]{32}(?:\/[a-z0-9][a-z0-9_-]{0,127})?$/i;
-var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
-function shannonEntropy(value) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
-  return [...counts.values()].reduce((entropy, count) => {
-    const p = count / value.length;
-    return entropy - p * Math.log2(p);
-  }, 0);
-}
-function isNonSecretUuidIdentifier(value) {
-  const match = UUID_IDENTIFIER_PATTERN.exec(value);
-  if (!match) return false;
-  const label = match[1] ?? "";
-  return !SECRET_LABEL_PATTERN.test(label);
-}
-function isNonSecretBootstrapResourceIdentifier(value) {
-  return BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN.test(value);
-}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -15992,15 +15975,6 @@ function collectInlineSecretFindings(sourceCode) {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push("secret-looking assignment literal");
   }
-  for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
-    const literal = match[1] ?? "";
-    if (isNonSecretUuidIdentifier(literal)) continue;
-    if (isNonSecretBootstrapResourceIdentifier(literal)) continue;
-    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
-      findings.push("high-entropy string literal");
-      break;
-    }
-  }
   return [...new Set(findings)];
 }
 
@@ -17128,7 +17102,7 @@ function traceCliSync(phase, fields, run) {
   }
 }
 function sleep5(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function parseReferencedPlayTarget2(target) {
   const trimmed = target.trim();
@@ -25591,7 +25565,7 @@ function emitEnrichDebug(message) {
   );
 }
 function sleep6(ms) {
-  return new Promise((resolve18) => setTimeout(resolve18, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function enrichExportBackingRowsWaitMs() {
   const raw = process.env.DEEPLINE_ENRICH_EXPORT_BACKING_ROWS_WAIT_MS?.trim();
@@ -31763,7 +31737,7 @@ async function readHiddenLine(prompt, streams = {}) {
   }
   let value = "";
   inputStream.resume();
-  return await new Promise((resolve18, reject) => {
+  return await new Promise((resolve19, reject) => {
     let settled = false;
     const cleanup = () => {
       inputStream.off("data", onData);
@@ -31781,7 +31755,7 @@ async function readHiddenLine(prompt, streams = {}) {
       settled = true;
       outputStream.write("\n");
       cleanup();
-      resolve18(line);
+      resolve19(line);
     };
     const fail = (error) => {
       if (settled) return;
@@ -35242,17 +35216,17 @@ Notes:
 // src/cli/commands/update.ts
 import { spawn as spawn3 } from "child_process";
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync10,
   realpathSync as realpathSync3,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   renameSync,
   rmSync as rmSync4,
   unlinkSync,
   writeFileSync as writeFileSync15
 } from "fs";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname16, isAbsolute as isAbsolute5, join as join18, relative as relative4, resolve as resolve16 } from "path";
+import { dirname as dirname16, isAbsolute as isAbsolute6, join as join19, relative as relative5, resolve as resolve17 } from "path";
 
 // src/cli/commands/skills.ts
 import { spawn as spawn2 } from "child_process";
@@ -35556,7 +35530,7 @@ function readSkillsInstallState(path) {
   }
 }
 function runProcess(command, args, cwd) {
-  return new Promise((resolve18, reject) => {
+  return new Promise((resolve19, reject) => {
     const plan = resolveShellSpawn(command, args);
     const child = spawn2(plan.command, plan.args, {
       cwd,
@@ -35575,7 +35549,7 @@ function runProcess(command, args, cwd) {
         process.stderr.write(`skills@latest exited ${code}.
 `);
       }
-      resolve18(code ?? 1);
+      resolve19(code ?? 1);
     });
   });
 }
@@ -35769,6 +35743,166 @@ Examples:
   });
 }
 
+// src/cli/install-integrity.ts
+import { createRequire } from "module";
+import { existsSync as existsSync14, readFileSync as readFileSync14, statSync as statSync5 } from "fs";
+import { isAbsolute as isAbsolute5, join as join18, relative as relative4, resolve as resolve16 } from "path";
+var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
+  "dist/cli/index.mjs",
+  "dist/index.mjs",
+  "dist/index.d.ts",
+  "dist/plays/bundle-play-file.mjs",
+  "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
+  "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
+  "dist/bundling-sources/shared_libs/tool-execution-error.ts"
+];
+var SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES = [
+  "esbuild/package.json",
+  "esbuild/lib/main.js"
+];
+function safeRelativePath(value) {
+  if (typeof value !== "string" || !value || isAbsolute5(value)) return false;
+  const segments = value.split(/[\\/]+/);
+  return segments.every(
+    (segment) => Boolean(segment) && segment !== "." && segment !== ".."
+  );
+}
+function resolveContainedPath(root, value) {
+  if (!safeRelativePath(value)) return null;
+  const target = resolve16(root, value);
+  const relativeTarget = relative4(resolve16(root), target);
+  if (!relativeTarget || relativeTarget.startsWith("..") || isAbsolute5(relativeTarget)) {
+    return null;
+  }
+  return target;
+}
+function parseJson(path) {
+  return JSON.parse(readFileSync14(path, "utf8"));
+}
+function isFile(path) {
+  try {
+    return statSync5(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function readManifest(packageRoot) {
+  const packageJsonPath = join18(packageRoot, "package.json");
+  let packageJson;
+  try {
+    packageJson = parseJson(packageJsonPath);
+  } catch (error) {
+    return {
+      mode: "manifest",
+      invalidReason: `invalid Deepline package metadata: ${error.message}`,
+      missing: existsSync14(packageJsonPath) ? [] : ["deepline/package.json"]
+    };
+  }
+  if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline package metadata: expected an object"
+    };
+  }
+  const metadata = packageJson;
+  if (metadata.deepline !== void 0 && (!metadata.deepline || typeof metadata.deepline !== "object" || Array.isArray(metadata.deepline))) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline package metadata: deepline must be an object"
+    };
+  }
+  const declaration = metadata.deepline?.installIntegrity;
+  if (!declaration) {
+    return {
+      mode: "legacy",
+      manifest: {
+        schemaVersion: 1,
+        packageFiles: [...SDK_SIDECAR_CRITICAL_PACKAGE_FILES],
+        dependencyFiles: [...SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES]
+      }
+    };
+  }
+  if (declaration.schemaVersion !== 1 || !safeRelativePath(declaration.manifest)) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline install-integrity declaration"
+    };
+  }
+  const manifestPath = resolveContainedPath(packageRoot, declaration.manifest);
+  if (!manifestPath || !isFile(manifestPath)) {
+    return {
+      mode: "manifest",
+      invalidReason: "declared Deepline install-integrity manifest is missing",
+      missing: [String(declaration.manifest)]
+    };
+  }
+  let raw;
+  try {
+    raw = parseJson(manifestPath);
+  } catch (error) {
+    return {
+      mode: "manifest",
+      invalidReason: `invalid Deepline install-integrity manifest: ${error.message}`
+    };
+  }
+  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !Array.isArray(raw.packageFiles) || !Array.isArray(raw.dependencyFiles)) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline install-integrity manifest schema"
+    };
+  }
+  const manifest = raw;
+  if (manifest.packageFiles.length === 0 || manifest.dependencyFiles.length === 0 || !manifest.packageFiles.every(safeRelativePath) || !manifest.dependencyFiles.every(safeRelativePath)) {
+    return {
+      mode: "manifest",
+      invalidReason: "unsafe path in Deepline install-integrity manifest"
+    };
+  }
+  return { mode: "manifest", manifest };
+}
+function inspectSdkSidecarInstall(versionDir) {
+  const nodeModulesRoot = join18(versionDir, "node_modules");
+  const packageRoot = join18(nodeModulesRoot, "deepline");
+  const manifestResult = readManifest(packageRoot);
+  if ("invalidReason" in manifestResult) {
+    return {
+      ok: false,
+      missing: manifestResult.missing ?? [],
+      invalidReason: manifestResult.invalidReason,
+      mode: manifestResult.mode
+    };
+  }
+  const missing = [
+    ...manifestResult.manifest.packageFiles.filter((path) => !isFile(join18(packageRoot, path))).map((path) => `deepline/${path}`),
+    ...manifestResult.manifest.dependencyFiles.filter((path) => !isFile(join18(nodeModulesRoot, path))).map((path) => `node_modules/${path}`)
+  ];
+  return {
+    ok: missing.length === 0,
+    missing,
+    invalidReason: null,
+    mode: manifestResult.mode
+  };
+}
+function probeSdkSidecarEsbuild(versionDir) {
+  try {
+    const requireFromInstall = createRequire(join18(versionDir, "package.json"));
+    const esbuild = requireFromInstall("esbuild");
+    if (typeof esbuild.transformSync !== "function") {
+      return "esbuild does not export transformSync";
+    }
+    const result = esbuild.transformSync("const value: number = 1;", {
+      loader: "ts"
+    });
+    if (typeof result?.code !== "string") {
+      return "esbuild transform probe returned no code";
+    }
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+
 // src/cli/commands/update.ts
 var NPM_SDK_INSTALL_COMMON_FLAGS = [
   "--no-audit",
@@ -35824,7 +35958,7 @@ function sidecarStateDir(input2) {
   if (!scope || scope.includes("/") || scope.includes("\\")) {
     return null;
   }
-  return join18(input2.homeDir, ".local", "deepline", scope, "sdk-cli");
+  return join19(input2.homeDir, ".local", "deepline", scope, "sdk-cli");
 }
 function sidecarRegistryUrl(hostUrl) {
   let url;
@@ -35851,7 +35985,7 @@ function publicNpmFallbackRegistryUrl(hostUrl) {
 }
 function readOptionalText(path) {
   try {
-    return readFileSync14(path, "utf8").trim();
+    return readFileSync15(path, "utf8").trim();
   } catch {
     return "";
   }
@@ -35859,19 +35993,19 @@ function readOptionalText(path) {
 function resolvePythonSidecarUpdatePlan(options) {
   const stateDir = sidecarStateDir(options);
   if (!stateDir) return null;
-  const relativeEntrypoint = relative4(
-    resolve16(stateDir),
-    resolve16(options.entrypoint)
+  const relativeEntrypoint = relative5(
+    resolve17(stateDir),
+    resolve17(options.entrypoint)
   );
-  if (!relativeEntrypoint || relativeEntrypoint.startsWith("..") || isAbsolute5(relativeEntrypoint)) {
+  if (!relativeEntrypoint || relativeEntrypoint.startsWith("..") || isAbsolute6(relativeEntrypoint)) {
     return null;
   }
-  const installMethod = readOptionalText(join18(stateDir, ".install-method"));
+  const installMethod = readOptionalText(join19(stateDir, ".install-method"));
   if (installMethod !== "python-sidecar") return null;
   const scope = options.env.DEEPLINE_CONFIG_SCOPE?.trim() || "";
   const hostUrl = options.env.DEEPLINE_HOST_URL?.trim() || "";
-  const nodeBin = readOptionalText(join18(stateDir, ".node-bin")) || process.execPath;
-  const sidecarPath = readOptionalText(join18(stateDir, ".command-path")) || join18(
+  const nodeBin = readOptionalText(join19(stateDir, ".node-bin")) || process.execPath;
+  const sidecarPath = readOptionalText(join19(stateDir, ".command-path")) || join19(
     stateDir,
     "bin",
     process.platform === "win32" ? "deepline-sdk.cmd" : "deepline-sdk"
@@ -35879,7 +36013,7 @@ function resolvePythonSidecarUpdatePlan(options) {
   const packageSpec = options.packageSpec || "deepline@latest";
   const npmCommand = "npm";
   const registryUrl = sidecarRegistryUrl(hostUrl);
-  const versionDir = join18(stateDir, "versions", "<version>");
+  const versionDir = join19(stateDir, "versions", "<version>");
   const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote4(versionDir)} --registry ${shellQuote4(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote4).join(" ")} ${shellQuote4(packageSpec)}`;
   return {
     kind: "python-sidecar",
@@ -35895,9 +36029,9 @@ function resolvePythonSidecarUpdatePlan(options) {
   };
 }
 function findRepoBackedSdkRoot(startPath) {
-  let current = resolve16(startPath);
+  let current = resolve17(startPath);
   while (true) {
-    if (existsSync14(join18(current, "sdk", "package.json")) && existsSync14(join18(current, "sdk", "bin", "deepline-dev.ts"))) {
+    if (existsSync15(join19(current, "sdk", "package.json")) && existsSync15(join19(current, "sdk", "bin", "deepline-dev.ts"))) {
       return current;
     }
     const parent = dirname16(current);
@@ -35910,7 +36044,7 @@ function inferNpmGlobalPrefixFromEntrypoint(entrypoint) {
     try {
       return realpathSync3(entrypoint);
     } catch {
-      return resolve16(entrypoint);
+      return resolve17(entrypoint);
     }
   })();
   const parts = normalized.split(/[\\/]+/);
@@ -35931,7 +36065,7 @@ function isHomebrewFormulaEntrypoint(entrypoint) {
     try {
       return realpathSync3(entrypoint);
     } catch {
-      return resolve16(entrypoint);
+      return resolve17(entrypoint);
     }
   })();
   const parts = normalized.split(/[\\/]+/);
@@ -35941,7 +36075,7 @@ function isHomebrewFormulaEntrypoint(entrypoint) {
 function resolveUpdatePlan(options = {}) {
   const env = options.env ?? process.env;
   const homeDir2 = options.homeDir ?? homedir12();
-  const entrypoint = options.entrypoint ?? (process.argv[1] ? resolve16(process.argv[1]) : "");
+  const entrypoint = options.entrypoint ?? (process.argv[1] ? resolve17(process.argv[1]) : "");
   const sourceRoot = entrypoint ? findRepoBackedSdkRoot(dirname16(entrypoint)) : null;
   if (sourceRoot) {
     return {
@@ -35989,9 +36123,9 @@ var AUTO_UPDATE_FAILURE_FILE = ".auto-update-failure.json";
 function autoUpdateFailurePath(plan) {
   if (plan.kind === "source" || plan.kind === "homebrew") return null;
   if (plan.kind === "python-sidecar") {
-    return join18(plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
+    return join19(plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
   }
-  return join18(
+  return join19(
     homedir12(),
     ".local",
     "deepline",
@@ -36009,7 +36143,7 @@ function readAutoUpdateFailure(plan) {
   if (!path) return null;
   try {
     const parsed = JSON.parse(
-      readFileSync14(path, "utf8")
+      readFileSync15(path, "utf8")
     );
     if ((parsed.kind === "npm-global" || parsed.kind === "python-sidecar") && typeof parsed.packageSpec === "string" && typeof parsed.failedAt === "string" && typeof parsed.exitCode === "number" && typeof parsed.manualCommand === "string") {
       return parsed;
@@ -36078,7 +36212,7 @@ function safeVersionSegment(value) {
   return /^[0-9A-Za-z._-]+$/.test(normalized) ? normalized : "";
 }
 function entryPathInVersionDir(versionDir) {
-  return join18(
+  return join19(
     versionDir,
     "node_modules",
     "deepline",
@@ -36088,19 +36222,36 @@ function entryPathInVersionDir(versionDir) {
   );
 }
 function installedPackageVersion(versionDir) {
-  const packageJsonPath = join18(
+  const packageJsonPath = join19(
     versionDir,
     "node_modules",
     "deepline",
     "package.json"
   );
   try {
-    const parsed = JSON.parse(readFileSync14(packageJsonPath, "utf8"));
+    const parsed = JSON.parse(readFileSync15(packageJsonPath, "utf8"));
     return typeof parsed.version === "string" ? safeVersionSegment(parsed.version) : "";
   } catch {
     return "";
   }
 }
+function sidecarStructureFailure(versionDir) {
+  const health = inspectSdkSidecarInstall(versionDir);
+  if (!health.ok) {
+    const details = [
+      ...health.invalidReason ? [health.invalidReason] : [],
+      ...health.missing.length > 0 ? [`missing ${health.missing.join(", ")}`] : []
+    ].join("; ");
+    return details || "required SDK CLI files are missing";
+  }
+  return null;
+}
+function sidecarInstallFailure(versionDir) {
+  const structureFailure = sidecarStructureFailure(versionDir);
+  if (structureFailure) return structureFailure;
+  const esbuildFailure = probeSdkSidecarEsbuild(versionDir);
+  return esbuildFailure ? `esbuild probe failed: ${esbuildFailure}` : null;
+}
 function runCommand(command, args, env = process.env) {
   return new Promise((resolveResult) => {
     let output2 = "";
@@ -36173,13 +36324,35 @@ async function runNpmInstallWithRegistryFallback(input2) {
 }
 function writeSidecarLauncher(input2) {
   mkdirSync10(dirname16(input2.path), { recursive: true });
+  const packageRoot = dirname16(dirname16(dirname16(input2.entryPath)));
+  const versionDir = dirname16(dirname16(packageRoot));
+  const esbuildProbe = "const {createRequire}=require('node:module');const path=require('node:path');const req=createRequire(path.join(process.argv[1],'package.json'));const result=req('esbuild').transformSync('const value: number = 1;',{loader:'ts'});if(!result||typeof result.code!=='string')process.exit(3);";
+  const criticalPaths = [
+    ...SDK_SIDECAR_CRITICAL_PACKAGE_FILES.map(
+      (path) => join19(packageRoot, path)
+    ),
+    ...SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES.map(
+      (path) => join19(versionDir, "node_modules", path)
+    )
+  ];
   if (process.platform === "win32") {
     writeFileSync15(
       input2.path,
       [
         `@set DEEPLINE_HOST_URL=${input2.hostUrl.replace(/\r?\n/g, "")}`,
         `@set DEEPLINE_CONFIG_SCOPE=${input2.scope.replace(/\r?\n/g, "")}`,
+        ...criticalPaths.map(
+          (path) => `@if not exist "${path}" goto repair_sdk`
+        ),
+        `@"${input2.nodeBin}" -e "${esbuildProbe}" "${versionDir}" >NUL 2>&1`,
+        "@if errorlevel 1 goto repair_sdk",
         `@"${input2.nodeBin}" "${input2.entryPath}" %*`,
+        "@exit /b %ERRORLEVEL%",
+        ":repair_sdk",
+        '@if defined DEEPLINE_REAL_BINARY "%DEEPLINE_REAL_BINARY%" --version=v2 %*',
+        "@if defined DEEPLINE_REAL_BINARY exit /b %ERRORLEVEL%",
+        "@echo Deepline SDK CLI install is incomplete. Run `deepline update` to repair it. 1>&2",
+        "@exit /b 1",
         ""
       ].join("\r\n"),
       "utf8"
@@ -36192,6 +36365,20 @@ function writeSidecarLauncher(input2) {
       "#!/usr/bin/env sh",
       `export DEEPLINE_HOST_URL=${shellQuote4(input2.hostUrl)}`,
       `export DEEPLINE_CONFIG_SCOPE=${shellQuote4(input2.scope)}`,
+      `if ${criticalPaths.map((path) => `[ ! -f ${shellQuote4(path)} ]`).join(" || ")}; then`,
+      '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
+      '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
+      "  fi",
+      '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
+      "  exit 1",
+      "fi",
+      `if ! ${shellQuote4(input2.nodeBin)} -e ${shellQuote4(esbuildProbe)} ${shellQuote4(versionDir)} >/dev/null 2>&1; then`,
+      '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
+      '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
+      "  fi",
+      '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
+      "  exit 1",
+      "fi",
       `exec ${shellQuote4(input2.nodeBin)} ${shellQuote4(input2.entryPath)} "$@"`,
       ""
     ].join("\n"),
@@ -36199,14 +36386,14 @@ function writeSidecarLauncher(input2) {
   );
 }
 async function runPythonSidecarUpdatePlan(plan) {
-  const versionsDir = join18(plan.stateDir, "versions");
-  const tempDir = join18(
+  const versionsDir = join19(plan.stateDir, "versions");
+  const tempDir = join19(
     versionsDir,
     `.tmp-sdk-update-${process.pid}-${Date.now()}`
   );
   rmSync4(tempDir, { recursive: true, force: true });
   mkdirSync10(tempDir, { recursive: true });
-  writeFileSync15(join18(tempDir, "package.json"), NPM_SDK_SIDECAR_PACKAGE_JSON);
+  writeFileSync15(join19(tempDir, "package.json"), NPM_SDK_SIDECAR_PACKAGE_JSON);
   const env = {
     ...process.env,
     PATH: `${dirname16(plan.nodeBin)}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
@@ -36237,30 +36424,91 @@ async function runPythonSidecarUpdatePlan(plan) {
     rmSync4(tempDir, { recursive: true, force: true });
     return 1;
   }
-  const finalDir = join18(versionsDir, installedVersion);
+  const stagedFailure = sidecarInstallFailure(tempDir);
+  if (stagedFailure) {
+    process.stderr.write(
+      `Updated Deepline SDK package is incomplete: ${stagedFailure}.
+`
+    );
+    rmSync4(tempDir, { recursive: true, force: true });
+    return 1;
+  }
+  const finalDir = join19(versionsDir, installedVersion);
   const finalEntryPath = entryPathInVersionDir(finalDir);
-  if (existsSync14(finalEntryPath)) {
+  const finalFailure = sidecarInstallFailure(finalDir);
+  let backupDir = null;
+  if (!finalFailure) {
     rmSync4(tempDir, { recursive: true, force: true });
   } else {
-    rmSync4(finalDir, { recursive: true, force: true });
-    try {
-      renameSync(tempDir, finalDir);
-    } catch (error) {
-      rmSync4(tempDir, { recursive: true, force: true });
-      process.stderr.write(
-        `Failed to publish Deepline SDK sidecar update: ${error.message}
-`
+    let shouldPublishTemp = true;
+    if (existsSync15(finalDir)) {
+      backupDir = join19(
+        versionsDir,
+        `.backup-${installedVersion}-${process.pid}-${Date.now()}`
       );
-      return 1;
+      try {
+        renameSync(finalDir, backupDir);
+      } catch (error) {
+        const concurrentlyPublishedFailure = sidecarInstallFailure(finalDir);
+        if (!concurrentlyPublishedFailure) {
+          rmSync4(tempDir, { recursive: true, force: true });
+          backupDir = null;
+          shouldPublishTemp = false;
+        } else {
+          rmSync4(tempDir, { recursive: true, force: true });
+          process.stderr.write(
+            `Failed to preserve the incomplete Deepline SDK sidecar before repair: ${error.message}.
+`
+          );
+          return 1;
+        }
+      }
+    }
+    if (shouldPublishTemp) {
+      try {
+        renameSync(tempDir, finalDir);
+      } catch (error) {
+        rmSync4(tempDir, { recursive: true, force: true });
+        const concurrentlyPublishedFailure = sidecarInstallFailure(finalDir);
+        if (!concurrentlyPublishedFailure) {
+          if (backupDir) rmSync4(backupDir, { recursive: true, force: true });
+          backupDir = null;
+        } else {
+          let restoreFailure = "";
+          if (backupDir && existsSync15(backupDir) && !existsSync15(finalDir)) {
+            try {
+              renameSync(backupDir, finalDir);
+              backupDir = null;
+            } catch (restoreError) {
+              restoreFailure = `; failed to restore previous install: ${restoreError.message}`;
+            }
+          }
+          process.stderr.write(
+            `Failed to publish Deepline SDK sidecar update: ${error.message}; current install remains incomplete: ${concurrentlyPublishedFailure}${restoreFailure}.
+`
+          );
+          return 1;
+        }
+      }
     }
   }
-  if (!existsSync14(finalEntryPath)) {
+  const publishedFailure = sidecarStructureFailure(finalDir);
+  if (publishedFailure) {
+    if (backupDir && existsSync15(backupDir)) {
+      rmSync4(finalDir, { recursive: true, force: true });
+      try {
+        renameSync(backupDir, finalDir);
+        backupDir = null;
+      } catch {
+      }
+    }
     process.stderr.write(
-      `Updated Deepline SDK CLI entrypoint missing: ${finalEntryPath}
+      `Updated Deepline SDK CLI install is incomplete: ${publishedFailure}.
 `
     );
     return 1;
   }
+  if (backupDir) rmSync4(backupDir, { recursive: true, force: true });
   writeSidecarLauncher({
     path: plan.sidecarPath,
     hostUrl: plan.hostUrl,
@@ -36269,27 +36517,27 @@ async function runPythonSidecarUpdatePlan(plan) {
     entryPath: finalEntryPath
   });
   writeFileSync15(
-    join18(plan.stateDir, ".version"),
+    join19(plan.stateDir, ".version"),
     `${installedVersion}
 `,
     "utf8"
   );
   writeFileSync15(
-    join18(plan.stateDir, ".install-method"),
+    join19(plan.stateDir, ".install-method"),
     "python-sidecar\n",
     "utf8"
   );
   writeFileSync15(
-    join18(plan.stateDir, ".command-path"),
+    join19(plan.stateDir, ".command-path"),
     `${plan.sidecarPath}
 `,
     "utf8"
   );
-  writeFileSync15(join18(plan.stateDir, ".runner"), "node\n", "utf8");
-  writeFileSync15(join18(plan.stateDir, ".node-bin"), `${plan.nodeBin}
+  writeFileSync15(join19(plan.stateDir, ".runner"), "node\n", "utf8");
+  writeFileSync15(join19(plan.stateDir, ".node-bin"), `${plan.nodeBin}
 `, "utf8");
   writeFileSync15(
-    join18(plan.stateDir, ".entry-path"),
+    join19(plan.stateDir, ".entry-path"),
     `${finalEntryPath}
 `,
     "utf8"
@@ -36413,16 +36661,16 @@ Examples:
 // src/cli/commands/setup.ts
 import { spawnSync } from "child_process";
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   lstatSync,
   mkdirSync as mkdirSync11,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync4,
   rmSync as rmSync5,
   writeFileSync as writeFileSync16
 } from "fs";
 import { homedir as homedir13 } from "os";
-import { dirname as dirname17, join as join19, resolve as resolve17 } from "path";
+import { dirname as dirname17, join as join20, resolve as resolve18 } from "path";
 var SETUP_PHASE_NAMES = [
   "cli",
   "cleanup",
@@ -36479,7 +36727,7 @@ function phasesFromLegacyStatus(status) {
 function readSetupState(input2) {
   try {
     const parsed = JSON.parse(
-      readFileSync15(
+      readFileSync16(
         setupStatePath(input2.baseUrl, input2.scope, input2.root),
         "utf8"
       )
@@ -36555,7 +36803,7 @@ function buildPendingAuthorizationOutput(input2) {
   };
 }
 function setupStatePath(baseUrl, scope, root) {
-  return scope === "local" && root ? join19(root, ".deepline", "setup", "state.json") : join19(sdkCliStateDirPath(baseUrl), "setup.json");
+  return scope === "local" && root ? join20(root, ".deepline", "setup", "state.json") : join20(sdkCliStateDirPath(baseUrl), "setup.json");
 }
 async function captureStdout2(run) {
   let stdout = "";
@@ -36584,14 +36832,14 @@ function asRecord3(value) {
 }
 function safeRead(path) {
   try {
-    return readFileSync15(path, "utf8");
+    return readFileSync16(path, "utf8");
   } catch {
     return "";
   }
 }
 function isNpmManagedDeeplinePath(path) {
   try {
-    return realpathSync4(path).includes(`${join19("node_modules", "deepline")}`);
+    return realpathSync4(path).includes(`${join20("node_modules", "deepline")}`);
   } catch {
     return false;
   }
@@ -36602,28 +36850,28 @@ function isInstallerManagedLegacyLauncher(path) {
 }
 function removeKnownLegacyPaths(baseUrl) {
   const home = homedir13();
-  const hostDir = join19(home, ".local", "deepline", baseUrlSlug(baseUrl));
-  const legacyLauncherPath = join19(home, ".local", "bin", "deepline");
+  const hostDir = join20(home, ".local", "deepline", baseUrlSlug(baseUrl));
+  const legacyLauncherPath = join20(home, ".local", "bin", "deepline");
   const installerCommandPath = safeRead(
-    join19(hostDir, "sdk", ".command-path")
+    join20(hostDir, "sdk", ".command-path")
   ).trim();
   const candidates = [
     ...isInstallerManagedLegacyLauncher(legacyLauncherPath) ? [legacyLauncherPath] : [],
-    join19(home, ".local", "bin", "deepline-real"),
-    join19(hostDir, "bin", "deepline"),
-    join19(hostDir, "bin", "deepline-real"),
-    join19(hostDir, "cli", ".install-method"),
-    join19(hostDir, "cli", ".version"),
-    join19(hostDir, "sdk", ".install-method"),
-    join19(hostDir, "sdk", ".command-path"),
+    join20(home, ".local", "bin", "deepline-real"),
+    join20(hostDir, "bin", "deepline"),
+    join20(hostDir, "bin", "deepline-real"),
+    join20(hostDir, "cli", ".install-method"),
+    join20(hostDir, "cli", ".version"),
+    join20(hostDir, "sdk", ".install-method"),
+    join20(hostDir, "sdk", ".command-path"),
     ...installerCommandPath ? [
       installerCommandPath,
-      join19(dirname17(installerCommandPath), "deepline-sdk")
+      join20(dirname17(installerCommandPath), "deepline-sdk")
     ] : []
   ];
   const removed = [];
   for (const path of candidates) {
-    if (!existsSync15(path)) continue;
+    if (!existsSync16(path)) continue;
     if (path === installerCommandPath && isNpmManagedDeeplinePath(path)) {
       continue;
     }
@@ -36640,7 +36888,7 @@ function resolvePathCommands(command) {
   );
   return [
     ...new Set(
-      String(lookup.stdout ?? "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((path) => resolve17(path))
+      String(lookup.stdout ?? "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((path) => resolve18(path))
     )
   ];
 }
@@ -36661,7 +36909,7 @@ function isHomebrewFormulaCommand(path) {
 function resolvePersistentGlobalCommand(dependencies = {}) {
   const platform3 = dependencies.platform ?? process.platform;
   const run = dependencies.spawn ?? spawnSync;
-  const pathExists = dependencies.exists ?? existsSync15;
+  const pathExists = dependencies.exists ?? existsSync16;
   const pathClis = dependencies.pathClis ?? resolvePathCommands("deepline");
   const homebrewCommand = pathClis.find(isHomebrewFormulaCommand);
   if (homebrewCommand) return homebrewCommand;
@@ -36673,7 +36921,7 @@ function resolvePersistentGlobalCommand(dependencies = {}) {
   if (prefix.status !== 0) return null;
   const root = String(prefix.stdout ?? "").trim();
   if (!root) return null;
-  const candidates = platform3 === "win32" ? [join19(root, "deepline.cmd"), join19(root, "deepline")] : [join19(root, "bin", "deepline")];
+  const candidates = platform3 === "win32" ? [join20(root, "deepline.cmd"), join20(root, "deepline")] : [join20(root, "bin", "deepline")];
   return candidates.find((candidate) => pathExists(candidate)) ?? null;
 }
 function inspectGlobalCliAvailability(input2) {
@@ -36688,18 +36936,18 @@ function pathsResolveToSameFile(left, right) {
   try {
     return realpathSync4(left) === realpathSync4(right);
   } catch {
-    return resolve17(left) === resolve17(right);
+    return resolve18(left) === resolve18(right);
   }
 }
 function isKnownDeeplineCommand(path) {
-  const entrypoint = process.argv[1] ? resolve17(process.argv[1]) : "";
+  const entrypoint = process.argv[1] ? resolve18(process.argv[1]) : "";
   let resolvedPath = path;
   try {
     resolvedPath = realpathSync4(path);
   } catch {
   }
   if (entrypoint && resolvedPath === entrypoint) return true;
-  if (resolvedPath.includes(`${join19("node_modules", "deepline")}`)) return true;
+  if (resolvedPath.includes(`${join20("node_modules", "deepline")}`)) return true;
   const content = safeRead(path);
   return content.includes("node_modules/deepline") || content.includes("node_modules\\deepline") || content.includes("DEEPLINE_CONFIG_SCOPE") || content.includes("deepline-real");
 }
@@ -36709,7 +36957,7 @@ function inspectPathConflict() {
   try {
     if (lstatSync(commandPath).isSymbolicLink()) {
       const target = realpathSync4(commandPath);
-      if (target.includes(`${join19("node_modules", "deepline")}`)) return null;
+      if (target.includes(`${join20("node_modules", "deepline")}`)) return null;
     }
   } catch {
   }
@@ -36758,7 +37006,7 @@ function failSetupPhase(phases, phase, code) {
   phases[phase] = { status: "failed", code };
 }
 function rollbackCommand(scope, root) {
-  const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify(join19(root, ".deepline", "runtime"))}` : "";
+  const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify(join20(root, ".deepline", "runtime"))}` : "";
   return `npm install -g${prefix} --no-audit --no-fund --include=optional --allow-scripts=esbuild deepline@${SDK_VERSION}`;
 }
 function setupResumeCommand(baseUrl, scope) {
@@ -36845,12 +37093,12 @@ function buildDoctorAssessment(input2) {
   const connected = input2.authStatus.payload?.connected === true;
   const authScopeOk = input2.scope === "local" ? Boolean(projectAuth) : Boolean(apiKey && !projectAuth);
   const skillsOk = skillsState?.scope === input2.scope && typeof skillsState.skillsVersion === "string" && Array.isArray(skillsState.agents) && skillsState.agents.length > 0;
-  const runningCliPath = process.argv[1] ? resolve17(process.argv[1]) : null;
+  const runningCliPath = process.argv[1] ? resolve18(process.argv[1]) : null;
   const globalCli = input2.scope === "global" ? inspectGlobalCliAvailability() : null;
   const pathGlobalCli = globalCli?.path ?? null;
   const cliPath = input2.scope === "global" ? pathGlobalCli : runningCliPath;
   const cliScopeOk = input2.scope === "global" ? Boolean(pathGlobalCli) : Boolean(
-    input2.root && runningCliPath?.includes(join19(input2.root, ".deepline", "runtime"))
+    input2.root && runningCliPath?.includes(join20(input2.root, ".deepline", "runtime"))
   );
   const checks = {
     cli: {
@@ -37496,7 +37744,7 @@ function isDowngradeAutoUpdateResponse(response) {
   return compareSemver(target, current) < 0;
 }
 function relaunchCurrentCommand(plan) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const command = plan.kind === "python-sidecar" ? plan.sidecarPath : process.execPath;
     const args = plan.kind === "python-sidecar" ? process.argv.slice(2) : process.argv.slice(1);
     const child = spawn4(command, args, {
@@ -37512,9 +37760,9 @@ function relaunchCurrentCommand(plan) {
         `Deepline SDK/CLI updated, but relaunch failed: ${error.message}
 `
       );
-      resolve18(1);
+      resolve19(1);
     });
-    child.on("close", (code) => resolve18(code ?? 1));
+    child.on("close", (code) => resolve19(code ?? 1));
   });
 }
 async function maybeAutoUpdateAndRelaunch(response) {
@@ -37566,13 +37814,13 @@ async function maybeAutoUpdateAndRelaunch(response) {
 // src/cli/skills-sync.ts
 import { spawn as spawn5, spawnSync as spawnSync2 } from "child_process";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync17
 } from "fs";
-import { dirname as dirname18, join as join20 } from "path";
+import { dirname as dirname18, join as join21 } from "path";
 var CHECK_TIMEOUT_MS2 = 3e3;
 var attemptedSync = false;
 function shouldSkipSkillsSync() {
@@ -37588,33 +37836,33 @@ function activePluginSkillsDir() {
     return "";
   }
   const dir = process.env.DEEPLINE_PLUGIN_SKILLS_DIR?.trim() ?? "";
-  return dir && existsSync16(dir) ? dir : "";
+  return dir && existsSync17(dir) ? dir : "";
 }
 function readPluginSkillsVersion() {
   const dir = activePluginSkillsDir();
   if (!dir) return "";
   try {
-    return readFileSync16(join20(dir, ".version"), "utf-8").trim();
+    return readFileSync17(join21(dir, ".version"), "utf-8").trim();
   } catch {
     return "";
   }
 }
 function sdkSkillsVersionPath(baseUrl) {
-  return join20(sdkCliStateDirPath(baseUrl), "skills-version");
+  return join21(sdkCliStateDirPath(baseUrl), "skills-version");
 }
 function legacySdkSkillsVersionPath(baseUrl) {
-  return join20(dirname18(sdkCliStateDirPath(baseUrl)), "sdk-skills", ".version");
+  return join21(dirname18(sdkCliStateDirPath(baseUrl)), "sdk-skills", ".version");
 }
 function unavailableSkillsNoticePath(baseUrl) {
-  return join20(sdkCliStateDirPath(baseUrl), "skills-sync-unavailable-version");
+  return join21(sdkCliStateDirPath(baseUrl), "skills-sync-unavailable-version");
 }
 function readSdkSkillsLocalVersion(baseUrl) {
   const pluginVersion = readPluginSkillsVersion();
   if (pluginVersion) return pluginVersion;
-  const path = existsSync16(sdkSkillsVersionPath(baseUrl)) ? sdkSkillsVersionPath(baseUrl) : legacySdkSkillsVersionPath(baseUrl);
-  if (!existsSync16(path)) return "";
+  const path = existsSync17(sdkSkillsVersionPath(baseUrl)) ? sdkSkillsVersionPath(baseUrl) : legacySdkSkillsVersionPath(baseUrl);
+  if (!existsSync17(path)) return "";
   try {
-    return readFileSync16(path, "utf-8").trim();
+    return readFileSync17(path, "utf-8").trim();
   } catch {
     return "";
   }
@@ -37628,7 +37876,7 @@ function writeLocalSkillsVersion(baseUrl, version) {
 function writeUnavailableSkillsNotice(baseUrl, remoteVersion, skillNames) {
   const path = unavailableSkillsNoticePath(baseUrl);
   try {
-    if (existsSync16(path) && readFileSync16(path, "utf-8").trim() === remoteVersion) {
+    if (existsSync17(path) && readFileSync17(path, "utf-8").trim() === remoteVersion) {
       return;
     }
     mkdirSync12(dirname18(path), { recursive: true });
@@ -37766,7 +38014,7 @@ function resolveSkillsInstallCommands(baseUrl, skillNames = DEFAULT_SDK_SKILL_NA
   return commands;
 }
 function runOneSkillsInstall(install) {
-  return new Promise((resolve18) => {
+  return new Promise((resolve19) => {
     const plan = resolveSkillsInstallSpawn(install);
     const child = spawn5(plan.command, plan.args, {
       stdio: ["ignore", "ignore", "pipe"],
@@ -37778,7 +38026,7 @@ function runOneSkillsInstall(install) {
       stderr += chunk.toString("utf-8");
     });
     child.on("error", (error) => {
-      resolve18({
+      resolve19({
         ok: false,
         detail: `failed to start ${install.command}: ${error.message}`,
         manualCommand: install.manualCommand
@@ -37786,11 +38034,11 @@ function runOneSkillsInstall(install) {
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve18({ ok: true, detail: "", manualCommand: install.manualCommand });
+        resolve19({ ok: true, detail: "", manualCommand: install.manualCommand });
         return;
       }
       const detail = stderr.trim();
-      resolve18({
+      resolve19({
         ok: false,
         detail: detail ? `${install.command}: ${detail}` : `${install.command} exited ${code}`,
         manualCommand: install.manualCommand
@@ -38218,8 +38466,8 @@ function topLevelCommandKnown(program, commandName) {
   );
 }
 async function runPlayRunnerHealthCheck() {
-  const dir = await mkdtemp2(join21(tmpdir6(), "deepline-health-play-"));
-  const file = join21(dir, "health-check.play.ts");
+  const dir = await mkdtemp2(join22(tmpdir6(), "deepline-health-play-"));
+  const file = join22(dir, "health-check.play.ts");
   try {
     await writeFile6(
       file,