deepline 0.3.123 → 0.3.125

package/dist/cli/index.mjs

@@ -3063,7 +3063,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.123",
+  version: "0.3.125",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -6914,7 +6914,7 @@ function playRunStatusFromState(state) {
     ..."result" in state ? { result: state.result } : {}
   };
 }
-var DeeplineClient = class {
+var DeeplineClient = class _DeeplineClient {
   http;
   config;
   /** Canonical run lifecycle namespace backed by `/api/v2/runs`. */
@@ -9839,9 +9839,16 @@ var DeeplineClient = class {
   // ——————————————————————————————————————————————————————————
   // Monitor Jobs, Batches, and Fleets
   // ——————————————————————————————————————————————————————————
+  static MONITOR_JOB_IDEMPOTENCY_KEY_MAX_LENGTH = 96;
   monitorJobIdempotencyKey(operation) {
-    const uuid = globalThis.crypto?.randomUUID?.();
-    return `monitor-job-${operation}-${uuid ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`}`;
+    const uuid = globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const prefix = "monitor-job-";
+    const safeOperation = operation.replace(/[^A-Za-z0-9._-]/g, "-");
+    const maxOperationLength = Math.max(
+      0,
+      _DeeplineClient.MONITOR_JOB_IDEMPOTENCY_KEY_MAX_LENGTH - prefix.length - uuid.length - 1
+    );
+    return `${prefix}${safeOperation.slice(0, maxOperationLength)}-${uuid}`;
   }
   monitorJobHeaders(operation, idempotencyKey) {
     return {
@@ -10291,6 +10298,12 @@ async function checkSdkCompatibility(baseUrl, options = {}) {
     clearTimeout(timeout);
   }
 }
+function isCiEnvironment() {
+  return ["CI", "GITHUB_ACTIONS"].some((name) => {
+    const value = process.env[name]?.trim().toLowerCase();
+    return value === "1" || value === "true" || value === "yes";
+  });
+}
 function enforceSdkCompatibilityResponse(response) {
   if (!response) {
     return;
@@ -10298,7 +10311,7 @@ function enforceSdkCompatibilityResponse(response) {
   if (response.update_required) {
     throw new Error(response.message);
   }
-  if (response.status === "deprecated" || response.status === "update_available") {
+  if ((response.status === "deprecated" || response.status === "update_available") && !isCiEnvironment()) {
     process.stderr.write(`${response.message}
 `);
   }
@@ -21304,7 +21317,8 @@ function printResult(input2) {
             lines: [
               `${input2.directory}: ${input2.status}`,
               ...input2.outcomes.map(renderOutcome),
-              ...failed && input2.deployment.error ? [input2.deployment.error] : []
+              ...failed && input2.deployment.error ? [input2.deployment.error] : [],
+              `Details: deepline plays deployments ${input2.deployment.id}`
             ]
           }
         ]
@@ -21383,6 +21397,461 @@ async function handlePlaysDeploy(directory, options) {
   }
 }
 
+// src/cli/commands/git.ts
+var GIT_DEPLOY_FEATURE = "github-deploy";
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function renderProject(project) {
+  const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
+  const flags = [
+    project.disabled ? "unlinked" : "linked",
+    `deploys ${project.productionBranch}`,
+    project.checkOnPullRequest ? "PR checks on" : "PR checks off"
+  ].join(", ");
+  return `${project.id}  ${project.repoFullName}${root} - ${flags}`;
+}
+function renderDeployment(deployment) {
+  const fromDirectory = deployment.playProjectId === null;
+  const kind = fromDirectory ? "directory deploy" : deployment.isProduction ? "production" : deployment.trigger === "pull_request" ? `pr #${deployment.pullRequestNumber ?? "?"}` : deployment.trigger;
+  const suffix = deployment.error ? ` - ${deployment.error.slice(0, 80)}` : "";
+  const source = [
+    deployment.commitSha?.slice(0, 10),
+    deployment.ref?.replace("refs/heads/", ""),
+    fromDirectory ? deployment.repoFullName : null
+  ].filter(Boolean).join(" ") || "no git metadata";
+  return `${deployment.id}  ${source} (${kind}) - ${deployment.status}${suffix}`;
+}
+async function handleList(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(
+    `/api/v2/play-projects${options.all ? "?includeDisabled=1" : ""}`
+  );
+  printCommandEnvelope(
+    {
+      projects: payload.projects,
+      count: payload.projects.length,
+      render: {
+        sections: [
+          {
+            title: "linked repositories",
+            lines: payload.projects.length ? payload.projects.map(renderProject) : [
+              "No repositories are linked. Run `deepline git repos` to see what the GitHub installation can reach, then `deepline git link`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function describeInstallationStatus(installation) {
+  switch (installation.status) {
+    case "active":
+      return [
+        `Connected to ${installation.accountLogin} (installation ${installation.installationId}).`
+      ];
+    case "uninstalled":
+      return [
+        `The Deepline GitHub App was uninstalled from ${installation.accountLogin}${installation.uninstalledAt ? ` at ${new Date(installation.uninstalledAt).toISOString()}` : ""}.`,
+        "Deploys are paused for every linked repository. Run `deepline git connect`, then `deepline git link <owner/repo>` again for each repository; links from the old installation cannot be resumed."
+      ];
+    case "suspended":
+      return [
+        `GitHub suspended the Deepline App on ${installation.accountLogin}${installation.suspendedAt ? ` at ${new Date(installation.suspendedAt).toISOString()}` : ""}.`,
+        "Pushes are not delivered while it is suspended; unsuspend it in GitHub settings."
+      ];
+  }
+}
+async function handleStatus2(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get("/api/v2/github/installation");
+  const installation = payload.installation;
+  const others = (payload.installations ?? []).filter(
+    (row) => row.installationId !== installation?.installationId
+  );
+  const lines = installation ? describeInstallationStatus(installation) : [
+    "No GitHub installation is connected to this workspace. Run `deepline git connect`."
+  ];
+  for (const other of others) {
+    lines.push(
+      `Also: ${other.accountLogin} (installation ${other.installationId}) is ${other.status}.`
+    );
+  }
+  const byId = new Map(
+    (payload.installations ?? []).map((row) => [row.installationId, row])
+  );
+  const { projects } = await http.get(
+    "/api/v2/play-projects?includeDisabled=1"
+  );
+  const affected_links = projects.map((project) => {
+    const own = byId.get(project.installationId);
+    const verdict = !own ? "unknown" : own.status === "active" ? null : own.status;
+    return verdict ? {
+      id: project.id,
+      repoId: project.repoId,
+      repoFullName: project.repoFullName,
+      rootDirectory: project.rootDirectory,
+      productionBranch: project.productionBranch,
+      manifestPath: project.manifestPath,
+      checkOnPullRequest: project.checkOnPullRequest,
+      disabled: project.disabled,
+      installationId: project.installationId,
+      installationStatus: verdict
+    } : null;
+  }).filter((row) => row !== null);
+  const activeInstallations = (payload.installations ?? []).filter(
+    (row) => row.status === "active"
+  );
+  const relinkCommand = (link2) => [
+    // The numeric repo id, not the name: a repository renamed while the
+    // App was gone keeps a stale name here, and `git link` accepts the id.
+    `deepline git link ${link2.repoId}`,
+    // Stored values are admin-controlled text and this line is
+    // copy-pasted into a shell by whoever reads it, so every
+    // interpolated value below is quoted.
+    `--branch ${shellQuote2(link2.productionBranch)}`,
+    link2.rootDirectory ? `--root-dir ${shellQuote2(link2.rootDirectory)}` : "",
+    link2.manifestPath && link2.manifestPath !== "deepline.json" ? `--manifest ${shellQuote2(link2.manifestPath)}` : "",
+    link2.checkOnPullRequest ? "" : "--no-pr-checks",
+    // With several active installations no id is guessed: the reader picks.
+    activeInstallations.length > 1 ? "--installation <id>" : ""
+  ].filter(Boolean).join(" ");
+  for (const link2 of affected_links) {
+    const label = `${link2.repoFullName}${link2.rootDirectory ? ` (${link2.rootDirectory})` : ""}`;
+    lines.push(
+      link2.installationStatus !== "suspended" ? `Link again: ${label} \u2014 its installation ${link2.installationId} is ${link2.installationStatus}; run \`${relinkCommand(link2)}\`${activeInstallations.length > 1 ? ` with <id> being the installation that reaches this repo: ${activeInstallations.map((row) => `${row.installationId} (${row.accountLogin})`).join(", ")}` : ""}.` : (
+        // A link disabled during the suspension stays disabled; only an
+        // enabled one picks up again on its own when GitHub unsuspends.
+        link2.disabled ? `Paused and disabled: ${label} \u2014 its installation is suspended, and the link stays disabled after GitHub unsuspends it until you run \`deepline git set ${link2.id} --enabled\`.` : `Paused: ${label} \u2014 its installation is suspended; pushes resume when GitHub unsuspends it.`
+      )
+    );
+  }
+  printCommandEnvelope(
+    {
+      installation,
+      installations: payload.installations ?? [],
+      affected_links,
+      render: { sections: [{ title: "github installation", lines }] }
+    },
+    { json: options.json }
+  );
+}
+async function handleRepos(options) {
+  const { http } = getAuthedHttpClient();
+  const query = options.installation ? `?installationId=${encodeURIComponent(options.installation)}` : "";
+  const payload = await http.get(`/api/v2/github/repos${query}`);
+  printCommandEnvelope(
+    {
+      installation: payload.installation,
+      repositories: payload.repositories,
+      count: payload.repositories.length,
+      render: {
+        sections: [
+          {
+            title: `repos on installation @${payload.installation.accountLogin} (${payload.installation.repositorySelection})`,
+            lines: payload.repositories.map(
+              (repo) => `${repo.repoId}  ${repo.fullName} (default: ${repo.defaultBranch}${repo.private ? ", private" : ""}${repo.fork ? ", fork" : ""})`
+            )
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function resolveRepoId(repo, installation) {
+  if (/^\d+$/.test(repo)) return Number(repo);
+  const { http } = getAuthedHttpClient();
+  const query = installation ? `?installationId=${encodeURIComponent(installation)}` : "";
+  const payload = await http.get(
+    `/api/v2/github/repos${query}`
+  );
+  const match = payload.repositories.find(
+    (entry) => entry.fullName.toLowerCase() === repo.toLowerCase()
+  );
+  if (!match) {
+    throw new Error(
+      `Repo "${repo}" is not accessible to the workspace's GitHub installation. Run \`deepline git repos\` to list what is.`
+    );
+  }
+  return match.repoId;
+}
+async function handleLink(repo, options) {
+  const repoId = await resolveRepoId(repo, options.installation);
+  const { http } = getAuthedHttpClient();
+  const payload = await http.post("/api/v2/play-projects", {
+    repoId,
+    ...options.installation !== void 0 ? { installationId: options.installation } : {},
+    ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
+    ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
+    ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
+    ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {}
+  });
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: "linked",
+            lines: [
+              renderProject(payload.project),
+              ...(payload.warnings ?? []).map(
+                (warning) => `WARNING: ${warning}`
+              ),
+              "Pushes to the production branch now register and promote changed plays.",
+              "Anyone who can push to this repo can change what runs in this workspace."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleGet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(
+    `/api/v2/play-projects/${encodeURIComponent(id)}`
+  );
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: "linked repository",
+            lines: [renderProject(payload.project)]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleSet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.patch(
+    `/api/v2/play-projects/${encodeURIComponent(id)}`,
+    {
+      ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
+      ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
+      ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
+      ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {},
+      ...options.disabled !== void 0 ? { disabled: options.disabled } : {}
+    }
+  );
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          { title: "updated", lines: [renderProject(payload.project)] }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleUnlink(id, options) {
+  const { http } = getAuthedHttpClient();
+  await http.delete(`/api/v2/play-projects/${encodeURIComponent(id)}`);
+  printCommandEnvelope(
+    {
+      ok: true,
+      id,
+      render: {
+        sections: [
+          {
+            title: "unlinked",
+            lines: [
+              `Repository link ${id} removed. Deployments stop immediately and in-flight deploy credentials die; live plays keep running.`
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleConnect(options) {
+  const baseUrl = resolveBaseUrlOnly();
+  const connectUrl = `${baseUrl.replace(/\/$/, "")}/api/v2/github/connect`;
+  const opened = openInBrowser(connectUrl);
+  printCommandEnvelope(
+    {
+      connectUrl,
+      browser: opened,
+      render: {
+        sections: [
+          {
+            title: "connect GitHub",
+            lines: [
+              opened === "opened" ? `Opened ${connectUrl} in your browser.` : `Open ${connectUrl} in your browser.`,
+              "Sign in as a workspace admin if prompted, approve the GitHub",
+              "installation, then return here and run `deepline git repos`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleDeploymentsList(options) {
+  const { http } = getAuthedHttpClient();
+  const query = new URLSearchParams();
+  if (options.repo) query.set("projectId", options.repo);
+  if (options.limit) query.set("limit", options.limit);
+  const suffix = query.size > 0 ? `?${query.toString()}` : "";
+  const payload = await http.get(
+    `/api/v2/deployments${suffix}`
+  );
+  printCommandEnvelope(
+    {
+      deployments: payload.deployments,
+      count: payload.deployments.length,
+      render: {
+        sections: [
+          {
+            title: "deployments",
+            lines: payload.deployments.length ? payload.deployments.map(renderDeployment) : [
+              "No deployments yet. Push to a linked repository, or run `deepline plays deploy`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function renderDeploymentPlayLines(results) {
+  const plays = results?.plays;
+  if (!Array.isArray(plays)) return [];
+  return plays.flatMap((play) => {
+    const version = play.version === void 0 ? "" : play.previousVersion === void 0 ? ` v${play.version}` : ` v${play.previousVersion} -> v${play.version}`;
+    const file = play.file ? ` (${play.file})` : "";
+    return [
+      `${play.name ?? "?"}${file} - ${play.status ?? "?"}${version}`,
+      ...play.error ? [`  error: ${play.error}`] : [],
+      ...play.warning ? [`  warning: ${play.warning}`] : []
+    ];
+  });
+}
+async function handleDeploymentGet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(`/api/v2/deployments/${encodeURIComponent(id)}`);
+  const playLines = renderDeploymentPlayLines(payload.deployment.results);
+  const repository = payload.project?.repoFullName ?? payload.deployment.repoFullName;
+  printCommandEnvelope(
+    {
+      deployment: payload.deployment,
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: `deployment ${payload.deployment.id}${repository ? ` (${repository})` : ""}`,
+            lines: [renderDeployment(payload.deployment)]
+          },
+          ...playLines.length ? [{ title: "plays", lines: playLines }] : []
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleDeploymentCancel(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.post(`/api/v2/deployments/${encodeURIComponent(id)}/cancel`, {});
+  printCommandEnvelope(
+    {
+      cancelled: payload.cancelled,
+      deployment: payload.deployment,
+      render: {
+        sections: [
+          {
+            title: payload.cancelled ? "cancelled" : "already cancelled",
+            lines: [
+              payload.deployment ? renderDeployment(payload.deployment) : `Deployment ${id} cancelled.`,
+              "The build stops at its next step and nothing from it goes live."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerGitCommands(program) {
+  const git = program.command("git", { hidden: !cliFeatureEnabled(GIT_DEPLOY_FEATURE) }).alias("projects").description(
+    "Git deploys: link repositories to this workspace and deploy plays on push."
+  ).addHelpText(
+    "after",
+    `
+Examples:
+  deepline git connect
+  deepline git repos
+  deepline git link acme/growth --branch main
+  deepline git list
+  deepline git set <id> --branch release
+  deepline git unlink <id>
+  deepline git deployments --repo <id>
+  deepline git cancel <deployment-id>
+`
+  );
+  git.command("connect").description("Connect a GitHub installation (browser step).").option("--json", "Emit JSON output").action(async (options) => handleConnect(options));
+  git.command("status").description(
+    "Show the workspace's GitHub installation and whether it is still usable."
+  ).option("--json", "Emit JSON output").action(async (options) => handleStatus2(options));
+  git.command("repos").description("List repos the workspace's GitHub installation can reach.").option(
+    "--installation <id>",
+    "GitHub installation id (required when several are connected)"
+  ).option("--json", "Emit JSON output").action(
+    async (options) => handleRepos(options)
+  );
+  git.command("list").description("List linked repositories.").option("--all", "Include unlinked repositories").option("--json", "Emit JSON output").action(
+    async (options) => handleList(options)
+  );
+  git.command("link").description("Link a repository to this workspace for deploy-on-push.").argument("<repo>", "Repo full name (owner/name) or numeric repo id").option("--root-dir <path>", "Base path inside the repo for this link").option("--branch <name>", "Production branch (default: repo default)").option(
+    "--manifest <file>",
+    "Manifest file name under the base path (default: deepline.json)"
+  ).option(
+    "--installation <id>",
+    "GitHub installation id (required when several are connected)"
+  ).option("--no-pr-checks", "Skip Check Runs on pull requests").option("--json", "Emit JSON output").action(
+    async (repo, options) => handleLink(repo, options)
+  );
+  git.command("get").description("Show one linked repository.").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(async (id, options) => handleGet(id, options));
+  git.command("set").description("Update a linked repository.").argument("<id>", "Repository link id").option("--branch <name>", "Production branch").option("--root-dir <path>", "Base path inside the repo for this link").option(
+    "--manifest <file>",
+    "Manifest file name under the base path (default: deepline.json)"
+  ).option("--pr-checks", "Enable Check Runs on pull requests").option("--no-pr-checks", "Disable Check Runs on pull requests").option("--disabled", "Pause deployments for this link").option("--enabled", "Resume deployments for this link").option("--json", "Emit JSON output").action(
+    async (id, options) => handleSet(id, {
+      ...options,
+      disabled: options.enabled === true ? false : options.disabled === true ? true : void 0
+    })
+  );
+  git.command("unlink").description("Unlink a repository (live plays keep running).").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleUnlink(id, options)
+  );
+  git.command("deployments").description("Deployment history; pass an id for one deployment.").argument("[id]", "Deployment id (omit to list)").option("--repo <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
+    async (id, options) => id ? handleDeploymentGet(id, options) : handleDeploymentsList(options)
+  );
+  git.command("cancel").description(
+    "Cancel a queued or running deployment before its plays go live (admin)."
+  ).argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleDeploymentCancel(id, options)
+  );
+  const deployments = program.command("deployments", { hidden: true });
+  deployments.command("list").option("--project <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
+    async (options) => handleDeploymentsList({ ...options, repo: options.project })
+  );
+  deployments.command("get").argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleDeploymentGet(id, options)
+  );
+}
+
 // src/cli/commands/play.ts
 var PLAY_BUNDLER_MODULE_PATHS = [
   // Built CLI bundle: dist/cli/index.mjs -> dist/plays/bundle-play-file.mjs.
@@ -21729,7 +22198,7 @@ function rankPlayReferenceSuggestions(input2) {
 function searchQueryForMissingPlayReference(target) {
   return parseReferencedPlayTarget2(target).unqualifiedPlayName.replace(/[-_./]+/g, " ").replace(/\s+/g, " ").trim();
 }
-function shellQuote2(value) {
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function buildPlayReferenceNotFoundMessage(input2) {
@@ -21762,7 +22231,7 @@ function buildPlayReferenceNotFoundMessage(input2) {
     lines.push(
       "",
       "Search visible plays:",
-      `  deepline plays search ${shellQuote2(searchQuery)} --all --json`
+      `  deepline plays search ${shellQuote3(searchQuery)} --all --json`
     );
   }
   return lines.join("\n");
@@ -26522,7 +26991,7 @@ function printPlayCheckOutcome(outcome, target, prefix) {
   printPlayCheckLimits(result.limits);
   if (result.artifactHash && outcome.exportName === PLAY_DEFAULT_EXPORT) {
     console.log(
-      `  publish: deepline plays publish ${shellQuote2(target)} --expected-artifact ${result.artifactHash}`
+      `  publish: deepline plays publish ${shellQuote3(target)} --expected-artifact ${result.artifactHash}`
     );
   }
   printPlayTriggers(result.triggers);
@@ -27155,7 +27624,7 @@ async function handleRunsList(args) {
     return lines2.join("\n");
   });
   const nextOffset = (page.offset ?? offset ?? 0) + runs.length;
-  const nextPage = page.hasMore && playName ? `deepline runs list --play ${shellQuote2(playName)}${statusFilter ? ` --status ${shellQuote2(statusFilter)}` : ""} --limit ${page.limit ?? limit ?? 20} --offset ${nextOffset} --json` : null;
+  const nextPage = page.hasMore && playName ? `deepline runs list --play ${shellQuote3(playName)}${statusFilter ? ` --status ${shellQuote3(statusFilter)}` : ""} --limit ${page.limit ?? limit ?? 20} --offset ${nextOffset} --json` : null;
   if (page.hasMore) {
     lines.push("List truncated \u2014 more runs match this filter.");
     lines.push(
@@ -27916,7 +28385,7 @@ async function handlePlayList(args) {
     cursor
   });
   const plays = page.plays;
-  const nextPage = page.hasMore && page.cursor ? `deepline plays list${categories ? ` --categories ${shellQuote2(categories)}` : ""}${limit ? ` --limit ${limit}` : ""}${showCost ? " --show-cost" : ""} --cursor ${shellQuote2(page.cursor)} --json` : null;
+  const nextPage = page.hasMore && page.cursor ? `deepline plays list${categories ? ` --categories ${shellQuote3(categories)}` : ""}${limit ? ` --limit ${limit}` : ""}${showCost ? " --show-cost" : ""} --cursor ${shellQuote3(page.cursor)} --json` : null;
   if (page.hasMore && !nextPage) {
     throw new Error(
       "Play list reported more results without a continuation cursor"
@@ -28337,7 +28806,7 @@ async function handlePlaySave(args) {
       message: "Refusing to save: the local file no longer produces the artifact checked earlier.",
       expectedArtifactHash: options.expectedArtifactHash,
       currentArtifactHash: artifactHash,
-      next: `deepline plays check ${shellQuote2(options.target)}`
+      next: `deepline plays check ${shellQuote3(options.target)}`
     };
     if (options.jsonOutput) {
       printCompactJson(result);
@@ -28402,7 +28871,7 @@ async function handlePlaySave(args) {
       graphHash: graph.root.artifact.graphHash,
       artifactStorageKey: saved.artifactStorageKey,
       next: {
-        publish: `deepline plays publish ${shellQuote2(options.target)} --expected-artifact ${artifactHash}`,
+        publish: `deepline plays publish ${shellQuote3(options.target)} --expected-artifact ${artifactHash}`,
         get: `deepline plays get ${playName} --source --out ./${playName}/ --working`
       }
     };
@@ -28462,7 +28931,7 @@ async function handlePlayPublish(args) {
         message: "Refusing to publish: the local file no longer produces the artifact checked earlier.",
         expectedArtifactHash: options.expectedArtifactHash,
         currentArtifactHash: artifactHash,
-        next: `deepline plays check ${shellQuote2(playName)}`
+        next: `deepline plays check ${shellQuote3(playName)}`
       };
       if (options.jsonOutput) {
         printCompactJson(result3);
@@ -29230,6 +29699,22 @@ Examples:
   ).option("--repo <owner/name>", "Repository to record on the deployment").option("--ref <ref>", "Branch or ref to record on the deployment").option("--commit <sha>", "Commit to record on the deployment").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(
     async (directory, options) => handlePlaysDeploy(directory, options)
   );
+  play.command("deployments [id]").description(
+    "Deployment history for this workspace; pass an id for one deployment and its plays."
+  ).addHelpText(
+    "after",
+    `
+Notes:
+  Lists every deployment, whether \`deepline plays deploy\` or a linked
+  repository's push made it. The same views as \`deepline git deployments\`.
+
+Examples:
+  deepline plays deployments
+  deepline plays deployments <deployment-id>
+`
+  ).option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(
+    async (id, options) => id ? handleDeploymentGet(id, options) : handleDeploymentsList(options)
+  );
   addPublishHelp(
     play.command("publish <target>").description(
       "Promote a saved play revision or publish a local play file."
@@ -37650,6 +38135,7 @@ function renderMonitorJob(payload) {
   if (!job) return void 0;
   const id = asString(job.id) ?? "<unknown>";
   const state = asString(job.state) ?? "unknown";
+  const outcome = asString(job.outcome);
   const phase = asString(job.phase);
   const counts = asRecord2(job.counts);
   const reconciliation = asRecord2(job.reconciliation);
@@ -37657,6 +38143,9 @@ function renderMonitorJob(payload) {
     `Monitor job: ${id}`,
     `State: ${state}${phase ? ` (${phase})` : ""}`
   ];
+  if (outcome) lines.push(`Outcome: ${outcome}`);
+  const operationId = asString(job.operation_id);
+  if (operationId) lines.push(`Operation: ${operationId}`);
   if (counts) {
     lines.push(
       `Counts: requested ${asFiniteNumber(counts.requested) ?? 0}, created ${asFiniteNumber(counts.created) ?? 0}, updated ${asFiniteNumber(counts.updated) ?? 0}, removed ${asFiniteNumber(counts.removed) ?? 0}, unchanged ${asFiniteNumber(counts.unchanged) ?? 0}, verified ${asFiniteNumber(counts.verified) ?? 0}, failed ${asFiniteNumber(counts.failed) ?? 0}`
@@ -40852,448 +41341,6 @@ Examples:
   );
 }
 
-// src/cli/commands/git.ts
-var GIT_DEPLOY_FEATURE = "github-deploy";
-function shellQuote3(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function renderProject(project) {
-  const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
-  const flags = [
-    project.disabled ? "unlinked" : "linked",
-    `deploys ${project.productionBranch}`,
-    project.checkOnPullRequest ? "PR checks on" : "PR checks off"
-  ].join(", ");
-  return `${project.id}  ${project.repoFullName}${root} - ${flags}`;
-}
-function renderDeployment(deployment) {
-  const kind = deployment.isProduction ? "production" : deployment.trigger === "pull_request" ? `pr #${deployment.pullRequestNumber ?? "?"}` : deployment.trigger;
-  const suffix = deployment.error ? ` - ${deployment.error.slice(0, 80)}` : "";
-  const source = [
-    deployment.commitSha?.slice(0, 10),
-    deployment.ref?.replace("refs/heads/", "") ?? deployment.repoFullName
-  ].filter(Boolean).join(" ") || "directory";
-  return `${deployment.id}  ${source} (${kind}) - ${deployment.status}${suffix}`;
-}
-async function handleList(options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.get(
-    `/api/v2/play-projects${options.all ? "?includeDisabled=1" : ""}`
-  );
-  printCommandEnvelope(
-    {
-      projects: payload.projects,
-      count: payload.projects.length,
-      render: {
-        sections: [
-          {
-            title: "linked repositories",
-            lines: payload.projects.length ? payload.projects.map(renderProject) : [
-              "No repositories are linked. Run `deepline git repos` to see what the GitHub installation can reach, then `deepline git link`."
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-function describeInstallationStatus(installation) {
-  switch (installation.status) {
-    case "active":
-      return [
-        `Connected to ${installation.accountLogin} (installation ${installation.installationId}).`
-      ];
-    case "uninstalled":
-      return [
-        `The Deepline GitHub App was uninstalled from ${installation.accountLogin}${installation.uninstalledAt ? ` at ${new Date(installation.uninstalledAt).toISOString()}` : ""}.`,
-        "Deploys are paused for every linked repository. Run `deepline git connect`, then `deepline git link <owner/repo>` again for each repository; links from the old installation cannot be resumed."
-      ];
-    case "suspended":
-      return [
-        `GitHub suspended the Deepline App on ${installation.accountLogin}${installation.suspendedAt ? ` at ${new Date(installation.suspendedAt).toISOString()}` : ""}.`,
-        "Pushes are not delivered while it is suspended; unsuspend it in GitHub settings."
-      ];
-  }
-}
-async function handleStatus2(options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.get("/api/v2/github/installation");
-  const installation = payload.installation;
-  const others = (payload.installations ?? []).filter(
-    (row) => row.installationId !== installation?.installationId
-  );
-  const lines = installation ? describeInstallationStatus(installation) : [
-    "No GitHub installation is connected to this workspace. Run `deepline git connect`."
-  ];
-  for (const other of others) {
-    lines.push(
-      `Also: ${other.accountLogin} (installation ${other.installationId}) is ${other.status}.`
-    );
-  }
-  const byId = new Map(
-    (payload.installations ?? []).map((row) => [row.installationId, row])
-  );
-  const { projects } = await http.get(
-    "/api/v2/play-projects?includeDisabled=1"
-  );
-  const affected_links = projects.map((project) => {
-    const own = byId.get(project.installationId);
-    const verdict = !own ? "unknown" : own.status === "active" ? null : own.status;
-    return verdict ? {
-      id: project.id,
-      repoId: project.repoId,
-      repoFullName: project.repoFullName,
-      rootDirectory: project.rootDirectory,
-      productionBranch: project.productionBranch,
-      manifestPath: project.manifestPath,
-      checkOnPullRequest: project.checkOnPullRequest,
-      disabled: project.disabled,
-      installationId: project.installationId,
-      installationStatus: verdict
-    } : null;
-  }).filter((row) => row !== null);
-  const activeInstallations = (payload.installations ?? []).filter(
-    (row) => row.status === "active"
-  );
-  const relinkCommand = (link2) => [
-    // The numeric repo id, not the name: a repository renamed while the
-    // App was gone keeps a stale name here, and `git link` accepts the id.
-    `deepline git link ${link2.repoId}`,
-    // Stored values are admin-controlled text and this line is
-    // copy-pasted into a shell by whoever reads it, so every
-    // interpolated value below is quoted.
-    `--branch ${shellQuote3(link2.productionBranch)}`,
-    link2.rootDirectory ? `--root-dir ${shellQuote3(link2.rootDirectory)}` : "",
-    link2.manifestPath && link2.manifestPath !== "deepline.json" ? `--manifest ${shellQuote3(link2.manifestPath)}` : "",
-    link2.checkOnPullRequest ? "" : "--no-pr-checks",
-    // With several active installations no id is guessed: the reader picks.
-    activeInstallations.length > 1 ? "--installation <id>" : ""
-  ].filter(Boolean).join(" ");
-  for (const link2 of affected_links) {
-    const label = `${link2.repoFullName}${link2.rootDirectory ? ` (${link2.rootDirectory})` : ""}`;
-    lines.push(
-      link2.installationStatus !== "suspended" ? `Link again: ${label} \u2014 its installation ${link2.installationId} is ${link2.installationStatus}; run \`${relinkCommand(link2)}\`${activeInstallations.length > 1 ? ` with <id> being the installation that reaches this repo: ${activeInstallations.map((row) => `${row.installationId} (${row.accountLogin})`).join(", ")}` : ""}.` : (
-        // A link disabled during the suspension stays disabled; only an
-        // enabled one picks up again on its own when GitHub unsuspends.
-        link2.disabled ? `Paused and disabled: ${label} \u2014 its installation is suspended, and the link stays disabled after GitHub unsuspends it until you run \`deepline git set ${link2.id} --enabled\`.` : `Paused: ${label} \u2014 its installation is suspended; pushes resume when GitHub unsuspends it.`
-      )
-    );
-  }
-  printCommandEnvelope(
-    {
-      installation,
-      installations: payload.installations ?? [],
-      affected_links,
-      render: { sections: [{ title: "github installation", lines }] }
-    },
-    { json: options.json }
-  );
-}
-async function handleRepos(options) {
-  const { http } = getAuthedHttpClient();
-  const query = options.installation ? `?installationId=${encodeURIComponent(options.installation)}` : "";
-  const payload = await http.get(`/api/v2/github/repos${query}`);
-  printCommandEnvelope(
-    {
-      installation: payload.installation,
-      repositories: payload.repositories,
-      count: payload.repositories.length,
-      render: {
-        sections: [
-          {
-            title: `repos on installation @${payload.installation.accountLogin} (${payload.installation.repositorySelection})`,
-            lines: payload.repositories.map(
-              (repo) => `${repo.repoId}  ${repo.fullName} (default: ${repo.defaultBranch}${repo.private ? ", private" : ""}${repo.fork ? ", fork" : ""})`
-            )
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function resolveRepoId(repo, installation) {
-  if (/^\d+$/.test(repo)) return Number(repo);
-  const { http } = getAuthedHttpClient();
-  const query = installation ? `?installationId=${encodeURIComponent(installation)}` : "";
-  const payload = await http.get(
-    `/api/v2/github/repos${query}`
-  );
-  const match = payload.repositories.find(
-    (entry) => entry.fullName.toLowerCase() === repo.toLowerCase()
-  );
-  if (!match) {
-    throw new Error(
-      `Repo "${repo}" is not accessible to the workspace's GitHub installation. Run \`deepline git repos\` to list what is.`
-    );
-  }
-  return match.repoId;
-}
-async function handleLink(repo, options) {
-  const repoId = await resolveRepoId(repo, options.installation);
-  const { http } = getAuthedHttpClient();
-  const payload = await http.post("/api/v2/play-projects", {
-    repoId,
-    ...options.installation !== void 0 ? { installationId: options.installation } : {},
-    ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
-    ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
-    ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
-    ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {}
-  });
-  printCommandEnvelope(
-    {
-      project: payload.project,
-      render: {
-        sections: [
-          {
-            title: "linked",
-            lines: [
-              renderProject(payload.project),
-              ...(payload.warnings ?? []).map(
-                (warning) => `WARNING: ${warning}`
-              ),
-              "Pushes to the production branch now register and promote changed plays.",
-              "Anyone who can push to this repo can change what runs in this workspace."
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleGet(id, options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.get(
-    `/api/v2/play-projects/${encodeURIComponent(id)}`
-  );
-  printCommandEnvelope(
-    {
-      project: payload.project,
-      render: {
-        sections: [
-          {
-            title: "linked repository",
-            lines: [renderProject(payload.project)]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleSet(id, options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.patch(
-    `/api/v2/play-projects/${encodeURIComponent(id)}`,
-    {
-      ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
-      ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
-      ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
-      ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {},
-      ...options.disabled !== void 0 ? { disabled: options.disabled } : {}
-    }
-  );
-  printCommandEnvelope(
-    {
-      project: payload.project,
-      render: {
-        sections: [
-          { title: "updated", lines: [renderProject(payload.project)] }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleUnlink(id, options) {
-  const { http } = getAuthedHttpClient();
-  await http.delete(`/api/v2/play-projects/${encodeURIComponent(id)}`);
-  printCommandEnvelope(
-    {
-      ok: true,
-      id,
-      render: {
-        sections: [
-          {
-            title: "unlinked",
-            lines: [
-              `Repository link ${id} removed. Deployments stop immediately and in-flight deploy credentials die; live plays keep running.`
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleConnect(options) {
-  const baseUrl = resolveBaseUrlOnly();
-  const connectUrl = `${baseUrl.replace(/\/$/, "")}/api/v2/github/connect`;
-  const opened = openInBrowser(connectUrl);
-  printCommandEnvelope(
-    {
-      connectUrl,
-      browser: opened,
-      render: {
-        sections: [
-          {
-            title: "connect GitHub",
-            lines: [
-              opened === "opened" ? `Opened ${connectUrl} in your browser.` : `Open ${connectUrl} in your browser.`,
-              "Sign in as a workspace admin if prompted, approve the GitHub",
-              "installation, then return here and run `deepline git repos`."
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleDeploymentsList(options) {
-  const { http } = getAuthedHttpClient();
-  const query = new URLSearchParams();
-  if (options.repo) query.set("projectId", options.repo);
-  if (options.limit) query.set("limit", options.limit);
-  const suffix = query.size > 0 ? `?${query.toString()}` : "";
-  const payload = await http.get(
-    `/api/v2/deployments${suffix}`
-  );
-  printCommandEnvelope(
-    {
-      deployments: payload.deployments,
-      count: payload.deployments.length,
-      render: {
-        sections: [
-          {
-            title: "deployments",
-            lines: payload.deployments.length ? payload.deployments.map(renderDeployment) : [
-              "No deployments yet. Push to a linked repository to create one."
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleDeploymentGet(id, options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.get(`/api/v2/deployments/${encodeURIComponent(id)}`);
-  const results = payload.deployment.results;
-  const playLines = Array.isArray(results?.plays) ? results.plays.map(
-    (play) => `${play.name ?? "?"} - ${play.status ?? "?"}${play.error ? `: ${play.error}` : ""}`
-  ) : [];
-  printCommandEnvelope(
-    {
-      deployment: payload.deployment,
-      project: payload.project,
-      render: {
-        sections: [
-          {
-            title: `deployment ${payload.deployment.id}${payload.project ? ` (${payload.project.repoFullName})` : ""}`,
-            lines: [renderDeployment(payload.deployment)]
-          },
-          ...playLines.length ? [{ title: "plays", lines: playLines }] : []
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-async function handleDeploymentCancel(id, options) {
-  const { http } = getAuthedHttpClient();
-  const payload = await http.post(`/api/v2/deployments/${encodeURIComponent(id)}/cancel`, {});
-  printCommandEnvelope(
-    {
-      cancelled: payload.cancelled,
-      deployment: payload.deployment,
-      render: {
-        sections: [
-          {
-            title: payload.cancelled ? "cancelled" : "already cancelled",
-            lines: [
-              payload.deployment ? renderDeployment(payload.deployment) : `Deployment ${id} cancelled.`,
-              "The build stops at its next step and nothing from it goes live."
-            ]
-          }
-        ]
-      }
-    },
-    { json: options.json }
-  );
-}
-function registerGitCommands(program) {
-  const git = program.command("git", { hidden: !cliFeatureEnabled(GIT_DEPLOY_FEATURE) }).alias("projects").description(
-    "Git deploys: link repositories to this workspace and deploy plays on push."
-  ).addHelpText(
-    "after",
-    `
-Examples:
-  deepline git connect
-  deepline git repos
-  deepline git link acme/growth --branch main
-  deepline git list
-  deepline git set <id> --branch release
-  deepline git unlink <id>
-  deepline git deployments --repo <id>
-  deepline git cancel <deployment-id>
-`
-  );
-  git.command("connect").description("Connect a GitHub installation (browser step).").option("--json", "Emit JSON output").action(async (options) => handleConnect(options));
-  git.command("status").description(
-    "Show the workspace's GitHub installation and whether it is still usable."
-  ).option("--json", "Emit JSON output").action(async (options) => handleStatus2(options));
-  git.command("repos").description("List repos the workspace's GitHub installation can reach.").option(
-    "--installation <id>",
-    "GitHub installation id (required when several are connected)"
-  ).option("--json", "Emit JSON output").action(
-    async (options) => handleRepos(options)
-  );
-  git.command("list").description("List linked repositories.").option("--all", "Include unlinked repositories").option("--json", "Emit JSON output").action(
-    async (options) => handleList(options)
-  );
-  git.command("link").description("Link a repository to this workspace for deploy-on-push.").argument("<repo>", "Repo full name (owner/name) or numeric repo id").option("--root-dir <path>", "Base path inside the repo for this link").option("--branch <name>", "Production branch (default: repo default)").option(
-    "--manifest <file>",
-    "Manifest file name under the base path (default: deepline.json)"
-  ).option(
-    "--installation <id>",
-    "GitHub installation id (required when several are connected)"
-  ).option("--no-pr-checks", "Skip Check Runs on pull requests").option("--json", "Emit JSON output").action(
-    async (repo, options) => handleLink(repo, options)
-  );
-  git.command("get").description("Show one linked repository.").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(async (id, options) => handleGet(id, options));
-  git.command("set").description("Update a linked repository.").argument("<id>", "Repository link id").option("--branch <name>", "Production branch").option("--root-dir <path>", "Base path inside the repo for this link").option(
-    "--manifest <file>",
-    "Manifest file name under the base path (default: deepline.json)"
-  ).option("--pr-checks", "Enable Check Runs on pull requests").option("--no-pr-checks", "Disable Check Runs on pull requests").option("--disabled", "Pause deployments for this link").option("--enabled", "Resume deployments for this link").option("--json", "Emit JSON output").action(
-    async (id, options) => handleSet(id, {
-      ...options,
-      disabled: options.enabled === true ? false : options.disabled === true ? true : void 0
-    })
-  );
-  git.command("unlink").description("Unlink a repository (live plays keep running).").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(
-    async (id, options) => handleUnlink(id, options)
-  );
-  git.command("deployments").description("Deployment history; pass an id for one deployment.").argument("[id]", "Deployment id (omit to list)").option("--repo <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
-    async (id, options) => id ? handleDeploymentGet(id, options) : handleDeploymentsList(options)
-  );
-  git.command("cancel").description(
-    "Cancel a queued or running deployment before its plays go live (admin)."
-  ).argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
-    async (id, options) => handleDeploymentCancel(id, options)
-  );
-  const deployments = program.command("deployments", { hidden: true });
-  deployments.command("list").option("--project <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
-    async (options) => handleDeploymentsList({ ...options, repo: options.project })
-  );
-  deployments.command("get").argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
-    async (id, options) => handleDeploymentGet(id, options)
-  );
-}
-
 // src/cli/getting-started.ts
 var DEEPLINE_GTM_SKILL = "/deepline-gtm";
 var DEEPLINE_GTM_STARTER_PROMPTS = [
@@ -41388,6 +41435,33 @@ function normalizeSecretName(value) {
   }
   return normalized;
 }
+function normalizePlaySelector(value) {
+  const normalized = value?.trim();
+  if (value !== void 0 && !normalized) {
+    throw new Error("--play requires a bare Play name.");
+  }
+  if (!normalized) return void 0;
+  if (normalized.includes("/")) {
+    throw new Error(
+      "--play expects the bare Play name, not an org-qualified name."
+    );
+  }
+  return normalized;
+}
+function resolveSecretWriteScope(options) {
+  const playName = normalizePlaySelector(options.play);
+  if (options.scope && options.scope !== "org" && options.scope !== "play") {
+    throw new Error("--scope must be either org or play.");
+  }
+  const scope = options.scope === void 0 ? playName ? "play" : "org" : options.scope;
+  if (scope === "play" && !playName) {
+    throw new Error("--play <name> is required when --scope play is used.");
+  }
+  if (scope === "org" && playName) {
+    throw new Error("--play can only be used with --scope play.");
+  }
+  return scope === "play" ? { scope, playName } : { scope };
+}
 function renderSecret(secret) {
   const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
   const added = new Date(secret.createdAt).toISOString();
@@ -41557,7 +41631,8 @@ async function handleList2(options) {
 async function handleCheck(nameInput, options) {
   const name = normalizeSecretName(nameInput);
   const client2 = new DeeplineClient();
-  const check = options.play !== void 0 ? await client2.inspectSecret(name, { playName: options.play }) : null;
+  const playName = options.play === void 0 ? void 0 : normalizePlaySelector(options.play);
+  const check = playName !== void 0 ? await client2.inspectSecret(name, { playName }) : null;
   const secret = check ? check.secret : await client2.checkSecret(name);
   const ok = check ? check.ok : Boolean(secret);
   const quotedPlay = `'${(options.play ?? "PLAY").replace(/'/g, `'"'"'`)}'`;
@@ -41588,11 +41663,7 @@ async function handleCheck(nameInput, options) {
 async function handleSet2(nameInput, forbidden, options) {
   preventShellHistoryLeak(forbidden);
   const name = normalizeSecretName(nameInput);
-  const scope = options.scope === "play" ? "play" : "org";
-  const playName = options.play?.trim();
-  if (scope === "play" && !playName) {
-    throw new Error("--play <name> is required when --scope play is used.");
-  }
+  const { scope, playName } = resolveSecretWriteScope(options);
   const value = await readSecretValueFromOptions(options);
   const { http } = getAuthedHttpClient();
   const response = await http.post(
@@ -41684,7 +41755,8 @@ Notes:
   Secret values are never accepted as command arguments. Use the hidden prompt,
   or one explicit non-argv source: --value-stdin, --from-env NAME, or
   --from-file PATH. Values are never printed. secrets list shows only metadata,
-  including any note you intentionally added.
+  including any note you intentionally added. Supplying --play implies
+  --scope play; --play expects the bare Play name in the current workspace.
 
 Examples:
   deepline secrets list
@@ -41710,7 +41782,7 @@ Examples:
   ).option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
-  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option(
+  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play; --play implies play").option("--play <name>", "Play name for play-scoped secrets").option(
     "--note <note>",
     "Optional non-sensitive memo (maximum 500 characters)"
   ).option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
@@ -42347,7 +42419,7 @@ async function maybeReportSdkCliFailure(input2) {
 // src/cli/skills-sync.ts
 var CHECK_TIMEOUT_MS2 = 3e3;
 function shouldSkipSkillsSync() {
-  if (detectAgentRuntime() === "claude_cowork") {
+  if (detectAgentRuntime() === "claude_cowork" || isCiEnvironment()) {
     return true;
   }
   const value = process.env.DEEPLINE_SKIP_SKILLS_SYNC?.trim().toLowerCase();
@@ -49809,11 +49881,8 @@ function envTruthy(name) {
   const value = process.env[name]?.trim().toLowerCase();
   return value === "1" || value === "true" || value === "yes";
 }
-function isCi() {
-  return envTruthy("CI") || envTruthy("GITHUB_ACTIONS");
-}
 function shouldSkipSelfUpdate() {
-  return envTruthy("DEEPLINE_SKIP_SELF_UPDATE") || envTruthy("DEEPLINE_NO_AUTO_UPDATE") || envTruthy("DEEPLINE_SKIP_SDK_AUTO_UPDATE") || envTruthy("DEEPLINE_DISABLE_AUTO_UPDATE") || !shouldRunCliAutoUpdate() || isCi();
+  return envTruthy("DEEPLINE_SKIP_SELF_UPDATE") || envTruthy("DEEPLINE_NO_AUTO_UPDATE") || envTruthy("DEEPLINE_SKIP_SDK_AUTO_UPDATE") || envTruthy("DEEPLINE_DISABLE_AUTO_UPDATE") || !shouldRunCliAutoUpdate() || isCiEnvironment();
 }
 function parseSemver(version) {
   const trimmed = version?.trim();