deepline 0.3.125 → 0.3.127

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.125',
+  version: '0.3.127',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -2,7 +2,7 @@ const REDACTED_VALUE = '[REDACTED]';
 
 type SecretRedactionOptions = {
   redactHighEntropy?: boolean;
-  /** Preserve only known pagination cursor fields in authenticated result data. */
+  /** Preserve pagination cursors and signed transfer URLs in authenticated results. */
   keyPolicy?: 'strict' | 'public-result';
   /** Replace sample cursor values with a non-capability-bearing placeholder. */
   placeholderContinuationValues?: boolean;
@@ -121,6 +121,59 @@ const SAFE_IDENTIFIER_KEYS = new Set([
   'snowflake_query_ids',
 ]);
 
+// Transfer URLs are bearer capabilities. Only return them in authenticated
+// results; keep logs, errors, and generated samples redacted.
+const PUBLIC_RESULT_TRANSFER_URL_KEYS = new Set([
+  'uploadUrl',
+  'upload_url',
+  'downloadUrl',
+  'download_url',
+]);
+const TRANSFER_SIGNING_PARAM =
+  /^(?:sig|signature|x-amz-(?:algorithm|credential|date|expires|signedheaders|signature|security-token)|x-goog-(?:algorithm|credential|date|expires|signedheaders|signature))$/i;
+
+function isPublicResultTransferUrl(
+  value: string,
+  key: string | undefined,
+  options: SecretRedactionOptions,
+): boolean {
+  if (
+    !key ||
+    !PUBLIC_RESULT_TRANSFER_URL_KEYS.has(key) ||
+    options.keyPolicy !== 'public-result' ||
+    options.placeholderContinuationValues
+  )
+    return false;
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (
+    url.protocol !== 'https:' ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    /\s/.test(value)
+  )
+    return false;
+  let signed = false;
+  for (const [name, paramValue] of url.searchParams) {
+    if (
+      SENSITIVE_URL_PARAM_KEY_PATTERN.test(name) &&
+      !TRANSFER_SIGNING_PARAM.test(name)
+    )
+      return false;
+    if (
+      /^(?:sig|signature|x-amz-signature|x-goog-signature)$/i.test(name) &&
+      paramValue
+    )
+      signed = true;
+  }
+  return signed;
+}
+
 const EXPLICIT_SECRET_VALUE_PATTERNS = [
   /\bnapi_[a-z0-9]{20,}\b/i,
   /\bgh[opsu]_[A-Za-z0-9_]{20,}\b/,
@@ -254,6 +307,7 @@ export function redactSecretsInValue<T>(
     if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
       return REDACTED_VALUE as T;
     }
+    if (isPublicResultTransferUrl(value, parentKey, options)) return value as T;
     if (parentKey && SAFE_IDENTIFIER_KEYS.has(parentKey)) {
       return value as T;
     }
@@ -297,6 +351,7 @@ export function redactSecretsInValue<T>(
     if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
       return REDACTED_VALUE;
     }
+    if (isPublicResultTransferUrl(item, itemParentKey, options)) return item;
     if (itemParentKey && SAFE_IDENTIFIER_KEYS.has(itemParentKey)) return item;
     if (itemParentKey && shouldRedactKey(itemParentKey)) {
       return REDACTED_VALUE;

package/dist/cli/index.js

@@ -3068,7 +3068,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.125",
+  version: "0.3.127",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3063,7 +3063,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.125",
+  version: "0.3.127",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -864,7 +864,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.125",
+  version: "0.3.127",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -768,7 +768,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.125",
+  version: "0.3.127",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.125";
+    readonly version: "0.3.127";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.125";
+    readonly version: "0.3.127";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.125",
+  version: "0.3.127",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.125",
+  version: "0.3.127",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/viewer/viewer.js

@@ -227,7 +227,8 @@ function codexContentText(content) {
 
 // Codex injects several synthetic "user" turns before the real prompt (plugin
 // catalog, AGENTS.md, environment context). They are transport, not intent —
-// the Claude path skips its own equivalent ("Base directory for this skill:").
+// Claude skill injections are likewise not prompts, but are retained as
+// labeled skill-load entries in the timeline.
 const CODEX_SYNTHETIC_PREFIXES = [
     '<recommended_plugins>',
     '<environment_context>',
@@ -1080,29 +1081,28 @@ function buildTimeline(events, firstTs) {
         eventIndex++;
         if (d.type === 'user') {
             const isExternal = d.userType === 'external' || (!d.isSynthetic && !asArray((d.message || {}).content).some(b => b && typeof b === 'object' && b.type === 'tool_result'));
-            if (isExternal) {
-                const rawContent = (d.message || {}).content;
-                let text = '';
-                if (typeof rawContent === 'string') text = rawContent;
-                else {
-                    const blocks = asArray(rawContent);
-                    text = blocks.filter(b => typeof b === 'string' || (b && b.type === 'text')).map(b => typeof b === 'string' ? b : b.text).join('\n');
-                }
-                text = text.trim();
-                if (text && !text.startsWith('Base directory for this skill:')) {
-                    let realElapsed = null;
-                    if (firstTs && d.timestamp) {
-                        const ts = parseIsoTs(d.timestamp);
-                        if (ts) realElapsed = Math.round(((ts - firstTs) / 1000) * 10) / 10;
-                    }
-                    timeline.push({
-                        kind: 'user_message',
-                        text: text,
-                        event_index: eventIndex,
-                        elapsed: realElapsed,
-                        repeat_count: d._repeat_count || null,
-                    });
+            const rawContent = (d.message || {}).content;
+            let text = '';
+            if (typeof rawContent === 'string') text = rawContent;
+            else {
+                const blocks = asArray(rawContent);
+                text = blocks.filter(b => typeof b === 'string' || (b && b.type === 'text')).map(b => typeof b === 'string' ? b : b.text).join('\n');
+            }
+            text = text.trim();
+            const isSkillLoad = text.startsWith('Base directory for this skill:');
+            if (text && (isExternal || isSkillLoad)) {
+                let realElapsed = null;
+                if (firstTs && d.timestamp) {
+                    const ts = parseIsoTs(d.timestamp);
+                    if (ts) realElapsed = Math.round(((ts - firstTs) / 1000) * 10) / 10;
                 }
+                timeline.push({
+                    kind: isSkillLoad ? 'skill_load' : 'user_message',
+                    text: text,
+                    event_index: eventIndex,
+                    elapsed: realElapsed,
+                    repeat_count: d._repeat_count || null,
+                });
             }
             continue;
         }
@@ -2183,11 +2183,14 @@ function renderTimeline(timeline, idPrefix) {
         const id = prefix + 'entry-' + i;
         const detailId = prefix + 'detail-' + i;
 
-        if (e.kind === 'user_message') {
+        if (e.kind === 'user_message' || e.kind === 'skill_load') {
             const long = e.text.length > 300;
+            const label = e.kind === 'skill_load'
+                ? 'SKILL LOADED · ' + esc(e.text.split('\n')[0].trim().replace(/\/$/, '').split('/').pop())
+                : 'USER';
             const repeatBadge = e.repeat_count ? `<span class="repeat-badge" title="This message repeated ${e.repeat_count} times and was collapsed">⟳ repeated ×${e.repeat_count}</span>` : '';
             html += `<div class="tl-entry tl-user" data-searchtext="${esc(e.text.toLowerCase())}">
-                <div class="user-label">USER${repeatBadge}</div>
+                <div class="user-label">${label}${repeatBadge}</div>
                 <div class="user-message md-rendered ${long ? 'collapsed' : ''}" id="${id}">${renderMarkdown(e.text)}</div>
                 ${long ? `<span class="reasoning-toggle" onclick="toggleReasoning('${id}', this)">Show more</span>` : ''}
             </div>`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.125",
+  "version": "0.3.127",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",