deepline 0.3.160 → 0.3.161

package/README.md

@@ -16,11 +16,22 @@ Claude Code, Codex, or your terminal.
 
 ## Install
 
+Check `npm --version` and use the matching command.
+
+For npm 11.16 or newer:
+
+```bash
+npm install -g --allow-scripts=esbuild deepline@latest
+```
+
+For older npm:
+
 ```bash
 npm install -g deepline@latest
-deepline setup --json
 ```
 
+Then run `deepline setup --json`.
+
 Setup opens your browser so you can sign in, then installs Deepline's skills
 for your coding agent. If global skill setup is unavailable, Deepline retries
 with project-local skills automatically.
@@ -30,7 +41,7 @@ with project-local skills automatically.
 Paste this into Claude Code, Codex, or another coding agent:
 
 ```text
-Set up https://code.deepline.com/INSTALL.md
+Install the official Deepline CLI globally from npm (package: deepline) by following https://code.deepline.com/INSTALL.md.
 ```
 
 Once setup is complete, tell your agent what you want to do:

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.160',
+  version: '0.3.161',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/cli/index.js

@@ -3051,7 +3051,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.160",
+  version: "0.3.161",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -42469,7 +42469,7 @@ Examples:
 }
 
 // src/cli/commands/setup.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_fs20 = require("fs");
 var import_node_os14 = require("os");
 var import_node_path25 = require("path");
@@ -44224,6 +44224,32 @@ Examples:
   });
 }
 
+// src/cli/npm-script-policy.ts
+var import_node_child_process4 = require("child_process");
+function npmSupportsAllowScripts(version) {
+  const match = /^(\d+)\.(\d+)(?:\.|$)/.exec(version?.trim() ?? "");
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major > 11 || major === 11 && minor >= 16;
+}
+function readNpmVersion(env) {
+  try {
+    const plan = resolveShellSpawn("npm", ["--version"]);
+    const result = (0, import_node_child_process4.spawnSync)(plan.command, plan.args, {
+      encoding: "utf8",
+      env,
+      shell: plan.shell,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    if (result.status !== 0) return null;
+    return String(result.stdout ?? "").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
 // src/cli/commands/setup.ts
 var SETUP_PHASE_NAMES = [
   "cli",
@@ -44413,7 +44439,7 @@ function removeKnownLegacyPaths(baseUrl) {
   }).removeRetiredArtifacts();
 }
 function resolvePathCommands(command) {
-  const lookup = (0, import_node_child_process4.spawnSync)(
+  const lookup = (0, import_node_child_process5.spawnSync)(
     process.platform === "win32" ? "where" : "which",
     process.platform === "win32" ? [command] : ["-a", command],
     { encoding: "utf8", shell: process.platform === "win32" }
@@ -44440,7 +44466,7 @@ function isHomebrewFormulaCommand(path) {
 }
 function resolvePersistentGlobalCommand(dependencies = {}) {
   const platform3 = dependencies.platform ?? process.platform;
-  const run = dependencies.spawn ?? import_node_child_process4.spawnSync;
+  const run = dependencies.spawn ?? import_node_child_process5.spawnSync;
   const pathExists = dependencies.exists ?? import_node_fs20.existsSync;
   const pathClis = dependencies.pathClis ?? resolvePathCommands("deepline");
   const homebrewCommand = pathClis.find(isHomebrewFormulaCommand);
@@ -44539,7 +44565,8 @@ function failSetupPhase(phases, phase, code) {
 }
 function rollbackCommand(scope, root) {
   const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify((0, import_node_path25.join)(root, ".deepline", "runtime"))}` : "";
-  return `npm install -g${prefix} --no-audit --no-fund --include=optional deepline@${SDK_VERSION}`;
+  const allowScriptsFlag = npmSupportsAllowScripts(readNpmVersion(process.env)) ? " --allow-scripts=esbuild" : "";
+  return `npm install -g${prefix} --no-audit --no-fund --include=optional${allowScriptsFlag} deepline@${SDK_VERSION}`;
 }
 function setupResumeCommand(baseUrl, scope) {
   const hostPrefix = baseUrl === "https://code.deepline.com" ? "" : `DEEPLINE_HOST_URL=${JSON.stringify(baseUrl)} `;
@@ -45280,7 +45307,7 @@ function consumePendingCliUpdateMessages(homeDir2 = (0, import_node_os15.homedir
 }
 
 // src/cli/commands/update.ts
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var import_node_fs23 = require("fs");
 var import_node_os16 = require("os");
 var import_node_path28 = require("path");
@@ -45631,7 +45658,7 @@ function normalizedNpmPrefix(value) {
 function resolveNpmGlobalPrefix(env) {
   try {
     const plan = resolveShellSpawn("npm", ["prefix", "-g"]);
-    const result = (0, import_node_child_process5.spawnSync)(plan.command, plan.args, {
+    const result = (0, import_node_child_process6.spawnSync)(plan.command, plan.args, {
       encoding: "utf8",
       env,
       shell: plan.shell,
@@ -45686,14 +45713,16 @@ function resolveUpdatePlan(options = {}) {
   const npmGlobalPrefix = options.npmGlobalPrefix !== void 0 ? options.npmGlobalPrefix : resolveNpmGlobalPrefix(env);
   const hasVerifiedNpmOwnership = inferredInstallPrefix !== null && normalizedNpmPrefix(inferredInstallPrefix) === normalizedNpmPrefix(npmGlobalPrefix);
   const installPrefix = options.requireVerifiedNpmOwnership ? hasVerifiedNpmOwnership ? inferredInstallPrefix : null : inferredInstallPrefix;
+  const npmVersion = options.npmVersion === void 0 ? readNpmVersion(env) : options.npmVersion;
+  const npmGlobalInstallFlags = npmSupportsAllowScripts(npmVersion) ? [...NPM_SDK_INSTALL_COMMON_FLAGS, "--allow-scripts=esbuild"] : NPM_SDK_INSTALL_COMMON_FLAGS;
   const args = installPrefix ? [
     "install",
     "-g",
     "--prefix",
     installPrefix,
-    ...NPM_SDK_INSTALL_COMMON_FLAGS,
+    ...npmGlobalInstallFlags,
     packageSpec
-  ] : ["install", "-g", ...NPM_SDK_INSTALL_COMMON_FLAGS, packageSpec];
+  ] : ["install", "-g", ...npmGlobalInstallFlags, packageSpec];
   const fallbackRegistryUrl = options.npmFallbackRegistryUrl !== void 0 ? options.npmFallbackRegistryUrl : publicNpmFallbackRegistryUrl(
     env.DEEPLINE_HOST_URL?.trim() || autoDetectBaseUrl()
   );
@@ -45843,7 +45872,7 @@ function runCommand(command, args, env = process.env) {
   return new Promise((resolveResult) => {
     let output2 = "";
     const plan = resolveShellSpawn(command, args);
-    const child = (0, import_node_child_process5.spawn)(plan.command, plan.args, {
+    const child = (0, import_node_child_process6.spawn)(plan.command, plan.args, {
       stdio: ["inherit", "pipe", "pipe"],
       shell: plan.shell,
       env
@@ -50823,7 +50852,7 @@ function registerDeeplineCommandGroups(program) {
 }
 
 // src/cli/self-update.ts
-var import_node_child_process6 = require("child_process");
+var import_node_child_process7 = require("child_process");
 var AUTO_UPDATE_TELEMETRY_TIMEOUT_MS = 2e3;
 var TRUSTED_AUTO_UPDATE_ORIGIN = "https://code.deepline.com";
 function trustedAutoUpdateRegistryUrl(baseUrl) {
@@ -50919,7 +50948,7 @@ function relaunchCurrentCommand(plan) {
   return new Promise((resolve22) => {
     const command = plan.kind === "python-sidecar" ? plan.sidecarPath : process.execPath;
     const args = plan.kind === "python-sidecar" ? process.argv.slice(2) : process.argv.slice(1);
-    const child = (0, import_node_child_process6.spawn)(command, args, {
+    const child = (0, import_node_child_process7.spawn)(command, args, {
       stdio: "inherit",
       shell: process.platform === "win32",
       env: {

package/dist/cli/index.mjs

@@ -3046,7 +3046,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.160",
+  version: "0.3.161",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -42554,7 +42554,7 @@ Examples:
 }
 
 // src/cli/commands/setup.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import {
   existsSync as existsSync15,
   lstatSync as lstatSync2,
@@ -44331,6 +44331,32 @@ Examples:
   });
 }
 
+// src/cli/npm-script-policy.ts
+import { spawnSync as spawnSync2 } from "child_process";
+function npmSupportsAllowScripts(version) {
+  const match = /^(\d+)\.(\d+)(?:\.|$)/.exec(version?.trim() ?? "");
+  if (!match) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major > 11 || major === 11 && minor >= 16;
+}
+function readNpmVersion(env) {
+  try {
+    const plan = resolveShellSpawn("npm", ["--version"]);
+    const result = spawnSync2(plan.command, plan.args, {
+      encoding: "utf8",
+      env,
+      shell: plan.shell,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    if (result.status !== 0) return null;
+    return String(result.stdout ?? "").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
 // src/cli/commands/setup.ts
 var SETUP_PHASE_NAMES = [
   "cli",
@@ -44520,7 +44546,7 @@ function removeKnownLegacyPaths(baseUrl) {
   }).removeRetiredArtifacts();
 }
 function resolvePathCommands(command) {
-  const lookup = spawnSync2(
+  const lookup = spawnSync3(
     process.platform === "win32" ? "where" : "which",
     process.platform === "win32" ? [command] : ["-a", command],
     { encoding: "utf8", shell: process.platform === "win32" }
@@ -44547,7 +44573,7 @@ function isHomebrewFormulaCommand(path) {
 }
 function resolvePersistentGlobalCommand(dependencies = {}) {
   const platform3 = dependencies.platform ?? process.platform;
-  const run = dependencies.spawn ?? spawnSync2;
+  const run = dependencies.spawn ?? spawnSync3;
   const pathExists = dependencies.exists ?? existsSync15;
   const pathClis = dependencies.pathClis ?? resolvePathCommands("deepline");
   const homebrewCommand = pathClis.find(isHomebrewFormulaCommand);
@@ -44646,7 +44672,8 @@ function failSetupPhase(phases, phase, code) {
 }
 function rollbackCommand(scope, root) {
   const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify(join20(root, ".deepline", "runtime"))}` : "";
-  return `npm install -g${prefix} --no-audit --no-fund --include=optional deepline@${SDK_VERSION}`;
+  const allowScriptsFlag = npmSupportsAllowScripts(readNpmVersion(process.env)) ? " --allow-scripts=esbuild" : "";
+  return `npm install -g${prefix} --no-audit --no-fund --include=optional${allowScriptsFlag} deepline@${SDK_VERSION}`;
 }
 function setupResumeCommand(baseUrl, scope) {
   const hostPrefix = baseUrl === "https://code.deepline.com" ? "" : `DEEPLINE_HOST_URL=${JSON.stringify(baseUrl)} `;
@@ -45394,7 +45421,7 @@ function consumePendingCliUpdateMessages(homeDir2 = homedir10()) {
 }
 
 // src/cli/commands/update.ts
-import { spawn as spawn4, spawnSync as spawnSync3 } from "child_process";
+import { spawn as spawn4, spawnSync as spawnSync4 } from "child_process";
 import {
   existsSync as existsSync18,
   mkdirSync as mkdirSync14,
@@ -45761,7 +45788,7 @@ function normalizedNpmPrefix(value) {
 function resolveNpmGlobalPrefix(env) {
   try {
     const plan = resolveShellSpawn("npm", ["prefix", "-g"]);
-    const result = spawnSync3(plan.command, plan.args, {
+    const result = spawnSync4(plan.command, plan.args, {
       encoding: "utf8",
       env,
       shell: plan.shell,
@@ -45816,14 +45843,16 @@ function resolveUpdatePlan(options = {}) {
   const npmGlobalPrefix = options.npmGlobalPrefix !== void 0 ? options.npmGlobalPrefix : resolveNpmGlobalPrefix(env);
   const hasVerifiedNpmOwnership = inferredInstallPrefix !== null && normalizedNpmPrefix(inferredInstallPrefix) === normalizedNpmPrefix(npmGlobalPrefix);
   const installPrefix = options.requireVerifiedNpmOwnership ? hasVerifiedNpmOwnership ? inferredInstallPrefix : null : inferredInstallPrefix;
+  const npmVersion = options.npmVersion === void 0 ? readNpmVersion(env) : options.npmVersion;
+  const npmGlobalInstallFlags = npmSupportsAllowScripts(npmVersion) ? [...NPM_SDK_INSTALL_COMMON_FLAGS, "--allow-scripts=esbuild"] : NPM_SDK_INSTALL_COMMON_FLAGS;
   const args = installPrefix ? [
     "install",
     "-g",
     "--prefix",
     installPrefix,
-    ...NPM_SDK_INSTALL_COMMON_FLAGS,
+    ...npmGlobalInstallFlags,
     packageSpec
-  ] : ["install", "-g", ...NPM_SDK_INSTALL_COMMON_FLAGS, packageSpec];
+  ] : ["install", "-g", ...npmGlobalInstallFlags, packageSpec];
   const fallbackRegistryUrl = options.npmFallbackRegistryUrl !== void 0 ? options.npmFallbackRegistryUrl : publicNpmFallbackRegistryUrl(
     env.DEEPLINE_HOST_URL?.trim() || autoDetectBaseUrl()
   );

package/dist/index.js

@@ -864,7 +864,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.160",
+  version: "0.3.161",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -768,7 +768,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.160",
+  version: "0.3.161",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.160";
+    readonly version: "0.3.161";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.160";
+    readonly version: "0.3.161";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.160",
+  version: "0.3.161",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.160",
+  version: "0.3.161",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.160",
+  "version": "0.3.161",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",