deepline 0.3.22 → 0.3.24

package/dist/bundling-sources/sdk/src/client.ts

@@ -1033,6 +1033,28 @@ export type TargetBillingStatusResult = {
   as_of: string | null;
 };
 
+export type TargetAutoRechargeResult = {
+  org_id: string;
+  enabled: boolean;
+  available: boolean;
+  reason: string | null;
+  threshold_credits: number | null;
+  refill_to_credits: number | null;
+  rolling_limit_cents: null;
+};
+
+export type TargetAutoRechargeUpdateOptions =
+  | {
+      enabled: false;
+      idempotencyKey: string;
+    }
+  | {
+      enabled: true;
+      thresholdCredits: number;
+      refillToCredits: number;
+      idempotencyKey: string;
+    };
+
 export type TargetBillingMutationResult = {
   data: Record<string, unknown>;
   operation: TargetBillingOperation;
@@ -1158,6 +1180,13 @@ export type BillingNamespace = {
   targetPlans: () => Promise<TargetBillingPlansResult>;
   /** Normalized target billing state. */
   targetStatus: () => Promise<TargetBillingStatusResult>;
+  /** Read and manage the Metronome-backed automatic recharge configuration. */
+  autoRecharge: {
+    get: () => Promise<TargetAutoRechargeResult>;
+    update: (
+      options: TargetAutoRechargeUpdateOptions,
+    ) => Promise<TargetAutoRechargeResult>;
+  };
   /** Buy Deepline credits through a payment-gated Metronome commit. */
   purchaseCredits: (options: {
     credits: number;
@@ -1750,6 +1779,10 @@ export class DeeplineClient {
       },
       targetPlans: () => this.getTargetBillingPlans(),
       targetStatus: () => this.getTargetBillingStatus(),
+      autoRecharge: {
+        get: () => this.getTargetAutoRecharge(),
+        update: (options) => this.updateTargetAutoRecharge(options),
+      },
       purchaseCredits: (options) => this.purchaseTargetBillingCredits(options),
       transitionPlan: (options) => this.transitionTargetBillingPlan(options),
       portalSession: () => this.createTargetBillingPortalSession(),
@@ -4537,6 +4570,37 @@ export class DeeplineClient {
     return this.http.get<TargetBillingStatusResult>('/api/v2/billing/status');
   }
 
+  /** Read the canonical Metronome automatic recharge configuration. */
+  async getTargetAutoRecharge(): Promise<TargetAutoRechargeResult> {
+    return this.http.get<TargetAutoRechargeResult>(
+      '/api/v2/billing/auto-recharge',
+    );
+  }
+
+  /** Update automatic recharge and return the server-verified configuration. */
+  async updateTargetAutoRecharge(
+    options: TargetAutoRechargeUpdateOptions,
+  ): Promise<TargetAutoRechargeResult> {
+    const idempotencyKey = requireTargetBillingIdempotencyKey(
+      options.idempotencyKey,
+    );
+    const response = await this.http.put<{
+      data: TargetAutoRechargeResult;
+      request_id?: string;
+    }>(
+      '/api/v2/billing/auto-recharge',
+      options.enabled
+        ? {
+            enabled: true,
+            threshold_credits: options.thresholdCredits,
+            refill_to_credits: options.refillToCredits,
+          }
+        : { enabled: false },
+      { 'Idempotency-Key': idempotencyKey },
+    );
+    return response.data;
+  }
+
   /**
    * Purchase target-billing credits through the durable commercial operation
    * flow. The caller supplies an idempotency key for safe retries.

package/dist/bundling-sources/sdk/src/http.ts

@@ -18,9 +18,6 @@
  *
  * @module
  */
-import { existsSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import type { ResolvedConfig } from './types.js';
 import {
   AuthError,
@@ -36,8 +33,8 @@ import {
 } from '../../shared_libs/tool-execution-error.js';
 import { SDK_API_CONTRACT, SDK_VERSION } from './version.js';
 import type { LiveEventEnvelope } from './types.js';
-import { baseUrlSlug, sdkCliStateDirPath } from './config.js';
 import { detectAgentRuntime, isCoworkLikeSandbox } from './agent-runtime.js';
+import { readSdkSkillsLocalVersion } from './skills-version.js';
 import {
   ABSURD_RELEASE_OVERRIDE_HEADER,
   COORDINATOR_INTERNAL_TOKEN_HEADER,
@@ -201,23 +198,9 @@ export class HttpClient {
     );
     if (explicit) return explicit;
     try {
-      const versionPath = join(
-        sdkCliStateDirPath(this.config.baseUrl),
-        'skills-version',
+      return this.cleanDiagnosticHeader(
+        readSdkSkillsLocalVersion(this.config.baseUrl),
       );
-      const legacyVersionPath = join(
-        process.env.HOME?.trim() || homedir(),
-        '.local',
-        'deepline',
-        baseUrlSlug(this.config.baseUrl),
-        'sdk-skills',
-        '.version',
-      );
-      const resolvedPath = existsSync(versionPath)
-        ? versionPath
-        : legacyVersionPath;
-      if (!existsSync(resolvedPath)) return null;
-      return this.cleanDiagnosticHeader(readFileSync(resolvedPath, 'utf-8'));
     } catch {
       return null;
     }

package/dist/bundling-sources/sdk/src/release.ts

@@ -192,7 +192,7 @@ export const SDK_RELEASE = {
   // 0.3.0 introduces raw-v2: complete scrubbed provider responses are
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
-  version: '0.3.22',
+  version: '0.3.24',
   updateSummary:
     'New raw-v2 tool responses preserve complete scrubbed provider envelopes at toolResponse.rawV2, including JSON:API included resources, links, cursors, and totals. Existing toolResponse.raw and declared getters keep working unchanged.',
   contracts: {

package/dist/bundling-sources/sdk/src/skills-version.ts

@@ -0,0 +1,107 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { detectAgentRuntime } from './agent-runtime.js';
+import { sdkCliStateDirPath } from './config.js';
+
+function activePluginSkillsDir(): string {
+  const pluginMode = process.env.DEEPLINE_PLUGIN_MODE?.trim().toLowerCase();
+  if (
+    pluginMode !== 'true' &&
+    pluginMode !== '1' &&
+    pluginMode !== 'yes' &&
+    pluginMode !== 'on'
+  ) {
+    return '';
+  }
+  const dir = process.env.DEEPLINE_PLUGIN_SKILLS_DIR?.trim() ?? '';
+  return dir && existsSync(dir) ? dir : '';
+}
+
+export function hasActivePluginSkills(): boolean {
+  return Boolean(activePluginSkillsDir());
+}
+
+function readPluginSkillsVersion(): string {
+  const dir = activePluginSkillsDir();
+  if (!dir) return '';
+  try {
+    return readFileSync(join(dir, '.version'), 'utf-8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function sdkSkillsVersionPath(
+  baseUrl: string,
+  agents: readonly string[] = [],
+): string {
+  const suffix = agents.length > 0 ? `-${agents.join('-')}` : '';
+  return join(sdkCliStateDirPath(baseUrl), `skills${suffix}-version`);
+}
+
+function legacySdkSkillsVersionPath(baseUrl: string): string {
+  return join(dirname(sdkCliStateDirPath(baseUrl)), 'sdk-skills', '.version');
+}
+
+export function resolveAutoSyncSkillAgents(): string[] {
+  switch (detectAgentRuntime()) {
+    case 'codex':
+      return ['codex'];
+    case 'claude_code':
+      return ['claude-code'];
+    case 'cursor':
+      return ['cursor'];
+    case 'gemini':
+      return ['gemini-cli'];
+    case 'antigravity':
+      return ['antigravity'];
+    default:
+      return [];
+  }
+}
+
+export function readSdkSkillsLocalVersion(baseUrl: string): string {
+  const pluginVersion = readPluginSkillsVersion();
+  if (pluginVersion) return pluginVersion;
+
+  const agents = resolveAutoSyncSkillAgents();
+  const scopedPath = sdkSkillsVersionPath(baseUrl, agents);
+  if (agents.length > 0 && existsSync(scopedPath)) {
+    try {
+      return readFileSync(scopedPath, 'utf-8').trim();
+    } catch {
+      return '';
+    }
+  }
+  // Legacy clients wrote a host-wide version after updating only their active
+  // agent. A detected agent without its own marker must therefore re-check
+  // instead of assuming another agent's legacy install applies to it.
+  if (agents.length > 0) {
+    const legacyPath = legacySdkSkillsVersionPath(baseUrl);
+    if (!existsSync(legacyPath)) return '';
+    try {
+      return readFileSync(legacyPath, 'utf-8').trim();
+    } catch {
+      return '';
+    }
+  }
+  const path = existsSync(sdkSkillsVersionPath(baseUrl))
+    ? sdkSkillsVersionPath(baseUrl)
+    : legacySdkSkillsVersionPath(baseUrl);
+  if (!existsSync(path)) return '';
+  try {
+    return readFileSync(path, 'utf-8').trim();
+  } catch {
+    return '';
+  }
+}
+
+export function writeSdkSkillsLocalVersion(
+  baseUrl: string,
+  version: string,
+  agents: readonly string[],
+): void {
+  const path = sdkSkillsVersionPath(baseUrl, agents);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${version}\n`, 'utf-8');
+}

package/dist/bundling-sources/sdk/src/types.ts

@@ -1280,6 +1280,17 @@ export interface PlayCheckResult {
   valid: boolean;
   errors: string[];
   warnings?: string[];
+  /**
+   * Effective sandbox limits selected for this Play when authoring-contract
+   * preflight succeeded. A valid modern check includes the default 30-minute
+   * timeout when the author did not declare `runtime`.
+   */
+  runtimeLimit?: {
+    timeoutSeconds: number;
+    memoryGiB: number;
+    cpu: number;
+    diskGiB: number;
+  } | null;
   staticPipeline?: Record<string, unknown> | null;
   toolGetterHints?: PlayCheckToolGetterHint[];
   /**
@@ -1308,6 +1319,11 @@ export interface PlayCheckResult {
    * `1 trigger · 2 tools · 1 dataset · 14 columns`.
    */
   summary?: string;
+  /**
+   * Feature-gated validation paths that were enabled for this exact cloud
+   * check. Present as an empty array when no feature gate affected the result.
+   */
+  featureFlags?: PlayCheckFeatureFlag[];
   artifactHash?: string | null;
   graphHash?: string | null;
   /** SHA-256 of the exact source bytes checked by Deepline. */
@@ -1338,9 +1354,24 @@ export interface PlayCheckResult {
       limitBytes: number;
       withinLimit: boolean;
     };
+    /** Present when this Play declares a cron binding. Advisory only; publish reserves capacity. */
+    activeScheduledPlays?: {
+      used: number;
+      limit: number;
+      remaining: number;
+      approachingLimit: boolean;
+    };
   };
 }
 
+/** An enabled server-side feature flag that affected a Play check. */
+export interface PlayCheckFeatureFlag {
+  id: string;
+  label: string;
+  enabled: true;
+  reason: string;
+}
+
 /**
  * One exported play's check result inside a multi-play file. Carries the same
  * per-play fields as {@link PlayCheckResult}, unprefixed and unaggregated, so a
@@ -1360,6 +1391,7 @@ export interface PlayCheckExportResult {
   graphHash?: string | null;
   sourceHash?: string | null;
   summary?: string;
+  featureFlags?: PlayCheckFeatureFlag[];
   recognized?: PlayCheckRecognizedSummary;
   triggers?: PlayCheckTriggersSummary | null;
 }

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -52,6 +52,7 @@ import {
 import { vercelProtectionBypassHeaders } from '@shared_libs/play-runtime/vercel-protection';
 import type { RuntimeReceiptAction } from '@shared_libs/play-runtime/runtime-actions';
 import { RUNTIME_CAPACITY_POLICY } from '@shared_libs/play-runtime/runtime-capacity-policy';
+import { RUNTIME_RELIABILITY_POLICY } from '@shared_libs/play-runtime/runtime-reliability-policy';
 import {
   DEFAULT_RUNTIME_TRAFFIC_POLICY,
   isRuntimeTrafficPolicy,
@@ -258,6 +259,10 @@ function applyRetryJitter(delayMs: number): number {
 }
 const APP_RUNTIME_API_DEFAULT_REQUEST_TIMEOUT_MS =
   RUNTIME_CAPACITY_POLICY.receiptGateway.requestTimeoutMs;
+const SIGNED_R2_FETCH_HEADERS_TIMEOUT_MS =
+  RUNTIME_RELIABILITY_POLICY.egress.fetchHeadersTimeoutMs;
+const SIGNED_R2_FETCH_BODY_TIMEOUT_MS =
+  RUNTIME_RELIABILITY_POLICY.egress.fetchBodyTimeoutMs;
 const APP_RUNTIME_RECEIPT_RETRY_TELEMETRY_TAG =
   '[perf][worker.receipt_api.transport]';
 const RUN_STATUS_LEDGER_SNAPSHOT_CACHE_LIMIT = 1_000;
@@ -1338,6 +1343,19 @@ type SignedR2ReadUrlResponse = {
   expiresAt: string;
 };
 
+class SignedR2FetchTimeoutError extends Error {
+  constructor(
+    kind: 'artifact' | 'staged_file',
+    phase: 'headers' | 'body',
+    timeoutMs: number,
+  ) {
+    super(
+      `Signed R2 ${kind} fetch exceeded its ${phase} deadline after ${timeoutMs}ms.`,
+    );
+    this.name = 'SignedR2FetchTimeoutError';
+  }
+}
+
 function logSignedR2FetchPerf(input: {
   kind: 'artifact' | 'staged_file';
   storageKey: string;
@@ -1352,18 +1370,67 @@ function logSignedR2FetchPerf(input: {
   });
 }
 
+async function runSignedR2FetchPhase<T>(input: {
+  controller: AbortController;
+  kind: 'artifact' | 'staged_file';
+  phase: 'headers' | 'body';
+  run: () => Promise<T>;
+  timeoutMs: number;
+}): Promise<T> {
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+  const timeoutPromise = new Promise<never>((_resolve, reject) => {
+    timeout = setTimeout(() => {
+      const error = new SignedR2FetchTimeoutError(
+        input.kind,
+        input.phase,
+        input.timeoutMs,
+      );
+      input.controller.abort(error);
+      reject(error);
+    }, input.timeoutMs);
+  });
+  try {
+    return await Promise.race([input.run(), timeoutPromise]);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+
+async function fetchSignedR2Response(input: {
+  kind: 'artifact' | 'staged_file';
+  signed: SignedR2ReadUrlResponse;
+}): Promise<{ controller: AbortController; response: Response }> {
+  const controller = new AbortController();
+  const response = await runSignedR2FetchPhase({
+    controller,
+    kind: input.kind,
+    phase: 'headers',
+    timeoutMs: SIGNED_R2_FETCH_HEADERS_TIMEOUT_MS,
+    run: () => fetch(input.signed.url, { signal: controller.signal }),
+  });
+  return { controller, response };
+}
+
 async function fetchSignedR2Buffer(input: {
   kind: 'artifact' | 'staged_file';
   signed: SignedR2ReadUrlResponse;
 }): Promise<Buffer> {
   const startedAt = Date.now();
-  const response = await fetch(input.signed.url);
+  const { controller, response } = await fetchSignedR2Response(input);
   if (!response.ok) {
     throw new Error(
       `Signed R2 ${input.kind} fetch failed for ${input.signed.storageKey} with status ${response.status}: ${await response.text()}`,
     );
   }
-  const buffer = Buffer.from(await response.arrayBuffer());
+  const buffer = Buffer.from(
+    await runSignedR2FetchPhase({
+      controller,
+      kind: input.kind,
+      phase: 'body',
+      timeoutMs: SIGNED_R2_FETCH_BODY_TIMEOUT_MS,
+      run: () => response.arrayBuffer(),
+    }),
+  );
   logSignedR2FetchPerf({
     kind: input.kind,
     storageKey: input.signed.storageKey,
@@ -1379,7 +1446,7 @@ async function fetchSignedR2ToFile(input: {
   targetPath: string;
 }): Promise<void> {
   const startedAt = Date.now();
-  const response = await fetch(input.signed.url);
+  const { controller, response } = await fetchSignedR2Response(input);
   if (!response.ok) {
     throw new Error(
       `Signed R2 ${input.kind} fetch failed for ${input.signed.storageKey} with status ${response.status}: ${await response.text()}`,
@@ -1390,10 +1457,19 @@ async function fetchSignedR2ToFile(input: {
       `Signed R2 ${input.kind} fetch returned an empty response body for ${input.signed.storageKey}.`,
     );
   }
-  await pipeline(
-    Readable.fromWeb(response.body as Parameters<typeof Readable.fromWeb>[0]),
-    createWriteStream(input.targetPath),
-  );
+  await runSignedR2FetchPhase({
+    controller,
+    kind: input.kind,
+    phase: 'body',
+    timeoutMs: SIGNED_R2_FETCH_BODY_TIMEOUT_MS,
+    run: async () =>
+      await pipeline(
+        Readable.fromWeb(
+          response.body as Parameters<typeof Readable.fromWeb>[0],
+        ),
+        createWriteStream(input.targetPath),
+      ),
+  });
   const written = await stat(input.targetPath);
   logSignedR2FetchPerf({
     kind: input.kind,

package/dist/bundling-sources/shared_libs/play-runtime/projection.ts

@@ -2,7 +2,7 @@
 //
 // "Projection" is the step that turns a provider response into the value a
 // target (email, email_status, phone, ...) resolves to. Historically this was
-// reimplemented in three runtimes (the V2 tool-result runtime, the playground
+// reimplemented in three runtimes (the V2 tool-result runtime, the portable
 // waterfall runtime, and the emitted V1-enrich play) with divergent precedence
 // — a latent drift bug class. This module is the one authoritative
 // implementation: callers supply a `ProjectionLookup` that knows how to walk
@@ -29,7 +29,7 @@ export type ProjectionHit = { value: unknown; path: string } | null;
  * The only seam-crossing dependency. Each runtime supplies an adapter that
  * resolves a list of candidate paths against its own payload shape and returns
  * the first meaningful hit (or null). This absorbs the input-shape difference
- * (V2 `{toolResponse:{raw}}` envelope vs playground raw payload vs the enrich
+ * (V2 `{toolResponse:{raw}}` envelope vs portable raw payload vs the enrich
  * play's pre-projected getters); the interpreter itself is payload-agnostic.
  */
 export type ProjectionLookup = (paths: readonly string[]) => ProjectionHit;

package/dist/bundling-sources/shared_libs/play-runtime/run-failure.ts

@@ -18,6 +18,7 @@ const RUNTIME_SANDBOX_START_FAILED_RE = /\bRUNTIME_SANDBOX_START_FAILED\b/i;
 const RUNTIME_SANDBOX_OOM_RE =
   /\bRUNTIME_SANDBOX_OOM\b|(?:javascript heap out of memory|fatal error:.*(?:heap|allocation).*memory)/i;
 const RUNTIME_SANDBOX_KILLED_RE = /\bRUNTIME_SANDBOX_KILLED\b/i;
+const MODAL_PAYLOAD_UPLOAD_TIMEOUT_RE = /\bMODAL_PAYLOAD_UPLOAD_TIMEOUT\b/i;
 const OUTPUT_TOO_LARGE_RE = /\b(?:OUTPUT_TOO_LARGE|OutputTooLarge)\b/;
 
 export const PLATFORM_DEPLOY_INTERRUPTED_MESSAGE =
@@ -48,6 +49,8 @@ export const RUNTIME_SANDBOX_INSPECTION_UNAVAILABLE_MESSAGE =
 // carries: nothing ran, so no provider call can already exist.
 export const RUNTIME_SANDBOX_START_FAILED_MESSAGE =
   'The execution sandbox never finished starting, so this play never began running. Re-run the same command; if this keeps happening, contact Deepline support with the run ID.';
+export const MODAL_PAYLOAD_UPLOAD_TIMEOUT_MESSAGE =
+  'The execution sandbox payload upload timed out before this play began. Re-run the same command; if this keeps happening, contact Deepline support with the run ID.';
 
 export const WORKSPACE_STORAGE_NOT_READY_CODE = 'WORKSPACE_STORAGE_NOT_READY';
 
@@ -371,6 +374,15 @@ export function normalizePlayRunFailure(error: unknown): PlayRunFailureDetails {
       ...(causes.length > 0 ? { causes } : {}),
     };
   }
+  if (MODAL_PAYLOAD_UPLOAD_TIMEOUT_RE.test(rawCause)) {
+    return {
+      code: 'MODAL_PAYLOAD_UPLOAD_TIMEOUT',
+      phase: 'infrastructure',
+      message: MODAL_PAYLOAD_UPLOAD_TIMEOUT_MESSAGE,
+      retryable: true,
+      cause,
+    };
+  }
   if (RUNTIME_SANDBOX_INSPECTION_UNAVAILABLE_RE.test(rawCause)) {
     return {
       code: 'RUNTIME_SANDBOX_INSPECTION_UNAVAILABLE',

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -417,6 +417,14 @@ async function createRetriedOneShotDaytonaSandbox(input: {
         attempt,
         error: message,
       });
+      const immediateFallbackReason =
+        resolveDaytonaSandboxAcquisitionUnavailableReason([message]);
+      if (immediateFallbackReason === 'daytona_total_cpu_limit_exceeded') {
+        throw new DaytonaSandboxAcquisitionUnavailableError(
+          immediateFallbackReason,
+          `Daytona sandbox create rejected by the organization CPU limit on provider attempt ${attempt}: ${message}`,
+        );
+      }
       if (isDaytonaSandboxStartTimeout(message)) {
         const deleted = await reconcileAndDeleteTimedOutDaytonaSandbox({
           daytona: input.daytona,