deepline 0.3.294 → 0.3.296

package/dist/bundling-sources/sdk/src/compat.ts

@@ -1,5 +1,13 @@
 import { SDK_API_CONTRACT, SDK_API_MAJOR, SDK_VERSION } from './version.js';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { sdkCliStateDirPath } from './config.js';
@@ -96,6 +104,21 @@ type CompatCacheFile = {
   >;
 };
 
+function writeCompatibilityCacheFile(
+  path: string,
+  cache: CompatCacheFile,
+): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(tempPath, `${JSON.stringify(cache, null, 2)}\n`);
+    // Concurrent CLI processes must never see a partially written policy.
+    renameSync(tempPath, path);
+  } finally {
+    rmSync(tempPath, { force: true });
+  }
+}
+
 function shouldSkipCompatibilityCheck(): boolean {
   const value =
     process.env.DEEPLINE_SKIP_SDK_COMPAT_CHECK?.trim().toLowerCase();
@@ -273,7 +296,7 @@ function invalidateCachedCompatibility(
     const entries = existing.entries ?? {};
     delete entries[compatibilityCacheKey(baseUrl, command, skillsVersion)];
     delete entries[legacyCompatibilityCacheKey(baseUrl, command)];
-    writeFileSync(cachePath, `${JSON.stringify({ entries }, null, 2)}\n`);
+    writeCompatibilityCacheFile(cachePath, { entries });
   } catch {
     // A cache that cannot be edited simply expires on its own TTL.
   }
@@ -287,16 +310,21 @@ function writeCachedCompatibility(
 ): void {
   try {
     const path = sdkCompatibilityCachePath(baseUrl);
-    const existing = existsSync(path)
-      ? (JSON.parse(readFileSync(path, 'utf8')) as CompatCacheFile)
-      : {};
+    let existing: CompatCacheFile = {};
+    if (existsSync(path)) {
+      try {
+        existing = JSON.parse(readFileSync(path, 'utf8')) as CompatCacheFile;
+      } catch {
+        // A failed or overlapping old write can corrupt the optional cache.
+        // Replace it with this live policy instead of failing every future write.
+      }
+    }
     const entries = existing.entries ?? {};
     entries[compatibilityCacheKey(baseUrl, command, skillsVersion)] = {
       savedAt: Date.now(),
       response,
     };
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify({ entries }, null, 2)}\n`);
+    writeCompatibilityCacheFile(path, { entries });
   } catch {
     // Compatibility checks are advisory unless the server explicitly responds
     // with a blocking policy. Cache failures must not block normal CLI usage.

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.294',
+  version: '0.3.296',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -193,6 +193,7 @@ import {
   readAbsurdSchemaSql,
 } from './absurd-pool';
 import {
+  isImmutableRuntimeExecutionRecoveryOrigin,
   runtimeApiBaseUrlFromLaunch,
   runtimeTokenOriginFromLaunch,
 } from './runtime-api-origin';
@@ -349,11 +350,15 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 // v58 installs deferred outbox readers while retaining synchronous writers
 // until the separately operated, reader-first cutover.
 // v59 adds origin identity bulk projection and independent durable search progress.
-export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 59;
+// v60 indexes all sandbox leases by Run, including released custody history.
+// This marker records deployment work, never a runtime schema floor.
+export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 60;
 const POSTGRES_SCHEDULER_SCHEMA_MIGRATIONS_TABLE =
   'scheduler_schema_migrations';
 export const POSTGRES_SCHEDULER_OPEN_RECOVERY_INDEX =
   'runtime_scheduler_runs_open_recovery_idx';
+export const POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX =
+  'runtime_scheduler_sandbox_capacity_leases_custody_idx';
 const POSTGRES_SCHEDULER_DEPENDENCY_CIRCUITS_TABLE =
   'runtime_dependency_circuits';
 /**
@@ -2693,6 +2698,12 @@ export async function ensurePostgresSchedulerSchema(
     const hasLegacyAdmissionRows =
       legacyAdmissionRows?.rows[0]?.present === true;
     if (schemaCoreIsCurrent) {
+      if (!options?.deferRuntimeAdminIndexes) {
+        await ensurePostgresSchedulerSandboxCustodyIndex(client, {
+          schema,
+          concurrently: false,
+        });
+      }
       await ensurePostgresSchedulerLaunchAdmissionFunctions(client, options);
       if (!schemaIsCurrent) {
         await ensurePostgresSchedulerTerminalComputeBillingOutboxTrigger(
@@ -3163,6 +3174,12 @@ export async function ensurePostgresSchedulerSchema(
       (run_id, provider, sandbox_id)
       WHERE released_at IS NULL
   `);
+    if (!options?.deferRuntimeAdminIndexes) {
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS ${POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX}
+          ON ${tableName('runtime_sandbox_capacity_leases', options)} (run_id, lease_id)
+      `);
+    }
     // Deletion note: runtime outbox producers were removed from the legacy
     // store path, but the table stays in bootstrap while run-read-model/admin
     // callers still import the projector against existing runtime_scheduler
@@ -4122,7 +4139,17 @@ export type PostgresSchedulerIndexState =
   | { kind: 'invalid'; ready: boolean }
   | { kind: 'ready' };
 
+// Custody locks include released history. The active-resource partial index
+// cannot serve that read while the transaction owns the Run and attempt locks.
+// This is a deploy-owned optimization, never a runtime admission prerequisite.
+const POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION = {
+  name: POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX,
+  table: 'runtime_sandbox_capacity_leases',
+  definition: '(run_id, lease_id)',
+} as const;
+
 const POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES = [
+  POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION,
   {
     name: 'runtime_scheduler_attempts_active_status_created_idx',
     table: 'attempts',
@@ -4337,38 +4364,73 @@ export async function ensurePostgresSchedulerRuntimeAdminIndexesConcurrently(
   client: PostgresSchedulerQueryClient,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<void> {
-  const schema = schemaName(options);
   for (const index of POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES) {
-    const state = await readPostgresSchedulerIndexState(
-      client,
-      index.name,
-      index.table,
-      options,
+    await ensurePostgresSchedulerIndex(client, index, options, true);
+  }
+}
+
+async function ensurePostgresSchedulerIndex(
+  client: PostgresSchedulerQueryClient,
+  index: { name: string; table: string; definition: string },
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  concurrently: boolean,
+): Promise<void> {
+  const schema = schemaName(options);
+  const state = await readPostgresSchedulerIndexState(
+    client,
+    index.name,
+    index.table,
+    options,
+  );
+  if (state.kind === 'ready') return;
+  const mode = concurrently ? 'CONCURRENTLY ' : '';
+  if (state.kind === 'invalid') {
+    await client.query(
+      `DROP INDEX ${mode}IF EXISTS ${quoteIdent(schema)}.${quoteIdent(index.name)}`,
     );
-    if (state.kind === 'ready') continue;
-    if (state.kind === 'invalid') {
-      await client.query(
-        `DROP INDEX CONCURRENTLY IF EXISTS ${quoteIdent(schema)}.${quoteIdent(index.name)}`,
-      );
-    }
-    await client.query(`
-      CREATE INDEX CONCURRENTLY IF NOT EXISTS ${quoteIdent(index.name)}
-        ON ${tableName(index.table, options)} ${index.definition}
-    `);
-    const installed = await readPostgresSchedulerIndexState(
-      client,
-      index.name,
-      index.table,
-      options,
+  }
+  await client.query(`
+    CREATE INDEX ${mode}IF NOT EXISTS ${quoteIdent(index.name)}
+      ON ${tableName(index.table, options)} ${index.definition}
+  `);
+  const installed = await readPostgresSchedulerIndexState(
+    client,
+    index.name,
+    index.table,
+    options,
+  );
+  if (installed.kind !== 'ready') {
+    throw new Error(
+      `Runtime scheduler index ${schema}.${index.name} is not valid and ready after creation.`,
     );
-    if (installed.kind !== 'ready') {
-      throw new Error(
-        `Runtime scheduler index ${schema}.${index.name} is not valid and ready after concurrent creation.`,
-      );
-    }
   }
 }
 
+export async function readPostgresSchedulerSandboxCustodyIndexState(
+  client: PostgresSchedulerQueryClient,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerIndexState> {
+  return readPostgresSchedulerIndexState(
+    client,
+    POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX,
+    'runtime_sandbox_capacity_leases',
+    options,
+  );
+}
+
+/** Shared schemas build concurrently; only quiesced run-scoped schemas opt out. */
+export async function ensurePostgresSchedulerSandboxCustodyIndex(
+  client: PostgresSchedulerQueryClient,
+  options: Pick<PostgresSchedulerOptions, 'schema'> & { concurrently: boolean },
+): Promise<void> {
+  await ensurePostgresSchedulerIndex(
+    client,
+    POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION,
+    options,
+    options.concurrently,
+  );
+}
+
 export async function readPostgresSchedulerOpenRecoveryIndexState(
   client: PostgresSchedulerQueryClient,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -20976,12 +21038,12 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   );
 }
 
-// Only freshly gateway-issued legacy run.progress authority is reused.
-// Prefix advertisements are reacquired for each drain because they select its
-// receipt shape, including recovery across receiver capability changes. This is not
-// a lease cache: every delivery still claims, renews, and proves its own lease
-// at append. Include the complete pinned authority/routing and internal-token
-// fingerprint so a different run, schema, origin, or authority never shares it.
+// Reuse only gateway-issued run.progress authority. A prefix advertisement
+// remains reusable only for the same immutable app build; mutable receivers
+// must reacquire their current receipt shape on every drain. Every delivery
+// still claims, renews, and proves its own live lease at append. The complete
+// authority/routing and internal-token fingerprint isolates each run, schema,
+// origin, and authority. Cache loss or signer rotation never owns delivery.
 const RUN_LEDGER_DISPATCH_TOKEN_CACHE_MS = 30_000;
 const RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES = 256;
 const runLedgerDispatchTokens = new Map<
@@ -21025,6 +21087,9 @@ async function requestRunLedgerDispatchToken(
       executorToken: cached.token,
       reused: true,
       cacheKey,
+      ...(cached.runLedgerIngressPrefixBatching
+        ? { runLedgerIngressPrefixBatching: true as const }
+        : {}),
     };
   runLedgerDispatchTokens.delete(cacheKey);
   const url = `${runtimeApiBaseUrlFromLaunch(input.launch).replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
@@ -21096,6 +21161,11 @@ async function requestRunLedgerDispatchToken(
             : 'invalid response',
     });
   }
+  const reusablePrefix =
+    body.runLedgerIngressPrefixBatching === true &&
+    isImmutableRuntimeExecutionRecoveryOrigin(
+      runtimeApiBaseUrlFromLaunch(input.launch),
+    );
   // Decode only the lifetime, never an authentication decision: the app
   // validates the signature, run scope, and live delivery lease on append.
   // Opaque/older token formats continue to work without this optimization.
@@ -21107,7 +21177,7 @@ async function requestRunLedgerDispatchToken(
       ).toString(),
     ) as { exp?: unknown };
     if (
-      body.runLedgerIngressPrefixBatching === undefined &&
+      (body.runLedgerIngressPrefixBatching === undefined || reusablePrefix) &&
       typeof claims.exp === 'number' &&
       Number.isFinite(claims.exp)
     ) {
@@ -21119,6 +21189,9 @@ async function requestRunLedgerDispatchToken(
         runLedgerDispatchTokens.set(cacheKey, {
           token: body.executorToken,
           expiresAt,
+          ...(reusablePrefix
+            ? { runLedgerIngressPrefixBatching: true as const }
+            : {}),
         });
         while (
           runLedgerDispatchTokens.size > RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES
@@ -21132,7 +21205,7 @@ async function requestRunLedgerDispatchToken(
   } catch {
     // A cache miss never changes delivery or hides a gateway rejection.
   }
-  if (body.runLedgerIngressPrefixBatching !== undefined) {
+  if (body.runLedgerIngressPrefixBatching !== undefined && !reusablePrefix) {
     runLedgerDispatchTokens.delete(cacheKey);
   }
   return {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-api-origin.ts

@@ -1,5 +1,30 @@
 import type { PlaySchedulerSubmitInput } from '../scheduler-backend';
 
+const RUNTIME_EXECUTION_RECOVERY_DEPLOYMENT_HOST_RE =
+  /^deepline(?:-api-[a-z0-9]+|-(?!api-)[a-z0-9]+)-aero-team-0f650658\.vercel\.app$/;
+
+/** A recovery reader must remain on one immutable, Deepline-owned app build. */
+export function isImmutableRuntimeExecutionRecoveryOrigin(
+  origin: string,
+): boolean {
+  try {
+    const url = new URL(origin);
+    return (
+      url.origin === origin &&
+      url.protocol === 'https:' &&
+      url.username === '' &&
+      url.password === '' &&
+      url.port === '' &&
+      url.pathname === '/' &&
+      url.search === '' &&
+      url.hash === '' &&
+      RUNTIME_EXECUTION_RECOVERY_DEPLOYMENT_HOST_RE.test(url.hostname)
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Resolve the app origin used for authenticated runtime API calls.
  *

package/dist/bundling-sources/shared_libs/play-runtime/tool-http-errors.ts

@@ -348,11 +348,24 @@ function formatInsufficientCreditsMessage(input: {
         ? ` Add credits at ${billingUrl}.`
         : '';
   const minimum = input.billing.minimum_balance_credits;
+  const estimate = input.billing.estimated_credits;
+  const estimatedPrice =
+    typeof estimate === 'number'
+      ? ` Estimated price: ${formatCreditAmount(estimate)}.`
+      : '';
   if (
     typeof minimum === 'number' &&
     input.billing.required_credits === minimum
   ) {
-    return `Workspace balance ${balance} is below the ${formatCreditAmount(minimum)}-credit workspace minimum for starting a billable call (${operation}); this is a workspace-wide minimum, separate from the tool's own price.${addSuffix}`;
+    return `Workspace balance ${balance} is below the ${formatCreditAmount(minimum)}-credit workspace minimum for starting a billable call (${operation}); this is a workspace-wide minimum, separate from the tool's own price.${estimatedPrice}${addSuffix}`;
+  }
+  // A required balance above the call's estimate is headroom, not a price.
+  if (
+    typeof estimate === 'number' &&
+    typeof input.billing.required_credits === 'number' &&
+    input.billing.required_credits > estimate
+  ) {
+    return `Workspace balance ${balance} is below the ${required}-credit balance required to start ${operation}; this is a required balance, not the price.${estimatedPrice}${addSuffix}`;
   }
   return `Workspace balance ${balance} < required ${required} for ${operation}.${addSuffix}`;
 }

package/dist/cli/auth-JCGIDVDF.mjs

@@ -0,0 +1,31 @@
+import {
+  EXIT_WORKSPACE_MISMATCH,
+  clearPendingClaim,
+  clearSatisfiedPendingClaim,
+  handleRegister,
+  handleStatus,
+  handleWait,
+  readPendingAuthClaim,
+  registerAuthCommands,
+  reportSetupCompleted,
+  resolvePendingAuthClaimForResume
+} from "./chunk-BZ77OTRF.mjs";
+import "./chunk-NTEZFZLE.mjs";
+import "./chunk-NPPJX3BL.mjs";
+import "./chunk-DLIRSHV6.mjs";
+import "./chunk-QSIO4TX2.mjs";
+import "./chunk-NXGCO4JB.mjs";
+import "./chunk-WZYKRD7T.mjs";
+import "./chunk-KRD6H754.mjs";
+export {
+  EXIT_WORKSPACE_MISMATCH,
+  clearPendingClaim,
+  clearSatisfiedPendingClaim,
+  handleRegister,
+  handleStatus,
+  handleWait,
+  readPendingAuthClaim,
+  registerAuthCommands,
+  reportSetupCompleted,
+  resolvePendingAuthClaimForResume
+};

package/dist/cli/auth-QDWV3TXX.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunkZDOC4HFLjs = require('./chunk-ZDOC4HFL.js');
+require('./chunk-7D6QG5KF.js');
+require('./chunk-6HPEDBSJ.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-LIKFCE7Z.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkZDOC4HFLjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkZDOC4HFLjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkZDOC4HFLjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkZDOC4HFLjs.handleRegister; exports.handleStatus = _chunkZDOC4HFLjs.handleStatus; exports.handleWait = _chunkZDOC4HFLjs.handleWait; exports.readPendingAuthClaim = _chunkZDOC4HFLjs.readPendingAuthClaim; exports.registerAuthCommands = _chunkZDOC4HFLjs.registerAuthCommands; exports.reportSetupCompleted = _chunkZDOC4HFLjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkZDOC4HFLjs.resolvePendingAuthClaimForResume;