deepline 0.3.59 → 0.3.60

package/dist/cli/index.mjs

@@ -1010,6 +1010,51 @@ function resolveProjectPinTarget(startDir = process.cwd()) {
 function getActiveProjectAuthSource(startDir = process.cwd()) {
   return loadProjectEnvCandidates(startDir)[0] ?? null;
 }
+function findNearestProjectMarkerDir(startDir) {
+  let current = resolve(startDir);
+  while (true) {
+    if (COWORK_PROJECT_MARKERS.some((marker) => existsSync(join(current, marker)))) {
+      return current;
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function resolveCliAuthProvenance(config, startDir = process.cwd()) {
+  const envApiKey = process.env[API_KEY_ENV]?.trim();
+  const folderAuth = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey,
+    startDir
+  );
+  const pinTarget = resolveProjectPinTarget(startDir);
+  const markerDir = findNearestProjectMarkerDir(startDir);
+  const project = !pinTarget.ok ? {
+    state: "ambiguous_cowork_project",
+    candidates: pinTarget.candidates
+  } : folderAuth ? {
+    state: "project",
+    dir: dirname(folderAuth.filePath),
+    pinPath: folderAuth.filePath,
+    source: "folder"
+  } : pinTarget.source === "cowork" ? {
+    state: "project",
+    dir: pinTarget.dir,
+    pinPath: join(pinTarget.dir, PROJECT_DEEPLINE_ENV_FILE),
+    source: "cowork"
+  } : markerDir ? {
+    state: "project",
+    dir: markerDir,
+    pinPath: join(markerDir, PROJECT_DEEPLINE_ENV_FILE),
+    source: "marker"
+  } : { state: "not_project" };
+  return {
+    scope: envApiKey ? "env" : folderAuth ? "folder" : "global",
+    project,
+    folderAuthPath: folderAuth?.filePath ?? null
+  };
+}
 
 // ../plays/artifact-contract-version.ts
 var CURRENT_PLAY_ARTIFACT_CONTRACT_VERSION = 2;
@@ -1060,7 +1105,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.59",
+  version: "0.3.60",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4864,6 +4909,7 @@ var DeeplineClient = class {
       ...this.summarizePlayListItem(play, options),
       currentPublishedVersion: play.currentPublishedVersion ?? play.liveRevision?.version ?? null,
       latestRunId: play.latestRunId ?? detail.latestRuns[0]?.workflowId ?? null,
+      ...play.triggerMetadata ? { triggerMetadata: play.triggerMetadata } : {},
       ...play.runtimeLimit ? { runtimeLimit: play.runtimeLimit } : {},
       ...play.activeScheduledPlays ? { activeScheduledPlays: play.activeScheduledPlays } : {}
     };
@@ -13675,6 +13721,39 @@ var PLAY_SQL_LISTENER_TOOL_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*\.[a-zA-Z][a-zA-Z0-
 var PLAY_SQL_LISTENER_WHERE_OPERATOR_SET = new Set(
   PLAY_SQL_LISTENER_WHERE_OPERATORS
 );
+var PLAY_AUTHORING_BINDING_FIELDS = {
+  root: [
+    "billing",
+    "compatibility",
+    "cron",
+    "inline",
+    "runtime",
+    "secrets",
+    "sqlListeners",
+    "webhook"
+  ],
+  cron: ["schedule", "timezone", "input"],
+  webhook: ["auth", "hmac"],
+  sqlListener: [
+    "id",
+    "tool",
+    "stream",
+    "where",
+    "table",
+    "monitor",
+    "output",
+    "operations"
+  ]
+};
+var PLAY_AUTHORING_DEFINE_PLAY_OPTION_FIELDS = [
+  "id",
+  "name",
+  "description",
+  "input",
+  "run",
+  "bindings",
+  ...PLAY_AUTHORING_BINDING_FIELDS.root
+];
 var PLAY_AUTHORING_DOCUMENTATION = {
   fetchBatching: {
     warning: "A static ctx.fetch key inside a loop is a warning because every iteration must still have distinct method, URL, body, or safe headers. One durable receipt must never stand in for every request.",
@@ -13936,6 +14015,22 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "IANA timezone. Omitted means UTC.",
     errorMessage: "bindings.cron.timezone must be a valid non-empty IANA timezone string."
   },
+  "bindings.cron.input": {
+    schema: Type.Object({}, { additionalProperties: true }),
+    fixtures: {
+      valid: { apply: true },
+      invalid: ["apply"],
+      absent: void 0,
+      unresolved: ["cronInput"],
+      edition1: void 0
+    },
+    referenceType: "Record<string, unknown>",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_binding_invalid",
+    description: "Static JSON object passed to every run created by this cron binding.",
+    errorMessage: "bindings.cron.input must be a static JSON object (no variables, spreads, or functions)."
+  },
   "bindings.sqlListeners": {
     schema: Type.Array(Type.Object({}, { additionalProperties: true })),
     fixtures: {
@@ -14939,14 +15034,15 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  readonly timeoutMs?: PlayRuntimeTimeoutMs;",
   "  readonly receiptWaitMs?: PlayReceiptWaitMs;",
   "};",
-  "export type PlayBindings = {",
+  "export type PlayCronInput<TInput> = TInput extends readonly unknown[] ? never : TInput extends object ? TInput : never;",
+  "export type PlayBindings<TInput = Record<string, unknown>> = {",
   `  description?: ${cloudReferenceType("description")};`,
   `  compatibility?: { toolErrorSchemaVersion?: ${cloudReferenceType("compatibility.toolErrorSchemaVersion")}; toolResponseReceiptRevision?: ${cloudReferenceType("compatibility.toolResponseReceiptRevision")} };`,
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
   `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
-  `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")} };`,
+  `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")}; input?: PlayCronInput<TInput> };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
   "};",
@@ -15012,8 +15108,10 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "  log(message: string): void;",
   `  sleep(ms: ${cloudReferenceType("ctx.sleep.ms")}): Promise<void>;`,
   "}",
-  "export type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = { id: string; description?: string; input: PlayInputContract<TInput>; run: (ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>; bindings?: PlayBindings; billing?: PlayBindings['billing']; runtime?: PlayBindings['runtime']; compatibility?: PlayBindings['compatibility'] };",
-  "export type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>) & { readonly name: string; readonly __inputType?: TInput; readonly __outputType?: TOutput; readonly runtime?: PlayBindings['runtime']; readonly compatibility?: PlayBindings['compatibility'] };"
+  "export type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = { id: string; description?: string; input: PlayInputContract<TInput>; run: (ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>; bindings?: PlayBindings<TInput>; billing?: PlayBindings<TInput>['billing']; runtime?: PlayBindings<TInput>['runtime']; compatibility?: PlayBindings<TInput>['compatibility'] };",
+  "export type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>) & { readonly name: string; readonly __inputType?: TInput; readonly __outputType?: TOutput; readonly bindings?: PlayBindings<TInput>; readonly runtime?: PlayBindings<TInput>['runtime']; readonly compatibility?: PlayBindings<TInput>['compatibility'] };",
+  "export type PlayHandlerInput<THandler> = THandler extends (context: DeeplinePlayRuntimeContext, input: infer TInput) => Promise<PlayReturnObject> ? TInput : never;",
+  "export type PlayHandlerOutput<THandler> = THandler extends (context: DeeplinePlayRuntimeContext, input: unknown) => Promise<infer TOutput extends PlayReturnObject> ? TOutput : never;"
 ];
 
 // ../plays/ts-ast.ts
@@ -20832,6 +20930,11 @@ function writeStartedPlayRun(input2) {
     name: input2.playName,
     status: input2.status ?? "started",
     dashboardUrl: input2.dashboardUrl,
+    execution: {
+      revision: input2.revisionLabel ?? "resolved by Deepline",
+      input_field_count: input2.inputFieldCount ?? 0,
+      cache_policy: input2.forceToolRefresh ? "completed provider receipts may be refreshed" : input2.force ? "fresh run graph; completed provider receipts may still be reused" : "completed provider receipts may be reused"
+    },
     next: {
       inspect: `deepline runs get ${input2.runId} --json`,
       full: `deepline runs get ${input2.runId} --full --json`,
@@ -20843,6 +20946,9 @@ function writeStartedPlayRun(input2) {
   const lines = [
     `Started ${input2.playName}`,
     `  run id: ${input2.runId}`,
+    `  revision: ${input2.revisionLabel ?? "resolved by Deepline"}`,
+    `  input: ${input2.inputFieldCount ?? 0} top-level field(s) supplied`,
+    `  cache: ${input2.forceToolRefresh ? "completed provider receipts may be refreshed" : input2.force ? "fresh run graph; completed provider receipts may still be reused" : "completed provider receipts may be reused"}`,
     `  inspect: deepline runs get ${input2.runId} --json`,
     `  full debug: deepline runs get ${input2.runId} --full --json`,
     `  logs: deepline runs logs ${input2.runId} --json`,
@@ -21380,7 +21486,7 @@ function printPlayTriggers(triggers) {
   if (!triggers) return;
   const hasAny = (triggers.sqlListeners?.length ?? 0) > 0 || Boolean(triggers.cron) || triggers.webhook === true;
   if (!hasAny) return;
-  console.log("  triggers:");
+  console.log("  declared triggers (source only):");
   for (const listener of triggers.sqlListeners ?? []) {
     const target = listener.tool && listener.stream ? `${listener.tool}/${listener.stream}` : listener.tool ?? listener.stream ?? listener.id;
     const operations = listener.operations.length ? listener.operations.join(", ") : "INSERT, UPDATE";
@@ -21395,10 +21501,77 @@ function printPlayTriggers(triggers) {
   if (triggers.cron) {
     const timezone = triggers.cron.timezone ? ` (${triggers.cron.timezone})` : "";
     console.log(`    cron \u2192 ${triggers.cron.schedule}${timezone}`);
+    if (triggers.cron.input && Object.keys(triggers.cron.input).length > 0) {
+      console.log(`      input \u2192 ${JSON.stringify(triggers.cron.input)}`);
+    }
   }
   if (triggers.webhook === true) {
     console.log("    webhook \u2192 enabled");
   }
+  if (triggers.cron) {
+    console.log(
+      "  This check validates the declaration only. Publish this revision before a cron can be armed."
+    );
+  }
+}
+function cronExecutionLabel(status) {
+  if (!status) return "not configured";
+  if (status === "active") return "armed";
+  if (status === "blocked") return "blocked";
+  return status;
+}
+function readLiveCronMetadata(play) {
+  const record2 = readRecord(play);
+  const metadata = readRecord(record2?.triggerMetadata);
+  return {
+    schedule: typeof metadata?.cronSchedule === "string" ? metadata.cronSchedule : null,
+    timezone: typeof metadata?.cronTimezone === "string" ? metadata.cronTimezone : null,
+    nextScheduledAt: typeof metadata?.nextScheduledAt === "number" ? metadata.nextScheduledAt : null
+  };
+}
+function liveTriggerStatusLines(status, play) {
+  const cron = readLiveCronMetadata(play);
+  if (!status?.cron && !cron.schedule && !status?.webhook) return [];
+  const lines = [];
+  if (status?.cron || cron.schedule) {
+    const timezone = cron.timezone ? ` (${cron.timezone})` : "";
+    lines.push(
+      `  Scheduled execution: ${cronExecutionLabel(status?.cron ?? null)}${cron.schedule ? ` \u2014 ${cron.schedule}${timezone}` : ""}`
+    );
+    if (cron.nextScheduledAt !== null && status?.cron === "active") {
+      lines.push(
+        `  Next scheduled run: ${formatTimestamp(cron.nextScheduledAt)}`
+      );
+    }
+    if (status?.blockedReason) {
+      lines.push(`  Schedule issue: ${status.blockedReason}`);
+    }
+  }
+  if (status?.webhook) {
+    lines.push(`  Webhook: ${status.webhook}`);
+  }
+  return lines;
+}
+function triggerStatusFromMetadata(value) {
+  const metadata = readRecord(value);
+  return {
+    cron: typeof metadata?.cronStatus === "string" ? metadata.cronStatus : null,
+    webhook: typeof metadata?.webhookStatus === "string" ? metadata.webhookStatus : null,
+    blockedReason: typeof metadata?.blockedReason === "string" ? metadata.blockedReason : null
+  };
+}
+function printPublishReceipt(input2) {
+  console.log(`\u2713 Published ${input2.name} as v${input2.liveVersion ?? "?"}`);
+  if (input2.previousLiveVersion !== void 0 && input2.previousLiveVersion !== null) {
+    console.log(`  previous live: v${input2.previousLiveVersion}`);
+  }
+  for (const line of liveTriggerStatusLines(
+    triggerStatusFromMetadata(input2.triggerMetadata),
+    { triggerMetadata: input2.triggerMetadata }
+  )) {
+    console.log(line);
+  }
+  console.log(`  revisions: deepline plays versions --name ${input2.name}`);
 }
 function printRecognizedSummary(recognized) {
   if (!recognized) return;
@@ -21974,7 +22147,11 @@ async function handleFileBackedRun(options, hooks) {
     dashboardUrl: resolvedDashboardUrl,
     package: options.fullJson ? void 0 : started.package,
     jsonOutput: options.jsonOutput,
-    progress
+    progress,
+    inputFieldCount: Object.keys(options.input ?? {}).length,
+    revisionLabel: "local file revision",
+    force: options.force,
+    forceToolRefresh: options.forceToolRefresh
   });
   return 0;
 }
@@ -22157,7 +22334,11 @@ async function handleNamedRun(options, hooks) {
     dashboardUrl: resolvedDashboardUrl,
     package: options.fullJson ? void 0 : started.package,
     jsonOutput: options.jsonOutput,
-    progress
+    progress,
+    inputFieldCount: Object.keys(options.input ?? {}).length,
+    revisionLabel: selectedRevisionId ? `pinned revision ${selectedRevisionId}` : "live revision",
+    force: options.force,
+    forceToolRefresh: options.forceToolRefresh
   });
   return 0;
 }
@@ -22823,7 +23004,17 @@ async function handlePlayGet(args) {
   );
   console.log(`Live version: ${detail.play.liveRevision?.version ?? "\u2014"}`);
   console.log(`Draft dirty: ${detail.play.isDraftDirty ? "yes" : "no"}`);
-  console.log(`Runs: ${detail.latestRuns.length}`);
+  if (detail.play.isDraftDirty && detail.play.liveRevision?.version) {
+    console.log(
+      `  Scheduled and named runs continue to use live v${detail.play.liveRevision.version}.`
+    );
+  }
+  for (const line of liveTriggerStatusLines(
+    detail.play.triggerStatus,
+    detail.play
+  )) {
+    console.log(line);
+  }
   console.log(`Updated: ${formatTimestamp(detail.play.updatedAt)}`);
   console.log(`Sheet rows: ${detail.sheetSummary?.stats?.total ?? 0}`);
   if (detail.customerDbUrl) {
@@ -22908,19 +23099,23 @@ async function handlePlayList(args) {
     if (play.inputSchema || play.hasInputSchema) {
       process.stdout.write("    inputSchema: yes\n");
     }
-    const configuredTriggers = [
-      play.triggerStatus?.cron ? `cron=${play.triggerStatus.cron}` : null,
-      play.triggerStatus?.webhook ? `webhook=${play.triggerStatus.webhook}` : null
-    ].filter(Boolean);
-    if (configuredTriggers.length > 0) {
-      process.stdout.write(`    triggers: ${configuredTriggers.join(", ")}
-`);
-      if (play.triggerStatus?.blockedReason) {
+    if (play.triggerStatus?.cron) {
+      process.stdout.write(
+        `    scheduled execution: ${cronExecutionLabel(play.triggerStatus.cron)}
+`
+      );
+      if (play.triggerStatus.blockedReason) {
         process.stdout.write(
-          `    trigger issue: ${play.triggerStatus.blockedReason}
+          `    schedule issue: ${play.triggerStatus.blockedReason}
 `
         );
       }
+    } else {
+      process.stdout.write("    scheduled execution: not configured\n");
+    }
+    if (play.triggerStatus?.webhook) {
+      process.stdout.write(`    webhook: ${play.triggerStatus.webhook}
+`);
     }
     process.stdout.write(`    run: deepline plays run ${reference} --watch
 `);
@@ -23028,15 +23223,13 @@ function printPlayDescription(play) {
       console.log(`    ${line}`);
     }
   }
-  const configuredTriggers = [
-    play.triggerStatus?.cron ? `cron=${play.triggerStatus.cron}` : null,
-    play.triggerStatus?.webhook ? `webhook=${play.triggerStatus.webhook}` : null
-  ].filter(Boolean);
-  if (configuredTriggers.length > 0) {
-    console.log(`  Triggers: ${configuredTriggers.join(", ")}`);
+  for (const line of liveTriggerStatusLines(play.triggerStatus, play)) {
+    console.log(line);
   }
-  if (play.triggerStatus?.blockedReason) {
-    console.log(`  Trigger issue: ${play.triggerStatus.blockedReason}`);
+  if (play.isDraftDirty && play.liveVersion) {
+    console.log(
+      `  Draft note: scheduled runs continue to use live v${play.liveVersion}.`
+    );
   }
   const runtimeLimit = formatPlayRuntimeLimit(play.runtimeLimit);
   if (runtimeLimit) {
@@ -23462,7 +23655,9 @@ async function handlePlaySave(args) {
       console.log(
         `\u2713 Saved ${playName} working draft as v${result.version ?? "?"}`
       );
-      console.log("  Live revision unchanged.");
+      console.log(
+        "  Live revision and any armed schedule are unchanged; scheduled runs do not use this draft yet."
+      );
       console.log(`  publish: ${result.next.publish}`);
     }
     return 0;
@@ -23609,24 +23804,19 @@ async function handlePlayPublish(args) {
       process.stdout.write(`${JSON.stringify(result2)}
 `);
     } else {
-      console.log(
-        `\u2713 Published ${rootPlayName} as v${result2.liveVersion ?? "?"}`
-      );
+      printPublishReceipt({
+        name: rootPlayName,
+        liveVersion: result2.liveVersion,
+        previousLiveVersion: result2.previousLiveVersion,
+        triggerMetadata: result2.triggerMetadata
+      });
       console.log(`  source: ${result2.sourceHash.slice(0, 12)}`);
       console.log(`  artifact: ${result2.artifactHash.slice(0, 12)}`);
-      if (result2.previousLiveVersion !== null) {
-        console.log(
-          `  previous live: v${result2.previousLiveVersion} (${result2.previousArtifactHash?.slice(0, 12) ?? "unknown artifact"})`
-        );
-      }
       if (result2.sourceBytes.before !== null) {
         console.log(
           `  source bytes: ${result2.sourceBytes.before.toLocaleString()} \u2192 ${result2.sourceBytes.after.toLocaleString()}`
         );
       }
-      console.log(
-        `  revisions: deepline plays versions --name ${rootPlayName}`
-      );
     }
     return 0;
   }
@@ -23667,8 +23857,16 @@ async function handlePlayPublish(args) {
     resolvedName,
     revisionId ? { revisionId } : {}
   );
-  process.stdout.write(`${JSON.stringify(result)}
+  if (options.jsonOutput) {
+    process.stdout.write(`${JSON.stringify(result)}
 `);
+  } else {
+    printPublishReceipt({
+      name: result.name,
+      liveVersion: result.liveVersion,
+      triggerMetadata: result.triggerMetadata
+    });
+  }
   return result.success ? 0 : 1;
 }
 async function handlePlayDelete(args) {
@@ -31457,7 +31655,7 @@ function parseJsonObjectArg(raw, argLabel) {
   return parsed;
 }
 function resolveMonitorJsonBody(input2) {
-  const readFile5 = input2.readFile ?? ((path) => readFileSync10(path, "utf-8"));
+  const readFile6 = input2.readFile ?? ((path) => readFileSync10(path, "utf-8"));
   const readStdin = input2.readStdin ?? (() => readFileSync10(0, "utf-8"));
   if (input2.positional !== void 0 && input2.file !== void 0) {
     throw new MonitorsUsageError(
@@ -31473,7 +31671,7 @@ function resolveMonitorJsonBody(input2) {
     }
     let raw;
     try {
-      raw = readFile5(input2.file);
+      raw = readFile6(input2.file);
     } catch (error) {
       throw new MonitorsUsageError(
         `Could not read --file ${input2.file}: ${error instanceof Error ? error.message : String(error)}`
@@ -33550,6 +33748,7 @@ async function handleOrgStatus(options) {
     config.apiKey
   );
   const folderTarget = resolveProjectPinTarget();
+  const provenance = resolveCliAuthProvenance(config);
   const hostPath = hostEnvFilePath(config.baseUrl);
   const envApiKey = processEnvValue(API_KEY_ENV);
   const envHostUrl = processEnvValue(HOST_URL_ENV);
@@ -33598,6 +33797,9 @@ async function handleOrgStatus(options) {
     lines.push(`${API_KEY_ENV} overrides saved auth for this process.`);
   } else if (activeProject) {
     lines.push("Global auth is overridden in this folder.");
+  } else if (provenance.scope === "global" && provenance.project.state === "project") {
+    lines.push("Cloud mutations are blocked until this project is pinned.");
+    lines.push("Pin it: deepline org set --auth-scope folder");
   }
   printCommandEnvelope(
     {
@@ -33608,6 +33810,15 @@ async function handleOrgStatus(options) {
       auth_source: authSource,
       host_env_path: hostPath,
       folder_target: folderTargetPayload,
+      project_pin: provenance.scope === "global" && provenance.project.state === "project" ? {
+        required: true,
+        path: provenance.project.pinPath,
+        cloud_mutations_blocked: true,
+        command: "deepline org set --auth-scope folder"
+      } : {
+        required: false,
+        cloud_mutations_blocked: false
+      },
       next: {
         set_auto: "deepline org set <org>",
         set_folder: "deepline org set <org> --auth-scope folder",
@@ -33623,6 +33834,41 @@ async function handleOrgStatus(options) {
 async function handleOrgSwitch(selection, options) {
   const authScope = normalizeAuthScope2(options.authScope);
   const config = resolveConfig();
+  const provenance = resolveCliAuthProvenance(config);
+  if (!selection && !options.orgId && authScope === "folder" && provenance.scope === "global" && provenance.project.state === "project") {
+    const project_env_paths2 = saveProjectDeeplineEnvValues(
+      {
+        [HOST_URL_ENV]: config.baseUrl,
+        [API_KEY_ENV]: config.apiKey
+      },
+      provenance.project.dir
+    );
+    printCommandEnvelope(
+      {
+        ok: true,
+        unchanged: true,
+        requested_auth_scope: "folder",
+        effective_auth_scope: "folder",
+        auth_scope: "folder",
+        project_env_paths: project_env_paths2,
+        next: { status: "deepline org status --json" },
+        render: {
+          sections: [
+            {
+              title: "org set",
+              lines: [
+                "\u2713 Pinned this project to the current target.",
+                `Saved folder auth in ${project_env_paths2[0]}.`,
+                "Global host auth was not changed."
+              ]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
   const http = new HttpClient(config);
   const payload = await fetchOrganizations(http, config.apiKey);
   if (!selection && !options.orgId) {
@@ -33844,6 +34090,9 @@ Notes:
             use this org. Existing folder pins still override global auth.
 
   Process env DEEPLINE_API_KEY overrides saved auth for that command only.
+  For projects, agents, CI, and multiple customer workspaces, prefer folder
+  scope or a per-command DEEPLINE_API_KEY. Global scope is machine-wide and
+  can make an unrelated terminal target the last-selected organization.
 
 Agent loop:
   deepline org list --json
@@ -33919,7 +34168,9 @@ Examples:
       `
 Notes:
   Selection can be a list number, exact organization name, or organization id.
-  Without a selection, prints choices.
+  Without a selection, prints choices. With --auth-scope folder while this
+  project is using global host auth, it pins the current target directly; this
+  is the fastest safe repair for a blocked cloud mutation.
 
   Mutates local auth state and asks Deepline for an org-scoped API key. It
   writes only the selected scope:
@@ -33934,6 +34185,11 @@ Notes:
   folder, commands in that folder still use the folder pin until it is changed
   or removed.
 
+  Prefer --auth-scope folder for a repository or customer workspace. Use
+  --auth-scope global only for deliberate host-wide interactive defaults; it
+  is shared by every unpinned CLI on this machine. For automation, pass
+  DEEPLINE_API_KEY only to that invocation and confirm with org status --json.
+
   Use --json for stable fields including effective_auth_scope,
   auth_scope_reason, host_env_path, project_env_paths, warnings, org_id, and
   org_name.
@@ -34057,6 +34313,7 @@ Deprecated:
 
 // src/cli/commands/secrets.ts
 import { stdin as input, stdout as output } from "process";
+import { readFile as readFile4 } from "fs/promises";
 var hiddenInputBuffer = "";
 function normalizeSecretName(value) {
   const normalized = value.trim().toUpperCase();
@@ -34069,7 +34326,10 @@ function normalizeSecretName(value) {
 }
 function renderSecret(secret) {
   const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
-  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}`;
+  const added = new Date(secret.createdAt).toISOString();
+  const updated = new Date(secret.updatedAt).toISOString();
+  const lastUsed = secret.lastUsedAt ? `, last used ${new Date(secret.lastUsedAt).toISOString()}` : ", never used";
+  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}, added ${added}${updated !== added ? `, updated ${updated}` : ""}${lastUsed}`;
 }
 async function readHiddenLine(prompt, streams = {}) {
   const inputStream = streams.input ?? input;
@@ -34161,6 +34421,48 @@ async function readSecretValue() {
   }
   return first;
 }
+function trimOneTerminalNewline(value) {
+  return value.endsWith("\r\n") ? value.slice(0, -2) : value.endsWith("\n") ? value.slice(0, -1) : value;
+}
+async function readSecretValueFromOptions(options) {
+  const sources = [
+    options.valueStdin ? "--value-stdin" : null,
+    options.fromEnv ? "--from-env" : null,
+    options.fromFile ? "--from-file" : null
+  ].filter((source) => Boolean(source));
+  if (sources.length > 1) {
+    throw new Error(
+      "Use exactly one secret source: --value-stdin, --from-env, or --from-file."
+    );
+  }
+  if (sources.length === 0) return readSecretValue();
+  let value;
+  if (options.valueStdin) {
+    if (input.isTTY) {
+      throw new Error(
+        "--value-stdin requires piped stdin. Omit it to use the hidden interactive prompt."
+      );
+    }
+    const chunks = [];
+    for await (const chunk of input) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    value = trimOneTerminalNewline(Buffer.concat(chunks).toString("utf8"));
+  } else if (options.fromEnv) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(options.fromEnv)) {
+      throw new Error("--from-env must name a valid environment variable.");
+    }
+    const envValue = process.env[options.fromEnv];
+    if (envValue === void 0) {
+      throw new Error(`Environment variable ${options.fromEnv} is not set.`);
+    }
+    value = envValue;
+  } else {
+    value = trimOneTerminalNewline(await readFile4(options.fromFile, "utf8"));
+  }
+  if (!value) throw new Error("Secret value is required.");
+  return value;
+}
 function preventShellHistoryLeak(forbidden) {
   if (forbidden.length > 0) {
     throw new Error(
@@ -34201,7 +34503,7 @@ async function handleCheck(nameInput, options) {
           {
             title: "secret check",
             lines: [
-              secret ? `${name}: active` : `${name}: missing, disabled, or empty`
+              secret ? `${name}: active \u2014 ${renderSecret(secret)}` : `${name}: missing, disabled, or empty`
             ]
           }
         ]
@@ -34219,7 +34521,7 @@ async function handleSet(nameInput, forbidden, options) {
   if (scope === "play" && !playName) {
     throw new Error("--play <name> is required when --scope play is used.");
   }
-  const value = await readSecretValue();
+  const value = await readSecretValueFromOptions(options);
   const { http } = getAuthedHttpClient();
   const response = await http.post(
     "/api/v2/secrets",
@@ -34239,7 +34541,10 @@ async function handleSet(nameInput, forbidden, options) {
         sections: [
           {
             title: "secret saved",
-            lines: [`${secret.name}: saved (${secret.scope})`]
+            lines: [
+              `${secret.name}: saved (${secret.scope}); secret value was not displayed.`,
+              renderSecret(secret)
+            ]
           }
         ]
       }
@@ -34252,14 +34557,18 @@ function registerSecretsCommands(program) {
     "after",
     `
 Notes:
-  Secret values are never accepted as command arguments, stdin pipes, env vars,
-  or files. Use deepline secrets set NAME and type the value at the hidden TTY
-  prompt. Agents can list/check metadata but should not enter secret values.
+  Secret values are never accepted as command arguments. Use the hidden prompt,
+  or one explicit non-argv source: --value-stdin, --from-env NAME, or
+  --from-file PATH. Values are never printed. secrets list shows only status,
+  added, updated, and last-used metadata.
 
 Examples:
   deepline secrets list
   deepline secrets check HUBSPOT_TOKEN
   deepline secrets set HUBSPOT_TOKEN
+  printf %s "$HUBSPOT_TOKEN" | deepline secrets set HUBSPOT_TOKEN --value-stdin
+  deepline secrets set HUBSPOT_TOKEN --from-env HUBSPOT_TOKEN
+  deepline secrets set HUBSPOT_TOKEN --from-file ./hubspot-token.txt
 `
   );
   secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
@@ -34268,7 +34577,7 @@ Examples:
   secrets.command("check").description("Check whether a secret exists and is active.").argument("<name>", "Secret name").option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
-  secrets.command("set").description("Set or rotate a secret through a hidden interactive prompt.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").action(
+  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
     async (name, forbidden, options) => {
       await handleSet(name, forbidden ?? [], options);
     }
@@ -40858,7 +41167,7 @@ Examples:
 }
 
 // src/cli/commands/workflow.ts
-import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname20, join as join22, resolve as resolve20 } from "path";
 
 // src/cli/workflow-to-play.ts
@@ -41076,7 +41385,7 @@ function readStatus(payload) {
 }
 async function readJsonOption(payload, file) {
   if (file) {
-    const raw = await readFile4(resolve20(file), "utf8");
+    const raw = await readFile5(resolve20(file), "utf8");
     return JSON.parse(raw);
   }
   if (payload) {
@@ -41842,6 +42151,97 @@ async function maybeReportSdkCliFailure(input2) {
 
 // src/cli/index.ts
 var PREFLIGHT_TIMEOUT_MS = 3e3;
+var ProjectOrgPinRequiredError = class extends Error {
+  code = "PROJECT_ORG_NOT_PINNED";
+  exitCode = 3;
+  payload;
+  constructor(input2) {
+    super("Cloud work is blocked because this project uses global host auth.");
+    this.name = "ProjectOrgPinRequiredError";
+    this.payload = {
+      ok: false,
+      exitCode: this.exitCode,
+      code: this.code,
+      message: this.message,
+      command: input2.command,
+      auth: { scope: "global", source: "host", projectPinned: false },
+      project: { dir: input2.projectDir, pinPath: input2.pinPath },
+      next: "deepline org set --auth-scope folder"
+    };
+  }
+};
+function commandUsesOnlyReadOrLocalOperations(command) {
+  const [group, action] = command.split(" ");
+  if ([
+    "auth",
+    "org",
+    "health",
+    "preflight",
+    "version",
+    "update",
+    "skills",
+    "doctor",
+    "quickstart"
+  ].includes(group ?? "")) {
+    return true;
+  }
+  if (group === "plays") {
+    return [
+      "check",
+      "get",
+      "list",
+      "search",
+      "grep",
+      "describe",
+      "versions"
+    ].includes(action ?? "");
+  }
+  if (group === "runs") {
+    return ["get", "list", "tail", "logs", "export"].includes(action ?? "");
+  }
+  if (group === "tools") {
+    return ["list", "search", "get", "describe"].includes(action ?? "");
+  }
+  if (group === "providers") return ["list", "get"].includes(action ?? "");
+  if (group === "secrets") return ["list", "check"].includes(action ?? "");
+  if (group === "billing")
+    return ["balance", "usage", "history"].includes(action ?? "");
+  return false;
+}
+function assertProjectCloudWorkIsPinned(command) {
+  if (process.argv.includes("--dry-run") || commandUsesOnlyReadOrLocalOperations(command)) {
+    return;
+  }
+  const config = resolveConfig();
+  const provenance = resolveCliAuthProvenance(config);
+  if (provenance.scope !== "global" || provenance.project.state !== "project") {
+    return;
+  }
+  throw new ProjectOrgPinRequiredError({
+    command,
+    projectDir: provenance.project.dir,
+    pinPath: provenance.project.pinPath
+  });
+}
+function printProjectOrgPinRequiredError(error) {
+  if (shouldEmitJson(process.argv.includes("--json"))) {
+    printJson(error.payload);
+    return;
+  }
+  const project = error.payload.project;
+  process.stderr.write(
+    [
+      "\u2717 Cloud work is blocked in this project",
+      "",
+      "  Auth: global host default",
+      "  This project is not pinned. Global auth is shared by every unpinned CLI on this machine.",
+      "",
+      "  Pin this folder to the current target:",
+      "    deepline org set --auth-scope folder",
+      `  This writes: ${project.pinPath}`
+    ].join("\n") + "\n"
+  );
+}
 function asCommanderError(error) {
   if (!(error instanceof Error) || !("code" in error)) {
     return null;
@@ -42151,11 +42551,12 @@ Exit codes:
     if (actionCommand.name() === "version" || actionCommand.name() === "update" || actionCommand.name() === "setup" || actionCommand.name() === "skills" || actionCommand.name() === "doctor" || isAutoUpdateSettingsInvocation() || isDeprecatedCommandInvocation()) {
       return;
     }
+    const compatibilityCommand = compatibilityCommandPath(actionCommand) || actionCommand.name();
+    assertProjectCloudWorkIsPinned(compatibilityCommand);
     if (printStartupPhase) {
       progress?.phase("checking sdk compatibility");
     }
     const baseUrl = autoDetectBaseUrl().replace(/\/$/, "");
-    const compatibilityCommand = compatibilityCommandPath(actionCommand) || actionCommand.name();
     const shouldDeferSkillsSync = shouldDeferSkillsSyncForCommand();
     const skillsVersion = shouldDeferSkillsSync ? void 0 : readSdkSkillsLocalVersion(baseUrl);
     const compatibility = await traceCliSpan(
@@ -42332,7 +42733,10 @@ Examples:
     });
     progress?.fail();
     const wantsJson = process.argv.includes("--json");
-    if (commanderError) {
+    if (error instanceof ProjectOrgPinRequiredError) {
+      printProjectOrgPinRequiredError(error);
+      process.exitCode = error.exitCode;
+    } else if (commanderError) {
       if (commanderError.code === "commander.unknownCommand") {
       }
       process.exitCode = commanderError.code === "commander.unknownCommand" && !wantsJson ? 2 : commanderError.exitCode ?? 1;