deepline 0.3.62 → 0.3.64

package/dist/bundling-sources/sdk/src/config.ts

@@ -47,6 +47,8 @@ import { ConfigError } from './errors.js';
 
 export const HOST_URL_ENV = 'DEEPLINE_HOST_URL';
 export const API_KEY_ENV = 'DEEPLINE_API_KEY';
+export const ACTIVE_ORG_ID_ENV = 'DEEPLINE_ACTIVE_ORG_ID';
+export const ACTIVE_ORG_NAME_ENV = 'DEEPLINE_ACTIVE_ORG_NAME';
 
 /** Production API base URL. */
 const PROD_URL = 'https://code.deepline.com';
@@ -76,6 +78,21 @@ const COWORK_PROJECT_MARKERS = [
 ];
 
 type EnvValues = Record<string, string>;
+const CLI_ENV_ALLOWED_KEYS = new Set([
+  HOST_URL_ENV,
+  API_KEY_ENV,
+  ACTIVE_ORG_ID_ENV,
+  ACTIVE_ORG_NAME_ENV,
+]);
+
+export type CliCommandContext = {
+  active_organization: {
+    org_id: string;
+    org_name: string | null;
+  } | null;
+  auth_scope: 'env' | 'folder' | 'global' | null;
+  metadata_source: 'process_env' | 'folder_env' | 'host_env' | null;
+};
 type ProjectEnvCandidate = {
   filePath: string;
   env: EnvValues;
@@ -155,10 +172,16 @@ function parseEnvFile(filePath: string): EnvValues {
     if (eqIndex < 0) continue;
     const key = trimmed.slice(0, eqIndex).trim();
     let value = trimmed.slice(eqIndex + 1).trim();
-    if (
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      try {
+        value = JSON.parse(value) as string;
+      } catch {
+        value = value.slice(1, -1);
+      }
+    } else if (
       value.length >= 2 &&
-      ((value.startsWith('"') && value.endsWith('"')) ||
-        (value.startsWith("'") && value.endsWith("'")))
+      value.startsWith("'") &&
+      value.endsWith("'")
     ) {
       value = value.slice(1, -1);
     }
@@ -362,6 +385,35 @@ function firstNonEmpty(...values: Array<string | undefined | null>): string {
   return '';
 }
 
+function formatEnvFileValue(value: string): string {
+  return /^[a-zA-Z0-9_./:@%+=,-]+$/.test(value) ? value : JSON.stringify(value);
+}
+
+function mergePersistedEnvValues(
+  existing: EnvValues,
+  values: EnvValues,
+): EnvValues {
+  const merged = { ...existing, ...values };
+  const nextApiKey = values[API_KEY_ENV];
+  if (
+    nextApiKey !== undefined &&
+    nextApiKey !== existing[API_KEY_ENV] &&
+    values[ACTIVE_ORG_ID_ENV] === undefined
+  ) {
+    delete merged[ACTIVE_ORG_ID_ENV];
+    delete merged[ACTIVE_ORG_NAME_ENV];
+  }
+  return merged;
+}
+
+function persistedEnvLines(values: EnvValues): string[] {
+  return Object.entries(values)
+    .filter(
+      ([key, value]) => CLI_ENV_ALLOWED_KEYS.has(key) && value.trim() !== '',
+    )
+    .map(([key, value]) => `${key}=${formatEnvFileValue(value)}`);
+}
+
 function sdkCliConfigDir(baseUrl: string): string {
   const home = process.env.HOME?.trim() || homedir();
   return join(home, '.local', 'deepline', baseUrlSlug(baseUrl || PROD_URL));
@@ -404,11 +456,8 @@ export function saveHostEnvValues(baseUrl: string, values: EnvValues): void {
   }
 
   const existing = parseEnvFile(filePath);
-  const merged = { ...existing, ...values };
-  const allowedKeys = new Set([HOST_URL_ENV, API_KEY_ENV]);
-  const lines = Object.entries(merged)
-    .filter(([key, value]) => allowedKeys.has(key) && value !== '')
-    .map(([key, value]) => `${key}=${value}`);
+  const merged = mergePersistedEnvValues(existing, values);
+  const lines = persistedEnvLines(merged);
   writeFileSync(filePath, `${lines.join('\n')}\n`, 'utf-8');
 }
 
@@ -520,14 +569,11 @@ export function resolveConfig(options?: DeeplineClientOptions): ResolvedConfig {
 
 function mergeProjectEnvFile(filePath: string, values: EnvValues): void {
   const existing = parseEnvFile(filePath);
-  const merged = { ...existing, ...values };
+  const merged = mergePersistedEnvValues(existing, values);
   const dir = dirname(filePath);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   ensureProjectEnvIsIgnored(dir);
-  const allowedKeys = new Set([HOST_URL_ENV, API_KEY_ENV]);
-  const lines = Object.entries(merged)
-    .filter(([key, value]) => allowedKeys.has(key) && value !== '')
-    .map(([key, value]) => `${key}=${value}`);
+  const lines = persistedEnvLines(merged);
   writeFileSync(filePath, `${lines.join('\n')}\n`, 'utf-8');
 }
 
@@ -766,6 +812,100 @@ export function resolveCliAuthProvenance(
   };
 }
 
+function activeOrganizationFromEnv(
+  env: EnvValues | NodeJS.ProcessEnv,
+): CliCommandContext['active_organization'] {
+  const orgId = env[ACTIVE_ORG_ID_ENV]?.trim();
+  if (!orgId) return null;
+  const orgName = env[ACTIVE_ORG_NAME_ENV]?.trim() || null;
+  return { org_id: orgId, org_name: orgName };
+}
+
+/**
+ * Resolve display-only organization metadata from the exact credential source
+ * selected for this CLI process. The metadata never participates in routing.
+ */
+export function resolveCliCommandContext(
+  inputConfig?: Pick<ResolvedConfig, 'baseUrl' | 'apiKey'>,
+  requestedScope?: NonNullable<CliCommandContext['auth_scope']>,
+): CliCommandContext {
+  let config = inputConfig;
+  if (!config) {
+    try {
+      config = resolveConfig();
+    } catch {
+      return {
+        active_organization: null,
+        auth_scope: null,
+        metadata_source: null,
+      };
+    }
+  }
+
+  const contextForScope = (
+    scope: NonNullable<CliCommandContext['auth_scope']>,
+  ): CliCommandContext | null => {
+    if (scope === 'env') {
+      const processApiKey = process.env[API_KEY_ENV]?.trim();
+      return processApiKey && processApiKey === config.apiKey
+        ? {
+            active_organization: activeOrganizationFromEnv(process.env),
+            auth_scope: 'env',
+            metadata_source: 'process_env',
+          }
+        : null;
+    }
+    if (scope === 'folder') {
+      const projectAuth = getResolvedProjectAuthSource(
+        config.baseUrl,
+        config.apiKey,
+      );
+      return projectAuth
+        ? {
+            active_organization: activeOrganizationFromEnv(projectAuth.env),
+            auth_scope: 'folder',
+            metadata_source: 'folder_env',
+          }
+        : null;
+    }
+    const hostEnv = loadCliEnv(config.baseUrl);
+    return (hostEnv[API_KEY_ENV] ?? '').trim() === config.apiKey
+      ? {
+          active_organization: activeOrganizationFromEnv(hostEnv),
+          auth_scope: 'global',
+          metadata_source: 'host_env',
+        }
+      : null;
+  };
+
+  // An explicit process key always wins credential resolution, even when a
+  // command accepts --auth-scope to select a saved fallback. Report the
+  // provenance of the key the command actually used.
+  const processContext = contextForScope('env');
+  if (processContext) return processContext;
+
+  if (requestedScope) {
+    return (
+      contextForScope(requestedScope) ?? {
+        active_organization: null,
+        auth_scope: requestedScope,
+        metadata_source: null,
+      }
+    );
+  }
+
+  for (const scope of ['folder', 'global'] as const) {
+    const context = contextForScope(scope);
+    if (context) return context;
+  }
+
+  return {
+    active_organization: null,
+    auth_scope: null,
+    metadata_source: null,
+  };
+}
+
 export {
   baseUrlSlug,
   loadCliEnv,

package/dist/bundling-sources/sdk/src/release.ts

@@ -199,7 +199,7 @@ export const SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: '0.3.62',
+  version: '0.3.64',
   updateSummary:
     'Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/plays/bundling/index.ts

@@ -1941,7 +1941,15 @@ async function analyzeSourceGraph(
 ): Promise<SourceGraphAnalysis> {
   const absoluteEntryFile = await normalizeLocalPath(entryFile);
   const workspace = createPlayWorkspace(absoluteEntryFile);
-  const sourceIdentityRoot = adapter.sourceIdentityRoot;
+  // Normalize the identity root exactly as its files are normalized. Every
+  // path it is compared against has been through realpath, so a root that has
+  // not — a build under a symlinked temp dir, say — makes every relative()
+  // escape with `..`, and sourceIdentityPath falls back to the absolute path.
+  // The build directory's name then lands in graphHash, so two byte-identical
+  // builds hash differently and every play re-versions on every deploy.
+  const sourceIdentityRoot = adapter.sourceIdentityRoot
+    ? await normalizeLocalPath(adapter.sourceIdentityRoot)
+    : undefined;
   const localFiles = new Map<string, string>();
   const nodeBuiltins = new Set<string>();
   const packages = new Map<string, string | null>();