deepline 0.3.74 → 0.3.76

package/dist/cli/index.mjs

@@ -890,6 +890,17 @@ function getResolvedProjectAuthSource(baseUrl, apiKey, startDir = process.cwd())
     return projectBaseUrl === normalizedBaseUrl && (env[API_KEY_ENV] ?? "").trim() === normalizedApiKey;
   }) ?? null;
 }
+function resolveBaseUrlOnly(options) {
+  const baseUrl = normalizeBaseUrl(
+    options?.baseUrl?.trim() || autoDetectBaseUrl()
+  );
+  if (!baseUrl) {
+    throw new ConfigError(
+      `Invalid ${HOST_URL_ENV}. Expected an http(s) URL such as https://code.deepline.com.`
+    );
+  }
+  return baseUrl;
+}
 function resolveConfig(options) {
   const baseUrl = normalizeBaseUrl(
     options?.baseUrl?.trim() || autoDetectBaseUrl()
@@ -1199,7 +1210,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.74",
+  version: "0.3.76",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -1621,7 +1632,7 @@ var RUNTIME_INCIDENT_DRILL_CATALOG = [
       valueMeaning: "occurrence"
     },
     expected: {
-      outcome: "The same logical run completes through receipt replay; recovery remains bounded if the provider outcome must be retried.",
+      outcome: "The same logical run completes through terminal-cache replay; any provider retry is governed by its separate operation policy.",
       safetyFacts: ["same_logical_run", "bounded_provider_execution"]
     },
     verification: {
@@ -4476,6 +4487,10 @@ var TERMINAL_PLAY_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "ca
 var INCLUDE_TOOL_METADATA_HEADER = "x-deepline-include-tool-metadata";
 var EXECUTE_RESPONSE_CONTRACT_HEADER = "x-deepline-execute-response-contract";
 var EXECUTE_RESPONSE_INTENT_HEADER = "x-deepline-execute-response-intent";
+var MONITOR_NON_RETRYABLE_MUTATION_OPTIONS = {
+  maxRetries: 0,
+  exactUrlOnly: true
+};
 var RAW_V2_EXECUTE_RESPONSE_CONTRACT = RAW_V2_TOOL_RESPONSE_CONTRACT;
 var COMPILE_MANIFEST_RETRY_DELAYS_MS = [250, 1e3];
 var REGISTER_PLAY_ARTIFACTS_COMPILE_CONCURRENCY = 3;
@@ -5034,11 +5049,15 @@ var DeeplineClient = class {
       update: (key, patch) => this.updateMonitor(key, patch),
       delete: (key, options2) => this.deleteMonitor(key, options2),
       reactivate: (key, options2) => this.reactivateMonitor(key, options2),
+      audit: (options2) => this.auditMonitors(options2),
+      repair: (options2) => this.repairMonitors(options2),
+      health: (options2) => this.readMonitorsHealth(options2),
       fleets: {
         sync: (definitionOrId, options2) => this.syncMonitorFleet(definitionOrId, options2),
         get: (fleetId, options2) => fleetId === void 0 ? this.listMonitorFleets() : this.getMonitorFleet(fleetId, options2),
         list: () => this.listMonitorFleets(),
         deactivate: (fleetId, options2) => this.deactivateMonitorFleet(fleetId, options2),
+        reactivate: (fleetId, options2) => this.reactivateMonitorFleet(fleetId, options2),
         waitForConvergence: (fleetId, options2) => this.waitForMonitorFleetConvergence(fleetId, options2)
       }
     };
@@ -6624,13 +6643,23 @@ var DeeplineClient = class {
     if (options?.grep?.trim()) {
       params.set("grep", options.grep.trim());
       params.set("grep_mode", options.grepMode ?? "all");
+      params.set("grep_paginated", "1");
       params.set("limit", "60");
     }
-    const suffix = params.toString() ? `?${params.toString()}` : "";
-    const response = await this.http.get(
-      `/api/v2/plays${suffix}`
-    );
-    return response.plays ?? [];
+    const plays = [];
+    let cursor = null;
+    let hasMore = true;
+    do {
+      if (cursor) params.set("cursor", cursor);
+      const suffix = params.toString() ? `?${params.toString()}` : "";
+      const response = await this.http.get(
+        `/api/v2/plays${suffix}`
+      );
+      plays.push(...response.plays ?? []);
+      cursor = response.pagination?.cursor ?? response.cursor ?? null;
+      hasMore = Boolean(response.pagination?.hasMore ?? response.hasMore);
+    } while (Boolean(options?.grep?.trim()) && hasMore && cursor);
+    return plays;
   }
   /** Set whether an org-owned Play sorts before unpinned Plays. */
   async setPlayPinned(playName, pinned) {
@@ -7207,6 +7236,44 @@ var DeeplineClient = class {
       ...typeof payload.reason === "string" && payload.reason.trim() ? { reason: payload.reason.trim() } : {}
     };
   }
+  /**
+   * One bounded audit pass. Prefer `client.monitors.audit(...)`.
+   *
+   * Never auto-retried: it is idempotent, but a retry that races the caller's
+   * own next pass would spend a provider slot to learn nothing new.
+   */
+  async auditMonitors(options) {
+    return this.http.request("/api/v2/monitors/audit", {
+      method: "POST",
+      body: {
+        ...options?.fleetId ? { fleet_id: options.fleetId } : {},
+        ...options?.cursor ? { cursor: options.cursor } : {}
+      },
+      maxRetries: 0
+    });
+  }
+  /** One repair pass or plan. Prefer `client.monitors.repair(...)`. */
+  async repairMonitors(options) {
+    return this.http.request("/api/v2/monitors/repair", {
+      method: "POST",
+      body: {
+        ...options?.fleetId ? { fleet_id: options.fleetId } : {},
+        ...options?.dryRun === void 0 ? {} : { dry_run: options.dryRun }
+      },
+      maxRetries: 0
+    });
+  }
+  /** Delivery and convergence health. Prefer `client.monitors.health(...)`. */
+  async readMonitorsHealth(options) {
+    const params = new URLSearchParams();
+    if (options?.fleetId) params.set("fleet_id", options.fleetId);
+    const query = params.toString();
+    const suffix = query ? `?${query}` : "";
+    return this.http.request(
+      `/api/v2/monitors/health${suffix}`,
+      { method: "GET" }
+    );
+  }
   /**
    * The deployable monitor tools catalog. Pass a tool id (positional or
    * `{ tool }`) to describe one tool's full payload/stream contract, or no tool
@@ -7284,7 +7351,6 @@ var DeeplineClient = class {
     if (options?.limit !== void 0)
       params.set("limit", String(options.limit));
     if (options?.cursor) params.set("cursor", options.cursor);
-    if (options?.compact) params.set("compact", "true");
     if (options?.includeConsumers) params.set("include_consumers", "true");
     const query = params.toString();
     const suffix = query ? `?${query}` : "";
@@ -7301,13 +7367,22 @@ var DeeplineClient = class {
     );
   }
   async testMonitorWebhook(key, payload, options) {
+    if (options?.dispatch === true || options?.validationOnly === false) {
+      throw new DeeplineError(
+        "Monitor tests are validation-only and cannot dispatch events.",
+        void 0,
+        "MONITOR_TEST_DISPATCH_NOT_SUPPORTED"
+      );
+    }
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
       {
         method: "POST",
         body: {
           payload,
-          ...options?.validationOnly ? { mode: "validation_only" } : options?.dispatch ? { mode: "dispatch" } : {}
+          // Send the legacy safe mode as well as accepting it server-side: an
+          // upgraded SDK must be safe when it reaches a still-running server.
+          mode: "validation_only"
         }
       }
     );
@@ -7335,7 +7410,14 @@ var DeeplineClient = class {
   async updateMonitor(key, patch) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "PATCH", body: patch }
+      {
+        method: "PATCH",
+        body: patch,
+        // A monitor write may have reached the control plane before a network
+        // failure reaches the caller. Do not turn that unknown outcome into a
+        // second mutation with a fresh snapshot.
+        ...MONITOR_NON_RETRYABLE_MUTATION_OPTIONS
+      }
     );
   }
   /** Delete a deployed monitor and its upstream provider resource. `dryRun` returns the delete plan. Prefer `client.monitors.delete(...)`. */
@@ -7352,7 +7434,12 @@ var DeeplineClient = class {
     const query = params.toString();
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ""}`,
-      { method: "DELETE" }
+      options?.dryRun ? { method: "DELETE" } : {
+        method: "DELETE",
+        // Deletion is a provider lifecycle operation. A timeout is an
+        // unknown outcome, not authority to begin another delete attempt.
+        ...MONITOR_NON_RETRYABLE_MUTATION_OPTIONS
+      }
     );
   }
   /**
@@ -7363,7 +7450,13 @@ var DeeplineClient = class {
     const query = options?.dryRun ? "?dry_run=true" : "";
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: "POST", body: {} }
+      options?.dryRun ? { method: "POST", body: {} } : {
+        method: "POST",
+        body: {},
+        // Reactivation can create an upstream resource, so it must not use
+        // the generic transport's automatic replay policy.
+        ...MONITOR_NON_RETRYABLE_MUTATION_OPTIONS
+      }
     );
   }
   // ——————————————————————————————————————————————————————————
@@ -7440,6 +7533,21 @@ var DeeplineClient = class {
       }
     );
   }
+  async reactivateMonitorFleet(fleetId, options) {
+    return this.http.request(
+      `${this.monitorFleetPath(fleetId)}/reactivate`,
+      {
+        method: "POST",
+        body: {},
+        headers: this.monitorFleetHeaders(
+          "reactivate",
+          options?.idempotencyKey
+        ),
+        maxRetries: 0,
+        exactUrlOnly: true
+      }
+    );
+  }
   /**
    * Poll one fleet until the server reports a terminal status.
    *
@@ -8346,6 +8454,7 @@ function printCommandEnvelope(envelope, options = {}) {
 var EXIT_OK = 0;
 var EXIT_AUTH = 3;
 var EXIT_SERVER = 5;
+var AUTH_HTTP_TIMEOUT_MS = 1e4;
 function statusBannerLine(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const banner = value;
@@ -8512,30 +8621,37 @@ async function httpJson(method, url, apiKey, body) {
   if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
   const bypassToken = process.env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim();
   if (bypassToken) headers["x-vercel-protection-bypass"] = bypassToken;
-  let response = null;
   let lastError = null;
   for (const candidateUrl of buildCandidateUrls2(url)) {
+    const controller = new AbortController();
+    let requestTimedOut = false;
+    const timeout = setTimeout(() => {
+      requestTimedOut = true;
+      controller.abort();
+    }, AUTH_HTTP_TIMEOUT_MS);
     try {
-      response = await fetch(candidateUrl, {
+      const response = await fetch(candidateUrl, {
         method,
         headers,
-        body: body !== void 0 ? JSON.stringify(body) : void 0
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
       });
-      break;
+      let data;
+      try {
+        data = await response.json();
+      } catch (error) {
+        if (controller.signal.aborted) throw error;
+        data = {};
+      }
+      return { status: response.status, data };
     } catch (error) {
       lastError = error;
+      if (requestTimedOut && method !== "GET") break;
+    } finally {
+      clearTimeout(timeout);
     }
   }
-  if (!response) {
-    throw lastError instanceof Error ? lastError : new Error(String(lastError));
-  }
-  let data;
-  try {
-    data = await response.json();
-  } catch {
-    data = {};
-  }
-  return { status: response.status, data };
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
 }
 async function reportSetupCompleted(input2) {
   const apiKey = input2.authScope === "folder" ? resolveProjectApiKeyForBaseUrl(input2.baseUrl) : resolveGlobalApiKeyForBaseUrl(input2.baseUrl);
@@ -9034,6 +9150,12 @@ async function handleStatus(args) {
               ...payload.workspace.name ? [`Workspace: ${payload.workspace.name}`] : [],
               ...payload.workspace.slug ? [`Workspace slug: ${payload.workspace.slug}`] : [],
               ...payload.workspace.id != null ? [`Org ID: ${payload.workspace.id}`] : [],
+              // Switching orgs lives under `deepline org`, but this is where
+              // people look when they discover they are in the wrong
+              // workspace. Without the pointer the reasonable next move is
+              // `deepline auth register`, which re-approves the same account
+              // and leaves the active org unchanged.
+              "Switch workspace: deepline org list, then deepline org set <org-id>",
               ...payload.user.id != null ? [`User ID: ${payload.user.id}`] : [],
               ...payload.examples.length > 0 ? [
                 "Examples:",
@@ -9065,8 +9187,16 @@ Notes:
   opening the approval page in Cowork. Use --wait no in CI or agent runs, then
   finish with deepline auth wait.
   Auth status shows the target host and active workspace without printing secrets.
+  Registering again re-approves the same account; it does not change the active
+  workspace. To switch, use deepline org list and deepline org set <org-id>.
 `
   );
+  auth.command("workspaces").description("Deprecated. Use deepline org list to see workspaces.").action(() => {
+    console.error(
+      "Workspaces live under `deepline org`.\n  List:   deepline org list\n  Switch: deepline org set <org-id>\n`deepline auth register` re-approves this device; it does not change the active workspace."
+    );
+    process.exitCode = 1;
+  });
   auth.command("register").description(
     "Register this device and open the approval page in your browser."
   ).addHelpText(
@@ -9311,6 +9441,18 @@ function billingTopUpFailureFromError(error, input2) {
   }
   return null;
 }
+function normalizeUnixMilliseconds(value) {
+  const timestamp = Math.floor(value);
+  return Number.isFinite(timestamp) && timestamp >= 0 && Number.isFinite(new Date(timestamp).getTime()) ? timestamp : null;
+}
+function parseSince(raw) {
+  if (!raw?.trim()) return null;
+  const numeric = Number(raw);
+  const normalizedNumeric = normalizeUnixMilliseconds(numeric);
+  if (normalizedNumeric !== null) return normalizedNumeric;
+  const parsed = Date.parse(raw);
+  return normalizeUnixMilliseconds(parsed);
+}
 function humanize(value) {
   return String(value || "").split("_").filter(Boolean).map((token) => token[0]?.toUpperCase() + token.slice(1)).join(" ") || "Unknown";
 }
@@ -9596,6 +9738,18 @@ async function handleHistory(options) {
   );
 }
 async function handleLedgerExportAll(options) {
+  const sinceAt = parseSince(options.since);
+  if (options.since && sinceAt === null) {
+    reportBillingFailure(
+      {
+        exitCode: 2,
+        code: "INVALID_SINCE",
+        message: "--since must be an ISO-8601 timestamp or Unix milliseconds."
+      },
+      options
+    );
+    return;
+  }
   const { http } = getAuthedHttpClient();
   const outputPath = options.output ? resolve3(String(options.output)) : defaultLedgerExportPath();
   let summary = { row_count: 0, net_delta_credits: 0 };
@@ -9605,6 +9759,8 @@ async function handleLedgerExportAll(options) {
     const params = new URLSearchParams({ limit: "5000" });
     if (cursor !== null) params.set("cursor", cursor);
     if (options.runId) params.set("run_id", options.runId);
+    if (options.operation) params.set("operation", options.operation);
+    if (sinceAt !== null) params.set("since_at", String(sinceAt));
     const payload = await http.get(
       `/api/v2/billing/ledger?${params.toString()}`
     );
@@ -9633,13 +9789,15 @@ async function handleLedgerExportAll(options) {
       net_delta_credits: summary.net_delta_credits,
       scope: "workspace",
       ...options.runId ? { run_id: options.runId } : {},
+      ...options.operation ? { operation: options.operation } : {},
+      ...sinceAt !== null ? { since_at: sinceAt } : {},
       render: {
         sections: [
           {
             title: "billing ledger",
             lines: [
               `Billing ledger written to ${outputPath}`,
-              `${summary.row_count} row(s) exported for the active workspace${options.runId ? ` and run ${options.runId}` : ""}.`,
+              `${summary.row_count} row(s) exported for the active workspace${options.runId ? ` and run ${options.runId}` : ""}${options.operation ? ` and operation ${options.operation}` : ""}${sinceAt !== null ? ` since ${new Date(sinceAt).toISOString()}` : ""}.`,
               `Net ledger delta: ${summary.net_delta_credits} Deepline Credits`
             ]
           }
@@ -10336,6 +10494,7 @@ Examples:
   deepline billing ledger export all
   deepline billing ledger export all --output ./ledger.csv
   deepline billing ledger export all --run-id play/demo/run/abc123
+  deepline billing ledger export all --operation limadata_find_audience_identifiers --since 2026-09-01T00:00:00Z
   deepline billing ledger export all --json
 `
   ).addCommand(
@@ -10357,7 +10516,10 @@ Examples:
   deepline billing ledger export all
   deepline billing ledger export all --json
 `
-      ).option("--output <path>", "Write CSV to an explicit path").option("--run-id <run_id>", "Export ledger rows for one play run.").option(
+      ).option("--output <path>", "Write CSV to an explicit path").option("--run-id <run_id>", "Export ledger rows for one play run.").option("--operation <id>", "Export rows for one tool operation.").option(
+        "--since <timestamp>",
+        "Only export rows since ISO-8601 time or Unix milliseconds."
+      ).option(
         "--json",
         "Emit JSON output. Also automatic when stdout is piped"
       ).action(handleLedgerExportAll)
@@ -16696,7 +16858,7 @@ async function traceCliSpan(phase, fields, run) {
 var EXTRACTED_GETTER_ERROR_HINT = "Deepline hint: extractedValues/extractedLists .get() only works for declared Deepline getters listed by `deepline tools describe <tool> --json`. Use `toolExecutionResult.toolResponse.raw` for provider/tool-specific scalar fields, and `toolExecutionResult.extractedLists.<name>.get()` for declared row/list outputs.";
 var DATASET_API_HINT = "Deepline hint: PlayDataset is lazy, durable, and async-only. Use `.count()`, `.first()`, `.at(index)`, `.peek(n)`, `.materialize(limit)`, or async iteration; do not use `.length`, numeric indexing, spread, synchronous iteration, `.rows`, or `.toArray()`.";
 var ROW_PROPERTY_HINT = "Deepline hint: this row type only contains fields produced by the CSV/schema and previous map steps. Check source column casing and the exact output field names from earlier steps before scaling.";
-var TOOLS_EXECUTE_SIGNATURE_HINT = "Deepline hint: ctx.tools.execute requires a request object: `ctx.tools.execute({ id, tool, input, description })`. The stable `id` is required for logs, metadata, and receipt attachment; provider-call reuse is based on play, tool, semantic input, auth scope, provider action version, and cache policy.";
+var TOOLS_EXECUTE_SIGNATURE_HINT = "Deepline hint: ctx.tools.execute requires a request object: `ctx.tools.execute({ id, tool, input, description })`. The stable `id` is required for logs, metadata, and result-cache identity; terminal cache reuse is based on play, tool, semantic input, auth scope, provider action version, and cache policy.";
 var RUN_PLAY_SIGNATURE_HINT = "Deepline hint: ctx.runPlay uses a stable key plus a composable child play reference. Direct-run-only or dataset-backed batch plays must be run directly, exported, then consumed by a separate play.";
 var MAP_BACKED_CHILD_HINT = "Deepline hint: dataset-backed child plays own durable table state and cannot be called from another play. Run that play directly, export its dataset, then pass the CSV to the next play.";
 function sourceLineForError(sourceCode, error) {
@@ -32538,7 +32700,7 @@ function renderDeployedListText(payload, requestedStatus) {
     return status && count !== void 0 ? [`${status}: ${count}`] : [];
   }).join("  ") : "";
   if (summary) lines.push(`All lifecycle states: ${summary}`);
-  if (payload.is_truncated === true) {
+  if (payload.has_more === true || payload.is_truncated === true) {
     const nextCursor = asString(payload.next_cursor);
     lines.push(
       total !== void 0 ? `List truncated \u2014 showing ${monitors.length} of ${total}. Before concluding "no matching monitor exists," page the full registry:` : 'List truncated. Before concluding "no matching monitor exists," page the full registry:',
@@ -32552,11 +32714,15 @@ function renderDeployedListText(payload, requestedStatus) {
 `;
 }
 async function handleMonitorsList(options) {
+  if (options.compact) {
+    process.stderr.write(
+      "`--compact` is deprecated and now does nothing; returning the complete monitor records.\n"
+    );
+  }
   const payload = await new DeeplineClient().monitors.list({
     ...options.status ? { status: options.status } : {},
     ...options.limit ? { limit: options.limit } : {},
     ...options.cursor ? { cursor: options.cursor } : {},
-    ...options.compact ? { compact: true } : {},
     ...options.includeConsumers ? { includeConsumers: true } : {}
   });
   printCommandEnvelope(payload, {
@@ -32667,6 +32833,10 @@ var MONITOR_FLEET_COMMANDS = [
   {
     name: "deactivate",
     summary: "Deactivate a fleet and the monitors it owns."
+  },
+  {
+    name: "reactivate",
+    summary: "Explicitly recreate a fleet after a credit-triggered suspension."
   }
 ];
 var MONITOR_FLEET_AGENT_NOTES = [
@@ -33169,6 +33339,72 @@ async function handleMonitorFleetsGet(fleetId, options) {
     { json: options.json, text }
   );
 }
+function fleetReactivateCommandLine(fleetId, options) {
+  const parts = [
+    "deepline",
+    "monitors",
+    "fleets",
+    "reactivate",
+    fleetShellArg(fleetId),
+    "--yes"
+  ];
+  if (options.wait) parts.push("--wait");
+  if (options.timeout)
+    parts.push(`--timeout ${fleetShellArg(options.timeout)}`);
+  if (options.idempotencyKey)
+    parts.push(`--idempotency-key ${fleetShellArg(options.idempotencyKey)}`);
+  parts.push(...fleetJsonFlag(options));
+  return parts.join(" ");
+}
+async function handleMonitorFleetsReactivate(fleetId, options, idempotencyKey) {
+  if (!options.yes) {
+    throw new MonitorsUsageError(
+      `reactivate can recreate every suspended provider monitor and restart lifecycle billing. Confirm with --yes:
+  ${fleetReactivateCommandLine(fleetId, options)}`
+    );
+  }
+  const client2 = new DeeplineClient();
+  const payload = await client2.monitors.fleets.reactivate(fleetId, {
+    idempotencyKey
+  });
+  const accepted = { ...payload, idempotency_key: idempotencyKey };
+  if (!options.wait) {
+    printCommandEnvelope(accepted, {
+      json: options.json,
+      text: `Fleet ${fleetId} \u2014 ${asString(payload.status) ?? "billing_reactivating"}
+  idempotency key ${idempotencyKey}
+`
+    });
+    return;
+  }
+  const timeoutMs = fleetTimeoutMs(options.timeout);
+  const progress = fleetProgressReporter();
+  let final;
+  try {
+    final = await client2.monitors.fleets.waitForConvergence(fleetId, {
+      timeoutMs,
+      pollIntervalMs: FLEET_POLL_INTERVAL_MS,
+      onProgress: progress.report
+    });
+  } finally {
+    progress.finish();
+  }
+  const envelope = { ...accepted, ...final };
+  const text = renderFleetGet(final);
+  if (fleetStatus(final) === "converged") {
+    printCommandEnvelope(envelope, { json: options.json, text });
+    return;
+  }
+  reportFleetState(
+    envelope,
+    new MonitorFleetStateError({
+      code: "MONITOR_FLEET_WAIT_TIMEOUT",
+      message: `Stopped waiting after ${timeoutMs}ms. Fleet ${fleetId} recovery is still in progress on the server.`,
+      next: fleetServerNext(final) ?? `deepline monitors fleets get ${fleetShellArg(fleetId)} --json`
+    }),
+    { json: options.json, text }
+  );
+}
 function fleetDeactivateCommandLine(fleetId, options) {
   const parts = [
     "deepline monitors fleets deactivate",
@@ -33466,18 +33702,11 @@ async function handleMonitorsGet(key, options) {
 }
 async function handleMonitorsTest(key, payload, options) {
   const explicitPayload = parseJsonObjectArg(payload, "<payload>");
-  const result = await new DeeplineClient().monitors.test(
-    key,
-    explicitPayload,
-    {
-      validationOnly: options.dispatch !== true,
-      dispatch: options.dispatch === true
-    }
-  );
-  const dispatch = options.dispatch === true;
+  const result = await new DeeplineClient().monitors.test(key, explicitPayload);
   const text = `Monitor diagnostic for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
-` + (dispatch ? "  mode: dispatch (writes rows and may dispatch bound Plays)\n" : "  mode: validation_only (no rows written, credits spent, or Plays dispatched)\n") + `${dispatch ? "persisted" : "would persist"} rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
-${dispatch ? "dispatched" : "would dispatch"} bound Plays: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
+  mode: validation_only (no rows written, credits spent, or Plays dispatched)
+persisted rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
+dispatched bound Plays: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
 `;
   printCommandEnvelope(result, { json: options.json, text });
 }
@@ -33557,6 +33786,206 @@ async function handleMonitorsReactivate(key, options) {
   const payload = await client2.monitors.reactivate(key);
   printCommandEnvelope(payload, { json: options.json });
 }
+var MONITOR_VERB_POLL_INTERVAL_MS = 2e3;
+function monitorHealthLine(health) {
+  return [
+    `converged ${health.converged}/${health.scanned}`,
+    `needs_repair ${health.needs_repair}`,
+    `missing ${health.observed.missing}`,
+    `unaudited ${health.observed.unknown + health.observed.unset}`,
+    `silent ${health.silent}`
+  ].join(" \xB7 ");
+}
+function monitorVerbProgressReporter() {
+  const interactive = process.stderr.isTTY === true;
+  let wrote = false;
+  let lastPlainAt = 0;
+  return {
+    report: (health) => {
+      const line = monitorHealthLine(health);
+      if (interactive) {
+        process.stderr.write(`\r\x1B[2K${line}`);
+        wrote = true;
+        return;
+      }
+      const now = Date.now();
+      if (wrote && now - lastPlainAt < FLEET_PLAIN_PROGRESS_INTERVAL_MS) return;
+      lastPlainAt = now;
+      wrote = true;
+      process.stderr.write(`${line}
+`);
+    },
+    finish: () => {
+      if (interactive && wrote) process.stderr.write("\n");
+    }
+  };
+}
+async function watchMonitorHealth(input2) {
+  const deadlineAt = Date.now() + input2.timeoutMs;
+  const scope = input2.fleetId ? { fleetId: input2.fleetId } : {};
+  let last = await input2.client.monitors.health(scope);
+  input2.onProgress(last);
+  while (Date.now() < deadlineAt) {
+    if (last.needs_repair === 0 && last.observed.unknown === 0) return last;
+    await new Promise(
+      (resolve21) => setTimeout(resolve21, MONITOR_VERB_POLL_INTERVAL_MS)
+    );
+    last = await input2.client.monitors.health(scope);
+    input2.onProgress(last);
+  }
+  return last;
+}
+function monitorHealthText(health) {
+  const partial = health.truncated ? " (partial \u2014 scope larger than one read)" : "";
+  const lines = [
+    `scope: ${health.scope.fleet_id ?? "workspace"}${partial}`,
+    monitorHealthLine(health)
+  ];
+  if (health.deactivation_reasons.length > 0) {
+    lines.push("");
+    lines.push("deactivated by Deepline:");
+    for (const entry of health.deactivation_reasons) {
+      const how = entry.resolution ? ` \u2014 ${entry.resolution}` : "";
+      lines.push(`  ${entry.reason} (${entry.count})${how}`);
+    }
+  }
+  if (health.worst_offenders.length > 0) {
+    lines.push("");
+    lines.push(
+      `silent longest (no delivery in ${health.silent_window_days}d):`
+    );
+    for (const entry of health.worst_offenders) {
+      const when = entry.last_event_at === null ? "never" : new Date(entry.last_event_at).toISOString();
+      lines.push(`  ${entry.monitor_key}  ${entry.tool}  last event ${when}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+async function handleMonitorsAudit(options) {
+  const client2 = new DeeplineClient();
+  const fleetId = options.fleet?.trim() || void 0;
+  const scope = fleetId ? { fleetId } : {};
+  let result = await client2.monitors.audit(scope);
+  const passes = [result.audit];
+  while (result.audit.cursor !== null) {
+    result = await client2.monitors.audit({
+      ...scope,
+      cursor: result.audit.cursor
+    });
+    passes.push(result.audit);
+  }
+  const totals = passes.reduce(
+    (sum, pass) => ({
+      scanned: sum.scanned + pass.scanned,
+      asked: sum.asked + pass.asked,
+      stale: sum.stale + pass.stale,
+      missing: sum.missing + pass.observed.missing
+    }),
+    { scanned: 0, asked: 0, stale: 0, missing: 0 }
+  );
+  let health = result.health;
+  if (options.watch) {
+    const progress = monitorVerbProgressReporter();
+    try {
+      health = await watchMonitorHealth({
+        client: client2,
+        ...scope,
+        timeoutMs: fleetTimeoutMs(options.timeout),
+        onProgress: progress.report
+      });
+    } finally {
+      progress.finish();
+    }
+  }
+  const unauditable = result.audit.unauditable_capabilities;
+  const overtaken = totals.stale > 0 ? ` \xB7 ${totals.stale} observations overtaken by a concurrent settle` : "";
+  const text = [
+    `audited ${totals.scanned} monitors \xB7 asked the provider about ${totals.asked}`,
+    `missing ${totals.missing}${overtaken}`,
+    ...unauditable.length > 0 ? [`not auditable (no batch-read contract): ${unauditable.join(", ")}`] : [],
+    "",
+    monitorHealthText(health)
+  ].join("\n");
+  printCommandEnvelope(
+    { ...result, audit: { ...result.audit, totals }, health },
+    { json: options.json, text }
+  );
+}
+async function handleMonitorsRepair(options) {
+  const client2 = new DeeplineClient();
+  const fleetId = options.fleet?.trim() || void 0;
+  const scope = fleetId ? { fleetId } : {};
+  const result = await client2.monitors.repair({
+    ...scope,
+    ...options.dryRun ? { dryRun: true } : {}
+  });
+  if (options.dryRun) {
+    assertMonitorDryRunAcknowledged(
+      result,
+      { command: "monitors repair", mutation: "repair" }
+    );
+  }
+  let health = result.health;
+  if (options.watch && !options.dryRun) {
+    const progress = monitorVerbProgressReporter();
+    try {
+      health = await watchMonitorHealth({
+        client: client2,
+        ...scope,
+        timeoutMs: fleetTimeoutMs(options.timeout),
+        onProgress: progress.report
+      });
+    } finally {
+      progress.finish();
+    }
+  }
+  const verb = options.dryRun ? "would queue" : "queued";
+  const lines = [
+    `${verb} ${result.repair.queued} of ${result.repair.scanned} monitors`
+  ];
+  for (const item of result.repair.plan.slice(0, REPAIR_PLAN_PREVIEW)) {
+    const why = item.deactivation_reason ? ` \xB7 ${item.deactivation_reason}` : "";
+    lines.push(
+      `  ${item.action.padEnd(6)} ${item.monitor_key}  desired ${item.desired} \xB7 observed ${item.observed}${why}`
+    );
+  }
+  if (result.repair.plan.length > REPAIR_PLAN_PREVIEW) {
+    lines.push(`  \u2026 ${result.repair.plan.length - REPAIR_PLAN_PREVIEW} more`);
+  }
+  if (result.repair.unaudited.length > 0) {
+    lines.push(
+      `${result.repair.unaudited.length} monitors have never been observed \u2014 run 'deepline monitors audit' first.`
+    );
+  }
+  if (result.repair.unowned.length > 0) {
+    lines.push(
+      `${result.repair.unowned.length} monitors disagree but no fleet owns them; repair those with 'deepline monitors deploy' or 'deepline monitors delete'.`
+    );
+  }
+  if (result.repair.fenced.length > 0) {
+    lines.push(
+      `${result.repair.fenced.length} monitors have a provider operation in flight; Deepline is finishing those and repair left them alone.`
+    );
+  }
+  lines.push("");
+  lines.push(monitorHealthText(health));
+  printCommandEnvelope(
+    { ...result, health },
+    { json: options.json, text: lines.join("\n") }
+  );
+}
+var REPAIR_PLAN_PREVIEW = 20;
+async function handleMonitorsHealth(options) {
+  const fleetId = options.fleet?.trim() || void 0;
+  const health = await new DeeplineClient().monitors.health(
+    fleetId ? { fleetId } : {}
+  );
+  printCommandEnvelope(health, {
+    json: options.json,
+    text: monitorHealthText(health)
+  });
+}
 function registerMonitorsCommands(program) {
   const monitors = program.command("monitors").description("Discover, deploy, and manage Deepline monitors.").showSuggestionAfterError(true).addHelpText(
     "after",
@@ -33592,6 +34021,75 @@ Examples:
   deepline monitors reactivate my-monitor --dry-run
 `
   );
+  withJsonOption(
+    monitors.command("audit").description(
+      "Re-read what the provider actually holds for your monitors."
+    ).option("--fleet <fleet-id>", "Audit one fleet instead of every monitor").option("--watch", "Keep polling health until the scope settles").option(
+      "--timeout <duration>",
+      "How long --watch waits, e.g. 90s, 5m, 1h (default 10m)"
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  Asks the provider, by resource id, what it still holds, and records the answer
+  on each monitor. It changes nothing upstream: no creates, no deletes, no
+  intent. Safe to run at any time, as often as you like \u2014 running it twice is
+  running it once, twice.
+
+  A monitor the provider does not return is recorded "missing". Use
+  'deepline monitors repair' to act on that.
+
+Examples:
+  deepline monitors audit
+  deepline monitors audit --fleet accounts-eu --json
+  deepline monitors audit --fleet accounts-eu --watch --timeout 5m
+`
+    )
+  ).action(monitorsAction(handleMonitorsAudit));
+  withJsonOption(
+    monitors.command("repair").description(
+      "Converge the monitors whose desired and observed states disagree."
+    ).option("--fleet <fleet-id>", "Repair one fleet instead of every monitor").option("--dry-run", "Show what would be queued without queueing it").option("--watch", "Keep polling health until the scope settles").option(
+      "--timeout <duration>",
+      "How long --watch waits, e.g. 90s, 5m, 1h (default 10m)"
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  Queues the monitors that disagree with the provider onto the same convergence
+  loop a fleet sync uses; the provider work happens on Deepline's own schedule.
+  Idempotent \u2014 the queue IS the disagreement, so a repeat run queues only what
+  is still wrong.
+
+  Monitors nobody has observed are never repaired: run 'deepline monitors audit'
+  first. Monitors no fleet owns are reported rather than queued; deploy or delete
+  those directly.
+
+Examples:
+  deepline monitors repair --dry-run
+  deepline monitors repair --fleet accounts-eu --watch
+`
+    )
+  ).action(monitorsAction(handleMonitorsRepair));
+  withJsonOption(
+    monitors.command("health").description("Delivery and convergence health for your monitors.").option(
+      "--fleet <fleet-id>",
+      "Report on one fleet instead of every monitor"
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  Read-only. Reports how many monitors the provider holds as asked, how many
+  disagree, how many Deepline deactivated and why, and how many are "silent" \u2014
+  the provider holds them but nothing has been delivered recently. The worst
+  offenders are listed longest-quiet first.
+
+Examples:
+  deepline monitors health
+  deepline monitors health --fleet accounts-eu --json
+`
+    )
+  ).action(monitorsAction(handleMonitorsHealth));
   withJsonOption(
     monitors.command("status").description("Check whether you have access to Deepline monitors.").addHelpText(
       "after",
@@ -33644,10 +34142,10 @@ Examples:
       `
 Notes:
   Read-only. --status filters by monitor status: active (default), disabled, or
-  all. The output echoes the status filter that was applied. --compact returns
-  high-signal fields only. The response reports total (the true registry count,
-  not the page size), returned, is_truncated, and next_cursor. When is_truncated
-  is true, page with --cursor <next_cursor> until it is false \u2014 a "no matching
+  all. The output echoes the status filter that was applied. The response reports
+  total (the true registry count, not the page size), returned, has_more, and
+  next_cursor. When has_more is true, page with --cursor <next_cursor> until it
+  is false \u2014 a "no matching
   monitor" reuse conclusion off a truncated page deploys a duplicate paid feed.
   The default list stays cheap: it includes the current downstream Play binding
   metadata but does not resolve per-monitor delivery/run health. Pass
@@ -33658,7 +34156,6 @@ Examples:
   deepline monitors list
   deepline monitors list --status all --json
   deepline monitors list --status all --cursor <next_cursor> --json
-  deepline monitors list --compact --json
   deepline monitors list --include-consumers --limit 20 --json
 `
     ).option(
@@ -33667,7 +34164,10 @@ Examples:
     ).option("--limit <n>", "Limit the number of deployed monitors returned").option(
       "--cursor <cursor>",
       "Page past a truncated result using the next_cursor from a prior list response"
-    ).option("--compact", COMPACT_OPTION_DESCRIPTION).option(
+    ).option(
+      "--compact",
+      "Deprecated no-op; complete records are always returned"
+    ).option(
       "--include-consumers",
       "Include current SQL-listener consumer health (requires --limit 20 or fewer)"
     )
@@ -33690,10 +34190,7 @@ Examples:
   ).action(monitorsAction(handleMonitorsGet));
   withJsonOption(
     monitors.command("test <key> <payload>").description(
-      "Send an explicit payload through a monitor\u2019s webhook ingestion path."
-    ).option(
-      "--dispatch",
-      "Inject the test event through normal ingestion (writes rows and may dispatch bound Plays)"
+      "Validate an explicit payload against a monitor\u2019s webhook contract."
     ).addHelpText(
       "after",
       `
@@ -33701,9 +34198,8 @@ Notes:
   <payload> must be an explicit JSON object. The command uses the deployed
   monitor\u2019s real binding and payload validation, but is a side-effect-free
   diagnostic: it does not persist rows, spend credits, dispatch Plays, or alter
-  monitor state. Pass --dispatch only when you deliberately need the historic
-  full-ingestion test event; it can write rows and trigger bound Plays. It does
-  not synthesize a provider event or accept an omitted payload.
+  monitor state. It does not synthesize a provider event or accept an omitted
+  payload.
 
 Examples:
   deepline monitors test rb2b-website-visitors '{"LinkedIn URL":"https://www.linkedin.com/in/example","Website":"https://example.com"}' --json
@@ -34020,6 +34516,40 @@ Examples:
       reportMonitorsFailure(error, { retryCommand });
     }
   });
+  withJsonOption(
+    fleets.command("reactivate <fleet-id>").description(
+      "Explicitly recreate a fleet after a credit-triggered suspension."
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  TAMRadar cannot reactivate a deleted radar. This command starts normal,
+  fenced provider creates from the fleet's retained desired definitions and
+  may restart lifecycle billing. A credit top-up alone never does this.
+
+Example:
+  deepline monitors fleets reactivate account-job-openings --yes --wait --json
+`
+    ).option("--wait", "Poll until the fleet reports converged").option(
+      "--timeout <duration>",
+      "How long --wait may poll: 500ms, 90s, 10m, 1h (default 10m)"
+    ).option("--yes", "Confirm recreating suspended provider monitors").option("--idempotency-key <key>", "Stable retry key")
+  ).action(async (fleetId, options) => {
+    let retryCommand = fleetReactivateCommandLine(fleetId, options);
+    try {
+      const idempotencyKey = fleetIdempotencyKey(
+        "reactivate",
+        options.idempotencyKey
+      );
+      retryCommand = fleetReactivateCommandLine(fleetId, {
+        ...options,
+        idempotencyKey
+      });
+      await handleMonitorFleetsReactivate(fleetId, options, idempotencyKey);
+    } catch (error) {
+      reportMonitorsFailure(error, { retryCommand });
+    }
+  });
   const deployed = withJsonOption(
     monitors.command("deployed", { hidden: true }).description("Alias of `monitors list` (plus get/update/delete aliases).").option(
       "--status <status>",
@@ -34027,7 +34557,10 @@ Examples:
     ).option("--limit <n>", "Limit the number of deployed monitors returned").option(
       "--cursor <cursor>",
       "Page past a truncated result using the next_cursor from a prior list response"
-    ).option("--compact", COMPACT_OPTION_DESCRIPTION).option(
+    ).option(
+      "--compact",
+      "Deprecated no-op; complete records are always returned"
+    ).option(
       "--include-consumers",
       "Include current SQL-listener consumer health (requires --limit 20 or fewer)"
     )
@@ -34355,11 +34888,13 @@ async function handleOrgStatus(options) {
       host_env_path: hostPath,
       folder_target: folderTargetPayload,
       project_pin: provenance.scope === "global" && provenance.project.state === "project" ? {
-        required: true,
+        available: true,
+        required: false,
         path: provenance.project.pinPath,
-        cloud_mutations_blocked: true,
+        cloud_mutations_blocked: false,
         command: "deepline org set --auth-scope folder"
       } : {
+        available: false,
         required: false,
         cloud_mutations_blocked: false
       },
@@ -34780,8 +35315,8 @@ Examples:
 Notes:
   Selection can be a list number, exact organization name, or organization id.
   Without a selection, prints choices. With --auth-scope folder while this
-  project is using global host auth, it pins the current target directly; this
-  is the fastest safe repair for a blocked cloud mutation.
+  project is using global host auth, it pins the current target directly
+  without an additional organization lookup.
 
   Mutates local auth state and asks Deepline for an org-scoped API key. It
   writes only the selected scope:
@@ -34798,7 +35333,9 @@ Notes:
 
   Prefer --auth-scope folder for a repository or customer workspace. Use
   --auth-scope global only for deliberate host-wide interactive defaults; it
-  is shared by every unpinned CLI on this machine. For automation, pass
+  is shared by every unpinned CLI on this machine. Global auth remains
+  supported in projects; use a folder pin when you want a project-specific
+  default. For automation, pass
   DEEPLINE_API_KEY only to that invocation and confirm with org status --json.
 
   Use --json for stable fields including effective_auth_scope,
@@ -34841,6 +35378,318 @@ Examples:
   );
 }
 
+// src/cli/commands/git.ts
+function renderProject(project) {
+  const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
+  const flags = [
+    project.disabled ? "unlinked" : "linked",
+    `deploys ${project.productionBranch}`,
+    project.checkOnPullRequest ? "PR checks on" : "PR checks off"
+  ].join(", ");
+  return `${project.id}  ${project.repoFullName}${root} - ${flags}`;
+}
+function renderDeployment(deployment) {
+  const ref = deployment.ref.replace("refs/heads/", "");
+  const kind = deployment.isProduction ? "production" : deployment.trigger === "pull_request" ? `pr #${deployment.pullRequestNumber ?? "?"}` : deployment.trigger;
+  const suffix = deployment.error ? ` - ${deployment.error.slice(0, 80)}` : "";
+  return `${deployment.id}  ${deployment.commitSha.slice(0, 10)} ${ref} (${kind}) - ${deployment.status}${suffix}`;
+}
+async function handleList(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(
+    `/api/v2/play-projects${options.all ? "?includeDisabled=1" : ""}`
+  );
+  printCommandEnvelope(
+    {
+      projects: payload.projects,
+      count: payload.projects.length,
+      render: {
+        sections: [
+          {
+            title: "linked repositories",
+            lines: payload.projects.length ? payload.projects.map(renderProject) : [
+              "No repositories are linked. Run `deepline git repos` to see what the GitHub installation can reach, then `deepline git link`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleRepos(options) {
+  const { http } = getAuthedHttpClient();
+  const query = options.installation ? `?installationId=${encodeURIComponent(options.installation)}` : "";
+  const payload = await http.get(`/api/v2/github/repos${query}`);
+  printCommandEnvelope(
+    {
+      installation: payload.installation,
+      repositories: payload.repositories,
+      count: payload.repositories.length,
+      render: {
+        sections: [
+          {
+            title: `repos on installation @${payload.installation.accountLogin} (${payload.installation.repositorySelection})`,
+            lines: payload.repositories.map(
+              (repo) => `${repo.repoId}  ${repo.fullName} (default: ${repo.defaultBranch}${repo.private ? ", private" : ""}${repo.fork ? ", fork" : ""})`
+            )
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function resolveRepoId(repo, installation) {
+  if (/^\d+$/.test(repo)) return Number(repo);
+  const { http } = getAuthedHttpClient();
+  const query = installation ? `?installationId=${encodeURIComponent(installation)}` : "";
+  const payload = await http.get(
+    `/api/v2/github/repos${query}`
+  );
+  const match = payload.repositories.find(
+    (entry) => entry.fullName.toLowerCase() === repo.toLowerCase()
+  );
+  if (!match) {
+    throw new Error(
+      `Repo "${repo}" is not accessible to the workspace's GitHub installation. Run \`deepline git repos\` to list what is.`
+    );
+  }
+  return match.repoId;
+}
+async function handleLink(repo, options) {
+  const repoId = await resolveRepoId(repo, options.installation);
+  const { http } = getAuthedHttpClient();
+  const payload = await http.post("/api/v2/play-projects", {
+    repoId,
+    ...options.installation !== void 0 ? { installationId: options.installation } : {},
+    ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
+    ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
+    ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
+    ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {}
+  });
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: "linked",
+            lines: [
+              renderProject(payload.project),
+              ...(payload.warnings ?? []).map(
+                (warning) => `WARNING: ${warning}`
+              ),
+              "Pushes to the production branch now register and promote changed plays.",
+              "Anyone who can push to this repo can change what runs in this workspace."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleGet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(
+    `/api/v2/play-projects/${encodeURIComponent(id)}`
+  );
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: "linked repository",
+            lines: [renderProject(payload.project)]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleSet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.patch(
+    `/api/v2/play-projects/${encodeURIComponent(id)}`,
+    {
+      ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
+      ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
+      ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
+      ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {},
+      ...options.disabled !== void 0 ? { disabled: options.disabled } : {}
+    }
+  );
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          { title: "updated", lines: [renderProject(payload.project)] }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleUnlink(id, options) {
+  const { http } = getAuthedHttpClient();
+  await http.delete(`/api/v2/play-projects/${encodeURIComponent(id)}`);
+  printCommandEnvelope(
+    {
+      ok: true,
+      id,
+      render: {
+        sections: [
+          {
+            title: "unlinked",
+            lines: [
+              `Repository link ${id} removed. Deployments stop immediately and in-flight deploy credentials die; live plays keep running.`
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleConnect(options) {
+  const baseUrl = resolveBaseUrlOnly();
+  const connectUrl = `${baseUrl.replace(/\/$/, "")}/api/v2/github/connect`;
+  const opened = openInBrowser(connectUrl);
+  printCommandEnvelope(
+    {
+      connectUrl,
+      browser: opened,
+      render: {
+        sections: [
+          {
+            title: "connect GitHub",
+            lines: [
+              opened === "opened" ? `Opened ${connectUrl} in your browser.` : `Open ${connectUrl} in your browser.`,
+              "Sign in as a workspace admin if prompted, approve the GitHub",
+              "installation, then return here and run `deepline git repos`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleDeploymentsList(options) {
+  const { http } = getAuthedHttpClient();
+  const query = new URLSearchParams();
+  if (options.repo) query.set("projectId", options.repo);
+  if (options.limit) query.set("limit", options.limit);
+  const suffix = query.size > 0 ? `?${query.toString()}` : "";
+  const payload = await http.get(
+    `/api/v2/deployments${suffix}`
+  );
+  printCommandEnvelope(
+    {
+      deployments: payload.deployments,
+      count: payload.deployments.length,
+      render: {
+        sections: [
+          {
+            title: "deployments",
+            lines: payload.deployments.length ? payload.deployments.map(renderDeployment) : [
+              "No deployments yet. Push to a linked repository to create one."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleDeploymentGet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(`/api/v2/deployments/${encodeURIComponent(id)}`);
+  const results = payload.deployment.results;
+  const playLines = Array.isArray(results?.plays) ? results.plays.map(
+    (play) => `${play.name ?? "?"} - ${play.status ?? "?"}${play.error ? `: ${play.error}` : ""}`
+  ) : [];
+  printCommandEnvelope(
+    {
+      deployment: payload.deployment,
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: `deployment ${payload.deployment.id}${payload.project ? ` (${payload.project.repoFullName})` : ""}`,
+            lines: [renderDeployment(payload.deployment)]
+          },
+          ...playLines.length ? [{ title: "plays", lines: playLines }] : []
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerGitCommands(program) {
+  const git = program.command("git").alias("projects").description(
+    "Git deploys: link repositories to this workspace and deploy plays on push."
+  ).addHelpText(
+    "after",
+    `
+Examples:
+  deepline git connect
+  deepline git repos
+  deepline git link acme/growth --branch main
+  deepline git list
+  deepline git set <id> --branch release
+  deepline git unlink <id>
+  deepline git deployments --repo <id>
+`
+  );
+  git.command("connect").description("Connect a GitHub installation (browser step).").option("--json", "Emit JSON output").action(async (options) => handleConnect(options));
+  git.command("repos").description("List repos the workspace's GitHub installation can reach.").option(
+    "--installation <id>",
+    "GitHub installation id (required when several are connected)"
+  ).option("--json", "Emit JSON output").action(
+    async (options) => handleRepos(options)
+  );
+  git.command("list").description("List linked repositories.").option("--all", "Include unlinked repositories").option("--json", "Emit JSON output").action(
+    async (options) => handleList(options)
+  );
+  git.command("link").description("Link a repository to this workspace for deploy-on-push.").argument("<repo>", "Repo full name (owner/name) or numeric repo id").option("--root-dir <path>", "Base path inside the repo for this link").option("--branch <name>", "Production branch (default: repo default)").option(
+    "--manifest <file>",
+    "Manifest file name under the base path (default: deepline.json)"
+  ).option(
+    "--installation <id>",
+    "GitHub installation id (required when several are connected)"
+  ).option("--no-pr-checks", "Skip Check Runs on pull requests").option("--json", "Emit JSON output").action(
+    async (repo, options) => handleLink(repo, options)
+  );
+  git.command("get").description("Show one linked repository.").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(async (id, options) => handleGet(id, options));
+  git.command("set").description("Update a linked repository.").argument("<id>", "Repository link id").option("--branch <name>", "Production branch").option("--root-dir <path>", "Base path inside the repo for this link").option(
+    "--manifest <file>",
+    "Manifest file name under the base path (default: deepline.json)"
+  ).option("--pr-checks", "Enable Check Runs on pull requests").option("--no-pr-checks", "Disable Check Runs on pull requests").option("--disabled", "Pause deployments for this link").option("--enabled", "Resume deployments for this link").option("--json", "Emit JSON output").action(
+    async (id, options) => handleSet(id, {
+      ...options,
+      disabled: options.enabled === true ? false : options.disabled === true ? true : void 0
+    })
+  );
+  git.command("unlink").description("Unlink a repository (live plays keep running).").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleUnlink(id, options)
+  );
+  git.command("deployments").description("Deployment history; pass an id for one deployment.").argument("[id]", "Deployment id (omit to list)").option("--repo <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
+    async (id, options) => id ? handleDeploymentGet(id, options) : handleDeploymentsList(options)
+  );
+  const deployments = program.command("deployments", { hidden: true });
+  deployments.command("list").option("--project <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
+    async (options) => handleDeploymentsList({ ...options, repo: options.project })
+  );
+  deployments.command("get").argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleDeploymentGet(id, options)
+  );
+}
+
 // src/cli/getting-started.ts
 var DEEPLINE_GTM_SKILL = "/deepline-gtm";
 var DEEPLINE_GTM_STARTER_PROMPTS = [
@@ -35081,7 +35930,7 @@ function preventShellHistoryLeak(forbidden) {
     );
   }
 }
-async function handleList(options) {
+async function handleList2(options) {
   const client2 = new DeeplineClient();
   const secrets = await client2.listSecrets();
   printCommandEnvelope(
@@ -35124,7 +35973,7 @@ async function handleCheck(nameInput, options) {
   );
   if (!secret) process.exitCode = 4;
 }
-async function handleSet(nameInput, forbidden, options) {
+async function handleSet2(nameInput, forbidden, options) {
   preventShellHistoryLeak(forbidden);
   const name = normalizeSecretName(nameInput);
   const scope = options.scope === "play" ? "play" : "org";
@@ -35183,14 +36032,14 @@ Examples:
 `
   );
   secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
-    await handleList(options);
+    await handleList2(options);
   });
   secrets.command("check").description("Check whether a secret exists and is active.").argument("<name>", "Secret name").option("--json", "Emit JSON output").action(async (name, options) => {
     await handleCheck(name, options);
   });
   secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play", "org").option("--play <name>", "Play name for play-scoped secrets").option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
     async (name, forbidden, options) => {
-      await handleSet(name, forbidden ?? [], options);
+      await handleSet2(name, forbidden ?? [], options);
     }
   );
 }
@@ -36840,7 +37689,7 @@ function failSetupPhase(phases, phase, code) {
 }
 function rollbackCommand(scope, root) {
   const prefix = scope === "local" && root ? ` --prefix ${JSON.stringify(join17(root, ".deepline", "runtime"))}` : "";
-  return `npm install -g${prefix} --no-audit --no-fund --include=optional --allow-scripts=esbuild deepline@${SDK_VERSION}`;
+  return `npm install -g${prefix} --no-audit --no-fund --include=optional deepline@${SDK_VERSION}`;
 }
 function setupResumeCommand(baseUrl, scope) {
   const hostPrefix = baseUrl === "https://code.deepline.com" ? "" : `DEEPLINE_HOST_URL=${JSON.stringify(baseUrl)} `;
@@ -37409,9 +38258,7 @@ async function runSetupCommand(options) {
             title: "setup",
             lines: [
               workspaceName ? `Deepline is installed and connected to ${workspaceName}.` : "Deepline is installed and connected.",
-              ...workspaceName ? [
-                "To link a different workspace, run: deepline auth register"
-              ] : [],
+              ...workspaceName ? ["To link a different workspace, run: deepline auth register"] : [],
               `Use ${DEEPLINE_GTM_SKILL} in your agent.`,
               ...DEEPLINE_GTM_STARTER_PROMPTS.map(
                 (example, index) => `${index + 1}. ${example.title}: ${example.prompt}`
@@ -37778,12 +38625,6 @@ var NPM_SDK_INSTALL_COMMON_FLAGS = [
   "--no-fund",
   "--include=optional"
 ];
-var NPM_SDK_GLOBAL_INSTALL_FLAGS = [
-  "--no-audit",
-  "--no-fund",
-  "--include=optional",
-  "--allow-scripts=esbuild"
-];
 var NPM_SDK_SIDECAR_PACKAGE_JSON = `${JSON.stringify(
   {
     private: true,
@@ -38018,9 +38859,9 @@ function resolveUpdatePlan(options = {}) {
     "-g",
     "--prefix",
     installPrefix,
-    ...NPM_SDK_GLOBAL_INSTALL_FLAGS,
+    ...NPM_SDK_INSTALL_COMMON_FLAGS,
     packageSpec
-  ] : ["install", "-g", ...NPM_SDK_GLOBAL_INSTALL_FLAGS, packageSpec];
+  ] : ["install", "-g", ...NPM_SDK_INSTALL_COMMON_FLAGS, packageSpec];
   const fallbackRegistryUrl = options.npmFallbackRegistryUrl !== void 0 ? options.npmFallbackRegistryUrl : publicNpmFallbackRegistryUrl(
     env.DEEPLINE_HOST_URL?.trim() || autoDetectBaseUrl()
   );
@@ -39772,6 +40613,17 @@ function numberValue(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 
+// src/cli/tool-connection-status.ts
+function toolConnectionStatusMessage(input2) {
+  if (input2.credentialStatus === "requires_connection") {
+    return "requires your credentials \u2014 not connected (connect to use)";
+  }
+  if (input2.connected === false && input2.credentialStatus === "managed") {
+    return "temporarily unavailable";
+  }
+  return null;
+}
+
 // src/cli/commands/tools.ts
 var TOOL_COMMAND_TEMPLATES = {
   describe: "deepline tools describe <toolId>",
@@ -39896,10 +40748,11 @@ function notConnectedSuffix(tool) {
   const record2 = tool;
   const status = stringField2(record2, "credentialStatus", "credential_status");
   const connected = record2.connected;
-  if (status === "requires_connection" || connected === false) {
-    return " - \u26A0 requires your credentials \u2014 not connected (connect to use)";
-  }
-  return "";
+  const message = toolConnectionStatusMessage({
+    connected: connected === false ? false : void 0,
+    credentialStatus: status || void 0
+  });
+  return message ? ` - \u26A0 ${message}` : "";
 }
 function shortPricingHint(tool) {
   const pricing = recordField2(
@@ -42449,14 +43302,14 @@ async function handleTransform(id, options) {
   );
   return outcomes.every((o) => o.ok) ? 0 : 1;
 }
-async function handleList2(options) {
+async function handleList3(options) {
   const limit = options.limit ? Number(options.limit) : void 0;
   const result = await client().listWorkflows({
     limit: Number.isFinite(limit) ? limit : void 0
   });
   emitPassThrough("list", result, options);
 }
-async function handleGet(id, options) {
+async function handleGet2(id, options) {
   emitPassThrough("get", await client().getWorkflow(id), options);
 }
 async function handleDelete(id, options) {
@@ -42575,12 +43428,12 @@ Notes:
   });
   withJsonOption2(
     workflows.command("list").description("List workspace workflows.").option("--limit <n>", "Max workflows to return")
-  ).action(handleList2);
+  ).action(handleList3);
   withJsonOption2(
     workflows.command("get <id>").description(
       "Fetch a workflow, including its published-revision config."
     )
-  ).action(handleGet);
+  ).action(handleGet2);
   withJsonOption2(
     workflows.command("disable <id>").description("Turn a workflow off.")
   ).action(handleDisable);
@@ -42633,6 +43486,7 @@ function registerDeeplineCommandGroups(program) {
   registerBillingCommands(program);
   registerMonitorsCommands(program);
   registerOrgCommands(program);
+  registerGitCommands(program);
   registerEnrichCommand(program);
   registerCsvCommands(program);
   registerDbCommands(program);
@@ -42846,97 +43700,6 @@ What changed in ${response.update_summary.version}: ${response.update_summary.su
 
 // src/cli/index.ts
 var PREFLIGHT_TIMEOUT_MS = 3e3;
-var ProjectOrgPinRequiredError = class extends Error {
-  code = "PROJECT_ORG_NOT_PINNED";
-  exitCode = 3;
-  payload;
-  constructor(input2) {
-    super("Cloud work is blocked because this project uses global host auth.");
-    this.name = "ProjectOrgPinRequiredError";
-    this.payload = {
-      ok: false,
-      exitCode: this.exitCode,
-      code: this.code,
-      message: this.message,
-      command: input2.command,
-      auth: { scope: "global", source: "host", projectPinned: false },
-      project: { dir: input2.projectDir, pinPath: input2.pinPath },
-      next: "deepline org set --auth-scope folder"
-    };
-  }
-};
-function commandUsesOnlyReadOrLocalOperations(command) {
-  const [group, action] = command.split(" ");
-  if ([
-    "auth",
-    "org",
-    "health",
-    "preflight",
-    "version",
-    "update",
-    "skills",
-    "doctor",
-    "quickstart"
-  ].includes(group ?? "")) {
-    return true;
-  }
-  if (group === "plays") {
-    return [
-      "check",
-      "get",
-      "list",
-      "search",
-      "grep",
-      "describe",
-      "versions"
-    ].includes(action ?? "");
-  }
-  if (group === "runs") {
-    return ["get", "list", "tail", "logs", "export"].includes(action ?? "");
-  }
-  if (group === "tools") {
-    return ["list", "search", "get", "describe"].includes(action ?? "");
-  }
-  if (group === "providers") return ["list", "get"].includes(action ?? "");
-  if (group === "secrets") return ["list", "check"].includes(action ?? "");
-  if (group === "billing")
-    return ["balance", "usage", "history"].includes(action ?? "");
-  return false;
-}
-function assertProjectCloudWorkIsPinned(command) {
-  if (process.argv.includes("--dry-run") || commandUsesOnlyReadOrLocalOperations(command)) {
-    return;
-  }
-  const config = resolveConfig();
-  const provenance = resolveCliAuthProvenance(config);
-  if (provenance.scope !== "global" || provenance.project.state !== "project") {
-    return;
-  }
-  throw new ProjectOrgPinRequiredError({
-    command,
-    projectDir: provenance.project.dir,
-    pinPath: provenance.project.pinPath
-  });
-}
-function printProjectOrgPinRequiredError(error) {
-  if (shouldEmitJson(process.argv.includes("--json"))) {
-    printJson(error.payload);
-    return;
-  }
-  const project = error.payload.project;
-  process.stderr.write(
-    [
-      "\u2717 Cloud work is blocked in this project",
-      "",
-      "  Auth: global host default",
-      "  This project is not pinned. Global auth is shared by every unpinned CLI on this machine.",
-      "",
-      "  Pin this folder to the current target:",
-      "    deepline org set --auth-scope folder",
-      `  This writes: ${project.pinPath}`
-    ].join("\n") + "\n"
-  );
-}
 function asCommanderError(error) {
   if (!(error instanceof Error) || !("code" in error)) {
     return null;
@@ -43247,7 +44010,6 @@ Exit codes:
       return;
     }
     const compatibilityCommand = compatibilityCommandPath(actionCommand) || actionCommand.name();
-    assertProjectCloudWorkIsPinned(compatibilityCommand);
     if (printStartupPhase) {
       progress?.phase("checking sdk compatibility");
     }
@@ -43424,10 +44186,7 @@ Examples:
     });
     progress?.fail();
     const wantsJson = process.argv.includes("--json");
-    if (error instanceof ProjectOrgPinRequiredError) {
-      printProjectOrgPinRequiredError(error);
-      process.exitCode = error.exitCode;
-    } else if (commanderError) {
+    if (commanderError) {
       if (commanderError.code === "commander.unknownCommand") {
       }
       process.exitCode = commanderError.code === "commander.unknownCommand" && !wantsJson ? 2 : commanderError.exitCode ?? 1;