deepspace 0.15.0 → 0.17.0

package/dist/cli.js

@@ -3,8 +3,8 @@
 // src/cli/cli.ts
 import { defineCommand as defineCommand14, runMain, runCommand, renderUsage } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync29, existsSync as existsSync27 } from "fs";
-import { dirname as dirname10, join as join25 } from "path";
+import { readFileSync as readFileSync30, existsSync as existsSync27 } from "fs";
+import { dirname as dirname11, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -41,7 +41,8 @@ function stopActiveSpinner() {
 
 // src/cli/lib/output.ts
 import * as p2 from "@clack/prompts";
-import { isAbsolute } from "path";
+import { readFileSync, realpathSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
 
 // src/cli/lib/cli-format.ts
 var ANSI_RE = /\[[0-9;]*m/g;
@@ -59,10 +60,35 @@ function humanCommand(argv) {
 }
 
 // src/cli/lib/output.ts
+function resolveActionArgv(argv) {
+  if (argv[0] !== "deepspace") return argv;
+  const entry = cliEntryPath();
+  return entry ? [process.execPath, entry, ...argv.slice(1)] : argv;
+}
+function cliEntryPath() {
+  const entry = process.argv[1];
+  if (!entry || !isAbsolute(entry)) return null;
+  let real;
+  try {
+    real = realpathSync(entry);
+  } catch {
+    return null;
+  }
+  if (!/(^|[\\/])cli\.[cm]?js$/.test(real)) return null;
+  try {
+    const pkg2 = JSON.parse(readFileSync(resolve(dirname(real), "..", "package.json"), "utf-8"));
+    return pkg2.name === "deepspace" ? real : null;
+  } catch {
+    return null;
+  }
+}
+function executableAction(action) {
+  const pinned = { ...action, argv: resolveActionArgv(action.argv) };
+  assertExecutableAction(pinned);
+  return pinned;
+}
 function cliAction(...argv) {
-  const action = { cwd: process.cwd(), argv };
-  assertExecutableAction(action);
-  return action;
+  return executableAction({ cwd: process.cwd(), argv });
 }
 function assertExecutableAction(action) {
   if (!isAbsolute(action.cwd)) throw new TypeError("CLI action cwd must be absolute");
@@ -78,7 +104,9 @@ function withSlug(msg, code) {
   return msg.trimEnd().endsWith(tag) ? msg : `${msg.trimEnd()} ${tag}`;
 }
 function displayArg(arg) {
-  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(arg) ? arg : shQuote(arg);
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(arg)) return arg;
+  if (process.platform === "win32") return `"${arg.replaceAll('"', '""')}"`;
+  return shQuote(arg);
 }
 function printAction(action) {
   assertExecutableAction(action);
@@ -342,7 +370,7 @@ function effectivePlatformUrls(env = process.env) {
 var DASHBOARD_URL = DEEPSPACE_ENV === "production" ? "https://dashboard.deep.space" : DEEPSPACE_ENV === "staging" ? "https://dashboard.deepspacesites.com" : "http://127.0.0.1:9";
 
 // src/cli/auth.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
 
@@ -382,8 +410,7 @@ var Refusal = class extends Error {
     super(message);
     this.name = "Refusal";
     this.code = code;
-    if (opts.action) assertExecutableAction(opts.action);
-    this.action = opts.action;
+    this.action = opts.action ? executableAction(opts.action) : void 0;
     this.actionRequired = opts.actionRequired ?? false;
     this.extra = opts.extra ?? {};
   }
@@ -428,7 +455,7 @@ function defineDeepspaceCommand(def) {
       let succeeded = false;
       try {
         const out = await def.run({ args }) ?? {};
-        if (out.action) assertExecutableAction(out.action);
+        if (out.action) out.action = executableAction(out.action);
         if (json) {
           console.log(
             JSON.stringify({
@@ -492,7 +519,7 @@ function credentialPaths(authUrl = AUTH_URL) {
 var { sessionPath: SESSION_PATH, tokenPath: TOKEN_PATH } = credentialPaths();
 async function ensureToken() {
   if (existsSync(TOKEN_PATH)) {
-    const existing = readFileSync(TOKEN_PATH, "utf-8").trim();
+    const existing = readFileSync2(TOKEN_PATH, "utf-8").trim();
     if (isTokenValid(existing)) {
       return existing;
     }
@@ -502,7 +529,7 @@ async function ensureToken() {
       action: cliAction("deepspace", "auth", "login")
     });
   }
-  const sessionToken = readFileSync(SESSION_PATH, "utf-8").trim();
+  const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
   const token = await exchangeSession(AUTH_URL, sessionToken);
   if (!token) {
     throw new Refusal(
@@ -526,7 +553,7 @@ function isTokenValid(jwt) {
 registerAuthRefresh(async () => {
   try {
     if (!existsSync(SESSION_PATH)) return null;
-    const sessionToken = readFileSync(SESSION_PATH, "utf-8").trim();
+    const sessionToken = readFileSync2(SESSION_PATH, "utf-8").trim();
     const token = await exchangeSession(AUTH_URL, sessionToken);
     if (!token) return null;
     mkdirSync(DIR, { recursive: true, mode: 448 });
@@ -538,7 +565,7 @@ registerAuthRefresh(async () => {
 });
 
 // src/cli/commands/login.ts
-import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
 import { join as join2 } from "path";
 import { homedir as homedir2 } from "os";
 import { randomBytes, createHash } from "crypto";
@@ -697,7 +724,7 @@ function readPasswordFromStdin() {
       "password_stdin_needs_pipe"
     );
   }
-  return readFileSync2(0, "utf-8").replace(/\r?\n$/, "");
+  return readFileSync3(0, "utf-8").replace(/\r?\n$/, "");
 }
 async function pollForCompletion(sessionId, codeVerifier) {
   const maxAttempts = 120;
@@ -738,7 +765,7 @@ async function provisionProfile(jwt) {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve20) => setTimeout(resolve20, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 function base64url(bytes) {
   return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -775,7 +802,7 @@ async function doEmailLogin(email, password) {
 }
 
 // src/cli/commands/logout.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4, rmSync } from "fs";
 var AUTH_URL3 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 var { sessionPath: SESSION_PATH2, tokenPath: TOKEN_PATH2 } = credentialPaths(AUTH_URL3);
 var logout_default = defineDeepspaceCommand({
@@ -784,7 +811,7 @@ var logout_default = defineDeepspaceCommand({
     description: "Sign out and remove cached credentials"
   },
   async run({ args }) {
-    const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync3(SESSION_PATH2, "utf-8").trim() : null;
+    const sessionToken = existsSync2(SESSION_PATH2) ? readFileSync4(SESSION_PATH2, "utf-8").trim() : null;
     if (sessionToken) {
       try {
         await fetch(`${AUTH_URL3}/api/auth/sign-out`, {
@@ -810,8 +837,8 @@ var logout_default = defineDeepspaceCommand({
 });
 
 // src/cli/lib/app-identity.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3, resolve as resolve2 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/server/utils/registry-client.ts
@@ -846,10 +873,10 @@ function mintAppId(now = Date.now()) {
   return `app_${mintUlid(now)}`;
 }
 function readWranglerIdentityConfig(cwd) {
-  const wranglerPath = join3(resolve(cwd), "wrangler.toml");
+  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) return null;
   try {
-    return parseToml(readFileSync4(wranglerPath, "utf-8"));
+    return parseToml(readFileSync5(wranglerPath, "utf-8"));
   } catch (err) {
     throw new InputError(
       `Could not parse ${wranglerPath}: ${err instanceof Error ? err.message : String(err)}`,
@@ -865,9 +892,9 @@ function readAppId(cwd = process.cwd(), wranglerEnv) {
   return typeof id === "string" && APP_ID_RE.test(id) ? id : null;
 }
 function writeAppId(cwd, appId, opts = {}) {
-  const wranglerPath = join3(resolve(cwd), "wrangler.toml");
+  const wranglerPath = join3(resolve2(cwd), "wrangler.toml");
   if (!existsSync3(wranglerPath)) {
-    throw new Error(`No wrangler.toml in ${resolve(cwd)}`);
+    throw new Error(`No wrangler.toml in ${resolve2(cwd)}`);
   }
   const existing = readAppId(cwd, opts.wranglerEnv);
   if (existing && !opts.force) {
@@ -876,7 +903,7 @@ function writeAppId(cwd, appId, opts = {}) {
       `wrangler.toml already carries ${existing}. The app id is immutable \u2014 use --new-id only to fork this repo as a separate app.`
     );
   }
-  let src = readFileSync4(wranglerPath, "utf-8");
+  let src = readFileSync5(wranglerPath, "utf-8");
   const header = opts.wranglerEnv ? `[env.${opts.wranglerEnv}.vars]` : "[vars]";
   const line = `DEEPSPACE_APP_ID = "${appId}"`;
   const headerRe = new RegExp(`^\\${header.replace(/\./g, "\\.")}[ \\t]*$`, "m");
@@ -902,18 +929,18 @@ ${line}
 }
 
 // src/cli/commands/dev.ts
-import { resolve as resolve7, basename as basename2, join as join12 } from "path";
+import { resolve as resolve8, basename as basename2, join as join12 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/lib/app-context.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, readdirSync } from "fs";
-import { dirname, join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync } from "fs";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 function detectAppName(cwd = process.cwd()) {
-  const wranglerPath = join4(resolve2(cwd), "wrangler.toml");
+  const wranglerPath = join4(resolve3(cwd), "wrangler.toml");
   if (!existsSync4(wranglerPath)) return null;
   try {
-    const config = parseToml2(readFileSync5(wranglerPath, "utf-8"));
+    const config = parseToml2(readFileSync6(wranglerPath, "utf-8"));
     return typeof config.name === "string" && config.name.length > 0 ? config.name : null;
   } catch (error) {
     throw new InputError(
@@ -923,10 +950,10 @@ function detectAppName(cwd = process.cwd()) {
   }
 }
 function findAppDir(start = process.cwd()) {
-  let dir = resolve2(start);
+  let dir = resolve3(start);
   for (; ; ) {
     if (existsSync4(join4(dir, "wrangler.toml"))) return dir;
-    const parent = dirname(dir);
+    const parent = dirname2(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -942,18 +969,18 @@ function findChildApps(dir) {
 // src/cli/lib/launch-config.ts
 import {
   existsSync as existsSync5,
-  readFileSync as readFileSync7,
-  realpathSync,
+  readFileSync as readFileSync8,
+  realpathSync as realpathSync2,
   writeFileSync as writeFileSync4,
   mkdirSync as mkdirSync4,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join6, resolve as resolve4, dirname as dirname3, basename, isAbsolute as isAbsolute2, sep } from "path";
+import { join as join6, resolve as resolve5, dirname as dirname4, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
-import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
+import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname3, join as join5, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
@@ -1156,16 +1183,16 @@ function listWorktrees(cwd) {
   return worktrees;
 }
 function ensureLocalExclude(cwd, pattern) {
-  const commonDir = resolve3(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
+  const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
   const excludePath = join5(commonDir, "info", "exclude");
   let current = "";
   try {
-    current = readFileSync6(excludePath, "utf-8");
+    current = readFileSync7(excludePath, "utf-8");
   } catch {
   }
   if (current.split("\n").some((line) => line.trim() === pattern)) return;
   try {
-    mkdirSync3(dirname2(excludePath), { recursive: true });
+    mkdirSync3(dirname3(excludePath), { recursive: true });
     appendFileSync(
       excludePath,
       `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
@@ -1177,7 +1204,7 @@ function ensureLocalExclude(cwd, pattern) {
 
 // src/cli/lib/launch-config.ts
 function writeLaunchFile(launchPath, config) {
-  mkdirSync4(dirname3(launchPath), { recursive: true });
+  mkdirSync4(dirname4(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
   writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
@@ -1193,7 +1220,7 @@ function writeLaunchFile(launchPath, config) {
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
   if (!existsSync5(launchPath)) return empty;
-  const raw = readFileSync7(launchPath, "utf-8").trim();
+  const raw = readFileSync8(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
@@ -1258,10 +1285,10 @@ function detectClaudeWorktree(appDir) {
       listWorktrees(appDir).map((worktree) => canonicalPath(worktree.path))
     );
     if (!registered.has(worktreeRoot)) return null;
-    const worktreesDir = dirname3(worktreeRoot);
-    const claudeDir = dirname3(worktreesDir);
+    const worktreesDir = dirname4(worktreeRoot);
+    const claudeDir = dirname4(worktreesDir);
     if (basename(worktreesDir) !== "worktrees" || basename(claudeDir) !== ".claude") return null;
-    const ownerRoot = canonicalPath(dirname3(claudeDir));
+    const ownerRoot = canonicalPath(dirname4(claudeDir));
     if (!registered.has(ownerRoot)) return null;
     return { mainRepoRoot: ownerRoot, worktreeName: basename(worktreeRoot) };
   } catch {
@@ -1270,9 +1297,9 @@ function detectClaudeWorktree(appDir) {
 }
 function canonicalPath(path) {
   try {
-    return realpathSync(path);
+    return realpathSync2(path);
   } catch {
-    return resolve4(path);
+    return resolve5(path);
   }
 }
 function detectLinkedWorktree(appDir) {
@@ -1324,7 +1351,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
       // the Claude Code desktop launch.json reference alongside `port`) and
       // verified end-to-end: with it set, the preview server builds from the
       // worktree instead of the session's main repo.
-      cwd: resolve4(appDir)
+      cwd: resolve5(appDir)
     });
     writeLaunchFile(launchPath, config);
     return { entryName, port };
@@ -1351,7 +1378,7 @@ function resolveWorktreePort(appDir) {
 }
 
 // src/cli/lib/dev-vars.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10 } from "fs";
 
 // src/cli/lib/app-tokens.ts
 async function fetchPublicKey(authUrl) {
@@ -1896,7 +1923,7 @@ function writeSecretFileSync(path, content) {
 }
 
 // src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join7 } from "path";
 import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
 
@@ -2090,7 +2117,7 @@ var WranglerConfigError = class extends Error {
 };
 function readWranglerConfig(appDir) {
   const path = join7(appDir, "wrangler.toml");
-  const raw = readFileSync8(path, "utf-8");
+  const raw = readFileSync9(path, "utf-8");
   try {
     return parseToml3(raw);
   } catch (err) {
@@ -2263,7 +2290,7 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
   const devVarsPath = devVarsPathFor(appDir, wranglerEnv, {
     sharedDevVarsCache: useSharedDevVarsCache
   });
-  const existing = existsSync7(devVarsPath) ? readFileSync9(devVarsPath, "utf-8") : "";
+  const existing = existsSync7(devVarsPath) ? readFileSync10(devVarsPath, "utf-8") : "";
   const custom = opts.generatedSecretsCache ?? extractCustomDevVars(stripGeneratedSecretsCache(existing).trimEnd());
   let body;
   if (!custom) {
@@ -2285,15 +2312,15 @@ ${custom}
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync11, realpathSync as realpathSync2 } from "fs";
-import { dirname as dirname4, join as join9, resolve as resolve5 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync12, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname5, join as join9, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
 import { join as join8 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync11(join8(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
@@ -2331,7 +2358,7 @@ function ensureInstallReady(appDir) {
   const donePath = join9(sentinelDir, "install.done");
   const logPath = join9(sentinelDir, "install.log");
   if (existsSync9(errPath)) {
-    const detail = readFileSync11(errPath, "utf-8").trimEnd();
+    const detail = readFileSync12(errPath, "utf-8").trimEnd();
     const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
       `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
@@ -2372,22 +2399,22 @@ function resolvesDeepspace(fromDir) {
   for (; ; ) {
     if (existsSync9(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
     if (dir === checkoutRoot) return false;
-    const parent = dirname4(dir);
+    const parent = dirname5(dir);
     if (parent === dir) return false;
     dir = parent;
   }
 }
 function canonicalPath2(path) {
   try {
-    return realpathSync2(path);
+    return realpathSync3(path);
   } catch {
-    return resolve5(path);
+    return resolve6(path);
   }
 }
 function installWorkerAlive(sentinelDir) {
   const pidPath = join9(sentinelDir, "install.pid");
   if (!existsSync9(pidPath)) return false;
-  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
+  const pid = Number(readFileSync12(pidPath, "utf-8").trim());
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -2401,7 +2428,7 @@ function installWorkerAlive(sentinelDir) {
 import { execFileSync } from "child_process";
 import { existsSync as existsSync10 } from "fs";
 import * as nodeModule from "module";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function") {
   if (hasRegisterHooks) return;
   throw new Refusal(
@@ -2412,7 +2439,7 @@ function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.regi
 var DLL_NOT_FOUND = -1073741515;
 function preflightWindowsWorkerd(appDir) {
   if (process.platform !== "win32") return;
-  const workerdExe = resolve6(
+  const workerdExe = resolve7(
     appDir,
     "node_modules",
     "@cloudflare",
@@ -2577,11 +2604,11 @@ import { createServer, Socket } from "net";
 var DEFAULT_PORT = 5173;
 function isPortListening(port, host, timeoutMs = 500) {
   const target2 = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const socket = new Socket();
     const done = (listening) => {
       socket.destroy();
-      resolve20(listening);
+      resolve21(listening);
     };
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => done(true));
@@ -2594,7 +2621,7 @@ async function waitForPortListening(port, host, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (await isPortListening(port, host)) return true;
-    await new Promise((resolve20) => setTimeout(resolve20, 250));
+    await new Promise((resolve21) => setTimeout(resolve21, 250));
   }
   return false;
 }
@@ -2660,7 +2687,7 @@ var dev_default = defineDeepspaceCommand({
     preflightNodeVersion("dev start");
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
     const host = typeof args.host === "string" && args.host.trim() ? args.host.trim() : DEFAULT_DEV_HOST;
-    const start = resolve7(args.dir ?? ".");
+    const start = resolve8(args.dir ?? ".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw new Refusal(noAppDirMessage(start, findChildApps(start)), "no_app_dir");
@@ -2817,7 +2844,7 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 
 // src/cli/commands/kill.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { readFileSync as readFileSync12, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { readFileSync as readFileSync13, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
@@ -2968,7 +2995,7 @@ function listenerPidsViaProc(port) {
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync12(f, "utf-8");
+        data = readFileSync13(f, "utf-8");
       } catch {
         continue;
       }
@@ -3098,7 +3125,7 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 import { sync as spawnSync4 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
@@ -3127,10 +3154,10 @@ function ensurePlaywright(appDir) {
 }
 
 // src/cli/lib/test-account-service.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join13 } from "path";
 var TEST_ACCOUNTS_PATH = join13(homedir3(), ".deepspace", "test-accounts.json");
@@ -3206,7 +3233,7 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
 function readTestAccountStore() {
   if (!existsSync12(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {}, unscoped: [] };
   try {
-    const raw = JSON.parse(readFileSync13(TEST_ACCOUNTS_PATH, "utf-8"));
+    const raw = JSON.parse(readFileSync14(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {}, unscoped: validTestAccounts(raw) };
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       return { version: 2, scopes: {}, unscoped: [] };
@@ -3244,7 +3271,7 @@ function saveTestAccountStore(store) {
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
 function sessionCookie() {
-  const token = readFileSync14(SESSION_PATH, "utf-8").trim();
+  const token = readFileSync15(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteTestAccounts() {
@@ -3321,7 +3348,7 @@ var test_default = defineDeepspaceCommand({
     preflightNodeVersion("test run");
     const suite = args.suite ?? "default";
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    const start = resolve8(".");
+    const start = resolve9(".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw new Refusal(noAppDirMessage(start, findChildApps(start)), "no_app_dir");
@@ -3468,7 +3495,7 @@ function runVitest(appDir) {
 
 // src/cli/commands/screenshot.ts
 import { sync as spawnSync5 } from "cross-spawn";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve10 } from "path";
 var screenshot_default = defineDeepspaceCommand({
   meta: {
     name: "screenshot",
@@ -3497,7 +3524,7 @@ var screenshot_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve9(".");
+    const appDir = resolve10(".");
     ensurePlaywright(appDir);
     const url = String(args.url);
     const output = String(args.output);
@@ -3798,7 +3825,7 @@ var test_accounts_default = defineCommand2({
 // src/cli/commands/deploy.ts
 import * as p12 from "@clack/prompts";
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
 
 // src/cli/lib/edge-propagation.ts
 import { request as httpRequest } from "http";
@@ -3863,14 +3890,14 @@ async function servesRelease(probe, releaseStamp) {
 }
 function getOnFreshConnection(url, timeoutMs = 5e3) {
   const send = url.protocol === "http:" ? httpRequest : httpsRequest;
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const request2 = send(
       url,
       { method: "GET", agent: false, timeout: timeoutMs, headers: { "cache-control": "no-cache" } },
       (response) => {
         if (response.statusCode !== 200) {
           response.resume();
-          resolve20(null);
+          resolve21(null);
           return;
         }
         let body = "";
@@ -3878,20 +3905,20 @@ function getOnFreshConnection(url, timeoutMs = 5e3) {
         response.on("data", (chunk) => {
           if (body.length < 4096) body += chunk;
         });
-        response.on("end", () => resolve20(body));
-        response.on("error", () => resolve20(null));
+        response.on("end", () => resolve21(body));
+        response.on("error", () => resolve21(null));
       }
     );
     request2.on("timeout", () => {
       request2.destroy();
-      resolve20(null);
+      resolve21(null);
     });
-    request2.on("error", () => resolve20(null));
+    request2.on("error", () => resolve21(null));
     request2.end();
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve20) => setTimeout(resolve20, ms));
+  return new Promise((resolve21) => setTimeout(resolve21, ms));
 }
 
 // src/shared/app-files.ts
@@ -3911,13 +3938,15 @@ function planUploadParts(totalBytes, partSize) {
   }
   return parts;
 }
-var APP_STORAGE_LIMIT_BYTES = {
+var GIB = 1024 * 1024 * 1024;
+var ACCOUNT_STORAGE_LIMIT_BYTES = {
   test: 0,
-  free: 128 * 1024 * 1024,
-  starter: 512 * 1024 * 1024,
-  premium: 2 * 1024 * 1024 * 1024,
-  admin: 10 * 1024 * 1024 * 1024
+  free: 1 * GIB,
+  starter: 10 * GIB,
+  premium: 30 * GIB,
+  admin: 100 * GIB
 };
+var REPO_STORE_LIMIT_BYTES = 256 * 1024 * 1024;
 var MAX_DEPLOY_ASSET_FILE_BYTES = 25 * 1024 * 1024;
 var DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
   "text/html",
@@ -3968,11 +3997,11 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync17, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname5, join as join16, resolve as resolve10 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync4 } from "fs";
+import { dirname as dirname6, join as join16, resolve as resolve11 } from "path";
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
 import { join as join14 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
   if (!existsSync13(join14(appDir, "documentation.json"))) return void 0;
@@ -3982,7 +4011,7 @@ function readDocumentationDeployManifest(appDir, clientDir) {
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
   }
-  return JSON.parse(readFileSync15(manifestPath, "utf8"));
+  return JSON.parse(readFileSync16(manifestPath, "utf8"));
 }
 
 // src/cli/commands/update/app-migrations.ts
@@ -3994,7 +4023,7 @@ import {
   ftruncateSync,
   lstatSync,
   openSync,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   writeSync
 } from "fs";
 import { join as join15 } from "path";
@@ -4139,7 +4168,7 @@ function readRegularFile(path) {
     if (!opened.isFile() || opened.dev !== after.dev || opened.ino !== after.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    return readFileSync16(fd, "utf-8");
+    return readFileSync17(fd, "utf-8");
   } finally {
     closeSync(fd);
   }
@@ -4165,7 +4194,7 @@ function writeRegularFile(path, before, after) {
     if (!opened.isFile() || opened.dev !== currentPath.dev || opened.ino !== currentPath.ino) {
       throw new Error(`Migration input changed while opening: ${path}`);
     }
-    if (readFileSync16(fd, "utf-8") !== before) {
+    if (readFileSync17(fd, "utf-8") !== before) {
       throw new Error(`Migration input changed after planning: ${path}`);
     }
     ftruncateSync(fd, 0);
@@ -4288,12 +4317,12 @@ async function buildDeployBundle(options) {
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync17(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve10(dirname5(deployConfigPath), deployConfig.configPath);
+  const deployConfig = JSON.parse(readFileSync18(deployConfigPath, "utf-8"));
+  const outputWranglerPath = resolve11(dirname6(deployConfigPath), deployConfig.configPath);
   if (!existsSync15(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync17(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync18(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -4301,9 +4330,9 @@ async function buildDeployBundle(options) {
       "build_output_mismatch"
     );
   }
-  const workerDir = dirname5(outputWranglerPath);
+  const workerDir = dirname6(outputWranglerPath);
   const workerBundlePath = join16(workerDir, outputConfig.main);
-  const clientDir = outputConfig.assets?.directory ? resolve10(workerDir, outputConfig.assets.directory) : null;
+  const clientDir = outputConfig.assets?.directory ? resolve11(workerDir, outputConfig.assets.directory) : null;
   if (!existsSync15(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
@@ -4320,7 +4349,7 @@ async function buildDeployBundle(options) {
   const assets = collectAssets(clientDir);
   const assetConfig = readDeployAssetConfig(clientDir);
   spinner2.stop(`Collected ${assets.length} assets`);
-  const workerJs = readFileSync17(workerBundlePath, "utf-8");
+  const workerJs = readFileSync18(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -4399,7 +4428,7 @@ function collectAssets(dir) {
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
-        const bytes = readFileSync17(fullPath);
+        const bytes = readFileSync18(fullPath);
         assets.push({
           path: `/${relativePath}`,
           hash: createHash2("sha256").update(bytes).digest("hex"),
@@ -4417,7 +4446,7 @@ function readDeployAssetConfig(clientDir) {
   for (const [file, key] of [["_headers", "_headers"], ["_redirects", "_redirects"]]) {
     const filePath = join16(clientDir, file);
     if (!existsSync15(filePath)) continue;
-    const content = readFileSync17(filePath, "utf8");
+    const content = readFileSync18(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
   return config;
@@ -4670,19 +4699,20 @@ function createDeployOutput(json) {
       introShown = true;
     },
     die(message, code, opts = {}) {
+      const action = opts.action ? executableAction(opts.action) : void 0;
       if (json) {
         emitJson({
           ok: false,
           code,
           error: message,
           ...opts.actionRequired ? { actionRequired: true } : {},
-          ...opts.action ? { action: opts.action } : {}
+          ...action ? { action } : {}
         });
       } else {
         if (introShown && opts.actionRequired) p8.log.warn(withSlug(message, code));
         else if (introShown) p8.cancel(withSlug(message, code));
         else console.error(withSlug(message, code));
-        if (opts.action) printAction(opts.action);
+        if (action) printAction(action);
       }
       process.exit(opts.actionRequired ? 2 : 1);
     }
@@ -4691,7 +4721,7 @@ function createDeployOutput(json) {
 
 // src/cli/commands/deploy/request.ts
 import * as p10 from "@clack/prompts";
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
@@ -4884,7 +4914,7 @@ function repoApi(deployUrl, token, appId) {
 // src/cli/lib/vc-remote.ts
 import { existsSync as existsSync17 } from "fs";
 import { tmpdir } from "os";
-import { isAbsolute as isAbsolute3, relative, resolve as resolve11 } from "path";
+import { isAbsolute as isAbsolute3, relative, resolve as resolve12 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
   if (environment === "staging") return "space-staging";
   if (environment === "production") return "space";
@@ -4930,7 +4960,7 @@ function entryIsTransient(cwd) {
   const entry = process.argv[1];
   if (!entry) return true;
   if (/[\\/]_npx[\\/]/.test(entry) || entry.startsWith(tmpdir())) return true;
-  const rel = relative(resolve11(cwd), resolve11(entry));
+  const rel = relative(resolve12(cwd), resolve12(entry));
   return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function helperEntryUsable(command) {
@@ -5003,6 +5033,25 @@ function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE) {
   installCredentialHelper(cwd, url);
   return url;
 }
+function ensureGitIdentity(cwd, token) {
+  try {
+    const configured = (key) => runGit(cwd, ["config", "--get", key], { allowFail: true }).stdout.toString("utf-8").trim() !== "";
+    const missingName = !configured("user.name");
+    const missingEmail = !configured("user.email");
+    if (!missingName && !missingEmail) return;
+    const payload = decodeJwtPayload(token);
+    if (!payload.email) return;
+    if (missingName) {
+      runGit(cwd, ["config", "--local", "user.name", payload.name || payload.email], {
+        allowFail: true
+      });
+    }
+    if (missingEmail) {
+      runGit(cwd, ["config", "--local", "user.email", payload.email], { allowFail: true });
+    }
+  } catch {
+  }
+}
 function appIdFromRepoUrl(url) {
   const match = /\/api\/repo\/([^/]+)\/?$/.exec(url);
   return match ? decodeURIComponent(match[1]) : null;
@@ -5418,7 +5467,7 @@ async function pushWithTransientRetry(push) {
       const message = errorMessage3(error);
       const transient = /(?:HTTP |error: )(?:429|503)\b/i.test(message);
       if (transient && attempt < backoffMs.length && Date.now() + backoffMs[attempt] < deadline) {
-        await new Promise((resolve20) => setTimeout(resolve20, backoffMs[attempt]));
+        await new Promise((resolve21) => setTimeout(resolve21, backoffMs[attempt]));
         continue;
       }
       throw error;
@@ -5458,6 +5507,7 @@ async function deployBuiltBundle(options) {
     appId,
     appName,
     token,
+    claimReleased,
     ignoreStale,
     bundle,
     secrets,
@@ -5475,7 +5525,8 @@ async function deployBuiltBundle(options) {
   await uploadDeployAssets({ deployUrl, appId, token, assets: bundle.assets, output, spinner: spinner2 });
   spinner2.message(`Deploying ${appName}...`);
   let confirmRename = options.rename;
-  const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, action) => {
+  const bail = async (message, stopLabel = "Deploy failed", code, actionRequired = false, rawAction) => {
+    const action = rawAction ? executableAction(rawAction) : void 0;
     if (stopLabel !== null) spinner2.stop(stopLabel);
     p10.cancel(code ? withSlug(message, code) : message);
     if (action) printAction(action);
@@ -5521,6 +5572,7 @@ async function deployBuiltBundle(options) {
     }
     form.append("name", appName);
     if (confirmRename) form.append("confirmRename", "true");
+    if (claimReleased) form.append("claimReleased", "true");
     if (shouldSendLineage(repository.commitOid, repository.recoverable)) {
       form.append("commitOid", repository.commitOid);
     }
@@ -5694,7 +5746,7 @@ async function uploadDeployAssets(options) {
           // against the plan before it touches storage, and a stream body
           // would be sent chunked with no length at all; a retry also needs a
           // body it can send again.
-          body: readFileSync18(asset.sourcePath)
+          body: readFileSync19(asset.sourcePath)
         })
       );
       if (!response.ok) {
@@ -5772,7 +5824,7 @@ async function postWithRetry(url, makeInit, {
       lastError = error;
     }
     if (attempt < attempts) {
-      await new Promise((resolve20) => setTimeout(resolve20, Math.min(8e3, 500 * 2 ** (attempt - 1))));
+      await new Promise((resolve21) => setTimeout(resolve21, Math.min(8e3, 500 * 2 ** (attempt - 1))));
     }
   }
   if (lastResponse) return lastResponse;
@@ -5781,7 +5833,7 @@ async function postWithRetry(url, makeInit, {
 
 // src/cli/commands/deploy/secrets.ts
 import * as p11 from "@clack/prompts";
-import { existsSync as existsSync18, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync20 } from "fs";
 function classifyDevVarsSecrets(options) {
   const store = new Set(options.storeSecretNames);
   const strayKeys = options.handEditedDevVarKeys.filter((key) => !store.has(key));
@@ -5880,7 +5932,7 @@ function prepareDeploySecrets(options) {
 }
 function readCustomDevVars(path, output) {
   if (!existsSync18(path)) return {};
-  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync19(path, "utf-8")));
+  const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync20(path, "utf-8")));
   if (!section) return {};
   try {
     return parseDevVars(section);
@@ -5920,6 +5972,11 @@ var deploy_default = defineCommand3({
       description: "Confirm that a changed wrangler `name` renames this app (its URL moves; data, secrets, and collaborators travel). Without this flag an interactive prompt asks.",
       default: false
     },
+    "claim-released": {
+      type: "boolean",
+      description: "Platform admins only: claim an app name still inside its 30-day release cooldown. The previous owner permanently loses their reserved reclaim. Non-admin accounts are refused.",
+      default: false
+    },
     "allow-missing-secrets": {
       type: "boolean",
       description: "Deploy even though hand-edited .dev.vars secrets are absent from the store (they will NOT be deployed, and any a previous deploy set are dropped).",
@@ -5945,7 +6002,7 @@ var deploy_default = defineCommand3({
   async run({ args }) {
     const output = createDeployOutput(args.json === true);
     preflightNodeVersion("deploy");
-    const appDir = resolve12(args.dir ?? ".");
+    const appDir = resolve13(args.dir ?? ".");
     const selectorRefusal = blankSelectorRefusal(args);
     if (selectorRefusal) output.die(selectorRefusal.error, selectorRefusal.code);
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
@@ -6033,6 +6090,7 @@ var deploy_default = defineCommand3({
       appName,
       token,
       rename: args.rename === true,
+      claimReleased: args["claim-released"] === true,
       ignoreStale: Boolean(args["ignore-stale"]),
       bundle,
       secrets,
@@ -6061,10 +6119,7 @@ var deploy_default = defineCommand3({
             url: body.url,
             releaseId: body.releaseId ?? null,
             bundleRetained: body.bundleRetained ?? null,
-            // `serving` says what was actually established; `edgePropagating`
-            // stays for callers written against the old shape.
             serving,
-            edgePropagating: serving === "unconfirmed",
             recoverable: repository.recoverable,
             ...staleBaseGuardFields(body)
           });
@@ -6083,7 +6138,7 @@ var deploy_default = defineCommand3({
         appName,
         url: body.url ?? null,
         // Always present, so a caller branches on one field instead of
-        // inferring success from the absence of `edgePropagating`.
+        // inferring success from an absent one.
         serving,
         releaseId: body.releaseId ?? null,
         bundleRetained: body.bundleRetained ?? null,
@@ -6763,8 +6818,8 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname7, join as join19, resolve as resolve14 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync22, realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname8, join as join19, resolve as resolve15 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/cli/commands/feature-installer.ts
@@ -6776,7 +6831,7 @@ import {
   mkdirSync as mkdirSync6,
   mkdtempSync,
   openSync as openSync2,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync21,
   readSync,
   readdirSync as readdirSync5,
   rmSync as rmSync4,
@@ -6784,21 +6839,21 @@ import {
 } from "fs";
 import { spawnSync as spawnSync6 } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join18, resolve as resolve13 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join18, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 var NAV_MARKER = "// \u2500\u2500 Features add nav items below this line \u2500\u2500";
 function featurePackageRoot(moduleUrl = import.meta.url) {
-  let dir = dirname6(fileURLToPath(moduleUrl));
+  let dir = dirname7(fileURLToPath(moduleUrl));
   for (; ; ) {
     const packagePath = join18(dir, "package.json");
     if (existsSync19(packagePath)) {
       try {
-        const pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
       } catch {
       }
     }
-    const parent = dirname6(dir);
+    const parent = dirname7(dir);
     if (parent === dir) throw new Error("Could not locate the deepspace package root");
     dir = parent;
   }
@@ -6810,7 +6865,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join18(packageRoot, "features", id, "feature.json");
   if (!existsSync19(configPath)) return null;
   try {
-    const config = JSON.parse(readFileSync20(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync21(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
       return null;
     }
@@ -6859,7 +6914,7 @@ function suggestFeature(featureId, packageRoot = featurePackageRoot()) {
   return closest !== null && closestDistance <= threshold ? closest : null;
 }
 function resolveTargetDir(raw) {
-  return isAbsolute4(raw) ? raw : resolve13(raw);
+  return isAbsolute4(raw) ? raw : resolve14(raw);
 }
 function resolveFeatureDestPath(fileDest, route) {
   const pages = "src/pages/";
@@ -6869,13 +6924,13 @@ function resolveFeatureDestPath(fileDest, route) {
   return route?.protected === false ? `${appPages}${rest}` : `${appPages}(protected)/${rest}`;
 }
 function copyFile(src, dest) {
-  mkdirSync6(dirname6(dest), { recursive: true });
+  mkdirSync6(dirname7(dest), { recursive: true });
   copyFileSync(src, dest);
 }
 function copyFileWithImportShift(src, dest, levels) {
-  mkdirSync6(dirname6(dest), { recursive: true });
+  mkdirSync6(dirname7(dest), { recursive: true });
   const prefix = "../".repeat(levels);
-  const shifted = readFileSync20(src, "utf-8").replace(
+  const shifted = readFileSync21(src, "utf-8").replace(
     /(from\s+|import\s+|import\()(['"])(\.\.\/)/g,
     `$1$2${prefix}$3`
   );
@@ -6934,7 +6989,7 @@ function integrateSchema(config, targetDir, emit) {
   if (!existsSync19(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
-  let content = readFileSync20(schemasPath, "utf-8");
+  let content = readFileSync21(schemasPath, "utf-8");
   const { exportName, importPath, spreadOperator } = config.schema;
   const importPattern = new RegExp(`^import\\s+\\{[^}]*\\b${exportName}\\b`, "m");
   if (importPattern.test(content)) {
@@ -6991,7 +7046,7 @@ function integrateActions(config, targetDir, emit) {
   if (!existsSync19(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
-  let content = readFileSync20(actionsPath, "utf-8");
+  let content = readFileSync21(actionsPath, "utf-8");
   const registryPattern = /export const actions:\s*Record<string,\s*ActionHandler(?:<[^>]*>)?>\s*=\s*\{/;
   if (!registryPattern.test(content)) {
     const reason = "src/actions/index.ts has an unexpected structure.";
@@ -7046,7 +7101,7 @@ function integrateCode(config, targetDir, emit) {
       });
       continue;
     }
-    const original = readFileSync20(targetPath, "utf-8");
+    const original = readFileSync21(targetPath, "utf-8");
     if (original.includes(insertion.insert.trim())) {
       emit(`   Integration already present: ${insertion.file}`);
       continue;
@@ -7082,7 +7137,7 @@ ${content.slice(importIndex < 0 ? 0 : importIndex)}`;
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join18(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync20(targetPath, "utf-8") : "";
+  const current = existsSync19(targetPath) ? readFileSync21(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -7102,7 +7157,7 @@ function integrateWrangler(config, targetDir, emit) {
   if (!existsSync19(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
-  let source = readFileSync20(targetPath, "utf-8");
+  let source = readFileSync21(targetPath, "utf-8");
   if (runWorkerFirst && !/^\[assets\]\s*$/m.test(source)) {
     return [{ area: "wrangler", reason: "wrangler.toml has no [assets] section.", steps }];
   }
@@ -7191,7 +7246,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       }
     ];
   }
-  let styles = readFileSync20(stylesPath, "utf-8");
+  let styles = readFileSync21(stylesPath, "utf-8");
   let integrated = 0;
   const unresolved = [];
   for (const cssFile of config.css) {
@@ -7205,7 +7260,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
       });
       continue;
     }
-    const css = readFileSync20(srcPath, "utf-8");
+    const css = readFileSync21(srcPath, "utf-8");
     const fingerprint = css.match(/\.([\w-]+)\s*\{|@keyframes\s+([\w-]+)/);
     const marker = fingerprint?.[1] ?? fingerprint?.[2];
     if (marker && styles.includes(marker)) {
@@ -7236,7 +7291,7 @@ function integrateRoute(config, targetDir, emit) {
   if (!existsSync19(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
-  let content = readFileSync20(navPath, "utf-8");
+  let content = readFileSync21(navPath, "utf-8");
   const routePath = config.route.path;
   if (content.includes(`'${routePath}'`)) {
     emit(`   Nav already present: ${routePath}`);
@@ -7317,7 +7372,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
   }
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync20(packagePath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
   } catch (error) {
     emit(
       `   Could not patch package.json (parse error: ${error instanceof Error ? error.message : String(error)})`
@@ -7377,7 +7432,7 @@ ${child.diagnosticTail}` : "";
 }
 function dependencySnapshot(targetDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync20(join18(targetDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync21(join18(targetDir, "package.json"), "utf-8"));
     return {
       dependencies: pkg2.dependencies ?? {},
       devDependencies: pkg2.devDependencies ?? {}
@@ -7626,7 +7681,7 @@ function isDeepSpaceApp(dir) {
   const packagePath = join19(dir, "package.json");
   if (!existsSync20(packagePath)) return false;
   try {
-    const pkg2 = JSON.parse(readFileSync21(packagePath, "utf-8"));
+    const pkg2 = JSON.parse(readFileSync22(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
   } catch {
     return false;
@@ -7637,7 +7692,7 @@ function installedPackageRoot(fromDir) {
   for (; ; ) {
     const candidate = join19(dir, "node_modules", "deepspace");
     if (existsSync20(join19(candidate, "package.json"))) return candidate;
-    const parent = dirname7(dir);
+    const parent = dirname8(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -7650,7 +7705,7 @@ async function targetInstaller(appDir) {
       "feature_installer_missing"
     );
   }
-  if (realpathSync3(installedRoot) === realpathSync3(featurePackageRoot())) {
+  if (realpathSync4(installedRoot) === realpathSync4(featurePackageRoot())) {
     return { installFeature };
   }
   const entry = join19(installedRoot, "dist", "feature-installer.js");
@@ -7747,7 +7802,7 @@ var add_default = defineDeepspaceCommand({
       }
       return { data: { features: featureCatalog(root) } };
     }
-    const appDir = resolve14(args.dir ?? ".");
+    const appDir = resolve15(args.dir ?? ".");
     if (!existsSync20(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
@@ -7829,11 +7884,11 @@ function fmtDate(iso) {
 }
 async function confirm4(message) {
   process.stdout.write(`${message} [y/N] `);
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     process.stdin.setEncoding("utf-8");
     process.stdin.once("data", (data) => {
       const answer = data.toString().trim().toLowerCase();
-      resolve20(answer === "y" || answer === "yes");
+      resolve21(answer === "y" || answer === "yes");
     });
   });
 }
@@ -8123,7 +8178,7 @@ var domain_default = defineCommand5({
 
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
-import { basename as basename4, resolve as resolve15 } from "path";
+import { basename as basename4, resolve as resolve16 } from "path";
 import { existsSync as existsSync21, statSync as statSync2 } from "fs";
 
 // src/cli/lib/app-files-api.ts
@@ -8324,7 +8379,7 @@ async function deleteAppFile(baseUrl, token, appId, key) {
   const path = filesPath(appId, `/${encodeKeyPath(key)}`);
   const res = await request(baseUrl, token, path, { method: "DELETE" });
   const body = await readJson(res, path);
-  return { existed: body.existed !== false };
+  return { existed: body.existed };
 }
 async function downloadAppFile(baseUrl, token, appId, key, destination) {
   const path = filesPath(appId, `/${encodeKeyPath(key)}`);
@@ -8394,7 +8449,7 @@ var put = defineDeepspaceCommand({
     app: { type: "string", description: "App id or live name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
-    const localPath = resolve15(String(args.file));
+    const localPath = resolve16(String(args.file));
     if (!existsSync21(localPath) || !statSync2(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
@@ -8495,7 +8550,7 @@ var get = defineDeepspaceCommand({
   },
   async run({ args }) {
     const key = requireKey(String(args.key));
-    const destination = resolve15(String(args.out ?? basename4(key)));
+    const destination = resolve16(String(args.out ?? basename4(key)));
     const { token, appId } = await target(args.app);
     const result = await downloadAppFile(PLATFORM_URL, token, appId, key, destination);
     if (!args.json) console.log(`\u2713 ${key} \u2192 ${destination} (${formatBytes(result.bytes)})`);
@@ -8865,7 +8920,7 @@ var transfer_default = defineCommand8({
 import { defineCommand as defineCommand9 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync22 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 import * as p15 from "@clack/prompts";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -8906,7 +8961,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync22(0, "utf-8") : readFileSync22(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync23(0, "utf-8") : readFileSync23(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -9185,8 +9240,8 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
-import { dirname as dirname8, join as join20 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync24 } from "fs";
+import { dirname as dirname9, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL8 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -9207,14 +9262,14 @@ function normalizeType(raw) {
 }
 function readCliVersion() {
   try {
-    const here = dirname8(fileURLToPath2(import.meta.url));
+    const here = dirname9(fileURLToPath2(import.meta.url));
     const candidates = [
       join20(here, "..", "package.json"),
       join20(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
       if (!existsSync22(path)) continue;
-      const pkg2 = JSON.parse(readFileSync23(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync24(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -9410,7 +9465,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync25 } from "fs";
 
 // src/cli/lib/citty-args.ts
 function dedupePositionals(bound, rest) {
@@ -9680,7 +9735,7 @@ var upload = defineCommand10({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync24(0, "utf-8") : readFileSync24(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync25(0, "utf-8") : readFileSync25(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0)
         fail(new InputError("No secrets found in the input.", "empty_input"));
@@ -9936,7 +9991,7 @@ var init_default = defineDeepspaceCommand({
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
 import * as p17 from "@clack/prompts";
-import { existsSync as existsSync23, readFileSync as readFileSync25 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync26 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -10030,7 +10085,7 @@ var status_default = defineCommand11({
       let who = "logged in";
       try {
         const payload = decodeJwtPayload(
-          readFileSync25(TOKEN_PATH, "utf-8").trim()
+          readFileSync26(TOKEN_PATH, "utf-8").trim()
         );
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
@@ -10182,21 +10237,24 @@ var status_default = defineCommand11({
           }
           const refs = refsResult.ok ? refsResult.value : void 0;
           const trunkRef = refs?.refs.find((r) => `refs/heads/${branch}` === r.name);
+          const defaultBranch = refs?.head && refs.head.startsWith("refs/heads/") ? refs.head.slice("refs/heads/".length) : null;
           if (!facts.workspaceId && branch) {
+            const isTrunk = defaultBranch === null ? null : branch === defaultBranch;
+            const label = isTrunk === false ? "Branch sync" : "Trunk";
             if (githubSource) {
-              lines.push(["Trunk", `${branch} is owned through normal Git/GitHub`]);
-              json.trunk = { state: "external", provider: "github", branch };
-            } else if (!refsResult.ok) reportRemoteFailure2("Trunk", "trunk", refsResult.error);
+              lines.push([label, `${branch} is owned through normal Git/GitHub`]);
+              json.trunk = { state: "external", provider: "github", branch, isTrunk };
+            } else if (!refsResult.ok) reportRemoteFailure2(label, "trunk", refsResult.error);
             else {
               const remoteOid = trunkRef?.oid ?? null;
               const localOid = resolveCommit(appDir, `refs/heads/${branch}`);
               const remoteKnownLocally = remoteOid ? resolveCommit(appDir, remoteOid) !== null : false;
               facts.trunkState = remoteOid === null && localOid === null ? "unknown" : remoteOid === localOid ? "in_sync" : remoteOid && localOid && remoteKnownLocally && isAncestor(appDir, remoteOid, localOid) ? "local_ahead" : remoteOid && localOid && remoteKnownLocally && isAncestor(appDir, localOid, remoteOid) ? "local_behind" : remoteOid && localOid && remoteKnownLocally ? "diverged" : "differs";
               lines.push([
-                "Trunk",
+                label,
                 remoteOid === null ? `cloud repo has no ${branch} yet` : facts.trunkState === "in_sync" ? `${branch} in sync with the cloud repo (${remoteOid.slice(0, 10)})` : `${branch} ${facts.trunkState.replace("_", " ")} relative to the cloud repo (local ${localOid?.slice(0, 10) ?? "none"}, cloud ${remoteOid.slice(0, 10)})`
               ]);
-              json.trunk = { state: facts.trunkState, localOid, remoteOid };
+              json.trunk = { state: facts.trunkState, localOid, remoteOid, branch, isTrunk };
             }
           }
           if (!releaseResult.ok) reportRemoteFailure2("Live", "live", releaseResult.error);
@@ -10423,7 +10481,7 @@ var push_default = defineDeepspaceCommand({
 
 // src/cli/commands/pull.ts
 import * as p19 from "@clack/prompts";
-import { realpathSync as realpathSync4 } from "fs";
+import { realpathSync as realpathSync5 } from "fs";
 function targetedVcAction(command, cwd, appId, branch) {
   return {
     cwd,
@@ -10447,7 +10505,7 @@ function workspaceBranchPullRefusal(branch, trunkBranch) {
 function worktreeHoldingBranch(worktrees, branch, selfPath) {
   const real = (pth) => {
     try {
-      return realpathSync4(pth);
+      return realpathSync5(pth);
     } catch {
       return pth;
     }
@@ -10705,7 +10763,7 @@ var pull_default = defineDeepspaceCommand({
 // src/cli/commands/clone.ts
 import * as p20 from "@clack/prompts";
 import { existsSync as existsSync24, readdirSync as readdirSync6, rmSync as rmSync5 } from "fs";
-import { resolve as resolve16, basename as basename5, join as join21 } from "path";
+import { resolve as resolve17, basename as basename5, join as join21 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
@@ -10759,7 +10817,7 @@ var clone_default = defineDeepspaceCommand({
   async run({ args }) {
     assertAppTargetResolvable(String(args.app));
     const selector = String(args.app).trim();
-    const dir = resolve16(String(args.dir ?? selector));
+    const dir = resolve17(String(args.dir ?? selector));
     const dirPreexisted = validateCloneTarget(dir);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Resolving ${selector}\u2026`);
@@ -10799,6 +10857,7 @@ var clone_default = defineDeepspaceCommand({
       throw err;
     }
     ensureSpaceRemote(dir, appId);
+    ensureGitIdentity(dir, token);
     const head = resolveCommit(dir, "HEAD");
     const branch = currentBranch(dir);
     spinner2?.stop(
@@ -11021,14 +11080,13 @@ Re-run with --allow-do-deletion to accept the data loss.`,
       spinner2?.message("Waiting for the edge to serve this release...");
       serving = await waitForLiveRelease(result.url, result.releaseStamp, 9e4);
     }
-    const edgePropagating = serving === "unconfirmed";
     spinner2?.stop(
       serving === "confirmed" ? `Rolled back to ${result.rolledBackTo ?? releaseId}.` : serving === "unconfirmed" ? `Rolled back to ${result.rolledBackTo ?? releaseId} \u2014 the edge is still rolling it out.` : `Rolled back to ${result.rolledBackTo ?? releaseId} \u2014 serving could not be verified from here.`
     );
     const doClassGuard = result.doClassGuard === "unverified" ? "unverified" : void 0;
     if (!args.json) {
       if (result.url) {
-        if (edgePropagating) p22.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
+        if (serving === "unconfirmed") p22.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
         else p22.log.success(`Live at: ${result.url}`);
       }
       if (result.bundleRetained === false) {
@@ -11056,7 +11114,6 @@ Re-run with --allow-do-deletion to accept the data loss.`,
         wranglerEnv: wranglerEnv ?? null,
         // Always present, matching `deploy`: one field to branch on.
         serving,
-        ...edgePropagating ? { edgePropagating: true } : {},
         ...doClassGuard ? { doClassGuard } : {}
       }
     };
@@ -11068,7 +11125,7 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p25 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, resolve as resolve17 } from "path";
+import { isAbsolute as isAbsolute6, resolve as resolve18 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p23 from "@clack/prompts";
@@ -11077,6 +11134,14 @@ var PEER_REF_PREFIX = `${spacePrivateRef("peers")}/`;
 function peerWorkspaceRef(workspaceId) {
   return `${PEER_REF_PREFIX}${workspaceId}`;
 }
+function workspaceSyncRelation(dir, localOid, publishedOid) {
+  if (localOid !== null && localOid === publishedOid) return "in_sync";
+  if (localOid === null || publishedOid === null) return "unknown";
+  if (resolveCommit(dir, publishedOid) === null) return "unknown";
+  if (isAncestor(dir, localOid, publishedOid)) return "behind";
+  if (isAncestor(dir, publishedOid, localOid)) return "ahead";
+  return "diverged";
+}
 function formatCount(count) {
   if (!count) return "?";
   return count.capped ? `${count.count}+` : String(count.count);
@@ -11193,18 +11258,18 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p24 from "@clack/prompts";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync26, realpathSync as realpathSync5, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync27, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute5, join as join22, relative as relative2, sep as sep2 } from "path";
 var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
     ensureLocalExclude(appDir, ".deepspace/");
-    const realDir = realpathSync5(dir);
-    const rel = relative2(realpathSync5(repoToplevel(appDir)), realDir);
+    const realDir = realpathSync6(dir);
+    const rel = relative2(realpathSync6(repoToplevel(appDir)), realDir);
     if (!rel || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute5(rel)) return;
     const pattern = rel.split(sep2).join("/");
     if (pattern === ".deepspace" || pattern.startsWith(".deepspace/")) return;
-    const relApp = relative2(realpathSync5(appDir), realDir).split(sep2).join("/");
+    const relApp = relative2(realpathSync6(appDir), realDir).split(sep2).join("/");
     if (relApp === ".deepspace" || relApp.startsWith(".deepspace/")) return;
     ensureLocalExclude(appDir, `/${pattern}/`);
   } catch {
@@ -11226,7 +11291,7 @@ function markManagedWorkspace(worktreeRoot, workspaceId) {
   const marker = { version: 1, workspaceId, mode: "managed-linked" };
   const tempPath = `${markerPath}.${process.pid}.tmp`;
   try {
-    mkdirSync7(dirname9(markerPath), { recursive: true });
+    mkdirSync7(dirname10(markerPath), { recursive: true });
     writeFileSync9(tempPath, JSON.stringify(marker) + "\n");
     renameSync2(tempPath, markerPath);
     return true;
@@ -11251,7 +11316,7 @@ function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
   const markerPath = worktreeMarkerPath(worktreeRoot);
   if (!markerPath) return false;
   try {
-    const marker = JSON.parse(readFileSync26(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync27(markerPath, "utf-8"));
     return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
     return false;
@@ -11263,7 +11328,7 @@ function defaultWorkspaceRoot(appDir, workspaceId) {
   return join22(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
 }
 function appDirInWorktree(appDir, worktreeRoot) {
-  const appRelative = relative2(realpathSync5(repoToplevel(appDir)), realpathSync5(appDir));
+  const appRelative = relative2(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
   return appRelative ? join22(worktreeRoot, appRelative) : worktreeRoot;
 }
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
@@ -11279,6 +11344,18 @@ function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint,
   }
   excludeWorktreeDir(appDir, worktreeRoot);
 }
+function rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, workspaceId, options = {}) {
+  const added = runGit(appDir, ["worktree", "add", worktreeRoot, branch], { allowFail: true });
+  if (added.status !== 0) {
+    return added.stderr.toString("utf-8").trim() || "unknown git error";
+  }
+  if (!(options.markManaged ?? markManagedWorkspace)(worktreeRoot, workspaceId)) {
+    runGit(appDir, ["worktree", "remove", worktreeRoot], { allowFail: true });
+    return `could not record DeepSpace ownership for ${worktreeRoot}`;
+  }
+  excludeWorktreeDir(appDir, worktreeRoot);
+  return null;
+}
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
@@ -11387,7 +11464,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
       }
       let inside = false;
       try {
-        inside = realpathSync5(repoToplevel(appDir)) === realpathSync5(linked.path);
+        inside = realpathSync6(repoToplevel(appDir)) === realpathSync6(linked.path);
       } catch {
         inside = false;
       }
@@ -11483,7 +11560,7 @@ function inferWorkspaceId(appDir, explicit) {
   const id = explicit?.trim() || workspaceIdFromBranch(currentBranch(appDir));
   if (!id) {
     throw new Refusal(
-      'Not inside a workspace worktree (the branch is not ws/<id>). Pass the workspace id, or create one with `deepspace workspace new -t "\u2026"`.',
+      'Not inside a workspace worktree (the branch is not ws/<id>). Select one with `-w ws_\u2026` (for `workspace drop`, pass the id as the argument), or create one with `deepspace workspace new -t "\u2026"`.',
       "not_in_workspace"
     );
   }
@@ -11492,17 +11569,28 @@ function inferWorkspaceId(appDir, explicit) {
   }
   return id;
 }
+function workspaceNotActiveRefusal(id, status3, dropAction) {
+  return new Refusal(
+    `Workspace ${id} is already ${status3}.` + (dropAction ? " This checkout is a leftover \u2014 `deepspace workspace drop` cleans it up." : ""),
+    "workspace_not_active",
+    {
+      ...dropAction ? { action: dropAction } : {},
+      extra: { workspaceId: id, status: status3 }
+    }
+  );
+}
 function assertSelectedWorkspaceCheckout(appDir, id, resumeArgv) {
   const branch = currentBranch(appDir);
   if (isSelectedWorkspaceCheckout(branch, id)) return;
   const worktree = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-  const action = worktree ? { cwd: worktree, argv: resumeArgv } : { cwd: appDir, argv: ["deepspace", "workspace", "attach", id] };
+  const worktreeAppDir = worktree ? appDirInWorktree(appDir, worktree) : null;
+  const action = worktreeAppDir ? { cwd: worktreeAppDir, argv: resumeArgv } : { cwd: appDir, argv: ["deepspace", "workspace", "attach", id] };
   throw new Refusal(
-    `Workspace ${id} is not checked out here (current branch: ${branch ?? "detached"}). ` + (worktree ? `Run this command from its checkout at ${worktree}.` : "Attach it in this clone before mutating its published line."),
+    `Workspace ${id} is not checked out here (current branch: ${branch ?? "detached"}). ` + (worktreeAppDir ? `Run this command from its checkout at ${worktreeAppDir}.` : "Attach it in this clone before mutating its published line."),
     "workspace_checkout_mismatch",
     {
       action,
-      extra: worktree ? { workspaceDir: worktree } : void 0
+      extra: worktreeAppDir ? { workspaceDir: worktreeAppDir } : void 0
     }
   );
 }
@@ -11526,10 +11614,11 @@ function pushWorkspaceRef(appDir, token, ref, headOid) {
   if (push.status === "committed" || push.status === "up_to_date") return;
   if (push.status === "ref_conflict" || push.status === "non_fast_forward") {
     throw new Refusal(
-      `Another checkout advanced this workspace's line, so publishing yours is not a fast-forward \u2014 the push was refused rather than drop that work. Integrate its tip (\`git pull ${SPACE_REMOTE} ${ref}\`, or re-attach the workspace in a fresh dir), resolve any conflicts, then re-run the command. (Amended or rebased your own commits? Same refusal \u2014 merge your old tip back in.)`,
+      `Another checkout advanced this workspace's line, so publishing yours is not a fast-forward \u2014 the push was refused rather than drop that work. Integrate its tip (\`git pull --no-rebase ${SPACE_REMOTE} ${ref}\`, or re-attach the workspace in a fresh dir), resolve any conflicts, then re-run the command. (Amended or rebased your own commits? Same refusal \u2014 merge your old tip back in.)`,
       push.status,
       {
-        action: { cwd: appDir, argv: ["git", "pull", SPACE_REMOTE, ref] }
+        actionRequired: true,
+        action: { cwd: appDir, argv: ["git", "pull", "--no-rebase", SPACE_REMOTE, ref] }
       }
     );
   }
@@ -11585,6 +11674,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
     );
     spinner2?.message("Creating workspace\u2026");
     ensureSpaceRemote(appDir, appId);
+    ensureGitIdentity(appDir, token);
     let baseOid = null;
     const refs = await api4.getRefs();
     if (baseArg) {
@@ -11628,7 +11718,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve17(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve18(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
     const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
@@ -11666,8 +11756,18 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 
 // src/cli/commands/workspace/attach.ts
 import * as p26 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, resolve as resolve18 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync7, realpathSync as realpathSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve19 } from "path";
+function samePath(a, b) {
+  const real = (p35) => {
+    try {
+      return realpathSync7(p35);
+    } catch {
+      return resolve19(p35);
+    }
+  };
+  return real(a) === real(b);
+}
 function finishedWorkspaceMessage(id, view) {
   const workspace = view.workspace;
   if (workspace.status === "landed") {
@@ -11736,6 +11836,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         });
       }
       ensureSpaceRemote(appDir, appId2);
+      ensureGitIdentity(appDir, token2);
       const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(appDir, token2, [
         "fetch",
@@ -11752,11 +11853,87 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve18(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve19(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
       const dir2 = appDirInWorktree(appDir, worktreeRoot);
-      if (resolveCommit(appDir, `refs/heads/${branch}`)) {
+      const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
+      if (localTip) {
+        let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
+        if (existing && !existsSync25(existing)) {
+          runGit(appDir, ["worktree", "prune"], { allowFail: true });
+          existing = null;
+        }
+        const relation = workspaceSyncRelation(appDir, localTip, tip2);
+        const inSync = relation === "in_sync";
+        const behindOrDiverged = relation === "behind" || relation === "diverged";
+        const syncAdvice = behindOrDiverged ? `integrate the published tip first (\`git pull --no-rebase ${SPACE_REMOTE} ${view2.workspace.ref}\`)` : `run \`deepspace workspace sync\` from it`;
+        const syncAction = (cwd) => behindOrDiverged ? { cwd, argv: ["git", "pull", "--no-rebase", SPACE_REMOTE, view2.workspace.ref] } : { cwd, argv: ["deepspace", "workspace", "sync"] };
+        if (existing && (!requestedDir || samePath(existing, worktreeRoot))) {
+          const existingDir = appDirInWorktree(appDir, existing);
+          spinner2?.stop(`Already attached: ${id}.`);
+          if (!args.json) {
+            p26.log.info(`Task: ${view2.workspace.task}`);
+            p26.log.info(`Work in: cd ${existingDir}`);
+            if (!inSync) {
+              p26.log.warn(
+                `The checkout is at ${localTip.slice(0, 10)} but the workspace's published tip is ${tip2.slice(0, 10)} \u2014 ${syncAdvice}.`
+              );
+            }
+          }
+          return {
+            data: {
+              workspaceId: id,
+              mode: "worktree",
+              dir: existingDir,
+              worktreeRoot: existing,
+              branch,
+              tipOid: localTip,
+              remoteTip: tip2,
+              syncRelation: relation,
+              task: view2.workspace.task,
+              alreadyAttached: true
+            },
+            ...inSync ? {} : { action: syncAction(existingDir) }
+          };
+        }
+        if (!existing) {
+          const failure = rematerializeWorkspaceWorktree(appDir, worktreeRoot, branch, id);
+          if (failure) {
+            spinner2?.stop("Branch exists.");
+            throw new Refusal(
+              `Branch ${branch} exists locally with no worktree, and re-materializing it failed: ${failure}. Inspect it (\`git log ${branch}\`) and check it out yourself.`,
+              "branch_exists"
+            );
+          }
+          spinner2?.stop(`Re-attached ${id}.`);
+          if (!args.json) {
+            p26.log.info(`Task: ${view2.workspace.task}`);
+            p26.log.info(`Work in: cd ${dir2}`);
+            if (!inSync) {
+              p26.log.warn(
+                `The re-materialized checkout is at ${localTip.slice(0, 10)} but the workspace's published tip is ${tip2.slice(0, 10)} \u2014 after installing, ${syncAdvice}.`
+              );
+            }
+          }
+          const action3 = { cwd: dir2, argv: [detectPackageManager(dir2), "install"] };
+          return {
+            data: {
+              workspaceId: id,
+              mode: "worktree",
+              dir: dir2,
+              worktreeRoot,
+              branch,
+              tipOid: localTip,
+              remoteTip: tip2,
+              syncRelation: relation,
+              task: view2.workspace.task,
+              rematerialized: true
+            },
+            action: action3
+          };
+        }
+        spinner2?.stop("Branch exists.");
         throw new Refusal(
-          `Branch ${branch} already exists locally (this workspace has a worktree here). Find it with \`git worktree list\` and continue there.`,
+          `Workspace ${id} is already checked out at ${existing} \u2014 continue there (or drop that worktree before attaching it elsewhere).`,
           "branch_exists"
         );
       }
@@ -11775,6 +11952,10 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
           worktreeRoot,
           branch,
           tipOid: tip2,
+          remoteTip: tip2,
+          // Freshly materialized at the published tip — trivially in sync;
+          // every attach outcome carries the same shape.
+          syncRelation: "in_sync",
           task: view2.workspace.task
         },
         action: action2
@@ -11791,7 +11972,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         extra: { status: view.workspace.status }
       });
     }
-    const dir = resolve18(
+    const dir = resolve19(
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
@@ -11810,6 +11991,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     try {
       runGit(process.cwd(), ["init", "--quiet", dir]);
       ensureSpaceRemote(dir, appId);
+      ensureGitIdentity(dir, token);
       const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(dir, token, [
         "fetch",
@@ -11846,6 +12028,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         dir,
         branch,
         tipOid: tip,
+        remoteTip: tip,
+        syncRelation: "in_sync",
         task: view.workspace.task
       },
       action
@@ -11878,7 +12062,19 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
       typeof args.app === "string" ? args.app : void 0
     );
     const id = inferWorkspaceId(appDir, workspaceArg);
-    assertSelectedWorkspaceCheckout(appDir, id, ["deepspace", "workspace", "sync"]);
+    try {
+      assertSelectedWorkspaceCheckout(appDir, id, ["deepspace", "workspace", "sync"]);
+    } catch (mismatch) {
+      const current = await api4.getWorkspace(id).then((r) => r.view).catch(() => null);
+      if (current && current.workspace.status !== "active") {
+        spinner2?.stop("Workspace finished.");
+        throw workspaceNotActiveRefusal(id, current.workspace.status, {
+          cwd: appDir,
+          argv: ["deepspace", "workspace", "drop", id, "--app", appId]
+        });
+      }
+      throw mismatch;
+    }
     const headOid = resolveCommit(appDir, "HEAD");
     if (!headOid) {
       throw new Refusal("The workspace has no commits yet \u2014 commit first, then sync.", "no_commits");
@@ -11897,6 +12093,7 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     ensureSpaceRemote(appDir, appId);
+    ensureGitIdentity(appDir, token);
     pushWorkspaceRef(appDir, token, before.workspace.ref, headOid);
     try {
       fetchTrunk(appDir, token, refs?.head ?? null);
@@ -12037,6 +12234,7 @@ var workspaceStatusCommand = defineDeepspaceCommand({
     const aheadExact = headOid && baseLocal ? revListCount(appDir, workspace.baseOid, headOid) : null;
     const unsynced = headOid !== null && view.tipOid !== headOid;
     const dirty = workspaceDir ? statusFiles(workspaceDir) : [];
+    const relation = !unsynced ? "in_sync" : workspace.status !== "active" || !workspaceDir ? "unknown" : workspaceSyncRelation(workspaceDir, headOid, view.tipOid);
     const lines = await loadWorkspaceLines(appDir, token, api4, trunkOid);
     const myTip = headOid ?? resolveCommit(appDir, peerWorkspaceRef(id)) ?? view.tipOid;
     const line = myTip ? lineChangedPaths(appDir, workspace.baseOid, myTip, trunkOid) : null;
@@ -12056,6 +12254,10 @@ var workspaceStatusCommand = defineDeepspaceCommand({
       ...attached ? {
         headOid,
         unsynced,
+        // The human line distinguishes behind/diverged/ahead; the machine
+        // mirror must too, or a JSON caller can't tell a fast-forward from
+        // a real divergence.
+        syncRelation: relation,
         uncommitted: dirty,
         trunkOverlap
       } : {},
@@ -12071,10 +12273,29 @@ var workspaceStatusCommand = defineDeepspaceCommand({
           `Not checked out in this clone \u2014 showing the published state (local HEAD/uncommitted unavailable). Attach it with \`deepspace workspace attach ${id} <dir>\`.`
         );
       }
-      if (unsynced)
-        p29.log.warn(
-          `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
-        );
+      if (unsynced) {
+        if (workspace.status === "landed") {
+          p29.log.info(
+            `Already landed${workspace.landedOid ? ` at ${workspace.landedOid.slice(0, 10)}` : ""} \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
+          );
+        } else if (workspace.status === "dropped") {
+          p29.log.info(
+            `Already dropped \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
+          );
+        } else if (relation === "behind") {
+          p29.log.warn(
+            `Local HEAD ${headOid?.slice(0, 10)} is BEHIND the published tip ${view.tipOid?.slice(0, 10)} (another checkout synced ahead) \u2014 fast-forward first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`).`
+          );
+        } else if (relation === "diverged") {
+          p29.log.warn(
+            `Local HEAD ${headOid?.slice(0, 10)} has DIVERGED from the published tip ${view.tipOid?.slice(0, 10)} \u2014 integrate it first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`), then \`deepspace workspace sync\`.`
+          );
+        } else {
+          p29.log.warn(
+            `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
+          );
+        }
+      }
       if (dirty.length > 0) p29.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
       if (trunkOverlap.length > 0) {
         p29.log.warn(
@@ -12092,13 +12313,13 @@ import * as p30 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync27 } from "fs";
+import { readFileSync as readFileSync28 } from "fs";
 import { join as join23 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync27(join23(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync28(join23(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -12128,6 +12349,14 @@ ${res.stderr?.toString("utf-8") ?? ""}`.trim();
 function hasLeftoverConflictMarkers(diffCheckOutput) {
   return /leftover conflict marker/.test(diffCheckOutput);
 }
+function conflictMarkerFiles(diffCheckOutput) {
+  const files = /* @__PURE__ */ new Set();
+  for (const line of diffCheckOutput.split("\n")) {
+    const match = /^(.+?):\d+: leftover conflict marker/.exec(line);
+    if (match) files.add(match[1]);
+  }
+  return [...files];
+}
 function landResumeArgv(args) {
   const argv = ["deepspace", "workspace", "land"];
   const workspace = args.workspace?.trim();
@@ -12193,7 +12422,20 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     });
     const recoveryAction = { cwd: appDir, argv: resumeArgv };
     const resumeNext = humanCommand(resumeArgv);
-    assertSelectedWorkspaceCheckout(appDir, id, resumeArgv);
+    const dropAction = {
+      cwd: appDir,
+      argv: ["deepspace", "workspace", "drop", id, "--app", appId]
+    };
+    try {
+      assertSelectedWorkspaceCheckout(appDir, id, resumeArgv);
+    } catch (mismatch) {
+      const current = await api4.getWorkspace(id).then((r) => r.view).catch(() => null);
+      if (current && current.workspace.status !== "active") {
+        spinner2?.stop("Workspace finished.");
+        throw workspaceNotActiveRefusal(id, current.workspace.status, dropAction);
+      }
+      throw mismatch;
+    }
     const headBefore = resolveCommit(appDir, "HEAD");
     if (!headBefore) {
       throw new Refusal("The workspace has no commits \u2014 nothing to land.", "no_commits");
@@ -12209,13 +12451,10 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     const [{ view }, refs] = await Promise.all([api4.getWorkspace(id), api4.getRefs()]);
     if (view.workspace.status !== "active") {
       spinner2?.stop("Workspace finished.");
-      throw new Refusal(
-        `Workspace ${id} is already ${view.workspace.status}.`,
-        "workspace_not_active",
-        { extra: { status: view.workspace.status } }
-      );
+      throw workspaceNotActiveRefusal(id, view.workspace.status, dropAction);
     }
     ensureSpaceRemote(appDir, appId);
+    ensureGitIdentity(appDir, token);
     const isResumedMerge = resolveCommit(appDir, "HEAD^2") !== null && view.tipOid !== null && resolveCommit(appDir, "HEAD^") === view.tipOid;
     if (!isResumedMerge) {
       pushWorkspaceRef(appDir, token, view.workspace.ref, headBefore);
@@ -12262,6 +12501,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           "merge_conflict",
           {
             actionRequired: true,
+            action: recoveryAction,
             extra: { workspaceId: id, conflict: true }
           }
         );
@@ -12271,14 +12511,17 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       const markerCheck = runGit(appDir, ["diff", "--check", "HEAD^", "HEAD"], {
         allowFail: true
       });
-      if (hasLeftoverConflictMarkers(markerCheck.stdout.toString("utf-8"))) {
+      const markerOutput = markerCheck.stdout.toString("utf-8");
+      if (hasLeftoverConflictMarkers(markerOutput)) {
+        const files = conflictMarkerFiles(markerOutput);
         spinner2?.stop("Conflict markers in merge.");
         throw new Refusal(
-          `The merge commit still contains unresolved conflict markers (<<<<<<< / ======= / >>>>>>>). Fix the marked files, commit the correction, then re-run \`${resumeNext}\`. Nothing was pushed to ${intoBranch}.`,
+          `The merge commit still contains unresolved conflict markers (<<<<<<< / ======= / >>>>>>>)${files.length ? ` in ${files.join(", ")}` : ""}. Fix the marked files, commit the correction, then re-run \`${resumeNext}\`. Nothing was pushed to ${intoBranch}.`,
           "conflict_markers",
           {
             actionRequired: true,
-            extra: { workspaceId: id, conflict: true }
+            action: recoveryAction,
+            extra: { workspaceId: id, conflict: true, ...files.length ? { files } : {} }
           }
         );
       }
@@ -12312,6 +12555,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           "validation_failed",
           {
             actionRequired: true,
+            action: recoveryAction,
             extra: { workspaceId: id, passed: false, outputTail }
           }
         );
@@ -12323,6 +12567,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
           "validation_mutated_tree",
           {
             actionRequired: true,
+            action: recoveryAction,
             extra: { workspaceId: id }
           }
         );
@@ -12358,7 +12603,37 @@ var landWorkspaceCommand = defineDeepspaceCommand({
         "push_rejected"
       );
     }
-    await api4.landWorkspace(id, { landedOid, intoRef });
+    try {
+      await api4.landWorkspace(id, { landedOid, intoRef });
+    } catch (err) {
+      const code = errorCode(err);
+      if (code === "workspace_not_active") {
+        const status3 = await api4.getWorkspace(id).then((r) => r.view.workspace.status).catch(() => null);
+        if (status3 && status3 !== "active") {
+          spinner2?.stop("Workspace finished.");
+          throw new Refusal(
+            `${intoBranch} took the land push (${landedOid.slice(0, 10)}), and the workspace is already ${status3} \u2014 a concurrent land or drop finished first, so there is nothing left to record. This checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`,
+            "workspace_not_active",
+            {
+              actionRequired: true,
+              action: dropAction,
+              extra: { workspaceId: id, into: intoBranch, landedOid, pushed: true, status: status3 }
+            }
+          );
+        }
+      }
+      spinner2?.stop("Landed; not recorded.");
+      const detail = err instanceof Error ? err.message : String(err);
+      throw new Refusal(
+        `The land push succeeded (${intoBranch} was at ${landedOid.slice(0, 10)}), but recording the land failed (${detail}). Resolve that, then re-run \`${resumeNext}\` \u2014 it re-checks the merge (a no-op when already pushed) and records it.`,
+        "land_unrecorded",
+        {
+          actionRequired: true,
+          action: recoveryAction,
+          extra: { workspaceId: id, into: intoBranch, landedOid, pushed: true }
+        }
+      );
+    }
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch, { expectedBranchOid: landedOid });
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
@@ -12403,6 +12678,22 @@ function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
   );
 }
 function workspaceUnsyncedRefusal(args) {
+  const dropKeepArgv = [
+    "deepspace",
+    "workspace",
+    "drop",
+    args.id,
+    "--app",
+    args.appId,
+    "--keep-worktree"
+  ];
+  if (args.status !== "active") {
+    return new Refusal(
+      `${args.id} is already ${args.status} on the server, and this checkout has committed work that was never published \u2014 nothing can publish it now. Keep it with \`${humanCommand(dropKeepArgv)}\` (retains the branch/worktree for manual disposal), or delete the branch yourself. Nothing was dropped.`,
+      "workspace_unsynced",
+      { extra: { workspaceId: args.id, status: args.status } }
+    );
+  }
   const syncArgv = ["deepspace", "workspace", "sync", "--app", args.appId, "--workspace", args.id];
   const dropArgv = ["deepspace", "workspace", "drop", args.id, "--app", args.appId];
   const publish = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
@@ -12410,11 +12701,25 @@ function workspaceUnsyncedRefusal(args) {
     `${args.id} has committed work that isn't published yet. ${publish} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
     "workspace_unsynced",
     {
+      // Exit 1 with an unblock action, deliberately: drop is destructive and
+      // refusing it is a hard stop, not the "your turn" hand-off exit 2 means.
       ...args.workspaceDir ? { action: { cwd: args.workspaceDir, argv: syncArgv } } : {},
-      extra: { workspaceId: args.id }
+      extra: { workspaceId: args.id, status: args.status }
     }
   );
 }
+async function dropRemoteTolerant(api4, id, statusBefore) {
+  try {
+    const view = (await api4.dropWorkspace(id)).view;
+    return { view, remoteDropped: statusBefore === "active" && view.workspace.status === "dropped" };
+  } catch (err) {
+    const code = errorCode(err);
+    if (code !== "workspace_not_active") throw err;
+    const current = await api4.getWorkspace(id).catch(() => null);
+    if (!current || current.view.workspace.status === "active") throw err;
+    return { view: current.view, remoteDropped: false };
+  }
+}
 var dropWorkspaceCommand = defineDeepspaceCommand({
   meta: { name: "drop", description: "Abandon a workspace (ref retained briefly, then GC)" },
   args: {
@@ -12439,32 +12744,47 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     spinner2?.start(`Preparing to drop ${explicitId ?? "workspace"}\u2026`);
     if (!findAppDir() && explicitId) {
       const { api: api5 } = await resolveApiOnly(appArg);
-      const { view: view2 } = await api5.dropWorkspace(explicitId);
+      const statusBefore = (await api5.getWorkspace(explicitId)).view.workspace.status;
+      const { view: view2, remoteDropped: remoteDropped2 } = await dropRemoteTolerant(api5, explicitId, statusBefore);
       spinner2?.stop();
       if (!args.json) {
         p31.log.success(
-          `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.`
+          remoteDropped2 ? `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${explicitId} was already ${view2.workspace.status} on the server \u2014 nothing to drop remotely.`
         );
       }
-      return { data: { workspaceId: explicitId, status: view2.workspace.status } };
+      return { data: { workspaceId: explicitId, status: view2.workspace.status, remoteDropped: remoteDropped2 } };
     }
-    const { appDir, appId, api: api4 } = await resolveTarget2(appArg);
+    const { appDir, appId, token, api: api4 } = await resolveTarget2(appArg);
     const id = inferWorkspaceId(appDir, explicitId);
     const inspection = inspectWorkspaceCleanup(appDir, id);
     let approvedBranchOid;
+    const { view: before } = await api4.getWorkspace(id);
     if (!keepWorktree && inspection.willDeleteBranch && inspection.branchOid) {
-      const { view: before } = await api4.getWorkspace(id);
       const publishedOids = [
         before.tipOid,
         before.workspace.landedOid,
         before.workspace.baseOid
       ].filter((oid) => oid !== null);
-      if (!isWorkspaceTipPublished(appDir, inspection.branchOid, publishedOids)) {
+      let published = isWorkspaceTipPublished(appDir, inspection.branchOid, publishedOids);
+      if (!published && before.workspace.status !== "active") {
+        ensureSpaceRemote(appDir, appId);
+        const refs = await api4.getRefs();
+        const trunkRef = refs?.head?.startsWith("refs/heads/") ? refs.head : null;
+        if (trunkRef) {
+          runGitRemote(appDir, token, ["fetch", "--quiet", "--refmap=", SPACE_REMOTE, trunkRef], {
+            allowFail: true
+          });
+          const trunkTip = resolveCommit(appDir, "FETCH_HEAD");
+          published = trunkTip !== null && isWorkspaceTipPublished(appDir, inspection.branchOid, [trunkTip]);
+        }
+      }
+      if (!published) {
         throw workspaceUnsyncedRefusal({
           appId,
           id,
           branch: inspection.branch,
-          workspaceDir: inspection.checkout.dir
+          workspaceDir: inspection.checkout.dir,
+          status: before.workspace.status
         });
       }
       approvedBranchOid = inspection.branchOid;
@@ -12479,7 +12799,7 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
         { extra: { workspaceId: id } }
       );
     }
-    const { view } = await api4.dropWorkspace(id);
+    const { view, remoteDropped } = await dropRemoteTolerant(api4, id, before.workspace.status);
     spinner2?.message(`Cleaning up ${id} locally\u2026`);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, null, {
       expectedBranchOid: approvedBranchOid,
@@ -12489,12 +12809,15 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     const data = {
       workspaceId: id,
       status: view.workspace.status,
+      remoteDropped,
       ...retainedWorktree ? { worktree: retainedWorktree } : {},
       ...cleanup ? { cleanup: cleanupJson(cleanup) } : {}
     };
     spinner2?.stop();
     if (!args.json) {
-      p31.log.success(`Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.`);
+      p31.log.success(
+        remoteDropped ? `Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${id} was already ${view.workspace.status} on the server \u2014 nothing to drop remotely.`
+      );
       if (cleanup && !cleanup.error) reportCleanupHuman(cleanup);
       else if (retainedWorktree) p31.log.info(`Retained checkout: ${retainedWorktree}`);
     }
@@ -12563,7 +12886,7 @@ function formatEvent2(e, lands, actors) {
       detail = `"${String(s.task ?? "")}" from ${short(s.baseOid)}`;
       break;
     case "workspace.synced":
-      detail = `\u2192 ${short(s.headOid)} (${Number(s.files ?? 0)} files vs base)`;
+      detail = `\u2192 ${short(s.headOid)}`;
       break;
     case "workspace.landed":
       detail = `"${String(s.task ?? "")}" \u2192 ${short(s.landedOid)} on ${String(s.into ?? "trunk")}`;
@@ -13061,8 +13384,8 @@ function sameRefs(left, right) {
 
 // src/cli/commands/update.ts
 import * as p34 from "@clack/prompts";
-import { existsSync as existsSync26, readFileSync as readFileSync28, writeFileSync as writeFileSync10 } from "fs";
-import { join as join24, resolve as resolve19 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync29, writeFileSync as writeFileSync10 } from "fs";
+import { join as join24, resolve as resolve20 } from "path";
 var REGISTRY = "https://registry.npmjs.org/deepspace/latest";
 var DOCS_URL = "https://documentation.deep.space/cli-reference/commands";
 var OLDEST_SUPPORTED_MINOR = 12;
@@ -13078,17 +13401,17 @@ function gapIsTooWide(from, to) {
 function readAppSdkVersion(appDir) {
   const installed = join24(appDir, "node_modules", "deepspace", "package.json");
   if (existsSync26(installed)) {
-    const parsed2 = JSON.parse(readFileSync28(installed, "utf8"));
+    const parsed2 = JSON.parse(readFileSync29(installed, "utf8"));
     if (typeof parsed2.version === "string") return parsed2.version;
   }
   const manifest = join24(appDir, "package.json");
   if (!existsSync26(manifest)) return null;
-  const parsed = JSON.parse(readFileSync28(manifest, "utf8"));
+  const parsed = JSON.parse(readFileSync29(manifest, "utf8"));
   return parsed.dependencies?.deepspace ?? null;
 }
 function pinSdkVersion(appDir, version) {
   const path = join24(appDir, "package.json");
-  const source = readFileSync28(path, "utf8");
+  const source = readFileSync29(path, "utf8");
   const updated = source.replace(
     /("deepspace"\s*:\s*")[^"]+(")/,
     (_match, head, tail) => `${head}^${version}${tail}`
@@ -13153,7 +13476,7 @@ var update_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve19(".");
+    const appDir = resolve20(".");
     if (!hasWranglerConfig(appDir)) {
       throw new Refusal(
         "No wrangler.toml found \u2014 run this from inside a DeepSpace app directory.",
@@ -13233,8 +13556,8 @@ var update_default = defineDeepspaceCommand({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync29(join25(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname11(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync30(join25(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync27("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
@@ -13361,7 +13684,9 @@ function assertKnownCommandPath(argv) {
     `${unknownCommandMessage(unknown)}
 Run \`${unknown.helpPath.join(" ")} --help\` for the command list.`
   );
-  if (unknown.executable) printAction({ cwd: process.cwd(), argv: unknown.suggestion });
+  if (unknown.executable) {
+    printAction(executableAction({ cwd: process.cwd(), argv: unknown.suggestion }));
+  }
   process.exit(1);
 }
 var rawArgs = process.argv.slice(2);
@@ -13383,7 +13708,7 @@ if (rawArgs.includes("--json") && !wantsHelp) {
         ok: false,
         code: "unknown_command",
         error: unknownCommandMessage(unknown),
-        ...unknown.executable ? { action: { cwd: process.cwd(), argv: unknown.suggestion } } : {}
+        ...unknown.executable ? { action: executableAction({ cwd: process.cwd(), argv: unknown.suggestion }) } : {}
       })
     );
     process.exit(1);