deepspace 0.24.1 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # deepspace
 
+## 0.25.0
+
+### Minor Changes
+
+- CLI and platform fixes ported from the reviews branch on their own. Behavior a script may notice: `secrets configs delete` now asks for confirmation (new — there was none) and `--json` requires `--yes`; `app create --json` refuses `invalid_flags` (it used to die on the scaffolder's own option parser with no envelope); `secrets get --plain --json` and `secrets download --json` refuse `invalid_flags`; `workspace drop` requires `--abandon-unseen` whenever this seat does not hold the workspace's published tip (no checkout, or the branch was never materialised locally) and reports `discardedTip`; a `-a <other-app>` from a checkout that declares a different app refuses `app_checkout_mismatch` instead of re-aiming the `space` remote; `push --force` is refused for a tip this checkout did not publish with `deepspace push` (the push record is written only when a push actually lands, no longer on `up_to_date`); a `push` refused for a committed secret no longer hands back a `git rm --cached` action and lists the `files`; a push transport failure carries `gitError`; every escaped refusal can now exit 2 with an `action` (`status`, `logs`, `secrets` included); `push` and `pull` configure a repo-local git identity when the checkout has none (they hand back committing recoveries); `logs` bounded output's `meta` frame gains `appId`/`retentionDays`; `workspace list --json` gains `truncated`; `workspace land --json` gains `localTrunkBehind` and its pull action names the branch and app; `workspace sync` on a finished workspace hands back a drop action; `secrets` validation refusals carry codes (`invalid_config_name`, `invalid_secret_name`, `reserved_secret_name`, `secret_too_large`, `invalid_format`). Fixes: `secrets` refusals render through the one CLI renderer (`configs delete` confirms and takes `--yes`; `get --plain --json` and `download --json` refuse `invalid_flags`; piped stdin reads asynchronously; upload file errors carry `file_not_found`/`file_unreadable`); `push` no longer records a fast-forwarded peer commit as your own last push (which let a later `--force` drop it), distinguishes strictly-behind from diverged, offers `--force` only for a rewrite of your own line, scans the whole push range for secret files (and stops handing back a `git rm --cached` action that never resolved the refusal), and codes `push_too_large`/`repo_full`; `status` reports `loggedIn` from either credential and a `sessionError` instead of asserting an identity off an expired token; `workspace status`/`list`/`drop`/`land`/`sync` classify sync by ancestry (a strictly-behind checkout is no longer "healthy"), fetch the published tip when it is absent, mark truncated lists, prune phantom worktrees, refuse to drop unseen commits (`workspace_behind`, `--abandon-unseen`), and name the checkout that should pull after a land; `logs --follow --json` opens with a `ready` record; every refusal envelope carries its code and action from one renderer; a vanished cwd is `worktree_missing`; command suggestions understand transpositions and aliases and never carry flag values into `action.argv`; `deepspace` refuses to re-aim the `space` remote at a different app than the checkout declares, and configures a repo-local git identity in that one place; peer-authored text (refs, tasks, log lines) is neutralised at the constructors that render it. Platform: annotated tags resolve in the code browser and history, the activity cursor can no longer park past the tail, `isAncestor` walks first parents first, workspace tasks are validated by code point, and `listWorkspaces` reports truncation.
+- Push refusals are structured end to end. The cloud repo now prefixes every `ng <ref> <reason>` line with a machine code (`<code>: <sentence>[ — <detail>]`) from one table — `push_too_large`, `repo_full`, `secret_committed`, `stale_ref`, `missing_objects`, `thin_pack`, `not_attempted`, `bad_tip`, `funny_refname`, `internal_ref`, `workspace_creator`, `unpacker_error`, `push_failed` — a busy repo is still an HTTP 503 with `Retry-After`, not an `ng` line — so `deepspace push`, `workspace sync`, and `workspace land` classify a refusal by its code instead of matching the server's prose. Every prose regex in the CLI is gone; an atomic push's `not_attempted` siblings no longer mask the real refusal; the CLI names the committed secret files the server reports; new `--json` slugs `missing_objects`, `thin_pack`, `funny_refname`, `internal_ref`, `bad_tip`, `unpacker_error`, `workspace_creator`. Rollout: a new CLI against an older worker sees untagged reasons and reports them as `rejected` with the server's own sentence; an OLDER CLI against the new worker loses its automatic `--no-thin` retry and its oversized-blob naming until upgraded — the refusal sentence itself still says what to do (`git push --no-thin`, remove or LFS the object). Plain `git push` still receives its refusals in-band on the `ng` line; the sentences are reworded (`stale ref, fetch first`; `not attempted, the push is atomic and another ref was refused`; the size figures move into the detail) and now carry the leading code.
+
+### Patch Changes
+
+- Raise the hono floor to ^4.12.34, the minimum release carrying the fixes for the 2026 hono security advisories (CORS credential reflection, bodyLimit bypass, cookie-name validation, and related middleware issues), in the SDK's dependencies and the scaffold template.
+
 ## 0.24.1
 
 ### Patch Changes

package/dist/{chunk-6RQ4GDEH.js → chunk-2GUGZLAX.js}

@@ -1274,7 +1274,7 @@ function renderInlineMarkdown(value) {
 import { useEffect as useEffect6, useRef as useRef5, useState as useState5 } from "react";
 
 // package.json
-var version = "0.24.1";
+var version = "0.25.0";
 
 // src/documentation/runtime/navigation.tsx
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
@@ -1954,4 +1954,4 @@ export {
   DefaultDocumentation,
   DocumentationContent
 };
-//# sourceMappingURL=chunk-6RQ4GDEH.js.map
+//# sourceMappingURL=chunk-2GUGZLAX.js.map