deepspace 0.24.1 → 0.25.0

package/dist/cli.js

@@ -8,12 +8,43 @@ import {
   renderUsage
 } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync27, existsSync as existsSync29 } from "fs";
+import { readFileSync as readFileSync27, existsSync as existsSync30 } from "fs";
 import { dirname as dirname13, join as join29 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
 import * as p from "@clack/prompts";
+
+// src/cli/lib/cli-format.ts
+var ANSI_RE = /\[[0-9;]*m/g;
+function stripAnsi(s) {
+  return s.replace(ANSI_RE, "");
+}
+function forTerminal(s) {
+  return process.stdout.isTTY ? s : stripAnsi(s);
+}
+function shQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function humanCommand(argv) {
+  return argv.map((arg) => /^[A-Za-z0-9_./=:@-]+$/.test(arg) ? arg : shQuote(arg)).join(" ");
+}
+function displayText(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, (ch) => {
+    if (ch === "	") return "    ";
+    const code = ch.codePointAt(0);
+    return `\\x${code.toString(16).padStart(2, "0")}`;
+  }).replace(/[\p{Cf}\p{Zl}\p{Zp}]/gu, (ch) => {
+    if (ch === "\u200C" || ch === "\u200D") return ch;
+    const code = ch.codePointAt(0);
+    return `\\u{${code.toString(16)}}`;
+  });
+}
+function displayLines(value) {
+  return value.split("\n").map((line) => displayText(line)).join("\n");
+}
+
+// src/cli/lib/spinner.ts
 var activeSpinner = null;
 function createSpinner() {
   const impl = process.stdout.isTTY ? p.spinner() : {
@@ -30,13 +61,13 @@ function createSpinner() {
   const wrapper = {
     start: (msg) => {
       activeSpinner = wrapper;
-      impl.start(msg);
+      impl.start(msg === void 0 ? msg : displayLines(msg));
     },
     stop: (msg) => {
-      impl.stop(msg);
+      impl.stop(msg === void 0 ? msg : displayLines(msg));
       if (activeSpinner === wrapper) activeSpinner = null;
     },
-    message: (msg) => impl.message(msg)
+    message: (msg) => impl.message(msg === void 0 ? msg : displayLines(msg))
   };
   return wrapper;
 }
@@ -48,23 +79,6 @@ function stopActiveSpinner() {
 import * as p2 from "@clack/prompts";
 import { readFileSync, realpathSync } from "fs";
 import { dirname, isAbsolute, resolve } from "path";
-
-// src/cli/lib/cli-format.ts
-var ANSI_RE = /\[[0-9;]*m/g;
-function stripAnsi(s) {
-  return s.replace(ANSI_RE, "");
-}
-function forTerminal(s) {
-  return process.stdout.isTTY ? s : stripAnsi(s);
-}
-function shQuote(s) {
-  return `'${s.replace(/'/g, "'\\''")}'`;
-}
-function humanCommand(argv) {
-  return argv.map((arg) => /^[A-Za-z0-9_./=:@-]+$/.test(arg) ? arg : shQuote(arg)).join(" ");
-}
-
-// src/cli/lib/output.ts
 function resolveActionArgv(argv, cwd) {
   if (argv[0] !== "deepspace") return argv;
   const entry = (cwd ? installedCliEntry(cwd) : null) ?? cliEntryPath();
@@ -122,9 +136,10 @@ function withSlug(msg, code) {
   return msg.trimEnd().endsWith(tag) ? msg : `${msg.trimEnd()} ${tag}`;
 }
 function displayArg(arg) {
-  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(arg)) return arg;
-  if (process.platform === "win32") return `"${arg.replaceAll('"', '""')}"`;
-  return shQuote(arg);
+  const safe = displayText(arg);
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(safe)) return safe;
+  if (process.platform === "win32") return `"${safe.replaceAll('"', '""')}"`;
+  return shQuote(safe);
 }
 function printAction(action) {
   assertExecutableAction(action);
@@ -171,7 +186,7 @@ async function fetchWithTransientRetry(url, makeInit, {
 // src/cli/lib/api.ts
 var ApiError = class extends Error {
   constructor(message, status3, code, apiPath, details) {
-    super(message);
+    super(displayLines(message));
     this.status = status3;
     this.code = code;
     this.apiPath = apiPath;
@@ -232,7 +247,7 @@ async function apiFetch(baseUrl, token, path, init, isRetry = false) {
       }
     } catch {
     }
-    if (!code && res.status === 404 && text2.trim() === "Not found") {
+    if (!code && res.status === 404 && msg.trim() === "Not found") {
       code = "unrecognized_service";
       msg = `The deploy service at ${baseUrl} doesn't recognize this request \u2014 check DEEPSPACE_DEPLOY_URL (is this the service the app lives on?); if it is, the server may be older than this CLI.`;
     }
@@ -286,17 +301,23 @@ function isTransientFailure(error) {
 // src/cli/lib/cli-errors.ts
 var InputError = class extends Error {
   constructor(message, code) {
-    super(message);
+    super(displayLines(message));
     this.code = code;
   }
 };
+function isMissingCwdError(err) {
+  if (!(err instanceof Error)) return false;
+  const errno = err;
+  if (errno.code !== "ENOENT") return false;
+  return errno.syscall === "uv_cwd";
+}
 var Refusal = class extends Error {
   code;
   action;
   actionRequired;
   extra;
   constructor(message, code, opts = {}) {
-    super(message);
+    super(displayLines(message));
     this.name = "Refusal";
     this.code = code;
     this.action = opts.action ? executableAction(opts.action) : void 0;
@@ -338,6 +359,7 @@ var CliExit = class extends Error {
 };
 function errorCode(err) {
   if (err instanceof ApiError || err instanceof InputError || err instanceof Refusal) return err.code;
+  if (isMissingCwdError(err)) return "worktree_missing";
   if (err instanceof Error && err.name === "GitError") return err.code ?? "git_error";
   if (err instanceof Error && err.name === "WranglerConfigError")
     return err.code ?? "invalid_config";
@@ -356,6 +378,10 @@ var API_ERROR_HINTS = {
   invite_email_failed: "The invite itself was not created and the charge was voided \u2014 nothing to undo. Retrying helps only if the send was transient; check the address is real and deliverable first. An email is needed ONLY for someone with no DeepSpace account yet: an existing user is added instantly, so having them sign in once and re-running this skips email entirely. If a retry now reports `already_invited` with no email sent, cancel the stuck invite (`deepspace app collaborators cancel <email>`) and invite again."
 };
 function formatCliError(err) {
+  if (isMissingCwdError(err)) {
+    const pwd = process.env.PWD;
+    return `The directory this command was run from no longer exists${pwd ? ` (${pwd})` : ""} \u2014 it was deleted or moved while the shell was still in it. Move somewhere that exists (\`cd\` to the main checkout). If it was a workspace worktree that a land, merge, or drop removed, \`deepspace workspace attach <ws_\u2026>\` re-materializes it there.`;
+  }
   const message = err instanceof Error ? err.message : String(err);
   const slug = errorCode(err);
   const hint = slug ? API_ERROR_HINTS[slug] : void 0;
@@ -363,11 +389,11 @@ function formatCliError(err) {
 ${hint}` : message;
 }
 function renderCliError(err) {
+  stopActiveSpinner();
   if (err instanceof CliExit) {
     process.exitCode = err.exitCode;
     return;
   }
-  stopActiveSpinner();
   const message = formatCliError(err);
   const slug = errorCode(err);
   if (process.argv.includes("--json")) {
@@ -529,6 +555,9 @@ function editDistance(a, b) {
         dp[i][j - 1] + 1,
         dp[i - 1][j - 1] + (left[i - 1] === right[j - 1] ? 0 : 1)
       );
+      if (i > 1 && j > 1 && left[i - 1] === right[j - 2] && left[i - 2] === right[j - 1]) {
+        dp[i][j] = Math.min(dp[i][j], dp[i - 2][j - 2] + 1);
+      }
     }
   }
   return dp[left.length][right.length];
@@ -548,15 +577,21 @@ function closestCommandPath(input, table) {
   );
   return ranked[0]?.path ?? null;
 }
+function takeLeadingPositionals(rest) {
+  const stop = rest.findIndex((token) => token.startsWith("-"));
+  return stop === -1 ? rest : rest.slice(0, stop);
+}
 function findUnknownCommand(argv, rootCommands) {
   let table = rootCommands;
   const accepted = [];
-  for (const token of argv) {
+  for (const [index, token] of argv.entries()) {
     if (!table || token.startsWith("-")) return null;
     const command = table[token];
     if (!command) {
+      const exactAll = commandPaths(table).filter((path) => path.at(-1) === token);
+      const exactHit = exactAll.length === 1 ? exactAll[0] : null;
       const split = splitTokenPath(token, table);
-      const relativeSuggestion = split ?? closestCommandPath(token, table);
+      const relativeSuggestion = exactHit ?? split ?? closestCommandPath(token, table);
       if (!relativeSuggestion) return null;
       const guessed = relativeSuggestion.at(-1) ?? "";
       return {
@@ -564,6 +599,11 @@ function findUnknownCommand(argv, rootCommands) {
         helpPath: ["deepspace", ...accepted],
         suggestion: ["deepspace", ...accepted, ...relativeSuggestion],
         executable: split !== null && !DESTRUCTIVE_VERBS.has(guessed),
+        // POSITIONALS ONLY. The remainder exists so the corrected verb keeps
+        // the arguments it needs; carrying flags too meant `auth logn --email
+        // a@b --password hunter2` echoed the password into `action.argv`, and
+        // agents persist envelopes. Cut at the first `-` token.
+        remainder: takeLeadingPositionals(argv.slice(index + 1)),
         ...split ? { quotedToken: true } : {}
       };
     }
@@ -1352,6 +1392,20 @@ function hasWranglerConfig(appDir) {
 }
 
 // src/cli/lib/app-identity.ts
+function declaredAppIds(cwd = process.cwd()) {
+  const appDir = resolve2(cwd);
+  if (!hasWranglerConfig(appDir)) return /* @__PURE__ */ new Set();
+  let cfg;
+  try {
+    cfg = readWranglerConfig(appDir);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+  const sections = [cfg.vars, ...Object.values(cfg.env ?? {}).map((env) => env?.vars)];
+  return new Set(
+    sections.map((vars) => vars?.DEEPSPACE_APP_ID).filter((id) => typeof id === "string" && APP_ID_RE.test(id))
+  );
+}
 var APP_ID_PLACEHOLDER = "__APP_ID__";
 function readAppId(cwd = process.cwd(), wranglerEnv) {
   const appDir = resolve2(cwd);
@@ -1437,7 +1491,7 @@ function findChildApps(dir) {
 
 // src/cli/lib/launch-config.ts
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   readFileSync as readFileSync7,
   realpathSync as realpathSync2,
   writeFileSync as writeFileSync4,
@@ -1448,16 +1502,17 @@ import {
 import { join as join6, resolve as resolve5, dirname as dirname5, basename, isAbsolute as isAbsolute2, sep } from "path";
 
 // src/cli/lib/git/repository.ts
-import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
 import { dirname as dirname4, join as join5, resolve as resolve4 } from "path";
 
 // src/cli/lib/git/process.ts
 import { sync as spawnSync } from "cross-spawn";
+import { existsSync as existsSync6 } from "fs";
 var MAX_GIT_BUFFER = 512 * 1024 * 1024;
 var GIT_TIMEOUT_MS = 3e5;
 var GitError = class extends Error {
   constructor(message, code) {
-    super(message);
+    super(displayLines(message));
     this.code = code;
     this.name = "GitError";
   }
@@ -1489,7 +1544,13 @@ function runGit(cwd, args, opts = {}) {
   }
   if (result.error) {
     const code = result.error.code;
-    if (code === "ENOENT") {
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      if (code === "ENOTDIR" || !existsSync6(cwd)) {
+        throw new GitError(
+          `The directory this command runs in is not there: ${cwd}. If it was a workspace worktree, prune it (\`git worktree prune\`) and re-attach.`,
+          "worktree_missing"
+        );
+      }
       throw new GitError(
         "git is not installed or not on PATH \u2014 install git and retry.",
         "git_not_installed"
@@ -1583,7 +1644,7 @@ function assertNoOperationInProgress(cwd) {
     ["REVERT_HEAD", "revert", "git revert --continue", "git revert --abort"],
     ["rebase-merge", "rebase", "git rebase --continue", "git rebase --abort"],
     ["rebase-apply", "rebase", "git rebase --continue", "git rebase --abort"]
-  ].find(([marker]) => existsSync6(join5(resolve4(cwd, gitDir), marker)));
+  ].find(([marker]) => existsSync7(join5(resolve4(cwd, gitDir), marker)));
   if (!inProgress) return;
   const [, kind, finish, abort] = inProgress;
   throw new InputError(
@@ -1594,6 +1655,18 @@ function assertNoOperationInProgress(cwd) {
 function repoToplevel(cwd) {
   return gitLine(cwd, ["rev-parse", "--show-toplevel"]);
 }
+function interruptedGitOperation(cwd) {
+  const gitDir = runGit(cwd, ["rev-parse", "--git-path", "HEAD"], { allowFail: true });
+  if (gitDir.status !== 0) return null;
+  const dir = dirname4(resolve4(cwd, gitDir.stdout.toString("utf-8").trim()));
+  if (existsSync7(join5(dir, "rebase-apply", "applying"))) return "am";
+  if (existsSync7(join5(dir, "rebase-merge")) || existsSync7(join5(dir, "rebase-apply"))) return "rebase";
+  if (existsSync7(join5(dir, "MERGE_HEAD"))) return "merge";
+  if (existsSync7(join5(dir, "CHERRY_PICK_HEAD"))) return "cherry-pick";
+  if (existsSync7(join5(dir, "REVERT_HEAD"))) return "revert";
+  if (existsSync7(join5(dir, "BISECT_LOG"))) return "bisect";
+  return null;
+}
 function currentBranch(cwd) {
   const result = runGit(cwd, ["symbolic-ref", "--short", "-q", "HEAD"], { allowFail: true });
   const name = result.stdout.toString("utf-8").trim();
@@ -1609,6 +1682,9 @@ function resolveCommit(cwd, ref) {
 function isWorkTreeClean(cwd) {
   return gitLine(cwd, ["status", "--porcelain"]) === "";
 }
+function hasUnmergedEntries(cwd) {
+  return gitLine(cwd, ["ls-files", "-u"]) !== "";
+}
 function updateRef(cwd, ref, oid) {
   runGit(cwd, ["update-ref", ref, oid]);
 }
@@ -1665,7 +1741,7 @@ function listWorktrees(cwd) {
       current.branch = ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
     }
   }
-  return worktrees;
+  return worktrees.filter((worktree) => existsSync7(worktree.path));
 }
 function ensureLocalExclude(cwd, pattern) {
   const commonDir = resolve4(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
@@ -1704,7 +1780,7 @@ function writeLaunchFile(launchPath, config) {
 }
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
-  if (!existsSync7(launchPath)) return empty;
+  if (!existsSync8(launchPath)) return empty;
   const raw = readFileSync7(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
@@ -1815,13 +1891,13 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
     const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
-      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync7(c.cwd);
+      const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync8(c.cwd);
       return !isStaleWorktreeEntry;
     });
     let port = opts.port;
     if (opts.probePort) {
       const taken = new Set(
-        config.configurations.map((c) => Number(c?.port)).filter((p35) => Number.isInteger(p35) && p35 > 0)
+        config.configurations.map((c) => Number(c?.port)).filter((p36) => Number.isInteger(p36) && p36 > 0)
       );
       for (let i = 0; i < WORKTREE_PORT_RANGE && taken.has(port); i++) {
         port = WORKTREE_PORT_MIN + (port - WORKTREE_PORT_MIN + 1) % WORKTREE_PORT_RANGE;
@@ -1865,6 +1941,29 @@ function resolveWorktreePort(appDir) {
 // src/cli/lib/repo-api.ts
 import { randomUUID } from "crypto";
 
+// src/cli/lib/workspace-id.ts
+var ULID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+var WORKSPACE_ID_RE = /^ws_[0-9A-HJKMNP-TV-Z]{26}$/;
+function isWorkspaceId(id) {
+  return WORKSPACE_ID_RE.test(id);
+}
+function workspaceBranchName(workspaceId) {
+  return `ws/${workspaceId.replace(/^ws_/, "").toLowerCase()}`;
+}
+function workspaceIdFromBranch(branch) {
+  if (!branch || !branch.startsWith("ws/")) return null;
+  const ulid = branch.slice(3);
+  if (!ULID_RE.test(ulid)) return null;
+  return `ws_${ulid.toUpperCase()}`;
+}
+function isSelectedWorkspaceCheckout(branch, workspaceId) {
+  return workspaceIdFromBranch(branch) === workspaceId;
+}
+function resolveWorkspaceWorktree(worktrees, workspaceId) {
+  const branch = workspaceBranchName(workspaceId);
+  return worktrees.find((worktree) => worktree.branch === branch)?.path ?? null;
+}
+
 // src/cli/lib/source-api.ts
 function githubSourceRefusal(appId, repository) {
   return new Refusal(
@@ -1898,6 +1997,10 @@ function setAppSource(deployUrl, token, appId, input) {
 }
 
 // src/cli/lib/repo-api.ts
+function isWorkspaceRef(ref) {
+  const prefix = "refs/deepspace/ws/";
+  return ref.startsWith(prefix) && isWorkspaceId(ref.slice(prefix.length));
+}
 function releaseSourceLabel(release2) {
   if (release2.commitOid) return `commit ${release2.commitOid.slice(0, 10)}`;
   if (release2.source?.provider === "github") return `GitHub \xB7 ${release2.source.repository}`;
@@ -1937,12 +2040,22 @@ function repoApi(deployUrl, token, appId) {
     "invalid_response",
     `${base}${path}`
   );
+  const normalizeWorkspace = (view, path) => {
+    if (view === null || typeof view !== "object") return;
+    const workspace = view.workspace;
+    if (workspace === null || typeof workspace !== "object") return;
+    const fields = workspace;
+    if (typeof fields.ref !== "string" || !isWorkspaceRef(fields.ref)) throw shapeError(path);
+    if (typeof fields.task === "string") fields.task = displayText(fields.task);
+  };
   const assertShape = (r, spec, path) => {
     if (r === null || typeof r !== "object") throw shapeError(path);
     const obj = r;
     for (const [key, kind] of Object.entries(spec)) {
       if (!KIND[kind](obj[key])) throw shapeError(path);
     }
+    normalizeWorkspace(obj.view, path);
+    if (Array.isArray(obj.views)) for (const view of obj.views) normalizeWorkspace(view, path);
     return r;
   };
   const getShape = async (path, spec) => assertShape(await call(path), spec, path);
@@ -1964,6 +2077,9 @@ function repoApi(deployUrl, token, appId) {
     createWorkspace(args) {
       return postShape("/workspaces", args, { view: "object" });
     },
+    /** `truncated` ⇒ the server had more rows than `limit` and stopped. Without
+     *  it a capped page is indistinguishable from the whole set, so a caller
+     *  reading "3 workspaces" cannot tell that a fourth exists. */
     listWorkspaces(opts) {
       const params = new URLSearchParams();
       if (opts?.all) params.set("all", "1");
@@ -2241,11 +2357,11 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, realpathSync as realpathSync3 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, realpathSync as realpathSync3 } from "fs";
 import { dirname as dirname6, join as join8, resolve as resolve6 } from "path";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
 import { join as join7 } from "path";
 function detectPackageManager(appDir) {
   try {
@@ -2254,9 +2370,9 @@ function detectPackageManager(appDir) {
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
   }
-  if (existsSync8(join7(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join7(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync8(join7(appDir, "bun.lock")) || existsSync8(join7(appDir, "bun.lockb"))) return "bun";
+  if (existsSync9(join7(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync9(join7(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync9(join7(appDir, "bun.lock")) || existsSync9(join7(appDir, "bun.lockb"))) return "bun";
   return "npm";
 }
 function installCommand(appDir) {
@@ -2267,9 +2383,9 @@ function installCommand(appDir) {
 function installState(appDir) {
   if (resolvesDeepspace(appDir)) return "ready";
   const sentinelDir = join8(appDir, ".deepspace");
-  if (existsSync9(join8(sentinelDir, "install.err"))) return "failed";
-  if (existsSync9(join8(sentinelDir, "install.started"))) {
-    if (!existsSync9(join8(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+  if (existsSync10(join8(sentinelDir, "install.err"))) return "failed";
+  if (existsSync10(join8(sentinelDir, "install.started"))) {
+    if (!existsSync10(join8(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
       return "installing";
     }
     return "failed";
@@ -2286,25 +2402,25 @@ function ensureInstallReady(appDir) {
   const startedPath = join8(sentinelDir, "install.started");
   const donePath = join8(sentinelDir, "install.done");
   const logPath = join8(sentinelDir, "install.log");
-  if (existsSync9(errPath)) {
+  if (existsSync10(errPath)) {
     const detail = readFileSync9(errPath, "utf-8").trimEnd();
-    const log29 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
+    const log29 = existsSync10(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
       `Dependency install failed: ${detail}.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
       "install_failed",
       { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
     );
   }
-  if (existsSync9(startedPath) && !existsSync9(donePath)) {
+  if (existsSync10(startedPath) && !existsSync10(donePath)) {
     if (!installWorkerAlive(sentinelDir)) {
-      const log29 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
+      const log29 = existsSync10(logPath) ? ` See what happened: ${logPath}.` : "";
       throw new Refusal(
         `The dependency install is no longer running and never finished.${log29} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
         "install_failed",
         { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
       );
     }
-    const tail = existsSync9(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
+    const tail = existsSync10(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
     throw new Refusal(
       `Dependencies are still installing.${tail} Retry once it finishes.`,
       "install_in_progress"
@@ -2326,7 +2442,7 @@ function resolvesDeepspace(fromDir) {
   } catch {
   }
   for (; ; ) {
-    if (existsSync9(join8(dir, "node_modules", "deepspace", "package.json"))) return true;
+    if (existsSync10(join8(dir, "node_modules", "deepspace", "package.json"))) return true;
     if (dir === checkoutRoot) return false;
     const parent = dirname6(dir);
     if (parent === dir) return false;
@@ -2342,7 +2458,7 @@ function canonicalPath2(path) {
 }
 function installWorkerAlive(sentinelDir) {
   const pidPath = join8(sentinelDir, "install.pid");
-  if (!existsSync9(pidPath)) return false;
+  if (!existsSync10(pidPath)) return false;
   return processAlive(Number(readFileSync9(pidPath, "utf-8").trim()));
 }
 function processAlive(pid) {
@@ -2357,7 +2473,7 @@ function processAlive(pid) {
 
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import * as nodeModule from "module";
 import { resolve as resolve7 } from "path";
 function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function", version = process.versions.node) {
@@ -2380,7 +2496,7 @@ function preflightWindowsWorkerd(appDir) {
     "bin",
     "workerd.exe"
   );
-  if (!existsSync10(workerdExe)) return;
+  if (!existsSync11(workerdExe)) return;
   try {
     execFileSync(workerdExe, ["--help"], { stdio: "pipe", timeout: 1e4 });
     return;
@@ -2731,28 +2847,34 @@ var CONFIG_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var MAX_SECRET_VALUE_BYTES = 32 * 1024;
 function validateConfigName(configName) {
   if (!CONFIG_NAME_RE.test(configName)) {
-    throw new Error(
-      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`
+    throw new InputError(
+      `Invalid config "${configName}". Use letters, numbers, underscores, or hyphens; start with a letter or number.`,
+      "invalid_config_name"
     );
   }
   return configName;
 }
 function validateSecretName(name) {
   if (!SECRET_NAME_RE.test(name)) {
-    throw new Error(
-      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`
+    throw new InputError(
+      `Invalid secret name "${name}". Use letters, numbers, and underscores; start with a letter or underscore.`,
+      "invalid_secret_name"
     );
   }
   if (RESERVED_SECRET_NAMES.has(name)) {
-    throw new Error(
-      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`
+    throw new InputError(
+      `"${name}" is managed by the DeepSpace SDK and can't be set as an app secret \u2014 the platform injects it at deploy time.`,
+      "reserved_secret_name"
     );
   }
   return name;
 }
 function validateSecretValue(key, value) {
   if (new TextEncoder().encode(value).byteLength > MAX_SECRET_VALUE_BYTES) {
-    throw new Error(`Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`);
+    throw new InputError(
+      `Secret "${key}" exceeds ${MAX_SECRET_VALUE_BYTES} bytes`,
+      "secret_too_large"
+    );
   }
 }
 function defaultConfigNameForEnv(wranglerEnv) {
@@ -2835,7 +2957,9 @@ async function pullAppSecretsCache(deployUrl, token, appId, configName) {
     }
     return { appId, configName, values: secrets };
   } catch (err) {
-    if (err?.status === 404) return null;
+    if (err instanceof ApiError && err.status === 404 && err.code !== "unrecognized_service") {
+      return null;
+    }
     throw err;
   }
 }
@@ -2857,14 +2981,27 @@ function parseSecretsUpload(content) {
   const trimmed = content.trim();
   if (!trimmed) return {};
   if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    const parsed = JSON.parse(trimmed);
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      throw new InputError(
+        "The input starts with { or [ but is not valid JSON. Pass a JSON object of KEY:value strings, or a dotenv file.",
+        "invalid_format"
+      );
+    }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("JSON upload must be an object of KEY=value strings.");
+      throw new InputError("JSON upload must be an object of KEY=value strings.", "invalid_format");
     }
     const out2 = {};
     for (const [key, value] of Object.entries(parsed)) {
       validateSecretName(key);
-      if (typeof value !== "string") throw new Error(`Secret "${key}" must be a string`);
+      if (typeof value !== "string") {
+        throw new InputError(
+          `Secret "${key}" must be a string \u2014 got ${Array.isArray(value) ? "an array" : typeof value}.`,
+          "invalid_format"
+        );
+      }
       validateSecretValue(key, value);
       out2[key] = value;
     }
@@ -2909,8 +3046,9 @@ function parseSecretsUpload(content) {
         parts.push(lines[i]);
       }
       if (!closed) {
-        throw new Error(
-          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
+        throw new InputError(
+          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`,
+          "invalid_format"
         );
       }
       value = parts.join("\n");
@@ -2967,7 +3105,7 @@ async function refreshSecretsCache(deployUrl, token, appId, wranglerEnv, selecte
 }
 
 // src/cli/lib/schema-lint.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { join as join10 } from "path";
 import { pathToFileURL } from "url";
 
@@ -3001,7 +3139,7 @@ function lintSchema(schema) {
     const offendingRoles = Object.entries(schema.permissions).filter(([, perms]) => perms.read === true).map(([role]) => role);
     if (offendingRoles.length > 0) {
       const usesAware = Object.values(schema.permissions).some(
-        (p35) => typeof p35.read === "string" && VISIBILITY_AWARE.includes(p35.read)
+        (p36) => typeof p36.read === "string" && VISIBILITY_AWARE.includes(p36.read)
       );
       if (!usesAware) {
         warnings.push(
@@ -3037,7 +3175,7 @@ function lintSchemaSet(schemas) {
   const warnings = [];
   if (!schemas.some((schema) => schema.name === "team_members")) {
     for (const schema of schemas) {
-      const teamRoles = Object.entries(schema.permissions).filter(([, p35]) => [p35.read, p35.update, p35.delete].includes("team")).map(([role]) => role);
+      const teamRoles = Object.entries(schema.permissions).filter(([, p36]) => [p36.read, p36.update, p36.delete].includes("team")).map(([role]) => role);
       if (teamRoles.length > 0) {
         warnings.push(
           `[${schema.name}] role(s) ${teamRoles.join(", ")} use the 'team' permission level, but no 'team_members' collection is registered. 'team' resolves membership from team_members (teamId, userId, status), so without it those roles are denied everything \u2014 silently. Register a team_members schema or use another level.`
@@ -3051,7 +3189,7 @@ function lintSchemaSet(schemas) {
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
   const schemasPath = join10(appDir, "src", "schemas.ts");
-  if (!existsSync11(schemasPath)) return null;
+  if (!existsSync12(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
@@ -3678,7 +3816,7 @@ function ensurePlaywright(appDir) {
 import { readFileSync as readFileSync12 } from "fs";
 
 // src/testing/accounts.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join12 } from "path";
 var TEST_ACCOUNTS_PATH = join12(homedir2(), ".deepspace", "test-accounts.json");
@@ -3746,7 +3884,7 @@ function removeTestAccounts(ids, emails = [], scope = currentTestAccountScope())
   });
 }
 function readTestAccountStore() {
-  if (!existsSync12(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
+  if (!existsSync13(TEST_ACCOUNTS_PATH)) return { version: 2, scopes: {} };
   try {
     const raw = JSON.parse(readFileSync11(TEST_ACCOUNTS_PATH, "utf-8"));
     if (Array.isArray(raw)) return { version: 2, scopes: {} };
@@ -4714,7 +4852,7 @@ function describeFilesFailure(status3, body) {
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15, readdirSync as readdirSync6 } from "fs";
 import { dirname as dirname7, isAbsolute as isAbsolute3, join as join17, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // src/build/app-id.ts
@@ -4732,11 +4870,11 @@ var APP_ID_ADOPTION_STEPS = `Point the client at the build-injected id \u2014 th
 `).join("") + APP_ID_ADOPTION_TOGETHER;
 
 // src/build/plugin.ts
-import { existsSync as existsSync13, lstatSync, readdirSync as readdirSync5, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync14, lstatSync, readdirSync as readdirSync5, unlinkSync as unlinkSync2 } from "fs";
 import { join as join14, resolve as resolve12 } from "path";
 function removeBuildDevVars(workerDir) {
   const path = join14(workerDir, ".dev.vars");
-  if (!existsSync13(path)) return false;
+  if (!existsSync14(path)) return false;
   if (!lstatSync(path).isFile()) {
     throw new Error(`Refusing unsafe build secret path: ${path}`);
   }
@@ -4745,12 +4883,12 @@ function removeBuildDevVars(workerDir) {
 }
 
 // src/documentation/deploy.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
 import { join as join15 } from "path";
 function readDocumentationDeployManifest(appDir, clientDir) {
-  if (!existsSync14(join15(appDir, "documentation.json"))) return void 0;
+  if (!existsSync15(join15(appDir, "documentation.json"))) return void 0;
   const manifestPath = join15(clientDir, "_documentation", "manifest.json");
-  if (!existsSync14(manifestPath)) {
+  if (!existsSync15(manifestPath)) {
     throw new Error(
       "documentation.json exists but the build produced no documentation manifest. Ensure vite.config.ts includes deepSpaceDocumentation() from deepspace/documentation."
     );
@@ -4759,7 +4897,7 @@ function readDocumentationDeployManifest(appDir, clientDir) {
 }
 
 // src/cli/commands/update/app-migrations.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
 import { join as join16 } from "path";
 
 // src/shared/protocol/app-migrations.ts
@@ -4835,7 +4973,7 @@ var APP_MIGRATION_DEFINITIONS = APP_MIGRATION_GUIDANCE.map(({ id, description })
 }));
 function readAppliedAppMigrations(appDir) {
   const path = join16(appDir, APP_MIGRATIONS_MANIFEST);
-  if (!existsSync15(path)) return [];
+  if (!existsSync16(path)) return [];
   let parsed;
   try {
     parsed = JSON.parse(readFileSync14(path, "utf8"));
@@ -4898,7 +5036,7 @@ async function buildDeployBundle(options) {
   }
   spinner2.stop(`Built (${Math.round((Date.now() - buildStarted) / 1e3)}s)`);
   const deployConfigPath = join17(appDir, ".wrangler", "deploy", "config.json");
-  if (!existsSync16(deployConfigPath)) {
+  if (!existsSync17(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
@@ -4906,7 +5044,7 @@ async function buildDeployBundle(options) {
   }
   const deployConfig = JSON.parse(readFileSync15(deployConfigPath, "utf-8"));
   const outputWranglerPath = resolve13(dirname7(deployConfigPath), deployConfig.configPath);
-  if (!existsSync16(outputWranglerPath)) {
+  if (!existsSync17(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
   const outputConfig = JSON.parse(readFileSync15(outputWranglerPath, "utf-8"));
@@ -4925,10 +5063,10 @@ async function buildDeployBundle(options) {
   }
   const workerBundlePath = join17(workerDir, outputConfig.main);
   const clientDir = outputConfig.assets?.directory ? resolve13(workerDir, outputConfig.assets.directory) : null;
-  if (!existsSync16(workerBundlePath)) {
+  if (!existsSync17(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
-  if (!clientDir || !existsSync16(clientDir)) {
+  if (!clientDir || !existsSync17(clientDir)) {
     return output.die(`Client assets not found at ${clientDir}`, "build_output_missing");
   }
   try {
@@ -5116,7 +5254,7 @@ function readDeployAssetConfig(clientDir) {
     ["_redirects", "_redirects"]
   ]) {
     const filePath = join17(clientDir, file);
-    if (!existsSync16(filePath)) continue;
+    if (!existsSync17(filePath)) continue;
     const content = readFileSync15(filePath, "utf8");
     if (content.trim()) config[key] = content;
   }
@@ -5131,7 +5269,7 @@ function errorMessage(error) {
 
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { join as join18 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 
@@ -5185,7 +5323,7 @@ function errorMessage2(error) {
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
   const sourcePath = join18(appDir, "src", sourceFile);
-  if (!existsSync17(sourcePath)) return void 0;
+  if (!existsSync18(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
   const outputPath = join18(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
@@ -5280,7 +5418,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync17(join18(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync18(join18(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -5335,7 +5473,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync17(join18(appDir, "src", "products.ts"))) return;
+  if (!existsSync18(join18(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -5447,92 +5585,8 @@ import { readFileSync as readFileSync16 } from "fs";
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
 
-// src/cli/lib/git/safety.ts
-var SECRET_FILE_RE = /(^|\/)(\.dev\.vars(\.[^/]*)?|\.env(\.[^/]*)?|\.npmrc|\.envrc|\.mcp\.json)$/i;
-var SECRET_TEMPLATE_RE = /\.(example|sample|template)$/i;
-function findOversizedObjects(cwd, capBytes, limit = 3) {
-  try {
-    const revisionObjects = runGit(cwd, ["rev-list", "--objects", "--all"], { allowFail: true });
-    if (revisionObjects.status !== 0) return [];
-    const pathByOid = /* @__PURE__ */ new Map();
-    for (const line of revisionObjects.stdout.toString("utf-8").split("\n")) {
-      const separator = line.indexOf(" ");
-      if (separator > 0) pathByOid.set(line.slice(0, separator), line.slice(separator + 1));
-    }
-    const sizedObjects = runGit(
-      cwd,
-      [
-        "cat-file",
-        "--batch-all-objects",
-        "--batch-check=%(objectname) %(objecttype) %(objectsize)"
-      ],
-      { allowFail: true }
-    );
-    if (sizedObjects.status !== 0) return [];
-    const oversized = [];
-    for (const line of sizedObjects.stdout.toString("utf-8").split("\n")) {
-      const [oid, type, size] = line.split(" ");
-      if (type !== "blob") continue;
-      const bytes = Number(size);
-      const path = pathByOid.get(oid);
-      if (path && Number.isFinite(bytes) && bytes > capBytes) oversized.push({ path, bytes });
-    }
-    return oversized.sort((left, right) => right.bytes - left.bytes).slice(0, limit);
-  } catch {
-    return [];
-  }
-}
-function statusFiles(cwd) {
-  const records = splitNulFields(
-    runGit(cwd, [
-      "-c",
-      "core.quotePath=false",
-      "status",
-      "--porcelain",
-      "--untracked-files=all",
-      "-z"
-    ]).stdout
-  );
-  const files = [];
-  for (let index = 0; index < records.length; index++) {
-    const record = records[index];
-    files.push(record.slice(3));
-    if (/[RC]/.test(record.slice(0, 2))) {
-      index++;
-      if (/R/.test(record.slice(0, 2)) && index < records.length) files.push(records[index]);
-    }
-  }
-  return [
-    ...new Set(
-      files.filter((path) => !(SECRET_FILE_RE.test(path) && !SECRET_TEMPLATE_RE.test(path)))
-    )
-  ];
-}
-function trackedSecretFiles(cwd, ref) {
-  const result = runGit(
-    repoToplevel(cwd),
-    ["-c", "core.quotePath=false", "ls-tree", "-r", "--name-only", "-z", ref],
-    { allowFail: true }
-  );
-  if (result.status !== 0) return [];
-  return splitNulFields(result.stdout).filter(
-    (path) => SECRET_FILE_RE.test(path) && !SECRET_TEMPLATE_RE.test(path)
-  );
-}
-var SECRET_IN_HISTORY_CODE = "secret_in_history";
-function committedSecretRefusal(cwd, commitOid, options) {
-  if (!commitOid) return null;
-  const files = trackedSecretFiles(cwd, commitOid);
-  if (files.length === 0) return null;
-  return {
-    files,
-    code: SECRET_IN_HISTORY_CODE,
-    message: `Refusing to ${options.action}: the commit being published carries secret file(s) \u2014 ${files.join(", ")}. These hold local secrets and must not reach the cloud repo, but pushing this commit would upload them through its history. Untrack with \`git rm --cached ${shQuote(files[0])}\`, ensure it's .gitignored, commit, then ${options.then}.`
-  };
-}
-
 // src/cli/lib/vc-remote.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute4, relative as relative3, resolve as resolve14 } from "path";
 function spaceRemoteName(environment = DEEPSPACE_ENV) {
@@ -5587,7 +5641,7 @@ function helperEntryUsable(command) {
   const match = /^!(?:DEEPSPACE_ENV=(production|staging) )?'([^']*)' '([^']*)' git-credential$/.exec(command);
   const expectedEnvironment = DEEPSPACE_ENV === "production" ? void 0 : DEEPSPACE_ENV;
   if (!match || match[1] !== expectedEnvironment) return false;
-  return existsSync18(match[2]) && existsSync18(match[3]);
+  return existsSync19(match[2]) && existsSync19(match[3]);
 }
 function credentialHelperCommand(environment = DEEPSPACE_ENV) {
   const entry = process.argv[1];
@@ -5632,23 +5686,31 @@ function installCredentialHelper(cwd, url) {
   } catch {
   }
 }
-function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE) {
+function ensureSpaceRemote(cwd, appId, remote = SPACE_REMOTE, token) {
   const url = repoUrl(appId);
   const current = runGit(cwd, ["remote", "get-url", remote], { allowFail: true });
-  if (current.status !== 0) {
+  const existing = current.status === 0 ? current.stdout.toString("utf-8").trim() : null;
+  if (appIdFromRepoUrl(existing ?? "") !== appId) {
+    const owned = declaredAppIds(cwd);
+    if (owned.size > 0 && !owned.has(appId)) {
+      throw new InputError(
+        `This checkout declares ${[...owned].join(", ")}, but this command targets ${appId}. Pointing its \`${remote}\` remote at another app would send every later plain \`git push ${remote}\` to the wrong repo. Work on ${appId} from its own checkout (\`deepspace clone ${appId}\` into a new directory), or fork THIS checkout into a brand-new app of your own with \`deepspace app init --new-id\`.`,
+        "app_checkout_mismatch"
+      );
+    }
+  }
+  if (token) ensureGitIdentity(cwd, token);
+  if (existing === null) {
     runGit(cwd, ["remote", "add", remote, url]);
-  } else {
-    const existing = current.stdout.toString("utf-8").trim();
-    if (existing !== url) {
-      const priorApp = appIdFromRepoUrl(existing);
-      if (priorApp && priorApp !== appId && !process.argv.includes("--json")) {
-        process.stderr.write(
-          `warning: remote '${remote}' was pointed at app ${priorApp}; re-aiming it at ${appId}.
+  } else if (existing !== url) {
+    const priorApp = appIdFromRepoUrl(existing);
+    if (priorApp && priorApp !== appId && !process.argv.includes("--json")) {
+      process.stderr.write(
+        `warning: remote '${remote}' was pointed at app ${priorApp}; re-aiming it at ${appId}.
 `
-        );
-      }
-      runGit(cwd, ["remote", "set-url", remote, url]);
+      );
     }
+    runGit(cwd, ["remote", "set-url", remote, url]);
   }
   installCredentialHelper(cwd, url);
   return url;
@@ -5665,6 +5727,9 @@ function ensureGitIdentity(cwd, token) {
     const missingName = !configured("user.name");
     const missingEmail = !configured("user.email");
     if (!missingName && !missingEmail) return;
+    if (runGit(cwd, ["config", "--get", "--type=bool", "user.useConfigOnly"], { allowFail: true }).stdout.toString("utf-8").trim() === "true") {
+      return;
+    }
     const payload = decodeJwtPayload(token);
     if (!payload.email) return;
     if (missingName) {
@@ -5675,6 +5740,14 @@ function ensureGitIdentity(cwd, token) {
     if (missingEmail) {
       runGit(cwd, ["config", "--local", "user.email", payload.email], { allowFail: true });
     }
+    const wrote = [...missingEmail ? ["user.email"] : [], ...missingName ? ["user.name"] : []];
+    const dir = /^[A-Za-z0-9_./:@-]+$/.test(cwd) ? cwd : shQuote(cwd);
+    const undo = wrote.map((key) => `git -C ${dir} config --local --unset ${key}`).join(" && ");
+    process.stderr.write(
+      `Git identity for this checkout set from your DeepSpace login (${payload.email}).
+  Undo with: ${undo}
+`
+    );
   } catch {
   }
 }
@@ -5683,74 +5756,287 @@ function appIdFromRepoUrl(url) {
   return match ? decodeURIComponent(match[1]) : null;
 }
 
-// src/cli/lib/vc-push.ts
-var CAS_CONFLICT_REASON = /stale ref|fetch first|no such ref|atomic push failed/i;
-function parsePushPorcelain(out) {
-  const results = [];
-  for (const line of out.split("\n")) {
-    const match = /^([ +\-*=!])\t([^\t]*)\t(.*)$/.exec(line);
-    if (!match) continue;
-    const [, flag, refspec, summary] = match;
-    const colon = refspec.indexOf(":");
-    const localRef = colon >= 0 ? refspec.slice(0, colon) : refspec;
-    const remoteRef = colon >= 0 ? refspec.slice(colon + 1) : refspec;
-    let status3;
-    let reason;
-    if (flag === "=") {
-      status3 = "up_to_date";
-    } else if (flag === "!") {
-      reason = /\((.*)\)\s*$/.exec(summary)?.[1];
-      if (!summary.startsWith("[remote rejected]")) {
-        status3 = "non_fast_forward";
-      } else if (reason && CAS_CONFLICT_REASON.test(reason)) {
-        status3 = "ref_conflict";
-      } else {
-        status3 = "rejected";
-      }
-    } else {
-      status3 = "committed";
+// src/cli/lib/git/safety.ts
+var SECRET_FILE_RE = /(^|\/)(\.dev\.vars(\.[^/]*)?|\.env(\.[^/]*)?|\.npmrc|\.envrc|\.mcp\.json)$/i;
+var SECRET_TEMPLATE_RE = /\.(example|sample|template)$/i;
+function findOversizedObjects(cwd, capBytes, limit = 3) {
+  try {
+    const revisionObjects = runGit(cwd, ["rev-list", "--objects", "--all"], { allowFail: true });
+    if (revisionObjects.status !== 0) return [];
+    const pathByOid = /* @__PURE__ */ new Map();
+    for (const line of revisionObjects.stdout.toString("utf-8").split("\n")) {
+      const separator = line.indexOf(" ");
+      if (separator > 0) pathByOid.set(line.slice(0, separator), line.slice(separator + 1));
     }
-    results.push({ status: status3, localRef, remoteRef, summary, ...reason ? { reason } : {} });
-  }
-  return results;
-}
-function isThinPackRejection(result) {
-  return result.status === "rejected" && /thin (?:push|pack)|--no-thin/i.test(result.reason ?? result.summary ?? "");
-}
-function isRecoverablePushFailure(status3) {
-  return status3 === "non_fast_forward" || status3 === "ref_conflict";
-}
-function classifyPushTransportFailure(error, cwd) {
-  const message = error instanceof Error ? error.message : String(error);
-  if (/(?:HTTP |error: )409\b/i.test(message)) {
-    return {
-      code: "app_quota_exceeded",
-      error: `A first push to this new app hit your plan's active-app quota. Use \`deepspace app list\` to choose an app to undeploy, or upgrade your plan, then retry.`
-    };
-  }
-  if (/(?:HTTP |error: )429\b/i.test(message)) {
-    return {
-      code: "rate_limited",
+    const sizedObjects = runGit(
+      cwd,
+      [
+        "cat-file",
+        "--batch-all-objects",
+        "--batch-check=%(objectname) %(objecttype) %(objectsize)"
+      ],
+      { allowFail: true }
+    );
+    if (sizedObjects.status !== 0) return [];
+    const oversized = [];
+    for (const line of sizedObjects.stdout.toString("utf-8").split("\n")) {
+      const [oid, type, size] = line.split(" ");
+      if (type !== "blob") continue;
+      const bytes = Number(size);
+      const path = pathByOid.get(oid);
+      if (path && Number.isFinite(bytes) && bytes > capBytes) oversized.push({ path, bytes });
+    }
+    return oversized.sort((left, right) => right.bytes - left.bytes).slice(0, limit);
+  } catch {
+    return [];
+  }
+}
+function statusFiles(cwd) {
+  const records = splitNulFields(
+    runGit(cwd, [
+      "-c",
+      "core.quotePath=false",
+      "status",
+      "--porcelain",
+      "--untracked-files=all",
+      "-z"
+    ]).stdout
+  );
+  const files = [];
+  for (let index = 0; index < records.length; index++) {
+    const record = records[index];
+    files.push(record.slice(3));
+    if (/[RC]/.test(record.slice(0, 2))) {
+      index++;
+      if (/R/.test(record.slice(0, 2)) && index < records.length) files.push(records[index]);
+    }
+  }
+  return [
+    ...new Set(
+      files.filter((path) => !(SECRET_FILE_RE.test(path) && !SECRET_TEMPLATE_RE.test(path)))
+    )
+  ];
+}
+function trackedSecretFiles(cwd, ref) {
+  const result = runGit(
+    repoToplevel(cwd),
+    ["-c", "core.quotePath=false", "ls-tree", "-r", "--name-only", "-z", ref],
+    { allowFail: true }
+  );
+  if (result.status !== 0) return [];
+  return splitNulFields(result.stdout).filter(
+    (path) => SECRET_FILE_RE.test(path) && !SECRET_TEMPLATE_RE.test(path)
+  );
+}
+function pushRange(root, base, tip) {
+  if (base) return ["--root", `${base}..${tip}`];
+  const listed = runGit(
+    root,
+    ["for-each-ref", "--format=%(refname)", `refs/remotes/${SPACE_REMOTE}/`],
+    { allowFail: true }
+  );
+  const spaceRefs = listed.status === 0 ? listed.stdout.toString("utf-8").split("\n").map((ref) => ref.trim()).filter(Boolean) : [];
+  return spaceRefs.length === 0 ? ["--root", tip] : ["--root", tip, "--not", ...spaceRefs];
+}
+function secretFilesInPushRange(cwd, base, tip) {
+  const root = repoToplevel(cwd);
+  const found = new Set(trackedSecretFiles(root, tip));
+  const result = runGit(
+    root,
+    [
+      "-c",
+      "core.quotePath=false",
+      "log",
+      // Rename detection is on by default, so `git mv notes.txt .env` is
+      // reported as R100 and never as an addition — while the blob still
+      // rides the pack and the server still refuses it.
+      "--no-renames",
+      "--diff-filter=A",
+      "--name-only",
+      "--pretty=format:",
+      "-z",
+      ...pushRange(root, base, tip)
+    ],
+    { allowFail: true }
+  );
+  if (result.status !== 0) {
+    return [...found];
+  }
+  for (const path of splitNulFields(result.stdout)) {
+    if (path && SECRET_FILE_RE.test(path) && !SECRET_TEMPLATE_RE.test(path)) found.add(path);
+  }
+  return [...found];
+}
+var SECRET_IN_HISTORY_CODE = "secret_in_history";
+function secretRecoverySentence(files, then) {
+  const first = shQuote(files[0]);
+  return `Untracking alone will not fix this: the file is already in the commits being sent, so its contents upload through history either way. Rewrite the history that carries it \u2014 \`git rebase -i\` back past the commit that added ${first}, or \`git reset --soft\` to before it and re-commit without the file \u2014 and add it to .gitignore, then ${then}. Treat any credential it held as exposed and rotate it.`;
+}
+function committedSecretRefusal(cwd, commitOid, options) {
+  if (!commitOid) return null;
+  const files = options.base === void 0 ? trackedSecretFiles(cwd, commitOid) : secretFilesInPushRange(cwd, options.base, commitOid);
+  if (files.length === 0) return null;
+  return {
+    files,
+    code: SECRET_IN_HISTORY_CODE,
+    message: `Refusing to ${options.action}: the commit being published carries secret file(s) \u2014 ${files.join(", ")}. These hold local secrets and must not reach the cloud repo, but publishing this commit would upload them through its history. ` + secretRecoverySentence(files, options.then)
+  };
+}
+function unmergedIndexRefusal(cwd, opts) {
+  const marker = interruptedGitOperation(cwd);
+  const unmerged = hasUnmergedEntries(cwd);
+  const operation = marker === "bisect" ? null : marker;
+  if (operation === null && !unmerged) return null;
+  if (operation !== null && !unmerged) {
+    return {
+      operation,
+      code: "git_operation_in_progress",
+      message: `A ${operation} is in progress in this checkout \u2014 finish it (\`git ${operation} --continue\`) or abort it (\`git ${operation} --abort\`), then re-run \`${opts.resume}\`. If it stopped at a conflict, anything already staged can still carry \`<<<<<<<\` markers; staging is not resolving.`
+    };
+  }
+  if (operation === "merge" || operation === null) {
+    return {
+      operation,
+      code: "merge_conflict",
+      message: (operation === "merge" ? `${opts.ours} is already in progress here, stopped at unresolved conflicts. ` : `The index has unresolved conflicts with no operation to continue \u2014 a squash merge or a stash pop. `) + `Resolve the conflicted files (remove the \`<<<<<<<\` markers), \`git add\` them, ` + (operation === "merge" ? `\`git commit\`, then re-run \`${opts.resume}\`. To abandon the merge instead: \`git merge --abort\`.` : `\`git commit\`, then re-run \`${opts.resume}\`. To discard them instead: \`git reset --merge\`.`)
+    };
+  }
+  return {
+    operation,
+    code: "git_operation_in_progress",
+    message: `A ${operation} is unfinished in this checkout with unresolved conflicts \u2014 finish it (\`git ${operation} --continue\` after resolving, or \`git ${operation} --abort\`), then re-run \`${opts.resume}\`.`
+  };
+}
+
+// src/cli/lib/vc-push.ts
+function parseRefusalCode(reason) {
+  const match = /^([a-z_]+): (.*)$/s.exec(reason);
+  if (!match) return null;
+  const remainder = match[2];
+  const cut = remainder.indexOf(" \u2014 ");
+  return cut === -1 ? { code: match[1], sentence: remainder } : {
+    code: match[1],
+    sentence: remainder.slice(0, cut),
+    detail: remainder.slice(cut + " \u2014 ".length)
+  };
+}
+function parsePushPorcelain(out) {
+  const results = [];
+  for (const line of out.split("\n")) {
+    const match = /^([ +\-*=!])\t([^\t]*)\t(.*)$/.exec(line);
+    if (!match) continue;
+    const [, flag, refspec, summary] = match;
+    const colon = refspec.indexOf(":");
+    const localRef = colon >= 0 ? refspec.slice(0, colon) : refspec;
+    const remoteRef = colon >= 0 ? refspec.slice(colon + 1) : refspec;
+    let status3;
+    let reason;
+    let code;
+    if (flag === "=") {
+      status3 = "up_to_date";
+    } else if (flag === "!") {
+      reason = /\((.*)\)\s*$/.exec(summary)?.[1];
+      code = reason ? parseRefusalCode(reason)?.code ?? void 0 : void 0;
+      if (!summary.startsWith("[remote rejected]")) {
+        status3 = "non_fast_forward";
+      } else if (code === "stale_ref") {
+        status3 = "ref_conflict";
+      } else {
+        status3 = "rejected";
+      }
+    } else {
+      status3 = "committed";
+    }
+    results.push({
+      status: status3,
+      localRef,
+      remoteRef,
+      summary,
+      ...reason ? { reason } : {},
+      ...code ? { code } : {}
+    });
+  }
+  return results;
+}
+function isThinPackRejection(result) {
+  return result.status === "rejected" && result.code === "thin_pack";
+}
+function isRecoverablePushFailure(status3) {
+  return status3 === "non_fast_forward" || status3 === "ref_conflict";
+}
+function gitHttpStatus(message) {
+  for (const line of message.split("\n")) {
+    if (/^\s*remote:/i.test(line)) continue;
+    const match = /(?:HTTP |error: )(\d{3})\b/i.exec(line);
+    if (match) return Number(match[1]);
+  }
+  return null;
+}
+function classifyPushTransportFailure(error, cwd) {
+  const message = error instanceof Error ? error.message : String(error);
+  const status3 = gitHttpStatus(message);
+  if (status3 === 409) {
+    return {
+      code: "app_quota_exceeded",
+      error: `A first push to this new app hit your plan's active-app quota. Use \`deepspace app list\` to choose an app to undeploy, or upgrade your plan, then retry.`
+    };
+  }
+  if (status3 === 429) {
+    return {
+      code: "rate_limited",
       error: "The cloud repo rate-limited this push. Wait a few seconds, then retry."
     };
   }
-  if (/(?:HTTP |error: )413\b/i.test(message)) {
+  if (status3 === 413) {
     return { code: "push_too_large", error: pushTooLargeMessage(cwd) };
   }
-  if (/(?:HTTP |error: )422\b/i.test(message)) {
+  if (status3 === 422) {
     return {
       code: "source_managed_by_github",
       error: "This app's source is managed by GitHub, so pushes to the DeepSpace repo are refused. Push to the GitHub repository instead \u2014 `deepspace app status` names it."
     };
   }
+  if (status3 === 401) {
+    return {
+      code: "not_authenticated",
+      error: "The cloud repo rejected the push as unauthenticated \u2014 the session likely expired mid-push. Run `deepspace auth login`, then push again. Nothing was applied."
+    };
+  }
+  if (status3 === 403) {
+    return {
+      code: "forbidden",
+      error: "The cloud repo refused this push: you do not have write access to that app, or its id belongs to another account (`deepspace app init --new-id` mints your own). Nothing was applied."
+    };
+  }
+  if (status3 === null && /unexpected disconnect|Empty reply from server|curl (?:18|52|56)/i.test(
+    message
+  )) {
+    return {
+      code: "push_outcome_unknown",
+      error: "The connection dropped while the push was in flight with no reply from the server, so whether the cloud repo applied it is unknown \u2014 it may have landed. Re-run this push before anything else: an already-applied push reports `up_to_date`. Do NOT force-push or reset until you have."
+    };
+  }
   return null;
 }
+function representativeResult(results) {
+  const refused = results.filter(
+    (result) => result.status !== "committed" && result.status !== "up_to_date"
+  );
+  return refused.find((result) => result.code !== "not_attempted") ?? refused[0] ?? results[0];
+}
 function pushToSpace(cwd, token, refspec, opts = {}) {
   const doPush = (extra) => {
     const result = runGitRemote(
       cwd,
       token,
-      ["push", "--porcelain", ...opts.force ? ["--force"] : [], ...extra, opts.remote ?? SPACE_REMOTE, refspec],
+      [
+        "push",
+        "--porcelain",
+        ...opts.force ? ["--force"] : [],
+        ...extra,
+        opts.remote ?? SPACE_REMOTE,
+        refspec
+      ],
       { allowFail: true }
     );
     const parsed = parsePushPorcelain(result.stdout.toString("utf-8"));
@@ -5760,12 +6046,11 @@ function pushToSpace(cwd, token, refspec, opts = {}) {
         stderr || `git push exited ${result.status} without reporting a ref status`
       );
     }
-    return parsed[0];
+    return representativeResult(parsed);
   };
   const first = doPush([]);
   return isThinPackRejection(first) ? doPush(["--no-thin"]) : first;
 }
-var OVERSIZED_PUSH_RE = /too large|exceeds|\bLFS\b/i;
 var SERVER_OBJECT_CAP_BYTES = 20 * 1024 * 1024;
 var SERVER_PACK_CAP_BYTES = 32 * 1024 * 1024;
 var PUSH_CEILINGS = `${formatBytes(SERVER_OBJECT_CAP_BYTES)} per file, ${formatBytes(SERVER_PACK_CAP_BYTES)} per push`;
@@ -5791,39 +6076,83 @@ function pushTooLargeMessage(cwd) {
   }
   return `${ceilings} ${fixForObjects(objects)}`;
 }
-function pushFailureMessage(label, push, cwd) {
-  const reason = push.reason ?? push.summary ?? "";
-  const detail = `${push.status}${reason ? `: ${reason}` : ""}`;
-  if (OVERSIZED_PUSH_RE.test(reason)) {
-    return `${label} failed (${detail}) \u2014 an object exceeds the server's size cap, so retrying cannot succeed. ${oversizedPushFix(cwd)}`;
-  }
-  if (/^missing necessary objects — retry the push$/i.test(reason)) {
-    return `${label} failed (${detail}). Retry; if it persists, report it with \`deepspace feedback\`.`;
+var GENERIC_REJECTION = {
+  code: "rejected",
+  message: `The server rejected this push; correct the reported history/ref problem, or report it with \`deepspace feedback\` if the reason is unclear.`
+};
+var REFUSAL_ADVICE = {
+  push_too_large: ({ cwd }) => ({
+    code: "push_too_large",
+    message: `An object exceeds the server's size cap, so retrying cannot succeed. ${oversizedPushFix(cwd)}`
+  }),
+  repo_full: () => ({
+    code: "repo_full",
+    message: `The cloud repo is at its size ceiling, so retrying cannot succeed. Large objects already committed upload through their history, so untracking them is not enough \u2014 ${removeFromHistoryAdvice(null)}`
+  }),
+  secret_committed: ({ detail }) => {
+    const files = (detail ?? "").split(", ").map((name) => name.trim()).filter(Boolean);
+    return {
+      code: SECRET_IN_HISTORY_CODE,
+      message: files.length > 0 ? secretRecoverySentence(files, "push again") : "A secret file is committed in the history being pushed. Rewrite that history to drop it (untracking alone is not enough), then push again."
+    };
+  },
+  missing_objects: () => ({
+    code: "missing_objects",
+    message: "Retry; if it persists, report it with `deepspace feedback`."
+  }),
+  thin_pack: () => ({
+    code: "thin_pack",
+    // `pushToSpace` already retried once with `--no-thin`; reaching a caller
+    // means that retry also failed.
+    message: "Retry with `git push --no-thin`; if it persists, report it with `deepspace feedback`."
+  }),
+  // No `stale_ref` entry: it is encoded once, in `parsePushPorcelain`, as the
+  // `ref_conflict` STATUS. That is what drives the pull action and exit 2, and
+  // it is why no caller can reach this table with that code.
+  funny_refname: () => ({
+    code: "funny_refname",
+    message: "Rename the branch to a valid git ref name, then push again."
+  }),
+  workspace_creator: () => ({
+    code: "workspace_creator",
+    message: "Another agent owns that workspace ref. Publish your own with `deepspace workspace sync`."
+  }),
+  internal_ref: () => ({
+    code: "internal_ref",
+    message: "That ref namespace is managed by DeepSpace. Push a branch instead."
+  }),
+  bad_tip: () => ({
+    code: "bad_tip",
+    message: "Point the branch at a commit (not a tag or tree object), then push again."
+  }),
+  unpacker_error: () => ({
+    code: "unpacker_error",
+    message: "The server could not unpack this push. Report it with `deepspace feedback` \u2014 a plain retry sends the identical pack."
+  }),
+  // The server has no more specific code; its own sentence is the whole fact,
+  // so this reads exactly like an untagged rejection.
+  push_failed: () => GENERIC_REJECTION,
+  // Reaching here means `representativeResult` found nothing better — every
+  // ref reported "not attempted", so the refusal that stopped the push was
+  // never reported. Re-running would produce the same incomplete report, so
+  // say what is actually true rather than prescribing a loop.
+  not_attempted: () => ({
+    code: "rejected",
+    message: 'The push is atomic and every ref reports "not attempted", so the server did not report the refusal that stopped it. That should not happen \u2014 send this output with `deepspace feedback`.'
+  })
+};
+function classifyRejection(reason, cwd) {
+  const parsed = parseRefusalCode(reason);
+  if (parsed && Object.hasOwn(REFUSAL_ADVICE, parsed.code)) {
+    return REFUSAL_ADVICE[parsed.code]({ detail: parsed.detail, cwd });
   }
-  return `${label} failed (${detail}). The server rejected this push; correct the reported history/ref problem, or report it with \`deepspace feedback\` if the reason is unclear.`;
-}
-
-// src/cli/lib/workspace-id.ts
-var ULID_RE = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
-var WORKSPACE_ID_RE = /^ws_[0-9A-HJKMNP-TV-Z]{26}$/;
-function isWorkspaceId(id) {
-  return WORKSPACE_ID_RE.test(id);
+  return GENERIC_REJECTION;
 }
-function workspaceBranchName(workspaceId) {
-  return `ws/${workspaceId.replace(/^ws_/, "").toLowerCase()}`;
-}
-function workspaceIdFromBranch(branch) {
-  if (!branch || !branch.startsWith("ws/")) return null;
-  const ulid = branch.slice(3);
-  if (!ULID_RE.test(ulid)) return null;
-  return `ws_${ulid.toUpperCase()}`;
-}
-function isSelectedWorkspaceCheckout(branch, workspaceId) {
-  return workspaceIdFromBranch(branch) === workspaceId;
-}
-function resolveWorkspaceWorktree(worktrees, workspaceId) {
-  const branch = workspaceBranchName(workspaceId);
-  return worktrees.find((worktree) => worktree.branch === branch)?.path ?? null;
+function pushFailureMessage(subject, push, cwd) {
+  const reason = push.reason ?? push.summary ?? "";
+  const sentence = parseRefusalCode(reason)?.sentence ?? reason;
+  const detail = `${push.status}${sentence ? `: ${sentence}` : ""}`;
+  return `${subject} failed (${detail}). ${classifyRejection(reason, cwd).message}`;
 }
 
 // src/cli/lib/source-control.ts
@@ -5924,7 +6253,7 @@ function preflightDeployRepository(options) {
     }
     assertNoOperationInProgress(appDir);
     const branch = currentBranch(appDir);
-    if (!isWorkTreeClean(appDir)) return dirtyWorktreeRefusal(branch);
+    if (!isWorkTreeClean(appDir)) return dirtyWorktreeRefusal(branch, appDir);
     if (!branch) return detachedHeadRefusal();
     return null;
   } catch (error) {
@@ -5999,7 +6328,7 @@ async function syncDeployRepository(options) {
       p9.log.info(`Workspace ${workspaceBranchId} is synced at ${tip.slice(0, 10)}.`);
     } else if (secretFiles.length > 0) {
       p9.log.warn(
-        `Skipping cloud-repo push \u2014 the branch tracks secret file(s): ${secretFiles.join(", ")}. Untrack with \`git rm --cached ${secretFiles[0]}\` (add to .gitignore), re-commit, then \`deepspace push\`. Without the push this deploy carries no source lineage: if the live release has one, the server refuses it as stale (--ignore-stale replaces it anyway), and this release's source isn't recoverable until the push works.`
+        `Skipping cloud-repo push \u2014 the branch tracks secret file(s): ${secretFiles.join(", ")}. ` + secretRecoverySentence(secretFiles, "`deepspace push`") + ` Without the push this deploy carries no source lineage: if the live release has one, the server refuses it as stale (--ignore-stale replaces it anyway), and this release's source isn't recoverable until the push works.`
       );
     } else {
       const pushResult = await pushWithTransientRetry(
@@ -6117,7 +6446,14 @@ function workspaceDeployLineage(status3, publishedTip, localTip) {
   if (status3 !== "active") return "inactive";
   return publishedTip === localTip ? "recoverable" : "unsynced";
 }
-function dirtyWorktreeRefusal(branch) {
+function dirtyWorktreeRefusal(branch, cwd) {
+  const conflicted = cwd ? unmergedIndexRefusal(cwd, { ours: "A merge", resume: "deepspace deploy" }) : null;
+  if (conflicted) {
+    return {
+      code: conflicted.code,
+      error: `${conflicted.message} A deploy records the commit it ships, so committing an unresolved merge would ship the markers.`
+    };
+  }
   const workspaceId = workspaceIdFromBranch(branch);
   return {
     code: "dirty_worktree",
@@ -6350,7 +6686,7 @@ async function deployBuiltBundle(options) {
     await bail(
       formatDeployWorkerError(response.status, body.error, body.code),
       "Deploy failed",
-      body.code
+      body.code ?? "deploy_failed"
     );
   }
   p10.log.info(`Platform commit: ${Math.round((Date.now() - commitStarted) / 1e3)}s`);
@@ -7227,6 +7563,7 @@ var RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_WINDOW_MS = 15 * 60 * 1e3;
 var MIN_POLL_MS = 2500;
 var FOLLOW_LAG_MS = 9e4;
+var LOG_RETENTION_DAYS = 7;
 function followInitialLimit(limit, maxLimit) {
   return limit ?? maxLimit;
 }
@@ -7306,23 +7643,23 @@ function formatEvent(e, color, now = Date.now()) {
   if (e.eventType === "exception" && e.exception) {
     tag = paint("31", "ERROR", color);
     const where = e.request ? ` \u2014 ${e.request.method} ${e.request.path}` : "";
-    body = `${e.exception.name}: ${e.exception.message}${where}`;
+    body = displayLines(`${e.exception.name}: ${e.exception.message}${where}`);
     if (e.exception.stack) {
       const lines = e.exception.stack.split("\n");
       const firstIsHeader = lines.length > 0 && !/^\s*at\s/.test(lines[0]) && lines[0].includes(e.exception.message);
       const frames = (firstIsHeader ? lines.slice(1) : lines).map((l) => "    " + l.trim()).filter((l) => l.trim().length > 0);
-      if (frames.length) body += "\n" + paint("2", frames.join("\n"), color);
+      if (frames.length) body += "\n" + paint("2", displayLines(frames.join("\n")), color);
     }
   } else if (e.eventType === "request" && e.request) {
     tag = paint("36", "REQ  ", color);
     const status3 = e.request.status !== void 0 ? ` ${e.request.status}` : "";
     const outcome = e.outcome && e.outcome !== "ok" ? ` (${e.outcome})` : "";
-    body = `${e.request.method} ${e.request.path}${status3}${outcome}`;
+    body = displayLines(`${e.request.method} ${e.request.path}${status3}${outcome}`);
   } else {
     const style = LEVEL_STYLE[e.level];
     tag = (e.level.toUpperCase() + "     ").slice(0, 5);
     if (style) tag = paint(style, tag, color);
-    body = style ? paint(style, e.message, color) : e.message;
+    body = style ? paint(style, displayLines(e.message), color) : displayLines(e.message);
   }
   const client = e.source === "client" ? paint("35", "CLIENT", color) + " " : "";
   return `${time} ${client}${tag} ${body}`;
@@ -7433,16 +7770,33 @@ var logs_default = defineCommand4({
       }
     };
     const first = await fetchPage(initialSince, args.follow ? followLimit : limit, token);
+    if (args.follow && args.json) {
+      process.stdout.write(
+        JSON.stringify({
+          type: "ready",
+          appId,
+          window: windowLabel,
+          count: first.events.length,
+          retentionDays: LOG_RETENTION_DAYS
+        }) + "\n"
+      );
+    }
     print(first.events);
     if (!args.follow) {
       if (first.events.length === 0) {
         if (args.json) {
           process.stdout.write(
-            JSON.stringify({ type: "meta", count: 0, window: windowLabel }) + "\n"
+            JSON.stringify({
+              type: "meta",
+              count: 0,
+              window: windowLabel,
+              appId,
+              retentionDays: LOG_RETENTION_DAYS
+            }) + "\n"
           );
         } else {
           console.log(
-            `No logs in the last ${windowLabel} for ${appId}. New logs can take up to a minute to appear; retention is 7 days.`
+            `No logs in the last ${windowLabel} for ${appId}. New logs can take up to a minute to appear; retention is ${LOG_RETENTION_DAYS} days.`
           );
         }
       } else if (first.truncated) {
@@ -7606,7 +7960,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync20, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync19, realpathSync as realpathSync4 } from "fs";
 import { dirname as dirname10, join as join22, resolve as resolve17 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -7614,7 +7968,7 @@ import { pathToFileURL as pathToFileURL3 } from "url";
 import {
   closeSync,
   copyFileSync,
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   fstatSync,
   mkdirSync as mkdirSync7,
   mkdtempSync,
@@ -7634,7 +7988,7 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   let dir = dirname9(fileURLToPath(moduleUrl));
   for (; ; ) {
     const packagePath = join21(dir, "package.json");
-    if (existsSync19(packagePath)) {
+    if (existsSync20(packagePath)) {
       try {
         const pkg2 = JSON.parse(readFileSync18(packagePath, "utf-8"));
         if (pkg2.name === "deepspace") return dir;
@@ -7647,11 +8001,11 @@ function featurePackageRoot(moduleUrl = import.meta.url) {
   }
 }
 function hasFeatureCatalog(packageRoot = featurePackageRoot()) {
-  return existsSync19(join21(packageRoot, "features"));
+  return existsSync20(join21(packageRoot, "features"));
 }
 function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
   const configPath = join21(packageRoot, "features", id, "feature.json");
-  if (!existsSync19(configPath)) return null;
+  if (!existsSync20(configPath)) return null;
   try {
     const config = JSON.parse(readFileSync18(configPath, "utf-8"));
     if (typeof config.id !== "string" || typeof config.name !== "string" || !Array.isArray(config.files)) {
@@ -7664,7 +8018,7 @@ function readFeatureConfig(id, packageRoot = featurePackageRoot()) {
 }
 function listFeatureConfigs(packageRoot = featurePackageRoot()) {
   const featuresDir = join21(packageRoot, "features");
-  if (!existsSync19(featuresDir)) return [];
+  if (!existsSync20(featuresDir)) return [];
   return readdirSync7(featuresDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => readFeatureConfig(entry.name, packageRoot)).filter((config) => config !== null && !config.internal).sort((a, b) => a.id.localeCompare(b.id));
 }
 function featureCatalog(packageRoot = featurePackageRoot()) {
@@ -7734,9 +8088,9 @@ function installFiles(packageRoot, config, targetDir, emit) {
     const srcPath = join21(packageRoot, "features", config.id, file.src);
     const resolvedDest = resolveFeatureDestPath(file.dest, config.route);
     const destPath = join21(targetDir, resolvedDest);
-    const existed = existsSync19(destPath);
+    const existed = existsSync20(destPath);
     if (existed) preexisting.push(resolvedDest);
-    if (!existsSync19(srcPath)) {
+    if (!existsSync20(srcPath)) {
       emit(`   Warning: source not found: ${file.src}`, "stderr");
       if (!existed) missing.push(resolvedDest);
       continue;
@@ -7774,7 +8128,7 @@ function unresolvedSchema(schema, reason, emit) {
 function integrateSchema(config, targetDir, emit) {
   if (!config.schema) return [];
   const schemasPath = join21(targetDir, "src", "schemas.ts");
-  if (!existsSync19(schemasPath)) {
+  if (!existsSync20(schemasPath)) {
     return [unresolvedSchema(config.schema, "src/schemas.ts was not found.", emit)];
   }
   let content = readFileSync18(schemasPath, "utf-8");
@@ -7831,7 +8185,7 @@ function unresolvedActions(actions, reason, emit) {
 function integrateActions(config, targetDir, emit) {
   if (!config.actions?.length) return [];
   const actionsPath = join21(targetDir, "src", "actions", "index.ts");
-  if (!existsSync19(actionsPath)) {
+  if (!existsSync20(actionsPath)) {
     return [unresolvedActions(config.actions, "src/actions/index.ts was not found.", emit)];
   }
   let content = readFileSync18(actionsPath, "utf-8");
@@ -7881,7 +8235,7 @@ function integrateCode(config, targetDir, emit) {
   const unresolved = [];
   for (const insertion of config.code ?? []) {
     const targetPath = join21(targetDir, insertion.file);
-    if (!existsSync19(targetPath)) {
+    if (!existsSync20(targetPath)) {
       unresolved.push({
         area: "code",
         reason: `${insertion.file} was not found.`,
@@ -7927,7 +8281,7 @@ ${content.slice(
 function integrateIgnore(config, targetDir) {
   if (!config.ignore?.length) return;
   const targetPath = join21(targetDir, ".gitignore");
-  const current = existsSync19(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
+  const current = existsSync20(targetPath) ? readFileSync18(targetPath, "utf-8") : "";
   const present = new Set(current.split(/\r?\n/).map((line) => line.trim()));
   const missing = config.ignore.filter((pattern) => !present.has(pattern));
   if (missing.length === 0) return;
@@ -7944,7 +8298,7 @@ function integrateWrangler(config, targetDir, emit) {
     ...runWorkerFirst ? ["Set assets.run_worker_first = true in wrangler.toml."] : [],
     ...rateLimits.map((binding) => `Add the ${binding.name} rate-limit binding to wrangler.toml.`)
   ];
-  if (!existsSync19(targetPath)) {
+  if (!existsSync20(targetPath)) {
     return [{ area: "wrangler", reason: "wrangler.toml was not found.", steps }];
   }
   let source = readFileSync18(targetPath, "utf-8");
@@ -8024,7 +8378,7 @@ function rateLimitBindingBlock(scope, binding) {
 function integrateCss(packageRoot, config, targetDir, emit) {
   if (!config.css?.length) return [];
   const stylesPath = join21(targetDir, "src", "styles.css");
-  if (!existsSync19(stylesPath)) {
+  if (!existsSync20(stylesPath)) {
     emit("   Warning: Cannot integrate CSS \u2014 src/styles.css not found");
     return [
       {
@@ -8041,7 +8395,7 @@ function integrateCss(packageRoot, config, targetDir, emit) {
   const unresolved = [];
   for (const cssFile of config.css) {
     const srcPath = join21(packageRoot, "features", config.id, cssFile);
-    if (!existsSync19(srcPath)) {
+    if (!existsSync20(srcPath)) {
       emit(`   Warning: CSS source not found: ${cssFile}`, "stderr");
       unresolved.push({
         area: "css",
@@ -8085,7 +8439,7 @@ function routeRolesSuffix(route) {
 function integrateRoute(config, targetDir, emit) {
   if (!config.route) return [];
   const navPath = join21(targetDir, "src", "nav.ts");
-  if (!existsSync19(navPath)) {
+  if (!existsSync20(navPath)) {
     return [unresolvedRoute(config.route, config, "src/nav.ts was not found.", emit)];
   }
   let content = readFileSync18(navPath, "utf-8");
@@ -8163,7 +8517,7 @@ function integrateDependencies(config, targetDir, runInstall, outputVisible, emi
     return { added: [], installRan: false, packageManager };
   }
   const packagePath = join21(targetDir, "package.json");
-  if (!existsSync19(packagePath)) {
+  if (!existsSync20(packagePath)) {
     emit("   Could not patch package.json (file not found)");
     return { added: [], installRan: false, packageManager };
   }
@@ -8241,7 +8595,7 @@ function dependencySnapshot(targetDir) {
 function installedNavFeatures(packageRoot, targetDir) {
   return listFeatureConfigs(packageRoot).filter((feature) => feature.category === "nav" && feature.files.length > 0).filter((feature) => {
     const signature = resolveFeatureDestPath(feature.files[0].dest, feature.route);
-    return existsSync19(join21(targetDir, signature));
+    return existsSync20(join21(targetDir, signature));
   }).map((feature) => feature.id);
 }
 function warnNavConflicts(packageRoot, config, targetDir, emit) {
@@ -8474,9 +8828,9 @@ function renderFeatureInfo(config) {
   return lines.join("\n");
 }
 function isDeepSpaceApp(dir) {
-  if (existsSync20(join22(dir, "wrangler.toml"))) return true;
+  if (existsSync21(join22(dir, "wrangler.toml"))) return true;
   const packagePath = join22(dir, "package.json");
-  if (!existsSync20(packagePath)) return false;
+  if (!existsSync21(packagePath)) return false;
   try {
     const pkg2 = JSON.parse(readFileSync19(packagePath, "utf-8"));
     return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
@@ -8488,7 +8842,7 @@ function installedPackageRoot(fromDir) {
   let dir = fromDir;
   for (; ; ) {
     const candidate = join22(dir, "node_modules", "deepspace");
-    if (existsSync20(join22(candidate, "package.json"))) return candidate;
+    if (existsSync21(join22(candidate, "package.json"))) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -8507,7 +8861,7 @@ async function targetInstaller(appDir) {
   }
   const entry = join22(installedRoot, "dist", "feature-installer.js");
   const catalog = join22(installedRoot, "features");
-  if (!existsSync20(entry) || !existsSync20(catalog)) {
+  if (!existsSync21(entry) || !existsSync21(catalog)) {
     throw new Refusal(
       `The app's installed deepspace package does not contain the typed feature installer.
 Expected: ${entry}
@@ -8600,7 +8954,7 @@ var add_default = defineDeepspaceCommand({
       return { data: { features: featureCatalog(root) } };
     }
     const appDir = resolve17(args.dir ?? ".");
-    if (!existsSync20(appDir)) {
+    if (!existsSync21(appDir)) {
       throw new Refusal(
         `Target directory not found: ${appDir}
 Create a new app first: deepspace app create <name>`,
@@ -8976,7 +9330,7 @@ var domain_default = defineCommand5({
 // src/cli/commands/app-files.ts
 import { defineCommand as defineCommand6 } from "citty";
 import { basename as basename4, resolve as resolve18 } from "path";
-import { existsSync as existsSync21, statSync as statSync2 } from "fs";
+import { existsSync as existsSync22, statSync as statSync2 } from "fs";
 
 // src/cli/lib/app-files-api.ts
 import { createWriteStream, openAsBlob, statSync } from "fs";
@@ -9255,7 +9609,7 @@ var put = defineDeepspaceCommand({
   },
   async run({ args }) {
     const localPath = resolve18(String(args.file));
-    if (!existsSync21(localPath) || !statSync2(localPath).isFile()) {
+    if (!existsSync22(localPath) || !statSync2(localPath).isFile()) {
       throw new Refusal(`No such file: ${args.file}`, "file_not_found");
     }
     const key = requireKey(args.key ?? basename4(localPath));
@@ -9428,8 +9782,8 @@ var list4 = defineDeepspaceCommand({
       }
       if (pending.length) {
         console.log(`PENDING INVITES ON ${app2}`);
-        for (const p35 of pending) {
-          console.log(`  ${p35.email} (expires ${new Date(p35.expiresAt).toLocaleDateString()})`);
+        for (const p36 of pending) {
+          console.log(`  ${p36.email} (expires ${new Date(p36.expiresAt).toLocaleDateString()})`);
         }
       }
     }
@@ -9535,7 +9889,7 @@ var cancel3 = defineDeepspaceCommand({
       `/api/app-collaborators/${encodeURIComponent(app2)}`
     );
     const target2 = email.trim().toLowerCase();
-    const found = pending.find((p35) => p35.email.toLowerCase() === target2);
+    const found = pending.find((p36) => p36.email.toLowerCase() === target2);
     if (!found) {
       throw new Refusal(`${email} has no pending invite on ${app2}`, "no_pending_invite", {
         action: cliAction("deepspace", "app", "collaborators", "list", "--app", app2)
@@ -10137,7 +10491,7 @@ var integrations_default = defineCommand9({
 
 // src/cli/commands/feedback.ts
 import * as p16 from "@clack/prompts";
-import { existsSync as existsSync22, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync21 } from "fs";
 import { dirname as dirname11, join as join23 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
@@ -10165,7 +10519,7 @@ function readCliVersion() {
       join23(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
-      if (!existsSync22(path)) continue;
+      if (!existsSync23(path)) continue;
       const pkg2 = JSON.parse(readFileSync21(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
@@ -10362,6 +10716,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand10 } from "citty";
+import * as p17 from "@clack/prompts";
 import { readFileSync as readFileSync22 } from "fs";
 
 // src/cli/lib/citty-args.ts
@@ -10429,9 +10784,6 @@ async function resolveTarget(args) {
   const appId = await resolveAppTarget(DEPLOY_URL11, token, args.app, { wranglerEnv });
   return { appId, configName, token };
 }
-function fail(err) {
-  renderCliError(err);
-}
 function ok(json, data, human) {
   if (json) console.log(JSON.stringify({ ok: true, ...data }));
   else human();
@@ -10457,22 +10809,18 @@ var list6 = defineCommand10({
     }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
-      if (args.json) {
-        console.log(JSON.stringify({ ok: true, appId: t.appId, config: t.configName, secrets }));
-        return;
-      }
-      if (secrets.length === 0) {
-        console.log(`No secrets in ${t.configName}.`);
-        return;
-      }
-      for (const s of secrets) {
-        console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.updatedAt})`);
-      }
-    } catch (err) {
-      fail(err);
+    const t = await resolveTarget(args);
+    const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
+    if (args.json) {
+      console.log(JSON.stringify({ ok: true, appId: t.appId, config: t.configName, secrets }));
+      return;
+    }
+    if (secrets.length === 0) {
+      console.log(`No secrets in ${t.configName}.`);
+      return;
+    }
+    for (const s of secrets) {
+      console.log(args["only-names"] ? s.key : `${s.key}  (v${s.version}, ${s.updatedAt})`);
     }
   }
 });
@@ -10483,46 +10831,42 @@ var set = defineCommand10({
     secret: { type: "positional", description: "KEY=value (repeatable)", required: true }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const pairs = dedupePositionals(args.secret, args._);
-      const secrets = {};
-      const dupes = [];
-      for (const pair of pairs) {
-        const eq = pair.indexOf("=");
-        if (eq <= 0) throw new InputError(`Expected KEY=value, got "${pair}"`, "invalid_pair");
-        const key = validateSecretName(pair.slice(0, eq));
-        const value = pair.slice(eq + 1);
-        validateSecretValue(key, value);
-        if (key in secrets && !dupes.includes(key)) dupes.push(key);
-        secrets[key] = value;
-      }
-      if (dupes.length) {
-        console.warn(
-          `Warning: ${dupes.join(", ")} given more than once \u2014 kept the last value for each.`
-        );
-      }
-      if (Object.keys(secrets).length === 1) {
-        const [[k, v]] = Object.entries(secrets);
-        await setSecret(DEPLOY_URL11, t.token, t.appId, t.configName, k, v);
-      } else {
-        await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, false);
-      }
-      const n = Object.keys(secrets).length;
-      ok(
-        args.json === true,
-        { appId: t.appId, config: t.configName, set: Object.keys(secrets), ...APPLIES_AT_DEPLOY },
-        () => {
-          console.log(`Set ${n} secret${n === 1 ? "" : "s"} in ${t.configName}.`);
-          if (!warnIfDebugRoutesEnabled(secrets)) {
-            console.log(APPLY_HINT);
-            console.log(LOCAL_DEV_HINT);
-          }
-        }
+    const t = await resolveTarget(args);
+    const pairs = dedupePositionals(args.secret, args._);
+    const secrets = {};
+    const dupes = [];
+    for (const pair of pairs) {
+      const eq = pair.indexOf("=");
+      if (eq <= 0) throw new InputError(`Expected KEY=value, got "${pair}"`, "invalid_pair");
+      const key = validateSecretName(pair.slice(0, eq));
+      const value = pair.slice(eq + 1);
+      validateSecretValue(key, value);
+      if (key in secrets && !dupes.includes(key)) dupes.push(key);
+      secrets[key] = value;
+    }
+    if (dupes.length) {
+      console.warn(
+        `Warning: ${dupes.join(", ")} given more than once \u2014 kept the last value for each.`
       );
-    } catch (err) {
-      fail(err);
     }
+    if (Object.keys(secrets).length === 1) {
+      const [[k, v]] = Object.entries(secrets);
+      await setSecret(DEPLOY_URL11, t.token, t.appId, t.configName, k, v);
+    } else {
+      await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, false);
+    }
+    const n = Object.keys(secrets).length;
+    ok(
+      args.json === true,
+      { appId: t.appId, config: t.configName, set: Object.keys(secrets), ...APPLIES_AT_DEPLOY },
+      () => {
+        console.log(`Set ${n} secret${n === 1 ? "" : "s"} in ${t.configName}.`);
+        if (!warnIfDebugRoutesEnabled(secrets)) {
+          console.log(APPLY_HINT);
+          console.log(LOCAL_DEV_HINT);
+        }
+      }
+    );
   }
 });
 var get2 = defineCommand10({
@@ -10533,32 +10877,34 @@ var get2 = defineCommand10({
     plain: { type: "boolean", description: "Print the plaintext value", default: false }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const key = validateSecretName(args.key);
-      if (args.plain) {
-        const { value } = await getSecretPlain(DEPLOY_URL11, t.token, t.appId, t.configName, key);
-        process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
-        return;
-      }
-      const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
-      const item = secrets.find((s) => s.key === key);
-      if (!item)
-        throw new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found");
-      ok(
-        args.json === true,
-        {
-          appId: t.appId,
-          config: t.configName,
-          key: item.key,
-          version: item.version,
-          updatedAt: item.updatedAt
-        },
-        () => console.log(`${item.key}  (v${item.version}, ${item.updatedAt})`)
+    if (args.plain && args.json === true) {
+      throw new InputError(
+        "--plain writes the raw secret value, which is not JSON. Use --plain to capture the value, or --json for the metadata envelope \u2014 not both.",
+        "invalid_flags"
       );
-    } catch (err) {
-      fail(err);
     }
+    const t = await resolveTarget(args);
+    const key = validateSecretName(args.key);
+    if (args.plain) {
+      const { value } = await getSecretPlain(DEPLOY_URL11, t.token, t.appId, t.configName, key);
+      process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
+      return;
+    }
+    const { secrets } = await listSecrets(DEPLOY_URL11, t.token, t.appId, t.configName);
+    const item = secrets.find((s) => s.key === key);
+    if (!item)
+      throw new InputError(`Secret "${key}" not found in ${t.configName}`, "secret_not_found");
+    ok(
+      args.json === true,
+      {
+        appId: t.appId,
+        config: t.configName,
+        key: item.key,
+        version: item.version,
+        updatedAt: item.updatedAt
+      },
+      () => console.log(`${item.key}  (v${item.version}, ${item.updatedAt})`)
+    );
   }
 });
 var del2 = defineCommand10({
@@ -10568,36 +10914,33 @@ var del2 = defineCommand10({
     key: { type: "positional", description: "Secret name (repeatable)", required: true }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const keys = dedupePositionals(args.key, args._);
-      let deleted = 0;
-      let absent = 0;
-      for (const key of keys) {
-        const name = validateSecretName(key);
-        try {
-          const result = await deleteSecret(DEPLOY_URL11, t.token, t.appId, t.configName, name);
-          if (result.deleted === false) absent++;
-          else deleted++;
-        } catch (err) {
-          if (err?.status === 404) absent++;
-          else throw err;
-        }
+    const t = await resolveTarget(args);
+    const keys = dedupePositionals(args.key, args._);
+    let deleted = 0;
+    let absent = 0;
+    for (const key of keys) {
+      const name = validateSecretName(key);
+      try {
+        const result = await deleteSecret(DEPLOY_URL11, t.token, t.appId, t.configName, name);
+        if (result.deleted === false) absent++;
+        else deleted++;
+      } catch (err) {
+        if (err instanceof ApiError && err.status === 404 && err.code !== "unrecognized_service") {
+          absent++;
+        } else throw err;
       }
-      const note3 = absent > 0 ? ` (${absent} already absent)` : "";
-      ok(
-        args.json === true,
-        { appId: t.appId, config: t.configName, deleted, absent, ...APPLIES_AT_DEPLOY },
-        () => {
-          console.log(
-            `Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`
-          );
-          if (deleted > 0) console.log(APPLY_HINT);
-        }
-      );
-    } catch (err) {
-      fail(err);
     }
+    const note3 = absent > 0 ? ` (${absent} already absent)` : "";
+    ok(
+      args.json === true,
+      { appId: t.appId, config: t.configName, deleted, absent, ...APPLIES_AT_DEPLOY },
+      () => {
+        console.log(
+          `Deleted ${deleted} secret${deleted === 1 ? "" : "s"} from ${t.configName}.${note3}`
+        );
+        if (deleted > 0) console.log(APPLY_HINT);
+      }
+    );
   }
 });
 var upload = defineCommand10({
@@ -10616,30 +10959,26 @@ var upload = defineCommand10({
     }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const secrets = parseSecretsUpload(await readUploadSource(args.file));
-      if (Object.keys(secrets).length === 0)
-        throw new InputError("No secrets found in the input.", "empty_input");
-      await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
-      const uploaded = Object.keys(secrets);
-      ok(
-        args.json === true,
-        {
-          appId: t.appId,
-          config: t.configName,
-          uploaded,
-          replaced: args.replace === true,
-          ...APPLIES_AT_DEPLOY
-        },
-        () => {
-          console.log(`Uploaded ${uploaded.length} secrets to ${t.configName}.`);
-          if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
-        }
-      );
-    } catch (err) {
-      fail(err);
-    }
+    const t = await resolveTarget(args);
+    const secrets = parseSecretsUpload(await readUploadSource(String(args.file)));
+    if (Object.keys(secrets).length === 0)
+      throw new InputError("No secrets found in the input.", "empty_input");
+    await uploadSecrets(DEPLOY_URL11, t.token, t.appId, t.configName, secrets, args.replace);
+    const uploaded = Object.keys(secrets);
+    ok(
+      args.json === true,
+      {
+        appId: t.appId,
+        config: t.configName,
+        uploaded,
+        replaced: args.replace === true,
+        ...APPLIES_AT_DEPLOY
+      },
+      () => {
+        console.log(`Uploaded ${uploaded.length} secrets to ${t.configName}.`);
+        if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
+      }
+    );
   }
 });
 async function readUploadSource(file) {
@@ -10655,10 +10994,11 @@ async function readUploadSource(file) {
   try {
     return readFileSync22(file, "utf-8");
   } catch (err) {
-    if (err.code !== "ENOENT") throw err;
+    const errno = err.code;
+    if (typeof errno !== "string" || errno.length === 0) throw err;
     throw new InputError(
-      `No such file: ${file}. Pass the path of a dotenv or JSON file to upload, or \`-\` to read it from stdin.`,
-      "file_not_found"
+      errno === "ENOENT" ? `No such file: ${file}. Pass the path of a dotenv or JSON file to upload, or \`-\` to read it from stdin.` : `Cannot read ${file} (${errno}).`,
+      errno === "ENOENT" ? "file_not_found" : "file_unreadable"
     );
   }
 }
@@ -10666,6 +11006,17 @@ var download = defineCommand10({
   meta: { name: "download", description: "Download a config\u2019s secrets (dotenv/json/shell)" },
   args: {
     ...COMMON_ARGS,
+    // `download` writes a FILE FORMAT to stdout, so `--json` has no meaning
+    // here and is REFUSED rather than described: rewording it was not enough,
+    // because the flag still silently emitted dotenv — zero JSON documents on
+    // a success path, with the plaintext secrets themselves as the output a
+    // parser choked on. `secrets get --plain --json` already refuses the same
+    // contradiction.
+    json: {
+      type: "boolean",
+      description: "Not supported here \u2014 secrets are a stream; use --format json for JSON output",
+      default: false
+    },
     format: {
       type: "string",
       description: "dotenv (default) | json | shell",
@@ -10673,79 +11024,73 @@ var download = defineCommand10({
     }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const format = args.format;
-      if (!["dotenv", "json", "shell"].includes(format)) {
-        throw new InputError(
-          `Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`,
-          "invalid_format"
-        );
-      }
-      const { secrets } = await fetchSecretsValues(DEPLOY_URL11, t.token, t.appId, t.configName);
-      process.stdout.write(formatSecretsDownload(secrets, format));
-    } catch (err) {
-      fail(err);
+    if (args.json === true) {
+      throw new InputError(
+        "--json is not supported by `secrets download`: it writes the secrets themselves to stdout, not an envelope. Use `--format json` for JSON-shaped secrets, or `secrets list --json` for the metadata envelope.",
+        "invalid_flags"
+      );
+    }
+    const t = await resolveTarget(args);
+    const format = args.format;
+    if (!["dotenv", "json", "shell"].includes(format)) {
+      throw new InputError(
+        `Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`,
+        "invalid_format"
+      );
     }
+    const { secrets } = await fetchSecretsValues(DEPLOY_URL11, t.token, t.appId, t.configName);
+    process.stdout.write(formatSecretsDownload(secrets, format));
   }
 });
 var pull = defineCommand10({
   meta: { name: "pull", description: "Refresh the .dev.vars cache from the app store" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
-    try {
-      const wranglerEnv = args.env?.trim() || void 0;
-      const appDir = findAppDir();
-      if (!appDir)
-        throw new InputError(
-          "Run from a DeepSpace app directory (one containing wrangler.toml).",
-          "not_in_app_repo"
-        );
-      const t = await resolveTarget(args);
-      const ownerId = decodeJwtPayload(t.token).sub;
-      const refreshed = await refreshSecretsCache(
-        DEPLOY_URL11,
-        t.token,
-        t.appId,
-        wranglerEnv,
-        t.configName
-      );
-      await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
-        appId: t.appId,
-        generatedSecretsCache: refreshed.rendered
-      });
-      const count = Object.keys(refreshed.pulled?.values ?? {}).length;
-      ok(
-        args.json === true,
-        { appId: t.appId, config: t.configName, pulled: count },
-        () => console.log(
-          refreshed.pulled ? `Pulled ${count} secrets (${t.configName}) into .dev.vars.` : `Config ${t.configName} does not exist yet; regenerated .dev.vars without app secrets.`
-        )
+    const wranglerEnv = args.env?.trim() || void 0;
+    const appDir = findAppDir();
+    if (!appDir)
+      throw new InputError(
+        "Run from a DeepSpace app directory (one containing wrangler.toml).",
+        "not_in_app_repo"
       );
-    } catch (err) {
-      fail(err);
-    }
+    const t = await resolveTarget(args);
+    const ownerId = decodeJwtPayload(t.token).sub;
+    const refreshed = await refreshSecretsCache(
+      DEPLOY_URL11,
+      t.token,
+      t.appId,
+      wranglerEnv,
+      t.configName
+    );
+    await writeDevVars(appDir, ownerId, t.token, wranglerEnv, {
+      appId: t.appId,
+      generatedSecretsCache: refreshed.rendered
+    });
+    const count = Object.keys(refreshed.pulled?.values ?? {}).length;
+    ok(
+      args.json === true,
+      { appId: t.appId, config: t.configName, pulled: count },
+      () => console.log(
+        refreshed.pulled ? `Pulled ${count} secrets (${t.configName}) into .dev.vars.` : `Config ${t.configName} does not exist yet; regenerated .dev.vars without app secrets.`
+      )
+    );
   }
 });
 var configsList = defineCommand10({
   meta: { name: "list", description: "List the app\u2019s configs" },
   args: { ...COMMON_ARGS },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
-      ok(args.json === true, { appId: t.appId, configs: configs2 }, () => {
-        if (configs2.length === 0) {
-          console.log("No configs yet \u2014 the first `secrets set` creates one.");
-          return;
-        }
-        for (const cfg of configs2) {
-          console.log(`${cfg.name}  (${cfg.secretCount ?? 0} secrets, updated ${cfg.updatedAt})`);
-        }
-      });
-    } catch (err) {
-      fail(err);
-    }
+    const t = await resolveTarget(args);
+    const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
+    ok(args.json === true, { appId: t.appId, configs: configs2 }, () => {
+      if (configs2.length === 0) {
+        console.log("No configs yet \u2014 the first `secrets set` creates one.");
+        return;
+      }
+      for (const cfg of configs2) {
+        console.log(`${cfg.name}  (${cfg.secretCount ?? 0} secrets, updated ${cfg.updatedAt})`);
+      }
+    });
   }
 });
 var configsCreate = defineCommand10({
@@ -10756,55 +11101,80 @@ var configsCreate = defineCommand10({
     "copy-from": { type: "string", description: "Copy secrets from this config", required: false }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const name = validateConfigName(args.name);
-      const copyFrom = args["copy-from"] || void 0;
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
-      if (configs2.some((c) => c.name === name)) {
-        if (copyFrom) {
-          throw new InputError(
-            `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`,
-            "config_exists"
-          );
-        }
-        ok(
-          args.json === true,
-          { appId: t.appId, config: name, created: false },
-          () => console.log(`Config ${name} already exists.`)
+    const t = await resolveTarget(args);
+    const name = validateConfigName(args.name);
+    const copyFrom = args["copy-from"] || void 0;
+    const { configs: configs2 } = await listConfigs(DEPLOY_URL11, t.token, t.appId);
+    if (configs2.some((c) => c.name === name)) {
+      if (copyFrom) {
+        throw new InputError(
+          `Config "${name}" already exists \u2014 refusing to copy "${copyFrom}" over it. Delete it first, or pick a new name.`,
+          "config_exists"
         );
-        return;
       }
-      await createConfig(DEPLOY_URL11, t.token, t.appId, name, copyFrom);
       ok(
         args.json === true,
-        { appId: t.appId, config: name, created: true, ...copyFrom ? { copyFrom } : {} },
-        () => console.log(`Created ${name}.`)
+        { appId: t.appId, config: name, created: false },
+        () => console.log(`Config ${name} already exists.`)
       );
-    } catch (err) {
-      fail(err);
+      return;
     }
+    await createConfig(DEPLOY_URL11, t.token, t.appId, name, copyFrom);
+    ok(
+      args.json === true,
+      { appId: t.appId, config: name, created: true, ...copyFrom ? { copyFrom } : {} },
+      () => console.log(`Created ${name}.`)
+    );
   }
 });
 var configsDelete = defineCommand10({
   meta: { name: "delete", description: "Delete a config and all of its secrets" },
   args: {
     ...COMMON_ARGS,
-    name: { type: "positional", description: "Config name", required: true }
+    name: { type: "positional", description: "Config name", required: true },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the confirmation (required for --json / non-interactive)",
+      default: false
+    }
   },
   async run({ args }) {
-    try {
-      const t = await resolveTarget(args);
-      const name = validateConfigName(args.name);
-      await deleteConfig(DEPLOY_URL11, t.token, t.appId, name);
-      ok(
-        args.json === true,
-        { appId: t.appId, config: name, deleted: true },
-        () => console.log(`Deleted ${name}.`)
+    const t = await resolveTarget(args);
+    const name = validateConfigName(args.name);
+    if (args.yes !== true && (args.json === true || !process.stdin.isTTY)) {
+      throw new InputError(
+        `Deleting config ${name} removes every secret in it permanently. Re-run with --yes to confirm.`,
+        "confirmation_required"
       );
-    } catch (err) {
-      fail(err);
     }
+    let secrets = [];
+    let counted = true;
+    try {
+      secrets = (await listSecrets(DEPLOY_URL11, t.token, t.appId, name)).secrets;
+    } catch (error) {
+      if (args.yes !== true) throw error;
+      counted = false;
+    }
+    const count = secrets.length;
+    if (args.yes !== true) {
+      const detail = count === 0 ? `Config ${name} is empty.` : `Config ${name} holds ${count} secret${count === 1 ? "" : "s"}: ${secrets.map((secret) => secret.key).slice(0, 8).join(", ")}${count > 8 ? `, \u2026` : ""}.`;
+      const confirmed = await p17.confirm({
+        message: `${detail} Deleting it removes ${count === 1 ? "that secret" : "them all"} permanently.`,
+        initialValue: false
+      });
+      if (p17.isCancel(confirmed) || !confirmed) {
+        throw new InputError("Cancelled.", "confirmation_required");
+      }
+    }
+    await deleteConfig(DEPLOY_URL11, t.token, t.appId, name);
+    ok(
+      args.json === true,
+      { appId: t.appId, config: name, deleted: true, secretsDeleted: counted ? count : null },
+      () => console.log(
+        counted ? `Deleted ${name} and ${count} secret${count === 1 ? "" : "s"}.` : `Deleted ${name}.`
+      )
+    );
   }
 });
 var configs = defineCommand10({
@@ -10826,11 +11196,11 @@ var secrets_default = defineCommand10({
 });
 
 // src/cli/commands/init.ts
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 import { join as join24 } from "path";
 var DEPLOY_URL12 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function wranglerConfigUncommitted(appDir) {
-  if (!existsSync23(join24(appDir, ".git"))) return false;
+  if (!existsSync24(join24(appDir, ".git"))) return false;
   const dryRun = runGit(appDir, ["commit", "--dry-run", "-m", "x", "--", "wrangler.toml"], {
     allowFail: true
   });
@@ -10838,7 +11208,7 @@ function wranglerConfigUncommitted(appDir) {
 }
 function commitScaffoldIfUnborn(appDir, token) {
   try {
-    if (!existsSync23(join24(appDir, ".git"))) return false;
+    if (!existsSync24(join24(appDir, ".git"))) return false;
     if (runGit(appDir, ["rev-parse", "--verify", "HEAD"], { allowFail: true }).status === 0) {
       return false;
     }
@@ -10989,8 +11359,8 @@ var init_default = defineDeepspaceCommand({
 
 // src/cli/commands/status.ts
 import { defineCommand as defineCommand11 } from "citty";
-import * as p17 from "@clack/prompts";
-import { existsSync as existsSync24, readFileSync as readFileSync23 } from "fs";
+import * as p18 from "@clack/prompts";
+import { existsSync as existsSync25, readFileSync as readFileSync23 } from "fs";
 function timeAgo(iso) {
   const ms = Date.now() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return iso;
@@ -11002,6 +11372,7 @@ function timeAgo(iso) {
   return `${Math.floor(h / 24)}d ago`;
 }
 var UNREACHABLE = "(unreachable)";
+var sessionError = (error) => ({ state: "unavailable", error, code: "not_authenticated" });
 var observeRemote = (promise) => promise.then(
   (value) => ({ ok: true, value }),
   (error) => ({ ok: false, error })
@@ -11082,13 +11453,14 @@ var status_default = defineCommand11({
       ]);
       if (urlOverrides.length > 0) json.urlOverrides = urlOverrides;
     }
-    facts.loggedIn = existsSync24(SESSION_PATH);
+    facts.loggedIn = existsSync25(SESSION_PATH) || existsSync25(TOKEN_PATH);
     let userId = null;
     if (!facts.loggedIn) {
       lines.push(["Session", "not logged in"]);
       json.loggedIn = false;
+      json.sessionError = sessionError("Not logged in. Run `deepspace auth login` first.");
     } else {
-      let who = "logged in";
+      let who = null;
       try {
         const payload = decodeJwtPayload(
           readFileSync23(TOKEN_PATH, "utf-8").trim()
@@ -11097,9 +11469,12 @@ var status_default = defineCommand11({
         userId = payload.sub ?? null;
       } catch {
       }
-      lines.push(["Session", `${who} \xB7 renews on use (re-login only after 30 idle days)`]);
+      lines.push([
+        "Session",
+        `${who ?? "logged in"} \xB7 renews on use (re-login only after 30 idle days)`
+      ]);
       json.loggedIn = true;
-      json.user = who;
+      if (who) json.user = who;
     }
     const appDir = findAppDir();
     if (!appDir) {
@@ -11158,6 +11533,9 @@ var status_default = defineCommand11({
             lines.push(["Cloud", "session expired \u2014 run `deepspace auth login`"]);
             facts.loggedIn = false;
             json.sessionExpired = true;
+            json.loggedIn = false;
+            delete json.user;
+            json.sessionError = sessionError("Session expired. Run `deepspace auth login`.");
           }
         }
         if (token) {
@@ -11245,9 +11623,13 @@ var status_default = defineCommand11({
           const refs = refsResult.ok ? refsResult.value : void 0;
           const trunkRef = refs?.refs.find((r) => `refs/heads/${branch}` === r.name);
           const defaultBranch = refs?.head && refs.head.startsWith("refs/heads/") ? refs.head.slice("refs/heads/".length) : null;
+          if (!githubSource && refsResult.ok && defaultBranch) json.defaultBranch = defaultBranch;
           if (!facts.workspaceId && branch) {
             const isTrunk = defaultBranch === null ? null : branch === defaultBranch;
             const label = isTrunk === false ? "Branch sync" : "Trunk";
+            if (isTrunk === false && defaultBranch && !githubSource) {
+              lines.push(["Trunk", `${defaultBranch} (this checkout is on ${branch})`]);
+            }
             if (githubSource) {
               lines.push([label, `${branch} is owned through normal Git/GitHub`]);
               json.trunk = { state: "external", provider: "github", branch, isTrunk };
@@ -11276,12 +11658,12 @@ var status_default = defineCommand11({
       return;
     }
     const width = Math.max(...lines.map(([k]) => k.length));
-    for (const [k, v] of lines) p17.log.message(`${k.padEnd(width)}  ${v}`);
+    for (const [k, v] of lines) p18.log.message(displayLines(`${k.padEnd(width)}  ${v}`));
   }
 });
 
 // src/cli/commands/push.ts
-import * as p18 from "@clack/prompts";
+import * as p19 from "@clack/prompts";
 function pullRecoveryAction(cwd, appId, branch) {
   return {
     cwd,
@@ -11298,12 +11680,26 @@ function forcePushOrphansWork(lastPushed, remoteTip, tipOid, tipContainsRemoteTi
   if (remoteTip === lastPushed) return false;
   return !tipContainsRemoteTip;
 }
+function fetchRemoteTip(appDir, token, branch) {
+  try {
+    runGitRemote(appDir, token, [
+      "fetch",
+      "--quiet",
+      "--refmap=",
+      SPACE_REMOTE,
+      `refs/heads/${branch}`
+    ]);
+    return resolveCommit(appDir, "FETCH_HEAD");
+  } catch {
+    return null;
+  }
+}
 function workspaceBranchPushRefusal(branch) {
   const id = workspaceIdFromBranch(branch);
-  if (!id) return null;
+  if (!id && !branch?.startsWith("ws/")) return null;
   return {
     code: "workspace_branch",
-    error: `"${branch}" is a workspace branch (${id}). A plain push moves only the visible ref and bypasses workspace coordination \u2014 the workspace tip, overlap warnings, and activity would go stale. Publish it with \`deepspace workspace sync\` instead.`
+    error: `"${branch}" is in the workspace branch namespace${id ? ` (${id})` : ""}. A plain push moves only the visible ref and bypasses workspace coordination \u2014 the workspace tip, overlap warnings, and activity would go stale. Publish it with \`deepspace workspace sync\` instead.`
   };
 }
 var push_default = defineDeepspaceCommand({
@@ -11326,7 +11722,7 @@ var push_default = defineDeepspaceCommand({
     },
     force: {
       type: "boolean",
-      description: "Allow a non-fast-forward ref move to rewrite history you previously pushed with `deepspace push`. Guarded: refuses whenever the remote tip is a commit your branch does not contain, so no work is silently dropped (a first force from a fresh clone/pull is refused until you re-integrate that tip).",
+      description: "Allow a non-fast-forward ref move to rewrite history you previously pushed with `deepspace push`. Guarded by a per-checkout push record: allowed when THIS checkout published the cloud tip with `deepspace push` (your own amend/rebase), refused when the cloud tip is any other commit your branch does not contain \u2014 so a peer's work is never silently dropped. A plain `git push space` leaves no record, so a force over a tip published that way is refused until you re-integrate it, as is a first force from a fresh clone/pull.",
       default: false
     }
   },
@@ -11390,7 +11786,14 @@ var push_default = defineDeepspaceCommand({
         const { appId: appId2 } = await resolveTarget3();
         const checkoutPath = selectedBranchCheckout(appDir, branch);
         const workspaceId = workspaceIdFromBranch(branch);
-        if (!workspaceId) throw new Error(`Workspace branch did not contain an id: ${branch}`);
+        if (!workspaceId) {
+          spinner2?.stop("Workspace branch.");
+          throw new Refusal(
+            `${wsRefusal.error} "${branch}" carries no workspace id, so nothing can publish it \u2014 rename it out of the \`ws/\` namespace (\`git branch -m ${shQuote(branch)} <name>\`) and push that.`,
+            wsRefusal.code,
+            { extra: { appId: appId2, branch } }
+          );
+        }
         const syncCommand = `deepspace workspace sync --app ${shQuote(appId2)} --workspace ${shQuote(workspaceId)}`;
         const quotedSyncCommand = `\`${syncCommand}\``;
         const message = checkoutPath ? `${wsRefusal.error} Run ${quotedSyncCommand} from its checkout at ${checkoutPath}.` : `${wsRefusal.error} ${branch} exists locally but is not checked out. Check it out in a clean worktree, then run ${quotedSyncCommand}.`;
@@ -11405,16 +11808,23 @@ var push_default = defineDeepspaceCommand({
           extra: { appId: appId2, branch, ...checkoutPath ? { worktreePath: checkoutPath } : {} }
         });
       }
-      const secretFiles = trackedSecretFiles(appDir, tipOid);
+      const secretFiles = secretFilesInPushRange(
+        appDir,
+        resolveCommit(appDir, `refs/remotes/${SPACE_REMOTE}/${branch}`) ?? resolveCommit(appDir, spacePrivateRef(`pushed/${branch}`)),
+        tipOid
+      );
       if (secretFiles.length > 0) {
         const checkoutPath = selectedBranchCheckout(appDir, branch);
-        const checkoutNote = checkoutPath ? "" : ` Check out ${shQuote(branch)} in a clean worktree before untracking it.`;
+        const checkoutNote = checkoutPath ? "" : ` Check out ${shQuote(branch)} in a clean worktree to do it.`;
         throw new Refusal(
-          `Refusing to push: the branch tracks secret file(s) \u2014 ${secretFiles.join(", ")}. These hold local secrets and must not reach the cloud repo. Untrack with \`git rm --cached ${shQuote(secretFiles[0])}\`, ensure it's .gitignored, commit, then push.` + checkoutNote,
+          `Refusing to push: the commits being sent carry secret file(s) \u2014 ${secretFiles.join(", ")}. These hold local secrets and must not reach the cloud repo. ` + secretRecoverySentence(secretFiles, "push") + checkoutNote,
           SECRET_IN_HISTORY_CODE,
           {
-            action: checkoutPath ? { cwd: checkoutPath, argv: ["git", "rm", "--cached", secretFiles[0]] } : void 0,
-            extra: { branch, ...checkoutPath ? { worktreePath: checkoutPath } : {} }
+            extra: {
+              branch,
+              files: secretFiles,
+              ...checkoutPath ? { worktreePath: checkoutPath } : {}
+            }
           }
         );
       }
@@ -11441,11 +11851,11 @@ var push_default = defineDeepspaceCommand({
         throw githubSourceRefusal(appId, sourceState.source.repository);
       }
       const pullRecoveryCwd = selectedBranchCheckout(appDir, branch) ?? appDir;
-      ensureSpaceRemote(appDir, appId);
+      ensureSpaceRemote(appDir, appId, void 0, token);
       if (force) {
         spinner2?.message(`Checking the cloud ${branch} tip before force-push\u2026`);
         const lastPushed = resolveCommit(appDir, spacePrivateRef(`pushed/${branch}`));
-        let remoteTip = null;
+        let remoteTip2 = null;
         try {
           runGitRemote(appDir, token, [
             "fetch",
@@ -11454,7 +11864,7 @@ var push_default = defineDeepspaceCommand({
             SPACE_REMOTE,
             `refs/heads/${branch}`
           ]);
-          remoteTip = resolveCommit(appDir, "FETCH_HEAD");
+          remoteTip2 = resolveCommit(appDir, "FETCH_HEAD");
         } catch {
           const ls = runGitRemote(
             appDir,
@@ -11465,14 +11875,25 @@ var push_default = defineDeepspaceCommand({
             }
           );
           if (ls.status === 0 && ls.stdout.toString("utf-8").trim() === "") {
-            remoteTip = null;
+            remoteTip2 = null;
           } else {
             const error = `Couldn't reach the cloud repo to check ${branch} before force-pushing. Refusing --force so it can't silently drop a peer's commits \u2014 retry when connected, or run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate first.`;
             throw new Refusal(error, "force_unverified", { extra: { appId, branch } });
           }
         }
-        if (remoteTip && forcePushOrphansWork(lastPushed, remoteTip, tipOid, isAncestor(appDir, remoteTip, tipOid))) {
-          const error = `The cloud repo's ${branch} advanced since you last synced \u2014 a peer pushed commit(s) you don't have. Force-pushing now would DROP that work. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase onto it), then push.`;
+        if (remoteTip2 && forcePushOrphansWork(lastPushed, remoteTip2, tipOid, isAncestor(appDir, remoteTip2, tipOid))) {
+          if (isAncestor(appDir, tipOid, remoteTip2)) {
+            throw new Refusal(
+              `The cloud repo's ${branch} is at ${remoteTip2.slice(0, 10)} and already contains everything this checkout has \u2014 this checkout is strictly behind. Force-pushing would REWIND the branch and drop the newer commit(s). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to fast-forward, then push normally if anything is left to publish.`,
+              "behind",
+              {
+                actionRequired: true,
+                action: pullRecoveryAction(pullRecoveryCwd, appId, branch),
+                extra: { appId, branch }
+              }
+            );
+          }
+          const error = `The cloud repo's ${branch} is at ${remoteTip2.slice(0, 10)}, and this checkout has no record of publishing it (\`deepspace push\` records its own pushes; a plain \`git push ${SPACE_REMOTE}\` does not), so a peer's work on top can't be ruled out. Force-pushing now would DROP that line. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase onto it), then push.`;
           throw new Refusal(error, "diverged", {
             actionRequired: true,
             action: pullRecoveryAction(pullRecoveryCwd, appId, branch),
@@ -11484,20 +11905,35 @@ var push_default = defineDeepspaceCommand({
       const result = pushToSpace(appDir, token, `refs/heads/${branch}:refs/heads/${branch}`, {
         force
       });
-      spinner2?.stop(
-        result.status === "up_to_date" ? `${branch} is already up to date at ${tipOid.slice(0, 10)}.` : result.status === "committed" ? `Pushed ${branch} \u2192 ${tipOid.slice(0, 10)}.` : `Push did not complete.`
-      );
       const ok2 = result.status === "up_to_date" || result.status === "committed";
-      if (ok2) {
+      if (result.status === "committed") {
         updateRef(appDir, spacePrivateRef(`pushed/${branch}`), tipOid);
       }
       const recoverable = isRecoverablePushFailure(result.status);
       const rejectReason = result.reason ?? result.summary;
-      const errorMsg = ok2 ? null : result.status === "ref_conflict" ? `The cloud repo's ${branch} moved while you worked (${rejectReason}). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate, then push again.` : result.status === "rejected" ? pushFailureMessage(`The cloud repo rejected ${branch}`, result, appDir ?? void 0) : `The cloud repo's ${branch} has commit(s) your local ${branch} doesn't. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase), then push. Avoid --force here \u2014 it's guarded and will refuse rather than silently drop a peer's commits.`;
-      if (!args.json && ok2) p18.log.info(`App: ${appId}`);
-      const action = recoverable ? pullRecoveryAction(pullRecoveryCwd, appId, branch) : void 0;
+      const rejectedFastForward = !ok2 && result.status === "non_fast_forward" && !force;
+      if (rejectedFastForward) spinner2?.message(`Checking the cloud ${branch} tip\u2026`);
+      const remoteTip = rejectedFastForward ? fetchRemoteTip(appDir, token, branch) : null;
+      const ownRewrite = remoteTip !== null && remoteTip === resolveCommit(appDir, spacePrivateRef(`pushed/${branch}`));
+      const strictlyBehind = remoteTip !== null && !ownRewrite && isAncestor(appDir, tipOid, remoteTip);
+      spinner2?.stop(
+        result.status === "up_to_date" ? `${branch} is already up to date at ${tipOid.slice(0, 10)}.` : result.status === "committed" ? `Pushed ${branch} \u2192 ${tipOid.slice(0, 10)}.` : `Push did not complete.`
+      );
+      const pullNext = `Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` and merge (or rebase onto it), then push.`;
+      const errorMsg = ok2 ? null : result.status === "ref_conflict" ? (
+        // The machine token belongs in `code`, not mid-sentence: the reason
+        // arrives as `<code>: <sentence>`, and printing it raw put
+        // "stale_ref: stale ref, fetch first" inside human prose.
+        `The cloud repo's ${branch} moved while you worked (${parseRefusalCode(rejectReason)?.sentence ?? rejectReason}). Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to integrate, then push again.`
+      ) : result.status === "rejected" ? pushFailureMessage(`The push of ${branch}`, result, appDir ?? void 0) : ownRewrite ? `The cloud repo's ${branch} is exactly the tip THIS checkout last pushed, and your local ${branch} no longer contains it \u2014 you rewrote your own published line (amend/rebase). Publish the rewrite with \`deepspace push --force --branch ${shQuote(branch)}\`: the guard allows it because it discards only your own superseded tip. (Pulling instead would merge the commit you just amended away back in.)` : strictlyBehind ? `The cloud repo's ${branch} is at ${remoteTip.slice(0, 10)} and already contains everything this checkout has \u2014 this checkout is just behind, with nothing of its own to publish. Run \`deepspace pull --app ${shQuote(appId)} --branch ${shQuote(branch)}\` to fast-forward, then push again if anything is left.` : `The cloud repo's ${branch} has commit(s) your local ${branch} doesn't. ${pullNext} Avoid --force here \u2014 it's guarded and will refuse rather than silently drop a peer's commits.`;
+      if (!args.json && ok2) p19.log.info(`App: ${appId}`);
+      const action = ownRewrite ? {
+        cwd: pullRecoveryCwd,
+        argv: ["deepspace", "push", "--force", "--app", appId, "--branch", branch]
+      } : recoverable ? pullRecoveryAction(pullRecoveryCwd, appId, branch) : void 0;
       if (!ok2) {
-        throw new Refusal(errorMsg ?? `Push did not complete.`, result.status, {
+        const code = result.status === "rejected" ? classifyRejection(rejectReason, appDir ?? void 0).code : strictlyBehind ? "behind" : result.status;
+        throw new Refusal(errorMsg ?? `Push did not complete.`, code, {
           actionRequired: recoverable,
           action,
           extra: { status: result.status, appId, branch, oid: tipOid }
@@ -11508,7 +11944,9 @@ var push_default = defineDeepspaceCommand({
       if (err instanceof Refusal) throw err;
       const transportFailure = classifyPushTransportFailure(err, appDir ?? void 0);
       if (transportFailure) {
-        throw new Refusal(transportFailure.error, transportFailure.code);
+        throw new Refusal(transportFailure.error, transportFailure.code, {
+          extra: { gitError: err instanceof Error ? err.message : String(err) }
+        });
       }
       throw err;
     }
@@ -11516,7 +11954,7 @@ var push_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/pull.ts
-import * as p19 from "@clack/prompts";
+import * as p20 from "@clack/prompts";
 import { realpathSync as realpathSync5 } from "fs";
 function targetedVcAction(command, cwd, appId, branch) {
   return {
@@ -11610,7 +12048,7 @@ var pull_default = defineDeepspaceCommand({
     const appId = await resolveAppTarget(deployUrl, token, appArg);
     spinner2?.message(`Checking the cloud ${branch} ref\u2026`);
     const remote = await repoApi(deployUrl, token, appId).getRefs();
-    ensureSpaceRemote(appDir, appId);
+    ensureSpaceRemote(appDir, appId, void 0, token);
     if (!remote) {
       spinner2?.stop("No cloud repo yet.");
       const pushCommand2 = targetedVcCommand("push", appId, branch);
@@ -11778,7 +12216,7 @@ var pull_default = defineDeepspaceCommand({
     const actionRequired = recoveryAction !== void 0;
     spinner2?.stop(codeForState ? `Fetched ${SPACE_REMOTE}/${branch}.` : line);
     if (!args.json)
-      p19.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
+      p20.log.info(`App: ${appId} \xB7 ${SPACE_REMOTE}/${branch} at ${remoteOid.slice(0, 10)}`);
     if (codeForState) {
       throw new Refusal(line, codeForState, {
         actionRequired,
@@ -11797,15 +12235,15 @@ var pull_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/clone.ts
-import * as p20 from "@clack/prompts";
-import { existsSync as existsSync25, readdirSync as readdirSync8, rmSync as rmSync6 } from "fs";
+import * as p21 from "@clack/prompts";
+import { existsSync as existsSync26, readdirSync as readdirSync8, rmSync as rmSync6 } from "fs";
 import { resolve as resolve19, basename as basename5, join as join25 } from "path";
 function cleanFailedCloneDir(dir) {
   let entries;
   try {
     entries = readdirSync8(dir);
   } catch {
-    return existsSync25(dir) ? ["<unreadable>"] : [];
+    return existsSync26(dir) ? ["<unreadable>"] : [];
   }
   if (entries.length === 1 && entries[0] === ".git") {
     try {
@@ -11818,7 +12256,7 @@ function cleanFailedCloneDir(dir) {
   return entries;
 }
 function validateCloneTarget(dir) {
-  if (!existsSync25(dir)) return false;
+  if (!existsSync26(dir)) return false;
   let entries;
   try {
     entries = readdirSync8(dir);
@@ -11892,15 +12330,14 @@ var clone_default = defineDeepspaceCommand({
       }
       throw err;
     }
-    ensureSpaceRemote(dir, appId);
-    ensureGitIdentity(dir, token);
+    ensureSpaceRemote(dir, appId, void 0, token);
     const head = resolveCommit(dir, "HEAD");
     const branch = currentBranch(dir);
     spinner2?.stop(
       `Cloned ${selector} (${branches.length} ${branches.length === 1 ? "branch" : "branches"}) into ${basename5(dir)}/ at ${head?.slice(0, 10) ?? "(unborn)"}.`
     );
     if (!args.json && !branch) {
-      p20.log.warn("HEAD is detached \u2014 check `git branch -a`.");
+      p21.log.warn("HEAD is detached \u2014 check `git branch -a`.");
     }
     return {
       data: {
@@ -11919,7 +12356,7 @@ var clone_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/releases.ts
-import * as p21 from "@clack/prompts";
+import * as p22 from "@clack/prompts";
 
 // src/cli/lib/actor-labels.ts
 var API_URL9 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
@@ -11981,7 +12418,7 @@ var releases_default = defineDeepspaceCommand({
     spinner2?.stop(`Loaded ${releases.length} ${releases.length === 1 ? "release" : "releases"}.`);
     if (!args.json) {
       if (releases.length === 0) {
-        p21.log.info("No releases yet \u2014 the history starts with the next `deepspace deploy`.");
+        p22.log.info("No releases yet \u2014 the history starts with the next `deepspace deploy`.");
       } else {
         const actors = await actorLabels(token, appId);
         for (const r of releases) {
@@ -11991,7 +12428,7 @@ var releases_default = defineDeepspaceCommand({
             `#${r.seq}  ${r.id}  ${r.kind.padEnd(8)}  ${r.createdAt}  ${actors.get(r.actor) ?? r.actor}  ${source}  ${rollback}`
           );
         }
-        p21.log.info(
+        p22.log.info(
           `Roll back an available release with: deepspace rollback <release-id>${wranglerEnv ? ` --env ${wranglerEnv}` : ""}`
         );
       }
@@ -12001,7 +12438,7 @@ var releases_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/rollback.ts
-import * as p22 from "@clack/prompts";
+import * as p23 from "@clack/prompts";
 var REL_ID_RE = /^rel_[0-9A-HJKMNP-TV-Z]{26}$/;
 function unavailableDoGuardRefusal(message) {
   return new Refusal(
@@ -12122,20 +12559,20 @@ Re-run with --allow-do-deletion to accept the data loss.`,
     const doClassGuard = result.doClassGuard === "unverified" ? "unverified" : void 0;
     if (!args.json) {
       if (result.url) {
-        if (serving === "unconfirmed") p22.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
-        else p22.log.success(`Live at: ${result.url}`);
+        if (serving === "unconfirmed") p23.log.warn(`URL: ${result.url} (accepted; serving not yet verified)`);
+        else p23.log.success(`Live at: ${result.url}`);
       }
       if (result.bundleRetained === false) {
-        p22.log.warn(
+        p23.log.warn(
           "The rollback is live, but its bundle was concurrently retired and is not available for a future rollback."
         );
       }
       if (doClassGuard === "unverified") {
-        p22.log.warn(
+        p23.log.warn(
           "DO-class guard bypassed (--allow-do-deletion): this rollback was NOT checked against the live Durable Object classes \u2014 any class the target doesn't declare has been deleted with its data."
         );
       }
-      p22.log.info(
+      p23.log.info(
         "This rollback is itself the newest release \u2014 `deepspace releases` shows the full history."
       );
     }
@@ -12160,24 +12597,24 @@ Re-run with --allow-do-deletion to accept the data loss.`,
 import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
-import * as p25 from "@clack/prompts";
+import * as p26 from "@clack/prompts";
 import { isAbsolute as isAbsolute7, resolve as resolve20 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
-import * as p23 from "@clack/prompts";
+import * as p24 from "@clack/prompts";
 var MAX_OVERLAP_PATHS = 20;
 var PEER_REF_PREFIX = `${spacePrivateRef("peers")}/`;
+function workspaceSyncRelation(dir, headOid, publishedTip) {
+  if (dir === null || headOid === null || publishedTip === null) return "unknown";
+  if (headOid === publishedTip) return "in_sync";
+  if (resolveCommit(dir, publishedTip) === null) return "unknown";
+  if (isAncestor(dir, headOid, publishedTip)) return "behind";
+  if (isAncestor(dir, publishedTip, headOid)) return "ahead";
+  return "diverged";
+}
 function peerWorkspaceRef(workspaceId) {
   return `${PEER_REF_PREFIX}${workspaceId}`;
 }
-function workspaceSyncRelation(dir, localOid, publishedOid) {
-  if (localOid !== null && localOid === publishedOid) return "in_sync";
-  if (localOid === null || publishedOid === null) return "unknown";
-  if (resolveCommit(dir, publishedOid) === null) return "unknown";
-  if (isAncestor(dir, localOid, publishedOid)) return "behind";
-  if (isAncestor(dir, publishedOid, localOid)) return "ahead";
-  return "diverged";
-}
 function formatCount(count) {
   if (!count) return "?";
   return count.capped ? `${count.count}+` : String(count.count);
@@ -12286,16 +12723,16 @@ function printOverlaps(overlaps, json) {
   for (const overlap of overlaps) {
     const sample = overlap.paths.slice(0, 5).join(", ");
     const more = overlap.paths.length - 5 + overlap.morePaths;
-    p23.log.warn(
+    p24.log.warn(
       `Overlap: ${overlap.workspaceId} ("${overlap.task}") also modified ${sample}${more > 0 ? ` (+${more} more)` : ""} \u2014 coordinate before landing.`
     );
   }
 }
 
 // src/cli/commands/workspace/local.ts
-import * as p24 from "@clack/prompts";
+import * as p25 from "@clack/prompts";
 import {
-  existsSync as existsSync26,
+  existsSync as existsSync27,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync24,
   realpathSync as realpathSync6,
@@ -12375,11 +12812,6 @@ function appDirInWorktree(appDir, worktreeRoot) {
   const appRelative = relative4(realpathSync6(repoToplevel(appDir)), realpathSync6(appDir));
   return appRelative ? join26(worktreeRoot, appRelative) : worktreeRoot;
 }
-function primaryAppDir(appDir) {
-  const primary = listWorktrees(appDir)[0];
-  if (!primary) throw new Error("Git did not report a primary worktree");
-  return appDirInWorktree(appDir, primary.path);
-}
 function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId, options = {}) {
   const createdOid = resolveCommit(appDir, startPoint);
   if (!createdOid) throw new Error(`Could not resolve workspace start point ${startPoint}`);
@@ -12533,7 +12965,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
         }
         runGit(mainDir, ["worktree", "prune"], { allowFail: true });
         out.worktreeDir = null;
-        const leftover = existsSync26(linked.path);
+        const leftover = existsSync27(linked.path);
         if (leftover) out.leftoverDir = linked.path;
         else out.worktreeRemoved = linked.path;
         deleteWsBranch(mainDir, branch, expectedBranchOid, out);
@@ -12548,6 +12980,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch, options = {}) {
       deleteWsBranch(mainDir, branch, expectedBranchOid, out);
       return out;
     }
+    runGit(mainDir, ["worktree", "prune"], { allowFail: true });
     if (currentBranch(mainDir) === branch && !switchOffWsBranch(mainDir, trunkBranch)) {
       out.error = `could not switch off ${branch} to delete it`;
       return out;
@@ -12579,7 +13012,7 @@ function cleanupAction(outcome) {
 }
 function reportCleanupHuman(outcome) {
   if (outcome.error) {
-    p24.log.warn(
+    p25.log.warn(
       cleanupRefusalMessage({
         error: outcome.error,
         worktreeDir: outcome.worktreeDir,
@@ -12593,12 +13026,12 @@ function reportCleanupHuman(outcome) {
     outcome.worktreeRemoved ? "worktree" : null,
     outcome.branchDeleted ? `branch ${outcome.branch}` : null
   ].filter(Boolean);
-  if (parts.length) p24.log.success(`Removed ${parts.join(" + ")}.`);
+  if (parts.length) p25.log.success(`Removed ${parts.join(" + ")}.`);
   if (outcome.worktreeRetained) {
-    p24.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
+    p25.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
   }
   if (outcome.worktreeRemoved && outcome.mainDir) {
-    p24.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
+    p25.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
   }
 }
 
@@ -12634,6 +13067,15 @@ async function resolveApiOnly(appArg) {
 function inferWorkspaceId(appDir, explicit) {
   const id = explicit?.trim() || workspaceIdFromBranch(currentBranch(appDir));
   if (!id) {
+    const interrupted = currentBranch(appDir) === null ? interruptedGitOperation(appDir) : null;
+    if (interrupted) {
+      const finish = interrupted === "bisect" ? "end it (`git bisect reset`)" : `finish it (\`git ${interrupted} --continue\`) or abandon it (\`git ${interrupted} --abort\`)`;
+      throw new Refusal(
+        `A ${interrupted} is in progress here, so HEAD is detached and the branch no longer names a workspace. ${finish[0].toUpperCase()}${finish.slice(1)}, then re-run \u2014 the workspace is unchanged either way.`,
+        "git_operation_in_progress",
+        { extra: { operation: interrupted } }
+      );
+    }
     throw new Refusal(
       'Not inside a workspace worktree (the branch is not ws/<id>). Select one with `-w ws_\u2026` (for `workspace drop`, pass the id as the argument), or create one with `deepspace workspace new -t "\u2026"`.',
       "not_in_workspace"
@@ -12679,17 +13121,30 @@ function assertExplicitWorkspaceId(explicit) {
     );
   }
 }
-function pushWorkspaceRef(appDir, token, ref, headOid) {
+function pushWorkspaceRef(appDir, token, ref, headOid, publishedTip) {
   const secret = committedSecretRefusal(appDir, headOid, {
     action: "publish this workspace",
-    then: "re-run the command"
+    then: "re-run the command",
+    // What the cloud already has for this ref, so the scan covers every commit
+    // this publish would upload — which is what the server scans.
+    base: publishedTip ?? null
   });
   if (secret) throw new Refusal(secret.message, secret.code);
   const push = pushToSpace(appDir, token, `${headOid}:${ref}`);
   if (push.status === "committed" || push.status === "up_to_date") return;
   if (push.status === "ref_conflict" || push.status === "non_fast_forward") {
+    const conflicted = unmergedIndexRefusal(appDir, {
+      ours: "The merge this workspace's last pull started",
+      resume: "the command"
+    });
+    if (conflicted) {
+      throw new Refusal(conflicted.message, conflicted.code, {
+        extra: { conflict: true, operation: conflicted.operation }
+      });
+    }
+    const strictlyBehind = typeof publishedTip === "string" && resolveCommit(appDir, publishedTip) !== null && isAncestor(appDir, headOid, publishedTip);
     throw new Refusal(
-      `Another checkout advanced this workspace's line, so publishing yours is not a fast-forward \u2014 the push was refused rather than drop that work. Integrate its tip (\`git pull --no-rebase ${SPACE_REMOTE} ${ref}\`, or re-attach the workspace in a fresh dir), resolve any conflicts, then re-run the command. (Amended or rebased your own commits? Same refusal \u2014 merge your old tip back in.)`,
+      strictlyBehind ? `Another checkout already synced ahead of this one \u2014 nothing of yours is unpublished; this checkout is just behind. Fast-forward it (\`git pull --no-rebase ${SPACE_REMOTE} ${ref}\`), then re-run the command.` : `Another checkout advanced this workspace's line, so publishing yours is not a fast-forward \u2014 the push was refused rather than drop that work. Integrate its tip (\`git pull --no-rebase ${SPACE_REMOTE} ${ref}\`, or re-attach the workspace in a fresh dir), resolve any conflicts, then re-run the command. (Amended or rebased your own commits? Same refusal \u2014 merge your old tip back in.)`,
       push.status,
       {
         actionRequired: true,
@@ -12697,7 +13152,8 @@ function pushWorkspaceRef(appDir, token, ref, headOid) {
       }
     );
   }
-  throw new Refusal(pushFailureMessage("Workspace upload", push, appDir), push.status);
+  const code = push.status === "rejected" ? classifyRejection(push.reason ?? push.summary ?? "", appDir).code : push.status;
+  throw new Refusal(pushFailureMessage("Workspace upload", push, appDir), code);
 }
 
 // src/cli/commands/workspace/new.ts
@@ -12748,8 +13204,7 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       typeof args.app === "string" ? args.app : void 0
     );
     spinner2?.message("Creating workspace\u2026");
-    ensureSpaceRemote(appDir, appId);
-    ensureGitIdentity(appDir, token);
+    ensureSpaceRemote(appDir, appId, void 0, token);
     let baseOid = null;
     const refs = await api4.getRefs();
     if (baseArg) {
@@ -12808,8 +13263,8 @@ var newWorkspaceCommand = defineDeepspaceCommand({
     }
     spinner2?.stop(`Workspace ${id} created.`);
     if (!args.json) {
-      p25.log.info(`Work in: cd ${dir}`);
-      p25.log.info(
+      p26.log.info(`Work in: cd ${dir}`);
+      p26.log.info(
         `Then: commit as usual, \`deepspace workspace sync\` to publish, \`deepspace workspace land\` when done.`
       );
     }
@@ -12830,15 +13285,15 @@ var newWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/attach.ts
-import * as p26 from "@clack/prompts";
-import { existsSync as existsSync27, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync7 } from "fs";
+import * as p27 from "@clack/prompts";
+import { existsSync as existsSync28, readdirSync as readdirSync9, realpathSync as realpathSync7, rmSync as rmSync7 } from "fs";
 import { isAbsolute as isAbsolute8, resolve as resolve21 } from "path";
 function samePath(a, b) {
-  const real = (p35) => {
+  const real = (p36) => {
     try {
-      return realpathSync7(p35);
+      return realpathSync7(p36);
     } catch {
-      return resolve21(p35);
+      return resolve21(p36);
     }
   };
   return real(a) === real(b);
@@ -12851,7 +13306,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync27(dir)) return [];
+  if (!existsSync28(dir)) return [];
   let entries;
   try {
     entries = readdirSync9(dir);
@@ -12910,8 +13365,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
           extra: { status: view2.workspace.status }
         });
       }
-      ensureSpaceRemote(appDir, appId2);
-      ensureGitIdentity(appDir, token2);
+      ensureSpaceRemote(appDir, appId2, void 0, token2);
       const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(appDir, token2, [
         "fetch",
@@ -12933,7 +13387,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       const localTip = resolveCommit(appDir, `refs/heads/${branch}`);
       if (localTip) {
         let existing = resolveWorkspaceWorktree(listWorktrees(appDir), id);
-        if (existing && !existsSync27(existing)) {
+        if (existing && !existsSync28(existing)) {
           runGit(appDir, ["worktree", "prune"], { allowFail: true });
           existing = null;
         }
@@ -12946,10 +13400,10 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
           const existingDir = appDirInWorktree(appDir, existing);
           spinner2?.stop(`Already attached: ${id}.`);
           if (!args.json) {
-            p26.log.info(`Task: ${view2.workspace.task}`);
-            p26.log.info(`Work in: cd ${existingDir}`);
+            p27.log.info(`Task: ${view2.workspace.task}`);
+            p27.log.info(`Work in: cd ${existingDir}`);
             if (!inSync) {
-              p26.log.warn(
+              p27.log.warn(
                 `The checkout is at ${localTip.slice(0, 10)} but the workspace's published tip is ${tip2.slice(0, 10)} \u2014 ${syncAdvice}.`
               );
             }
@@ -12981,10 +13435,10 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
           }
           spinner2?.stop(`Re-attached ${id}.`);
           if (!args.json) {
-            p26.log.info(`Task: ${view2.workspace.task}`);
-            p26.log.info(`Work in: cd ${dir2}`);
+            p27.log.info(`Task: ${view2.workspace.task}`);
+            p27.log.info(`Work in: cd ${dir2}`);
             if (!inSync) {
-              p26.log.warn(
+              p27.log.warn(
                 `The re-materialized checkout is at ${localTip.slice(0, 10)} but the workspace's published tip is ${tip2.slice(0, 10)} \u2014 after installing, ${syncAdvice}.`
               );
             }
@@ -13015,8 +13469,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       materializeWorkspaceWorktree(appDir, worktreeRoot, branch, tip2, id);
       spinner2?.stop(`Attached ${id}.`);
       if (!args.json) {
-        p26.log.info(`Task: ${view2.workspace.task}`);
-        p26.log.info(`Work in: cd ${dir2}`);
+        p27.log.info(`Task: ${view2.workspace.task}`);
+        p27.log.info(`Work in: cd ${dir2}`);
       }
       const action2 = { cwd: dir2, argv: [detectPackageManager(dir2), "install"] };
       return {
@@ -13051,7 +13505,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync27(dir)) {
+    if (existsSync28(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -13065,8 +13519,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     let tip;
     try {
       runGit(process.cwd(), ["init", "--quiet", dir]);
-      ensureSpaceRemote(dir, appId);
-      ensureGitIdentity(dir, token);
+      ensureSpaceRemote(dir, appId, void 0, token);
       const localWorkspaceRef = spacePrivateRef(`workspaces/${id}`);
       runGitRemote(dir, token, [
         "fetch",
@@ -13093,8 +13546,8 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
     spinner2?.stop(`Attached ${id}.`);
     const action = { cwd: dir, argv: [detectPackageManager(dir), "install"] };
     if (!args.json) {
-      p26.log.info(`Task: ${view.workspace.task}`);
-      p26.log.info("Pull app secrets after install if this workspace needs them.");
+      p27.log.info(`Task: ${view.workspace.task}`);
+      p27.log.info("Pull app secrets after install if this workspace needs them.");
     }
     return {
       data: {
@@ -13113,7 +13566,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/sync.ts
-import * as p27 from "@clack/prompts";
+import * as p28 from "@clack/prompts";
 var syncWorkspaceCommand = defineDeepspaceCommand({
   meta: {
     name: "sync",
@@ -13161,15 +13614,13 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
     ]);
     if (before.workspace.status !== "active") {
       spinner2?.stop("Workspace finished.");
-      throw new Refusal(
-        `Workspace ${id} is ${before.workspace.status} \u2014 create a new workspace to continue this line of work.`,
-        "workspace_not_active",
-        { extra: { status: before.workspace.status } }
-      );
+      throw workspaceNotActiveRefusal(id, before.workspace.status, {
+        cwd: appDir,
+        argv: ["deepspace", "workspace", "drop", id, "--app", appId]
+      });
     }
-    ensureSpaceRemote(appDir, appId);
-    ensureGitIdentity(appDir, token);
-    pushWorkspaceRef(appDir, token, before.workspace.ref, headOid);
+    ensureSpaceRemote(appDir, appId, void 0, token);
+    pushWorkspaceRef(appDir, token, before.workspace.ref, headOid, before.tipOid);
     try {
       fetchTrunk(appDir, token, refs?.head ?? null);
     } catch {
@@ -13183,16 +13634,16 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
     const view = upToDate ? before : (await api4.syncWorkspace(id, { headOid })).view;
     const dirty = statusFiles(appDir);
     spinner2?.stop(
-      upToDate ? `Already synced \u2014 ${id} is up to date at ${headOid.slice(0, 10)}.` : changedPaths !== void 0 ? `Synced ${id} \u2192 ${headOid.slice(0, 10)} (${changedPaths.length} ${changedPaths.length === 1 ? "file" : "files"} vs base).` : `Synced ${id} \u2192 ${headOid.slice(0, 10)} (base not present locally \u2014 no overlap report).`
+      upToDate ? `Already synced \u2014 ${id} is up to date at ${headOid.slice(0, 10)}${dirty.length > 0 ? ` (${dirty.length} uncommitted file(s) remain unpublished)` : ""}.` : changedPaths !== void 0 ? `Synced ${id} \u2192 ${headOid.slice(0, 10)} (${changedPaths.length} ${changedPaths.length === 1 ? "file" : "files"} vs base).` : `Synced ${id} \u2192 ${headOid.slice(0, 10)} (base not present locally \u2014 no overlap report).`
     );
     printOverlaps(overlaps, args.json);
     if (!args.json && trunkOverlap.length > 0) {
-      p27.log.warn(
+      p28.log.warn(
         `Trunk already changed ${trunkOverlap.length} file(s) you also touch \u2014 landed work you haven't merged: ${trunkOverlap.slice(0, 5).join(", ")}${trunkOverlap.length > 5 ? ` (+${trunkOverlap.length - 5} more)` : ""}. Merge trunk before landing (\`deepspace workspace status\` shows the full picture).`
       );
     }
     if (!args.json && dirty.length > 0) {
-      p27.log.warn(
+      p28.log.warn(
         `${dirty.length} uncommitted ${dirty.length === 1 ? "file" : "files"} NOT synced \u2014 commit them to this workspace branch (WIP commits are fine \u2014 they land with the merge).`
       );
     }
@@ -13212,7 +13663,7 @@ var syncWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/list.ts
-import * as p28 from "@clack/prompts";
+import * as p29 from "@clack/prompts";
 function withWorkspaceOverlaps(views, overlapsById) {
   return views.map((view) => ({
     ...view,
@@ -13235,21 +13686,24 @@ var listWorkspacesCommand = defineDeepspaceCommand({
       typeof args.app === "string" ? args.app : void 0
     );
     const all = Boolean(args.all);
-    const { views } = await api4.listWorkspaces({ all, limit });
+    const { views, truncated } = await api4.listWorkspaces({ all, limit });
     if (views.length === 0) {
       spinner2?.stop("No workspaces found.");
       if (!args.json) {
-        p28.log.info(
+        p29.log.info(
           all ? "No workspaces." : 'No active workspaces. Create one with `deepspace workspace new -t "\u2026"`.'
         );
       }
-      return { data: { workspaces: views } };
+      return { data: { workspaces: views, truncated: truncated === true } };
     }
     spinner2?.message("Checking workspace overlaps\u2026");
     const overlapsPromise = listOverlaps(appId, token, api4, views);
     if (args.json) {
       return {
-        data: { workspaces: withWorkspaceOverlaps(views, await overlapsPromise) }
+        data: {
+          workspaces: withWorkspaceOverlaps(views, await overlapsPromise),
+          truncated: truncated === true
+        }
       };
     }
     const [actors, overlapsById] = await Promise.all([actorLabels(token, appId), overlapsPromise]);
@@ -13268,13 +13722,18 @@ var listWorkspacesCommand = defineDeepspaceCommand({
         );
       }
     }
-    p28.log.info("\u2191 commits ahead of base \xB7 \u2193 trunk commits since base (staleness)");
-    return { data: { workspaces } };
+    if (truncated) {
+      p29.log.warn(
+        `More workspaces exist than shown \u2014 this is the first ${views.length}. Raise it with \`--limit\` (up to 200); past that, narrow with \`--all\` off or land/drop finished work.`
+      );
+    }
+    p29.log.info("\u2191 commits ahead of base \xB7 \u2193 trunk commits since base (staleness)");
+    return { data: { workspaces, truncated: truncated === true } };
   }
 });
 
 // src/cli/commands/workspace/status.ts
-import * as p29 from "@clack/prompts";
+import * as p30 from "@clack/prompts";
 var workspaceStatusCommand = defineDeepspaceCommand({
   meta: { name: "status", description: "This workspace: base staleness, overlaps, sync state" },
   args: {
@@ -13307,9 +13766,16 @@ var workspaceStatusCommand = defineDeepspaceCommand({
     const baseLocal = resolveCommit(appDir, workspace.baseOid) !== null;
     const behindExact = trunk && baseLocal ? revListCount(appDir, workspace.baseOid, trunk.oid) : null;
     const aheadExact = headOid && baseLocal ? revListCount(appDir, workspace.baseOid, headOid) : null;
-    const unsynced = headOid !== null && view.tipOid !== headOid;
+    const publishedTip = view.tipOid ?? workspace.landedOid;
+    if (publishedTip !== null && resolveCommit(appDir, publishedTip) === null) {
+      runGitRemote(appDir, token, ["fetch", "--quiet", "--refmap=", SPACE_REMOTE, workspace.ref], {
+        allowFail: true
+      });
+    }
+    const headPublished = headOid !== null && publishedTip !== null && (publishedTip === headOid || workspaceDir !== null && resolveCommit(workspaceDir, publishedTip) !== null && isAncestor(workspaceDir, headOid, publishedTip));
+    const unsynced = headOid !== null && !headPublished;
     const dirty = workspaceDir ? statusFiles(workspaceDir) : [];
-    const relation = !unsynced ? "in_sync" : workspace.status !== "active" || !workspaceDir ? "unknown" : workspaceSyncRelation(workspaceDir, headOid, view.tipOid);
+    const relation = workspace.status === "active" && workspaceDir ? workspaceSyncRelation(workspaceDir, headOid, view.tipOid) : "unknown";
     const lines = await loadWorkspaceLines(appDir, token, api4, trunkOid);
     const myTip = headOid ?? resolveCommit(appDir, peerWorkspaceRef(id)) ?? view.tipOid;
     const line = myTip ? lineChangedPaths(appDir, workspace.baseOid, myTip, trunkOid) : null;
@@ -13339,41 +13805,39 @@ var workspaceStatusCommand = defineDeepspaceCommand({
       overlaps
     };
     if (!args.json) {
-      p29.log.info(`Task: ${workspace.task}`);
-      p29.log.info(
+      p30.log.info(`Task: ${workspace.task}`);
+      p30.log.info(
         `Base: ${workspace.baseOid.slice(0, 10)} \xB7 ahead ${aheadExact ?? "?"} commit(s) \xB7 trunk moved ${behindExact ?? "?"} commit(s) since your base`
       );
       if (!attached) {
-        p29.log.info(
-          `Not checked out in this clone \u2014 showing the published state (local HEAD/uncommitted unavailable). Attach it with \`deepspace workspace attach ${id} <dir>\`.`
+        p30.log.info(
+          workspace.status === "active" ? `Not checked out in this clone \u2014 showing the published state (local HEAD/uncommitted unavailable). Attach it with \`deepspace workspace attach ${id} <dir>\`.` : `Not checked out in this clone \u2014 showing the recorded state (the workspace is ${workspace.status}).`
         );
       }
-      if (unsynced) {
-        if (workspace.status === "landed") {
-          p29.log.info(
-            `Already landed${workspace.landedOid ? ` at ${workspace.landedOid.slice(0, 10)}` : ""} \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
-          );
-        } else if (workspace.status === "dropped") {
-          p29.log.info(
-            `Already dropped \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
-          );
-        } else if (relation === "behind") {
-          p29.log.warn(
-            `Local HEAD ${headOid?.slice(0, 10)} is BEHIND the published tip ${view.tipOid?.slice(0, 10)} (another checkout synced ahead) \u2014 fast-forward first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`).`
-          );
-        } else if (relation === "diverged") {
-          p29.log.warn(
-            `Local HEAD ${headOid?.slice(0, 10)} has DIVERGED from the published tip ${view.tipOid?.slice(0, 10)} \u2014 integrate it first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`), then \`deepspace workspace sync\`.`
-          );
-        } else {
-          p29.log.warn(
-            `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
-          );
-        }
+      if (attached && workspace.status === "landed") {
+        p30.log.info(
+          `Already landed${workspace.landedOid ? ` at ${workspace.landedOid.slice(0, 10)}` : ""} \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.` + (unsynced ? " It has commits beyond the landed tip \u2014 nothing can publish them now." : "")
+        );
+      } else if (attached && workspace.status === "dropped") {
+        p30.log.info(
+          `Already dropped \u2014 this checkout is a leftover; \`deepspace workspace drop ${id}\` cleans it up.`
+        );
+      } else if (relation === "behind") {
+        p30.log.warn(
+          `Local HEAD ${headOid.slice(0, 10)} is BEHIND the published tip ${view.tipOid.slice(0, 10)} (another checkout synced ahead) \u2014 fast-forward first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`).`
+        );
+      } else if (relation === "diverged") {
+        p30.log.warn(
+          `Local HEAD ${headOid.slice(0, 10)} has DIVERGED from the published tip ${view.tipOid.slice(0, 10)} \u2014 integrate it first (\`git pull --no-rebase ${SPACE_REMOTE} ${workspace.ref}\`), then \`deepspace workspace sync\`.`
+        );
+      } else if (unsynced) {
+        p30.log.warn(
+          `Local HEAD ${headOid?.slice(0, 10)} is not synced (server has ${view.tipOid?.slice(0, 10) ?? "nothing"}) \u2014 run \`deepspace workspace sync\`.`
+        );
       }
-      if (dirty.length > 0) p29.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
+      if (dirty.length > 0) p30.log.warn(`${dirty.length} uncommitted file(s) in the worktree.`);
       if (trunkOverlap.length > 0) {
-        p29.log.warn(
+        p30.log.warn(
           `Trunk also modified: ${trunkOverlap.slice(0, 5).join(", ")}${trunkOverlap.length > 5 ? ` (+${trunkOverlap.length - 5} more)` : ""} \u2014 expect merge attention at land time.`
         );
       }
@@ -13384,7 +13848,7 @@ var workspaceStatusCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/land.ts
-import * as p30 from "@clack/prompts";
+import * as p31 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
@@ -13432,10 +13896,27 @@ function conflictMarkerFiles(diffCheckOutput) {
   }
   return [...files];
 }
-function pullAfterLandAction(primaryDir, intoBranch, landedOid) {
-  if (currentBranch(primaryDir) !== intoBranch) return null;
-  if (resolveCommit(primaryDir, "HEAD") === landedOid) return null;
-  return executableAction({ cwd: primaryDir, argv: ["deepspace", "pull"] });
+function staleTrunkPullAction(trunkCheckoutDir, intoBranch, appArg) {
+  return executableAction({
+    cwd: trunkCheckoutDir,
+    argv: [
+      "deepspace",
+      "pull",
+      "-b",
+      intoBranch,
+      // The trunk checkout is a DIFFERENT directory; carry `-a` when the
+      // caller named an app, or the action could resolve a different one
+      // from that cwd.
+      ...appArg && appArg.trim() ? ["-a", appArg.trim()] : []
+    ]
+  });
+}
+function staleTrunkCheckout(appDir, intoBranch, landedOid) {
+  const dir = listWorktrees(appDir).find((worktree) => worktree.branch === intoBranch)?.path ?? null;
+  if (dir === null) return null;
+  const localTip = resolveCommit(dir, `refs/heads/${intoBranch}`);
+  if (localTip === null || localTip === landedOid) return null;
+  return isAncestor(dir, localTip, landedOid) ? dir : null;
 }
 function landResumeArgv(args) {
   const argv = ["deepspace", "workspace", "land"];
@@ -13533,11 +14014,10 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       spinner2?.stop("Workspace finished.");
       throw workspaceNotActiveRefusal(id, view.workspace.status, dropAction);
     }
-    ensureSpaceRemote(appDir, appId);
-    ensureGitIdentity(appDir, token);
+    ensureSpaceRemote(appDir, appId, void 0, token);
     const isResumedMerge = resolveCommit(appDir, "HEAD^2") !== null && view.tipOid !== null && resolveCommit(appDir, "HEAD^") === view.tipOid;
     if (!isResumedMerge) {
-      pushWorkspaceRef(appDir, token, view.workspace.ref, headBefore);
+      pushWorkspaceRef(appDir, token, view.workspace.ref, headBefore, view.tipOid);
     }
     const intoBranch = intoArg?.trim() || (refs?.head?.startsWith("refs/heads/") ? refs.head.slice("refs/heads/".length) : null);
     if (!intoBranch) {
@@ -13655,7 +14135,11 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     }
     const trunkSecret = committedSecretRefusal(appDir, resolveCommit(appDir, "HEAD"), {
       action: `land onto ${intoBranch}`,
-      then: "re-run the land"
+      then: "re-run the land",
+      // The fetched trunk tip is what this push uploads against, so the scan
+      // covers exactly the commits the merge carries onto trunk — the same
+      // range the server scans.
+      base: remoteTip
     });
     if (trunkSecret) {
       spinner2?.stop("Secret in history.");
@@ -13667,7 +14151,10 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     if (push.status === "ref_conflict" || push.status === "non_fast_forward") {
       spinner2?.stop("Trunk moved.");
       throw new Refusal(
-        `${intoBranch} moved while you merged (${push.reason ?? push.summary}). Re-run \`${resumeNext}\` to integrate the new tip.`,
+        // The machine token belongs in `code`, not mid-sentence: the reason
+        // arrives as `<code>: <sentence>`, and printing it raw put
+        // "stale_ref: stale ref, fetch first" inside human prose.
+        `${intoBranch} moved while you merged (${parseRefusalCode(push.reason ?? push.summary)?.sentence ?? push.reason ?? push.summary}). Re-run \`${resumeNext}\` to integrate the new tip.`,
         "trunk_moved",
         {
           actionRequired: true,
@@ -13679,8 +14166,8 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     if (push.status === "rejected") {
       spinner2?.stop("Push rejected.");
       throw new Refusal(
-        `The cloud repo rejected the land push: ${push.reason ?? push.summary}.`,
-        "push_rejected"
+        pushFailureMessage("The land push", push, appDir),
+        classifyRejection(push.reason ?? push.summary ?? "", appDir).code
       );
     }
     try {
@@ -13715,8 +14202,13 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       );
     }
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
-    const primaryDir = primaryAppDir(appDir);
-    const action = pullAfterLandAction(primaryDir, intoBranch, landedOid);
+    const trunkCheckoutDir = staleTrunkCheckout(appDir, intoBranch, landedOid);
+    const localTrunkBehind = trunkCheckoutDir !== null;
+    const action = trunkCheckoutDir ? staleTrunkPullAction(
+      trunkCheckoutDir,
+      intoBranch,
+      typeof args.app === "string" ? args.app : void 0
+    ) : null;
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch, { expectedBranchOid: landedOid });
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
     const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree || inOwnWorktree ? appDir : null);
@@ -13724,6 +14216,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
       workspaceId: id,
       into: intoBranch,
       landedOid,
+      ...localTrunkBehind ? { localTrunkBehind: true } : {},
       ...validationResult ? { validation: validationResult } : {},
       ...retainedWorktree ? { worktree: retainedWorktree } : {},
       ...cleanup ? { cleanup: cleanupJson(cleanup) } : {}
@@ -13731,7 +14224,12 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     if (!args.json && cleanup && !cleanup.error) {
       reportCleanupHuman(cleanup);
     } else if (!args.json && retainedWorktree) {
-      p30.log.info(`Retained checkout: ${retainedWorktree}`);
+      p31.log.info(`Retained checkout: ${retainedWorktree}`);
+    }
+    if (!args.json && localTrunkBehind) {
+      p31.log.info(
+        `Local ${intoBranch} in ${trunkCheckoutDir} is behind the landed merge \u2014 run \`deepspace pull\` there to catch up.`
+      );
     }
     if (cleanup?.error) {
       const action2 = cleanupAction({
@@ -13755,31 +14253,23 @@ var landWorkspaceCommand = defineDeepspaceCommand({
 });
 
 // src/cli/commands/workspace/drop.ts
-import * as p31 from "@clack/prompts";
+import * as p32 from "@clack/prompts";
 function isWorkspaceTipPublished(appDir, localTip, publishedOids) {
   return publishedOids.some(
     (publishedOid) => publishedOid === localTip || isAncestor(appDir, localTip, publishedOid)
   );
 }
 function workspaceUnsyncedRefusal(args) {
-  const dropKeepArgv = [
-    "deepspace",
-    "workspace",
-    "drop",
-    args.id,
-    "--app",
-    args.appId,
-    "--keep-worktree"
-  ];
+  const dropArgv = ["deepspace", "workspace", "drop", args.id, "--app", args.appId];
   if (args.status !== "active") {
+    const keepArgv = [...dropArgv, "--keep-worktree"];
     return new Refusal(
-      `${args.id} is already ${args.status} on the server, and this checkout has committed work that was never published \u2014 nothing can publish it now. Keep it with \`${humanCommand(dropKeepArgv)}\` (retains the branch/worktree for manual disposal), or delete the branch yourself. Nothing was dropped.`,
+      `${args.id} is already ${args.status} on the server, and this checkout holds commits that nothing in the cloud represents any more \u2014 nothing can publish them now. \`${humanCommand(keepArgv)}\` drops the cloud workspace but retains the local branch/worktree for manual disposal, or delete the branch yourself. Nothing was dropped.`,
       "workspace_unsynced",
       { extra: { workspaceId: args.id, status: args.status } }
     );
   }
   const syncArgv = ["deepspace", "workspace", "sync", "--app", args.appId, "--workspace", args.id];
-  const dropArgv = ["deepspace", "workspace", "drop", args.id, "--app", args.appId];
   const publish = args.workspaceDir ? `Publish them first with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.` : `Recreate a worktree from the branch (\`git worktree add <dir> ${args.branch}\`), publish from there with \`${humanCommand(syncArgv)}\`, then re-run \`${humanCommand(dropArgv)}\`.`;
   return new Refusal(
     `${args.id} has committed work that isn't published yet. ${publish} Alternatively, pass \`--keep-worktree\` to drop the cloud workspace while retaining the local branch/worktree for manual disposal. Nothing was dropped.`,
@@ -13817,6 +14307,11 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
       description: "Keep the local worktree and branch after dropping",
       default: false
     },
+    "abandon-unseen": {
+      type: "boolean",
+      description: "Drop even though this checkout has not seen the published tip \u2014 an explicit decision to abandon commits you have not read (workspace_behind)",
+      default: false
+    },
     app: APP_ARG
   },
   async run({ args }) {
@@ -13824,28 +14319,63 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     assertExplicitWorkspaceId(explicitId);
     const appArg = typeof args.app === "string" ? args.app : void 0;
     const keepWorktree = Boolean(args["keep-worktree"]);
+    const abandonUnseen = Boolean(args["abandon-unseen"]);
     const spinner2 = args.json ? null : createSpinner();
     spinner2?.start(`Preparing to drop ${explicitId ?? "workspace"}\u2026`);
-    if (!findAppDir() && explicitId) {
-      const { api: api5 } = await resolveApiOnly(appArg);
-      const statusBefore = (await api5.getWorkspace(explicitId)).view.workspace.status;
-      const { view: view2, remoteDropped: remoteDropped2 } = await dropRemoteTolerant(api5, explicitId, statusBefore);
-      spinner2?.stop();
-      if (!args.json) {
-        p31.log.success(
-          remoteDropped2 ? `Dropped ${explicitId}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${explicitId} was already ${view2.workspace.status} on the server \u2014 nothing to drop remotely.`
+    const inCheckout = findAppDir() !== null || !explicitId;
+    const { appDir, appId, token, api: api4 } = inCheckout ? await resolveTarget2(appArg) : { appDir: null, ...await resolveApiOnly(appArg) };
+    const id = appDir ? inferWorkspaceId(appDir, explicitId) : explicitId;
+    const inspection = appDir ? inspectWorkspaceCleanup(appDir, id) : null;
+    let approvedBranchOid;
+    const { view: before } = await api4.getWorkspace(id);
+    if (before.workspace.status === "active" && before.tipOid !== null) {
+      if (appDir) {
+        ensureSpaceRemote(appDir, appId, void 0, token);
+        if (resolveCommit(appDir, before.tipOid) === null) {
+          runGitRemote(
+            appDir,
+            token,
+            ["fetch", "--quiet", "--refmap=", SPACE_REMOTE, before.workspace.ref],
+            { allowFail: true }
+          );
+        }
+      }
+      const relation = workspaceSyncRelation(appDir, inspection?.branchOid ?? null, before.tipOid);
+      if (!abandonUnseen && relation !== "in_sync" && relation !== "ahead") {
+        const pullArgv = ["git", "pull", "--no-rebase", SPACE_REMOTE, before.workspace.ref];
+        const attachArgv = ["deepspace", "workspace", "attach", id, "--app", appId];
+        const abandonCommand = humanCommand([
+          "deepspace",
+          "workspace",
+          "drop",
+          id,
+          "--app",
+          appId,
+          "--abandon-unseen"
+        ]);
+        const worktreeDir = inspection?.checkout.dir ?? null;
+        throw new Refusal(
+          `Dropping ${id} would discard its published tip ${before.tipOid.slice(0, 10)}, which this seat has not read (${relation}) \u2014 integrate it first, or run \`${abandonCommand}\` to abandon it unread. Nothing was dropped.`,
+          "workspace_behind",
+          {
+            action: worktreeDir ? { cwd: worktreeDir, argv: pullArgv } : appDir ? { cwd: appDir, argv: attachArgv } : void 0,
+            extra: {
+              workspaceId: id,
+              publishedTip: before.tipOid,
+              localTip: inspection?.branchOid ?? null,
+              relation
+            }
+          }
         );
       }
-      return { data: { workspaceId: explicitId, status: view2.workspace.status, remoteDropped: remoteDropped2 } };
     }
-    const { appDir, appId, token, api: api4 } = await resolveTarget2(appArg);
-    const id = inferWorkspaceId(appDir, explicitId);
-    const inspection = inspectWorkspaceCleanup(appDir, id);
-    let approvedBranchOid;
-    const { view: before } = await api4.getWorkspace(id);
-    if (!keepWorktree && inspection.willDeleteBranch && inspection.branchOid) {
+    if (appDir && inspection && !keepWorktree && inspection.willDeleteBranch && inspection.branchOid) {
       const publishedOids = [
-        before.tipOid,
+        // A FINISHED workspace's own ref is being reaped — it can prove
+        // nothing. Only trunk (landed) or the pre-existing base counts, or a
+        // dropped workspace's last local copy gets deleted on the strength of
+        // the very ref that is going away.
+        ...before.workspace.status === "active" ? [before.tipOid] : [],
         before.workspace.landedOid,
         before.workspace.baseOid
       ].filter((oid) => oid !== null);
@@ -13873,37 +14403,56 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
       }
       approvedBranchOid = inspection.branchOid;
     }
-    const cleanupDir = inspection.willDeleteBranch ? inspection.checkout.dir : null;
+    const cleanupDir = inspection?.willDeleteBranch ? inspection.checkout.dir : null;
     if (!keepWorktree && cleanupDir && !isWorkTreeClean(cleanupDir)) {
       const dropArgv = ["deepspace", "workspace", "drop", id, "--app", appId];
       const dropNext = humanCommand(dropArgv);
+      const conflicted = unmergedIndexRefusal(cleanupDir, {
+        ours: "A merge",
+        resume: dropNext
+      });
+      if (conflicted) {
+        throw new Refusal(
+          `${conflicted.message} Or pass \`--keep-worktree\` to drop the workspace while retaining this checkout. Nothing was dropped.`,
+          conflicted.code,
+          { extra: { workspaceId: id, conflict: true, operation: conflicted.operation } }
+        );
+      }
       throw new Refusal(
         `The workspace checkout has uncommitted changes and cleanup would remove it or switch it off ${inspection.branch}. Commit them and re-run \`${dropNext}\`, or pass \`--keep-worktree\` to drop while retaining the checkout. Nothing was dropped.`,
         "dirty_worktree",
         { extra: { workspaceId: id } }
       );
     }
-    const { view, remoteDropped } = await dropRemoteTolerant(api4, id, before.workspace.status);
-    spinner2?.message(`Cleaning up ${id} locally\u2026`);
-    const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, null, {
+    const statusBefore = (await api4.getWorkspace(id)).view.workspace.status;
+    const { view, remoteDropped } = await dropRemoteTolerant(api4, id, statusBefore);
+    if (appDir && !keepWorktree) spinner2?.message(`Cleaning up ${id} locally\u2026`);
+    const cleanup = appDir && inspection && !keepWorktree ? cleanupWorkspaceLocal(appDir, id, null, {
       expectedBranchOid: approvedBranchOid,
       retainLocal: !inspection.willDeleteBranch
-    });
-    const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree ? inspection.checkout.dir : null);
+    }) : null;
+    const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree ? inspection?.checkout.dir ?? null : null);
+    const discardedTip = remoteDropped && before.tipOid && (!inspection?.branchOid || abandonUnseen) ? before.tipOid : null;
     const data = {
       workspaceId: id,
       status: view.workspace.status,
       remoteDropped,
+      ...discardedTip ? { discardedTip } : {},
       ...retainedWorktree ? { worktree: retainedWorktree } : {},
       ...cleanup ? { cleanup: cleanupJson(cleanup) } : {}
     };
     spinner2?.stop();
     if (!args.json) {
-      p31.log.success(
-        remoteDropped ? `Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${id} was already ${view.workspace.status} on the server \u2014 nothing to drop remotely.`
+      p32.log.success(
+        remoteDropped ? `Dropped ${id}. Its ref sticks around briefly for undo, then is reaped.` : `Workspace ${id} was already ${statusBefore} on the server \u2014 nothing to drop remotely.`
       );
+      if (discardedTip) {
+        p32.log.warn(
+          `The published tip ${discardedTip.slice(0, 10)} was abandoned unread \u2014 this seat could not prove it had read it. Its ref is retained briefly if that was a mistake.`
+        );
+      }
       if (cleanup && !cleanup.error) reportCleanupHuman(cleanup);
-      else if (retainedWorktree) p31.log.info(`Retained checkout: ${retainedWorktree}`);
+      else if (retainedWorktree) p32.log.info(`Retained checkout: ${retainedWorktree}`);
     }
     if (cleanup?.error) {
       const action = cleanupAction({
@@ -13944,7 +14493,7 @@ var workspace_default = defineCommand12({
 });
 
 // src/cli/commands/activity.ts
-import * as p32 from "@clack/prompts";
+import * as p33 from "@clack/prompts";
 var FOLLOW_INTERVAL_MS = 5e3;
 function landIndex(events) {
   const m = /* @__PURE__ */ new Map();
@@ -13958,12 +14507,16 @@ function landIndex(events) {
 function formatEvent2(e, lands, actors) {
   const s = e.summary ?? {};
   const short = (oid) => typeof oid === "string" ? oid.slice(0, 10) : "?";
+  const isZeroOid = (oid) => typeof oid === "string" && /^0{40}$/.test(oid);
   const who = (id) => typeof id === "string" ? actors?.get(id) ?? id : String(id ?? "?");
   let detail = "";
   switch (e.kind) {
     case "push": {
       const refs = Array.isArray(s.refs) ? s.refs : [];
-      detail = refs.map((r) => `${String(r.ref ?? "").replace("refs/heads/", "")} \u2192 ${short(r.newOid)}`).join(", ");
+      detail = refs.map((r) => {
+        const name = String(r.ref ?? "").replace("refs/heads/", "");
+        return isZeroOid(r.newOid) ? `deleted ${name}` : `${name} \u2192 ${short(r.newOid)}`;
+      }).join(", ");
       const landWs = refs.map((r) => typeof r.newOid === "string" ? lands?.get(r.newOid) : void 0).find(Boolean);
       if (landWs) detail += ` (land of ${landWs})`;
       break;
@@ -13991,7 +14544,7 @@ function formatEvent2(e, lands, actors) {
     default:
       detail = "";
   }
-  return `#${e.seq}  ${e.createdAt}  ${e.kind}  ${who(e.actor)}  ${detail}`.trimEnd();
+  return displayText(`#${e.seq}  ${e.createdAt}  ${e.kind}  ${who(e.actor)}  ${detail}`.trimEnd());
 }
 var activity_default = defineDeepspaceCommand({
   meta: {
@@ -14060,7 +14613,7 @@ var activity_default = defineDeepspaceCommand({
           const lands = landIndex(page.events);
           for (const e of page.events) console.log(formatEvent2(e, lands, actors));
           if (page.events.length === 0 && !args.follow) {
-            p32.log.info(cursor > 0 ? `No activity after #${cursor}.` : "No activity yet.");
+            p33.log.info(cursor > 0 ? `No activity after #${cursor}.` : "No activity yet.");
           }
         }
         cursor = page.cursor;
@@ -14070,7 +14623,7 @@ var activity_default = defineDeepspaceCommand({
         }
         if (!args.follow) {
           if (page.events.length > 0) {
-            p32.log.info(
+            p33.log.info(
               `Cursor: ${cursor}` + (page.hasMore ? ` \xB7 more available (next page: --since ${cursor})` : ` (resume later with --since ${cursor})`)
             );
           }
@@ -14092,7 +14645,7 @@ var activity_default = defineDeepspaceCommand({
             })
           );
         } else {
-          p32.log.warn(`Activity feed interrupted (${code}); retrying in 5s.`);
+          p33.log.warn(`Activity feed interrupted (${code}); retrying in 5s.`);
         }
       }
       await new Promise((resolveSleep) => setTimeout(resolveSleep, FOLLOW_INTERVAL_MS));
@@ -14143,13 +14696,6 @@ function declineHint(op, input, token, deployUrl) {
   }
   return "";
 }
-async function readStdin() {
-  if (process.stdin.isTTY) return "";
-  process.stdin.setEncoding("utf-8");
-  let data = "";
-  for await (const chunk of process.stdin) data += chunk;
-  return data;
-}
 var git_credential_default = defineCommand13({
   meta: {
     name: "git-credential",
@@ -14164,7 +14710,7 @@ var git_credential_default = defineCommand13({
   },
   async run({ args }) {
     const op = String(args.op ?? "");
-    const input = await readStdin();
+    const input = process.stdin.isTTY ? "" : await readStreamText(process.stdin, MAX_STDIN_BYTES);
     if (op !== "get") return;
     const url = deployBaseUrl();
     let token = null;
@@ -14185,7 +14731,7 @@ var git_credential_default = defineCommand13({
 });
 
 // src/cli/commands/source.ts
-import * as p33 from "@clack/prompts";
+import * as p34 from "@clack/prompts";
 var TRANSFER_PREFIX = spacePrivateRef("source-transfer");
 var source_default = defineDeepspaceCommand({
   meta: {
@@ -14239,14 +14785,14 @@ var source_default = defineDeepspaceCommand({
     const reconciliation = reconcileSpaceRemote(appDir, appId, result.source);
     const spaceRemote = reconciliation.spaceRemote;
     if (!args.json) {
-      p33.log.success(
+      p34.log.success(
         result.source.provider === "github" ? `Source: GitHub \xB7 ${result.source.repository} (revision ${result.revision})` : `Source: DeepSpace (revision ${result.revision})`
       );
-      p33.log.info(
+      p34.log.info(
         spaceRemote === "removed" ? `Removed the \`${SPACE_REMOTE}\` git remote \u2014 DeepSpace no longer owns this repo.` : spaceRemote === "absent" ? `No \`${SPACE_REMOTE}\` git remote to remove \u2014 source operations go through GitHub.` : spaceRemote === "present" ? `The \`${SPACE_REMOTE}\` git remote points at this app's cloud repo.` : `The local \`${SPACE_REMOTE}\` git remote still needs reconciliation.`
       );
       if (reconciliation.localReconciliation) {
-        p33.log.warn(reconciliation.localReconciliation.message);
+        p34.log.warn(reconciliation.localReconciliation.message);
       }
     }
     return {
@@ -14482,14 +15028,14 @@ function sameRefs(left, right) {
 }
 
 // src/cli/commands/update.ts
-import * as p34 from "@clack/prompts";
-import { existsSync as existsSync28, readFileSync as readFileSync26 } from "fs";
+import * as p35 from "@clack/prompts";
+import { existsSync as existsSync29, readFileSync as readFileSync26 } from "fs";
 import { join as join28, resolve as resolve22 } from "path";
 
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.24.1",
+  version: "0.25.0",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },
@@ -14565,7 +15111,7 @@ var package_default = {
     "cross-spawn": "^7.0.6",
     esbuild: "^0.27.0",
     "highlight.js": "^11.11.1",
-    hono: "^4.6.0",
+    hono: "^4.12.34",
     jose: "^6.1.0",
     marked: "^18.0.7",
     "mdast-util-gfm": "^3.1.0",
@@ -14667,7 +15213,7 @@ function gapIsTooWide(from, to) {
 }
 function readManifest(appDir) {
   const path = join28(appDir, "package.json");
-  if (!existsSync28(path)) {
+  if (!existsSync29(path)) {
     throw new Refusal("This app has no package.json \u2014 nothing to update.", "not_in_app_repo");
   }
   try {
@@ -14706,7 +15252,7 @@ function planDependencyGuidance(appDir) {
 function usersSchemaVisibilityUpgradeInstruction(appDir) {
   const schemaName = "src/schemas/users-schema.ts";
   const path = join28(appDir, schemaName);
-  if (!existsSync28(path)) return null;
+  if (!existsSync29(path)) return null;
   const source = readFileSync26(path, "utf8");
   if (!/\bmember\s*:\s*\{[^}]*\bread\s*:\s*true\b/s.test(source)) return null;
   return `${schemaName}: review member user-row visibility at ${USERS_SCHEMA_VISIBILITY_GUIDE}; leave the app-owned schema unchanged until you choose its policy.`;
@@ -14744,7 +15290,7 @@ var update_default = defineDeepspaceCommand({
     } : null;
     if (versionGuidance) {
       const steps2 = [versionGuidance.step];
-      if (!args.json) p34.log.warn(versionGuidance.step);
+      if (!args.json) p35.log.warn(versionGuidance.step);
       return {
         data: {
           ready: false,
@@ -14780,9 +15326,9 @@ var update_default = defineDeepspaceCommand({
     ];
     const status3 = unverifiedSdk ? "dependency_unverified" : steps.length === 0 ? "aligned" : "guidance_available";
     if (!args.json) {
-      p34.log.info(`App dependency: ${currentSpec}; guidance owner: deepspace CLI ${targetVersion}`);
-      for (const step of steps) p34.log.message(`\u2022 ${step}`);
-      if (steps.length === 0) p34.log.success("This app is already aligned with this CLI version.");
+      p35.log.info(`App dependency: ${currentSpec}; guidance owner: deepspace CLI ${targetVersion}`);
+      for (const step of steps) p35.log.message(`\u2022 ${step}`);
+      if (steps.length === 0) p35.log.success("This app is already aligned with this CLI version.");
     }
     const data = {
       ready: status3 === "aligned",
@@ -14802,9 +15348,13 @@ var update_default = defineDeepspaceCommand({
 });
 
 // src/cli/cli.ts
+process.stdout.on("error", (error) => {
+  if (error.code === "EPIPE") return;
+  throw error;
+});
 var __dirname = dirname13(fileURLToPath3(import.meta.url));
 var pkg = JSON.parse(readFileSync27(join29(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync29("/etc/ssl/certs/ca-certificates.crt")) {
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync30("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({
@@ -14832,6 +15382,16 @@ var create2 = defineCommand14({
     }
   },
   run({ rawArgs: rawArgs2 }) {
+    if (rawArgs2.includes("--json")) {
+      console.log(
+        JSON.stringify({
+          ok: false,
+          code: "invalid_flags",
+          error: "`app create` runs the interactive scaffolder, which has no JSON mode \u2014 its output is a directory, not a document. Run it without --json; every later command in the new app supports it."
+        })
+      );
+      process.exit(1);
+    }
     const scaffolder = `create-deepspace@${pkg.version}`;
     console.log(`Running: npx ${scaffolder} ${rawArgs2.join(" ")}`.trimEnd() + "\n");
     const res = spawnSync8("npx", ["-y", scaffolder, ...rawArgs2], { stdio: "inherit" });
@@ -14931,7 +15491,12 @@ function assertKnownCommandPath(argv) {
 Run \`${unknown.helpPath.join(" ")} --help\` for the command list.`
   );
   if (unknown.executable) {
-    printAction(executableAction({ cwd: process.cwd(), argv: unknown.suggestion }));
+    printAction(
+      executableAction({
+        cwd: process.cwd(),
+        argv: [...unknown.suggestion, ...unknown.remainder]
+      })
+    );
   }
   process.exit(1);
 }
@@ -14997,7 +15562,18 @@ if (rawArgs.includes("--json") && !wantsHelp) {
         ok: false,
         code: "unknown_command",
         error: unknownCommandMessage(unknown),
-        ...unknown.executable ? { action: executableAction({ cwd: process.cwd(), argv: unknown.suggestion }) } : {}
+        // The corrected verb PLUS what the caller wrote after it: an action
+        // that drops the positionals refuses `missing_argument` when run
+        // verbatim, which is the one thing the action contract promises it
+        // will not do. Attached ONLY when the correction is executable
+        // (certain and non-destructive); a guess would hand an agent a
+        // different verb to execute against its own arguments.
+        ...unknown.executable ? {
+          action: executableAction({
+            cwd: process.cwd(),
+            argv: [...unknown.suggestion, ...unknown.remainder]
+          })
+        } : {}
       })
     );
     process.exit(1);
@@ -15006,7 +15582,7 @@ if (rawArgs.includes("--json") && !wantsHelp) {
     stopActiveSpinner();
     const cittyCode = err instanceof Error && err.name === "CLIError" ? err.code : void 0;
     const code = cittyCode === "EARG" ? "missing_argument" : cittyCode === "E_UNKNOWN_COMMAND" ? "unknown_command" : cittyCode === "E_NO_COMMAND" ? "no_command" : errorCode(err);
-    const message = stripAnsi(err instanceof Error ? err.message : String(err));
+    const message = stripAnsi(formatCliError(err));
     console.log(JSON.stringify({ ok: false, error: message, ...code ? { code } : {} }));
     process.exit(1);
   });