deepspace 0.28.0 → 0.28.2

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # deepspace
 
+## 0.28.2
+
+### Patch Changes
+
+- Every fixable finding from the 2026-08-28 five-lane v0.28.1 AX pass (summary
+  and dispositions: `docs/audits/2026-08-28-v0281-ax-summary.md`). Agent-loop
+  killers: the server's `stale_base` sentence names all three recoveries
+  (`workspace land` included — the old text prescribed the exact `pull` loop the
+  0.28.0 action removal closed); a quota-blocked first-use registration refuses
+  with the quota's own code instead of `app_not_initialized` plus an `app init`
+  action the CLI had just been told cannot succeed (one `registerForLocalRun`
+  chokepoint; existing-id checkouts keep local-first warn-and-continue). Agent
+  tools: `invalid_tool_input` states the validator's cause; the published
+  `additionalProperties: false` is enforced at the invoke route (a typo'd key
+  refuses naming it instead of silently succeeding); `tool_not_found` lists the
+  available tools; `forbidden` names the one-step remedy; the agent-endpoint 404
+  distinguishes "wrong app" from "no registerAgent"; `user_current` explains the
+  no-users-row state instead of "User not found". Source latch edges: the
+  `--new-id` fork warns that it inherits the wrangler `name` (its first deploy
+  targets the ORIGINAL subdomain until `name` changes); pre-latch `status` names
+  the repository the latch would record; the claimed-GitHub sentence is
+  byte-identical CLI and server. Sessions and test accounts: a present-but-
+  undecodable token file reports `sessionError` (`status` no longer calls a
+  garbage session healthy); `recover --json` carries `savedTo`; recovered
+  accounts keep their real `createdAt` (the credential endpoint returns it);
+  remedy joins no longer double the period; the internal docs teach
+  `--password-stdin` and retrieval-based `recover`. Operations: a live install
+  is reported before `not_authenticated` on dev/test (the heal stays after
+  auth); `port_in_use` carries the `dev kill --port <n>` machine action the
+  contract documents; `workspace.synced` events record the task and the
+  activity feed prints it; `workspace new -t` refuses a flag-shaped task
+  instead of creating a workspace named `--json`; `whoami`/`app source` human
+  output carries `expiresAt`/`registered` (JSON parity); `app usage` help points
+  at `app files list` for storage; the scaffold's Next steps warn about
+  committing the `__APP_ID__` placeholder; `behind_trunk`/`vc_diverged` are
+  documented beside `stale_base`.
+
+## 0.28.1
+
+### Patch Changes
+
+- Let apps share one authenticated tool set between their in-app assistant and local assistants through stateless `deepspace agent` commands.
+
 ## 0.28.0
 
 ### Minor Changes

package/README.md

@@ -97,8 +97,16 @@ The package ships a `deepspace` binary for local dev and deployment:
 npx deepspace auth login # authenticate
 npx deepspace dev start  # run locally
 npx deepspace deploy     # deploy to *.app.space
+npx deepspace agent tools my-app # discover an app's local-assistant tools
 ```
 
+Apps that register assistant tools can expose the same tool factory to their
+website AI and to a user's local assistant. The stateless
+`deepspace agent tools` and `deepspace agent invoke` commands reuse the CLI
+session to mint a five-minute credential for the exact target app. The
+ordinary platform token is never sent to the app, and no separate connection
+or browser approval is required.
+
 When updating an existing app, run the target CLI rather than the app's old
 installed binary:
 

package/dist/{chunk-652TIGI4.js → chunk-DMUR67NG.js}

@@ -1274,7 +1274,7 @@ function renderInlineMarkdown(value) {
 import { useEffect as useEffect6, useRef as useRef5, useState as useState5 } from "react";
 
 // package.json
-var version = "0.28.0";
+var version = "0.28.2";
 
 // src/documentation/runtime/navigation.tsx
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
@@ -1954,4 +1954,4 @@ export {
   DefaultDocumentation,
   DocumentationContent
 };
-//# sourceMappingURL=chunk-652TIGI4.js.map
+//# sourceMappingURL=chunk-DMUR67NG.js.map