deepspace 0.28.1 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # deepspace
 
+## 0.29.0
+
+### Minor Changes
+
+- Add `logEventText(event)` to the log-events module: one event's plain-text body (what the event says, without colors, tags, timestamps, or stack frames), shared by the CLI line formatter and the dashboard log rows and search. CLI output is byte-identical; this is the extraction of the wording both renderers already produced independently. The platform logs endpoint also retires its never-used `until` query param — the window always ends at request time, and an explicit `until` is ignored (no released client ever sent one).
+- New `loggableError(err)` export (shared, both entries): renders an error as the string form that survives Workers Logs ingestion — the telemetry pipeline keeps only a logged Error OBJECT's stack frames, dropping its message, so uncaught route errors showed in `deepspace logs` as bare frames. The SDK's own error logs now go through it — the room runtime (BaseRoom/RecordRoom/CronRoom/JobRoom message, task, job, and websocket error logs), Yjs doc loads, the auth glue's Apple-secret/onUserCreated logs, chat compaction, the files quota/multipart paths, and the documentation MCP worker — so those messages come back for every app on upgrade + redeploy. Output is bounded: causes are walked to a fixed depth and the rendered text is capped at the exported `MAX_LOG_TEXT_LENGTH` (8 KB, the same budget the platform's log reader truncates at), so a hostile or enormous error can't flood the log store. App code should follow the same rule: log `loggableError(err)`, never a bare Error object.
+- Remove the opt-in client-side error forwarding subsystem (`installClientErrorReporter`, `reportClientError`, `registerClientErrorRoute`, `handleClientErrorReport`, `CLIENT_LOG_MARKER`, and the `ClientErrorReport`/`ClientErrorKind`/`ClientErrorReporterOptions` types), and with it the `source: 'client'` field on `AppLogEvent` and the `CLIENT` tag in `deepspace logs` and the dashboard. Shipped in 0.7.0, it was never wired anywhere — not the scaffold, the skill, or the site manual — so it has been ~900 lines of dormant surface, including an anonymous ingestion endpoint (`POST /_deepspace/client-errors`) in every app that opted in. Browser JS errors are therefore invisible to `deepspace logs` again (they never invoke the Worker); the tenant-safe design is recorded in `docs/platform/app-logs.md` and observability gap A7 for resurrection — scaffold-wired by default — if demand appears. Apps that did call the removed APIs must drop those calls when upgrading; reports POSTed by already-deployed apps now surface as plain marker-prefixed log lines instead of `CLIENT`-tagged events.
+- New `workerErrorHandler(prefix, respond?)` export (`deepspace/worker`): the one Hono `app.onError` — a response-bearing error (`HTTPException`) keeps its own answer, everything else is logged as one string (`[prefix] METHOD /path: message, frames, bounded cause chain`, via `loggableError`) and answered with a generic 500 (or the worker's own `respond` shape). The scaffold template and the deploy/auth/platform workers now register it instead of carrying hand-copied handler bodies (api-worker's own handler is the billing owner's area, unchanged). Also exported: `truncateLogText(s)`, the single budget-inclusive, surrogate-safe truncation both `loggableError` (write side) and the platform log reader (read side) use — a capped field never exceeds `MAX_LOG_TEXT_LENGTH` anymore. And `--search` now matches the shared `logEventText` rendering (the same corpus the dashboard searches and both renderers display), so an exception's name/message and a request's method/path/status match — not just the raw message field.
+
+### Patch Changes
+
+- `logs --follow` no longer retries a 400 forever. The flags are constant for the life of a tail (a bad `--since` already failed on the first fetch, before the loop), so a mid-tail 400 means the platform stopped accepting a shape it used to — exactly what removing a param does to an older CLI. Resending the identical request cannot succeed; the tail now ends with the error. 429 (the route's own throttle) and 5xx still back off and retry.
+
+## 0.28.2
+
+### Patch Changes
+
+- Every fixable finding from the 2026-08-28 five-lane v0.28.1 AX pass (summary
+  and dispositions: `docs/audits/2026-08-28-v0281-ax-summary.md`). Agent-loop
+  killers: the server's `stale_base` sentence names all three recoveries
+  (`workspace land` included — the old text prescribed the exact `pull` loop the
+  0.28.0 action removal closed); a quota-blocked first-use registration refuses
+  with the quota's own code instead of `app_not_initialized` plus an `app init`
+  action the CLI had just been told cannot succeed (one `registerForLocalRun`
+  chokepoint; existing-id checkouts keep local-first warn-and-continue). Agent
+  tools: `invalid_tool_input` states the validator's cause; the published
+  `additionalProperties: false` is enforced at the invoke route (a typo'd key
+  refuses naming it instead of silently succeeding); `tool_not_found` lists the
+  available tools; `forbidden` names the one-step remedy; the agent-endpoint 404
+  distinguishes "wrong app" from "no registerAgent"; `user_current` explains the
+  no-users-row state instead of "User not found". Source latch edges: the
+  `--new-id` fork warns that it inherits the wrangler `name` (its first deploy
+  targets the ORIGINAL subdomain until `name` changes); pre-latch `status` names
+  the repository the latch would record; the claimed-GitHub sentence is
+  byte-identical CLI and server. Sessions and test accounts: a present-but-
+  undecodable token file reports `sessionError` (`status` no longer calls a
+  garbage session healthy); `recover --json` carries `savedTo`; recovered
+  accounts keep their real `createdAt` (the credential endpoint returns it);
+  remedy joins no longer double the period; the internal docs teach
+  `--password-stdin` and retrieval-based `recover`. Operations: a live install
+  is reported before `not_authenticated` on dev/test (the heal stays after
+  auth); `port_in_use` carries the `dev kill --port <n>` machine action the
+  contract documents; `workspace.synced` events record the task and the
+  activity feed prints it; `workspace new -t` refuses a flag-shaped task
+  instead of creating a workspace named `--json`; `whoami`/`app source` human
+  output carries `expiresAt`/`registered` (JSON parity); `app usage` help points
+  at `app files list` for storage; the scaffold's Next steps warn about
+  committing the `__APP_ID__` placeholder; `behind_trunk`/`vc_diverged` are
+  documented beside `stale_base`.
+
 ## 0.28.1
 
 ### Patch Changes

package/dist/{chunk-PVEUIQN4.js → chunk-ZWFH5HON.js}

@@ -1274,7 +1274,7 @@ function renderInlineMarkdown(value) {
 import { useEffect as useEffect6, useRef as useRef5, useState as useState5 } from "react";
 
 // package.json
-var version = "0.28.1";
+var version = "0.29.0";
 
 // src/documentation/runtime/navigation.tsx
 import { Fragment as Fragment4, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
@@ -1954,4 +1954,4 @@ export {
   DefaultDocumentation,
   DocumentationContent
 };
-//# sourceMappingURL=chunk-PVEUIQN4.js.map
+//# sourceMappingURL=chunk-ZWFH5HON.js.map