deepspace 0.28.1 → 0.29.0

package/dist/cli.js

@@ -1800,6 +1800,24 @@ function healBlocker(appDir, wranglerEnv) {
   }
   return null;
 }
+async function registerForLocalRun(appDir, token, wranglerEnv) {
+  try {
+    return (await ensureAppRegistered(appDir, token, wranglerEnv))?.appId ?? null;
+  } catch (registrationError) {
+    let hasUsableId = false;
+    try {
+      hasUsableId = readAppId(appDir, wranglerEnv) !== null;
+    } catch {
+    }
+    if (!hasUsableId) throw registrationError;
+    const firstLine = registrationError instanceof Error ? registrationError.message.split("\n")[0] : String(registrationError);
+    process.stderr.write(
+      `warning: could not register the app (${firstLine}) \u2014 continuing without app secrets.
+`
+    );
+    return null;
+  }
+}
 function healRefusal(appDir, wranglerEnv) {
   const blocker = healBlocker(appDir, wranglerEnv);
   if (blocker === "placeholder_committed") {
@@ -2332,7 +2350,7 @@ function resolveWorkspaceWorktree(worktrees, workspaceId) {
 // src/cli/lib/source-api.ts
 function githubSourceRefusal(appId, repository) {
   return new Refusal(
-    `This app uses GitHub source (${repository}). Use normal Git/GitHub for source operations (clone, fetch, push); \`deepspace deploy\` ships the local working tree without changing Git.`,
+    `This app uses GitHub source (${repository}). Use normal Git/GitHub for source operations. \`deepspace deploy\` ships the local working tree without changing Git.`,
     "source_managed_by_github",
     { extra: { appId, repository } }
   );
@@ -3776,7 +3794,11 @@ async function ensurePortFree(port, host, waitMs = 15e3) {
     `Port ${port} is already in use.
 Free it with \`${killArgv.join(" ")}\`, or use another port: \`--port <other>\`.`,
     "port_in_use",
-    { extra: { port } }
+    // The machine action the contract documents for this refusal — the prose
+    // named it while `--json` carried none (2026-08-28 coldstart AX). Not
+    // actionRequired: freeing the port and choosing another port are both
+    // legitimate, so the choice stays the caller's.
+    { extra: { port }, action: { cwd: process.cwd(), argv: killArgv } }
   );
 }
 async function isHttpResponding(port, timeoutMs = 2e3) {
@@ -3918,6 +3940,7 @@ var dev_default = defineDeepspaceCommand({
     writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename2(appDir), port, {
       updatePort: explicitPort
     });
+    ensureInstallReady(appDir);
     let token;
     try {
       token = await ensureToken();
@@ -3940,21 +3963,12 @@ var dev_default = defineDeepspaceCommand({
     if (wranglerEnv) say(`Wrangler env: ${wranglerEnv}`);
     say(`Port: ${port}`);
     if (host !== DEFAULT_DEV_HOST) say(`Host: ${host}`);
-    ensureInstallReady(appDir);
     const lintFindings = await lintProjectSchemas(appDir);
     if (lintFindings && lintFindings.length > 0 && !args.json) {
       for (const line of formatSchemaLintFindings(lintFindings)) console.warn(line);
     }
     let generatedSecretsCache;
-    let appIdForSecrets = null;
-    try {
-      appIdForSecrets = (await ensureAppRegistered(appDir, token, wranglerEnv))?.appId ?? null;
-    } catch (registrationError) {
-      process.stderr.write(
-        `warning: could not register the app (${registrationError instanceof Error ? registrationError.message.split("\n")[0] : String(registrationError)}) \u2014 continuing without app secrets.
-`
-      );
-    }
+    const appIdForSecrets = await registerForLocalRun(appDir, token, wranglerEnv);
     if (appIdForSecrets) {
       try {
         const refreshed = await refreshSecretsCache(DEPLOY_URL2, token, appIdForSecrets, wranglerEnv);
@@ -4644,6 +4658,7 @@ var test_default = defineDeepspaceCommand({
       arg: args.port,
       worktree: () => resolveWorktreePort(appDir)
     });
+    ensureInstallReady(appDir);
     if (suite !== "unit") await ensurePortFree(port, "0.0.0.0");
     let token;
     let ownerId;
@@ -4658,17 +4673,8 @@ var test_default = defineDeepspaceCommand({
         { action: cliAction("deepspace", "auth", "login") }
       );
     }
-    ensureInstallReady(appDir);
     let generatedSecretsCache;
-    let appIdForSecrets = null;
-    try {
-      appIdForSecrets = (await ensureAppRegistered(appDir, token, wranglerEnv))?.appId ?? null;
-    } catch (registrationError) {
-      process.stderr.write(
-        `warning: could not register the app (${registrationError instanceof Error ? registrationError.message.split("\n")[0] : String(registrationError)}) \u2014 continuing without app secrets.
-`
-      );
-    }
+    const appIdForSecrets = await registerForLocalRun(appDir, token, wranglerEnv);
     if (appIdForSecrets) {
       try {
         const refreshed = await refreshSecretsCache(DEPLOY_URL3, token, appIdForSecrets, wranglerEnv);
@@ -4928,7 +4934,8 @@ async function requireConsent(opts) {
 
 // src/cli/commands/test-accounts.ts
 function testAccountFailure(err, fallbackCode) {
-  const message = err instanceof Error ? err.message : String(err);
+  const raw = err instanceof Error ? err.message : String(err);
+  const message = raw.replace(/\.\s*$/, "");
   const code = err instanceof TestAccountServiceError ? err.code : void 0;
   if (code === "test_account_cap") {
     return new Refusal(
@@ -4948,7 +4955,7 @@ function testAccountFailure(err, fallbackCode) {
       "not_authenticated"
     );
   }
-  return new Refusal(`Failed: ${message}`, code ?? fallbackCode);
+  return new Refusal(`Failed: ${raw}`, code ?? fallbackCode);
 }
 var create = defineDeepspaceCommand({
   meta: {
@@ -5291,7 +5298,7 @@ var recover = defineDeepspaceCommand({
       targets = remote.filter((account) => !known.has(account.id));
       if (targets.length === 0) {
         if (!args.json) console.log("Every pool account already has a local credential.");
-        return { data: { recovered: [], alreadyLocal: remote.length } };
+        return { data: { recovered: [], alreadyLocal: remote.length, savedTo: TEST_ACCOUNTS_PATH } };
       }
     } else {
       const match = args.id ? remote.find((account) => account.id === args.id) : remote.find((account) => account.email === args.email);
@@ -5342,7 +5349,7 @@ Stored in ${TEST_ACCOUNTS_PATH}. ${rotatedCount} account(s) had no stored creden
 Stored in ${TEST_ACCOUNTS_PATH}. Passwords were retrieved, not reset \u2014 other machines' credentials still work.`
       );
     }
-    return { data: { recovered, requested: targets.length, failures: [] } };
+    return { data: { recovered, requested: targets.length, failures: [], savedTo: TEST_ACCOUNTS_PATH } };
   }
 });
 var test_accounts_default = defineCommand2({
@@ -8055,6 +8062,9 @@ var whoami_default = defineDeepspaceCommand({
       console.log(`Email:      ${payload.email ?? "(none)"}`);
       console.log(`Type:       ${accountType}`);
       if (payload.iss) console.log(`Issuer:     ${payload.iss}`);
+      if (payload.exp) {
+        console.log(`Expires:    ${new Date(payload.exp * 1e3).toISOString()} (renews on use)`);
+      }
       console.log(`Dashboard:  ${DASHBOARD_URL}`);
       if (isTestAccount) {
         console.log("");
@@ -8140,6 +8150,19 @@ import { setTimeout as delay } from "timers/promises";
 
 // src/shared/log-events.ts
 var LOG_LEVELS = ["debug", "log", "info", "warn", "error"];
+function logEventText(e) {
+  if (e.eventType === "exception" && e.exception) {
+    const where = e.request ? ` \u2014 ${e.request.method} ${e.request.path}` : "";
+    return `${e.exception.name}: ${e.exception.message}${where}`;
+  }
+  if (e.eventType === "request" && e.request) {
+    const status3 = e.request.status !== void 0 ? ` ${e.request.status}` : "";
+    const outcome = e.outcome && e.outcome !== "ok" ? ` (${e.outcome})` : "";
+    return `${e.request.method} ${e.request.path}${status3}${outcome}`;
+  }
+  return e.message;
+}
+var MAX_LOG_TEXT_LENGTH = 8 * 1024;
 
 // src/cli/commands/logs.ts
 var DEPLOY_URL7 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
@@ -8151,6 +8174,9 @@ var LOG_RETENTION_DAYS = 7;
 function followInitialLimit(limit, maxLimit) {
   return limit ?? maxLimit;
 }
+function fatalFollowStatus(status3) {
+  return [400, 401, 403, 404].includes(status3);
+}
 function nextPollSince(cursor, floor, lagMs = FOLLOW_LAG_MS) {
   return Math.max(cursor - lagMs, floor);
 }
@@ -8222,12 +8248,12 @@ function formatTime(ts, now) {
 }
 function formatEvent(e, color, now = Date.now()) {
   const time = paint("2", formatTime(e.timestamp, now), color);
+  const text2 = displayLines(logEventText(e));
   let tag;
   let body;
   if (e.eventType === "exception" && e.exception) {
     tag = paint("31", "ERROR", color);
-    const where = e.request ? ` \u2014 ${e.request.method} ${e.request.path}` : "";
-    body = displayLines(`${e.exception.name}: ${e.exception.message}${where}`);
+    body = text2;
     if (e.exception.stack) {
       const lines = e.exception.stack.split("\n");
       const firstIsHeader = lines.length > 0 && !/^\s*at\s/.test(lines[0]) && lines[0].includes(e.exception.message);
@@ -8236,17 +8262,14 @@ function formatEvent(e, color, now = Date.now()) {
     }
   } else if (e.eventType === "request" && e.request) {
     tag = paint("36", "REQ  ", color);
-    const status3 = e.request.status !== void 0 ? ` ${e.request.status}` : "";
-    const outcome = e.outcome && e.outcome !== "ok" ? ` (${e.outcome})` : "";
-    body = displayLines(`${e.request.method} ${e.request.path}${status3}${outcome}`);
+    body = text2;
   } else {
     const style = LEVEL_STYLE[e.level];
     tag = (e.level.toUpperCase() + "     ").slice(0, 5);
     if (style) tag = paint(style, tag, color);
-    body = style ? paint(style, displayLines(e.message), color) : displayLines(e.message);
+    body = style ? paint(style, text2, color) : text2;
   }
-  const client = e.source === "client" ? paint("35", "CLIENT", color) + " " : "";
-  return `${time} ${client}${tag} ${body}`;
+  return `${time} ${tag} ${body}`;
 }
 var sleep3 = (ms, signal) => delay(ms, void 0, { signal });
 var logs_default = defineCommand4({
@@ -8285,7 +8308,7 @@ var logs_default = defineCommand4({
     },
     search: {
       type: "string",
-      description: "Only events whose message contains this text",
+      description: "Only events whose rendered text contains this (case-insensitive)",
       required: false
     },
     limit: {
@@ -8353,6 +8376,13 @@ var logs_default = defineCommand4({
         );
       }
     };
+    const noteTruncation = (humanMessage) => {
+      if (args.json) {
+        process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
+      } else {
+        console.error(humanMessage);
+      }
+    };
     const first = await fetchPage(initialSince, args.follow ? followLimit : limit, token);
     if (args.follow && args.json) {
       process.stdout.write(
@@ -8384,16 +8414,9 @@ var logs_default = defineCommand4({
           );
         }
       } else if (first.truncated) {
-        if (args.json)
-          process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
-        else if (args.search)
-          console.error(
-            `(showing the newest ${first.events.length} matches \u2014 search scans at most the newest 500 level-filtered events per fetch; narrow with --since/--level or raise --limit)`
-          );
-        else
-          console.error(
-            `(showing the newest ${first.events.length} events \u2014 narrow with --since/--level)`
-          );
+        noteTruncation(
+          args.search ? `(showing the newest ${first.events.length} matches \u2014 search scans at most the newest 500 level-filtered events per fetch; narrow with --since/--level or raise --limit)` : `(showing the newest ${first.events.length} events \u2014 narrow with --since/--level)`
+        );
       }
       return;
     }
@@ -8410,17 +8433,13 @@ var logs_default = defineCommand4({
     let warnedTruncated = false;
     if (first.truncated) {
       warnedTruncated = true;
-      if (args.json) {
-        process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
-      } else {
-        console.error(
-          paint(
-            "33",
-            args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events in the initial ${windowLabel} window \u2014 older matches may be omitted; narrow with --since/--level)` : `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level)`,
-            stderrColor()
-          )
-        );
-      }
+      noteTruncation(
+        paint(
+          "33",
+          args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events in the initial ${windowLabel} window \u2014 older matches may be omitted; narrow with --since/--level)` : `(more than ${followLimit} events in the initial ${windowLabel} window \u2014 some older events not shown; narrow with --since/--level)`,
+          stderrColor()
+        )
+      );
     }
     for (; ; ) {
       try {
@@ -8440,7 +8459,7 @@ var logs_default = defineCommand4({
         );
       } catch (err) {
         if (tail.signal.aborted) return;
-        if (err instanceof ApiError && [401, 403, 404].includes(err.status)) throw err;
+        if (err instanceof ApiError && fatalFollowStatus(err.status)) throw err;
         backoff = Math.min(backoff ? backoff * 2 : MIN_POLL_MS, 3e4);
         const msg = err instanceof Error ? err.message : String(err);
         console.error(
@@ -8455,17 +8474,13 @@ var logs_default = defineCommand4({
       const realDrop = fresh.length >= followLimit || Boolean(args.search && page.truncated);
       if (realDrop && !warnedTruncated) {
         warnedTruncated = true;
-        if (args.json) {
-          process.stdout.write(JSON.stringify({ type: "meta", truncated: true }) + "\n");
-        } else {
-          console.error(
-            paint(
-              "33",
-              args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events this poll \u2014 older matches may be omitted; narrow with --level)` : `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level)`,
-              stderrColor()
-            )
-          );
-        }
+        noteTruncation(
+          paint(
+            "33",
+            args.search ? `(search scanned only the newest ${MAX_LIMIT} level-filtered events this poll \u2014 older matches may be omitted; narrow with --level)` : `(burst exceeded ${followLimit} events/poll \u2014 some may be dropped; narrow with --level)`,
+            stderrColor()
+          )
+        );
       } else if (!realDrop) {
         warnedTruncated = false;
       }
@@ -8537,7 +8552,7 @@ function renderSummary(summary) {
 var usage_default = defineDeepspaceCommand({
   meta: {
     name: "usage",
-    description: "Show account-wide credits and integration spend (all apps)"
+    description: "Show account-wide credits and integration spend (all apps). Storage is per app: `deepspace app files list`"
   },
   async run({ args }) {
     const token = await ensureToken();
@@ -11289,7 +11304,7 @@ function httpRefusal(response, tokens) {
   }
   if (response.status === 404 && !server) {
     return new Refusal(
-      "This app does not expose the requested agent endpoint.",
+      "No agent endpoint answered for this app. Either the app name/id is wrong (`deepspace app list` shows yours), or the app does not register assistant tools \u2014 its worker needs `registerAgent(app, { tools, inApp: false })` deployed.",
       "agent_endpoint_not_found"
     );
   }
@@ -12252,6 +12267,9 @@ var init_default = defineDeepspaceCommand({
         console.log(
           `Registered on ${DEEPSPACE_ENV} as a NEW app under ${accountLabel(token)}; the original is untouched.`
         );
+        console.log(
+          "Note: the fork keeps the wrangler `name` \u2014 its first deploy targets the SAME subdomain as the original. For a separate URL, change `name` in wrangler.toml (and APP_NAME) before deploying."
+        );
       } else {
         console.log(`Registered ${appId}${envSuffix} on ${DEEPSPACE_ENV} to ${accountLabel(token)}${commitNote}`);
         if (replacedMalformed !== null) {
@@ -12403,6 +12421,7 @@ var status_default = defineCommand12({
       json.sessionError = sessionError("Not logged in. Run `deepspace auth login` first.");
     } else {
       let who = null;
+      let undecodableToken = false;
       try {
         const payload = decodeJwtPayload(
           readFileSync23(TOKEN_PATH, "utf-8").trim()
@@ -12410,13 +12429,39 @@ var status_default = defineCommand12({
         if (payload.email) who = payload.email;
         userId = payload.sub ?? null;
       } catch {
+        undecodableToken = existsSync26(TOKEN_PATH);
+      }
+      let sessionLineEmitted = false;
+      if (undecodableToken) {
+        try {
+          const healed = await ensureToken();
+          const payload = decodeJwtPayload(healed);
+          if (payload.email) who = payload.email;
+          userId = payload.sub ?? null;
+        } catch (err) {
+          sessionLineEmitted = true;
+          const offline = err instanceof TypeError || errorCode(err) === "network_error";
+          if (offline) {
+            lines.push(["Session", "logged in \xB7 stored token unreadable, could not verify offline"]);
+            json.loggedIn = true;
+          } else {
+            lines.push(["Session", "stored credentials unusable \u2014 run `deepspace auth login`"]);
+            facts.loggedIn = false;
+            json.loggedIn = false;
+            json.sessionError = sessionError(
+              "Stored credentials are unusable. Run `deepspace auth login`."
+            );
+          }
+        }
+      }
+      if (!sessionLineEmitted) {
+        lines.push([
+          "Session",
+          `${who ?? "logged in"} \xB7 renews on use (re-login only after 30 idle days)`
+        ]);
+        json.loggedIn = true;
+        if (who) json.user = who;
       }
-      lines.push([
-        "Session",
-        `${who ?? "logged in"} \xB7 renews on use (re-login only after 30 idle days)`
-      ]);
-      json.loggedIn = true;
-      if (who) json.user = who;
     }
     const appDir = findAppDir();
     if (!appDir) {
@@ -12551,9 +12596,10 @@ var status_default = defineCommand12({
             ]);
             json.source = { ...source, revision: sourceResult.value.revision };
           } else {
+            const observed = inferredGithub ? observedGitHubRepository(appDir) : null;
             lines.push([
               "Source",
-              `unclaimed \xB7 ${inferredGithub ? "first release claims GitHub (from this checkout\u2019s remote), permanently" : "first deploy or push claims DeepSpace, permanently"}`
+              `unclaimed \xB7 ${inferredGithub ? `first release claims GitHub${observed ? ` (${observed})` : ""} from this checkout\u2019s remote, permanently` : "first deploy or push claims DeepSpace, permanently"}`
             ]);
             json.source = null;
             json.sourceInference = inferredGithub ? "github" : "deepspace";
@@ -14175,9 +14221,9 @@ var newWorkspaceCommand = defineDeepspaceCommand({
   },
   async run({ args }) {
     const task = typeof args.task === "string" ? args.task.trim() : "";
-    if (!task) {
+    if (!task || task.startsWith("-")) {
       throw new Refusal(
-        'A workspace needs a task \u2014 pass -t "<what this workspace is for>" (it is shown to every collaborator and agent).',
+        'A workspace needs a task \u2014 pass -t "<what this workspace is for>" (quote it, and put flags like --json after it; it is shown to every collaborator and agent).',
         "invalid_task"
       );
     }
@@ -15528,7 +15574,7 @@ function formatEvent2(e, lands, actors) {
       detail = `"${String(s.task ?? "")}" from ${short(s.baseOid)}`;
       break;
     case "workspace.synced":
-      detail = `${e.subjectId ? `${e.subjectId} ` : ""}\u2192 ${short(s.headOid)}`;
+      detail = `${e.subjectId ? `${e.subjectId} ` : ""}${typeof s.task === "string" && s.task ? `"${s.task}" ` : ""}\u2192 ${short(s.headOid)}`;
       break;
     case "workspace.landed":
       detail = `"${String(s.task ?? "")}" \u2192 ${short(s.landedOid)} on ${String(s.into ?? "trunk")}`;
@@ -15799,6 +15845,7 @@ function reportSource(appId, state, json) {
     );
   }
   console.log(`Revision: ${state.revision}`);
+  console.log(`Registered: ${state.registered ? "yes" : "no"}`);
 }
 
 // src/cli/commands/update.ts
@@ -15809,7 +15856,7 @@ import { join as join28, resolve as resolve22 } from "path";
 // package.json
 var package_default = {
   name: "deepspace",
-  version: "0.28.1",
+  version: "0.29.0",
   engines: {
     node: ">=22.15.0 <23 || >=24 <25 || >=26 <27"
   },