v0.21.0

Minor Changes

• Cron mutation receipts: useCronMonitor's trigger/pause/resume now resolve a typed CronMutationResult over a new cron.ack frame (a trigger resolves once the run completes; its execution record arrives via history), and the hook surfaces previously dropped server ERROR frames as lastError. Pause/resume of an unknown task now rejects with unknown_task (and a missing taskName with failed) instead of acking success.
• The files round trip works and failures are visible. upload/uploadBase64 accept { key } to place an object at an exact location within the scope (slashes allowed, upsert semantics — the server contract the CLI already used), so upload then list(prefix) finds what you stored; name stays display metadata. list() now throws a humanized error on auth/server failures instead of silently returning an empty directory, accepts { limit, cursor }, and the new listPage() returns { files, cursor, truncated } for real pagination past the server cap. Entries and upload results carry relativeKey (the key within your scope). Also fixes a cross-page listing bug where a cursor continuation could re-list keys earlier pages already returned. The file-manager feature renders list failures with a retry instead of an empty grid.
• Integration failures arrive typed and human at the same time. IntegrationResponse.error is now the human-readable message (it was the machine slug — which is why raw insufficient_credits reached product copy); the slug moves to code, with status and structured details (for example availableCredits/requiredCredits on a 402) preserved instead of discarded. useCheckout/useSubscription surface the same typed code (so owner_connect_not_ready is branchable, not string-matched), and integrations invoke prints the human line while carrying the real slug in its refusal. Chat completions that spend the entire token budget on reasoning before any visible output now fail typed as output_budget_exhausted with the budget in the message, instead of returning an empty string. On output_budget_exhausted the worst-case pre-charge stands (no reconciliation), the same as any other handler failure.
• Testing stops lying to you. Cached Playwright sign-in state is validated against the target app before reuse (session probe plus identity match, keyed by auth scope + app origin + email) instead of trusted for seven days on file age alone — a fresh-but-dead state file can no longer poison every protected test. test accounts list now shows the fixture selector name and a usableByFixture flag (with --usable to filter and passwords masked behind --reveal in human output; --json still carries them for automation), and accounts created without --name default it from the email so they are always selectable. test run accepts --grep, --project, and --headed. dev start no longer lets Vite clear the terminal over the CLI's own preflight output. The new deepspace/testing/mcp subpath ships a dependency-free MCP wire client (initialize/listTools/callTool/notify) used by the SDK's own new wire tests. Breaking for test-harness code that reached into the cache internals: readCachedState is removed from deepspace/testing (validation replaced age-based reuse), getStatePathForEmail now requires a baseURL second argument because cache identity is keyed by auth scope + app origin + email, and EnsureStorageStateOptions.maxAgeMs is gone.

Patch Changes

• ChatPanel's first chat can no longer vanish. When mounted with chatId={null}, the panel now keeps the chat it creates (prop changes still win, including back to null for "new chat"), so messages render and persist without requiring the parent to wire onChatCreated — previously the screen stayed permanently empty and every further send leaked another chat record. onChatCreated is a plain notification again. The AI chat page also stops offering "Retry" (which created a new chat) after a failed delete, and surfaces rename failures instead of logging them.
• Brandable AuthOverlay (title/description/logo props, --ds-auth-backdrop var), an in-page signed-out fallback for the scaffold's protected routes, Modal long-string wrapping, integration-test catalog error/retry states, and a token-styled cron log page.
• Fix agent-reported workspace continuations, file metadata and generated file-manager behavior, collaborator recovery guidance, documentation theme strict mode, and source-mode guidance.
• Deploys are bounded, faster, and tell you where the time went. Every deploy HTTP call now carries an explicit per-attempt timeout (60s; the commit POST gets 240s and retries once instead of three times, since each re-POST records a release) — a hung deploy service surfaces as a fast retryable failure instead of a silent multi-minute stall. Asset uploads run 16-wide instead of 4-wide, which matters exactly on many-small-file first deploys where per-request round trips, not bandwidth, dominate. The CLI now prints phase durations — Built (Ns), Uploaded N file(s) in Ns, Platform commit: Ns, Deployed! (edge confirmed in Ns) — so a slow deploy names its slow phase instead of demanding forensics.
• Native documentation gains theme.density: "compact" — one config key that tightens type scale, measure, padding, header, and sidebar through new geometry tokens (--documentation-font-size, --documentation-line-height, --documentation-content-width, --documentation-reader-pad), so matching a compact host no longer takes hundreds of lines of custom CSS. Unknown theme keys now warn instead of silently vanishing, and the config input type now carries exactly the settable keys — preset (never implemented) is gone, and resolved-only keys (backgroundDark, backgroundDecoration, the font fields, codeBlockMode, eyebrowStyle, logoHref) moved to the new ResolvedDocumentationTheme type (Mintlify normalization is unaffected). Documentation output now records the deepspace version that built it — in the manifest and as a small footer line — so a docs site can't silently describe an older SDK. The machine surfaces get honest edges: documentation_search flags weak matches with an explicit notice instead of returning confidently-scored misses, documentation_read accepts slash-less routes and returns just the requested #fragment section (whole page plus a notice when the fragment is unknown), and a missing .md page answers with a one-line plain-text 404 instead of the styled HTML page.
• The integration catalog now tells you what each endpoint does before you call it: deepspace integrations list prints a one-line description per endpoint (with an OAuth tag where the platform manages the OAuth connection), and integrations info adds the description, a Requires-OAuth explanation of the retry flow, and a curated output schema for endpoints whose success shape the platform defines. --json carries the same fields.