v0.25.0

Minor Changes

• CLI and platform fixes ported from the reviews branch on their own. Behavior a script may notice: secrets configs delete now asks for confirmation (new — there was none) and --json requires --yes; app create --json refuses invalid_flags (it used to die on the scaffolder's own option parser with no envelope); secrets get --plain --json and secrets download --json refuse invalid_flags; workspace drop requires --abandon-unseen whenever this seat does not hold the workspace's published tip (no checkout, or the branch was never materialised locally) and reports discardedTip; a -a <other-app> from a checkout that declares a different app refuses app_checkout_mismatch instead of re-aiming the space remote; push --force is refused for a tip this checkout did not publish with deepspace push (the push record is written only when a push actually lands, no longer on up_to_date); a push refused for a committed secret no longer hands back a git rm --cached action and lists the files; a push transport failure carries gitError; every escaped refusal can now exit 2 with an action (status, logs, secrets included); push and pull configure a repo-local git identity when the checkout has none (they hand back committing recoveries); logs bounded output's meta frame gains appId/retentionDays; workspace list --json gains truncated; workspace land --json gains localTrunkBehind and its pull action names the branch and app; workspace sync on a finished workspace hands back a drop action; secrets validation refusals carry codes (invalid_config_name, invalid_secret_name, reserved_secret_name, secret_too_large, invalid_format). Fixes: secrets refusals render through the one CLI renderer (configs delete confirms and takes --yes; get --plain --json and download --json refuse invalid_flags; piped stdin reads asynchronously; upload file errors carry file_not_found/file_unreadable); push no longer records a fast-forwarded peer commit as your own last push (which let a later --force drop it), distinguishes strictly-behind from diverged, offers --force only for a rewrite of your own line, scans the whole push range for secret files (and stops handing back a git rm --cached action that never resolved the refusal), and codes push_too_large/repo_full; status reports loggedIn from either credential and a sessionError instead of asserting an identity off an expired token; workspace status/list/drop/land/sync classify sync by ancestry (a strictly-behind checkout is no longer "healthy"), fetch the published tip when it is absent, mark truncated lists, prune phantom worktrees, refuse to drop unseen commits (workspace_behind, --abandon-unseen), and name the checkout that should pull after a land; logs --follow --json opens with a ready record; every refusal envelope carries its code and action from one renderer; a vanished cwd is worktree_missing; command suggestions understand transpositions and aliases and never carry flag values into action.argv; deepspace refuses to re-aim the space remote at a different app than the checkout declares, and configures a repo-local git identity in that one place; peer-authored text (refs, tasks, log lines) is neutralised at the constructors that render it. Platform: annotated tags resolve in the code browser and history, the activity cursor can no longer park past the tail, isAncestor walks first parents first, workspace tasks are validated by code point, and listWorkspaces reports truncation.
• Push refusals are structured end to end. The cloud repo now prefixes every ng <ref> <reason> line with a machine code (<code>: <sentence>[ — <detail>]) from one table — push_too_large, repo_full, secret_committed, stale_ref, missing_objects, thin_pack, not_attempted, bad_tip, funny_refname, internal_ref, workspace_creator, unpacker_error, push_failed — a busy repo is still an HTTP 503 with Retry-After, not an ng line — so deepspace push, workspace sync, and workspace land classify a refusal by its code instead of matching the server's prose. Every prose regex in the CLI is gone; an atomic push's not_attempted siblings no longer mask the real refusal; the CLI names the committed secret files the server reports; new --json slugs missing_objects, thin_pack, funny_refname, internal_ref, bad_tip, unpacker_error, workspace_creator. Rollout: a new CLI against an older worker sees untagged reasons and reports them as rejected with the server's own sentence; an OLDER CLI against the new worker loses its automatic --no-thin retry and its oversized-blob naming until upgraded — the refusal sentence itself still says what to do (git push --no-thin, remove or LFS the object). Plain git push still receives its refusals in-band on the ng line; the sentences are reworded (stale ref, fetch first; not attempted, the push is atomic and another ref was refused; the size figures move into the detail) and now carry the leading code.

Patch Changes

• Raise the hono floor to ^4.12.34, the minimum release carrying the fixes for the 2026 hono security advisories (CORS credential reflection, bodyLimit bypass, cookie-name validation, and related middleware issues), in the SDK's dependencies and the scaffold template.