v0.26.0

Minor Changes

• Source authority is inferred from use, never registered, and the 0.25.0 AX-pass defects are fixed. Nothing is declared "at the beginning": the source_unclaimed deploy refusal is gone — an unclaimed app whose checkout has a GitHub remote deploys as GitHub automatically (no git gates, no credential probe; github_credentials_required no longer exists), and each release records the observed repository. The first deepspace push (or an unclaimed app's deploy sync) claims DeepSpace source at the git receive path, once, permanently — and now says so on stderr at the moment it happens. The claim fires on the pack POST rather than the ref advert, so a git push --dry-run or an abandoned push never pins the app — and an admin-tier push to an unclaimed app refuses (admin_cannot_claim): support must neither claim an app nor create history on an unclaimed one. deepspace app source is now read-only (source_inferred refuses the old setter, and reporting an unregistered checkout never mints); the server's POST /source route and the transfer protocol (ref/release proofs, github_push_required, the transfer-preparation source_changed checks — deploy's own source_changed race check remains — the owner-only import receive path and its X-DeepSpace-Source-Revision header) are removed. A claimed GitHub app's stale space git remote is now removed by deploy (the old claim command did this). Releases also record the dirty flag on commit-bearing --no-push deploys (commit abc123 (dirty worktree)), and a rollback carries its TARGET release's source evidence and dirty flag instead of losing them. App registration is also no longer an upfront step: apps register on FIRST USE. Any verb that USES the app — secrets set/upload/pull before the first deploy, dev start, test run, deploy, and push once the repo has commits — mints and stamps its id through the one resolver chokepoint when wrangler.toml has none (same registration app init performs, announced on stderr with the plane and account; the initial scaffold commit is made by app init and deploy only). A wrangler.toml whose COMMITTED content still carries the __APP_ID__ placeholder refuses (a shared repo must not mint one app per clone), a typo'd --env name still refuses (no_app_id_for_env) — minting only fills a declared env block or the top level — and a malformed existing id still refuses (invalid_app_id), never minted over. Healing is scoped twice: only a wrangler.toml that DECLARES DEEPSPACE_APP_ID (the scaffold's placeholder) can mint — an unrelated Cloudflare Workers repo refuses as before — and only the verbs whose purpose is building or using the app register (deploy, dev, test, push, and the secrets WRITE verbs); read and ownership verbs (secrets list/get/download, logs, releases, collaborators, transfer, …) keep the app_not_initialized refusal rather than consuming a quota slot as a side effect. Only app init/deploy create the initial scaffold commit (the resolver never authors git commits). Dependencies also install on first use: a fresh clone's dev/test/deploy/add runs the detected package manager itself (streamed to .deepspace/install.log, bounded at 5 minutes, retried on the next command after a failure, DEEPSPACE_NO_INSTALL=1 restores the old deps_missing refusal — note this includes workspace worktrees, which get their own install). Collaborator pushes now claim DeepSpace source like the owner's (the old owner-only claim would have left collaborator-built apps unclaimed — with claiming and pushing at the same receive path, an app with cloud history is always claimed), and inferred-GitHub evidence travels as its own field so a 0.25.0 worker's stale-base guard is never skipped by it; the retired POST /source answers 410 source_inferred instead of a misleading 404. npm create → any command works with no intermediate step; a logged-out scaffold exits 0; app init remains the explicit spelling and the only path that can replace an id (--new-id). app undeploy automation must pass --yes (the repo's own reaper and harness scripts updated). Consent: app undeploy under --json or a non-TTY stdin now refuses confirmation_required without --yes instead of treating the command as consent. Releases: a deploy records sourceDirty — whether the shipped working tree carried uncommitted changes — and releases/status label a dirty GitHub-source release (GitHub · owner/repo, dirty worktree), so a rollback no longer picks between clean and dirty releases blind. push over a dirty worktree now warns and carries uncommitted in --json (push publishes committed history only). test accounts create accepts --password-stdin (argv passwords discouraged). test run refuses a zombie dev server (port_in_use, bounded wait) instead of letting Playwright adopt a dying one mid-run. not_app_owner refusals name the recoveries (ask the owner, app transfer offer, app init --new-id). An unknown subcommand that exactly names a command elsewhere in the tree is suggested there (auth status → status, not auth logout).