@go-labs-sg/gosh 0.10.1 → 0.12.0

package/README.md

@@ -2,6 +2,20 @@
 
 `@go-labs-sg/gosh` provides the `gosh` binary for permission-aware GOSH organizer operations and agent automation. It calls the same tRPC procedures as the web app using the authorizing user's global, organization, and event permissions.
 
+## First step: update before use
+
+Before starting a task, **update to the latest published release first**, including when an AI agent runs this CLI:
+
+```bash
+bun add --global @go-labs-sg/gosh@latest
+gosh version
+gosh --help
+```
+
+Run this sequence once per task, not before every command. Re-read the updated help before choosing commands or flags. If updating fails, stop and report the failure rather than silently using an outdated CLI. If the user explicitly requested a pinned version or a development/staging build, preserve that version instead of replacing it with the public release.
+
+New installation? Follow the runtime and installation instructions below to install Bun first, then return to this step.
+
 ## Runtime and installation
 
 The CLI requires [Bun](https://bun.com/docs/installation) 1.4.0 or newer. npm remains the package distribution channel, while the installed `gosh` command runs under Bun.
@@ -41,6 +55,16 @@ bun add --global @go-labs-sg/gosh
 gosh version
 ```
 
+## Secure credential storage
+
+`GO_LABS_CLI_CREDENTIAL_ACCOUNT` selects the native credential-store account for this CLI. The default is `default`, preserving existing production logins. The downloadable staging launcher sets it to `staging` so a staging login does not replace the production login; keep the same account value for login and subsequent commands. The launcher also sets `GO_LABS_CLI_SKIP_DOTENV=1`, which skips the CLI's explicit current-directory `.env` load while leaving normal production behavior unchanged.
+
+Browser sessions use `Bun.secrets`: macOS Keychain, Windows Credential Manager, or Linux Secret Service. Linux requires libsecret, a reachable user D-Bus session, and an unlocked Secret Service collection. SSH and containers must provide those native prerequisites themselves; `--no-browser` only lets approval happen on another device. Denied D-Bus access is a host permissions/session issue, not something the CLI bypasses.
+
+Before requesting approval, login verifies write/read/delete capability with a unique non-secret probe. Native operations have a 10-second process deadline and sanitized errors. Issued credentials are read back and verified; failed persistence attempts remote revocation and reports local and remote cleanup separately. There is no plaintext fallback or external credential-helper configuration.
+
+See the [shared authentication contract](../../cli-auth/README.md) for recovery and verification limits.
+
 ## Authentication
 
 ```bash
@@ -227,6 +251,37 @@ measures mission work only: travel between stations and staff review time are
 excluded. Existing leaderboard and results commands include the resulting
 timing information.
 
+### Artwork requirements (no login required)
+
+Read the bundled upload policy before preparing station, mission, or branding artwork:
+
+```bash
+gosh assets requirements --type station
+gosh assets requirements --type mission --format text
+gosh assets requirements
+```
+
+The default output is the standard JSON envelope; `--format text` gives a readable brief.
+Omitting `--type` lists every supported artwork type. `gosh commands`,
+`gosh help assets requirements`, and the upload-command help expose this guidance too.
+This command is local and read-only: it does not access credentials, contact the API,
+or upload a file. API URL configuration is not used or validated for this command or
+its help. Its policy comes from the installed CLI version, not a live deployment.
+Update the CLI when newer policy definitions are published.
+
+- Station and mission setup images: JPEG, PNG, WebP; at most **10 MiB (10,485,760 bytes)**.
+- Branding images (logo, sponsor-logo, login-banner, map-marker, player-background):
+  the same formats; at most **5 MiB (5,242,880 bytes)**.
+- Neither artwork upload policy enforces pixel dimensions or aspect ratio.
+- **Recommendations, not requirements:** station artwork 1920 × 1080 (16:9),
+  mission artwork 1600 × 1000 (16:10). Participant cover containers can crop artwork;
+  the standard station card also becomes shorter on completion. Keep essential
+  text in station/mission text fields and important image content away from the edges.
+- Logos, login banners, map markers, and player backgrounds have separate display
+  guidance; no exact canvas is prescribed for them. Preview on the relevant mobile surface.
+
+These policies describe organizer artwork, not participant submission media or profile images.
+
 ### Local file uploads
 
 Upload commands add the local file metadata to the supplied API input, request a permission-scoped signed URL, and upload the bytes directly to storage without sending the GOSH CLI access token to storage:

package/command-manifest.json

@@ -2947,5 +2947,17 @@
 			"slug",
 			"name"
 		]
+	},
+	{
+		"path": ["assets", "requirements"],
+		"operation": "local",
+		"input": "none",
+		"requiresAuth": false,
+		"effects": [],
+		"summary": "Show upload limits and separate artwork recommendations without login or network access.",
+		"options": {
+			"--type": "Select station, mission, logo, sponsor-logo, login-banner, map-marker, player-background; omit for all asset types.",
+			"--format": "json (default, standard CLI envelope) or text."
+		}
 	}
 ]

package/command-reference.md

@@ -953,6 +953,7 @@ Upload an event branding asset from a local file.
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
 - Effects: state-change, external-write
+- Artwork guidance: `gosh assets requirements` (bundled policy, no login required).
 
 ## `gosh upload setup-image`
 
@@ -961,6 +962,7 @@ Upload a station or mission setup image from a local file.
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
 - Effects: state-change, external-write
+- Artwork guidance: `gosh assets requirements` (bundled policy, no login required).
 
 ## `gosh upload profile-image`
 
@@ -1153,3 +1155,13 @@ Unban a user.
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
 - Effects: state-change
+
+## `gosh assets requirements`
+
+Show upload limits and separate artwork recommendations without login or network access.
+
+- Authentication: not required
+- Input: none
+- Effects: read-only
+- --type: Select station, mission, logo, sponsor-logo, login-banner, map-marker, player-background; omit for all asset types.
+- --format: json (default, standard CLI envelope) or text.

package/dist/index.js

@@ -468,7 +468,9 @@ var require_dist = __commonJS(function(exports, module) {
 // src/load-env.ts
 var import_dotenv = __toESM(require_dist(), 1);
 import path from "path";
-import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
+if (process.env.GO_LABS_CLI_SKIP_DOTENV !== "1") {
+  import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
+}
 
 // src/cli.ts
 import { readFileSync } from "fs";
@@ -1486,6 +1488,8 @@ function datetime(args) {
 }
 var anyString = /^[\s\S]{0,}$/;
 var number = /^-?\d+(?:\.\d+)?$/;
+var boolean = /^(?:true|false)$/i;
+var _null = /^null$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
@@ -2367,6 +2371,43 @@ var $ZodNumberFormat = /* @__PURE__ */ $constructor("$ZodNumberFormat", (inst, d
   $ZodCheckNumberFormat.init(inst, def);
   $ZodNumber.init(inst, def);
 });
+var $ZodBoolean = /* @__PURE__ */ $constructor("$ZodBoolean", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = boolean;
+  inst._zod.parse = (payload, _ctx) => {
+    if (def.coerce)
+      try {
+        payload.value = Boolean(payload.value);
+      } catch (_) {}
+    const input = payload.value;
+    if (typeof input === "boolean")
+      return payload;
+    payload.issues.push({
+      expected: "boolean",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
+var $ZodNull = /* @__PURE__ */ $constructor("$ZodNull", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = _null;
+  inst._zod.values = new Set([null]);
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (input === null)
+      return payload;
+    payload.issues.push({
+      expected: "null",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodUnknown = /* @__PURE__ */ $constructor("$ZodUnknown", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload) => payload;
@@ -3904,6 +3945,18 @@ function _int(Class, params) {
     ...normalizeParams(params)
   });
 }
+function _boolean(Class, params) {
+  return new Class({
+    type: "boolean",
+    ...normalizeParams(params)
+  });
+}
+function _null2(Class, params) {
+  return new Class({
+    type: "null",
+    ...normalizeParams(params)
+  });
+}
 function _unknown(Class) {
   return new Class({
     type: "unknown"
@@ -4786,6 +4839,18 @@ var numberProcessor = (schema, ctx, _json, params) => {
       json.allOf = [...json.allOf ?? [], ...rest.map((m) => ({ multipleOf: m }))];
   }
 };
+var booleanProcessor = (_schema, _ctx, json, _params) => {
+  json.type = "boolean";
+};
+var nullProcessor = (_schema, ctx, json, _params) => {
+  if (ctx.target === "openapi-3.0") {
+    json.type = "string";
+    json.nullable = true;
+    json.enum = [null];
+  } else {
+    json.type = "null";
+  }
+};
 var neverProcessor = (_schema, _ctx, json, _params) => {
   json.not = {};
 };
@@ -5580,6 +5645,22 @@ var ZodNumberFormat = /* @__PURE__ */ $constructor("ZodNumberFormat", (inst, def
 function int(params) {
   return _int(ZodNumberFormat, params);
 }
+var ZodBoolean = /* @__PURE__ */ $constructor("ZodBoolean", (inst, def) => {
+  $ZodBoolean.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => booleanProcessor(inst, ctx, json, params);
+});
+function boolean2(params) {
+  return _boolean(ZodBoolean, params);
+}
+var ZodNull = /* @__PURE__ */ $constructor("ZodNull", (inst, def) => {
+  $ZodNull.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => nullProcessor(inst, ctx, json, params);
+});
+function _null3(params) {
+  return _null2(ZodNull, params);
+}
 var ZodUnknown = /* @__PURE__ */ $constructor("ZodUnknown", (inst, def) => {
   $ZodUnknown.init(inst, def);
   ZodType.init(inst, def);
@@ -5998,6 +6079,9 @@ var storedCliCredentialsSchema = object({
   session: cliSessionIdentitySchema
 }).strict();
 var cliProductSchema = _enum(cliProducts);
+// ../../cli-auth/src/client/secret-backend.ts
+import { execFile } from "child_process";
+
 // ../../cli-auth/src/client/runtime.ts
 var MINIMUM_BUN_VERSION = [1, 4, 0];
 var parseBunVersion = (version) => {
@@ -6023,27 +6107,145 @@ var assertBunRuntime = (runtime = globalThis.Bun) => {
   }
 };
 
-// ../../cli-auth/src/client/credential-store.ts
+// ../../cli-auth/src/client/storage-error.ts
+var guidance = {
+  "missing-library": "Install the runtime's native credential-store library and ensure your own native keyring/session is accessible and unlocked; Linux desktop storage requires libsecret AND an accessible, unlocked Secret Service.",
+  "bus-unavailable": "The Linux user D-Bus session is absent or unreachable. --no-browser does not provide storage. Start or repair your own user session and native keyring before retrying.",
+  "bus-denied": "Access to the Linux user bus was denied. Fix your own native keyring/session permissions or host policy; do not change bus/socket permissions or borrow another user's bus.",
+  "service-unavailable": "The user bus is reachable but your own Secret Service is unavailable. Start or repair your own native keyring session; do not expose another user's store.",
+  locked: "Unlock your own native credential collection/session before retrying. The CLI will not wait indefinitely for an unlock prompt.",
+  timeout: "The native credential backend did not finish within 10 seconds and its process was terminated. Fix or unlock your own native keyring/session outside the CLI; the CLI will not bypass host permissions.",
+  "invalid-response": "The native credential backend returned an invalid response. Check your own keyring/session and configuration; no credential output was disclosed.",
+  "read-failed": "The native credential backend could not read credentials. Check your own keyring/session availability and permissions; this is not evidence that you are logged out.",
+  "write-failed": "The native credential backend could not persist credentials. Check your own keyring/session write permissions and availability; no plaintext fallback is used.",
+  "delete-failed": "The native credential backend could not delete its entry. Check your own keyring/session permissions and remove any non-secret preflight probe through that backend if necessary."
+};
+
 class CliCredentialStoreUnavailableError extends Error {
   code = "CLI_CREDENTIAL_STORE_UNAVAILABLE";
-  constructor(product, options) {
-    super(`Secure credential storage is unavailable for the ${product} CLI. Bun.secrets requires the operating system credential store, including Secret Service on Linux. Browser authentication cannot continue without a supported secure store.`, options);
+  reason;
+  constructor(product, reason = "read-failed") {
+    super(`Secure credential storage is unavailable for the ${product} CLI [CLI_CREDENTIAL_STORE_UNAVAILABLE:${reason}]. ${guidance[reason]}`);
     this.name = "CliCredentialStoreUnavailableError";
-  }
+    this.reason = reason;
+  }
+}
+var classifyCredentialStoreFailure = (message, fallback) => {
+  if (/libsecret.*(not found|not available|cannot open|load)|dlopen|shared (object|library).*not found/i.test(message))
+    return "missing-library";
+  if (/(d-?bus|user bus|session bus).*(denied|not permitted)|(?:denied|not permitted).*(d-?bus|user bus|session bus)/i.test(message))
+    return "bus-denied";
+  if (/locked|interaction.*not allowed|user.*cancel/i.test(message))
+    return "locked";
+  if (/ServiceUnknown|org\.freedesktop\.secrets.*(not provided|no owner|not available)|secret.?service.*(unavailable|not running)/i.test(message))
+    return "service-unavailable";
+  if (/d-?bus|user bus|session bus|autolaunch/i.test(message))
+    return "bus-unavailable";
+  return fallback;
+};
+
+class CliCredentialPersistenceError extends Error {
+  remoteRevoked;
+  localRestored;
+  phase;
+  code = "CLI_CREDENTIAL_PERSISTENCE_FAILED";
+  constructor(remoteRevoked, localRestored, phase) {
+    super(`CLI credentials could not be saved after ${phase} [CLI_CREDENTIAL_PERSISTENCE_FAILED]. ${remoteRevoked ? "The newly issued session was revoked." : "Remote revocation could not be confirmed; revoke the session in the product's session management before retrying."} ${localRestored ? phase === "login" ? "The previous local credentials were preserved." : "The unusable rotated local credentials were removed; sign in again." : "Local cleanup could not be confirmed. Inspect your own native credential backend before retrying."}`);
+    this.remoteRevoked = remoteRevoked;
+    this.localRestored = localRestored;
+    this.phase = phase;
+    this.name = "CliCredentialPersistenceError";
+  }
+}
+var getCliStorageError = (error) => {
+  if (error instanceof CliCredentialStoreUnavailableError)
+    return {
+      code: error.code,
+      message: error.message,
+      details: { reason: error.reason }
+    };
+  if (error instanceof CliCredentialPersistenceError)
+    return {
+      code: error.code,
+      message: error.message,
+      details: {
+        remoteRevoked: error.remoteRevoked,
+        localRestored: error.localRestored,
+        phase: error.phase
+      }
+    };
+  return;
+};
+
+// ../../cli-auth/src/client/secret-backend.ts
+var timeoutMs = 1e4;
+var maxBuffer = 64 * 1024;
+var runBackend = (product, executable, args, input, failure) => new Promise((resolve, reject) => {
+  const child = execFile(executable, args, {
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    maxBuffer,
+    windowsHide: true
+  }, (error, stdout, stderr) => {
+    if (error) {
+      const reason = error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" ? "invalid-response" : error.killed ? "timeout" : classifyCredentialStoreFailure(`${stdout}
+${stderr}`, failure);
+      reject(new CliCredentialStoreUnavailableError(product, reason));
+      return;
+    }
+    resolve(stdout);
+  });
+  child.stdin?.on("error", () => {});
+  child.stdin?.end(input);
+});
+var nativeWorker = `
+try {
+ const { operation, input } = JSON.parse(await Bun.stdin.text());
+ const value = await Bun.secrets[operation](input);
+ process.stdout.write(JSON.stringify({ value: value ?? null }));
+} catch (error) {
+ const message = error instanceof Error ? error.message : "Credential backend failed";
+ // libsecret's bus transport errors can omit the D-Bus context.
+ const context = process.platform === "linux" && /^Could not connect:/i.test(message) ? "D-Bus: " : "";
+ process.stderr.write(context + message);
+ process.exitCode = 1;
 }
-var useSecrets = async (product, operation) => {
+`;
+var nativeResponse = object({ value: union([string2(), boolean2(), _null3()]) }).strict();
+var createIsolatedBunSecrets = (product) => {
+  const run = async (operation, input) => {
+    assertBunRuntime();
+    const output = await runBackend(product, process.execPath, ["--no-env-file", "--eval", nativeWorker], JSON.stringify({ operation, input }), operation === "set" ? "write-failed" : operation === "delete" ? "delete-failed" : "read-failed");
+    try {
+      return nativeResponse.parse(JSON.parse(output)).value;
+    } catch {
+      throw new CliCredentialStoreUnavailableError(product, "invalid-response");
+    }
+  };
+  return {
+    get: async (input) => {
+      const value = await run("get", input);
+      if (value === null || typeof value === "string")
+        return value;
+      throw new CliCredentialStoreUnavailableError(product, "invalid-response");
+    },
+    set: async (input) => {
+      await run("set", input);
+    },
+    delete: async (input) => await run("delete", input) === true
+  };
+};
+
+// ../../cli-auth/src/client/credential-store.ts
+var runSecretOperation = async (product, operation, fallback = "read-failed") => {
   try {
     return await operation();
   } catch (cause) {
     if (cause instanceof CliCredentialStoreUnavailableError)
       throw cause;
-    throw new CliCredentialStoreUnavailableError(product, { cause });
+    throw new CliCredentialStoreUnavailableError(product, classifyCredentialStoreFailure(cause instanceof Error ? cause.message : "", fallback));
   }
 };
-var defaultSecrets = () => {
-  assertBunRuntime();
-  return Bun.secrets;
-};
 var refreshLockTimeoutMs = 5 * 60 * 1000;
 var refreshLockRetryMs = 50;
 var getCredentialLockDirectoryPath = () => {
@@ -6115,18 +6317,38 @@ var acquireRefreshLock = async (path) => {
   }
   throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
 };
+var resolveCliCredentialAccount = (environment = process.env) => environment.GO_LABS_CLI_CREDENTIAL_ACCOUNT?.trim() || "default";
 var createBunCredentialStore = ({
-  account = "default",
+  account = resolveCliCredentialAccount(),
   product,
-  secrets = defaultSecrets()
+  secrets = createIsolatedBunSecrets(product)
 }) => {
   const service = `go-labs-cli:${product}`;
   return {
+    preflight: async () => {
+      const input = { name: `probe-${randomUUID()}`, service };
+      const value = `go-labs-non-secret-probe:${randomUUID()}`;
+      try {
+        await runSecretOperation(product, () => secrets.set({ ...input, value }), "write-failed");
+        if (await runSecretOperation(product, () => secrets.get(input)) !== value) {
+          throw new CliCredentialStoreUnavailableError(product, "write-failed");
+        }
+      } catch (error) {
+        await secrets.delete(input).catch(() => {
+          return;
+        });
+        throw error;
+      }
+      await runSecretOperation(product, () => secrets.delete(input), "delete-failed");
+      if (await runSecretOperation(product, () => secrets.get(input)) !== null) {
+        throw new CliCredentialStoreUnavailableError(product, "delete-failed");
+      }
+    },
     delete: async () => {
-      await useSecrets(product, () => secrets.delete({ name: account, service }));
+      await runSecretOperation(product, () => secrets.delete({ name: account, service }), "delete-failed");
     },
     get: async () => {
-      const value = await useSecrets(product, () => secrets.get({ name: account, service }));
+      const value = await runSecretOperation(product, () => secrets.get({ name: account, service }));
       if (value === null)
         return null;
       try {
@@ -6137,11 +6359,11 @@ var createBunCredentialStore = ({
     },
     set: async (credentials) => {
       const parsed = storedCliCredentialsSchema.parse(credentials);
-      await useSecrets(product, () => secrets.set({
+      await runSecretOperation(product, () => secrets.set({
         name: account,
         service,
         value: JSON.stringify(parsed)
-      }));
+      }), "write-failed");
     },
     withCredentialLock: async (operation) => {
       const refreshLockPath = await getCredentialLockPath(product, account);
@@ -6162,6 +6384,7 @@ var createBunCredentialStore = ({
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname } from "os";
+import { isDeepStrictEqual } from "util";
 var normalizeCliAuthIssuer = (value) => {
   const url = new URL(value);
   url.hash = "";
@@ -6224,12 +6447,15 @@ var openSystemBrowser = async (url) => {
     "-NoProfile",
     "-NonInteractive",
     "-Command",
-    "Start-Process -FilePath $args[0]",
-    url
+    "Start-Process -FilePath $env:GO_LABS_CLI_VERIFICATION_URI -ErrorAction Stop"
   ] : ["xdg-open", url];
   try {
-    const process2 = Bun.spawn(command, { stderr: "ignore", stdout: "ignore" });
-    return await process2.exited === 0;
+    const browserProcess = Bun.spawn(command, {
+      env: process.platform === "win32" ? { ...process.env, GO_LABS_CLI_VERIFICATION_URI: url } : process.env,
+      stderr: "ignore",
+      stdout: "ignore"
+    });
+    return await browserProcess.exited === 0;
   } catch {
     return false;
   }
@@ -6247,6 +6473,8 @@ var loginWithBrowser = async ({
   store
 }) => {
   const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
+  if (store.preflight)
+    await withCredentialLock(store, () => store.preflight?.() ?? Promise.resolve());
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -6274,7 +6502,19 @@ var loginWithBrowser = async ({
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
       const credentials = toStoredCredentials(issued, baseUrl, now());
-      await withCredentialLock(store, () => store.set(credentials));
+      try {
+        await withCredentialLock(store, () => persistIssuedCredentials({
+          store,
+          credentials,
+          apiBaseUrl: baseUrl,
+          fetch: fetchImplementation,
+          phase: "login"
+        }));
+      } catch (error) {
+        if (error instanceof CliCredentialPersistenceError)
+          throw error;
+        throw new CliCredentialPersistenceError(await revokeIssuedCredentials(fetchImplementation, baseUrl, credentials), false, "login");
+      }
       return credentials;
     }
     const error = deviceTokenErrorSchema.safeParse(payload);
@@ -6294,6 +6534,55 @@ var loginWithBrowser = async ({
   }
   throw new Error("CLI authentication expired. Run auth login again.");
 };
+var revokeIssuedCredentials = async (fetchImplementation, apiBaseUrl, credentials) => {
+  try {
+    const response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+    return response.ok;
+  } catch {
+    return false;
+  }
+};
+var persistIssuedCredentials = async ({
+  store,
+  credentials,
+  previous,
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  phase
+}) => {
+  let prior = previous;
+  try {
+    if (phase === "login")
+      prior = await store.get();
+    await store.set(credentials);
+    const saved = await store.get();
+    if (!isDeepStrictEqual(saved, credentials))
+      throw new Error("Credential write could not be verified");
+    return;
+  } catch {
+    const remoteRevoked = await revokeIssuedCredentials(fetchImplementation, apiBaseUrl, credentials);
+    let localRestored = false;
+    try {
+      const current = await store.get();
+      if (phase === "login" && prior !== undefined) {
+        if (isDeepStrictEqual(current, prior))
+          localRestored = true;
+        else if (current === null || current.refreshToken === credentials.refreshToken) {
+          if (prior)
+            await store.set(prior);
+          else
+            await store.delete();
+          localRestored = isDeepStrictEqual(await store.get(), prior);
+        }
+      } else if (phase === "refresh" && (!current || current.refreshToken === credentials.refreshToken || current.refreshToken === prior?.refreshToken)) {
+        if (current)
+          await store.delete();
+        localRestored = await store.get() === null;
+      }
+    } catch {}
+    throw new CliCredentialPersistenceError(remoteRevoked, localRestored, phase);
+  }
+};
 var refreshes = new WeakMap;
 var refreshRequestTimeoutMs = 30000;
 var isInvalidGrantResponse = (payload) => {
@@ -6348,7 +6637,14 @@ var refreshAccessToken = async ({
     throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
   }
   const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
-  await store.set(stored);
+  await persistIssuedCredentials({
+    store,
+    credentials: stored,
+    previous: credentials,
+    apiBaseUrl,
+    fetch: fetchImplementation,
+    phase: "refresh"
+  });
   return stored.accessToken;
 };
 var refreshWithCurrentCredentials = async ({
@@ -6420,126 +6716,64 @@ var logoutCliSession = async ({
     return { remoteRevoked };
   });
 };
-// src/api-client.ts
-import {
-  createTRPCProxyClient,
-  httpBatchLink,
-  httpSubscriptionLink,
-  loggerLink,
-  splitLink
-} from "@trpc/client";
-import SuperJSON from "superjson";
-
-// src/features/authenticated-event-source.ts
-class AuthenticatedEventSource {
-  url;
-  init;
-  CLOSED = 2;
-  CONNECTING = 0;
-  OPEN = 1;
-  readyState = this.CONNECTING;
-  abortController = null;
-  closed = false;
-  lastEventId = "";
-  listeners = new Map;
-  retryMilliseconds = 1000;
-  constructor(url, init = {}) {
-    this.url = url;
-    this.init = init;
-    this.connect();
-  }
-  addEventListener(type, listener) {
-    const listeners = this.listeners.get(type) ?? new Set;
-    listeners.add(listener);
-    this.listeners.set(type, listeners);
-  }
-  removeEventListener(type, listener) {
-    this.listeners.get(type)?.delete(listener);
-  }
-  close = () => {
-    this.closed = true;
-    this.readyState = this.CLOSED;
-    this.abortController?.abort();
-  };
-  dispatch(type, event) {
-    for (const listener of this.listeners.get(type) ?? [])
-      listener(event);
-  }
-  async connect() {
-    if (this.closed)
-      return;
-    this.readyState = this.CONNECTING;
-    this.abortController = new AbortController;
-    try {
-      const response = await fetch(this.url, {
-        headers: {
-          Accept: "text/event-stream",
-          ...this.init.headers,
-          ...this.lastEventId ? { "Last-Event-ID": this.lastEventId } : {}
-        },
-        signal: this.abortController.signal
-      });
-      if (!response.ok || !response.body) {
-        throw new Error(`SSE connection failed with HTTP ${response.status}.`);
-      }
-      this.readyState = this.OPEN;
-      this.dispatch("open", new Event("open"));
-      await this.consume(response.body);
-    } catch (error) {
-      if (!this.closed) {
-        this.dispatch("error", new ErrorEvent("error", {
-          error: error instanceof Error ? error : new Error(String(error))
-        }));
-      }
-    }
-    if (!this.closed) {
-      setTimeout(() => void this.connect(), this.retryMilliseconds);
-    }
-  }
-  async consume(body) {
-    const reader = body.getReader();
-    const decoder = new TextDecoder;
-    let pending = "";
-    while (!this.closed) {
-      const { done, value } = await reader.read();
-      pending += decoder.decode(value, { stream: !done });
-      const blocks = pending.split(/\r?\n\r?\n/);
-      pending = blocks.pop() ?? "";
-      for (const block of blocks)
-        this.processBlock(block);
-      if (done)
-        break;
-    }
-  }
-  processBlock(block) {
-    let data = "";
-    let eventType = "message";
-    for (const line of block.split(/\r?\n/)) {
-      if (!line || line.startsWith(":"))
-        continue;
-      const separator = line.indexOf(":");
-      const field = separator === -1 ? line : line.slice(0, separator);
-      const rawValue = separator === -1 ? "" : line.slice(separator + 1);
-      const value = rawValue.startsWith(" ") ? rawValue.slice(1) : rawValue;
-      if (field === "data")
-        data += `${value}
-`;
-      if (field === "event")
-        eventType = value;
-      if (field === "id")
-        this.lastEventId = value;
-      if (field === "retry" && /^\d+$/.test(value)) {
-        this.retryMilliseconds = Number(value);
-      }
-    }
-    if (!data)
-      return;
-    this.dispatch(eventType, new MessageEvent(eventType, {
-      data: data.slice(0, -1),
-      lastEventId: this.lastEventId
-    }));
+// ../validators/src/asset-requirements.ts
+var goshImageContentTypes = ["image/jpeg", "image/png", "image/webp"];
+var goshImageAccept = goshImageContentTypes.join(",");
+var maxGoshSetupImageBytes = 10 * 1024 * 1024;
+var maxGoshBrandingImageBytes = 5 * 1024 * 1024;
+var goshAssetTypes = [
+  "station",
+  "mission",
+  "logo",
+  "sponsor-logo",
+  "login-banner",
+  "map-marker",
+  "player-background"
+];
+var logoGuidance = {
+  recommendedCanvas: null,
+  display: "Logo containers use contain sizing; available space varies by surface.",
+  artworkAdvice: "Use PNG or WebP for transparency. Keep the logo legible at small sizes; there is no prescribed canvas."
+};
+var guidance2 = {
+  station: {
+    recommendedCanvas: { width: 1920, height: 1080, aspectRatio: "16:9" },
+    display: "The standard event-home station card uses a 16:9 cover crop and a shorter crop when completed. Other station surfaces differ.",
+    artworkAdvice: "Keep important text and logos away from the edges. Prefer putting essential instructions in station text rather than the image."
+  },
+  mission: {
+    recommendedCanvas: { width: 1600, height: 1000, aspectRatio: "16:10" },
+    display: "Participant mission cards and mission artwork use 16:10 cover crops.",
+    artworkAdvice: "Keep important content away from the edges. Use mission text for essential instructions."
+  },
+  logo: logoGuidance,
+  "sponsor-logo": logoGuidance,
+  "login-banner": {
+    recommendedCanvas: null,
+    display: "The login banner uses full container width and automatic height; there is no prescribed upload ratio.",
+    artworkAdvice: "Preview in the mobile login card. No exact canvas is prescribed; do not assume the station's 16:9 recommendation applies."
+  },
+  "map-marker": {
+    recommendedCanvas: null,
+    display: "Custom markers appear in small map-marker containers.",
+    artworkAdvice: "Use a simple, legible icon and PNG or WebP for transparency. Preview on the participant map."
+  },
+  "player-background": {
+    recommendedCanvas: null,
+    display: "Participant backgrounds use centered cover sizing and can crop differently with the viewport.",
+    artworkAdvice: "Use decorative artwork without essential text. Check both portrait and landscape previews."
   }
-}
+};
+var getGoshAssetRequirements = (type) => ({
+  type,
+  requirements: {
+    acceptedContentTypes: goshImageContentTypes,
+    maxBytes: type === "station" || type === "mission" ? maxGoshSetupImageBytes : maxGoshBrandingImageBytes,
+    dimensions: null,
+    aspectRatio: null
+  },
+  recommendations: guidance2[type]
+});
 
 // src/runtime/index.ts
 import { createInterface } from "readline/promises";
@@ -6631,6 +6865,9 @@ var sanitizeValue = (value, seen = new WeakSet) => {
   ]));
 };
 var normalizeError = (error) => {
+  const storageError = getCliStorageError(error);
+  if (storageError)
+    return storageError;
   if (error instanceof CliError) {
     return {
       code: error.code,
@@ -6776,6 +7013,168 @@ var createProcessRuntime = () => ({
   }
 });
 
+// src/features/asset-requirements.ts
+var assetRequirementsCommand = {
+  path: ["assets", "requirements"],
+  operation: "local",
+  input: "none",
+  requiresAuth: false,
+  effects: [],
+  summary: "Show upload limits and separate artwork recommendations without login or network access.",
+  options: {
+    "--type": `Select ${goshAssetTypes.join(", ")}; omit for all asset types.`,
+    "--format": "json (default, standard CLI envelope) or text."
+  }
+};
+var getAssetRequirementsOutput = (type) => {
+  const selectedTypes = type !== undefined ? goshAssetTypes.filter((candidate) => candidate === type) : goshAssetTypes;
+  if (selectedTypes.length === 0) {
+    throw new CliError("USAGE", `Unknown asset type: ${type}. Choose ${goshAssetTypes.join(", ")}.`);
+  }
+  return {
+    provenance: "Bundled CLI policy; not a live-server verification. Update the CLI to obtain newer policy definitions.",
+    assets: selectedTypes.map(getGoshAssetRequirements)
+  };
+};
+var formatAssetRequirementsText = (output) => [
+  output.provenance,
+  ...output.assets.map(({ type, requirements, recommendations }) => {
+    const canvas = recommendations.recommendedCanvas;
+    return [
+      `
+${type}`,
+      `Required: JPEG, PNG, WebP; maximum ${requirements.maxBytes} bytes (${requirements.maxBytes / (1024 * 1024)} MiB).`,
+      "Enforced pixel dimensions / aspect ratio: none.",
+      `Recommended canvas (not required): ${canvas ? `${canvas.width} \xD7 ${canvas.height} px (${canvas.aspectRatio})` : "not prescribed"}.`,
+      `Display: ${recommendations.display}`,
+      `Artwork advice: ${recommendations.artworkAdvice}`
+    ].join(`
+`);
+  })
+].join(`
+`);
+
+// src/api-client.ts
+import {
+  createTRPCProxyClient,
+  httpBatchLink,
+  httpSubscriptionLink,
+  loggerLink,
+  splitLink
+} from "@trpc/client";
+import SuperJSON from "superjson";
+
+// src/features/authenticated-event-source.ts
+class AuthenticatedEventSource {
+  url;
+  init;
+  CLOSED = 2;
+  CONNECTING = 0;
+  OPEN = 1;
+  readyState = this.CONNECTING;
+  abortController = null;
+  closed = false;
+  lastEventId = "";
+  listeners = new Map;
+  retryMilliseconds = 1000;
+  constructor(url, init = {}) {
+    this.url = url;
+    this.init = init;
+    this.connect();
+  }
+  addEventListener(type, listener) {
+    const listeners = this.listeners.get(type) ?? new Set;
+    listeners.add(listener);
+    this.listeners.set(type, listeners);
+  }
+  removeEventListener(type, listener) {
+    this.listeners.get(type)?.delete(listener);
+  }
+  close = () => {
+    this.closed = true;
+    this.readyState = this.CLOSED;
+    this.abortController?.abort();
+  };
+  dispatch(type, event) {
+    for (const listener of this.listeners.get(type) ?? [])
+      listener(event);
+  }
+  async connect() {
+    if (this.closed)
+      return;
+    this.readyState = this.CONNECTING;
+    this.abortController = new AbortController;
+    try {
+      const response = await fetch(this.url, {
+        headers: {
+          Accept: "text/event-stream",
+          ...this.init.headers,
+          ...this.lastEventId ? { "Last-Event-ID": this.lastEventId } : {}
+        },
+        signal: this.abortController.signal
+      });
+      if (!response.ok || !response.body) {
+        throw new Error(`SSE connection failed with HTTP ${response.status}.`);
+      }
+      this.readyState = this.OPEN;
+      this.dispatch("open", new Event("open"));
+      await this.consume(response.body);
+    } catch (error) {
+      if (!this.closed) {
+        this.dispatch("error", new ErrorEvent("error", {
+          error: error instanceof Error ? error : new Error(String(error))
+        }));
+      }
+    }
+    if (!this.closed) {
+      setTimeout(() => void this.connect(), this.retryMilliseconds);
+    }
+  }
+  async consume(body) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder;
+    let pending = "";
+    while (!this.closed) {
+      const { done, value } = await reader.read();
+      pending += decoder.decode(value, { stream: !done });
+      const blocks = pending.split(/\r?\n\r?\n/);
+      pending = blocks.pop() ?? "";
+      for (const block of blocks)
+        this.processBlock(block);
+      if (done)
+        break;
+    }
+  }
+  processBlock(block) {
+    let data = "";
+    let eventType = "message";
+    for (const line of block.split(/\r?\n/)) {
+      if (!line || line.startsWith(":"))
+        continue;
+      const separator = line.indexOf(":");
+      const field = separator === -1 ? line : line.slice(0, separator);
+      const rawValue = separator === -1 ? "" : line.slice(separator + 1);
+      const value = rawValue.startsWith(" ") ? rawValue.slice(1) : rawValue;
+      if (field === "data")
+        data += `${value}
+`;
+      if (field === "event")
+        eventType = value;
+      if (field === "id")
+        this.lastEventId = value;
+      if (field === "retry" && /^\d+$/.test(value)) {
+        this.retryMilliseconds = Number(value);
+      }
+    }
+    if (!data)
+      return;
+    this.dispatch(eventType, new MessageEvent(eventType, {
+      data: data.slice(0, -1),
+      lastEventId: this.lastEventId
+    }));
+  }
+}
+
 // src/config.ts
 var DEFAULT_GOSH_API_BASE_URL = "https://app.gosh.sg";
 var normalizeApiBaseUrl = (value) => {
@@ -7929,10 +8328,14 @@ var allowedFlags = new Set([
   "input",
   "no-browser",
   "quiet",
-  "target"
+  "target",
+  "type",
+  "format"
 ]);
 var commandName = (command) => command.path.join(" ");
+var updateBeforeUse = "First step before each task: update to the latest published release with 'bun add --global @go-labs-sg/gosh@latest', then run 'gosh version' and 'gosh --help' before using commands. Update once per task. If updating fails, stop and report it. Preserve an explicitly requested pinned or development/staging version.";
 var commandHelp = (command) => ({
+  beforeUse: updateBeforeUse,
   effects: command.effects,
   input: command.input === "json" ? "Pass the exact tRPC input object with --input '<json>'." : "This command does not accept --input.",
   path: command.path,
@@ -7942,9 +8345,14 @@ var commandHelp = (command) => ({
     target: "Pass --target with the exact resource being changed."
   },
   summary: command.summary,
+  ...command.upload === "setup-image" || command.upload === "branding" ? {
+    assetRequirements: goshAssetTypes.filter((type) => command.upload === "setup-image" ? type === "station" || type === "mission" : type !== "station" && type !== "mission").map(getGoshAssetRequirements),
+    assetRequirementsCommand: "gosh assets requirements"
+  } : {},
   usage: `gosh ${commandName(command)}${command.input === "json" ? " --input '<json>'" : ""}`
 });
 var rootHelp = {
+  beforeUse: updateBeforeUse,
   authentication: {
     instructions: "Run 'gosh auth login'. Approve the device in your browser; credentials are stored through Bun.secrets."
   },
@@ -7952,6 +8360,7 @@ var rootHelp = {
     "gosh help [command path]",
     "gosh commands",
     "gosh version",
+    "gosh assets requirements [--type station] [--format text]",
     "gosh <command path> [--input '<json>']"
   ],
   globalOptions: {
@@ -7987,6 +8396,16 @@ var emitHelp = (runtime, apiBaseUrl, positional) => {
       command: "help"
     }, rootHelp);
   }
+  if (positional.join(" ") === "assets requirements") {
+    return emitSuccess(runtime, {
+      apiBaseUrl,
+      cliVersion: GOSH_CLI_VERSION,
+      command: "help assets requirements"
+    }, {
+      ...assetRequirementsCommand,
+      usage: "gosh assets requirements [--type station] [--format json|text]"
+    });
+  }
   const resolved = findCommand(positional);
   if (!resolved || resolved.consumed !== positional.length) {
     throw new CliError("USAGE", `Unknown GOSH command: ${positional.join(" ")}`);
@@ -8003,8 +8422,14 @@ var runGoshCli = async (argv, dependencies) => {
   let apiBaseUrl = DEFAULT_GOSH_API_BASE_URL;
   try {
     validateFlags(flags);
-    apiBaseUrl = resolveApiBaseUrl(dependencies.runtime, flags);
     const [first, ...rest] = positional;
+    const isAssetRequirements = (first === "help" ? rest : positional).join(" ") === "assets requirements";
+    if (!isAssetRequirements) {
+      apiBaseUrl = resolveApiBaseUrl(dependencies.runtime, flags);
+    }
+    if (!isAssetRequirements && (flags.type !== undefined || flags.format !== undefined)) {
+      throw new CliError("USAGE", "--type and --format are only supported by assets requirements.");
+    }
     if (first === undefined || first === "help" || flags.help === true) {
       return emitHelp(dependencies.runtime, apiBaseUrl, first === "help" ? rest : positional);
     }
@@ -8026,9 +8451,37 @@ var runGoshCli = async (argv, dependencies) => {
         apiBaseUrl,
         cliVersion: GOSH_CLI_VERSION,
         command: "commands"
-      }, commandManifest);
+      }, [...commandManifest, assetRequirementsCommand]);
+    }
+    if (isAssetRequirements && first !== "help") {
+      for (const flag of Object.keys(flags)) {
+        if (!["type", "format", "api-url", "debug", "quiet", "help"].includes(flag)) {
+          throw new CliError("USAGE", `assets requirements does not accept --${flag}.`);
+        }
+      }
+      if (flags.type === true || flags.format === true) {
+        throw new CliError("USAGE", "--type and --format require values.");
+      }
+      const format = getStringFlag(flags, "format") ?? "json";
+      if (format !== "json" && format !== "text") {
+        throw new CliError("USAGE", "--format must be json or text.");
+      }
+      const output = getAssetRequirementsOutput(getStringFlag(flags, "type"));
+      if (format === "text") {
+        dependencies.runtime.stdout.write(`${formatAssetRequirementsText(output)}
+`);
+        return 0;
+      }
+      return emitSuccess(dependencies.runtime, {
+        apiBaseUrl,
+        cliVersion: GOSH_CLI_VERSION,
+        command: "assets requirements"
+      }, output);
     }
-    const credentialStore = dependencies.credentialStore ?? createBunCredentialStore({ product: "gosh" });
+    const credentialStore = dependencies.credentialStore ?? createBunCredentialStore({
+      account: resolveCliCredentialAccount(dependencies.runtime.env),
+      product: "gosh"
+    });
     if (first === "auth" && rest[0] === "login" && rest.length === 1) {
       const credentials = await loginWithBrowser({
         apiBaseUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/gosh",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "GOSH CLI for organizers and AI agents — manage organizations, events, teams, stations, missions, templates, and live operations through the GOSH API.",
   "type": "module",
   "main": "./dist/index.js",