gipity 1.0.394 → 1.0.396

package/dist/auth.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync, chmodSync } from 'fs';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync, chmodSync, openSync, closeSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { decodeJwtExp } from './utils.js';
@@ -8,6 +8,7 @@ import { decodeJwtExp } from './utils.js';
 // so the `claude` subprocess and git/npm still use the real home.
 const AUTH_DIR = process.env.GIPITY_DIR || join(homedir(), '.gipity');
 const AUTH_FILE = join(AUTH_DIR, 'auth.json');
+const AUTH_LOCK_FILE = join(AUTH_DIR, 'auth.lock');
 let cached = null;
 export function getAuth() {
     if (cached)
@@ -70,16 +71,65 @@ export function sessionExpired() {
     return Date.now() > exp * 1000;
 }
 const delay = (ms) => new Promise(r => setTimeout(r, ms));
+// ─── Cross-process refresh lock ────────────────────────────────
+// Serializes token refreshes across every `gipity` process that shares this
+// ~/.gipity/auth.json (foreground commands, the file-sync hook, the relay
+// daemon). Without it, siblings race to refresh the SINGLE-USE refresh token:
+// the first wins and rotates it, the rest submit the now-dead token and 401.
+// Retry-and-re-read alone left a window (a sibling could 401 before the winner
+// finished writing the file). Holding the lock closes that window — siblings
+// wait, then re-read and ADOPT the freshly-rotated token instead of refreshing.
+const LOCK_WAIT_MS = 10_000; // refresh is one quick round-trip; cap the wait
+const LOCK_POLL_MS = 100;
+/** Acquire the global auth-refresh lock. Returns a release fn, or null if we
+ *  couldn't get it within the wait window (caller then proceeds best-effort —
+ *  refresh must never block a command indefinitely). Mirrors sync.ts's advisory
+ *  lock: O_EXCL create, PID payload, stale-holder reclaim. Exported for tests. */
+export async function acquireRefreshLock() {
+    mkdirSync(AUTH_DIR, { recursive: true, mode: 0o700 });
+    const start = Date.now();
+    while (true) {
+        try {
+            const fd = openSync(AUTH_LOCK_FILE, 'wx'); // fails if the file exists
+            writeFileSync(fd, String(process.pid));
+            closeSync(fd);
+            return () => { try {
+                unlinkSync(AUTH_LOCK_FILE);
+            }
+            catch { /* already gone */ } };
+        }
+        catch {
+            // Lock held (or a transient create error). Reclaim it if the holder PID is dead.
+            try {
+                const pid = parseInt(readFileSync(AUTH_LOCK_FILE, 'utf-8').trim(), 10);
+                if (pid && !isNaN(pid)) {
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch {
+                        try {
+                            unlinkSync(AUTH_LOCK_FILE);
+                        }
+                        catch { /* race */ }
+                        continue;
+                    }
+                }
+            }
+            catch { /* unreadable - retry */ }
+            if (Date.now() - start > LOCK_WAIT_MS)
+                return null; // give up waiting, proceed best-effort
+            await delay(LOCK_POLL_MS);
+        }
+    }
+}
 /** Renew the access token (5-min buffer) before an authenticated call, surviving
  *  the case that broke overnight fix-mode runs: MANY concurrent `gipity` processes
  *  (relay daemon, file-sync hook, parallel commands) sharing one ~/.gipity/auth.json.
  *  Refresh tokens are SINGLE-USE — the server rotates them, so when several siblings
- *  race to refresh the same token, the first wins and the rest get a 401. The old
- *  code trusted a stale in-process cache and, on that race, let the 401 reach the
- *  caller, whose handler called clearAuth() and DELETED the shared file — locking
- *  every sibling out mid-run ("Not logged in"). Fix: always read the file fresh, and
- *  retry the race/transient failures, re-reading each attempt so we ADOPT whatever
- *  token a sibling just rotated in rather than resubmitting the rotated-away one.
+ *  race to refresh the same token, the first wins and the rest get a 401. We guard
+ *  the refresh with a cross-process lock so only one sibling refreshes at a time; the
+ *  others wait, re-read the file, and ADOPT the freshly-rotated token. If the lock
+ *  can't be had in time we still try (re-reading first), so this never hangs a command.
  *  Stays void / never throws / never clears auth: a genuine dead token still flows to
  *  the caller's existing 401 path (which messages "run: gipity login"). */
 export async function refreshTokenIfNeeded() {
@@ -90,57 +140,71 @@ export async function refreshTokenIfNeeded() {
     const buffer = 5 * 60 * 1000; // refresh 5 min before the access token lapses
     const fresh = (a) => Date.now() <= new Date(a.expiresAt).getTime() - buffer;
     if (fresh(auth))
-        return;
+        return; // fast path: token still good, no lock needed
     // If the refresh token itself has expired, re-login is genuinely required; leave the
     // expired auth in place so the caller's existing 401 path prompts `gipity login`.
     const refreshExp = decodeJwtExp(auth.refreshToken);
     if (refreshExp && Date.now() > refreshExp * 1000)
         return;
-    const { resolveApiBase } = await import('./config.js');
-    const apiBase = resolveApiBase();
-    for (let attempt = 1; attempt <= 3; attempt++) {
-        const cur = readAuthFresh(); // a sibling may have just refreshed for us
-        if (cur && fresh(cur)) {
-            cached = cur;
+    // Serialize with sibling processes so we don't race the single-use refresh token.
+    const release = await acquireRefreshLock();
+    try {
+        // Re-check under the lock: a sibling may have refreshed while we waited.
+        const held = readAuthFresh();
+        if (held && fresh(held)) {
+            cached = held;
             return;
         }
-        const refreshToken = cur?.refreshToken ?? auth.refreshToken;
-        let res;
-        try {
-            res = await fetch(`${apiBase}/auth/refresh`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ refreshToken }),
-            });
-        }
-        catch {
-            await delay(attempt * 300);
-            continue; // network blip - retry
-        }
-        if (res.ok) {
-            const json = await res.json().catch(() => null);
-            const exp = json && decodeJwtExp(json.accessToken);
-            if (!json || !exp) {
+        const { resolveApiBase } = await import('./config.js');
+        const apiBase = resolveApiBase();
+        for (let attempt = 1; attempt <= 3; attempt++) {
+            const cur = readAuthFresh(); // a sibling may have just refreshed for us
+            if (cur && fresh(cur)) {
+                cached = cur;
+                return;
+            }
+            const refreshToken = cur?.refreshToken ?? auth.refreshToken;
+            let res;
+            try {
+                res = await fetch(`${apiBase}/auth/refresh`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ refreshToken }),
+                });
+            }
+            catch {
                 await delay(attempt * 300);
-                continue;
+                continue; // network blip - retry
             }
-            saveAuth({ accessToken: json.accessToken, refreshToken: json.refreshToken, email: auth.email, expiresAt: new Date(exp * 1000).toISOString() });
-            return;
-        }
-        // 401/403 → the refresh token was rejected outright (it was rotated away by a
-        // sibling, or genuinely expired). Re-read once more in case a sibling's fresh
-        // token just landed; otherwise stop and let the caller's 401 path re-login.
-        if (res.status === 401 || res.status === 403) {
-            const after = readAuthFresh();
-            if (after && fresh(after)) {
-                cached = after;
+            if (res.ok) {
+                const json = await res.json().catch(() => null);
+                const exp = json && decodeJwtExp(json.accessToken);
+                if (!json || !exp) {
+                    await delay(attempt * 300);
+                    continue;
+                }
+                saveAuth({ accessToken: json.accessToken, refreshToken: json.refreshToken, email: auth.email, expiresAt: new Date(exp * 1000).toISOString() });
                 return;
             }
-            return;
+            // 401/403 → the refresh token was rejected outright (rotated away by a sibling
+            // that beat us to the lock, or genuinely expired). Re-read once more in case a
+            // sibling's fresh token just landed; otherwise stop and let the caller re-login.
+            if (res.status === 401 || res.status === 403) {
+                const after = readAuthFresh();
+                if (after && fresh(after)) {
+                    cached = after;
+                    return;
+                }
+                return;
+            }
+            await delay(attempt * 300); // 5xx / unexpected → transient, retry
         }
-        await delay(attempt * 300); // 5xx / unexpected → transient, retry
+        // Retries exhausted: leave the existing token. The caller's request will 401 and the
+        // existing handler messages the user — we never delete the shared auth.json here.
+    }
+    finally {
+        if (release)
+            release();
     }
-    // Retries exhausted: leave the existing token. The caller's request will 401 and the
-    // existing handler messages the user — we never delete the shared auth.json here.
 }
 //# sourceMappingURL=auth.js.map

package/dist/colors.js

@@ -47,10 +47,14 @@ function detectColorLevel() {
         return 2;
     if (/-256(color)?$/.test(term) || term.includes('256'))
         return 2;
-    // Modern Windows consoles set COLORTERM (caught above). Older cmd.exe /
-    // conhost only do 16-color reliably.
+    // Windows Terminal / VS Code set COLORTERM=truecolor (caught above). The
+    // classic console host (conhost, the standalone PowerShell window) advertises
+    // nothing, but every still-supported Windows build (10 v1703+, 2017) handles
+    // 256-color VT sequences reliably - so 256 is the safe floor. Orange then
+    // downscales to xterm-214 (a real orange) instead of the bright-yellow the
+    // 16-color palette is forced into (it has no orange slot at all).
     if (process.platform === 'win32')
-        return 1;
+        return 2;
     if (term)
         return 1;
     return 0;
@@ -60,7 +64,8 @@ const COLOR_LEVEL = detectColorLevel();
 const identity = (s) => s;
 // ── RGB downgrade helpers ───────────────────────────────────────────────
 // RGB → nearest xterm-256 palette index (6x6x6 cube + grayscale ramp).
-function rgbTo256(r, g, b) {
+// Exported for unit tests that pin the documented downscale (orange → 214).
+export function rgbTo256(r, g, b) {
     if (r === g && g === b) {
         if (r < 8)
             return 16;
@@ -74,7 +79,9 @@ function rgbTo256(r, g, b) {
         Math.round((b / 255) * 5));
 }
 // RGB → nearest 16-color SGR foreground code (30-37 / 90-97).
-function rgbTo16(r, g, b) {
+// Exported for unit tests that pin the documented downscale (orange → bright
+// yellow, i.e. the palette has no orange slot).
+export function rgbTo16(r, g, b) {
     const value = Math.round((Math.max(r, g, b) / 255) * 3);
     if (value === 0)
         return 30;
@@ -87,7 +94,13 @@ function rgbTo16(r, g, b) {
     return code;
 }
 // ── Low-level builders ──────────────────────────────────────────────────
-export function makeFg(r, g, b) {
+// `lowColorFallback` controls the 16-color (level 1) tier. The ANSI 16-color
+// palette has no orange and only crude approximations of off-palette hues, so a
+// color that can't be represented reads as a bug (brand orange → bright yellow).
+// Off-palette brand colors pass a monochrome fallback (e.g. `bold`) to convey
+// emphasis without a wrong hue; semantic colors that map cleanly (red, green,
+// blue) omit it and keep their nearest-16 approximation.
+export function makeFg(r, g, b, lowColorFallback) {
     if (COLOR_LEVEL === 0)
         return identity;
     if (COLOR_LEVEL === 3) {
@@ -97,6 +110,8 @@ export function makeFg(r, g, b) {
         const n = rgbTo256(r, g, b);
         return (s) => `${ESC}[38;5;${n}m${s}${ESC}[39m`;
     }
+    if (lowColorFallback)
+        return lowColorFallback;
     const code = rgbTo16(r, g, b);
     return (s) => `${ESC}[${code}m${s}${ESC}[39m`;
 }
@@ -130,7 +145,7 @@ export const underline = makeStyle(4, 24);
 // ── Gipity platform palette ────────────────────────────────────────────
 // Colors sourced from platform/client/src/css/styles.css and
 // platform/apps/gipitsm/src/css/tokens.css
-export const brand = makeFg(254, 166, 14); // Gipity orange #fea60e
+export const brand = makeFg(254, 166, 14, bold); // Gipity orange #fea60e (→ bold on 16-color; no orange in palette)
 export const error = makeFg(239, 68, 68); // #ef4444
 export const warning = makeFg(245, 158, 11); // #f59e0b
 export const success = makeFg(34, 197, 94); // #22c55e

package/dist/commands/claude.js

@@ -17,7 +17,7 @@ function resolveCommand(cmd) {
         return `${cmd}.cmd`;
     }
 }
-import { getAuth, saveAuth, clearAuth } from '../auth.js';
+import { getAuth, saveAuth } from '../auth.js';
 import { get, post, publicPost, ApiError, getAccountSlug } from '../api.js';
 import { getConfig, saveConfigAt, clearConfigCache, getApiBaseOverride, DEFAULT_API_BASE, getConfigPath } from '../config.js';
 import { sync } from '../sync.js';
@@ -339,7 +339,9 @@ export const claudeCommand = new Command('claude')
             }
             catch (err) {
                 if (err instanceof ApiError && err.statusCode === 401) {
-                    clearAuth();
+                    // Don't clearAuth() — the file is shared with concurrent gipity
+                    // processes (sync hook, relay); deleting it logs them all out. A
+                    // re-login overwrites it anyway. Leave it and just point the user.
                     console.error(`  ${clrError('Your session expired.')} ${muted('Run: gipity login')}`);
                 }
                 else {
@@ -480,7 +482,9 @@ export const claudeCommand = new Command('claude')
                         process.exit(1);
                     }
                     if (err instanceof ApiError && err.statusCode === 401 && !reauthed && !nonInteractive) {
-                        clearAuth();
+                        // No clearAuth(): interactiveLogin() saves fresh tokens over the
+                        // file. Deleting it first would log out any sibling process (sync
+                        // hook, relay) sharing this ~/.gipity/auth.json mid-run.
                         console.log(`  ${muted('Your session expired. Let\'s sign you back in.')}\n`);
                         auth = await interactiveLogin();
                         console.log('');
@@ -488,7 +492,7 @@ export const claudeCommand = new Command('claude')
                         continue;
                     }
                     if (err instanceof ApiError && err.statusCode === 401) {
-                        clearAuth();
+                        // Leave the shared auth.json in place (see above) — just message.
                         console.error(`  ${clrError('Your session expired.')}`);
                         console.error(`  ${muted('Run: gipity login')}`);
                         process.exit(1);

package/dist/commands/deploy.js

@@ -22,7 +22,8 @@ export const deployCommand = new Command('deploy')
     .option('--only <phases>', 'Run only specific phases (comma-separated)')
     .option('--force', 'Re-run all phases (ignore checksums) and bypass the sync bulk-deletion guard')
     .option('--no-sync', 'Skip sync-up before deploy')
-    .option('--optimize', 'Run build optimization')
+    .option('--optimize', 'Force Vite build optimization on (default for prod; use this to optimize a dev deploy too)')
+    .option('--no-optimize', 'Skip build optimization and upload files as-is - the escape hatch for plain-HTML apps whose <script src> tags are not type="module"')
     .option('--json', 'Output as JSON')
     .action((target, opts) => run('Deploy', async () => {
     if (target !== 'dev' && target !== 'prod') {

package/dist/commands/generate.js

@@ -66,6 +66,7 @@ Examples:
     .option('--quality <quality>', 'Quality: low|medium|high|auto (gpt-image-2)')
     .option('--aspect-ratio <ratio>', 'Aspect ratio (Gemini only): 1:1, 16:9, 9:16, 4:3, 3:4, 3:2, 2:3, 4:5, 5:4, 21:9')
     .option('--image-size <size>', 'Output resolution (Gemini only): 512, 1K, 2K, 4K')
+    .option('--seed <n>', 'Deterministic seed (BFL only): reuse one seed to keep a set of images visually coherent', (v) => parseInt(v, 10))
     .option('-o, --output <file>', 'Output path (default ./generated.png). For an image your app ships, write it into the source tree so it deploys, e.g. -o src/assets/images/hero.png; the cwd default is fine for one-off generation.')
     .option('--json', 'Output as JSON')
     .action(async (prompt, opts) => {
@@ -79,6 +80,7 @@ Examples:
             quality: opts.quality,
             aspect_ratio: opts.aspectRatio,
             image_size: opts.imageSize,
+            seed: Number.isFinite(opts.seed) ? opts.seed : undefined,
         });
         const ext = result.content_type.includes('png') ? 'png' : 'jpg';
         const filename = opts.output || `generated.${ext}`;
@@ -90,6 +92,9 @@ Examples:
             const sizeKb = Math.round(result.size_bytes / 1024);
             console.log(`${muted(`Generated with ${result.provider}/${result.model} (${sizeKb}KB)`)}`);
             console.log(success(`Saved to ${savedPath}`));
+            if (result.seed !== undefined) {
+                console.log(muted(`Seed ${result.seed} — pass --seed ${result.seed} to keep the next image coherent`));
+            }
         }
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gipity",
-  "version": "1.0.394",
+  "version": "1.0.396",
   "description": "The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.",
   "bin": {
     "gipity": "dist/updater/shim.js",
@@ -12,7 +12,7 @@
     "build": "tsc && chmod +x dist/index.js dist/gipcc.js dist/gipccd.js dist/updater/shim.js dist/updater/check.js",
     "dev": "tsc --watch",
     "test": "npm run test:smoke",
-    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
+    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
     "test:e2e": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-live.test.js dist/__tests__/cli-e2e-services-media-live.test.js dist/__tests__/cli-e2e-workflow-live.test.js dist/__tests__/cli-e2e-sandbox-live.test.js dist/__tests__/cli-e2e-page-fetch-live.test.js dist/__tests__/cli-e2e-page-test-live.test.js",
     "test:e2e:sandbox": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sandbox-live.test.js"
   },