gipity 1.0.405 → 1.0.407

package/dist/api.js

@@ -1,6 +1,6 @@
 import { Readable } from 'stream';
 import * as tar from 'tar-stream';
-import { getAuth, refreshTokenIfNeeded } from './auth.js';
+import { getAuth, refreshTokenIfNeeded, forceRefreshAccessToken } from './auth.js';
 import { resolveApiBase, requireConfig, saveConfig } from './config.js';
 import { clientHeaders } from './client-context.js';
 export class ApiError extends Error {
@@ -53,6 +53,40 @@ async function bearerToken() {
         throw new Error('Not authenticated. Run: gipity login');
     return auth.accessToken;
 }
+/** True when a long-lived agent API token (GIPITY_TOKEN) is in play. Such a token
+ *  is static — it can't be refreshed — so the 401 self-heal path must skip it and
+ *  the "run: gipity login" hint must not be shown (that's the wrong recovery for
+ *  env-token callers). */
+function usingEnvToken() {
+    return !!process.env.GIPITY_TOKEN?.trim();
+}
+// A transient 401 on a session token means the access token the server just saw
+// is dead NOW — it lapsed at the refresh boundary, a sibling `gipity` process
+// sharing this auth.json rotated the single-use refresh token out from under us,
+// or clock skew put us past expiry while the 5-min refresh buffer still read
+// "fresh". refreshTokenIfNeeded's fast-path skips a locally-fresh token, so we
+// force a refresh and replay the call once. This self-heals the intermittent
+// "Session expired" that surfaced on `page eval` (a kickoff POST plus a long GET
+// poll loop crosses the refresh boundary many times). These two helpers carry
+// that behavior to EVERY authenticated entry point — including the streaming and
+// download paths (downloadStream → sync, postForTarEntries → page screenshot)
+// that bypass request() — so one raced 401 can't hard-fail them either.
+/** Decide whether to replay an authenticated call after a 401: force one token
+ *  refresh and return true if the caller should retry. False for an env-token
+ *  caller (static, unrefreshable), an already-retried call, a non-401, or an
+ *  unrecoverable session — the caller then surfaces the error. */
+async function shouldRetryAfter401(status, retried) {
+    if (status !== 401 || retried || usingEnvToken())
+        return false;
+    return forceRefreshAccessToken();
+}
+/** Append a re-login hint to a 401 message for session users. A 401 that
+ *  survived the refresh-and-retry is an unrecoverable session (the refresh token
+ *  is gone too); env-token callers authenticate differently, so don't misdirect
+ *  them. */
+function with401Hint(status, message) {
+    return status === 401 && !usingEnvToken() ? `${message} — run: gipity login` : message;
+}
 async function getHeaders() {
     return {
         ...clientHeaders(),
@@ -74,7 +108,7 @@ export async function getAuthHeader() {
     const headers = await getHeaders();
     return headers.Authorization;
 }
-async function request(method, path, body) {
+async function request(method, path, body, retrying = false) {
     const headers = await getHeaders();
     const url = `${baseUrl()}${path}`;
     const res = await fetchWithTimeout(url, {
@@ -82,10 +116,13 @@ async function request(method, path, body) {
         headers,
         body: body ? JSON.stringify(body) : undefined,
     }, REQUEST_TIMEOUT_MS, `${method} ${path}`);
+    if (await shouldRetryAfter401(res.status, retrying)) {
+        return request(method, path, body, true);
+    }
     if (!res.ok) {
         const json = await res.json().catch(() => ({ error: { code: 'UNKNOWN', message: res.statusText } }));
         const err = json.error || { code: 'UNKNOWN', message: res.statusText };
-        throw new ApiError(res.status, err.code, err.message, json.data);
+        throw new ApiError(res.status, err.code, with401Hint(res.status, err.message), json.data);
     }
     return res.json();
 }
@@ -97,7 +134,7 @@ export function post(path, body) {
 }
 /** POST JSON and consume the response as a tar stream, returning each entry as
  *  { name, buffer } in arrival order. Non-2xx responses are parsed as JSON errors. */
-export async function postForTarEntries(path, body) {
+export async function postForTarEntries(path, body, retried = false) {
     const headers = await getHeaders();
     const url = `${baseUrl()}${path}`;
     const res = await fetch(url, {
@@ -105,10 +142,13 @@ export async function postForTarEntries(path, body) {
         headers,
         body: body ? JSON.stringify(body) : undefined,
     });
+    if (await shouldRetryAfter401(res.status, retried)) {
+        return postForTarEntries(path, body, true);
+    }
     if (!res.ok) {
         const json = await res.json().catch(() => ({ error: { code: 'UNKNOWN', message: res.statusText } }));
         const err = json.error || { code: 'UNKNOWN', message: res.statusText };
-        throw new ApiError(res.status, err.code, err.message, json.data);
+        throw new ApiError(res.status, err.code, with401Hint(res.status, err.message), json.data);
     }
     if (!res.body)
         throw new ApiError(500, 'EMPTY_RESPONSE', 'Server returned no body');
@@ -158,18 +198,21 @@ export async function sendMessage(message) {
     return res.data.content;
 }
 /** Download a file as raw bytes (no JSON parsing) */
-export async function download(path) {
+export async function download(path, retried = false) {
     const url = `${baseUrl()}${path}`;
     const res = await fetch(url, {
         headers: { ...clientHeaders(), 'Authorization': `Bearer ${await bearerToken()}` },
     });
+    if (await shouldRetryAfter401(res.status, retried)) {
+        return download(path, true);
+    }
     if (!res.ok) {
-        throw new ApiError(res.status, 'DOWNLOAD_ERROR', `Download failed: ${res.statusText}`);
+        throw new ApiError(res.status, 'DOWNLOAD_ERROR', with401Hint(res.status, `Download failed: ${res.statusText}`));
     }
     return Buffer.from(await res.arrayBuffer());
 }
 /** Download a response as a Node.js Readable stream */
-export async function downloadStream(path) {
+export async function downloadStream(path, retried = false) {
     const { Readable } = await import('stream');
     const url = `${baseUrl()}${path}`;
     // Bound time-to-first-byte only: abort if no RESPONSE within the header window,
@@ -194,8 +237,11 @@ export async function downloadStream(path) {
     finally {
         clearTimeout(headerTimer);
     }
+    if (await shouldRetryAfter401(res.status, retried)) {
+        return downloadStream(path, true);
+    }
     if (!res.ok) {
-        throw new ApiError(res.status, 'DOWNLOAD_ERROR', `Download failed: ${res.statusText}`);
+        throw new ApiError(res.status, 'DOWNLOAD_ERROR', with401Hint(res.status, `Download failed: ${res.statusText}`));
     }
     return Readable.fromWeb(res.body);
 }

package/dist/auth.js

@@ -149,15 +149,22 @@ export async function acquireRefreshLock() {
  *  others wait, re-read the file, and ADOPT the freshly-rotated token. If the lock
  *  can't be had in time we still try (re-reading first), so this never hangs a command.
  *  Stays void / never throws / never clears auth: a genuine dead token still flows to
- *  the caller's existing 401 path (which messages "run: gipity login"). */
-export async function refreshTokenIfNeeded() {
+ *  the caller's existing 401 path (which messages "run: gipity login").
+ *
+ *  `force` is for the post-401 recovery path: when the server has just REJECTED the
+ *  access token, the local 5-min freshness check is no longer trustworthy (clock
+ *  skew put us past expiry while the buffer still read "fresh", or a sibling rotated
+ *  the refresh token out from under us). Force skips every "looks fresh, skip the
+ *  refresh" shortcut and performs the refresh round-trip unconditionally, so a token
+ *  the server considers dead actually gets replaced instead of re-sent. */
+export async function refreshTokenIfNeeded(force = false) {
     const auth = readAuthFresh(); // never the cache — a sibling may have rotated
     if (!auth)
         return; // not logged in - caller throws the clean error
     cached = auth;
     const buffer = 5 * 60 * 1000; // refresh 5 min before the access token lapses
     const fresh = (a) => Date.now() <= new Date(a.expiresAt).getTime() - buffer;
-    if (fresh(auth))
+    if (!force && fresh(auth))
         return; // fast path: token still good, no lock needed
     // If the refresh token itself has expired, re-login is genuinely required; leave the
     // expired auth in place so the caller's existing 401 path prompts `gipity login`.
@@ -167,9 +174,11 @@ export async function refreshTokenIfNeeded() {
     // Serialize with sibling processes so we don't race the single-use refresh token.
     const release = await acquireRefreshLock();
     try {
-        // Re-check under the lock: a sibling may have refreshed while we waited.
+        // Re-check under the lock: a sibling may have refreshed while we waited. Under
+        // force we skip this adopt — a locally-"fresh" token is exactly what the server
+        // just rejected, so we must actually refresh rather than re-adopt it.
         const held = readAuthFresh();
-        if (held && fresh(held)) {
+        if (!force && held && fresh(held)) {
             cached = held;
             return;
         }
@@ -177,7 +186,7 @@ export async function refreshTokenIfNeeded() {
         const apiBase = resolveApiBase();
         for (let attempt = 1; attempt <= 3; attempt++) {
             const cur = readAuthFresh(); // a sibling may have just refreshed for us
-            if (cur && fresh(cur)) {
+            if (!force && cur && fresh(cur)) {
                 cached = cur;
                 return;
             }
@@ -225,4 +234,16 @@ export async function refreshTokenIfNeeded() {
             release();
     }
 }
+/** Recover from a live 401 on a session token: force a refresh round-trip
+ *  (bypassing the local freshness fast-path, since the server has already
+ *  rejected the token the local clock still thinks is fine) and report whether
+ *  we now hold a usable, unexpired access token. The API layer calls this once
+ *  on a 401 and retries the request only when it returns true — turning a
+ *  transient/raced "Session expired" into a self-healing retry instead of a hard
+ *  failure. Returns false when the refresh token itself is gone (genuine
+ *  re-login required), so the caller surfaces the error instead of looping. */
+export async function forceRefreshAccessToken() {
+    await refreshTokenIfNeeded(true);
+    return !accessTokenExpired();
+}
 //# sourceMappingURL=auth.js.map

package/dist/commands/claude.js

@@ -849,6 +849,16 @@ export const claudeCommand = new Command('claude')
             cwd: process.cwd(),
             env: childEnv,
         });
+        // A spawn failure (missing/non-executable binary) arrives asynchronously via
+        // 'error', which the surrounding try/catch can't catch - without this handler
+        // Node crashes with a raw stack trace. claude is normally installed above, so
+        // this is a defensive fallback.
+        child.on('error', (err) => {
+            console.error(`\n  ${clrError(err.code === 'ENOENT'
+                ? `Claude Code not found. Install it: npm install -g ${CLAUDE_PACKAGE}`
+                : `Failed to launch Claude Code: ${err.message}`)}`);
+            process.exit(1);
+        });
         child.on('exit', (code) => {
             const doneLine = `Done (${formatElapsed(Date.now() - runStart)})`;
             if (nonInteractive)

package/dist/commands/credits.js

@@ -1,7 +1,7 @@
 import { Command } from 'commander';
 import { spawn } from 'node:child_process';
 import { get } from '../api.js';
-import { brand, muted, success, error as clrError } from '../colors.js';
+import { brand, muted } from '../colors.js';
 import { run, printList } from '../helpers/index.js';
 const PRICING_URL = 'https://prompt.gipity.ai/pricing';
 function openInBrowser(url) {
@@ -12,10 +12,17 @@ function openInBrowser(url) {
         process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] :
             ['xdg-open', [url]];
     try {
-        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        // A missing/non-executable launcher (ENOENT, or EACCES on WSL/minimal Linux
+        // where xdg-open isn't runnable) is reported ASYNCHRONOUSLY via an 'error'
+        // event - not a throw - so the try/catch alone can't stop it. With no
+        // listener Node escalates it to an unhandled 'error' and crashes the whole
+        // process. Swallow it; the caller already printed the URL as the fallback.
+        child.on('error', () => { });
+        child.unref();
     }
     catch {
-        // Spawn failed (no xdg-open on minimal Linux, etc.) - caller prints the URL.
+        // Synchronous spawn failure - caller prints the URL.
     }
 }
 export const creditsCommand = new Command('credits')
@@ -50,40 +57,13 @@ creditsCommand
     openInBrowser(PRICING_URL);
     console.log(muted("If your browser didn't open automatically, copy the URL above."));
 }));
-creditsCommand
-    .command('status')
-    .description('Show billing/Stripe configuration health (admin only)')
-    .option('--json', 'Output as JSON')
-    // optsWithGlobals(): the parent `credits` command also declares --json, which
-    // commander binds to the parent - so read merged opts to see the flag here.
-    .action((_opts, cmd) => run('Billing status', async () => {
-    const opts = cmd.optsWithGlobals();
-    const res = await get('/admin/billing-status');
-    const s = res.data;
-    if (opts.json) {
-        console.log(JSON.stringify(s));
-        return;
-    }
-    const mark = (ok) => (ok ? success('✓') : clrError('✗'));
-    console.log(`Stripe mode:     ${brand(s.mode)}`);
-    console.log(`Secret key:      ${mark(s.secretKeyConfigured)}`);
-    console.log(`Webhook secret:  ${mark(s.webhookSecretConfigured)}  ${muted(`endpoint ${s.webhookPath}`)}`);
-    console.log(`Credit packs:    ${mark(s.packsConfigured)}${s.packsError ? `  ${clrError(s.packsError)}` : ''}`);
-    for (const p of s.packs) {
-        console.log(`  ${p.name}  ${muted(p.priceId)}${p.hidden ? muted(' [hidden]') : ''}`);
-    }
-    console.log(`Test pack ($1):  ${mark(s.testPackConfigured)}  ${muted('set STRIPE_PACK_TEST_PRICE_ID to enable a cheap purchase smoke test')}`);
-    console.log('Subscription plans:');
-    for (const pl of s.subscriptionPlans) {
-        console.log(`  ${pl.name} (${pl.tier})  ${mark(pl.priceIdConfigured)}`);
-    }
-}));
 creditsCommand
     .command('usage')
     .description('Show recent usage')
     .option('--limit <n>', 'Number of entries', '20')
     .option('--json', 'Output as JSON')
-    // optsWithGlobals(): parent `credits` also declares --json (see status above).
+    // optsWithGlobals(): the parent `credits` command also declares --json, which
+    // commander binds to the parent - so read merged opts to see the flag here.
     .action((_opts, cmd) => run('Usage', async () => {
     const opts = cmd.optsWithGlobals();
     const limit = parseInt(opts.limit, 10) || 20;

package/dist/commands/fn.js

@@ -1,7 +1,7 @@
 import { Command } from 'commander';
 import { get, post, del } from '../api.js';
 import { requireConfig } from '../config.js';
-import { error as clrError, bold, muted, success } from '../colors.js';
+import { error as clrError, bold, muted, success, warning } from '../colors.js';
 import { run, printList, emitField } from '../helpers/index.js';
 import { confirm } from '../utils.js';
 export const fnCommand = new Command('fn')
@@ -30,8 +30,16 @@ fnCommand
         const dur = log.duration_ms != null ? `${log.duration_ms}ms` : '?';
         const ts = new Date(log.created_at).toLocaleString();
         const statusColor = log.status === 'success' ? success : log.status === 'error' ? clrError : muted;
-        const line = `${statusColor(log.status)}  ${dur}  ${muted(log.trigger_type || 'http')}  ${muted(ts)}`;
-        return log.error_message ? `${line}\n${clrError(`error: ${log.error_message}`)}` : line;
+        let line = `${statusColor(log.status)}  ${dur}  ${muted(log.trigger_type || 'http')}  ${muted(ts)}`;
+        if (log.error_message)
+            line += `\n${clrError(`error: ${log.error_message}`)}`;
+        // Captured console.log/warn/error output for this invocation.
+        for (const entry of (log.logs ?? [])) {
+            const lvlColor = entry.level === 'error' ? clrError : entry.level === 'warn' ? warning : muted;
+            const tag = entry.level === 'log' ? '' : `${entry.level}: `;
+            line += `\n  ${lvlColor(`${tag}${entry.message}`)}`;
+        }
+        return line;
     });
 }));
 fnCommand

package/dist/commands/job.js

@@ -240,6 +240,15 @@ jobCommand
     }
     const runArgs = ['run', ...sharedArgs, '--entrypoint', 'sh', opts.image, '-c', shellCmd];
     const child = spawn('docker', runArgs, { stdio: 'inherit' });
+    // A missing `docker` binary is reported asynchronously via 'error' (not a
+    // throw), so a try/catch can't stop it - without this handler Node crashes
+    // with a raw stack trace instead of a clear message.
+    child.on('error', (err) => {
+        console.error(clrError(err.code === 'ENOENT'
+            ? 'Docker not found. Install Docker to use `gipity job run-local`.'
+            : `Failed to launch docker: ${err.message}`));
+        process.exit(1);
+    });
     child.on('exit', (code) => {
         if (code === 0)
             console.error(muted(`[run-local] ${success('done')}`));

package/dist/commands/logs.js

@@ -31,6 +31,13 @@ logsCommand
         const trigger = muted(log.trigger_type.padEnd(8));
         const err = log.error_message ? `  ${clrError(`"${log.error_message}"`)}` : '';
         console.log(`${muted(time)}  ${status} ${dur} ${trigger}${err}`);
+        // Captured console.log/warn/error output for this invocation, indented
+        // under its summary line. Empty for calls that printed nothing.
+        for (const line of log.logs ?? []) {
+            const lvlColor = line.level === 'error' ? clrError : line.level === 'warn' ? warning : muted;
+            const tag = line.level === 'log' ? '' : `${line.level}: `;
+            console.log(`${muted('         │')} ${lvlColor(`${tag}${line.message}`)}`);
+        }
     }
 }));
 logsCommand

package/dist/commands/notify.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import { get, post } from '../api.js';
-import { requireConfig } from '../config.js';
+import { resolveProjectContext } from '../config.js';
 import { bold, muted, success, warning } from '../colors.js';
 import { run } from '../helpers/index.js';
 export const notifyCommand = new Command('notify')
@@ -12,9 +12,10 @@ notifyCommand
     .option('--title <text>', 'Notification title', 'Test notification')
     .option('--body <text>', 'Notification body', 'Hello from Gipity Notify 👋')
     .option('--url <url>', 'URL to open when the notification is clicked')
+    .option('--project <guid-or-slug>', 'Target a specific project instead of cwd / Home')
     .option('--json', 'Output raw JSON')
     .action((opts) => run('Notify', async () => {
-    const config = requireConfig();
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
     const to = opts.to === 'all' ? 'all' : (opts.to.includes(',') ? opts.to.split(',').map((s) => s.trim()) : opts.to);
     const notification = { title: opts.title, body: opts.body };
     if (opts.url)
@@ -37,9 +38,10 @@ notifyCommand
 notifyCommand
     .command('subs')
     .description('Show how many push subscriptions this app has, per user')
+    .option('--project <guid-or-slug>', 'Target a specific project instead of cwd / Home')
     .option('--json', 'Output raw JSON')
     .action((opts) => run('Notify', async () => {
-    const config = requireConfig();
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
     const res = await get(`/api/${config.projectGuid}/services/notify/subs`);
     if (opts.json) {
         console.log(JSON.stringify(res.data));
@@ -54,9 +56,10 @@ notifyCommand
     .command('rm')
     .description("Remove a user's push subscriptions (e.g. on account deletion)")
     .requiredOption('--user <guid>', 'User guid whose subscriptions to remove')
+    .option('--project <guid-or-slug>', 'Target a specific project instead of cwd / Home')
     .option('--json', 'Output raw JSON')
     .action((opts) => run('Notify', async () => {
-    const config = requireConfig();
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
     const res = await post(`/api/${config.projectGuid}/services/notify/remove`, { user_guid: opts.user });
     if (opts.json) {
         console.log(JSON.stringify(res.data));

package/dist/commands/page-inspect.js

@@ -64,14 +64,21 @@ export const pageInspectCommand = new Command('inspect')
         };
         const res = await post(`/tools/browser/inspect`, inspectBody);
         const b = res.data;
-        // ── Strip the platform's own instrumentation noise first ──
-        // Every deployed page loads Gipity's injected analytics SDK, which POSTs to
-        // Gipity's traffic/error log endpoints (`/api/<guid>/log/traffic|error`).
-        // Those are platform infrastructure, not the app's resources, so when one
-        // fails it surfaces as a failed resource on the Gipity host PLUS a generic,
-        // URL-less "Failed to load resource" console error — identical noise on
-        // essentially every deployed app. Drop both so an agent inspecting the app
-        // it just built sees only its own code's resources, not the platform's.
+        // ── Move resource-load failures out of the console, where they're noise ──
+        // A sub-resource that returns an HTTP 4xx/5xx is reported twice: once in
+        // `failedResources` (CDP network layer — carries the full URL, method, and
+        // status) and once as a generic, URL-less console echo ("Failed to load
+        // resource: the server responded with a status of 404 ()"). The echo names
+        // nothing, so it can't be triaged on its own and only duplicates — worse —
+        // what `failedResources` already says with a URL. Drop one echo per failed
+        // resource we actually have, so every attributed failure (a real app 404 AND
+        // the platform's own injected-SDK telemetry-beacon 404, which 404s on
+        // essentially every deployed page) is surfaced exactly once, under Failed
+        // resources, with its URL — never as a bare, unattributable console line.
+        // Count BEFORE stripping the platform log endpoints below, so their echoes go
+        // too. Any SURPLUS echo (a failure the network drain missed, leaving
+        // failedResources short) is KEPT — a real problem is never hidden just because
+        // we couldn't name it.
         const isPlatformLog = (entry) => {
             const urlPart = entry.replace(/\s*\([^)]*\)\s*$/, '');
             try {
@@ -82,22 +89,22 @@ export const pageInspectCommand = new Command('inspect')
                 return false;
             }
         };
-        const platformFailures = (b.failedResources || []).filter(isPlatformLog);
-        b.failedResources = (b.failedResources || []).filter((r) => !isPlatformLog(r));
-        // Each failed platform POST also emits exactly one generic, URL-less
-        // "Failed to load resource" console error. Drop one per platform failure —
-        // the text is identical, so removing by count is exact and any genuine app
-        // 404 keeps its own (indistinguishable) line.
-        let platformConsoleToDrop = platformFailures.length;
-        if (platformConsoleToDrop > 0) {
+        let resourceEchoesToDrop = (b.failedResources || []).length;
+        if (resourceEchoesToDrop > 0) {
+            const isHttpStatusResourceError = (l) => /^error:\s*Failed to load resource: the server responded with a status of \d{3}/i.test(l);
             b.console = (b.console || []).filter((l) => {
-                if (platformConsoleToDrop > 0 && /^error:\s*Failed to load resource:/i.test(l)) {
-                    platformConsoleToDrop--;
+                if (resourceEchoesToDrop > 0 && isHttpStatusResourceError(l)) {
+                    resourceEchoesToDrop--;
                     return false;
                 }
                 return true;
             });
         }
+        // The injected analytics SDK POSTs to `/log/{traffic,error}` on the Gipity
+        // host; a failure there is platform infrastructure, not the app's, so strip it
+        // from the failed-resource list entirely (its console echo is already gone,
+        // dropped above with every other attributed failure).
+        b.failedResources = (b.failedResources || []).filter((r) => !isPlatformLog(r));
         // Pull message-less cross-origin "Script error." lines out first. They carry
         // no source/stack, so they're never actionable as app-code defects, and on a
         // Gipity-deployed page the platform's own injected SDK is itself a

package/dist/commands/page-screenshot.js

@@ -102,7 +102,7 @@ export const pageScreenshotCommand = new Command('screenshot')
     // is applied in the merge instead.
     .option('--post-load-delay <ms>', 'Delay after DOMContentLoaded before capture, in ms (default: 1000)')
     .option('--action <js>', 'Run JS in the page before capturing — e.g. click a button to enter a state ("document.getElementById(\'play\').click()"). Runs after the post-load delay, then settles again before the shot.')
-    .option('--full', 'Capture the full scrollable page (default: viewport only)')
+    .option('--full', 'Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.')
     .option('-o, --output <file>', 'Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)')
     .option('--device <names>', `Viewport preset(s): ${Object.keys(DEVICE_PRESETS).join(', ')} (comma-separated or repeat flag)`, appendOption, [])
     .option('--viewport <dims>', 'Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag)', appendOption, [])
@@ -242,16 +242,18 @@ export const pageScreenshotCommand = new Command('screenshot')
         console.log(`${label('Screenshot file')} ${success(savedFiles[i])}`);
     }
 }));
-// `screenshot` captures the page AFTER load + settle (+ optional --action). It does
-// NOT scroll or wait for a selector before capture (agents reach for --scroll/
-// --selector and get an unknown-option detour). State the supported levers right
-// here, so the help (rendered on any bad flag, and this 'after' block survives
-// `| tail`/`| grep`) ends the hunt in one shot. --action covers "click, then shoot";
-// --full + crop covers off-screen regions; `page eval` reads data without a picture.
+// `screenshot` captures the page AFTER load + settle (+ optional --action). There
+// is no scroll-to-a-position or wait-for-a-selector lever (agents reach for
+// --scroll/--selector and get an unknown-option detour) — but `--full` does walk
+// the page top→bottom→top before the shot so scroll-reveal content paints in.
+// State the supported levers right here, so the help (rendered on any bad flag,
+// and this 'after' block survives `| tail`/`| grep`) ends the hunt in one shot.
+// --action covers "click, then shoot"; --full + crop covers off-screen regions
+// (and triggers reveals); `page eval` reads data without a picture.
 pageScreenshotCommand.addHelpText('after', `
 Examples:
   gipity page screenshot "https://dev.gipity.ai/me/app/"
-  gipity page screenshot "https://dev.gipity.ai/me/app/" --full          # whole scrollable page
+  gipity page screenshot "https://dev.gipity.ai/me/app/" --full          # whole scrollable page (scroll-reveal sections triggered)
   gipity page screenshot "https://dev.gipity.ai/me/app/" --device mobile,desktop
   gipity page screenshot "https://dev.gipity.ai/me/app/" \\
     --action "document.getElementById('play').click()"                   # capture an in-game frame

package/dist/commands/relay.js

@@ -302,6 +302,14 @@ relayCommand
             process.exit(1);
         }
         const child = spawn(tailCmd, ['-f', '-n', '0', path], { stdio: 'inherit' });
+        // `tail` missing surfaces asynchronously via 'error' (not a throw); without
+        // this handler Node would crash with a raw stack trace.
+        child.on('error', (err) => {
+            console.error(clrError(err.code === 'ENOENT'
+                ? "`tail` not found - can't follow the log on this system."
+                : `Failed to follow log: ${err.message}`));
+            process.exit(1);
+        });
         process.on('SIGINT', () => child.kill('SIGINT'));
         child.on('exit', code => process.exit(code ?? 0));
     }

package/dist/commands/sandbox.js

@@ -190,6 +190,11 @@ GCC/Rust).
         if (res.data.autoMirrorSkipped) {
             console.error(dim(`Note: ${res.data.autoMirrorSkipped.reason}`));
         }
+        if (res.data.mirrorWarnings && res.data.mirrorWarnings.length > 0) {
+            console.error(dim(`Note: ${res.data.mirrorWarnings.length} project file(s) could not be mirrored into the sandbox and were skipped:`));
+            for (const w of res.data.mirrorWarnings)
+                console.error(dim(`  - ${w}`));
+        }
         if (res.data.stdout)
             console.log(res.data.stdout);
         if (res.data.stderr)

package/dist/commands/secrets.js

@@ -0,0 +1,73 @@
+import { Command } from 'commander';
+import { get, put, del } from '../api.js';
+import { resolveProjectContext } from '../config.js';
+import { bold, muted, success } from '../colors.js';
+import { run } from '../helpers/index.js';
+/** Build the query string for a scope. Account scope is project-independent;
+ *  project scope needs the linked app's guid. */
+async function scopeQuery(opts) {
+    if (opts.account)
+        return 'scope=account';
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
+    return `scope=project&app_guid=${config.projectGuid}`;
+}
+export const secretsCommand = new Command('secrets')
+    .description('Encrypted secrets (API keys, tokens) for your app — read in functions via secrets.get("NAME")');
+secretsCommand
+    .command('list')
+    .alias('ls')
+    .description('List secret names (never values). Project secrets by default; --account for account-wide')
+    .option('--account', 'Account-wide secrets shared across all your projects')
+    .option('--project <guid-or-slug>', 'Target a specific project instead of cwd / Home')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => run('Secrets', async () => {
+    const res = await get(`/secrets?${await scopeQuery(opts)}`);
+    if (opts.json) {
+        console.log(JSON.stringify(res.data));
+        return;
+    }
+    const scope = opts.account ? 'account-wide' : 'this project';
+    if (res.data.length === 0) {
+        console.log(muted(`No ${scope} secrets yet. Add one with: gipity secrets set NAME VALUE${opts.account ? ' --account' : ''}`));
+        return;
+    }
+    console.log(bold(`${res.data.length} ${scope} secret${res.data.length === 1 ? '' : 's'}:`));
+    for (const s of res.data) {
+        const masked = s.preview ? muted(`…${s.preview}`) : muted('(hidden)');
+        console.log(`  ${s.name}  ${masked}  ${muted(`updated ${new Date(s.updated_at).toLocaleDateString()}`)}`);
+    }
+}));
+secretsCommand
+    .command('set <name> <value>')
+    .description('Create or update a secret (UPPER_SNAKE_CASE name). Encrypted at rest; never echoed back')
+    .option('--account', 'Store account-wide (shared across all your projects)')
+    .option('--project <guid-or-slug>', 'Target a specific project instead of cwd / Home')
+    .option('--json', 'Output raw JSON')
+    .action((name, value, opts) => run('Secrets', async () => {
+    const res = await put(`/secrets?${await scopeQuery(opts)}`, { name, value });
+    if (opts.json) {
+        console.log(JSON.stringify(res.data));
+        return;
+    }
+    const scope = opts.account ? 'account-wide' : 'this project';
+    console.log(success(`✓ Secret '${res.data.name}' saved (encrypted, ${scope}). Read it in a function with secrets.get('${res.data.name}').`));
+}));
+secretsCommand
+    .command('rm <name>')
+    .alias('delete')
+    .description('Delete a secret')
+    .option('--account', 'Delete from account-wide secrets')
+    .option('--project <guid-or-slug>', 'Target a specific project instead of cwd / Home')
+    .option('--json', 'Output raw JSON')
+    .action((name, opts) => run('Secrets', async () => {
+    const res = await del(`/secrets/${encodeURIComponent(name)}?${await scopeQuery(opts)}`);
+    if (opts.json) {
+        console.log(JSON.stringify(res.data));
+        return;
+    }
+    if (res.data.deleted)
+        console.log(success(`✓ Secret '${name}' deleted.`));
+    else
+        console.log(muted(`No secret named '${name}' found.`));
+}));
+//# sourceMappingURL=secrets.js.map

package/dist/commands/workflow.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import { get, post, put, del } from '../api.js';
-import { requireConfig } from '../config.js';
+import { getConfig, requireConfig } from '../config.js';
 import { success, error as clrError, muted, bold } from '../colors.js';
 import { run, printList, printResult } from '../helpers/index.js';
 // `--json` is declared on the parent `workflow` command (so the bare list
@@ -60,14 +60,24 @@ async function waitForRun(wfGuid, prevGuid, timeoutSec) {
 }
 async function listWorkflows(opts) {
     const res = await get('/workflows');
+    // The endpoint is account-wide. Default to the linked project so the list
+    // isn't drowned in every other project's workflows; --all (or running outside
+    // a linked project) shows everything.
+    const config = getConfig();
+    const scoped = !opts.all && config
+        ? { ...res, data: res.data.filter(w => w.project_slug === config.projectSlug) }
+        : res;
     if (opts.json) {
-        console.log(JSON.stringify(res));
+        console.log(JSON.stringify(scoped));
         return;
     }
-    if (res.meta) {
-        console.log(`Active workflows: ${res.meta.activeCount}/${res.meta.activeLimit}`);
+    if (scoped.meta) {
+        console.log(`Active workflows: ${scoped.meta.activeCount}/${scoped.meta.activeLimit}`);
     }
-    printList(res.data, opts, 'No workflows.', w => {
+    if (!opts.all && config) {
+        console.log(muted(`Project: ${config.projectSlug} (use --all for every project)`));
+    }
+    printList(scoped.data, opts, opts.all || !config ? 'No workflows.' : `No workflows in ${config.projectSlug}.`, w => {
         const statusText = w.is_active ? success('on') : clrError('off');
         const cron = w.cron_expression ? `  ${muted(`cron: ${w.cron_expression}`)}` : '';
         const table = w.trigger_table ? `  ${muted(`table: ${w.trigger_table}`)}` : '';
@@ -79,11 +89,13 @@ async function listWorkflows(opts) {
 export const workflowCommand = new Command('workflow')
     .description('Manage workflows')
     .option('--json', 'Output as JSON')
+    .option('--all', 'List workflows across all projects (default: the linked project only)')
     .action((_opts, cmd) => run('Workflow', () => listWorkflows(mergedOpts(cmd))));
 workflowCommand
     .command('list')
-    .description('List workflows')
+    .description('List workflows (linked project by default; --all for every project)')
     .option('--json', 'Output as JSON')
+    .option('--all', 'List workflows across all projects')
     .action((_opts, cmd) => run('List', () => listWorkflows(mergedOpts(cmd))));
 workflowCommand
     .command('info <name>')

package/dist/helpers/command.js

@@ -21,12 +21,20 @@ export function printCommandError(label, err) {
     if (err?.code === 'INSUFFICIENT_CREDITS') {
         console.error(clrError(`${label} failed - out of Gipity credits.`));
         console.error(err.message);
+        console.error("Run 'gipity credits' to see your balance, or 'gipity credits buy' to top up.");
         return;
     }
     console.error(clrError(`${label} failed: ${err.message}`));
 }
+// Returns the action's promise so Commander can await it. This matters for the
+// central output frame (installOutputFrame): Commander chains the `postAction`
+// hook off whatever the action handler returns, and only waits when that value
+// is thenable. Return `void` here and the trailing blank line fires before the
+// command's async output has even printed — the frame's leading blank then reads
+// as a double blank above the result, with none below it. Returning the promise
+// keeps the frame's boundaries (one blank above, one below) correctly ordered.
 export function run(label, action) {
-    action().catch((err) => {
+    return action().catch((err) => {
         printCommandError(label, err);
         process.exit(1);
     });

package/dist/index.js

@@ -35,6 +35,7 @@ import { pageCommand } from './commands/page.js';
 import { recordsCommand } from './commands/records.js';
 import { fnCommand } from './commands/fn.js';
 import { serviceCommand } from './commands/service.js';
+import { secretsCommand } from './commands/secrets.js';
 import { notifyCommand } from './commands/notify.js';
 import { paymentsCommand } from './commands/payments.js';
 import { jobCommand } from './commands/job.js';
@@ -126,7 +127,7 @@ const commonGroup = [skillCommand, projectCommand, addCommand, removeCommand, de
 const connectGroup = [claudeCommand, relayCommand];
 const projectGroup = [domainCommand, statusCommand, initCommand];
 const filesGroup = [fileCommand, syncCommand, pushCommand, uploadCommand];
-const appBuildingGroup = [testCommand, fnCommand, serviceCommand, notifyCommand, paymentsCommand, jobCommand, dbCommand, logsCommand, workflowCommand, realtimeCommand, rbacCommand, auditCommand, recordsCommand];
+const appBuildingGroup = [testCommand, fnCommand, serviceCommand, secretsCommand, notifyCommand, paymentsCommand, jobCommand, dbCommand, logsCommand, workflowCommand, realtimeCommand, rbacCommand, auditCommand, recordsCommand];
 const utilitiesGroup = [pageCommand, sandboxCommand, generateCommand, emailCommand, gmailCommand, locationCommand, textCommand];
 const agentGroup = [chatCommand, memoryCommand, agentCommand, approvalCommand];
 const setupGroup = [loginCommand, logoutCommand, tokenCommand, creditsCommand, planCommand, doctorCommand, updateCommand, uninstallCommand];
@@ -310,5 +311,8 @@ if (mappedCmd) {
         process.exit(0);
     }
 }
-program.parse(normalizeAliases(process.argv, program));
+// parseAsync (not parse) so commander awaits each command's returned promise
+// before its postAction hook - that ordering is what keeps the output frame's
+// trailing blank line after the command's async output instead of before it.
+await program.parseAsync(normalizeAliases(process.argv, program));
 //# sourceMappingURL=index.js.map

package/dist/knowledge.js

@@ -102,14 +102,14 @@ mkdir -p ~/GipityProjects/<slug> && cd ~/GipityProjects/<slug> && gipity init <s
 
 ## CLI quick reference
 
-Key commands: \`gipity add <template|kit>\`, \`gipity deploy dev\`, \`gipity sandbox run\`, \`gipity page inspect <url>\`, \`gipity page screenshot <url>\`, \`gipity db query "SQL"\`, \`gipity fn call <name>\`, \`gipity logs fn <name>\`, \`gipity email send --to <addr> --subject <s> --body <b>\` (sends as \`gipity@gipity.ai\`; omit \`--to\` to self-send), \`gipity skill read <name>\`.
+Key commands: \`gipity add <template|kit>\`, \`gipity deploy dev\`, \`gipity sandbox run\`, \`gipity page inspect <url>\`, \`gipity page screenshot <url>\`, \`gipity db query "SQL"\`, \`gipity fn call <name>\`, \`gipity logs fn <name>\`, \`gipity secrets set <NAME> <value> [--account]\` (store an API key/token encrypted; read in functions via \`secrets.get('NAME')\` — never hardcode keys), \`gipity email send --to <addr> --subject <s> --body <b>\` (sends as \`gipity@gipity.ai\`; omit \`--to\` to self-send), \`gipity skill read <name>\`.
 Pull an existing remote project local (given its URL/slug): \`mkdir -p ~/GipityProjects/<slug> && cd ~/GipityProjects/<slug> && gipity init <slug>\` (adopts the matching project and syncs files down - this is the "clone").
 For deterministic text questions (letter/word counts, substring occurrences, nth word/char, anagrams), use \`gipity text analyze "<text>"\` - local and instant, no sandbox or LLM needed.
 Run \`gipity --help\` for the full list. Use \`--help\` on any command for details.
 
 Function return shape: \`gipity fn call\`, the in-test \`ctx.fn.call\`/\`callAs\`, and the client \`Gipity.fn\` all return your function's value **unwrapped** - read/assert \`result.field\`. Only raw HTTP/\`curl\` wraps it as \`{ data: ... }\`; never write \`result.data.field\` in a test.
 
-Tests write to your real DB: \`gipity test\` runs the test code sandboxed, but \`ctx.fn.call\`/\`callAs\` hit your actual deployed functions, which write to the same project database the app reads from - rows a test creates persist and surface on the live page. Register \`ctx.cleanup(fn)\` in any write-test to delete what it made; the harness runs every cleanup after the suite (even on failure).
+Tests are isolated, not run against your live DB: \`gipity test\` points \`ctx.fn.call\`/\`callAs\` at a throwaway copy of your database (your \`migrations/\` + \`seeds/\`), reset (truncate + reseed) before every run - so test rows never reach the deployed app and you don't write teardown. Functions see \`ctx.isTest === true\` during a run (use it to skip your own rate limiting); the platform also suppresses \`notify()\` push so a suite can't spam subscribers. Reference data tests need goes in seed files; a runtime-written settings table that isn't seeded goes under \`test.preserve\` in \`gipity.yaml\`. Build per-file fixtures in \`setup(fn)\` → \`ctx.fixtures\`, and namespace unique values with \`ctx.testId\`.
 
 ## Tool output is complete and synchronous
 

package/dist/relay/setup.js

@@ -91,6 +91,9 @@ export function startDaemon() {
             detached: true,
             stdio: 'ignore',
         });
+        // A spawn 'error' arrives asynchronously and bypasses the try/catch; swallow
+        // it so a launch failure stays best-effort instead of crashing the process.
+        child.on('error', () => { });
         child.unref();
     }
     catch {

package/dist/sync.js

@@ -347,12 +347,14 @@ async function downloadAll(projectGuid, onBytes) {
     return extractTarToMap(stream, DOWNLOAD_IDLE_MS, onBytes);
 }
 async function fetchOne(projectGuid, path) {
-    // Exact single-file read first. The tree-tar endpoint below treats its `path`
-    // as a DIRECTORY prefix, so a single root file (e.g. `gipity.yaml`) comes back
-    // empty — which silently broke conflict restores and trapped sync in an
-    // unresolvable delete-vs-newer loop. `/files/read` is the exact-path endpoint
+    // Exact single-file read first. `/files/read` is the exact-path endpoint
     // (what `gipity file cat` uses); it returns text content, reliable for the
-    // config/code files that actually hit a restore. Binary falls through to tar.
+    // config/code files that actually hit a restore. Binary falls through to the
+    // tar path below, which now resolves an exact file path server-side (the
+    // /files/tree endpoint stats a non-directory `path` and packs that one file
+    // under its full name). Before that fix the tar endpoint treated `path` as a
+    // DIRECTORY prefix, so a single file came back empty and a dropped binary
+    // (e.g. an agent-generated image) could never be recovered.
     try {
         const res = await get(`/projects/${projectGuid}/files/read?path=${encodeURIComponent(path)}`);
         const content = res?.data?.content;

package/dist/updater/shim.js

@@ -27,6 +27,9 @@ function startBackgroundUpdater() {
             stdio: 'ignore',
             env: process.env,
         });
+        // Async spawn 'error' bypasses the try/catch; swallow so the best-effort
+        // updater never crashes the CLI.
+        child.on('error', () => { });
         child.unref();
     }
     catch { /* updater is best-effort, never block */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gipity",
-  "version": "1.0.405",
+  "version": "1.0.407",
   "description": "The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.",
   "bin": {
     "gipity": "dist/updater/shim.js",
@@ -13,7 +13,7 @@
     "postbuild": "node scripts/gen-build-info.mjs",
     "dev": "tsc --watch",
     "test": "npm run test:smoke",
-    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
+    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
     "test:e2e": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-live.test.js dist/__tests__/cli-e2e-sync-live.test.js dist/__tests__/cli-e2e-services-media-live.test.js dist/__tests__/cli-e2e-workflow-live.test.js dist/__tests__/cli-e2e-sandbox-live.test.js dist/__tests__/cli-e2e-page-fetch-live.test.js dist/__tests__/cli-e2e-page-test-live.test.js",
     "test:e2e:sync": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sync-live.test.js",
     "test:e2e:sandbox": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sandbox-live.test.js"