gipity 1.0.406 → 1.0.408

package/dist/banner.js

@@ -1,6 +1,21 @@
 // ── Gipity CLI Startup Banner ──────────────────────────────────────────
 // Two-panel box showing all AI models, platform tools, and sandbox capabilities.
+import { homedir } from 'os';
+import { sep } from 'path';
 import { brand, bold, faint, muted, fg } from './colors.js';
+/** Abbreviate a home-relative path to `~`, cross-platform. On Windows `HOME`
+ *  is usually unset (it's `USERPROFILE`), and `str.replace('', '~')` prepends
+ *  a stray `~`, so use os.homedir() and a real prefix check. */
+function tildify(p) {
+    const home = homedir();
+    if (!home)
+        return p;
+    if (p === home)
+        return '~';
+    if (p.startsWith(home + sep))
+        return '~' + p.slice(home.length);
+    return p;
+}
 // ── Static content ─────────────────────────────────────────────────────
 // ── Feature groups ────────────────────────────────────────────────────
 const AI_MODELS = [
@@ -174,7 +189,7 @@ function buildLeftPanel(opts, panelW) {
         leftLines.push(center(line, panelW));
     }
     if (opts.cwd) {
-        const short = leadingEllipsify(opts.cwd.replace(process.env['HOME'] || '', '~'), panelW);
+        const short = leadingEllipsify(tildify(opts.cwd), panelW);
         leftLines.push('');
         leftLines.push(center(muted(short), panelW));
         leftLines.push('');

package/dist/commands/claude.js

@@ -1,10 +1,9 @@
 import { Command } from 'commander';
-import { join, dirname, resolve, basename } from 'path';
+import { join, dirname, resolve, basename, sep } from 'path';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, readdirSync, statSync } from 'fs';
-import { spawn } from 'child_process';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
-import { resolveCommand } from '../platform.js';
+import { resolveCommand, spawnCommand } from '../platform.js';
 import { getAuth, saveAuth, sessionExpired, accessTokenExpired, refreshTokenIfNeeded } from '../auth.js';
 import { get, post, publicPost, ApiError, getAccountSlug } from '../api.js';
 import { getConfig, saveConfigAt, clearConfigCache, getApiBaseOverride, DEFAULT_API_BASE, getConfigPath } from '../config.js';
@@ -234,7 +233,7 @@ export const claudeCommand = new Command('claude')
     // Forwarded to `claude` via the unknown-arg passthrough below (NOT in the
     // gipity strip lists). Declared here only so it shows up in --help — without
     // this, callers can't discover that the session model is selectable.
-    .option('--model <model>', 'Model for the Claude session, forwarded to claude (e.g. sonnet, opus, or a full id like claude-sonnet-4-6)')
+    .option('--model <model>', 'Model for the Claude session, forwarded to claude (e.g. sonnet, opus, or a full id like claude-sonnet-5)')
     .allowUnknownOption(true)
     .allowExcessArguments(true)
     .action(async (opts) => {
@@ -822,8 +821,9 @@ export const claudeCommand = new Command('claude')
                 allArgs.push('--verbose');
             }
         }
-        // Resolve full path on Windows so we can avoid shell:true, which
-        // passes args through cmd.exe and mangles quotes/special chars.
+        // Resolve the real path on Windows; spawnCommand then routes the `.cmd`
+        // shim through cmd.exe with verbatim args (a bare `spawn` of a `.cmd`
+        // throws EINVAL on Node >=18.20.2/20.12.2 - the CVE-2024-27980 fix).
         const claudeCmd = resolveCommand('claude');
         const childEnv = { ...process.env };
         // Gate hook-based capture: when the daemon is streaming via
@@ -844,7 +844,7 @@ export const claudeCommand = new Command('claude')
         // `-p` runs skip the dialog already, so this is only needed interactively.
         if (!nonInteractive)
             markFolderTrusted(process.cwd());
-        const child = spawn(claudeCmd, allArgs, {
+        const child = spawnCommand(claudeCmd, allArgs, {
             stdio: 'inherit',
             cwd: process.cwd(),
             env: childEnv,
@@ -945,10 +945,10 @@ function formatNewProjectLabel(existingSlugs) {
     const slug = suggestProjectName(existingSlugs);
     const root = getProjectsRoot();
     const home = homedir();
-    const display = root.startsWith(home + '/') || root === home
+    const display = root === home || root.startsWith(home + sep)
         ? '~' + root.slice(home.length)
         : root;
-    return `${display}/${slug}`;
+    return `${display}${sep}${slug}`;
 }
 /** Run the size-tier scan, surface the right UX:
  *    - easy   → silent, return true.

package/dist/commands/sandbox.js

@@ -190,6 +190,11 @@ GCC/Rust).
         if (res.data.autoMirrorSkipped) {
             console.error(dim(`Note: ${res.data.autoMirrorSkipped.reason}`));
         }
+        if (res.data.mirrorWarnings && res.data.mirrorWarnings.length > 0) {
+            console.error(dim(`Note: ${res.data.mirrorWarnings.length} project file(s) could not be mirrored into the sandbox and were skipped:`));
+            for (const w of res.data.mirrorWarnings)
+                console.error(dim(`  - ${w}`));
+        }
         if (res.data.stdout)
             console.log(res.data.stdout);
         if (res.data.stderr)

package/dist/commands/test.js

@@ -168,6 +168,12 @@ export const testCommand = new Command('test')
         console.log(clrError(`No tests matched filter: ${filterPath}`));
         process.exit(1);
     }
+    if (!filterPath && data.total === 0 && data.results.length === 0) {
+        console.log(muted('No tests ran - this app has no tests/*.test.js files.'));
+        console.log(muted('gipity test runs server-function tests only; a frontend-only app (no functions/) has nothing here to run.'));
+        console.log(muted('Verify a frontend app by driving the live page: gipity page inspect <url> (or gipity page eval).'));
+        return;
+    }
     if (data.status === 'failed' && data.errorMessage) {
         console.log(clrError(`Run failed: ${data.errorMessage}`));
         console.log('');

package/dist/knowledge.js

@@ -155,8 +155,10 @@ App services skills (load before calling \`/services/*\` endpoints):
 
 App development skills:
 - \`agent-deploy\` - headless auth via agent API tokens (GIPITY_TOKEN) for unattended deploys
+- \`app-database\` - app Postgres database: migrations, the db helper, transactions, table permissions
 - \`app-debugging\` - debug a deployed app: page inspect/eval, screenshots, function logs
 - \`app-development\` - functions, database, and API
+- \`app-testing\` - testing deployed app functions (ctx.fn.call/callAs, the isolated test DB)
 - \`deploy\` - the deploy pipeline & gipity.yaml manifest
 - \`jobs\` - long-running CPU + GPU compute jobs (Python / Node / bash)
 - \`realtime-scheduled-app\` - recipe: realtime presence/messages + DB function + scheduled poster, end-to-end

package/dist/platform.js

@@ -1,12 +1,16 @@
-import { execSync } from 'child_process';
+import { execSync, spawn, spawnSync } from 'child_process';
 /**
- * Resolve a command to something Node's spawn/spawnSync can launch directly.
+ * Resolve a command to a concrete path when possible.
  *
  * On Windows, npm-installed CLIs (npm, npx, gipity, claude) are `.cmd` batch
- * shims, not `.exe`s. Node's spawn without `shell: true` cannot launch a bare
- * `npm` - it fails with ENOENT and a null exit status. Resolving the real path
- * (preferring `.exe`, falling back to `.cmd`) lets us spawn without `shell: true`
- * (which would otherwise require escaping arguments).
+ * shims, not `.exe`s. A bare `npm` fails to spawn with ENOENT, so we resolve
+ * the real path (preferring a native `.exe`, falling back to the `.cmd` shim).
+ *
+ * NOTE: resolving to the `.cmd` path is NOT enough on its own. Since Node
+ * 18.20.2 / 20.12.2 (the CVE-2024-27980 fix), `spawn`/`spawnSync` REFUSE to
+ * launch a `.cmd`/`.bat` target unless `shell: true` - they throw `EINVAL`.
+ * So always launch a resolved command through `spawnCommand` /
+ * `spawnSyncCommand` below, which route batch shims through cmd.exe safely.
  */
 export function resolveCommand(cmd) {
     if (process.platform !== 'win32')
@@ -23,4 +27,47 @@ export function resolveCommand(cmd) {
         return `${cmd}.cmd`;
     }
 }
+/** True for a Windows batch shim that Node cannot spawn without a shell. */
+export function isBatchShim(cmd) {
+    return process.platform === 'win32' && /\.(cmd|bat)$/i.test(cmd);
+}
+/**
+ * Build a cmd.exe invocation that launches a `.cmd`/`.bat` shim with its args
+ * passed through verbatim - the correct way to run a batch file post-CVE
+ * without `shell: true` mangling argument quoting.
+ *
+ * `cmd.exe /d /s /c "<line>"`: `/d` skips AutoRun, `/s` + the wrapping outer
+ * quotes make cmd strip exactly the first and last quote of the whole line
+ * (leaving each already-quoted token intact). We quote every token ourselves
+ * and set `windowsVerbatimArguments` so Node hands our line to cmd untouched.
+ */
+export function winBatchInvocation(cmd, args) {
+    const comspec = process.env.ComSpec || 'cmd.exe';
+    // Double-quote each token; escape any embedded double-quote as "" (cmd's
+    // in-quote escape). Our call sites pass flags/paths/guids with no cmd
+    // metacharacters, so this conservative quoting is sufficient and safe.
+    const quote = (t) => `"${String(t).replace(/"/g, '""')}"`;
+    const line = [cmd, ...args].map(quote).join(' ');
+    return { file: comspec, args: ['/d', '/s', '/c', `"${line}"`] };
+}
+/**
+ * Drop-in `spawn` that survives Windows batch shims. When `cmd` is a `.cmd`/
+ * `.bat` on win32, it is launched via cmd.exe with verbatim arguments;
+ * otherwise this is a plain `spawn`. Use for anything from `resolveCommand`.
+ */
+export function spawnCommand(cmd, args = [], options = {}) {
+    if (isBatchShim(cmd)) {
+        const inv = winBatchInvocation(cmd, args);
+        return spawn(inv.file, inv.args, { ...options, windowsVerbatimArguments: true });
+    }
+    return spawn(cmd, [...args], options);
+}
+/** Drop-in `spawnSync` counterpart of {@link spawnCommand}. */
+export function spawnSyncCommand(cmd, args = [], options = {}) {
+    if (isBatchShim(cmd)) {
+        const inv = winBatchInvocation(cmd, args);
+        return spawnSync(inv.file, inv.args, { ...options, windowsVerbatimArguments: true });
+    }
+    return spawnSync(cmd, [...args], options);
+}
 //# sourceMappingURL=platform.js.map

package/dist/relay/daemon.js

@@ -1,27 +1,4 @@
-/**
- * Gipity relay daemon - the `gipity-relay` long-running helper that backs
- * `gipity relay run`. Runs two concurrent loops against the paired Gipity
- * account using the device's bearer token:
- *
- *   1. Heartbeat every 60s → POST /remote-devices/heartbeat. Drives the
- *      web CLI's presence indicator.
- *   2. Long-poll → GET /remote-devices/next. On a 200 claim, look up the
- *      dispatch's project in the local allowlist, spawn `gipity claude -p
- *      "<msg>"` in that project's cwd, wait for it to exit, POST ack.
- *
- * The conversation stream (prompts, tool calls, assistant output) flows
- * back to the web CLI *automatically* via the capture hooks installed in
- * `.claude/settings.json` - the daemon itself doesn't forward content.
- *
- * Graceful exit:
- *   - SIGINT / SIGTERM → stop both loops, wait for in-flight child, exit 0.
- *   - 401 from heartbeat or /next → device was revoked; exit 0.
- *   - Any other backend error → log and retry with exponential backoff.
- *
- * See docs/feature-backlog/gipity-relay-phases.md (Phase A Step 7).
- */
-import { spawn } from 'child_process';
-import { resolveCommand } from '../platform.js';
+import { resolveCommand, spawnCommand } from '../platform.js';
 import { appendFileSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, closeSync, openSync, unlinkSync } from 'fs';
 import { stat, readFile } from 'fs/promises';
 import { createInterface } from 'readline';
@@ -528,14 +505,15 @@ function isSafeSessionId(s) {
     return /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(s);
 }
 /** Resolve Claude Code's on-disk transcript path for measuring resume
- *  size. Claude encodes the project cwd into a slug by replacing `/` with
- *  `-`. We only read this file cosmetically (to show "resume 5 KB" in the
- *  Invoking marker); actual capture is via stream-json. Returns null for
+ *  size. Claude encodes the project cwd into a slug by replacing every
+ *  non-alphanumeric char with `-` (so `/`, and on Windows `\` and `:`, all
+ *  collapse). We only read this file cosmetically (to show "resume 5 KB" in
+ *  the Invoking marker); actual capture is via stream-json. Returns null for
  *  a sessionId that fails the safety check. */
 function transcriptPathFor(cwd, sessionId) {
     if (!isSafeSessionId(sessionId))
         return null;
-    const slug = cwd.replace(/\//g, '-');
+    const slug = cwd.replace(/[^a-zA-Z0-9]/g, '-');
     return join(homedir(), '.claude', 'projects', slug, `${sessionId}.jsonl`);
 }
 /** `18.4s` when under a minute, `3:12.2` above. */
@@ -867,7 +845,7 @@ async function spawnSync(cwd, timeoutMs) {
     // verbatim (it may be a full path); only the default name is resolved.
     const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || resolveCommand('gipity');
     return new Promise((resolve, reject) => {
-        const child = spawn(cmd, ['sync', '--json'], {
+        const child = spawnCommand(cmd, ['sync', '--json'], {
             cwd,
             env: process.env,
             stdio: ['ignore', 'pipe', 'pipe'],
@@ -921,7 +899,7 @@ export async function spawnGipityClaude(args, cwd, d) {
     const fullArgs = [...args, '--output-format', 'stream-json', '--verbose'];
     const env = { ...process.env, GIPITY_CONVERSATION_GUID: d.conversation_guid };
     return new Promise((resolve, reject) => {
-        const child = spawn(cmd, fullArgs, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+        const child = spawnCommand(cmd, fullArgs, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
         // `exited` fires when the child fully unwinds (exit event). Callers
         // like `killRunningForConv` await this before spawning a replacement
         // so the outgoing child has a chance to post its cancelled marker

package/dist/relay/installers.js

@@ -126,6 +126,14 @@ WantedBy=default.target
 function windowsTaskPlan(cliPath) {
     const taskName = 'GipityRelay';
     const path = join(homedir(), 'AppData', 'Local', 'Gipity', 'relay-task.xml');
+    // Launch through node.exe explicitly. Task Scheduler's <Command> runs the
+    // target via CreateProcess, and a `.js` cliPath (what resolveCliPath yields)
+    // would resolve to its file association - Windows Script Host - which chokes
+    // on the shebang with "Invalid character" (800A03F6). Passing the entry as a
+    // node argument runs it under Node like every other platform.
+    const runsViaNode = /\.[cm]?js$/i.test(cliPath);
+    const command = runsViaNode ? process.execPath : cliPath;
+    const argLine = runsViaNode ? `"${cliPath}" relay run` : 'relay run';
     const content = `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
@@ -151,8 +159,8 @@ function windowsTaskPlan(cliPath) {
   </Settings>
   <Actions>
     <Exec>
-      <Command>${cliPath}</Command>
-      <Arguments>relay run</Arguments>
+      <Command>${command}</Command>
+      <Arguments>${argLine}</Arguments>
     </Exec>
   </Actions>
 </Task>

package/dist/setup.js

@@ -5,7 +5,7 @@ import { resolve, join, dirname } from 'path';
 import { homedir } from 'os';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import { spawnSync } from 'child_process';
-import { resolveCommand } from './platform.js';
+import { resolveCommand, spawnSyncCommand } from './platform.js';
 import { SKILLS_CONTENT, BUILD_VS_NON_BUILD_RULE, DEFINITION_OF_DONE } from './knowledge.js';
 export { SKILLS_CONTENT };
 /** Canonical list of workstation artifacts that are NOT part of the project.
@@ -137,7 +137,7 @@ export const GIPITY_MARKETPLACE_REPO = 'GipityAI/claude-plugin';
 // an installed plugin when the marketplace advances - only an explicit
 // `plugin install`/`update` does - so this constant is how a CLI upgrade tells
 // ensureGipityPluginInstalled() to refresh a stale user-scope install.
-export const GIPITY_PLUGIN_VERSION = '0.4.0';
+export const GIPITY_PLUGIN_VERSION = '0.4.1';
 /** True for hook commands the CLI itself wrote into settings.json in past
  *  versions. Matched by signature so migration strips exactly our own
  *  entries and never touches user-authored hooks. */
@@ -288,11 +288,11 @@ export function ensureGipityPluginInstalled() {
     // without an explicit path, so resolve it (otherwise the install silently
     // ENOENTs and the plugin's hooks never land at user scope).
     const claudeCmd = resolveCommand('claude');
-    spawnSync(claudeCmd, ['plugin', 'marketplace', 'update', GIPITY_MARKETPLACE_NAME], {
+    spawnSyncCommand(claudeCmd, ['plugin', 'marketplace', 'update', GIPITY_MARKETPLACE_NAME], {
         stdio: 'ignore',
         timeout: 120_000,
     });
-    spawnSync(claudeCmd, ['plugin', 'install', GIPITY_PLUGIN_ID, '--scope', 'user'], {
+    spawnSyncCommand(claudeCmd, ['plugin', 'install', GIPITY_PLUGIN_ID, '--scope', 'user'], {
         stdio: 'ignore',
         timeout: 120_000,
     });

package/dist/updater/bootstrap.js

@@ -1,8 +1,7 @@
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
-import { spawnSync } from 'child_process';
 import { join } from 'path';
 import { LOCAL_DIR, LOCAL_ENTRY, LOCAL_PKG_DIR, writeState, readState } from './state.js';
-import { resolveCommand } from '../platform.js';
+import { resolveCommand, spawnSyncCommand } from '../platform.js';
 export function isBootstrapped() {
     return existsSync(LOCAL_ENTRY);
 }
@@ -26,7 +25,7 @@ export function bootstrap(version, quiet = false) {
     // --ignore-scripts: don't run install lifecycle hooks (gipity ships
     // precompiled, deps need no build), so a compromised package can't execute
     // code during this self-managed install.
-    const res = spawnSync(resolveCommand('npm'), ['install', '--no-audit', '--no-fund', '--ignore-scripts', `gipity@${version}`], {
+    const res = spawnSyncCommand(resolveCommand('npm'), ['install', '--no-audit', '--no-fund', '--ignore-scripts', `gipity@${version}`], {
         cwd: LOCAL_DIR,
         stdio: ['ignore', 'pipe', 'pipe'],
         encoding: 'utf-8',

package/dist/updater/check.js

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
 // Background updater. Invoked detached by the shim; can also be invoked
 // directly by `gipity update --force`.
-import { spawnSync } from 'child_process';
 import { appendFileSync, existsSync } from 'fs';
 import { LOCAL_DIR, LOCAL_ENTRY, UPDATE_LOG, readState, writeState, updatesDisabled } from './state.js';
-import { resolveCommand } from '../platform.js';
+import { resolveCommand, spawnSyncCommand } from '../platform.js';
 const CHECK_INTERVAL_MS = 4 * 60 * 60 * 1000; // 4 hours
 function log(line) {
     try {
@@ -38,7 +37,7 @@ function installVersion(version) {
     // --ignore-scripts: this runs unattended in the background, so don't let a
     // compromised package's install lifecycle hooks execute. gipity ships
     // precompiled (dist/) and its deps need no build step, so nothing is lost.
-    const res = spawnSync(resolveCommand('npm'), ['install', '--silent', '--no-audit', '--no-fund', '--ignore-scripts', `gipity@${version}`], {
+    const res = spawnSyncCommand(resolveCommand('npm'), ['install', '--silent', '--no-audit', '--no-fund', '--ignore-scripts', `gipity@${version}`], {
         cwd: LOCAL_DIR,
         stdio: 'ignore',
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gipity",
-  "version": "1.0.406",
+  "version": "1.0.408",
   "description": "The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.",
   "bin": {
     "gipity": "dist/updater/shim.js",
@@ -13,7 +13,7 @@
     "postbuild": "node scripts/gen-build-info.mjs",
     "dev": "tsc --watch",
     "test": "npm run test:smoke",
-    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
+    "test:smoke": "tsc && node --test dist/__tests__/utils.test.js dist/__tests__/platform.test.js dist/__tests__/colors.test.js dist/__tests__/config.test.js dist/__tests__/sync.test.js dist/__tests__/sync-apply.test.js dist/__tests__/sync-lock.test.js dist/__tests__/auth-lock.test.js dist/__tests__/api-401-retry.test.js dist/__tests__/push-cas.test.js dist/__tests__/upload.test.js dist/__tests__/progress.test.js dist/__tests__/updater.test.js dist/__tests__/cli-smoke.test.js dist/__tests__/claude-noninteractive.test.js dist/__tests__/claude-trust.test.js dist/__tests__/relay-state.test.js dist/__tests__/relay-daemon.test.js dist/__tests__/relay-installers.test.js dist/__tests__/relay-bridge-abort.test.js dist/__tests__/relay-redact.test.js dist/__tests__/relay-machine-id.test.js dist/__tests__/stream-json.test.js dist/__tests__/relay-ingest-contract.test.js dist/__tests__/prompts.test.js dist/__tests__/capture-transcript.test.js dist/__tests__/flag-aliases.test.js dist/__tests__/client-context.test.js dist/__tests__/adopt-cwd.test.js dist/__tests__/cli-cmd-agent.test.js dist/__tests__/cli-cmd-approval.test.js dist/__tests__/cli-cmd-audit.test.js dist/__tests__/cli-cmd-chat.test.js dist/__tests__/cli-cmd-credits.test.js dist/__tests__/cli-cmd-db.test.js dist/__tests__/cli-cmd-deploy.test.js dist/__tests__/cli-cmd-domain.test.js dist/__tests__/cli-cmd-email.test.js dist/__tests__/cli-cmd-file.test.js dist/__tests__/cli-cmd-fn.test.js dist/__tests__/cli-cmd-service.test.js dist/__tests__/cli-cmd-job.test.js dist/__tests__/cli-cmd-generate.test.js dist/__tests__/cli-cmd-gmail.test.js dist/__tests__/cli-cmd-info.test.js dist/__tests__/cli-cmd-init.test.js dist/__tests__/cli-cmd-location.test.js dist/__tests__/cli-cmd-text.test.js dist/__tests__/cli-cmd-login.test.js dist/__tests__/cli-cmd-logout.test.js dist/__tests__/cli-cmd-token.test.js dist/__tests__/cli-cmd-logs.test.js dist/__tests__/cli-cmd-memory.test.js dist/__tests__/cli-cmd-page.test.js dist/__tests__/cli-cmd-plan.test.js dist/__tests__/cli-cmd-project.test.js dist/__tests__/cli-cmd-rbac.test.js dist/__tests__/cli-cmd-realtime.test.js dist/__tests__/cli-cmd-records.test.js dist/__tests__/cli-cmd-relay.test.js dist/__tests__/cli-cmd-doctor.test.js dist/__tests__/claude-setup.test.js dist/__tests__/cli-cmd-sandbox.test.js dist/__tests__/cli-cmd-add.test.js dist/__tests__/cli-cmd-remove.test.js dist/__tests__/cli-cmd-skill.test.js dist/__tests__/cli-cmd-test.test.js dist/__tests__/cli-cmd-workflow.test.js dist/__tests__/setup-skills-block.test.js dist/__tests__/setup-hooks.test.js",
     "test:e2e": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-live.test.js dist/__tests__/cli-e2e-sync-live.test.js dist/__tests__/cli-e2e-services-media-live.test.js dist/__tests__/cli-e2e-workflow-live.test.js dist/__tests__/cli-e2e-sandbox-live.test.js dist/__tests__/cli-e2e-page-fetch-live.test.js dist/__tests__/cli-e2e-page-test-live.test.js",
     "test:e2e:sync": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sync-live.test.js",
     "test:e2e:sandbox": "tsc && GIPITY_E2E=1 node --test --test-timeout=180000 dist/__tests__/cli-e2e-sandbox-live.test.js"
@@ -33,8 +33,7 @@
   },
   "files": [
     "dist/**/*.js",
-    "!dist/__tests__/**",
-    "hooks"
+    "!dist/__tests__/**"
   ],
   "license": "MIT"
 }

package/hooks/post-write.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-# PostToolUse hook: push file to Gipity after Write/Edit
-# Runs after CC's Write or Edit tool. Fires gipity push in background.
-
-INPUT=$(cat)
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
-
-# Skip if no file path extracted
-[ -z "$FILE_PATH" ] && exit 0
-
-# Skip if not a Gipity project
-[ ! -f ".gipity.json" ] && exit 0
-
-# Push in background, suppress output
-gipity push "$FILE_PATH" --quiet &
-disown
-exit 0

package/hooks/pre-turn.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-# UserPromptSubmit hook: sync check before each CC turn
-# Pulls remote changes and reports diff as systemMessage.
-
-# Skip if not a Gipity project
-[ ! -f ".gipity.json" ] && exit 0
-
-# Sync down with JSON output
-RESULT=$(gipity sync down --json 2>/dev/null)
-
-# Check if any files were pulled
-PULLED=$(echo "$RESULT" | jq -r '.pulled // 0' 2>/dev/null)
-
-if [ "$PULLED" -gt 0 ]; then
-  SUMMARY=$(echo "$RESULT" | jq -r '.summary // "Files changed remotely."' 2>/dev/null)
-  # Output systemMessage so CC sees the diff
-  echo "{\"systemMessage\": \"Gipity sync: ${SUMMARY}\"}"
-fi
-
-exit 0