gipity 1.0.409 → 1.0.410

package/dist/index.js

@@ -25,8 +25,8 @@ import { projectCommand } from './commands/project.js';
 import { agentCommand } from './commands/agent.js';
 import { workflowCommand } from './commands/workflow.js';
 import { creditsCommand } from './commands/credits.js';
-import { planCommand } from './commands/plan.js';
 import { fileCommand } from './commands/file.js';
+import { storageCommand } from './commands/storage.js';
 import { claudeCommand } from './commands/claude.js';
 import { addCommand } from './commands/add.js';
 import { removeCommand } from './commands/remove.js';
@@ -37,6 +37,7 @@ import { fnCommand } from './commands/fn.js';
 import { serviceCommand } from './commands/service.js';
 import { secretsCommand } from './commands/secrets.js';
 import { notifyCommand } from './commands/notify.js';
+import { bugCommand } from './commands/bug.js';
 import { paymentsCommand } from './commands/payments.js';
 import { jobCommand } from './commands/job.js';
 import { rbacCommand } from './commands/rbac.js';
@@ -126,11 +127,11 @@ program.enablePositionalOptions();
 const commonGroup = [skillCommand, projectCommand, addCommand, removeCommand, deployCommand];
 const connectGroup = [claudeCommand, relayCommand];
 const projectGroup = [domainCommand, statusCommand, initCommand];
-const filesGroup = [fileCommand, syncCommand, pushCommand, uploadCommand];
+const filesGroup = [fileCommand, storageCommand, syncCommand, pushCommand, uploadCommand];
 const appBuildingGroup = [testCommand, fnCommand, serviceCommand, secretsCommand, notifyCommand, paymentsCommand, jobCommand, dbCommand, logsCommand, workflowCommand, realtimeCommand, rbacCommand, auditCommand, recordsCommand];
 const utilitiesGroup = [pageCommand, sandboxCommand, generateCommand, emailCommand, gmailCommand, locationCommand, textCommand];
-const agentGroup = [chatCommand, memoryCommand, agentCommand, approvalCommand];
-const setupGroup = [loginCommand, logoutCommand, tokenCommand, creditsCommand, planCommand, doctorCommand, updateCommand, uninstallCommand];
+const agentGroup = [chatCommand, memoryCommand, agentCommand, approvalCommand, bugCommand];
+const setupGroup = [loginCommand, logoutCommand, tokenCommand, creditsCommand, doctorCommand, updateCommand, uninstallCommand];
 const HELP_SECTIONS = [
     { title: 'Common', cmds: commonGroup },
     { title: 'Connect', cmds: connectGroup },

package/dist/knowledge.js

@@ -64,6 +64,10 @@ Gipity ships first-party services for what apps usually pull from third parties
 
 When a user asks about Gipity itself - how to install it, what it costs, what's shipped, how a command or flag works - answer from an authoritative source, not memory, and don't hedge with "I don't want to guess." Check in this order: (1) \`gipity skill read <name>\` / \`gipity skill list\` - install and account basics live in \`getting-started\`; (2) \`gipity <command> --help\` for command syntax; (3) if it's genuinely not in the skills or CLI help, fetch the live site at \`https://gipity.ai\` (or web search) and cite what you found. A wrong or vague answer about the product is worse than spending one tool call to get the current, correct one.
 
+## Plans, limits & upgrading - unblock the user
+
+Gipity runs on **credits** (the one consumable) and **plans** (Free / Gipity Pro) that set limits and the monthly credit grant. When a metered action fails with a limit error - "limit reached", "on your plan", "Pro only", or "Insufficient credits" - that's your cue to help them upgrade, not just report the error. The play: name what they hit, run \`gipity credits list\` to compare plans, surface what Pro unlocks for *their* task, then run \`gipity credits buy\` and hand them the checkout link (it only prints a link - Stripe takes payment; nothing is charged until they click and pay). Do it proactively and once - don't nag. \`gipity credits\` shows their current plan, balance, and full limits. Load the \`plans\` skill for the full model and honest positioning vs other platforms; never quote a price or limit from memory - read it live.
+
 ## Gipity is opinionated - build on its stack
 
 Gipity is an opinionated platform with its own best-practice stack, and that stack is the one you use - whatever tools the user names. The platform layer is fixed:
@@ -105,12 +109,30 @@ mkdir -p ~/GipityProjects/<slug> && cd ~/GipityProjects/<slug> && gipity init <s
 Key commands: \`gipity add <template|kit>\`, \`gipity deploy dev\`, \`gipity sandbox run\`, \`gipity page inspect <url>\`, \`gipity page screenshot <url>\`, \`gipity db query "SQL"\`, \`gipity fn call <name>\`, \`gipity logs fn <name>\`, \`gipity secrets set <NAME> <value> [--account]\` (store an API key/token encrypted; read in functions via \`secrets.get('NAME')\` — never hardcode keys), \`gipity email send --to <addr> --subject <s> --body <b>\` (sends as \`gipity@gipity.ai\`; omit \`--to\` to self-send), \`gipity skill read <name>\`.
 Pull an existing remote project local (given its URL/slug): \`mkdir -p ~/GipityProjects/<slug> && cd ~/GipityProjects/<slug> && gipity init <slug>\` (adopts the matching project and syncs files down - this is the "clone").
 For deterministic text questions (letter/word counts, substring occurrences, nth word/char, anagrams), use \`gipity text analyze "<text>"\` - local and instant, no sandbox or LLM needed.
+Hit a platform bug or friction? File it in real time: \`gipity bug report --category <cli|deploy|template|kit|db|docs|skill|service|sandbox|other> --severity <S1|S2|S3|S4> --summary "<7 words max>" [--detail "<what failed + workaround>"]\` (see below).
 Run \`gipity --help\` for the full list. Use \`--help\` on any command for details.
 
 Function return shape: \`gipity fn call\`, the in-test \`ctx.fn.call\`/\`callAs\`, and the client \`Gipity.fn\` all return your function's value **unwrapped** - read/assert \`result.field\`. Only raw HTTP/\`curl\` wraps it as \`{ data: ... }\`; never write \`result.data.field\` in a test.
 
 Tests are isolated, not run against your live DB: \`gipity test\` points \`ctx.fn.call\`/\`callAs\` at a throwaway copy of your database (your \`migrations/\` + \`seeds/\`), reset (truncate + reseed) before every run - so test rows never reach the deployed app and you don't write teardown. Functions see \`ctx.isTest === true\` during a run (use it to skip your own rate limiting); the platform also suppresses \`notify()\` push so a suite can't spam subscribers. Reference data tests need goes in seed files; a runtime-written settings table that isn't seeded goes under \`test.preserve\` in \`gipity.yaml\`. Build per-file fixtures in \`setup(fn)\` → \`ctx.fixtures\`, and namespace unique values with \`ctx.testId\`.
 
+## Hit friction on the platform? Report it in real time
+
+When *the Gipity platform itself* fights you — a CLI command errors or behaves unexpectedly, a doc/skill is wrong or missing, a deploy/template/kit/service/sandbox misbehaves — file a bug report the moment it happens, **even if you found a workaround and kept going.** Capturing it in the moment (with the real cause fresh) beats us mining it out of transcripts later.
+
+\`\`\`
+gipity bug report --category <cli|deploy|template|kit|db|docs|skill|service|sandbox|other> \\
+                  --severity <S1|S2|S3|S4> \\
+                  --summary "one line, 7 words max" \\
+                  --detail "what you did, what failed, the workaround"
+\`\`\`
+
+- **Severity:** S1 blocker (no workaround) · S2 major (costly workaround) · S3 minor (easy workaround) · S4 friction (papercut).
+- **summary** ≤ 7 words; **detail** as succinct as possible (a few sentences, not a transcript).
+- **Never include PII or user data** (emails, names, secrets, tokens, prompt/file contents) — describe the platform problem in the abstract.
+- File it for *platform* problems, not your own mistakes or the app's own bugs. One report per distinct problem.
+- Reports go to a review queue for the team to triage into fixes; see what you've filed with \`gipity bug list\`.
+
 ## Tool output is complete and synchronous
 
 Every tool call returns its full output with that call. There is no output buffer to flush. Never run no-op commands (echo, date, sleep, repeated reads) to "retrieve" or "flush" lagged output - if a result looks empty or delayed, treat it as the actual result and move on, or re-run the real command once.

package/dist/platform.js

@@ -16,7 +16,7 @@ export function resolveCommand(cmd) {
     if (process.platform !== 'win32')
         return cmd;
     try {
-        const lines = execSync(`where ${cmd}`, { encoding: 'utf-8' })
+        const lines = execSync(`where ${cmd}`, { encoding: 'utf-8', windowsHide: true })
             .split(/\r?\n/)
             .map(l => l.trim())
             .filter(Boolean);
@@ -54,20 +54,24 @@ export function winBatchInvocation(cmd, args) {
  * Drop-in `spawn` that survives Windows batch shims. When `cmd` is a `.cmd`/
  * `.bat` on win32, it is launched via cmd.exe with verbatim arguments;
  * otherwise this is a plain `spawn`. Use for anything from `resolveCommand`.
+ *
+ * `windowsHide: true` is the default so background/detached children (and the
+ * cmd.exe wrapper we use for batch shims) never flash a console window on
+ * Windows; a caller can still override it in `options`.
  */
 export function spawnCommand(cmd, args = [], options = {}) {
     if (isBatchShim(cmd)) {
         const inv = winBatchInvocation(cmd, args);
-        return spawn(inv.file, inv.args, { ...options, windowsVerbatimArguments: true });
+        return spawn(inv.file, inv.args, { windowsHide: true, ...options, windowsVerbatimArguments: true });
     }
-    return spawn(cmd, [...args], options);
+    return spawn(cmd, [...args], { windowsHide: true, ...options });
 }
 /** Drop-in `spawnSync` counterpart of {@link spawnCommand}. */
 export function spawnSyncCommand(cmd, args = [], options = {}) {
     if (isBatchShim(cmd)) {
         const inv = winBatchInvocation(cmd, args);
-        return spawnSync(inv.file, inv.args, { ...options, windowsVerbatimArguments: true });
+        return spawnSync(inv.file, inv.args, { windowsHide: true, ...options, windowsVerbatimArguments: true });
     }
-    return spawnSync(cmd, [...args], options);
+    return spawnSync(cmd, [...args], { windowsHide: true, ...options });
 }
 //# sourceMappingURL=platform.js.map

package/dist/relay/daemon.js

@@ -124,10 +124,11 @@ function lockLogPerms(dir, file) {
         chmodSync(dir, 0o700);
     }
     catch { /* ignore - best-effort */ }
-    // Ensure file exists before chmod; open+close creates it if missing.
+    // Ensure file exists before chmod; open+close creates it if missing. Pass
+    // mode 0600 so it's owner-only from creation (no umask-default race window).
     if (!existsSync(file)) {
         try {
-            closeSync(openSync(file, 'a'));
+            closeSync(openSync(file, 'a', 0o600));
         }
         catch { /* ignore */ }
     }
@@ -403,10 +404,36 @@ function getRelaySecrets() {
  *  Every entry is run through `redactEntries` first: a dispatched
  *  `bypassPermissions` session can read the host's credentials, so this is
  *  the single chokepoint that keeps a leaked secret out of the transcript. */
+// Server-side per-entry length caps (remote-sessions.ts ingest schema). The
+// server rejects the ENTIRE batch with a 400 if any entry violates one, which
+// would drop good content (and, for the prompt echo, the "Running…" marker
+// batched with it). We clamp defensively here so a batch never 400s on length
+// - truncating an over-long value is strictly better than losing the batch.
+const INGEST_PROMPT_MAX = 200_000;
+const INGEST_ASSISTANT_MAX = 500_000;
+const INGEST_SYSTEM_MAX = 500;
+const TRUNCATE_SUFFIX = '… [truncated]';
+function clampText(s, max) {
+    return s.length <= max ? s : s.slice(0, max - TRUNCATE_SUFFIX.length) + TRUNCATE_SUFFIX;
+}
+/** Clamp the human-text fields that have server caps. Runs AFTER redaction so
+ *  truncation can't split a secret past the literal-match scrubber. Exported
+ *  for unit testing. */
+export function clampForIngest(entries) {
+    return entries.map(e => {
+        if (e.kind === 'prompt')
+            return { ...e, prompt: clampText(e.prompt, INGEST_PROMPT_MAX) };
+        if (e.kind === 'assistant')
+            return { ...e, text: clampText(e.text, INGEST_ASSISTANT_MAX) };
+        if (e.kind === 'system')
+            return { ...e, content: clampText(e.content, INGEST_SYSTEM_MAX) };
+        return e;
+    });
+}
 async function postIngest(convGuid, entries) {
     if (!entries.length)
         return { ok: true };
-    const safeEntries = redactEntries(entries, getRelaySecrets());
+    const safeEntries = clampForIngest(redactEntries(entries, getRelaySecrets()));
     try {
         const res = await deviceFetch('POST', `/remote-sessions/${encodeURIComponent(convGuid)}/ingest`, {
             entries: safeEntries,
@@ -525,10 +552,16 @@ function formatDuration(ms) {
     const s = totalSec - m * 60;
     return `${m}:${s.toFixed(1).padStart(4, '0')}`;
 }
+// The server's ack schema caps `error` at 2000 chars and 400s anything longer
+// - which would leave the dispatch stuck in `delivering` forever (no ack, no
+// broadcast, a permanent queue-cap slot). Some error strings we build embed an
+// arbitrary OS/spawn message, so clamp here to stay under the cap.
+const MAX_ACK_ERROR_CHARS = 2000;
 async function ack(shortGuid, status, error) {
+    const safeError = error != null ? error.slice(0, MAX_ACK_ERROR_CHARS) : null;
     try {
         const res = await deviceFetch('POST', `/remote-devices/dispatches/${encodeURIComponent(shortGuid)}/ack`, {
-            status, error: error ?? null,
+            status, error: safeError,
         }, 10_000);
         if (!res.ok) {
             // fetch() doesn't throw on 4xx/5xx - surface it ourselves so a
@@ -588,9 +621,9 @@ async function handleDispatch(d) {
     // the dispatch (the old in-process bootstrap sync could hang forever).
     if (bootstrapped) {
         await postIngest(d.conversation_guid, [{ kind: 'system', content: 'Syncing project files…' }]);
+        let syncKilled = false;
         try {
-            await spawnSync(cwd, PROJECT_SYNC_TIMEOUT_MS);
-            await postIngest(d.conversation_guid, [{ kind: 'system', content: 'Project files synced.' }]);
+            syncKilled = (await runDispatchSync(d, cwd)).killed;
         }
         catch (err) {
             const msg = `project sync ${err?.message || 'failed'}`;
@@ -599,6 +632,16 @@ async function handleDispatch(d) {
             await ack(d.short_guid, 'error', msg);
             return;
         }
+        if (syncKilled) {
+            // The user cancelled (or a newer message for this conv superseded us)
+            // WHILE the pre-Claude sync was running. Before this was registered in
+            // `running`, a cancel was silently ignored until the 120s sync timeout.
+            log('info', 'dispatch cancelled during project sync', { id: d.short_guid });
+            await postIngest(d.conversation_guid, [{ kind: 'system', content: 'Claude Code cancelled (during project sync)' }]);
+            await ack(d.short_guid, 'cancelled');
+            return;
+        }
+        await postIngest(d.conversation_guid, [{ kind: 'system', content: 'Project files synced.' }]);
     }
     // Build argv for `gipity claude -p …` (or with --resume). No shell - argv
     // as array so the message string can't be interpreted as shell syntax.
@@ -813,6 +856,11 @@ export function getRunningConvGuids() {
  *  cancelled marker). Used at the top of handleDispatch so a new message
  *  for a busy conv cleanly replaces the in-flight one. No-op if no child
  *  matches. */
+/** Grace period between SIGTERM and the SIGKILL escalation. A child that traps
+ *  or ignores SIGTERM (or is blocked in uninterruptible I/O) must not hang the
+ *  handler forever - that would permanently hold one of the concurrency slots.
+ *  Overridable for tests. */
+const KILL_GRACE_MS = parseInt(process.env.GIPITY_RELAY_KILL_GRACE_MS || '10000', 10);
 export async function killRunningForConv(convGuid) {
     const matches = [...running.values()].filter(e => e.convGuid === convGuid);
     if (matches.length === 0)
@@ -824,7 +872,29 @@ export async function killRunningForConv(convGuid) {
         }
         catch { /* ignore - already exited */ }
     }
+    // Wait for a clean unwind, but escalate to SIGKILL if the grace period
+    // elapses so a stuck child can't wedge a slot. Whichever resolves first,
+    // we still await `exited` so the outgoing children post their cancelled
+    // markers + acks before the replacement spawns.
+    const graceTimers = [];
+    const escalate = new Promise(resolve => {
+        const t = setTimeout(() => {
+            for (const e of matches) {
+                log('warn', 'previous dispatch ignored SIGTERM - escalating to SIGKILL', { conv: convGuid });
+                try {
+                    e.child.kill('SIGKILL');
+                }
+                catch { /* already gone */ }
+            }
+            resolve();
+        }, KILL_GRACE_MS);
+        graceTimers.push(t);
+    });
+    await Promise.race([Promise.all(matches.map(e => e.exited)), escalate]);
+    // Ensure every child has actually exited (SIGKILL fires the exit event too).
     await Promise.all(matches.map(e => e.exited));
+    for (const t of graceTimers)
+        clearTimeout(t);
 }
 /** Spawn `gipity claude …` in `cwd` with `--output-format stream-json
  *  --verbose` so every event (assistant messages, tool_use blocks,
@@ -839,7 +909,7 @@ export async function killRunningForConv(convGuid) {
  *  back to VFS. Runs as a child so we inherit sync's cwd-walk for config
  *  resolution (the daemon itself doesn't chdir into projects).
  *  Non-blocking on failure - caller catches and logs. */
-async function spawnSync(cwd, timeoutMs) {
+async function spawnSync(cwd, timeoutMs, onSpawn) {
     // resolveCommand: on Windows the bare `gipity` is a .cmd shim that spawn
     // can't launch without an explicit path. An explicit env override is used
     // verbatim (it may be a full path); only the default name is resolved.
@@ -850,6 +920,9 @@ async function spawnSync(cwd, timeoutMs) {
             env: process.env,
             stdio: ['ignore', 'pipe', 'pipe'],
         });
+        // Hand the child to the caller so it can register the sync in `running`,
+        // making it cancellable (the poller / kill-on-new-message can SIGTERM it).
+        onSpawn?.(child);
         // Drain pipes so the child doesn't stall on a full buffer.
         let stdoutLen = 0;
         let stderrBuf = '';
@@ -1001,6 +1074,38 @@ export async function spawnGipityClaude(args, cwd, d) {
         });
     });
 }
+/** Run the pre-Claude `gipity sync` for a dispatch, registered in `running`
+ *  so it's cancellable. Without this the dispatch is invisible to the
+ *  cancellation poller and to kill-on-new-message during the sync, so a slow
+ *  sync couldn't be interrupted for up to PROJECT_SYNC_TIMEOUT_MS. Returns
+ *  `{ killed }` = true when the sync child was SIGTERMed externally (user
+ *  cancel or a newer message on the same conv), distinct from a genuine sync
+ *  failure (which throws) - the daemon's own timeout uses SIGKILL, so a
+ *  SIGTERM here can only be an external interrupt. */
+async function runDispatchSync(d, cwd) {
+    let killed = false;
+    try {
+        await spawnSync(cwd, PROJECT_SYNC_TIMEOUT_MS, (child) => {
+            const exited = new Promise(resolve => {
+                child.once('exit', (_code, signal) => {
+                    if (signal === 'SIGTERM')
+                        killed = true;
+                    resolve();
+                });
+            });
+            running.set(d.short_guid, { child, convGuid: d.conversation_guid, exited });
+        });
+        return { killed: false };
+    }
+    catch (err) {
+        if (killed)
+            return { killed: true };
+        throw err;
+    }
+    finally {
+        running.delete(d.short_guid);
+    }
+}
 /** SIGTERM a specific running dispatch. Returns true if one was killed,
  *  false if no such child was running on this daemon. */
 export function killDispatch(shortGuid) {

package/dist/relay/installers.js

@@ -60,7 +60,15 @@ function launchdPlan(cliPath) {
     <string>run</string>
   </array>
   <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
+  <!-- Restart ONLY on a non-zero exit, mirroring systemd's Restart=on-failure.
+       The daemon exits 0 on a clean revoke/shutdown; a bare KeepAlive=true
+       would relaunch it anyway, and run() would then silently re-register a
+       new device - undoing the revoke. SuccessfulExit=false keeps crash
+       recovery without that re-pair loop. -->
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key><false/>
+  </dict>
   <key>StandardOutPath</key><string>${join(logDir, 'relay.out.log')}</string>
   <key>StandardErrorPath</key><string>${join(logDir, 'relay.err.log')}</string>
   <key>ProcessType</key><string>Background</string>
@@ -80,7 +88,7 @@ function launchdPlan(cliPath) {
         enableDisplay: display(enableCmds),
         disableDisplay: display(disableCmds),
         statusDisplay: statusCmd.join(' '),
-        summary: 'LaunchAgent at ~/Library/LaunchAgents/ai.gipity.relay.plist (starts at login, auto-restarts)',
+        summary: 'LaunchAgent at ~/Library/LaunchAgents/ai.gipity.relay.plist (starts at login, restarts on failure)',
     };
 }
 // ─── Linux - systemd --user unit ───────────────────────────────────────

package/dist/relay/onboarding.js

@@ -56,8 +56,11 @@ export async function maybeOfferRelayOn() {
     }
     catch (err) {
         console.error(`\n  ${clrError(`Could not create device: ${err?.message || err}`)}`);
-        console.error(`  ${dim('Skipping relay setup. Try later with `gipity relay install`.')}`);
-        state.setRelayEnabled(false);
+        console.error(`  ${dim('Skipping for now - we\'ll offer again next time. Or turn it on with `gipity relay install`.')}`);
+        // Deliberately DON'T persist relay_enabled here: the user SAID YES, and
+        // this is a transient failure (network blip, server down). Leaving the
+        // tri-state unset means onboarding re-offers on the next `gipity claude`
+        // run instead of silently opting the user out forever.
         return;
     }
     // Start the daemon for this session.

package/dist/relay/redact.js

@@ -38,15 +38,38 @@ const JWT_RE = /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g;
  *  literal-secret list. An `sk-ant-` token in a relay transcript is always a
  *  credential, so over-redaction risk is negligible. */
 const ANTHROPIC_KEY_RE = /sk-ant-[A-Za-z0-9_-]{20,}/g;
-/** Replace every occurrence of each known secret - and any JWT- or
- *  Anthropic-key-shaped substring - in `text` with the marker. */
+/** Well-known third-party credential shapes. A `bypassPermissions` session can
+ *  read the host's environment and files, so a `cat .env` / `env` could echo
+ *  ANY of these into the transcript - not just the Gipity/Anthropic tokens on
+ *  the literal-secret list. Each pattern is a high-entropy, provider-specific
+ *  prefix that is effectively never a false positive in a relay transcript, so
+ *  the over-redaction risk is the same negligible trade-off already accepted
+ *  for the JWT and `sk-ant-` passes. Extend this list as new providers appear;
+ *  it is defense-in-depth, NOT a guarantee (a base64/chunked secret still
+ *  slips through - the real backstop remains an instantly-revocable
+ *  credential). */
+const THIRD_PARTY_KEY_RES = [
+    /sk-[A-Za-z0-9_-]{20,}/g, // OpenAI (sk-, sk-proj-) + any sk- key
+    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, // GitHub tokens
+    /\bgithub_pat_[A-Za-z0-9_]{60,}\b/g, // GitHub fine-grained PAT
+    /\bAKIA[0-9A-Z]{16}\b/g, // AWS access key id
+    /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b/g, // Stripe live secret/restricted key
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, // Slack tokens
+    /\bAIza[A-Za-z0-9_-]{35}\b/g, // Google API key
+    /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g, // PEM private keys
+];
+/** Replace every occurrence of each known secret - plus any JWT-, Anthropic-,
+ *  or well-known-third-party-key-shaped substring - in `text` with the marker. */
 function redactString(text, secrets) {
     let out = text;
     for (const secret of secrets) {
         if (out.includes(secret))
             out = out.split(secret).join(REDACTION_MARKER);
     }
-    return out.replace(JWT_RE, REDACTION_MARKER).replace(ANTHROPIC_KEY_RE, REDACTION_MARKER);
+    out = out.replace(JWT_RE, REDACTION_MARKER).replace(ANTHROPIC_KEY_RE, REDACTION_MARKER);
+    for (const re of THIRD_PARTY_KEY_RES)
+        out = out.replace(re, REDACTION_MARKER);
+    return out;
 }
 /** Deep-walk any JSON-ish value, redacting every string. Returns a new
  *  value; objects/arrays are cloned, primitives passed through. */

package/dist/relay/setup.js

@@ -10,7 +10,7 @@
  * the interactive prompts that live in `onboarding.ts`. No `console` output
  * and no `process.exit` in this module: callers own all UX.
  */
-import { spawn, spawnSync } from 'child_process';
+import { spawnCommand, spawnSyncCommand } from '../platform.js';
 import { hostname, platform as osPlatform } from 'os';
 import { resolve, dirname } from 'path';
 import { mkdirSync, writeFileSync } from 'fs';
@@ -87,7 +87,7 @@ export function startDaemon() {
     if (state.isDaemonRunning())
         return;
     try {
-        const child = spawn(process.execPath, [resolveCliPath(), 'relay', 'run'], {
+        const child = spawnCommand(process.execPath, [resolveCliPath(), 'relay', 'run'], {
             detached: true,
             stdio: 'ignore',
         });
@@ -118,7 +118,7 @@ export function installAutostart(opts = {}) {
     writeFileSync(plan.path, plan.content);
     let ok = true;
     for (const argv of plan.enableCmds) {
-        const r = spawnSync(argv[0], argv.slice(1), { stdio });
+        const r = spawnSyncCommand(argv[0], argv.slice(1), { stdio });
         if (r.status !== 0) {
             ok = false;
             break;
@@ -136,7 +136,7 @@ export function removeAutostart(opts = {}) {
     const plan = planFor({ cliPath: resolveCliPath() });
     let ok = true;
     for (const argv of plan.disableCmds) {
-        const r = spawnSync(argv[0], argv.slice(1), { stdio });
+        const r = spawnSyncCommand(argv[0], argv.slice(1), { stdio });
         if (r.status !== 0)
             ok = false;
     }

package/dist/relay/state.js

@@ -47,9 +47,12 @@ export function loadState() {
 }
 export function saveState(state) {
     mkdirSync(RELAY_DIR, { recursive: true });
-    writeFileSync(RELAY_FILE, JSON.stringify(state, null, 2) + '\n');
-    // Token is inside - enforce owner-only even if the file existed with
-    // looser permissions before.
+    // `mode` on write means a NEWLY-created file is owner-only from the first
+    // byte - no window where it exists at the umask default (typically 0644)
+    // before a follow-up chmod tightens it. The chmodSync still runs to fix a
+    // file that already existed with looser permissions (mode is ignored for
+    // an existing file).
+    writeFileSync(RELAY_FILE, JSON.stringify(state, null, 2) + '\n', { mode: FILE_MODE });
     try {
         chmodSync(RELAY_FILE, FILE_MODE);
     }

package/dist/setup.js

@@ -4,7 +4,6 @@
 import { resolve, join, dirname } from 'path';
 import { homedir } from 'os';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
-import { spawnSync } from 'child_process';
 import { resolveCommand, spawnSyncCommand } from './platform.js';
 import { SKILLS_CONTENT, BUILD_VS_NON_BUILD_RULE, DEFINITION_OF_DONE } from './knowledge.js';
 export { SKILLS_CONTENT };
@@ -257,10 +256,10 @@ export function userScopePluginCurrent() {
     }
 }
 function claudeOnPath() {
-    const probe = spawnSync(process.platform === 'win32' ? 'where' : 'which', ['claude'], {
+    const probe = spawnSyncCommand(process.platform === 'win32' ? 'where' : 'which', ['claude'], {
         encoding: 'utf-8',
     });
-    return probe.status === 0 && !!probe.stdout?.trim();
+    return probe.status === 0 && !!probe.stdout?.toString().trim();
 }
 /** Materialize the Gipity plugin at USER scope via Claude Code's own plugin
  *  CLI, so its hooks (session capture + file sync) load in EVERY directory.