gipity 1.0.422 → 1.0.425

package/dist/api.js

@@ -353,12 +353,14 @@ export async function getAccountSlug() {
     accountSlugCache = res.data.accountSlug;
     return accountSlugCache;
 }
-/** Unauthenticated request (for login/verify) */
-export async function publicPost(path, body) {
+/** Unauthenticated request (for login/verify, and anonymous-visitor calls like
+ *  `fn call --anon`). extraHeaders lets callers attach non-auth headers such as
+ *  X-App-Token; no Authorization header is ever sent. */
+export async function publicPost(path, body, extraHeaders) {
     const url = `${baseUrl()}${path}`;
     const res = await fetch(url, {
         method: 'POST',
-        headers: { ...clientHeaders(), 'Content-Type': 'application/json' },
+        headers: { ...clientHeaders(), 'Content-Type': 'application/json', ...extraHeaders },
         body: JSON.stringify(body),
     });
     if (!res.ok) {

package/dist/commands/add.js

@@ -5,7 +5,7 @@ import { Command } from 'commander';
 import { post } from '../api.js';
 import { requireConfig } from '../config.js';
 import { sync } from '../sync.js';
-import { success, muted, bold, warning } from '../colors.js';
+import { success, muted, bold, warning, error as clrError } from '../colors.js';
 import { run } from '../helpers/index.js';
 import { createProgressReporter, withSpinner } from '../progress.js';
 const STARTERS = [
@@ -164,9 +164,14 @@ export const addCommand = new Command('add')
         }
         return;
     }
-    // No name = show the full help (usage + options + catalog), same as --help.
+    // No name is a usage error, not a help request: error + help on STDERR and
+    // a nonzero exit. (It used to outputHelp() to stdout and exit 0, which an
+    // agent piping through `tail` reads as a successful add that printed
+    // help-shaped output.)
     if (!name) {
-        command.outputHelp();
+        console.error(clrError('Missing template or kit name. Usage: gipity add <name>  (see the catalog below, or `gipity add --list`)'));
+        command.outputHelp({ error: true });
+        process.exitCode = 1;
         return;
     }
     const config = requireConfig();
@@ -201,6 +206,12 @@ export const addCommand = new Command('add')
     }
     // The server runs the whole install pipeline before responding; animate the
     // wait, then clear the spinner so the installed-files list is the result.
+    // The spinner is TTY-only, so piped/agent transcripts would otherwise show
+    // a silent multi-second gap (favicon generation on a cold cache can take
+    // ~10s, cli#117) - leave one stderr marker so the wait reads as work.
+    if (!opts.json && !process.stdout.isTTY) {
+        console.error(muted('Installing (server writes files + generates favicons; first add for a title can take ~10s)...'));
+    }
     const doAdd = () => post(`/projects/${config.projectGuid}/add`, body);
     const res = opts.json
         ? await doAdd()

package/dist/commands/bug.js

@@ -15,7 +15,9 @@ export const bugCommand = new Command('bug')
     `\nso the team can triage it into a fix.\n` +
     `\nCategories: ${CATEGORIES.join(', ')}` +
     `\nSeverity:   ${SEVERITY_HINT}` +
-    `\nNever include PII or user data — describe the platform problem in the abstract.`);
+    `\nNever include PII or user data — describe the platform problem in the abstract.` +
+    `\nFiled one by mistake? Withdraw it yourself with \`gipity bug retract <id>\`` +
+    `\n(works until a human picks it up) — don't file a second report asking for a close.`);
 bugCommand
     .command('report')
     .description('File a bug / friction report about the Gipity platform')
@@ -43,6 +45,24 @@ bugCommand
     }
     console.log(success(`✓ Bug report filed (${res.data.report_guid}) — queued for triage.`));
 }));
+bugCommand
+    .command('retract <id>')
+    .description('Withdraw a bug report you filed (e.g. it was your own mistake)')
+    .option('--reason <text>', 'Short note for triage on why you are retracting')
+    .option('--project <guid-or-slug>', 'Resolve auth against a specific project instead of cwd / Home')
+    .option('--json', 'Output raw JSON')
+    .addHelpText('after', `\nOnly works on your own reports, and only while they are still queued` +
+    `\n(status new/triaged). Once a report is filed/fixed/dismissed, a human` +
+    `\nowns closing it out. Find report ids with \`gipity bug list\`.`)
+    .action((id, opts) => run('Bug report', async () => {
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
+    const res = await post(`/api/${config.projectGuid}/services/bug-report/retract`, { report_guid: id, reason: opts.reason });
+    if (opts.json) {
+        console.log(JSON.stringify(res.data));
+        return;
+    }
+    console.log(success(`✓ Bug report ${res.data.report_guid} retracted — it is out of the triage queue.`));
+}));
 bugCommand
     .command('list')
     .description('List the bug / friction reports you have filed')

package/dist/commands/claude.js

@@ -20,7 +20,25 @@ import { printBanner } from '../banner.js';
 import { scanForAdoption, isLikelyEmpty, canAdoptCwd, formatCwdLabel, formatBytes, adoptCurrentDir, ADOPT_THRESHOLDS, } from '../adopt-cwd.js';
 import { isClaudeInstalled, ensureClaudeInstalled, CLAUDE_PACKAGE } from '../claude-setup.js';
 const __clDir = dirname(fileURLToPath(import.meta.url));
-const __clPkg = JSON.parse(readFileSync(resolve(__clDir, '../../package.json'), 'utf-8'));
+// Walk up to the nearest gipity package.json instead of a hardcoded '../..':
+// the per-module tsc layout puts this file at dist/commands/, the bundled CLI
+// at dist/, so a fixed depth breaks one of the two layouts.
+function readOwnPkg(fromDir) {
+    for (let d = fromDir;; d = dirname(d)) {
+        const p = join(d, 'package.json');
+        if (existsSync(p)) {
+            try {
+                const pkg = JSON.parse(readFileSync(p, 'utf-8'));
+                if (pkg.name === 'gipity')
+                    return pkg;
+            }
+            catch { /* keep walking */ }
+        }
+        if (dirname(d) === d)
+            return {};
+    }
+}
+const __clPkg = readOwnPkg(__clDir);
 /** Report a sync run to the user. Beyond the applied-changes line, this SURFACES
  *  sync.errors - a download that came back incomplete (truncated bulk tar, a file
  *  that couldn't be refetched) lands here, so we never print "ready" over a
@@ -292,7 +310,7 @@ export const claudeCommand = new Command('claude')
             process.exit(1);
         }
         if (!nonInteractive) {
-            printBanner({ version: __clPkg.version, email: auth?.email, cwd: process.cwd() });
+            printBanner({ version: __clPkg.version ?? 'unknown', email: auth?.email, cwd: process.cwd() });
         }
         // A GIPITY_TOKEN env token authenticates every request on its own, so the
         // saved session's expiry is irrelevant when one is set — never re-login or

package/dist/commands/deploy.js

@@ -5,6 +5,7 @@ import { formatSize } from '../utils.js';
 import { success, error as clrError, warning, muted, bold, brand } from '../colors.js';
 import { run, syncBeforeAction } from '../helpers/index.js';
 import { withSpinner } from '../progress.js';
+import { inspectPage } from './page-inspect.js';
 // ── Status icons ───────────────────────────────────────────────────────
 function statusIcon(status) {
     if (status === 'ok')
@@ -26,6 +27,7 @@ export const deployCommand = new Command('deploy')
     .option('--optimize', 'Force Vite build optimization on (default for prod; use this to optimize a dev deploy too)')
     .option('--no-optimize', 'Skip build optimization and upload files as-is - the escape hatch for plain-HTML apps whose <script src> tags are not type="module"')
     .option('--json', 'Output as JSON')
+    .option('--inspect [path]', 'After a successful deploy, run `page inspect` on the deployed URL (or URL + path) in the same command - one build-loop step instead of two. With --json, emits two JSON lines: deploy, then inspect.')
     .action((target, opts) => run('Deploy', async () => {
     if (target !== 'dev' && target !== 'prod') {
         console.error(clrError('Target must be "dev" or "prod"'));
@@ -44,8 +46,32 @@ export const deployCommand = new Command('deploy')
         ? await doDeploy()
         : await withSpinner(`Deploying to ${target}…`, doDeploy, { done: null });
     const d = res.data;
+    // Deploy + verify in one command: after a successful deploy, run the
+    // same inspect pipeline `page inspect` uses against the live URL. An
+    // inspect failure is reported but never turns a successful deploy into
+    // a nonzero exit - the deploy DID land.
+    const inspectAfter = async () => {
+        if (!opts.inspect)
+            return;
+        if (!d.url) {
+            console.error(warning('--inspect skipped: this deploy produced no URL (e.g. --only database)'));
+            return;
+        }
+        const url = typeof opts.inspect === 'string' ? new URL(opts.inspect, d.url).toString() : d.url;
+        if (!opts.json)
+            console.log('');
+        try {
+            await inspectPage(url, { json: opts.json });
+        }
+        catch (err) {
+            console.error(warning(`Inspect failed (deploy itself succeeded): ${err?.message ?? err}`));
+        }
+    };
     if (opts.json) {
         console.log(JSON.stringify(d));
+        const failedJson = d.phases?.some(p => p.status === 'failed');
+        if (!failedJson)
+            await inspectAfter();
         return;
     }
     // Format output
@@ -54,7 +80,8 @@ export const deployCommand = new Command('deploy')
     console.log(muted('─'.repeat(40)));
     if (d.phases && d.phases.length > 0) {
         for (const phase of d.phases) {
-            console.log(`${statusIcon(phase.status)} ${bold(phase.name)}: ${phase.summary}`);
+            const ms = phase.elapsedMs != null ? muted(` (${phase.elapsedMs}ms)`) : '';
+            console.log(`${statusIcon(phase.status)} ${bold(phase.name)}: ${phase.summary}${ms}`);
         }
     }
     else {
@@ -101,6 +128,7 @@ export const deployCommand = new Command('deploy')
         // has to reconstruct the URL convention or guess a subdomain.
         if (d.url)
             console.log(`${muted('Live:')} ${brand(d.url)}`);
+        await inspectAfter();
     }
 }));
 //# sourceMappingURL=deploy.js.map

package/dist/commands/fn.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { get, post, del } from '../api.js';
+import { get, post, del, publicPost } from '../api.js';
 import { requireConfig } from '../config.js';
 import { error as clrError, bold, muted, success, warning } from '../colors.js';
 import { run, printList, emitField } from '../helpers/index.js';
@@ -42,17 +42,36 @@ fnCommand
         return line;
     });
 }));
+/** Invoke a function exactly like an anonymous visitor: mint the same
+ *  short-lived public app token the browser SDK uses (best-effort — public
+ *  functions run with no token at all), POST with no user credentials, and
+ *  return the standard envelope. A 401 here is the correct answer for an
+ *  auth-gated function — the server's message is surfaced as-is, with no
+ *  "run: gipity login" misdirection. */
+async function callAnon(projectGuid, name, body) {
+    let appToken;
+    try {
+        const minted = await publicPost('/api/token', { app: projectGuid });
+        appToken = minted.data.token;
+    }
+    catch { /* public functions work without a token; auth-gated ones will 401 with the real reason */ }
+    return publicPost(`/api/${projectGuid}/fn/${encodeURIComponent(name)}`, body, appToken ? { 'X-App-Token': appToken } : undefined);
+}
 fnCommand
     .command('call <name> [body]')
     .description('Call a function')
     .option('--data <json>', 'JSON request body')
+    .option('--anon', 'Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account')
     .option('--field <path>', 'Print only this field of the result (dot path, e.g. items.0.short_guid)')
     .option('--json', 'Output as JSON')
     .action((name, bodyArg, opts) => run('Call', async () => {
     const config = requireConfig();
     const raw = bodyArg || opts.data || '{}';
     const body = JSON.parse(raw);
-    const res = await post(`/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`, body);
+    const path = `/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`;
+    const res = opts.anon
+        ? await callAnon(config.projectGuid, name, body)
+        : await post(path, body);
     if (opts.field) {
         emitField(res.data, opts.field);
         return;

package/dist/commands/page-eval.js

@@ -1,8 +1,9 @@
 import { readFileSync } from 'node:fs';
 import { Command, Option } from 'commander';
 import { post, get, ApiError } from '../api.js';
-import { brand, bold, muted, warning } from '../colors.js';
+import { brand, bold, muted, warning, success } from '../colors.js';
 import { run } from '../helpers/index.js';
+import { getAuth } from '../auth.js';
 import { resolveProjectContext } from '../config.js';
 import { uploadPublicFixture, deleteFixture } from '../page-fixtures.js';
 // Shown when an eval runs cleanly but returns nothing serializable. Turns a
@@ -43,6 +44,26 @@ export function normalizeEvalResult(raw) {
     }
     return { result: raw, noValue: false };
 }
+// A one-line inline expr is worth echoing back — it's the thing you're asserting
+// on. A multi-line driver script is not: echoing 30 lines of the caller's own
+// source above the result buries the value, and an echo that lands right before
+// `(empty result)` reads like the parser choked on the script rather than like
+// the script returned nothing. Collapse anything bigger than a single short line
+// to its first line plus a shape summary.
+const EXPR_ECHO_MAX_CHARS = 120;
+export function summarizeExpr(expr) {
+    const lines = expr.split('\n');
+    const meaningful = lines.filter((l) => l.trim() !== '');
+    const oneLine = meaningful.length <= 1;
+    if (oneLine && expr.trim().length <= EXPR_ECHO_MAX_CHARS)
+        return expr.trim();
+    const first = (meaningful[0] ?? '').trim();
+    const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 1)}…` : first;
+    const shape = oneLine
+        ? `(${expr.trim().length} chars)`
+        : `(+${meaningful.length - 1} more ${meaningful.length - 1 === 1 ? 'line' : 'lines'}, ${expr.trim().length} chars)`;
+    return `${head} ${shape}`;
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // A single browser session is held open synchronously for the whole --wait, so
 // the server caps it at the gateway idle timeout. Longer is impossible in one
@@ -140,11 +161,13 @@ const JS_DECOY_FLAGS = ['--js', '--javascript', '--script', '--code', '--expr',
 // tools, undo/redo, transforms) and `return` a JSON-serializable result —
 // no /tmp + shell command-substitution harness needed.
 export const pageEvalCommand = new Command('eval')
-    .description('Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script)')
+    .description('Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead')
     .argument('<url>', 'URL to load')
-    .argument('[expr]', 'JavaScript to evaluate in page context (inline expression or statement body with return/await; result is JSON-serialized). Omit when using --file.')
-    .option('--file <path>', 'Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work.')
+    .argument('[expr]', 'JavaScript to evaluate in page context (inline expression or statement body with return/await; result is JSON-serialized). Omit when using --file. Time budget: the body has ~20s to finish after page load - keep driver scripts within it.')
+    .option('--file <path>', 'Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work. Same ~20s post-load budget as <expr>.')
     .option('--fixture <path>', 'Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. Repeat for several files (single-value so it never swallows the inline <expr>).', (val, prev) => [...prev, val], [])
+    .option('--reload <expr>', 'After the first eval, reload the page IN PLACE (localStorage/sessionStorage/cookies preserved) and evaluate this second expression against the post-reload DOM. One command verifies persisted state survives a reload: seed/assert state with <expr>, then assert the restored UI here.')
+    .option('--reload-file <path>', 'Read the post-reload expression from a file instead of inline --reload (mutually exclusive)')
     .option('--wait <ms>', 'Sleep this many ms after DOMContentLoaded before evaluating (lets late async work settle; max 30000)', '500')
     .option('--wait-for <selector>', 'Wait until this CSS selector appears before evaluating (deterministic; replaces --wait)')
     .option('--wait-timeout <ms>', 'Max ms to wait for --wait-for before giving up', '5000')
@@ -167,6 +190,16 @@ export const pageEvalCommand = new Command('eval')
     if (exprArg === undefined && !opts.file) {
         pageEvalCommand.error('error: Provide an inline <expr> arg or --file <path>');
     }
+    // Catch a swapped <url>/<expr> locally: the server's bare "Invalid URL"
+    // names neither the bad argument nor the expected order, so it reads like
+    // the page failed to evaluate rather than like a mis-invocation.
+    if (!/^https?:\/\//i.test(url)) {
+        const flatUrl = url.replace(/\s+/g, ' ').trim();
+        const shownUrl = flatUrl.length > 60 ? `${flatUrl.slice(0, 57)}...` : flatUrl;
+        pageEvalCommand.error(exprArg !== undefined && /^https?:\/\//i.test(exprArg)
+            ? `error: arguments are swapped — the URL is the FIRST positional: gipity page eval "${exprArg}" '<expr>'`
+            : `error: <url> must be an absolute http(s) URL (got: "${shownUrl}") — usage: gipity page eval <url> [expr]`);
+    }
     let expr = exprArg;
     if (opts.file) {
         try {
@@ -176,6 +209,20 @@ export const pageEvalCommand = new Command('eval')
             pageEvalCommand.error(`error: Cannot read file: ${opts.file}`);
         }
     }
+    // Post-reload expression: inline --reload or --reload-file, same shape
+    // rules as the primary <expr>/--file pair.
+    if (opts.reload !== undefined && opts.reloadFile) {
+        pageEvalCommand.error('error: Pass either --reload <expr> or --reload-file <path>, not both');
+    }
+    let reloadExpr = opts.reload;
+    if (opts.reloadFile) {
+        try {
+            reloadExpr = readFileSync(opts.reloadFile, 'utf8');
+        }
+        catch {
+            pageEvalCommand.error(`error: Cannot read file: ${opts.reloadFile}`);
+        }
+    }
     const waitMs = capWaitMs(opts.wait, url);
     const parsedTimeout = parseInt(opts.waitTimeout, 10);
     const waitForTimeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout >= 0 ? parsedTimeout : 5000;
@@ -204,31 +251,54 @@ export const pageEvalCommand = new Command('eval')
         }
         const kickoff = await post('/tools/browser/eval', {
             url, expr: sentExpr, waitMs,
+            reloadExpr,
             waitForSelector: opts.waitFor || undefined,
             waitForTimeoutMs: opts.waitFor ? waitForTimeoutMs : undefined,
             auth: opts.auth || undefined,
         });
-        const d = await pollEvalResult(kickoff.data.evalJobId, waitMs);
+        // The reload leg re-runs the settle before its eval — budget for both.
+        const d = await pollEvalResult(kickoff.data.evalJobId, reloadExpr !== undefined ? waitMs * 2 : waitMs);
         const { result, noValue } = normalizeEvalResult(d.result);
+        const reload = d.reloadResult !== undefined ? normalizeEvalResult(d.reloadResult) : undefined;
         const execTimeout = evalExecTimeoutMessage(d.result);
         if (execTimeout)
             throw new Error(execTimeout);
         if (opts.json) {
-            console.log(JSON.stringify(noValue ? { ...d, result, hint: EVAL_NO_VALUE_HINT } : { ...d, result }));
+            console.log(JSON.stringify({
+                ...d, result,
+                ...(reload ? { reloadResult: reload.result } : {}),
+                ...(noValue ? { hint: EVAL_NO_VALUE_HINT } : {}),
+            }));
             return;
         }
         console.log(`${brand('Eval')} ${bold(d.url || url)}`);
         if (d.navigationIncomplete) {
             console.log(`${warning('⚠ Navigation incomplete:')} ${d.note || 'page did not reach full load'}`);
         }
+        // Auth state: without this line an agent can't distinguish "signed-in
+        // eval" from "--auth silently no-op'd against the anonymous page".
+        if (d.auth?.requested) {
+            const who = getAuth()?.email;
+            console.log(d.auth.established
+                ? `${muted('Auth:')} ${success('session established')}${who ? muted(` as ${who}`) : ''} ${muted('(what the page renders with it is app-defined)')}`
+                : `${warning('Auth: session NOT established')}${d.auth.detail ? ` — ${d.auth.detail}` : ''} ${muted('(this is the anonymous view)')}`);
+        }
         if (hosted.length)
             console.log(`${muted('Fixtures:')} ${hosted.map((h) => h.name).join(', ')}`);
-        console.log(opts.file ? `${muted('Script:')} ${opts.file}` : `${muted('Expression:')} ${expr}`);
+        console.log(opts.file ? `${muted('Script:')} ${opts.file}` : `${muted('Expression:')} ${summarizeExpr(expr)}`);
         console.log(`\n${result.trim() ? result : muted('(empty result)')}`);
         if (noValue)
             console.log(muted(`\n${EVAL_NO_VALUE_HINT}`));
         if (d.truncated)
             console.log(muted('\n(result truncated to fit context - narrow the expression for the full value)'));
+        if (reload) {
+            console.log(`\n${bold('After reload')} ${muted('(page reloaded in place — storage preserved)')}`);
+            console.log(reload.result.trim() ? reload.result : muted('(empty result)'));
+            if (reload.noValue)
+                console.log(muted(EVAL_NO_VALUE_HINT));
+            if (d.reloadTruncated)
+                console.log(muted('(reload result truncated to fit context - narrow the expression for the full value)'));
+        }
     }
     finally {
         for (const h of hosted) {
@@ -261,6 +331,16 @@ Examples:
   # fetch-able 'fixtureUrl', runs the eval, then deletes the hosted copy:
   gipity page eval "https://dev.gipity.ai/me/app/" --fixture ./sample.mp3 \\
     "(async()=>{ const b = await fetch(fixtureUrl).then(r=>r.arrayBuffer()); return window.App.parseId3(b); })()"
+  # Verify persisted state survives a reload (localStorage/sessionStorage kept):
+  # run <expr>, reload the page in place, then run the --reload expression:
+  gipity page eval "https://dev.gipity.ai/me/app/" \\
+    "localStorage.setItem('todo','milk'); document.title" \\
+    --reload "({ restored: localStorage.getItem('todo'), heading: document.querySelector('h1')?.textContent })"
+
+Module resolution: dynamic import() specifiers starting with ./ or ../ resolve
+against the PAGE URL, so import('./packages/i18n/index.js') loads the app's own
+module without hand-building the deployed /account/project/ path. Absolute paths
+and full URLs pass through unchanged.
 
 The eval body runs under a ~20s in-page execution budget (its own await/setTimeout
 pauses count; --wait only sleeps BEFORE the eval and does not extend it). For a long