gipity 1.0.424 → 1.0.425

package/dist/api.js

@@ -353,12 +353,14 @@ export async function getAccountSlug() {
     accountSlugCache = res.data.accountSlug;
     return accountSlugCache;
 }
-/** Unauthenticated request (for login/verify) */
-export async function publicPost(path, body) {
+/** Unauthenticated request (for login/verify, and anonymous-visitor calls like
+ *  `fn call --anon`). extraHeaders lets callers attach non-auth headers such as
+ *  X-App-Token; no Authorization header is ever sent. */
+export async function publicPost(path, body, extraHeaders) {
     const url = `${baseUrl()}${path}`;
     const res = await fetch(url, {
         method: 'POST',
-        headers: { ...clientHeaders(), 'Content-Type': 'application/json' },
+        headers: { ...clientHeaders(), 'Content-Type': 'application/json', ...extraHeaders },
         body: JSON.stringify(body),
     });
     if (!res.ok) {

package/dist/commands/add.js

@@ -206,6 +206,12 @@ export const addCommand = new Command('add')
     }
     // The server runs the whole install pipeline before responding; animate the
     // wait, then clear the spinner so the installed-files list is the result.
+    // The spinner is TTY-only, so piped/agent transcripts would otherwise show
+    // a silent multi-second gap (favicon generation on a cold cache can take
+    // ~10s, cli#117) - leave one stderr marker so the wait reads as work.
+    if (!opts.json && !process.stdout.isTTY) {
+        console.error(muted('Installing (server writes files + generates favicons; first add for a title can take ~10s)...'));
+    }
     const doAdd = () => post(`/projects/${config.projectGuid}/add`, body);
     const res = opts.json
         ? await doAdd()

package/dist/commands/bug.js

@@ -15,7 +15,9 @@ export const bugCommand = new Command('bug')
     `\nso the team can triage it into a fix.\n` +
     `\nCategories: ${CATEGORIES.join(', ')}` +
     `\nSeverity:   ${SEVERITY_HINT}` +
-    `\nNever include PII or user data — describe the platform problem in the abstract.`);
+    `\nNever include PII or user data — describe the platform problem in the abstract.` +
+    `\nFiled one by mistake? Withdraw it yourself with \`gipity bug retract <id>\`` +
+    `\n(works until a human picks it up) — don't file a second report asking for a close.`);
 bugCommand
     .command('report')
     .description('File a bug / friction report about the Gipity platform')
@@ -43,6 +45,24 @@ bugCommand
     }
     console.log(success(`✓ Bug report filed (${res.data.report_guid}) — queued for triage.`));
 }));
+bugCommand
+    .command('retract <id>')
+    .description('Withdraw a bug report you filed (e.g. it was your own mistake)')
+    .option('--reason <text>', 'Short note for triage on why you are retracting')
+    .option('--project <guid-or-slug>', 'Resolve auth against a specific project instead of cwd / Home')
+    .option('--json', 'Output raw JSON')
+    .addHelpText('after', `\nOnly works on your own reports, and only while they are still queued` +
+    `\n(status new/triaged). Once a report is filed/fixed/dismissed, a human` +
+    `\nowns closing it out. Find report ids with \`gipity bug list\`.`)
+    .action((id, opts) => run('Bug report', async () => {
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
+    const res = await post(`/api/${config.projectGuid}/services/bug-report/retract`, { report_guid: id, reason: opts.reason });
+    if (opts.json) {
+        console.log(JSON.stringify(res.data));
+        return;
+    }
+    console.log(success(`✓ Bug report ${res.data.report_guid} retracted — it is out of the triage queue.`));
+}));
 bugCommand
     .command('list')
     .description('List the bug / friction reports you have filed')

package/dist/commands/fn.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { get, post, del } from '../api.js';
+import { get, post, del, publicPost } from '../api.js';
 import { requireConfig } from '../config.js';
 import { error as clrError, bold, muted, success, warning } from '../colors.js';
 import { run, printList, emitField } from '../helpers/index.js';
@@ -42,17 +42,36 @@ fnCommand
         return line;
     });
 }));
+/** Invoke a function exactly like an anonymous visitor: mint the same
+ *  short-lived public app token the browser SDK uses (best-effort — public
+ *  functions run with no token at all), POST with no user credentials, and
+ *  return the standard envelope. A 401 here is the correct answer for an
+ *  auth-gated function — the server's message is surfaced as-is, with no
+ *  "run: gipity login" misdirection. */
+async function callAnon(projectGuid, name, body) {
+    let appToken;
+    try {
+        const minted = await publicPost('/api/token', { app: projectGuid });
+        appToken = minted.data.token;
+    }
+    catch { /* public functions work without a token; auth-gated ones will 401 with the real reason */ }
+    return publicPost(`/api/${projectGuid}/fn/${encodeURIComponent(name)}`, body, appToken ? { 'X-App-Token': appToken } : undefined);
+}
 fnCommand
     .command('call <name> [body]')
     .description('Call a function')
     .option('--data <json>', 'JSON request body')
+    .option('--anon', 'Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account')
     .option('--field <path>', 'Print only this field of the result (dot path, e.g. items.0.short_guid)')
     .option('--json', 'Output as JSON')
     .action((name, bodyArg, opts) => run('Call', async () => {
     const config = requireConfig();
     const raw = bodyArg || opts.data || '{}';
     const body = JSON.parse(raw);
-    const res = await post(`/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`, body);
+    const path = `/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`;
+    const res = opts.anon
+        ? await callAnon(config.projectGuid, name, body)
+        : await post(path, body);
     if (opts.field) {
         emitField(res.data, opts.field);
         return;

package/dist/commands/page-eval.js

@@ -1,8 +1,9 @@
 import { readFileSync } from 'node:fs';
 import { Command, Option } from 'commander';
 import { post, get, ApiError } from '../api.js';
-import { brand, bold, muted, warning } from '../colors.js';
+import { brand, bold, muted, warning, success } from '../colors.js';
 import { run } from '../helpers/index.js';
+import { getAuth } from '../auth.js';
 import { resolveProjectContext } from '../config.js';
 import { uploadPublicFixture, deleteFixture } from '../page-fixtures.js';
 // Shown when an eval runs cleanly but returns nothing serializable. Turns a
@@ -43,6 +44,26 @@ export function normalizeEvalResult(raw) {
     }
     return { result: raw, noValue: false };
 }
+// A one-line inline expr is worth echoing back — it's the thing you're asserting
+// on. A multi-line driver script is not: echoing 30 lines of the caller's own
+// source above the result buries the value, and an echo that lands right before
+// `(empty result)` reads like the parser choked on the script rather than like
+// the script returned nothing. Collapse anything bigger than a single short line
+// to its first line plus a shape summary.
+const EXPR_ECHO_MAX_CHARS = 120;
+export function summarizeExpr(expr) {
+    const lines = expr.split('\n');
+    const meaningful = lines.filter((l) => l.trim() !== '');
+    const oneLine = meaningful.length <= 1;
+    if (oneLine && expr.trim().length <= EXPR_ECHO_MAX_CHARS)
+        return expr.trim();
+    const first = (meaningful[0] ?? '').trim();
+    const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 1)}…` : first;
+    const shape = oneLine
+        ? `(${expr.trim().length} chars)`
+        : `(+${meaningful.length - 1} more ${meaningful.length - 1 === 1 ? 'line' : 'lines'}, ${expr.trim().length} chars)`;
+    return `${head} ${shape}`;
+}
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // A single browser session is held open synchronously for the whole --wait, so
 // the server caps it at the gateway idle timeout. Longer is impossible in one
@@ -140,11 +161,13 @@ const JS_DECOY_FLAGS = ['--js', '--javascript', '--script', '--code', '--expr',
 // tools, undo/redo, transforms) and `return` a JSON-serializable result —
 // no /tmp + shell command-substitution harness needed.
 export const pageEvalCommand = new Command('eval')
-    .description('Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script)')
+    .description('Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead')
     .argument('<url>', 'URL to load')
     .argument('[expr]', 'JavaScript to evaluate in page context (inline expression or statement body with return/await; result is JSON-serialized). Omit when using --file. Time budget: the body has ~20s to finish after page load - keep driver scripts within it.')
     .option('--file <path>', 'Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work. Same ~20s post-load budget as <expr>.')
     .option('--fixture <path>', 'Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. Repeat for several files (single-value so it never swallows the inline <expr>).', (val, prev) => [...prev, val], [])
+    .option('--reload <expr>', 'After the first eval, reload the page IN PLACE (localStorage/sessionStorage/cookies preserved) and evaluate this second expression against the post-reload DOM. One command verifies persisted state survives a reload: seed/assert state with <expr>, then assert the restored UI here.')
+    .option('--reload-file <path>', 'Read the post-reload expression from a file instead of inline --reload (mutually exclusive)')
     .option('--wait <ms>', 'Sleep this many ms after DOMContentLoaded before evaluating (lets late async work settle; max 30000)', '500')
     .option('--wait-for <selector>', 'Wait until this CSS selector appears before evaluating (deterministic; replaces --wait)')
     .option('--wait-timeout <ms>', 'Max ms to wait for --wait-for before giving up', '5000')
@@ -186,6 +209,20 @@ export const pageEvalCommand = new Command('eval')
             pageEvalCommand.error(`error: Cannot read file: ${opts.file}`);
         }
     }
+    // Post-reload expression: inline --reload or --reload-file, same shape
+    // rules as the primary <expr>/--file pair.
+    if (opts.reload !== undefined && opts.reloadFile) {
+        pageEvalCommand.error('error: Pass either --reload <expr> or --reload-file <path>, not both');
+    }
+    let reloadExpr = opts.reload;
+    if (opts.reloadFile) {
+        try {
+            reloadExpr = readFileSync(opts.reloadFile, 'utf8');
+        }
+        catch {
+            pageEvalCommand.error(`error: Cannot read file: ${opts.reloadFile}`);
+        }
+    }
     const waitMs = capWaitMs(opts.wait, url);
     const parsedTimeout = parseInt(opts.waitTimeout, 10);
     const waitForTimeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout >= 0 ? parsedTimeout : 5000;
@@ -214,31 +251,54 @@ export const pageEvalCommand = new Command('eval')
         }
         const kickoff = await post('/tools/browser/eval', {
             url, expr: sentExpr, waitMs,
+            reloadExpr,
             waitForSelector: opts.waitFor || undefined,
             waitForTimeoutMs: opts.waitFor ? waitForTimeoutMs : undefined,
             auth: opts.auth || undefined,
         });
-        const d = await pollEvalResult(kickoff.data.evalJobId, waitMs);
+        // The reload leg re-runs the settle before its eval — budget for both.
+        const d = await pollEvalResult(kickoff.data.evalJobId, reloadExpr !== undefined ? waitMs * 2 : waitMs);
         const { result, noValue } = normalizeEvalResult(d.result);
+        const reload = d.reloadResult !== undefined ? normalizeEvalResult(d.reloadResult) : undefined;
         const execTimeout = evalExecTimeoutMessage(d.result);
         if (execTimeout)
             throw new Error(execTimeout);
         if (opts.json) {
-            console.log(JSON.stringify(noValue ? { ...d, result, hint: EVAL_NO_VALUE_HINT } : { ...d, result }));
+            console.log(JSON.stringify({
+                ...d, result,
+                ...(reload ? { reloadResult: reload.result } : {}),
+                ...(noValue ? { hint: EVAL_NO_VALUE_HINT } : {}),
+            }));
             return;
         }
         console.log(`${brand('Eval')} ${bold(d.url || url)}`);
         if (d.navigationIncomplete) {
             console.log(`${warning('⚠ Navigation incomplete:')} ${d.note || 'page did not reach full load'}`);
         }
+        // Auth state: without this line an agent can't distinguish "signed-in
+        // eval" from "--auth silently no-op'd against the anonymous page".
+        if (d.auth?.requested) {
+            const who = getAuth()?.email;
+            console.log(d.auth.established
+                ? `${muted('Auth:')} ${success('session established')}${who ? muted(` as ${who}`) : ''} ${muted('(what the page renders with it is app-defined)')}`
+                : `${warning('Auth: session NOT established')}${d.auth.detail ? ` — ${d.auth.detail}` : ''} ${muted('(this is the anonymous view)')}`);
+        }
         if (hosted.length)
             console.log(`${muted('Fixtures:')} ${hosted.map((h) => h.name).join(', ')}`);
-        console.log(opts.file ? `${muted('Script:')} ${opts.file}` : `${muted('Expression:')} ${expr}`);
+        console.log(opts.file ? `${muted('Script:')} ${opts.file}` : `${muted('Expression:')} ${summarizeExpr(expr)}`);
         console.log(`\n${result.trim() ? result : muted('(empty result)')}`);
         if (noValue)
             console.log(muted(`\n${EVAL_NO_VALUE_HINT}`));
         if (d.truncated)
             console.log(muted('\n(result truncated to fit context - narrow the expression for the full value)'));
+        if (reload) {
+            console.log(`\n${bold('After reload')} ${muted('(page reloaded in place — storage preserved)')}`);
+            console.log(reload.result.trim() ? reload.result : muted('(empty result)'));
+            if (reload.noValue)
+                console.log(muted(EVAL_NO_VALUE_HINT));
+            if (d.reloadTruncated)
+                console.log(muted('(reload result truncated to fit context - narrow the expression for the full value)'));
+        }
     }
     finally {
         for (const h of hosted) {
@@ -271,6 +331,16 @@ Examples:
   # fetch-able 'fixtureUrl', runs the eval, then deletes the hosted copy:
   gipity page eval "https://dev.gipity.ai/me/app/" --fixture ./sample.mp3 \\
     "(async()=>{ const b = await fetch(fixtureUrl).then(r=>r.arrayBuffer()); return window.App.parseId3(b); })()"
+  # Verify persisted state survives a reload (localStorage/sessionStorage kept):
+  # run <expr>, reload the page in place, then run the --reload expression:
+  gipity page eval "https://dev.gipity.ai/me/app/" \\
+    "localStorage.setItem('todo','milk'); document.title" \\
+    --reload "({ restored: localStorage.getItem('todo'), heading: document.querySelector('h1')?.textContent })"
+
+Module resolution: dynamic import() specifiers starting with ./ or ../ resolve
+against the PAGE URL, so import('./packages/i18n/index.js') loads the app's own
+module without hand-building the deployed /account/project/ path. Absolute paths
+and full URLs pass through unchanged.
 
 The eval body runs under a ~20s in-page execution budget (its own await/setTimeout
 pauses count; --wait only sleeps BEFORE the eval and does not extend it). For a long

package/dist/commands/page-inspect.js

@@ -32,7 +32,7 @@ function shortUrl(url, truncate = true, maxLen = 100) {
     return result.slice(0, headLen) + '…' + result.slice(-tailLen);
 }
 export const pageInspectCommand = new Command('inspect')
-    .description('Inspect a web page (console, failed resources, timing, layout overflow)')
+    .description('Inspect a web page (console, failed resources, timing, layout overflow). ONE passive load - to verify realtime/presence across concurrent clients use `page test --observe`')
     .argument('<url>', 'URL to inspect')
     .option('--wait <ms>', 'Sleep this many ms after DOMContentLoaded before capturing (lets late async/LCP work settle; max 30000)', '500')
     .option('--wait-for <selector>', 'Wait until this CSS selector appears before capturing (deterministic; replaces --wait)')

package/dist/commands/page-screenshot.js

@@ -3,7 +3,8 @@ import { mkdirSync, writeFileSync } from 'fs';
 import { dirname, join, resolve as resolvePath } from 'path';
 import { postForTarEntries } from '../api.js';
 import { getProjectRoot } from '../config.js';
-import { brand, bold, muted, success } from '../colors.js';
+import { getAuth } from '../auth.js';
+import { brand, bold, muted, success, warning } from '../colors.js';
 import { formatSize } from '../utils.js';
 import { run } from '../helpers/index.js';
 import { withSpinner } from '../progress.js';
@@ -28,6 +29,25 @@ function label(text) {
 function fmtMs(ms) {
     return ms >= 1000 ? `${(ms / 1000).toFixed(1)}s` : `${ms}ms`;
 }
+/** Auth state line (same format as page inspect/eval): without it an agent
+ *  can't tell a signed-in capture from "--auth silently no-op'd and this is
+ *  the anonymous page". */
+function printAuthLine(auth) {
+    if (!auth?.requested)
+        return;
+    const who = getAuth()?.email;
+    console.log(auth.established
+        ? `${label('Auth')} ${success('session established')}${who ? muted(` as ${who}`) : ''} ${muted('(what the page renders with it is app-defined)')}`
+        : `${warning('Auth: session NOT established')}${auth.detail ? ` — ${auth.detail}` : ''} ${muted('(this is the anonymous view)')}`);
+}
+/** A failed --action still yields a screenshot - of the page the action never
+ *  touched. Silence there is the trap: the image looks plausible and the command
+ *  reports success, so the caller trusts a capture of the wrong state. Say so. */
+function printActionErrorLine(actionError) {
+    if (!actionError)
+        return;
+    console.log(`${warning('⚠ --action failed:')} ${actionError} ${muted('(this image shows the page BEFORE the action ran)')}`);
+}
 function fmtPerformance(p) {
     const parts = [
         `TTFB ${fmtMs(p.ttfb)}`,
@@ -137,7 +157,7 @@ export const pageScreenshotCommand = new Command('screenshot')
     // so the `?? opts.wait` merge below would never see the --wait alias. Default
     // is applied in the merge instead.
     .option('--post-load-delay <ms>', 'Delay after DOMContentLoaded before capture, in ms (default: 1000)')
-    .option('--action <js>', 'Run JS in the page before capturing — e.g. click a button to enter a state ("document.getElementById(\'play\').click()"). Runs after the post-load delay, then settles again before the shot.')
+    .option('--action <js>', 'Run JS in the page before capturing — e.g. click a button to enter a state ("document.getElementById(\'play\').click()"). Runs as an async function body, so const/await and app-relative import(\'./…\') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.')
     .option('--full', 'Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.')
     .option('-o, --output <file>', 'Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)')
     .option('--device <names>', `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(', ')} (comma-separated or repeat flag). mobile/tablet emulate a real touch device — touch events, mobile user-agent, DPR — so touch-gated mobile UI actually renders.`, appendOption, [])
@@ -223,6 +243,7 @@ export const pageScreenshotCommand = new Command('screenshot')
                 final_url: meta.finalUrl,
                 status: meta.status,
                 performance: meta.performance,
+                ...(meta.auth ? { auth: meta.auth } : {}),
             },
             screenshots: meta.screenshots.map((s, i) => ({
                 file: savedFiles[i],
@@ -253,6 +274,8 @@ export const pageScreenshotCommand = new Command('screenshot')
             console.log(`${label('Web page status')} ${meta.status}`);
         if (meta.performance)
             console.log(`${label('Web page perf')} ${fmtPerformance(meta.performance)}`);
+        printAuthLine(meta.auth);
+        printActionErrorLine(meta.actionError);
         if (s.viewport.device)
             console.log(`${label('Emulated device')} ${s.viewport.device} ${muted('(touch events, mobile user-agent)')}`);
         const sizePart = formatSize(s.screenshotSizeBytes) + (meta.full ? ' (full page)' : '');
@@ -271,6 +294,8 @@ export const pageScreenshotCommand = new Command('screenshot')
         console.log(`${label('Web page status')} ${meta.status}`);
     if (meta.performance)
         console.log(`${label('Web page perf')} ${fmtPerformance(meta.performance)}`);
+    printAuthLine(meta.auth);
+    printActionErrorLine(meta.actionError);
     for (let i = 0; i < meta.screenshots.length; i++) {
         const s = meta.screenshots[i];
         const dims = `${s.viewport.width}×${s.viewport.height}${s.viewport.deviceScaleFactor > 1 ? ` @${s.viewport.deviceScaleFactor}x` : ''}`;

package/dist/commands/page.js

@@ -10,7 +10,7 @@ import { pageFetchCommand } from './page-fetch.js';
 // top-level surface lean and makes the siblings discoverable via `page --help`.
 // `inspect` is the rendered DOM (browser); `fetch` is the raw asset (plain HTTP).
 export const pageCommand = new Command('page')
-    .description('Inspect web pages')
+    .description('Inspect, drive, and test web pages in a real browser (page test = N concurrent clients for realtime/presence verification)')
     .addCommand(pageInspectCommand)
     .addCommand(pageEvalCommand)
     .addCommand(pageScreenshotCommand)

package/dist/commands/sandbox.js

@@ -169,6 +169,11 @@ sandboxCommand
     .option('--file <path>', 'Read the code body from a file instead of the inline <code> arg; --language is inferred from the extension when not given')
     .option('--timeout <seconds>', 'Execution timeout in seconds', '30')
     .option('--input <path>', 'Narrow to specific project files instead of auto-mirroring the whole tree (repeatable). Use this only for >1 GB projects or when you want surgical control.', (v, prev) => [...(prev ?? []), v])
+    // Commander maps a `--no-` prefixed flag to the un-prefixed camelCase name
+    // (`opts.syncOutput`); the explicit `[]` default stops commander's negated-
+    // boolean convention from defaulting it to `true`. Collected as an array so
+    // the flag is repeatable.
+    .option('--no-sync-output <glob>', 'Do not persist run outputs matching this glob back to the project (repeatable). For byproducts you want to inspect once but never keep, e.g. --no-sync-output "docs/preview*". Supports *, **, and dir/ prefixes.', (v, prev) => [...prev, v], [])
     .option('--json', 'Output as JSON')
     .addHelpText('after', `
 By default the whole project is auto-mirrored into /work/ (up to 1 GB) -
@@ -263,6 +268,13 @@ GCC/Rust).
     // This runs BEFORE the project sync and the server round trip below, so a
     // missing language costs nothing but the message.
     const language = resolveLanguage({ langFromInterp, langOpt: opts.language, filePath, inlineCode });
+    // Validate --no-sync-output globs while we're still pre-network: an empty
+    // pattern (e.g. a quoting mishap) would silently match nothing server-side.
+    const noSyncOutput = opts.syncOutput ?? [];
+    if (noSyncOutput.some((g) => !g.trim())) {
+        console.error(clrError('--no-sync-output requires a non-empty glob (e.g. --no-sync-output "docs/preview*")'));
+        process.exit(1);
+    }
     // Args are good - now it's worth resolving (and announcing) the project.
     const { config } = await resolveProjectContext();
     const timeout = parseInt(opts.timeout, 10);
@@ -297,6 +309,10 @@ GCC/Rust).
         timeout: isNaN(timeout) ? 30 : timeout,
         input_files: opts.input,
         cwd,
+        // The filter must run SERVER-side (in the output extractor): skipping
+        // only in the CLI would still write the files into project storage and
+        // make every later sync propose deleting them.
+        noSyncOutput: noSyncOutput.length ? noSyncOutput : undefined,
     });
     const res = opts.json
         ? await doRun()
@@ -333,6 +349,11 @@ GCC/Rust).
             for (const f of res.data.outputFiles)
                 console.log(`${f}`);
         }
+        if (res.data.skippedOutputFiles && res.data.skippedOutputFiles.length > 0) {
+            console.log(dim('\nNot persisted (--no-sync-output):'));
+            for (const f of res.data.skippedOutputFiles)
+                console.log(dim(`${f}`));
+        }
         if (res.data.exitCode !== 0) {
             // No "did you mean another language?" hint is needed: the language is now
             // always something the caller pinned, never a silent default we chose.

package/dist/commands/test.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import { get, post } from '../api.js';
-import { requireConfig } from '../config.js';
+import { requireConfig, getProjectRoot } from '../config.js';
 import { success, error as clrError, warning, muted, bold, dim } from '../colors.js';
 import { run, syncBeforeAction } from '../helpers/index.js';
 // Absolute poll ceiling - the server reaps stalled runs (~65 min) well before
@@ -15,6 +15,22 @@ function statusIcon(status) {
         return muted('→');
     return muted('?');
 }
+/** When the runner finds nothing, list the test-looking files it deliberately
+ *  skipped (kit tests under src/packages/, .spec.* files) so "no tests" never
+ *  contradicts what's on disk, and point at the sandbox as the way to run
+ *  frontend/kit module tests (cli#120/cli#121). */
+function printSkippedCandidates(skipped) {
+    if (skipped.length === 0)
+        return;
+    console.log('');
+    console.log(muted(`Found ${skipped.length} test-looking file${skipped.length === 1 ? '' : 's'} that gipity test does not run:`));
+    for (const s of skipped.slice(0, 10)) {
+        console.log(muted(`  ${s.path} (${s.reason})`));
+    }
+    if (skipped.length > 10)
+        console.log(muted(`  ... and ${skipped.length - 10} more`));
+    console.log(muted('Run frontend/kit module tests in the sandbox: gipity sandbox run bash "node <file>"'));
+}
 // Long-run hint for non-TTY runs: after this, print a one-time "not hung" + faster-path hint.
 const LONG_RUN_MS = 60000;
 async function pollTestStatus(projectGuid, runGuid, opts) {
@@ -169,9 +185,21 @@ export const testCommand = new Command('test')
         process.exit(1);
     }
     if (!filterPath && data.total === 0 && data.results.length === 0) {
-        console.log(muted('No tests ran - this app has no tests/*.test.js files.'));
+        // Name the searched root: discovery is server-side over the synced
+        // project tree's tests/, never the shell cwd - an agent running from a
+        // subdirectory must not read this as "the project has no tests" for
+        // the wrong reason (cli#120).
+        const root = getProjectRoot();
+        console.log(muted(`No tests ran - no tests/*.test.js files under the project root${root ? ` (${root})` : ''}.`));
         console.log(muted('gipity test runs server-function tests only; a frontend-only app (no functions/) has nothing here to run.'));
         console.log(muted('Verify a frontend app by driving the live page: gipity page inspect <url> (or gipity page eval).'));
+        // Enumerate test-looking files the runner deliberately skips (kit
+        // tests, .spec.*) so this answer never contradicts what's on disk.
+        try {
+            const listRes = await get(`/projects/${config.projectGuid}/test/list`);
+            printSkippedCandidates(listRes.data.skipped ?? []);
+        }
+        catch { /* the skipped list is advisory - never fail the run over it */ }
         return;
     }
     if (data.status === 'failed' && data.errorMessage) {
@@ -268,9 +296,17 @@ testCommand
         return;
     }
     if (total === 0) {
+        // Discovery is server-side over the synced project tree's tests/ -
+        // never the shell cwd. Say which root was searched so this can't be
+        // misread as a definitive project-level fact from a subdirectory
+        // (cli#120), and list any test-looking files deliberately skipped
+        // (kit tests, .spec.*) instead of asserting none exist (cli#121).
+        const root = getProjectRoot();
         console.log(muted(pathFilter
             ? `No test files matched filter: ${pathFilter}`
-            : 'No test files found. Add *.test.js files under tests/.'));
+            : `No test files found under tests/ at the project root${root ? ` (${root})` : ''}. Add *.test.js files under tests/.`));
+        if (!pathFilter)
+            printSkippedCandidates(res.data.skipped ?? []);
         return;
     }
     console.log(bold(`Test files${pathFilter ? ` (filter: ${pathFilter})` : ''}: ${total}`));

package/dist/commands/workflow.js

@@ -29,6 +29,25 @@ function formatRunLine(r) {
     const statusColor = r.status === 'completed' ? success : r.status === 'failed' ? clrError : muted;
     return `${muted(r.short_guid)}  ${statusColor(r.status)}  ${dur}  ${runTokens(r)} tokens  ${muted(fmtTime(r.started_at))}`;
 }
+/** Print each step's status, tokens, model, error and output. A run line alone
+ *  says a run finished, not what it did — without the steps you can't tell a
+ *  workflow that wrote a row from one that silently skipped every step. */
+function printStepRuns(steps, emptyNote) {
+    if (steps.length === 0) {
+        console.log(`  ${muted(emptyNote)}`);
+        return;
+    }
+    for (const s of steps) {
+        const statusColor = s.status === 'completed' ? success : s.status === 'failed' ? clrError : muted;
+        const model = s.model_used ? `  ${muted(`[${s.model_used}]`)}` : '';
+        console.log(`  ${s.step_order}. ${statusColor(s.status)}  ${s.tokens_used ?? 0} tokens${model}`);
+        if (s.error_message)
+            console.log(`     ${clrError(s.error_message)}`);
+        if (s.output_json !== null && s.output_json !== undefined) {
+            console.log(JSON.stringify(s.output_json, null, 2).split('\n').map(l => `     ${l}`).join('\n'));
+        }
+    }
+}
 const TERMINAL_RUN_STATUSES = new Set(['completed', 'failed', 'cancelled']);
 const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 /**
@@ -155,6 +174,10 @@ workflowCommand
         console.log(formatRunLine(r));
         if (r.error_message)
             console.log(`  ${clrError(r.error_message)}`);
+        // The whole point of --wait is to see what the run did. The detail endpoint
+        // we just polled already carries the steps, so show them rather than make
+        // the caller re-query the database to find out whether anything happened.
+        printStepRuns(r.step_runs ?? [], '(no steps recorded)');
     }
     if (r.status !== 'completed')
         process.exit(1);
@@ -176,22 +199,7 @@ workflowCommand
             return;
         }
         console.log(formatRunLine(r));
-        const steps = r.step_runs ?? [];
-        if (steps.length === 0) {
-            console.log('  (no steps recorded)');
-            return;
-        }
-        for (const s of steps) {
-            const statusColor = s.status === 'completed' ? success : s.status === 'failed' ? clrError : muted;
-            const model = s.model_used ? `  ${muted(`[${s.model_used}]`)}` : '';
-            console.log(`  ${s.step_order}. ${statusColor(s.status)}  ${s.tokens_used ?? 0} tokens${model}`);
-            if (s.error_message)
-                console.log(`     ${clrError(s.error_message)}`);
-            if (s.output_json !== null && s.output_json !== undefined) {
-                const pretty = JSON.stringify(s.output_json, null, 2).split('\n').map(l => `     ${l}`).join('\n');
-                console.log(pretty);
-            }
-        }
+        printStepRuns(r.step_runs ?? [], '(no steps recorded)');
         return;
     }
     const res = await get(`/workflows/${wf.short_guid}/runs`);