gipity 1.0.424 → 1.0.425

package/dist/index.js

@@ -6862,11 +6862,11 @@ async function getAccountSlug() {
   accountSlugCache = res.data.accountSlug;
   return accountSlugCache;
 }
-async function publicPost(path4, body) {
+async function publicPost(path4, body, extraHeaders) {
   const url = `${baseUrl()}${path4}`;
   const res = await fetch(url, {
     method: "POST",
-    headers: { ...clientHeaders(), "Content-Type": "application/json" },
+    headers: { ...clientHeaders(), "Content-Type": "application/json", ...extraHeaders },
     body: JSON.stringify(body)
   });
   if (!res.ok) {
@@ -7380,6 +7380,7 @@ gipity bug report --category <cli|deploy|template|kit|db|docs|skill|service|sand
 - **Never include PII or user data** (emails, names, secrets, tokens, prompt/file contents) \u2014 describe the platform problem in the abstract.
 - File it for *platform* problems, not your own mistakes or the app's own bugs. One report per distinct problem.
 - Reports go to a review queue for the team to triage into fixes; see what you've filed with \`gipity bug list\`.
+- Filed one by mistake? Withdraw it yourself: \`gipity bug retract <report-id> [--reason "<why>"]\` \u2014 works while it's still queued (status new/triaged). Never file a second report asking a human to close the first.
 
 ## Tool output is complete and synchronous
 
@@ -8585,7 +8586,8 @@ function readGipityIgnore(root) {
 }
 function effectiveIgnore(root, configIgnore) {
   const base = configIgnore && configIgnore.length ? configIgnore : DEFAULT_SYNC_IGNORE;
-  return [...base, GIPITY_IGNORE_FILE, ...readGipityIgnore(root)];
+  const merged = [...base, GIPITY_IGNORE_FILE, ...readGipityIgnore(root)];
+  return [...merged, ...SCRATCH_IGNORE.filter((p) => !merged.includes(p))];
 }
 function isLocalTreeClean() {
   try {
@@ -10335,6 +10337,7 @@ init_auth();
 import { readFileSync as readFileSync11 } from "node:fs";
 init_api();
 init_colors();
+init_auth();
 init_config();
 
 // src/page-fixtures.ts
@@ -10391,6 +10394,17 @@ function normalizeEvalResult(raw) {
   }
   return { result: raw, noValue: false };
 }
+var EXPR_ECHO_MAX_CHARS = 120;
+function summarizeExpr(expr) {
+  const lines = expr.split("\n");
+  const meaningful = lines.filter((l) => l.trim() !== "");
+  const oneLine = meaningful.length <= 1;
+  if (oneLine && expr.trim().length <= EXPR_ECHO_MAX_CHARS) return expr.trim();
+  const first = (meaningful[0] ?? "").trim();
+  const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 1)}\u2026` : first;
+  const shape = oneLine ? `(${expr.trim().length} chars)` : `(+${meaningful.length - 1} more ${meaningful.length - 1 === 1 ? "line" : "lines"}, ${expr.trim().length} chars)`;
+  return `${head} ${shape}`;
+}
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 var MAX_WAIT_MS = 3e4;
 function capWaitMs(rawWait, url) {
@@ -10435,12 +10449,15 @@ function evalExecTimeoutMessage(result) {
   return `the expression hit the ~${EVAL_EXEC_BUDGET_MS / 1e3}s in-page execution budget \u2014 the eval body (including its own await/setTimeout pauses) ran longer than that. This budget is the time the expression itself is allowed to run; it is separate from --wait, which only sleeps BEFORE the eval and cannot extend it. Split a long interactive check into several shorter 'page eval' calls (e.g. one per state to verify), keeping each body's in-page waits well under ${EVAL_EXEC_BUDGET_MS / 1e3}s.`;
 }
 var JS_DECOY_FLAGS = ["--js", "--javascript", "--script", "--code", "--expr", "--eval", "--exec"];
-var pageEvalCommand = new Command("eval").description("Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script)").argument("<url>", "URL to load").argument("[expr]", "JavaScript to evaluate in page context (inline expression or statement body with return/await; result is JSON-serialized). Omit when using --file. Time budget: the body has ~20s to finish after page load - keep driver scripts within it.").option("--file <path>", "Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work. Same ~20s post-load budget as <expr>.").option(
+var pageEvalCommand = new Command("eval").description("Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead").argument("<url>", "URL to load").argument("[expr]", "JavaScript to evaluate in page context (inline expression or statement body with return/await; result is JSON-serialized). Omit when using --file. Time budget: the body has ~20s to finish after page load - keep driver scripts within it.").option("--file <path>", "Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work. Same ~20s post-load budget as <expr>.").option(
   "--fixture <path>",
   "Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. Repeat for several files (single-value so it never swallows the inline <expr>).",
   (val, prev) => [...prev, val],
   []
-).option("--wait <ms>", "Sleep this many ms after DOMContentLoaded before evaluating (lets late async work settle; max 30000)", "500").option("--wait-for <selector>", "Wait until this CSS selector appears before evaluating (deterministic; replaces --wait)").option("--wait-timeout <ms>", "Max ms to wait for --wait-for before giving up", "5000").option("--auth", "Evaluate signed in as you (your Gipity account), so a page behind a Sign-in-with-Gipity login is reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.").option("--json", "Output as JSON").action((url, exprArg, opts) => run("Page eval", async () => {
+).option(
+  "--reload <expr>",
+  "After the first eval, reload the page IN PLACE (localStorage/sessionStorage/cookies preserved) and evaluate this second expression against the post-reload DOM. One command verifies persisted state survives a reload: seed/assert state with <expr>, then assert the restored UI here."
+).option("--reload-file <path>", "Read the post-reload expression from a file instead of inline --reload (mutually exclusive)").option("--wait <ms>", "Sleep this many ms after DOMContentLoaded before evaluating (lets late async work settle; max 30000)", "500").option("--wait-for <selector>", "Wait until this CSS selector appears before evaluating (deterministic; replaces --wait)").option("--wait-timeout <ms>", "Max ms to wait for --wait-for before giving up", "5000").option("--auth", "Evaluate signed in as you (your Gipity account), so a page behind a Sign-in-with-Gipity login is reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.").option("--json", "Output as JSON").action((url, exprArg, opts) => run("Page eval", async () => {
   const decoy = JS_DECOY_FLAGS.find((f) => opts[f.slice(2)] !== void 0);
   if (decoy) {
     pageEvalCommand.error(
@@ -10468,6 +10485,17 @@ var pageEvalCommand = new Command("eval").description("Evaluate JS in a real bro
       pageEvalCommand.error(`error: Cannot read file: ${opts.file}`);
     }
   }
+  if (opts.reload !== void 0 && opts.reloadFile) {
+    pageEvalCommand.error("error: Pass either --reload <expr> or --reload-file <path>, not both");
+  }
+  let reloadExpr = opts.reload;
+  if (opts.reloadFile) {
+    try {
+      reloadExpr = readFileSync11(opts.reloadFile, "utf8");
+    } catch {
+      pageEvalCommand.error(`error: Cannot read file: ${opts.reloadFile}`);
+    }
+  }
   const waitMs = capWaitMs(opts.wait, url);
   const parsedTimeout = parseInt(opts.waitTimeout, 10);
   const waitForTimeoutMs = Number.isFinite(parsedTimeout) && parsedTimeout >= 0 ? parsedTimeout : 5e3;
@@ -10494,29 +10522,47 @@ return (${expr});`;
       url,
       expr: sentExpr,
       waitMs,
+      reloadExpr,
       waitForSelector: opts.waitFor || void 0,
       waitForTimeoutMs: opts.waitFor ? waitForTimeoutMs : void 0,
       auth: opts.auth || void 0
     });
-    const d = await pollEvalResult(kickoff.data.evalJobId, waitMs);
+    const d = await pollEvalResult(kickoff.data.evalJobId, reloadExpr !== void 0 ? waitMs * 2 : waitMs);
     const { result, noValue } = normalizeEvalResult(d.result);
+    const reload = d.reloadResult !== void 0 ? normalizeEvalResult(d.reloadResult) : void 0;
     const execTimeout = evalExecTimeoutMessage(d.result);
     if (execTimeout) throw new Error(execTimeout);
     if (opts.json) {
-      console.log(JSON.stringify(noValue ? { ...d, result, hint: EVAL_NO_VALUE_HINT } : { ...d, result }));
+      console.log(JSON.stringify({
+        ...d,
+        result,
+        ...reload ? { reloadResult: reload.result } : {},
+        ...noValue ? { hint: EVAL_NO_VALUE_HINT } : {}
+      }));
       return;
     }
     console.log(`${brand("Eval")} ${bold(d.url || url)}`);
     if (d.navigationIncomplete) {
       console.log(`${warning("\u26A0 Navigation incomplete:")} ${d.note || "page did not reach full load"}`);
     }
+    if (d.auth?.requested) {
+      const who = getAuth()?.email;
+      console.log(d.auth.established ? `${muted("Auth:")} ${success("session established")}${who ? muted(` as ${who}`) : ""} ${muted("(what the page renders with it is app-defined)")}` : `${warning("Auth: session NOT established")}${d.auth.detail ? ` \u2014 ${d.auth.detail}` : ""} ${muted("(this is the anonymous view)")}`);
+    }
     if (hosted.length) console.log(`${muted("Fixtures:")} ${hosted.map((h) => h.name).join(", ")}`);
-    console.log(opts.file ? `${muted("Script:")} ${opts.file}` : `${muted("Expression:")} ${expr}`);
+    console.log(opts.file ? `${muted("Script:")} ${opts.file}` : `${muted("Expression:")} ${summarizeExpr(expr)}`);
     console.log(`
 ${result.trim() ? result : muted("(empty result)")}`);
     if (noValue) console.log(muted(`
 ${EVAL_NO_VALUE_HINT}`));
     if (d.truncated) console.log(muted("\n(result truncated to fit context - narrow the expression for the full value)"));
+    if (reload) {
+      console.log(`
+${bold("After reload")} ${muted("(page reloaded in place \u2014 storage preserved)")}`);
+      console.log(reload.result.trim() ? reload.result : muted("(empty result)"));
+      if (reload.noValue) console.log(muted(EVAL_NO_VALUE_HINT));
+      if (d.reloadTruncated) console.log(muted("(reload result truncated to fit context - narrow the expression for the full value)"));
+    }
   } finally {
     for (const h of hosted) {
       try {
@@ -10538,6 +10584,16 @@ Examples:
   # fetch-able 'fixtureUrl', runs the eval, then deletes the hosted copy:
   gipity page eval "https://dev.gipity.ai/me/app/" --fixture ./sample.mp3 \\
     "(async()=>{ const b = await fetch(fixtureUrl).then(r=>r.arrayBuffer()); return window.App.parseId3(b); })()"
+  # Verify persisted state survives a reload (localStorage/sessionStorage kept):
+  # run <expr>, reload the page in place, then run the --reload expression:
+  gipity page eval "https://dev.gipity.ai/me/app/" \\
+    "localStorage.setItem('todo','milk'); document.title" \\
+    --reload "({ restored: localStorage.getItem('todo'), heading: document.querySelector('h1')?.textContent })"
+
+Module resolution: dynamic import() specifiers starting with ./ or ../ resolve
+against the PAGE URL, so import('./packages/i18n/index.js') loads the app's own
+module without hand-building the deployed /account/project/ path. Absolute paths
+and full URLs pass through unchanged.
 
 The eval body runs under a ~20s in-page execution budget (its own await/setTimeout
 pauses count; --wait only sleeps BEFORE the eval and does not extend it). For a long
@@ -10553,6 +10609,7 @@ Testing realtime/shared state across clients?
 // src/commands/page-screenshot.ts
 init_api();
 init_config();
+init_auth();
 init_colors();
 init_utils();
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
@@ -10572,6 +10629,15 @@ function label(text) {
 function fmtMs(ms) {
   return ms >= 1e3 ? `${(ms / 1e3).toFixed(1)}s` : `${ms}ms`;
 }
+function printAuthLine(auth) {
+  if (!auth?.requested) return;
+  const who = getAuth()?.email;
+  console.log(auth.established ? `${label("Auth")} ${success("session established")}${who ? muted(` as ${who}`) : ""} ${muted("(what the page renders with it is app-defined)")}` : `${warning("Auth: session NOT established")}${auth.detail ? ` \u2014 ${auth.detail}` : ""} ${muted("(this is the anonymous view)")}`);
+}
+function printActionErrorLine(actionError) {
+  if (!actionError) return;
+  console.log(`${warning("\u26A0 --action failed:")} ${actionError} ${muted("(this image shows the page BEFORE the action ran)")}`);
+}
 function fmtPerformance(p) {
   const parts = [
     `TTFB ${fmtMs(p.ttfb)}`,
@@ -10653,7 +10719,7 @@ function splitCsv(values) {
 function appendOption(value, previous = []) {
   return [...previous, value];
 }
-var pageScreenshotCommand = new Command("screenshot").description("Screenshot a web page").argument("<url>", "URL to screenshot").option("--post-load-delay <ms>", "Delay after DOMContentLoaded before capture, in ms (default: 1000)").option("--action <js>", `Run JS in the page before capturing \u2014 e.g. click a button to enter a state ("document.getElementById('play').click()"). Runs after the post-load delay, then settles again before the shot.`).option("--full", "Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.").option("-o, --output <file>", "Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)").option("--device <names>", `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(", ")} (comma-separated or repeat flag). mobile/tablet emulate a real touch device \u2014 touch events, mobile user-agent, DPR \u2014 so touch-gated mobile UI actually renders.`, appendOption, []).option("--viewport <dims>", "Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag)", appendOption, []).option("--no-reload-between", "Skip reload between viewports (faster, lower fidelity - only safe for static pages)").option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps render headlessly (audio is a built-in tone, not real speech)").option("--auth", "Capture the page signed in as you (your Gipity account), so UI behind a Sign-in-with-Gipity login is shown. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.").option("--json", "Output JSON metadata instead of a friendly summary").addOption(new Option("--wait <ms>", "Alias for --post-load-delay").hideHelp()).addOption(new Option("--full-page", "Alias for --full").hideHelp()).action((url, opts) => run("Page screenshot", async () => {
+var pageScreenshotCommand = new Command("screenshot").description("Screenshot a web page").argument("<url>", "URL to screenshot").option("--post-load-delay <ms>", "Delay after DOMContentLoaded before capture, in ms (default: 1000)").option("--action <js>", `Run JS in the page before capturing \u2014 e.g. click a button to enter a state ("document.getElementById('play').click()"). Runs as an async function body, so const/await and app-relative import('./\u2026') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.`).option("--full", "Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.").option("-o, --output <file>", "Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)").option("--device <names>", `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(", ")} (comma-separated or repeat flag). mobile/tablet emulate a real touch device \u2014 touch events, mobile user-agent, DPR \u2014 so touch-gated mobile UI actually renders.`, appendOption, []).option("--viewport <dims>", "Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag)", appendOption, []).option("--no-reload-between", "Skip reload between viewports (faster, lower fidelity - only safe for static pages)").option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps render headlessly (audio is a built-in tone, not real speech)").option("--auth", "Capture the page signed in as you (your Gipity account), so UI behind a Sign-in-with-Gipity login is shown. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.").option("--json", "Output JSON metadata instead of a friendly summary").addOption(new Option("--wait <ms>", "Alias for --post-load-delay").hideHelp()).addOption(new Option("--full-page", "Alias for --full").hideHelp()).action((url, opts) => run("Page screenshot", async () => {
   const delayRaw = opts.postLoadDelay ?? opts.wait ?? "1000";
   const postLoadDelayMs = delayRaw !== void 0 ? parseInt(String(delayRaw), 10) : void 0;
   if (postLoadDelayMs !== void 0 && (!Number.isFinite(postLoadDelayMs) || postLoadDelayMs < 0)) {
@@ -10707,7 +10773,8 @@ var pageScreenshotCommand = new Command("screenshot").description("Screenshot a
         title: meta.title,
         final_url: meta.finalUrl,
         status: meta.status,
-        performance: meta.performance
+        performance: meta.performance,
+        ...meta.auth ? { auth: meta.auth } : {}
       },
       screenshots: meta.screenshots.map((s, i) => ({
         file: savedFiles[i],
@@ -10734,6 +10801,8 @@ var pageScreenshotCommand = new Command("screenshot").description("Screenshot a
     if (meta.finalUrl) console.log(`${label("Web page URL")} ${meta.finalUrl}`);
     if (meta.status != null) console.log(`${label("Web page status")} ${meta.status}`);
     if (meta.performance) console.log(`${label("Web page perf")} ${fmtPerformance(meta.performance)}`);
+    printAuthLine(meta.auth);
+    printActionErrorLine(meta.actionError);
     if (s.viewport.device) console.log(`${label("Emulated device")} ${s.viewport.device} ${muted("(touch events, mobile user-agent)")}`);
     const sizePart = formatSize(s.screenshotSizeBytes) + (meta.full ? " (full page)" : "");
     console.log(`${label("Screenshot size")} ${sizePart}`);
@@ -10746,6 +10815,8 @@ var pageScreenshotCommand = new Command("screenshot").description("Screenshot a
   if (meta.finalUrl) console.log(`${label("Web page URL")} ${meta.finalUrl}`);
   if (meta.status != null) console.log(`${label("Web page status")} ${meta.status}`);
   if (meta.performance) console.log(`${label("Web page perf")} ${fmtPerformance(meta.performance)}`);
+  printAuthLine(meta.auth);
+  printActionErrorLine(meta.actionError);
   for (let i = 0; i < meta.screenshots.length; i++) {
     const s = meta.screenshots[i];
     const dims = `${s.viewport.width}\xD7${s.viewport.height}${s.viewport.deviceScaleFactor > 1 ? ` @${s.viewport.deviceScaleFactor}x` : ""}`;
@@ -10794,7 +10865,7 @@ function shortUrl(url, truncate = true, maxLen = 100) {
   const tailLen = Math.floor(keep / 2);
   return result.slice(0, headLen) + "\u2026" + result.slice(-tailLen);
 }
-var pageInspectCommand = new Command("inspect").description("Inspect a web page (console, failed resources, timing, layout overflow)").argument("<url>", "URL to inspect").option("--wait <ms>", "Sleep this many ms after DOMContentLoaded before capturing (lets late async/LCP work settle; max 30000)", "500").option("--wait-for <selector>", "Wait until this CSS selector appears before capturing (deterministic; replaces --wait)").option("--wait-timeout <ms>", "Max ms to wait for --wait-for before giving up", "5000").option("--json", "Output as JSON").option("--no-reprobe", "Skip the automatic second probe that filters one-time transient console errors - roughly halves inspect time on a page with any console error, at the cost of possibly reporting a cold-load transient as real").option("--no-truncate", "Show full URLs instead of truncating long ones with middle-ellipsis").option("--all", "Include render-blocking, large resources, oversized images, overflow culprits, and LCP detail").option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps run headlessly (audio is a built-in tone, not real speech)").option("--device <name>", `Inspect as a real touch device: ${TOUCH_DEVICES.join(", ")}. Emulates touch events, mobile user-agent and DPR, so a touch-gated mobile layout is what gets inspected.`).option("--auth", "Load the page signed in as you (your Gipity account), so pages behind a Sign-in-with-Gipity login are reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.").addOption(new Option("--screenshot [path]", "Capture a screenshot").hideHelp()).action((url, opts) => {
+var pageInspectCommand = new Command("inspect").description("Inspect a web page (console, failed resources, timing, layout overflow). ONE passive load - to verify realtime/presence across concurrent clients use `page test --observe`").argument("<url>", "URL to inspect").option("--wait <ms>", "Sleep this many ms after DOMContentLoaded before capturing (lets late async/LCP work settle; max 30000)", "500").option("--wait-for <selector>", "Wait until this CSS selector appears before capturing (deterministic; replaces --wait)").option("--wait-timeout <ms>", "Max ms to wait for --wait-for before giving up", "5000").option("--json", "Output as JSON").option("--no-reprobe", "Skip the automatic second probe that filters one-time transient console errors - roughly halves inspect time on a page with any console error, at the cost of possibly reporting a cold-load transient as real").option("--no-truncate", "Show full URLs instead of truncating long ones with middle-ellipsis").option("--all", "Include render-blocking, large resources, oversized images, overflow culprits, and LCP detail").option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps run headlessly (audio is a built-in tone, not real speech)").option("--device <name>", `Inspect as a real touch device: ${TOUCH_DEVICES.join(", ")}. Emulates touch events, mobile user-agent and DPR, so a touch-gated mobile layout is what gets inspected.`).option("--auth", "Load the page signed in as you (your Gipity account), so pages behind a Sign-in-with-Gipity login are reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.").addOption(new Option("--screenshot [path]", "Capture a screenshot").hideHelp()).action((url, opts) => {
   if (opts.screenshot !== void 0) {
     console.error(error("page inspect does not capture screenshots. Use page screenshot:"));
     console.error(`  gipity page screenshot ${url}${typeof opts.screenshot === "string" ? ` -o ${opts.screenshot}` : ""}`);
@@ -11345,6 +11416,11 @@ sandboxCommand.command("run [args...]").description("Run code").option("--langua
   "--input <path>",
   "Narrow to specific project files instead of auto-mirroring the whole tree (repeatable). Use this only for >1 GB projects or when you want surgical control.",
   (v, prev) => [...prev ?? [], v]
+).option(
+  "--no-sync-output <glob>",
+  'Do not persist run outputs matching this glob back to the project (repeatable). For byproducts you want to inspect once but never keep, e.g. --no-sync-output "docs/preview*". Supports *, **, and dir/ prefixes.',
+  (v, prev) => [...prev, v],
+  []
 ).option("--json", "Output as JSON").addHelpText("after", `
 By default the whole project is auto-mirrored into /work/ (up to 1 GB) -
 so your code can reference project files by their relative path, and any
@@ -11416,6 +11492,11 @@ GCC/Rust).
     }
   }
   const language = resolveLanguage({ langFromInterp, langOpt: opts.language, filePath, inlineCode });
+  const noSyncOutput = opts.syncOutput ?? [];
+  if (noSyncOutput.some((g) => !g.trim())) {
+    console.error(error('--no-sync-output requires a non-empty glob (e.g. --no-sync-output "docs/preview*")'));
+    process.exit(1);
+  }
   const { config } = await resolveProjectContext();
   const timeout = parseInt(opts.timeout, 10);
   const cwd = resolveRelativeCwd();
@@ -11436,7 +11517,11 @@ GCC/Rust).
     language,
     timeout: isNaN(timeout) ? 30 : timeout,
     input_files: opts.input,
-    cwd
+    cwd,
+    // The filter must run SERVER-side (in the output extractor): skipping
+    // only in the CLI would still write the files into project storage and
+    // make every later sync propose deleting them.
+    noSyncOutput: noSyncOutput.length ? noSyncOutput : void 0
   });
   const res = opts.json ? await doRun() : await withSpinner("Running in sandbox\u2026", doRun, { done: null });
   const pulledLocal = !!(res.data.outputFiles?.length && getConfigPath());
@@ -11461,6 +11546,10 @@ GCC/Rust).
 Output files ${pulledLocal ? "synced to this directory" : "saved to project"}:`);
       for (const f of res.data.outputFiles) console.log(`${f}`);
     }
+    if (res.data.skippedOutputFiles && res.data.skippedOutputFiles.length > 0) {
+      console.log(dim("\nNot persisted (--no-sync-output):"));
+      for (const f of res.data.skippedOutputFiles) console.log(dim(`${f}`));
+    }
     if (res.data.exitCode !== 0) {
       process.exit(res.data.exitCode);
     }
@@ -11858,6 +11947,21 @@ function formatRunLine(r) {
   const statusColor = r.status === "completed" ? success : r.status === "failed" ? error : muted;
   return `${muted(r.short_guid)}  ${statusColor(r.status)}  ${dur}  ${runTokens(r)} tokens  ${muted(fmtTime(r.started_at))}`;
 }
+function printStepRuns(steps, emptyNote) {
+  if (steps.length === 0) {
+    console.log(`  ${muted(emptyNote)}`);
+    return;
+  }
+  for (const s of steps) {
+    const statusColor = s.status === "completed" ? success : s.status === "failed" ? error : muted;
+    const model = s.model_used ? `  ${muted(`[${s.model_used}]`)}` : "";
+    console.log(`  ${s.step_order}. ${statusColor(s.status)}  ${s.tokens_used ?? 0} tokens${model}`);
+    if (s.error_message) console.log(`     ${error(s.error_message)}`);
+    if (s.output_json !== null && s.output_json !== void 0) {
+      console.log(JSON.stringify(s.output_json, null, 2).split("\n").map((l) => `     ${l}`).join("\n"));
+    }
+  }
+}
 var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 var sleep2 = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
 async function waitForRun(wfGuid, prevGuid, timeoutSec) {
@@ -11942,6 +12046,7 @@ workflowCommand.command("run <name>").description("Trigger a workflow (add --wai
   } else {
     console.log(formatRunLine(r));
     if (r.error_message) console.log(`  ${error(r.error_message)}`);
+    printStepRuns(r.step_runs ?? [], "(no steps recorded)");
   }
   if (r.status !== "completed") process.exit(1);
 }));
@@ -11956,21 +12061,7 @@ workflowCommand.command("runs <name> [runGuid]").description("List recent runs,
       return;
     }
     console.log(formatRunLine(r));
-    const steps = r.step_runs ?? [];
-    if (steps.length === 0) {
-      console.log("  (no steps recorded)");
-      return;
-    }
-    for (const s of steps) {
-      const statusColor = s.status === "completed" ? success : s.status === "failed" ? error : muted;
-      const model = s.model_used ? `  ${muted(`[${s.model_used}]`)}` : "";
-      console.log(`  ${s.step_order}. ${statusColor(s.status)}  ${s.tokens_used ?? 0} tokens${model}`);
-      if (s.error_message) console.log(`     ${error(s.error_message)}`);
-      if (s.output_json !== null && s.output_json !== void 0) {
-        const pretty = JSON.stringify(s.output_json, null, 2).split("\n").map((l) => `     ${l}`).join("\n");
-        console.log(pretty);
-      }
-    }
+    printStepRuns(r.step_runs ?? [], "(no steps recorded)");
     return;
   }
   const res = await get(`/workflows/${wf.short_guid}/runs`);
@@ -14231,6 +14322,9 @@ var addCommand = new Command("add").description("Add a template or kit").argumen
       force: opts.force
     };
   }
+  if (!opts.json && !process.stdout.isTTY) {
+    console.error(muted("Installing (server writes files + generates favicons; first add for a title can take ~10s)..."));
+  }
   const doAdd = () => post(`/projects/${config.projectGuid}/add`, body);
   const res = opts.json ? await doAdd() : await withSpinner("Installing\u2026", doAdd, { done: null });
   const syncResult = await sync({ interactive: false, progress: opts.json ? void 0 : createProgressReporter() });
@@ -15015,7 +15109,7 @@ ${error(`\u2717 ${failed.length} of ${results.length} file(s) missing or wrong-t
 }));
 
 // src/commands/page.ts
-var pageCommand = new Command("page").description("Inspect web pages").addCommand(pageInspectCommand).addCommand(pageEvalCommand).addCommand(pageScreenshotCommand).addCommand(pageTestCommand).addCommand(pageFetchCommand);
+var pageCommand = new Command("page").description("Inspect, drive, and test web pages in a real browser (page test = N concurrent clients for realtime/presence verification)").addCommand(pageInspectCommand).addCommand(pageEvalCommand).addCommand(pageScreenshotCommand).addCommand(pageTestCommand).addCommand(pageFetchCommand);
 pageCommand.action(() => {
   pageCommand.help();
 });
@@ -15142,14 +15236,25 @@ ${error(`error: ${log3.error_message}`)}`;
     return line;
   });
 }));
-fnCommand.command("call <name> [body]").description("Call a function").option("--data <json>", "JSON request body").option("--field <path>", "Print only this field of the result (dot path, e.g. items.0.short_guid)").option("--json", "Output as JSON").action((name, bodyArg, opts) => run("Call", async () => {
+async function callAnon(projectGuid, name, body) {
+  let appToken;
+  try {
+    const minted = await publicPost("/api/token", { app: projectGuid });
+    appToken = minted.data.token;
+  } catch {
+  }
+  return publicPost(
+    `/api/${projectGuid}/fn/${encodeURIComponent(name)}`,
+    body,
+    appToken ? { "X-App-Token": appToken } : void 0
+  );
+}
+fnCommand.command("call <name> [body]").description("Call a function").option("--data <json>", "JSON request body").option("--anon", "Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account").option("--field <path>", "Print only this field of the result (dot path, e.g. items.0.short_guid)").option("--json", "Output as JSON").action((name, bodyArg, opts) => run("Call", async () => {
   const config = requireConfig();
   const raw = bodyArg || opts.data || "{}";
   const body = JSON.parse(raw);
-  const res = await post(
-    `/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`,
-    body
-  );
+  const path4 = `/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`;
+  const res = opts.anon ? await callAnon(config.projectGuid, name, body) : await post(path4, body);
   if (opts.field) {
     emitField(res.data, opts.field);
     return;
@@ -15319,7 +15424,9 @@ so the team can triage it into a fix.
 
 Categories: ${CATEGORIES.join(", ")}
 Severity:   ${SEVERITY_HINT}
-Never include PII or user data \u2014 describe the platform problem in the abstract.`
+Never include PII or user data \u2014 describe the platform problem in the abstract.
+Filed one by mistake? Withdraw it yourself with \`gipity bug retract <id>\`
+(works until a human picks it up) \u2014 don't file a second report asking for a close.`
 );
 bugCommand.command("report").description("File a bug / friction report about the Gipity platform").requiredOption("--category <cat>", `One of: ${CATEGORIES.join(", ")}`).requiredOption("--severity <sev>", SEVERITY_HINT).requiredOption("--summary <text>", "One line, 7 words max. No PII/user data.").option("--detail <text>", "Succinct: what you did, what failed, the workaround. No PII/user data.").option("--project <guid-or-slug>", "Attribute to a specific project instead of cwd / Home").option("--json", "Output raw JSON").action((opts) => run("Bug report", async () => {
   const category = String(opts.category).toLowerCase();
@@ -15340,6 +15447,24 @@ bugCommand.command("report").description("File a bug / friction report about the
   }
   console.log(success(`\u2713 Bug report filed (${res.data.report_guid}) \u2014 queued for triage.`));
 }));
+bugCommand.command("retract <id>").description("Withdraw a bug report you filed (e.g. it was your own mistake)").option("--reason <text>", "Short note for triage on why you are retracting").option("--project <guid-or-slug>", "Resolve auth against a specific project instead of cwd / Home").option("--json", "Output raw JSON").addHelpText(
+  "after",
+  `
+Only works on your own reports, and only while they are still queued
+(status new/triaged). Once a report is filed/fixed/dismissed, a human
+owns closing it out. Find report ids with \`gipity bug list\`.`
+).action((id, opts) => run("Bug report", async () => {
+  const { config } = await resolveProjectContext({ projectOverride: opts.project });
+  const res = await post(
+    `/api/${config.projectGuid}/services/bug-report/retract`,
+    { report_guid: id, reason: opts.reason }
+  );
+  if (opts.json) {
+    console.log(JSON.stringify(res.data));
+    return;
+  }
+  console.log(success(`\u2713 Bug report ${res.data.report_guid} retracted \u2014 it is out of the triage queue.`));
+}));
 bugCommand.command("list").description("List the bug / friction reports you have filed").option("--project <guid-or-slug>", "Resolve auth against a specific project instead of cwd / Home").option("--json", "Output raw JSON").action((opts) => run("Bug report", async () => {
   const { config } = await resolveProjectContext({ projectOverride: opts.project });
   const res = await get(
@@ -15597,7 +15722,7 @@ jobCommand.command("cancel <runGuid>").description("Cancel a queued or running j
 }));
 jobCommand.command("run-local <name>").description("Run the job in a local Docker container against your local filesystem (no platform round-trip)").option("--image <image>", "Docker image to run inside", "easyclaw/sandbox:latest").option("--no-deps", "Skip pip/npm install even if a deps file is present").action(async (name, opts) => {
   const { existsSync: existsSync20, statSync: statSync9 } = await import("node:fs");
-  const { resolve: resolve16, join: join21 } = await import("node:path");
+  const { resolve: resolve16, join: join22 } = await import("node:path");
   const { spawnCommand: spawnCommand2, spawnSyncCommand: spawnSyncCommand2 } = await Promise.resolve().then(() => (init_platform(), platform_exports));
   const jobDir = resolve16(process.cwd(), "jobs", name);
   if (!existsSync20(jobDir) || !statSync9(jobDir).isDirectory()) {
@@ -15621,7 +15746,7 @@ jobCommand.command("run-local <name>").description("Run the job in a local Docke
     },
     { file: "main.sh", runtime: "bash", entry: "bash" }
   ];
-  const picked = variants.find((v) => existsSync20(join21(jobDir, v.file)));
+  const picked = variants.find((v) => existsSync20(join22(jobDir, v.file)));
   if (!picked) {
     console.error(error(`No main.py / main.js / main.sh found under jobs/${name}/`));
     process.exit(1);
@@ -15646,7 +15771,7 @@ jobCommand.command("run-local <name>").description("Run the job in a local Docke
     "-v",
     `${jobDir}:/work`
   ];
-  const needsDeps = opts.deps !== false && picked.depsFile && picked.installCmd && existsSync20(join21(jobDir, picked.depsFile));
+  const needsDeps = opts.deps !== false && picked.depsFile && picked.installCmd && existsSync20(join22(jobDir, picked.depsFile));
   const handlerCmd = `${picked.entry} /work/${picked.file}`;
   let shellCmd;
   if (needsDeps && picked.installCmd) {
@@ -16308,6 +16433,16 @@ function statusIcon2(status) {
   if (status === "skipped") return muted("\u2192");
   return muted("?");
 }
+function printSkippedCandidates(skipped) {
+  if (skipped.length === 0) return;
+  console.log("");
+  console.log(muted(`Found ${skipped.length} test-looking file${skipped.length === 1 ? "" : "s"} that gipity test does not run:`));
+  for (const s of skipped.slice(0, 10)) {
+    console.log(muted(`  ${s.path} (${s.reason})`));
+  }
+  if (skipped.length > 10) console.log(muted(`  ... and ${skipped.length - 10} more`));
+  console.log(muted('Run frontend/kit module tests in the sandbox: gipity sandbox run bash "node <file>"'));
+}
 var LONG_RUN_MS = 6e4;
 async function pollTestStatus(projectGuid, runGuid, opts) {
   const startTime = Date.now();
@@ -16419,9 +16554,17 @@ var testCommand = new Command("test").description("Run tests").argument("[path]"
     process.exit(1);
   }
   if (!filterPath && data.total === 0 && data.results.length === 0) {
-    console.log(muted("No tests ran - this app has no tests/*.test.js files."));
+    const root = getProjectRoot();
+    console.log(muted(`No tests ran - no tests/*.test.js files under the project root${root ? ` (${root})` : ""}.`));
     console.log(muted("gipity test runs server-function tests only; a frontend-only app (no functions/) has nothing here to run."));
     console.log(muted("Verify a frontend app by driving the live page: gipity page inspect <url> (or gipity page eval)."));
+    try {
+      const listRes = await get(
+        `/projects/${config.projectGuid}/test/list`
+      );
+      printSkippedCandidates(listRes.data.skipped ?? []);
+    } catch {
+    }
     return;
   }
   if (data.status === "failed" && data.errorMessage) {
@@ -16489,7 +16632,9 @@ testCommand.command("list").description("List the test files that would run \u20
     return;
   }
   if (total === 0) {
-    console.log(muted(pathFilter ? `No test files matched filter: ${pathFilter}` : "No test files found. Add *.test.js files under tests/."));
+    const root = getProjectRoot();
+    console.log(muted(pathFilter ? `No test files matched filter: ${pathFilter}` : `No test files found under tests/ at the project root${root ? ` (${root})` : ""}. Add *.test.js files under tests/.`));
+    if (!pathFilter) printSkippedCandidates(res.data.skipped ?? []);
     return;
   }
   console.log(bold(`Test files${pathFilter ? ` (filter: ${pathFilter})` : ""}: ${total}`));
@@ -19694,7 +19839,58 @@ function collectRealFlags(argv2, program3) {
   return flags;
 }
 
+// src/trace.ts
+import { openSync as openSync4, writeSync, mkdirSync as mkdirSync12 } from "fs";
+import { join as join21 } from "path";
+import { homedir as homedir15 } from "os";
+var TRACE_KEY = /* @__PURE__ */ Symbol.for("gipity.traceOutput");
+function installOutputTrace(label2) {
+  if (process.env.GIPITY_TRACE_OUTPUT !== "1") return;
+  try {
+    const g = globalThis;
+    const existing = g[TRACE_KEY];
+    if (existing) {
+      existing.emit({ event: "reenter", label: label2 });
+      return;
+    }
+    const dir = join21(process.env.GIPITY_DIR || join21(homedir15(), ".gipity"), "trace");
+    mkdirSync12(dir, { recursive: true });
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", "_").replace(/:/g, "-");
+    const fd = openSync4(join21(dir, `${stamp}-pid${process.pid}.jsonl`), "a");
+    const emit = (rec) => {
+      try {
+        writeSync(fd, JSON.stringify({ t: (/* @__PURE__ */ new Date()).toISOString(), ...rec }) + "\n");
+      } catch {
+      }
+    };
+    g[TRACE_KEY] = { emit };
+    emit({
+      event: "start",
+      label: label2,
+      pid: process.pid,
+      ppid: process.ppid,
+      argv: process.argv,
+      cwd: process.cwd(),
+      tty: { stdout: !!process.stdout.isTTY, stderr: !!process.stderr.isTTY }
+    });
+    for (const name of ["stdout", "stderr"]) {
+      const stream = process[name];
+      const original = stream.write.bind(stream);
+      stream.write = ((chunk, encoding, cb) => {
+        emit({
+          stream: name,
+          data: typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8")
+        });
+        return original(chunk, encoding, cb);
+      });
+    }
+    process.on("exit", (code) => emit({ event: "exit", code }));
+  } catch {
+  }
+}
+
 // src/index.ts
+installOutputTrace("index");
 var __dirname = dirname13(fileURLToPath3(import.meta.url));
 var pkg = JSON.parse(readFileSync23(resolve15(__dirname, "../package.json"), "utf-8"));
 function versionLabel() {

package/dist/knowledge.js

@@ -136,6 +136,7 @@ gipity bug report --category <cli|deploy|template|kit|db|docs|skill|service|sand
 - **Never include PII or user data** (emails, names, secrets, tokens, prompt/file contents) — describe the platform problem in the abstract.
 - File it for *platform* problems, not your own mistakes or the app's own bugs. One report per distinct problem.
 - Reports go to a review queue for the team to triage into fixes; see what you've filed with \`gipity bug list\`.
+- Filed one by mistake? Withdraw it yourself: \`gipity bug retract <report-id> [--reason "<why>"]\` — works while it's still queued (status new/triaged). Never file a second report asking a human to close the first.
 
 ## Tool output is complete and synchronous
 

package/dist/sync.js

@@ -29,7 +29,7 @@ import { get, del, downloadStream, ApiError } from './api.js';
 import { requireConfig, shouldIgnore, getConfigPath } from './config.js';
 import { formatSize, prompt, getAutoConfirm } from './utils.js';
 import { uploadOneFile, hashFile, guessMime, transferToS3, uploadInitBatch, uploadCompleteBatch, UploadConflictError, UPLOAD_CONCURRENCY, UPLOAD_INIT_BATCH_SIZE, UPLOAD_MAX_BYTES, UPLOAD_MAX_PATH_CHARS, } from './upload.js';
-import { DEFAULT_SYNC_IGNORE } from './setup.js';
+import { DEFAULT_SYNC_IGNORE, SCRATCH_IGNORE } from './setup.js';
 const CONFIG_FILE = '.gipity.json';
 import * as tar from 'tar-stream';
 // ─── Tunables ──────────────────────────────────────────────────
@@ -659,10 +659,24 @@ export function readGipityIgnore(root) {
 /** The ignore list a sync/push actually runs with: the project config's
  *  `ignore` (falling back to DEFAULT_SYNC_IGNORE when empty, so an empty list
  *  never means "sync everything - node_modules, .git and all"), plus any
- *  `.gipityignore` patterns. The ignore file itself never syncs. */
+ *  `.gipityignore` patterns, plus - unconditionally - the scratch namespaces.
+ *  The ignore file itself never syncs.
+ *
+ *  SCRATCH_IGNORE is unioned in even when the config has its own `ignore`
+ *  list, because scratch dirs are a PLATFORM CONVENTION, not a user
+ *  preference: they must mirror the server's `isEphemeralSandboxPath`
+ *  denylist (see the comment on SCRATCH_IGNORE in setup.ts) so the same
+ *  paths are throwaway everywhere - the sandbox refuses to persist them and
+ *  sync/deploy refuses to upload them. `config.ignore` is frozen into
+ *  .gipity.json at link time, so any project linked before a scratch dir was
+ *  added to the defaults would otherwise keep syncing it forever (tmp/ did
+ *  exactly this). Appended LAST so a stray `!tmp/` negation earlier in the
+ *  list can't re-include scratch; deduped so the matcher cache in
+ *  config.ts keys on one canonical pattern set. */
 export function effectiveIgnore(root, configIgnore) {
     const base = configIgnore && configIgnore.length ? configIgnore : DEFAULT_SYNC_IGNORE;
-    return [...base, GIPITY_IGNORE_FILE, ...readGipityIgnore(root)];
+    const merged = [...base, GIPITY_IGNORE_FILE, ...readGipityIgnore(root)];
+    return [...merged, ...SCRATCH_IGNORE.filter(p => !merged.includes(p))];
 }
 /** Fast, LOCAL-ONLY dirtiness probe: true when every local file matches its
  *  baseline entry by size+mtime and nothing was added or deleted since the