gipity 1.0.429 → 1.1.2

package/dist/commands/chat.js

@@ -50,9 +50,15 @@ export const chatCommand = new Command('chat')
                 ...(a.remoteSize != null ? { size: a.remoteSize } : {}),
             }));
         }
+        // The server's cost-consent gate stops the agentic loop on big-build
+        // requests: content comes back empty with an explicit costWarning.
+        // Surface it - before this the CLI printed a blank line and the request
+        // silently did nothing. Re-running the command consents via chat reply.
+        const displayContent = res.data.content || res.data.costWarning?.message || '';
         if (opts.json) {
             console.log(JSON.stringify({
-                content: res.data.content,
+                content: displayContent,
+                costWarning: res.data.costWarning ?? null,
                 toolsUsed: res.data.toolsUsed?.map(t => ({
                     tool: t.toolName,
                     success: t.success,
@@ -67,8 +73,8 @@ export const chatCommand = new Command('chat')
             }));
         }
         else {
-            // Show agent response
-            console.log(res.data.content);
+            // Show agent response (or the cost warning when the gate stopped the loop)
+            console.log(displayContent);
             // Show tools used
             if (res.data.toolsUsed && res.data.toolsUsed.length > 0) {
                 const toolNames = [...new Set(res.data.toolsUsed.map(t => t.toolName))];

package/dist/commands/claude.js

@@ -9,7 +9,7 @@ import { get, post, ApiError, getAccountSlug } from '../api.js';
 import { interactiveLogin } from '../login-flow.js';
 import { getConfig, saveConfigAt, clearConfigCache, getApiBaseOverride, DEFAULT_API_BASE, getConfigPath } from '../config.js';
 import { sync } from '../sync.js';
-import { slugify, setupClaudeHooks, ensureGipityPluginInstalled, setupClaudeMd, setupAgentsMd, setupGitignore, DEFAULT_SYNC_IGNORE, isSyncIgnored } from '../setup.js';
+import { slugify, ensureGipityPluginInstalled, setupProjectTools, DEFAULT_SYNC_IGNORE, isSyncIgnored } from '../setup.js';
 import { buildProjectContextBlock as buildProjectContextBlockText, buildNewProjectPrompt, buildResumeWrap, buildFreshWrap, } from '../prompts.js';
 import * as relayState from '../relay/state.js';
 import { maybeOfferRelayOn, ensureDaemonRunning } from '../relay/onboarding.js';
@@ -481,10 +481,7 @@ export const claudeCommand = new Command('claude')
             catch (err) {
                 console.log(`  ${warning('Could not sync files (will retry on next prompt):')} ${err.message}`);
             }
-            setupClaudeHooks();
-            setupClaudeMd();
-            setupAgentsMd();
-            setupGitignore();
+            setupProjectTools();
             if (nonInteractive) {
                 // Headless: the -p message is wrapped later (Step 3). Just record
                 // whether to use the new-project framing for that wrap.
@@ -503,10 +500,7 @@ export const claudeCommand = new Command('claude')
             // cwd already has (or inherits) a .gipity.json - run inside it.
             console.log(`  Project: ${brand(existing.projectSlug)} ${muted(`(${existing.projectGuid})`)}`);
             console.log(`  ${success('Already set up.')}\n`);
-            setupClaudeHooks();
-            setupClaudeMd();
-            setupAgentsMd();
-            setupGitignore();
+            setupProjectTools();
             // Warn before syncing a very large project tree. An oversized root
             // (or a config accidentally rooted high up, e.g. at $HOME) makes the
             // sync slow, and a silent multi-GB walk reads as a hang.
@@ -658,10 +652,7 @@ export const claudeCommand = new Command('claude')
             // of done, and a welcome banner prints before launch - the user tells
             // Claude directly what they want to build or do.
             initialPrompt = '';
-            setupClaudeHooks();
-            setupClaudeMd();
-            setupAgentsMd();
-            setupGitignore();
+            setupProjectTools();
             console.log(`  ${success(`Project "${project.name}" ready.`)}\n`);
         }
         // ── Step 3: Launch Claude Code ────────────────────────────────────

package/dist/commands/db.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { get, post, sendMessage } from '../api.js';
+import { get, post } from '../api.js';
 import { requireConfig } from '../config.js';
 import { error as clrError, success } from '../colors.js';
 import { run, printList, emitField } from '../helpers/index.js';
@@ -44,6 +44,11 @@ dbCommand
                     console.log(columns.map(c => String(row[c] ?? 'NULL')).join('\t'));
                 }
             }
+            // DML with RETURNING carries both rows and a count - the rows are the
+            // table above; still name how many rows the statement touched.
+            if (res.data.affectedRows !== undefined) {
+                console.log(`Affected rows: ${res.data.affectedRows}`);
+            }
         }
         else if (res.data.affectedRows !== undefined) {
             console.log(`Affected rows: ${res.data.affectedRows}`);
@@ -51,6 +56,11 @@ dbCommand
         else if (res.data.results) {
             console.log(JSON.stringify(res.data.results, null, 2));
         }
+        else {
+            // Unknown payload shape: print it raw rather than nothing - silence
+            // here reads as "the query returned no data", which is a lie.
+            console.log(JSON.stringify(res.data, null, 2));
+        }
     }
 }));
 dbCommand
@@ -106,13 +116,20 @@ dbCommand
     .description('Create a database')
     .option('--json', 'Output as JSON')
     .action((name, opts) => run('Create', async () => {
-    // DDL delegates to agent (needs confirmation flow)
-    const response = await sendMessage(`Create a new database called "${name}" for this project. Confirm when done, no explanation.`);
+    // Direct REST create - same endpoint `db drop` uses. This used to delegate
+    // to agent chat, which burned LLM tokens and, after the cost-consent gate
+    // landed server-side, could return an empty response having created
+    // nothing. Creating a database isn't destructive, so no confirmation.
+    const config = requireConfig();
+    await post(`/projects/${config.projectGuid}/db/manage`, {
+        action: 'create',
+        name,
+    });
     if (opts.json) {
-        console.log(JSON.stringify({ response }));
+        console.log(JSON.stringify({ success: true, name }));
     }
     else {
-        console.log(response);
+        console.log(success(`Created database '${name}'.`));
     }
 }));
 dbCommand

package/dist/commands/deploy.js

@@ -146,6 +146,13 @@ export const deployCommand = new Command('deploy')
         // has to reconstruct the URL convention or guess a subdomain.
         if (d.url)
             console.log(`${muted('Live:')} ${brand(d.url)}`);
+        // Functions are served from the API host, NOT the static Live URL -
+        // for an API-only app the endpoint address IS the deliverable, so name
+        // it instead of leaving it to be inferred from a template comment.
+        if (d.phases?.some(p => p.name === 'functions')) {
+            console.log(`${muted('Functions:')} POST ${brand(`${config.apiBase}/api/${config.projectGuid}/fn/<name>`)}`);
+            console.log(muted('  (same address on dev and prod; names: gipity fn list; verify the public path: gipity fn call <name> --anon)'));
+        }
         await inspectAfter();
     }
 }));

package/dist/commands/doctor.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import { existsSync, readFileSync, statSync } from 'fs';
-import { join } from 'path';
+import { join, resolve } from 'path';
 import { homedir } from 'os';
 import { LOCAL_PKG_DIR, LOCAL_ENTRY, STATE_FILE, SETTINGS_FILE, UPDATE_LOG, readState, readSettings, updatesDisabled } from '../updater/state.js';
 import { bold, dim, success, warning, error as clrError, muted } from '../colors.js';
@@ -162,7 +162,13 @@ export const doctorCommand = new Command('doctor')
     console.log(`${muted('claude code     ')} installed ${yn(env.claude.installed)} · authenticated ${yn(env.claude.authenticated)}`);
     const autostartLabel = env.relay.autostart === null ? muted('n/a') : yn(env.relay.autostart);
     console.log(`${muted('relay           ')} paired ${yn(env.relay.paired)} · running ${yn(env.relay.running)} · autostart ${autostartLabel}${env.relay.paused ? warning(' · paused') : ''}${env.relay.device ? muted(`  (${env.relay.device.name})`) : ''}`);
-    console.log(`${muted('ready           ')} ${env.ready ? success('yes') : warning('no - run `gipity claude` (or the desktop app) to finish setup')}`);
+    // Codex approves project hooks interactively and stores the decision in
+    // its own opaque state - we can't verify it from here, so surface the
+    // one manual step whenever this project ships Codex hooks.
+    if (existsSync(resolve(process.cwd(), '.codex', 'hooks.json'))) {
+        console.log(`${muted('codex hooks     ')} ${warning('written')} - session capture needs a one-time approval: run /hooks inside Codex in this project`);
+    }
+    console.log(`${muted('ready           ')} ${env.ready ? success('yes') : warning('no - run `gipity build` (or the desktop app) to finish setup')}`);
     // ── CLI install / update health ────────────────────────────────────
     const state = readState();
     const settings = readSettings();

package/dist/commands/fn.js

@@ -1,5 +1,6 @@
 import { Command } from 'commander';
 import { get, post, del, publicPost } from '../api.js';
+import { getAuth } from '../auth.js';
 import { requireConfig } from '../config.js';
 import { error as clrError, bold, muted, success, warning } from '../colors.js';
 import { run, printList, emitField } from '../helpers/index.js';
@@ -17,6 +18,11 @@ fnCommand
         const line = `${bold(f.name)}  ${muted(`v${f.version}`)}  ${muted(f.auth_level)}  ${muted(`timeout=${f.timeout_ms}ms`)}`;
         return f.description ? `${line}\n${muted(f.description)}` : line;
     });
+    // The callable address is the deliverable for API-only apps - name it here
+    // rather than leaving it to be inferred from a template comment.
+    if (!opts.json && res.data.length > 0) {
+        console.log(muted(`Endpoint: POST ${config.apiBase}/api/${config.projectGuid}/fn/<name>  (same on dev and prod; public path: gipity fn call <name> --anon)`));
+    }
 }));
 fnCommand
     .command('logs <name>')
@@ -29,8 +35,15 @@ fnCommand
     printList(res.data, opts, 'No execution logs.', log => {
         const dur = log.duration_ms != null ? `${log.duration_ms}ms` : '?';
         const ts = new Date(log.created_at).toLocaleString();
-        const statusColor = log.status === 'success' ? success : log.status === 'error' ? clrError : muted;
+        // The runtime writes 'ok' | 'error' | 'limit_exceeded' - never 'success'
+        // (same dead value already fixed in `logs fn`).
+        const statusColor = log.status === 'ok' ? success : log.status === 'error' ? clrError : muted;
         let line = `${statusColor(log.status)}  ${dur}  ${muted(log.trigger_type || 'http')}  ${muted(ts)}`;
+        // Platform service calls made inside the invocation (notify, email,
+        // LLM, ...) - per-call outcomes live in `gipity logs app --type services`.
+        const svcCalls = log.limits_consumed?.max_service_calls;
+        if (svcCalls)
+            line += `  ${muted(`svc:${svcCalls}`)}`;
         if (log.error_message)
             line += `\n${clrError(`error: ${log.error_message}`)}`;
         // Captured console.log/warn/error output for this invocation.
@@ -69,6 +82,16 @@ fnCommand
     const raw = bodyArg || opts.data || '{}';
     const body = JSON.parse(raw);
     const path = `/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`;
+    // Name the calling identity (stderr, so stdout stays parseable). Without
+    // this, a "test the anonymous path" call silently runs authenticated as
+    // the signed-in owner and the public path never gets exercised.
+    if (opts.anon) {
+        console.error(muted('Auth: anonymous visitor (the public path a signed-out user hits)'));
+    }
+    else {
+        const who = getAuth()?.email;
+        console.error(muted(`Auth: calling as ${who ?? 'your signed-in account'} (the owner persona; use --anon for the public visitor path)`));
+    }
     const res = opts.anon
         ? await callAnon(config.projectGuid, name, body)
         : await post(path, body);

package/dist/commands/init.js

@@ -4,7 +4,7 @@ import { existsSync, readFileSync } from 'fs';
 import { getAccountSlug } from '../api.js';
 import { getConfig, getConfigPath, saveConfigAt } from '../config.js';
 import { getAuth } from '../auth.js';
-import { slugify, setupClaudeHooks, setupGitignore, SUPPORTED_TOOLS, DEFAULT_TOOLS, DEFAULT_SYNC_IGNORE } from '../setup.js';
+import { slugify, setupProjectTools, SUPPORTED_TOOLS, DEFAULT_TOOLS, DEFAULT_SYNC_IGNORE } from '../setup.js';
 import { success, error as clrError, info, muted, bold } from '../colors.js';
 import { confirm } from '../utils.js';
 import { scanForAdoption, adoptCurrentDir, canAdoptCwd, formatBytes, formatCwdLabel, ADOPT_THRESHOLDS, } from '../adopt-cwd.js';
@@ -23,7 +23,7 @@ function resolveTools(forFlag) {
 }
 export const initCommand = new Command('init')
     .description('Link this directory to a project')
-    .addHelpText('after', '\nWrites CLAUDE.md/AGENTS.md primer files so your AI coding tool understands Gipity.')
+    .addHelpText('after', '\nWrites CLAUDE.md/AGENTS.md primer files so your AI coding tool understands Gipity, and installs the Gipity skills + file-sync hooks into the agent CLIs found on this machine (Claude Code, Codex, Grok).')
     .argument('[name]', 'Project name/slug (defaults to current directory name)')
     .option('--agent <guid>', 'Agent GUID to use')
     .option('--no-capture', 'Don\'t record Claude Code sessions in this directory to your Gipity project (sets captureHooks: false in .gipity.json)')
@@ -32,7 +32,8 @@ export const initCommand = new Command('init')
 Examples:
   $ gipity init                          Link cwd as a new project (slug = dir name).
   $ gipity init my-app                   Link cwd with an explicit slug.
-  $ gipity init --for codex              Write only AGENTS.md (skip Claude/Cursor/etc).
+  $ gipity init --for codex              AGENTS.md + Codex skills/sync hooks only.
+  $ gipity init --for grok               AGENTS.md + the Gipity plugin in Grok only.
   $ gipity init --for cursor,gemini      Write only the Cursor + Gemini primers.
   $ gipity init --for aider              AGENTS.md + a read: entry in .aider.conf.yml
                                          (aider auto-reads nothing, so it's opt-in).
@@ -57,10 +58,6 @@ Working with an existing Gipity project:
         process.exit(1);
     }
     const wantsClaude = tools.some(t => t.key === 'claude');
-    const writeAllPrimers = () => {
-        for (const t of tools)
-            t.setup();
-    };
     const primerSummary = tools.map(t => t.label).join(', ');
     try {
         // Check auth
@@ -77,12 +74,9 @@ Working with an existing Gipity project:
         if (existsSync(resolve(cwd, '.gipity.json'))) {
             const existing = getConfig();
             console.log(`Already linked to ${info(`"${existing?.projectSlug ?? ''}"`)} ${muted(`(${existing?.projectGuid ?? ''})`)}`);
-            // Re-run setup in case hooks/skills are missing. Claude Code hooks
-            // only matter when the Claude primer is being written.
-            if (wantsClaude)
-                setupClaudeHooks();
-            writeAllPrimers();
-            setupGitignore();
+            // Re-run setup in case primers/hooks/skills are missing - each tool's
+            // integration self-gates on its binary and current-version state.
+            setupProjectTools(tools);
             // The config's ignore list was frozen at link time, so a workstation
             // artifact introduced by a newer CLI (e.g. aider's .aider.conf.yml)
             // would sync up as project content. Union in the current defaults.
@@ -143,7 +137,7 @@ Working with an existing Gipity project:
             const sizeStr = scan.truncated ? `>${formatBytes(ADOPT_THRESHOLDS.REFUSE_BYTES)}` : formatBytes(scan.bytes);
             const fileStr = scan.truncated ? `>${ADOPT_THRESHOLDS.REFUSE_FILES}` : `${scan.files}`;
             console.error(clrError(`Directory has ${fileStr} files (${sizeStr}) - too large to adopt as a Gipity project.`));
-            console.error(muted('Move into a subdirectory, or use `gipity claude` and pick "Create new project".'));
+            console.error(muted('Move into a subdirectory, or use `gipity build` and pick "Create new project".'));
             process.exit(1);
         }
         if (scan.tier === 'moderate') {
@@ -183,7 +177,7 @@ Working with an existing Gipity project:
         }
         console.log(success(`Wrote primer files: ${primerSummary}.`));
         if (wantsClaude) {
-            console.log(success('Ready! Run `gipity claude` for Claude Code, or open this directory in your other AI coding tool.'));
+            console.log(success('Ready! Run your coding agent here (claude, codex, grok), or `gipity build` to launch one with a picker.'));
             // Recording happens by default (however Claude Code is launched), so
             // say so up front - consent should be explicit, not discovered later.
             if (opts.capture === false) {

package/dist/commands/logs.js

@@ -9,7 +9,20 @@ logsCommand
     .command('fn <name>')
     .description('Show function logs')
     .option('--limit <n>', 'Max entries', '20')
-    .option('--json', 'Output as JSON')
+    .option('--json', 'Output as JSON (top-level ARRAY of invocations, newest first)')
+    .addHelpText('after', `
+Each line: time, status (ok / error / limit_exceeded), duration, trigger, and
+svc:N when the invocation made N platform service calls (notify, email, LLM,
+image, ...). Captured console output is indented beneath its invocation.
+
+--json emits a top-level ARRAY (not an object) of invocation rows:
+  [{ id, status, duration_ms, trigger_type, error_message,
+     limits_consumed: { max_queries, max_service_calls, ... }, logs: [...], created_at }]
+
+To confirm an individual service call succeeded (and see provider, latency,
+and its own error message), use the per-call log instead:
+  $ gipity logs app --type services
+`)
     .action((name, opts) => run('Logs', async () => {
     const config = requireConfig();
     const limit = parseInt(opts.limit, 10) || 20;
@@ -32,8 +45,14 @@ logsCommand
         const statusColor = log.status === 'ok' ? success : log.status === 'error' ? clrError : warning;
         const status = statusColor(log.status.padEnd(8));
         const trigger = muted(log.trigger_type.padEnd(8));
+        // Service calls made inside the invocation (notify, email, LLM, ...) are
+        // otherwise invisible here - surface the count so "did my send happen?"
+        // doesn't require spelunking --json limits counters. Per-call outcomes
+        // live in `gipity logs app --type services`.
+        const svcCalls = log.limits_consumed?.max_service_calls;
+        const svc = svcCalls ? ` ${muted(`svc:${svcCalls}`)}` : '';
         const err = log.error_message ? `  ${clrError(`"${log.error_message}"`)}` : '';
-        console.log(`${muted(time)}  ${status} ${dur} ${trigger}${err}`);
+        console.log(`${muted(time)}  ${status} ${dur} ${trigger}${svc}${err}`);
         // Captured console.log/warn/error output for this invocation, indented
         // under its summary line. Empty for calls that printed nothing.
         for (const line of log.logs ?? []) {

package/dist/commands/page-eval.js

@@ -8,8 +8,10 @@ import { resolveProjectContext } from '../config.js';
 import { uploadPublicFixture, uploadCameraFeed, assertCameraFile, deleteFixture } from '../page-fixtures.js';
 // Shown when an eval runs cleanly but returns nothing serializable. Turns a
 // bare/opaque `null` into a deterministic, actionable nudge so the agent shapes
-// a returnable value instead of guessing and retrying.
-export const EVAL_NO_VALUE_HINT = 'The eval ran but returned no JSON-serializable value. A statement body with no `return`, an assignment, a void call, or a DOM node/function all serialize to null. ' +
+// a returnable value instead of guessing and retrying. (A body ending in a bare
+// expression is auto-returned SERVER-side before this can fire — so this is the
+// residue: block/loop endings, explicit undefined returns, DOM nodes, functions.)
+export const EVAL_NO_VALUE_HINT = 'The eval ran but returned no JSON-serializable value. A body ending in a loop/if-block, a `return` of undefined, or a DOM node/function all serialize to null. ' +
     'End the script with an expression — or an explicit `return` — that yields plain data, e.g. `return { label: input.value, count: items.length }` or `return JSON.stringify(payload)`.';
 /** Normalize a raw eval result for display. The eval can come back as a useful
  *  serialized value, the literal `null`/`undefined`/empty string, or — when the
@@ -272,7 +274,8 @@ export function slowRenderMessage(fps, o) {
     return `${warning('⚠ Slow render:')} page painted at ${fps} fps. `
         + `Waiting on real time (setTimeout) advances animation/physics time far slower than it looks — `
         + `assertions after a wall-clock wait can report a false negative. `
-        + `Step the app's own loop deterministically instead (3D templates: ${bold('core.advance(seconds)')}).`;
+        + `Step the app's own loop deterministically instead (3D templates: ${bold('core.advance(seconds)')}; `
+        + `2D/Phaser template: ${bold("(await import('./js/config.js')).advance(seconds)")}).`;
 }
 /** Poll the async eval job until it finishes. Eval runs server-side as a
  *  short-lived job (so a long --wait can't trip the gateway idle timeout);
@@ -346,7 +349,9 @@ export function evalExecTimeoutMessage(result, budgetMs) {
 // a trap, since --json is a real flag that changes output but still leaves the
 // script unset, sending the agent in a loop. Capture the common guesses as
 // hidden decoy options so the action can redirect to the positional arg exactly.
-const JS_DECOY_FLAGS = ['--js', '--javascript', '--script', '--code', '--expr', '--eval', '--exec'];
+// `--action` rides along: it's the sibling `page screenshot`'s spelling of
+// "run JS on the page", so an agent that learned it there guesses it here.
+const JS_DECOY_FLAGS = ['--js', '--javascript', '--script', '--code', '--expr', '--eval', '--exec', '--action'];
 // The long-tail escape hatch alongside `page inspect`'s fixed bundle: when the
 // curated metrics don't cover what you need (computed styles, element rects,
 // visibility, z-index stacks), eval an expression in page context and get the
@@ -360,7 +365,7 @@ const JS_DECOY_FLAGS = ['--js', '--javascript', '--script', '--code', '--expr',
 export const pageEvalCommand = new Command('eval')
     .description('Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead')
     .argument('<url>', 'URL to load')
-    .argument('[expr]', `JavaScript to evaluate in page context (inline expression or statement body with return/await; result is JSON-serialized). Omit when using --file. Time budget: the body has ${EVAL_SCRIPT_BUDGET_MS / 1000}s to finish after page load (${EVAL_SCRIPT_BUDGET_CAMERA_MS / 1000}s with --camera) - raise it with --timeout, max ${EVAL_SCRIPT_BUDGET_MAX_MS / 1000}s.`)
+    .argument('[expr]', `JavaScript to evaluate in page context (inline expression or statement body; await works, and the trailing expression is returned automatically — REPL-style — so no explicit return is needed; result is JSON-serialized). Omit when using --file. Time budget: the body has ${EVAL_SCRIPT_BUDGET_MS / 1000}s to finish after page load (${EVAL_SCRIPT_BUDGET_CAMERA_MS / 1000}s with --camera) - raise it with --timeout, max ${EVAL_SCRIPT_BUDGET_MAX_MS / 1000}s.`)
     .option('--file <path>', `Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work. Same post-load budget as <expr> (--timeout).`)
     .option('--step <expr>', `Run another expression against the SAME loaded page, after <expr> (repeat, max ${MAX_EVAL_STEPS}). Whatever that page load paid for — a vision model coming up, a game booting, a socket connecting — stays up for every step, so an N-part check costs ONE page load instead of N. Each step gets its own in-page budget and its own reported result.`, (val, prev) => [...prev, val], [])
     .option('--fixture <path>', 'Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. Repeat for several files (single-value so it never swallows the inline <expr>).', (val, prev) => [...prev, val], [])
@@ -372,7 +377,7 @@ export const pageEvalCommand = new Command('eval')
     .option('--wait-for <selector>', `Wait until this CSS selector appears before evaluating, then evaluate (deterministic - beats guessing a --wait). Gate on the state you are ASSERTING, not just a ready flag: '#verdict:not(:empty)' returns the instant the round lands, where a fixed wait snapshots mid-sequence. Same flag on page inspect/screenshot. Max ${WAIT_FOR_MAX_MS}ms (--wait-timeout).`)
     .option('--wait-timeout <ms>', `Max ms to wait for --wait-for before giving up (max ${WAIT_FOR_MAX_MS})`, '5000')
     .option('--timeout <ms>', `How long the script itself may run IN the page - its own await/setTimeout pauses count (default ${EVAL_SCRIPT_BUDGET_MS}, ${EVAL_SCRIPT_BUDGET_CAMERA_MS} with --camera/--fake-media; max ${EVAL_SCRIPT_BUDGET_MAX_MS}). Raise it to trace a sequence that unfolds over time (a game round, an animation). Distinct from --wait, which only sleeps BEFORE the script.`)
-    .option('--auth', 'Evaluate signed in as you (your Gipity account), so a page behind a Sign-in-with-Gipity login is reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.')
+    .option('--auth', 'Evaluate signed in as you (your Gipity account), so a page behind a Sign-in-with-Gipity login is reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor — nothing carries over from earlier --auth runs.')
     .option('--json', 'Output as JSON')
     .action((url, exprArg, opts) => run('Page eval', async () => {
     // A JS-intent flag guess (captured as a hidden decoy below): redirect to the
@@ -470,6 +475,9 @@ export const pageEvalCommand = new Command('eval')
     // cleaned up, without shifting the fixture map the caller indexes into.
     let camera;
     let projectGuid;
+    // Completion-value semantics (a body ending in a bare expression returns it,
+    // REPL-style) are applied SERVER-side to every leg — one source of truth for
+    // every caller; the CLI sends the script as written.
     let sentExpr = expr;
     let sentSteps = steps;
     // Validate the camera file locally first: a wrong file type should cost one
@@ -563,7 +571,10 @@ export const pageEvalCommand = new Command('eval')
             }));
             return;
         }
-        console.log(`${brand('Eval')} ${bold(d.url || url)}`);
+        // Context echo (which URL, which script) goes to stderr: the caller
+        // already knows what it sent, and keeping stdout = qualifiers + result
+        // means `2>/dev/null` (or any stdout capture) yields just the answer.
+        console.error(`${brand('Eval')} ${bold(d.url || url)}`);
         if (d.navigationIncomplete) {
             console.log(`${warning('⚠ Navigation incomplete:')} ${d.note || 'page did not reach full load'}`);
         }
@@ -574,19 +585,23 @@ export const pageEvalCommand = new Command('eval')
         if (d.slowRender) {
             console.log(slowRenderMessage(d.slowRender.fps, { camera: !!camera, waitMs }));
         }
-        // Auth state: without this line an agent can't distinguish "signed-in
-        // eval" from "--auth silently no-op'd against the anonymous page".
+        // Identity line on EVERY run: without it an agent can't distinguish
+        // "signed-in eval" from "--auth silently no-op'd against the anonymous
+        // page" — or, worse, assume an unflagged run carried a signed-in session.
         if (d.auth?.requested) {
             const who = getAuth()?.email;
             console.log(d.auth.established
                 ? `${muted('Auth:')} ${success('session established')}${who ? muted(` as ${who}`) : ''} ${muted('(what the page renders with it is app-defined)')}`
                 : `${warning('Auth: session NOT established')}${d.auth.detail ? ` — ${d.auth.detail}` : ''} ${muted('(this is the anonymous view)')}`);
         }
+        else {
+            console.log(muted('Auth: anonymous visitor (signed out; pass --auth to run as your Gipity account)'));
+        }
         if (camera)
             console.log(`${muted('Camera:')} ${camera.name} ${muted('(played as the webcam feed; getUserMedia resolves)')}`);
         if (hosted.length)
             console.log(`${muted('Fixtures:')} ${hosted.map((h) => h.name).join(', ')}`);
-        console.log(opts.file ? `${muted('Script:')} ${opts.file}` : `${muted('Expression:')} ${summarizeExpr(expr)}`);
+        console.error(opts.file ? `${muted('Script:')} ${opts.file}` : `${muted('Expression:')} ${summarizeExpr(expr)}`);
         console.log(`\n${result.trim() ? result : muted('(empty result)')}`);
         if (noValue)
             console.log(muted(`\n${EVAL_NO_VALUE_HINT}`));

package/dist/commands/page-inspect.js

@@ -43,7 +43,7 @@ export const pageInspectCommand = new Command('inspect')
     .option('--all', 'Include render-blocking, large resources, oversized images, overflow culprits, and LCP detail')
     .option('--no-fake-media', "Inspect with NO camera or microphone present, so a getUserMedia app takes its no-device error path (use this only when that fallback IS what you're inspecting)")
     .option('--device <name>', `Inspect as a real touch device: ${INSPECT_DEVICES.join(', ')}. Emulates touch events, mobile user-agent and DPR, so a touch-gated mobile layout is what gets inspected.`)
-    .option('--auth', 'Load the page signed in as you (your Gipity account), so pages behind a Sign-in-with-Gipity login are reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.')
+    .option('--auth', 'Load the page signed in as you (your Gipity account), so pages behind a Sign-in-with-Gipity login are reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor — nothing carries over from earlier --auth runs.')
     // Hidden redirect: agents reach for `page inspect --screenshot`. We don't take
     // an image here (`page screenshot` is the single path for that) — just point there.
     .addOption(new Option('--screenshot [path]', 'Capture a screenshot').hideHelp())
@@ -164,14 +164,18 @@ export async function inspectPage(url, opts = {}) {
     if (b.navigationIncomplete) {
         console.log(`${warning('⚠ Navigation incomplete:')} ${b.note || 'page did not reach full load'}`);
     }
-    // Auth state: without this line an agent can't distinguish "signed-in render"
-    // from "--auth silently no-op'd and I'm looking at the anonymous page".
+    // Identity line on EVERY run: without it an agent can't distinguish
+    // "signed-in render" from "--auth silently no-op'd and I'm looking at the
+    // anonymous page" — or assume an unflagged run carried a signed-in session.
     if (b.auth?.requested) {
         const who = getAuth()?.email;
         console.log(b.auth.established
             ? `${muted('Auth:')} ${success('session established')}${who ? muted(` as ${who}`) : ''} ${muted('(what the page renders with it is app-defined)')}`
             : `${warning('Auth: session NOT established')}${b.auth.detail ? ` — ${b.auth.detail}` : ''} ${muted('(this is the anonymous view)')}`);
     }
+    else {
+        console.log(muted('Auth: anonymous visitor (signed out; pass --auth to load as your Gipity account)'));
+    }
     console.log(`${muted('Title:')} ${b.title || '(none)'}`);
     console.log(`${muted('Elements:')} ${b.elementCount || 0}`);
     console.log(`${muted('Page weight:')} ${info(formatSize(b.totalBytes || 0))}`);