gipity 1.0.429 → 1.1.2

package/dist/commands/page-screenshot.js

@@ -30,12 +30,15 @@ function label(text) {
 function fmtMs(ms) {
     return ms >= 1000 ? `${(ms / 1000).toFixed(1)}s` : `${ms}ms`;
 }
-/** Auth state line (same format as page inspect/eval): without it an agent
- *  can't tell a signed-in capture from "--auth silently no-op'd and this is
- *  the anonymous page". */
+/** Identity line on EVERY capture (same format as page inspect/eval): without
+ *  it an agent can't tell a signed-in capture from "--auth silently no-op'd and
+ *  this is the anonymous page" — or assumes an unflagged capture carried a
+ *  signed-in session. */
 function printAuthLine(auth) {
-    if (!auth?.requested)
+    if (!auth?.requested) {
+        console.log(`${label('Auth')} ${muted('anonymous visitor (signed out; pass --auth to capture as your Gipity account)')}`);
         return;
+    }
     const who = getAuth()?.email;
     console.log(auth.established
         ? `${label('Auth')} ${success('session established')}${who ? muted(` as ${who}`) : ''} ${muted('(what the page renders with it is app-defined)')}`
@@ -176,10 +179,13 @@ function appendOption(value, previous = []) {
     return [...previous, value];
 }
 // Pre-capture scripting lives on --action, but agents reach for the JS-intent
-// names first and an "unknown option" alone doesn't name the right flag. Capture
-// the common guesses as hidden decoys (taking a value, so they swallow the
-// script) and redirect precisely — same pattern as `page eval`'s JS_DECOY_FLAGS.
-const ACTION_DECOY_FLAGS = ['--eval', '--js', '--javascript', '--script', '--code', '--exec'];
+// names first — --eval above all, the name they already know from `page eval`.
+// The intent is unambiguous (run this JS in the page before the shot), so these
+// are working hidden aliases, not errors — same accept-the-reflex-guess pattern
+// as --full-page and --width/--height. (Supersedes the earlier decoy approach,
+// which swallowed the script and errored with a redirect: when the guess is
+// unambiguous, making it WORK beats making it a better error.)
+const ACTION_ALIAS_FLAGS = ['--eval', '--js', '--javascript', '--script', '--code', '--exec'];
 /** A capture is worthless if it fires before the app reaches the state you meant
  *  to photograph, and the only lever used to be a blind millisecond delay — so a
  *  camera/vision app got screenshotted with a guessed duration (`--wait 22000`).
@@ -216,6 +222,12 @@ export const CAMERA_DEFAULT_DELAY_MS = 15_000;
 export const pageScreenshotCommand = new Command('screenshot')
     .description('Screenshot a web page')
     .argument('<url>', 'URL to screenshot')
+    // --device / --viewport lead the options: "how does this look on a phone?" is
+    // the single most common reason to screenshot, and agents routinely read the
+    // help through `--help | head -N` — buried below the timing flags, these two
+    // fell off the bottom and the run proceeded at desktop width.
+    .option('--device <names>', `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(', ')} (comma-separated or repeat flag). mobile/tablet emulate a real touch device — touch events, mobile user-agent, DPR — so touch-gated mobile UI actually renders.`, appendOption, [])
+    .option('--viewport <dims>', 'Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag), e.g. --viewport 390x844 for a phone-sized window', appendOption, [])
     // No commander default: a default here would make the value always set, so the
     // merge below could not tell "caller chose a delay" from "nobody did" — which
     // is what --camera's model-load default and the --wait-for gate both hinge on.
@@ -225,27 +237,35 @@ export const pageScreenshotCommand = new Command('screenshot')
     .option('--action <js>', 'Run JS in the page before capturing — e.g. click a button to enter a state ("document.getElementById(\'play\').click()"). Runs as an async function body, so const/await and app-relative import(\'./…\') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.')
     .option('--full', 'Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.')
     .option('-o, --output <file>', 'Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)')
-    .option('--device <names>', `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(', ')} (comma-separated or repeat flag). mobile/tablet emulate a real touch device — touch events, mobile user-agent, DPR — so touch-gated mobile UI actually renders.`, appendOption, [])
-    .option('--viewport <dims>', 'Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag)', appendOption, [])
     .option('--no-reload-between', 'Skip reload between viewports (faster, lower fidelity - only safe for static pages)')
     .option('--fake-media', 'Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps render headlessly. The video feed is a built-in test pattern — to capture what the app does with a REAL frame (a hand, a face, an object), use --camera <path> instead.')
     .option('--camera <path>', 'Play a local image or video (.png/.jpg/.webp/.mp4/.webm/.y4m/.mjpeg) as the browser\'s WEBCAM feed, then capture — so the shot shows the app reacting to a frame you chose (detected gesture, boxes, labels). Implies --fake-media.')
-    .option('--auth', 'Capture the page signed in as you (your Gipity account), so UI behind a Sign-in-with-Gipity login is shown. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai.')
+    .option('--auth', 'Capture the page signed in as you (your Gipity account), so UI behind a Sign-in-with-Gipity login is shown. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor — nothing carries over from earlier --auth runs.')
     .option('--ephemeral', 'Skip the project screenshot history: do not persist this capture to Gipity (screenshots/ in the project). Local file is still written.')
     .option('--json', 'Output JSON metadata instead of a friendly summary')
     .addOption(new Option('--post-load-delay <ms>', 'Alias for --wait').hideHelp())
+    // (--eval and the other JS-intent guesses are registered in one place from
+    // ACTION_ALIAS_FLAGS below — a second standalone registration here makes
+    // commander throw "conflicting flag" at startup.)
     // `--full-page` is the Puppeteer/Playwright name for this (their `fullPage`),
     // so agents reach for it by reflex. Accept it as a hidden alias for `--full`
     // rather than reject it as an unknown option and send them on a --help detour.
     .addOption(new Option('--full-page', 'Alias for --full').hideHelp())
+    // `--width 390 --height 844` is the setViewport vocabulary agents guess first
+    // when asked for a phone-sized shot. Accept the pair as a working alias for
+    // --viewport WxH instead of bouncing the guess into a --help detour.
+    .addOption(new Option('--width <px>', 'Alias: --viewport WxH').hideHelp())
+    .addOption(new Option('--height <px>', 'Alias: --viewport WxH').hideHelp())
     .action((url, opts) => run('Page screenshot', async () => {
-    // A JS-intent flag guess (captured as a hidden decoy below): name the real
-    // flag before any other arg-shape check fires.
-    const decoy = ACTION_DECOY_FLAGS.find((f) => opts[f.slice(2)] !== undefined);
-    if (decoy) {
-        pageScreenshotCommand.error(`error: ${decoy} is not a flag on screenshot — use --action "<js>" to run JavaScript in the page ` +
-            `before the capture, e.g. gipity page screenshot "<url>" --action "document.getElementById('play').click()"`);
+    // A JS-intent alias guess (--eval et al., hidden): fold it into the action
+    // script so the reflex guess just works, and name the canonical flag once
+    // so the next call uses it.
+    const aliasFlag = ACTION_ALIAS_FLAGS.find((f) => opts[f.slice(2)] !== undefined);
+    if (aliasFlag) {
+        console.error(muted(`Note: treating ${aliasFlag} as --action — it runs your JS in the page before the capture. --action is the canonical flag.`));
     }
+    const actionScript = [opts.action, ...ACTION_ALIAS_FLAGS.map((f) => opts[f.slice(2)])]
+        .filter(Boolean).join('\n');
     // --wait is the canonical name (it is what `page inspect`/`page eval` call it);
     // --post-load-delay stays as a hidden alias. Whether the caller named EITHER is
     // what decides the defaults below, so keep the raw "was it set" signal.
@@ -284,6 +304,24 @@ export const pageScreenshotCommand = new Command('screenshot')
     }
     const deviceNames = splitCsv(opts.device);
     const viewportStrs = splitCsv(opts.viewport);
+    // --width/--height: fold the alias pair into a --viewport entry. Half a
+    // pair is a mis-invocation worth one precise line, not a range error.
+    if (opts.width !== undefined || opts.height !== undefined) {
+        if (opts.width === undefined || opts.height === undefined) {
+            pageScreenshotCommand.error('error: --width and --height go together (both in px, equivalent to --viewport WxH) — ' +
+                'or use a preset like --device mobile for a real handset (touch events, mobile user-agent, DPR)');
+        }
+        if (!/^\d+$/.test(String(opts.width)) || !/^\d+$/.test(String(opts.height))) {
+            pageScreenshotCommand.error('error: --width and --height must be integers (px)');
+        }
+        viewportStrs.push(`${opts.width}x${opts.height}`);
+        // A raw phone-sized window is NOT a phone: touch-gated mobile UI still
+        // renders its desktop variant. Say so once, on the path where the caller
+        // was clearly after a phone.
+        if (parseInt(String(opts.width), 10) <= 500) {
+            console.error(muted('Tip: --device mobile emulates a real handset (touch events, mobile user-agent, DPR) — a raw viewport only resizes the window.'));
+        }
+    }
     const customViewports = [
         ...deviceNames.map(resolveDevice),
         ...viewportStrs.map(parseViewportString),
@@ -318,11 +356,12 @@ export const pageScreenshotCommand = new Command('screenshot')
     }
     // The pre-capture script the server runs after the post-load delay: the
     // --wait-for gate first (so the shot waits for the state, deterministically),
-    // then the caller's --action. Both are the same in-page primitive, so they
+    // then the caller's --action (with any alias-flag scripts folded in by
+    // actionScript above). All the same in-page primitive, so they
     // compose into one script rather than needing a second server round-trip.
     const preCapture = [
         opts.waitFor ? buildWaitForGate(opts.waitFor, waitForTimeoutMs) : '',
-        opts.action ?? '',
+        actionScript,
     ].filter(Boolean).join('\n');
     const body = {
         url,
@@ -476,10 +515,10 @@ export const pageScreenshotCommand = new Command('screenshot')
         printVfsLine(s);
     }
 }));
-// Register the JS-intent guesses as hidden decoys (value-taking, so they swallow
-// the script) — the action turns any of them into the "--action" redirect above.
-for (const f of ACTION_DECOY_FLAGS)
-    pageScreenshotCommand.addOption(new Option(`${f} <value>`).hideHelp());
+// Register the JS-intent guesses as hidden aliases for --action (value-taking,
+// so they capture the script) — the action folds them into the pre-capture body.
+for (const f of ACTION_ALIAS_FLAGS)
+    pageScreenshotCommand.addOption(new Option(`${f} <js>`, 'Alias for --action').hideHelp());
 // `screenshot` captures the page AFTER load + settle (+ optional --wait-for gate
 // and --action). There is no scroll-to-a-position lever (agents reach for
 // --scroll and get an unknown-option detour) — but `--full` does walk the page

package/dist/commands/project.js

@@ -134,7 +134,7 @@ projectCommand
         console.log(`${muted('Next:')} switch to "${project.name}" in the sidebar.`);
     }
     else {
-        console.log(`${muted('Next:')} exit Claude (Ctrl+D), then run:  ${brand('gipity claude')}`);
+        console.log(`${muted('Next:')} exit Claude (Ctrl+D), then run:  ${brand('gipity build')}`);
         console.log(`${muted('Pick')} "${project.name}" ${muted(`- it'll be at the top of the list.`)}`);
     }
 }));

package/dist/commands/relay-install.js

@@ -6,7 +6,7 @@ import { installAutostart, removeAutostart, resolveCliPath } from '../relay/setu
 function requirePaired() {
     const device = state.getDevice();
     if (!device) {
-        console.error(`${clrError('No paired device.')} Run ${bold('gipity claude')} to pair this machine.`);
+        console.error(`${clrError('No paired device.')} Run ${bold('gipity connect')} to pair this machine.`);
         process.exit(1);
     }
     return device;

package/dist/commands/relay.js

@@ -29,7 +29,7 @@ relayCommand
     .option('--name <name>', 'Device name shown in the web CLI (default: this machine\'s hostname)')
     .option('--no-start', 'Pair only; do not start the relay daemon now')
     .option('--no-autostart', 'Skip the OS login service (use when a supervising app owns the daemon)')
-    .option('--force', 'Re-pair even if already paired (revokes the old device first)')
+    .option('--force', 'Re-pair even if already paired (re-registers this machine, rotating its token)')
     .option('--json', 'Machine-readable output')
     .action(async (opts) => {
     const fail = (code, message) => {
@@ -121,7 +121,7 @@ relayCommand
         return;
     }
     if (!s.device) {
-        console.log(`${muted('No paired device.')} Run ${brand('gipity claude')} to pair this machine.`);
+        console.log(`${muted('No paired device.')} Run ${brand('gipity connect')} to pair this machine.`);
         return;
     }
     console.log(`${bold('Device:')}      ${brand(s.device.name)} ${muted(`(${s.device.guid})`)}`);
@@ -380,7 +380,7 @@ registerInstallCommands(relayCommand);
 function requirePaired() {
     const device = state.getDevice();
     if (!device) {
-        console.error(`${clrError('No paired device.')} Run ${brand('gipity claude')} to pair this machine.`);
+        console.error(`${clrError('No paired device.')} Run ${brand('gipity connect')} to pair this machine.`);
         process.exit(1);
     }
     return device;

package/dist/commands/sandbox.js

@@ -1,6 +1,6 @@
-import { Command } from 'commander';
-import { readFileSync, existsSync, statSync } from 'fs';
-import { dirname, extname, relative, resolve } from 'path';
+import { Command, Option } from 'commander';
+import { readFileSync, existsSync, statSync, mkdirSync, writeFileSync } from 'fs';
+import { dirname, extname, relative, resolve, sep } from 'path';
 import { post } from '../api.js';
 import { resolveProjectContext, getConfigPath, getProjectRoot, shouldIgnore } from '../config.js';
 import { SCRATCH_IGNORE } from '../setup.js';
@@ -167,19 +167,28 @@ sandboxCommand
     // an interpreter token, or a --file extension - see resolveLanguage().
     .option('--language <language>', 'Language: js, py, or bash (required unless pinned by an interpreter token or --file extension)')
     .option('--file <path>', 'Read the code body from a file instead of the inline <code> arg; --language is inferred from the extension when not given')
+    // `--code "<code>"` is the natural first guess for passing inline code (the
+    // positional arg is the canonical spelling). Accept it as a working alias
+    // rather than bouncing the guess into an unknown-option --help detour.
+    .addOption(new Option('--code <code>', 'Alias for the positional inline <code> arg').hideHelp())
     .option('--timeout <seconds>', 'Execution timeout in seconds', '30')
     .option('--input <path>', 'Narrow to specific project files instead of auto-mirroring the whole tree (repeatable). Use this only for >1 GB projects or when you want surgical control.', (v, prev) => [...(prev ?? []), v])
-    // Commander maps a `--no-` prefixed flag to the un-prefixed camelCase name
-    // (`opts.syncOutput`); the explicit `[]` default stops commander's negated-
-    // boolean convention from defaulting it to `true`. Collected as an array so
-    // the flag is repeatable.
-    .option('--no-sync-output <glob>', 'Do not persist run outputs matching this glob back to the project (repeatable). For byproducts you want to inspect once but never keep, e.g. --no-sync-output "docs/preview*". Supports *, **, and dir/ prefixes.', (v, prev) => [...prev, v], [])
+    // Named "discard", not "no-sync": in Gipity vocabulary "sync" means the
+    // local<->cloud file sync, so a no-sync spelling reads as "give me the file
+    // locally, just don't sync it" - which is the tmp/ scratch path below, not
+    // this flag. Collected as an array so the flag is repeatable.
+    .option('--discard-output <glob>', 'Discard run outputs matching this glob entirely - not saved, not returned (repeatable). To LOOK at an output without keeping it, write it under tmp/ instead: scratch outputs land on local disk only and never enter the project. Supports *, **, and dir/ prefixes.', (v, prev) => [...prev, v], [])
     .option('--json', 'Output as JSON')
     .addHelpText('after', `
 By default the whole project is auto-mirrored into /work/ (up to 1 GB) -
 so your code can reference project files by their relative path, and any
 file you write lands back in the project. No manual copy needed.
 
+Exception: tmp/ is scratch. An output written under tmp/ comes back to
+your local tmp/ for inspection but is never saved to the project - use it
+for previews and other look-once artifacts (no cleanup needed). To drop
+an output entirely, --discard-output <glob>.
+
 Use --input only for projects over the auto-mirror cap, or when you want
 to restrict what the sandbox sees.
 
@@ -196,6 +205,11 @@ Examples:
   $ gipity sandbox run --language python \\
       "import pandas as pd; print(pd.read_csv('data/sales.csv').describe())"
 
+  # Preview a generated PDF without saving the preview: write it to tmp/
+  $ gipity sandbox run bash \\
+      "pdftoppm -png -r 90 docs/report.pdf tmp/preview"
+  # -> tmp/preview-1.png lands on local disk only; Read it, done.
+
   # Run a script file directly (language inferred from .py)
   $ gipity sandbox run --file build_report.py
   $ gipity sandbox run python build_report.py   # same thing, interpreter shorthand
@@ -228,6 +242,14 @@ GCC/Rust).
     let inlineCode;
     let filePath = opts.file;
     let langFromInterp;
+    // --code alias: fold it into the positional slot before the shape checks.
+    if (opts.code !== undefined) {
+        if (args.length) {
+            console.error(clrError('Pass the code once: either positionally or via --code, not both'));
+            process.exit(1);
+        }
+        args = [opts.code];
+    }
     if (args.length >= 2 && INTERPRETERS[args[0].toLowerCase()] !== undefined) {
         langFromInterp = INTERPRETERS[args[0].toLowerCase()];
         const rest = args.slice(1).join(' ');
@@ -268,11 +290,11 @@ GCC/Rust).
     // This runs BEFORE the project sync and the server round trip below, so a
     // missing language costs nothing but the message.
     const language = resolveLanguage({ langFromInterp, langOpt: opts.language, filePath, inlineCode });
-    // Validate --no-sync-output globs while we're still pre-network: an empty
+    // Validate --discard-output globs while we're still pre-network: an empty
     // pattern (e.g. a quoting mishap) would silently match nothing server-side.
-    const noSyncOutput = opts.syncOutput ?? [];
-    if (noSyncOutput.some((g) => !g.trim())) {
-        console.error(clrError('--no-sync-output requires a non-empty glob (e.g. --no-sync-output "docs/preview*")'));
+    const discardOutput = opts.discardOutput ?? [];
+    if (discardOutput.some((g) => !g.trim())) {
+        console.error(clrError('--discard-output requires a non-empty glob (e.g. --discard-output "*.ppm")'));
         process.exit(1);
     }
     // Args are good - now it's worth resolving (and announcing) the project.
@@ -311,8 +333,9 @@ GCC/Rust).
         cwd,
         // The filter must run SERVER-side (in the output extractor): skipping
         // only in the CLI would still write the files into project storage and
-        // make every later sync propose deleting them.
-        noSyncOutput: noSyncOutput.length ? noSyncOutput : undefined,
+        // make every later sync propose deleting them. (`noSyncOutput` is the
+        // wire name for --discard-output.)
+        noSyncOutput: discardOutput.length ? discardOutput : undefined,
     });
     const res = opts.json
         ? await doRun()
@@ -326,8 +349,26 @@ GCC/Rust).
     if (pulledLocal) {
         await sync({ interactive: false, progress: opts.json ? undefined : createProgressReporter() });
     }
+    // Scratch outputs (tmp/ and friends) never enter the project: the server
+    // returns their bytes inline instead of persisting them, and we land them
+    // here. The scratch namespace is ignored by sync in both directions, so
+    // the file exists on local disk only - inspect it, no cleanup required.
+    const scratchWritten = [];
+    if (res.data.scratchFiles?.length) {
+        const base = resolve(getProjectRoot() ?? process.cwd());
+        for (const f of res.data.scratchFiles) {
+            const rel = f.path.replace(/\\/g, '/');
+            const abs = resolve(base, rel);
+            if (abs !== base && !abs.startsWith(base + sep))
+                continue; // traversal guard
+            mkdirSync(dirname(abs), { recursive: true });
+            writeFileSync(abs, Buffer.from(f.contentBase64, 'base64'));
+            scratchWritten.push(rel);
+        }
+    }
     if (opts.json) {
-        console.log(JSON.stringify({ ...res.data, filesSynced: pulledLocal }));
+        const { scratchFiles: _omit, ...rest } = res.data;
+        console.log(JSON.stringify({ ...rest, scratchFiles: scratchWritten, filesSynced: pulledLocal }));
     }
     else {
         if (res.data.autoMirrorSkipped) {
@@ -367,8 +408,13 @@ GCC/Rust).
                     console.log(dim("Not pulled locally - run 'gipity sync' to fetch them."));
             }
         }
+        if (scratchWritten.length > 0) {
+            console.log('\nScratch outputs (local only - never synced or deployed):');
+            for (const f of scratchWritten)
+                console.log(`${f}`);
+        }
         if (res.data.skippedOutputFiles && res.data.skippedOutputFiles.length > 0) {
-            console.log(dim('\nNot persisted (--no-sync-output):'));
+            console.log(dim('\nDiscarded (--discard-output):'));
             for (const f of res.data.skippedOutputFiles)
                 console.log(dim(`${f}`));
         }

package/dist/commands/setup.js

@@ -1,12 +1,17 @@
 /**
- * `gipity setup` — get this computer ready as a relay, then stop.
+ * `gipity connect` — connect this computer to gipity.ai, then stop.
  *
- * Runs the SAME first steps as `gipity claude` (log in, then pair + start the
+ * Runs the SAME first steps as `gipity build` (log in, then pair + start the
  * relay + install the OS login service) but does NOT pick a project or launch
- * Claude Code. For the user who wants their machine available as a relay in the
- * web CLI without being dropped into a coding session.
+ * an agent. For the user who wants their machine drivable from the web CLI
+ * without being dropped into a coding session.
  *
- * Shares one implementation with `gipity claude`: auth via `login-flow.ts`,
+ * Named `connect` because "setup" and "init" are synonyms in plain English -
+ * the machine-scoped verb needed its own word (and it matches `gipity
+ * payments connect`). `setup` stays as a hidden alias for muscle memory and
+ * old docs.
+ *
+ * Shares one implementation with `gipity build`: auth via `login-flow.ts`,
  * relay setup via `relay/onboarding.ts` (`runRelaySetup`). Nothing to maintain
  * twice.
  */
@@ -16,12 +21,13 @@ import { interactiveLogin } from '../login-flow.js';
 import { runRelaySetup } from '../relay/onboarding.js';
 import * as relayState from '../relay/state.js';
 import { bold, brand, success, muted, error as clrError } from '../colors.js';
-export const setupCommand = new Command('setup')
-    .description('Set up this computer as a relay (no project, no launch)')
+export const connectCommand = new Command('connect')
+    .alias('setup') // legacy name, kept working but not advertised
+    .description('Connect this computer to gipity.ai so the web CLI can drive it (no project, no launch)')
     .action(async () => {
     try {
         // Leading blank comes from the central output frame (installOutputFrame).
-        console.log(`  ${bold('Gipity setup')} ${muted('- get this computer ready as a relay')}`);
+        console.log(`  ${bold('Gipity connect')} ${muted('- let gipity.ai drive this computer')}`);
         console.log('');
         // ── Step 1: Auth ──────────────────────────────────────────────────
         let auth = getAuth();
@@ -44,10 +50,10 @@ export const setupCommand = new Command('setup')
         if (enabled) {
             const running = relayState.isRelayEnabled() && !relayState.isPaused();
             console.log(`  ${success('Done')} — your relay ${running ? 'is running in the background' : 'is set up'} and will start with your computer.`);
-            console.log(`  ${muted('Open')} ${brand('gipity.ai')} ${muted('and start a chat to drive Claude Code here. Manage it with `gipity relay status`.')}`);
+            console.log(`  ${muted('Open')} ${brand('gipity.ai')} ${muted('and start a chat to drive your coding agent here. Manage it with `gipity relay status`.')}`);
         }
         else {
-            console.log(`  ${muted('No relay set up. Run `gipity setup` again anytime, or `gipity claude` to build with Gipity.')}`);
+            console.log(`  ${muted('No relay set up. Run `gipity connect` again anytime, or `gipity build` to start building.')}`);
         }
         console.log('');
     }

package/dist/commands/status.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync } from 'fs';
 import { join, resolve } from 'path';
 import { homedir } from 'os';
 import { getAuth, sessionExpired } from '../auth.js';
+import { get, usingEnvToken, ApiError } from '../api.js';
 import { getConfig, liveUrl } from '../config.js';
 import { brand, success, warning, muted, error as clrError } from '../colors.js';
 import { GIPITY_PLUGIN_ID, GIPITY_MARKETPLACE_NAME, setupClaudeHooks, ensureGipityPlugin, ensureGipityPluginInstalled, userScopeInstallState } from '../setup.js';
@@ -38,6 +39,17 @@ function checkGipityPlugin() {
     const stale = missing.length === 1 && missing[0] === 'install' && install.exists;
     return { missing, ok: missing.length === 0, stale };
 }
+async function probeAuth(loggedIn) {
+    if (!loggedIn && !usingEnvToken())
+        return 'none';
+    if (!usingEnvToken() && sessionExpired())
+        return 'expired';
+    // Cap the probe well below the API layer's 60s request timeout - status is
+    // a diagnostic command and must answer fast even when the network is dark.
+    const timeout = new Promise(res => setTimeout(() => res('unreachable'), 5000).unref?.());
+    const call = get('/users/me').then(() => 'ok', (err) => (err instanceof ApiError && err.statusCode === 401 ? 'rejected' : 'unreachable'));
+    return Promise.race([call, timeout]);
+}
 // `whoami` is the name agents reach for first when they want the signed-in
 // identity (it's the unix spelling), and this is the command that prints it.
 // Aliasing costs one line and turns a guess into a hit.
@@ -58,6 +70,7 @@ export const statusCommand = new Command('status')
     // now go out. Skipped entirely (existsSync short-circuit) when the queue
     // is empty, which is the common case, so this stays a no-op most runs.
     const queueDelivered = (auth && !sessionExpired()) ? await flushBugQueue().catch(() => 0) : 0;
+    const probe = await probeAuth(!!auth);
     if (opts.json) {
         console.log(JSON.stringify({
             project: config ? {
@@ -69,9 +82,13 @@ export const statusCommand = new Command('status')
             } : null,
             // `valid` reflects the refresh token (the real session) - access
             // tokens auto-renew, so their expiry must not read as "invalid".
-            auth: auth ? {
-                email: auth.email,
-                valid: !sessionExpired(),
+            // `probe` is what one live call just proved: 'rejected' means every
+            // authenticated command will fail even though `valid` reads true.
+            auth: (auth || usingEnvToken()) ? {
+                email: auth?.email,
+                source: usingEnvToken() ? 'agent-token' : 'session',
+                valid: usingEnvToken() ? probe !== 'rejected' : !sessionExpired(),
+                probe,
             } : null,
             plugin: hookCheck,
         }, null, 2));
@@ -88,14 +105,25 @@ export const statusCommand = new Command('status')
         if (config.agentGuid)
             console.log(`${muted('Agent:')} ${config.agentGuid}`);
     }
-    if (!auth) {
+    if (usingEnvToken()) {
+        console.log(`${muted('Auth:')} ${probe === 'rejected'
+            ? warning('agent API token (GIPITY_TOKEN) rejected by the server — mint a new one: gipity skill read agent-deploy')
+            : success('agent API token (GIPITY_TOKEN)')}${probe === 'unreachable' ? ` ${muted('(unverified — API unreachable)')}` : ''}`);
+    }
+    else if (!auth) {
         console.log(`${muted('Auth:')} ${warning('not logged in. Run: gipity login')}`);
     }
-    else if (sessionExpired()) {
-        console.log(`${muted('Auth:')} ${warning(`session expired for ${auth.email}. Run: gipity login`)}`);
+    else if (probe === 'expired') {
+        console.log(`${muted('Auth:')} ${warning(`session expired for ${auth.email}. Run: gipity login (headless/CI: set GIPITY_TOKEN — gipity skill read agent-deploy)`)}`);
+    }
+    else if (probe === 'rejected') {
+        // Locally fresh but the server says no (refresh token rotated away or
+        // revoked). Without the live probe this printed a green identity while
+        // every authenticated command failed.
+        console.log(`${muted('Auth:')} ${warning(`session for ${auth.email} was rejected by the server. Run: gipity login (headless/CI: set GIPITY_TOKEN — gipity skill read agent-deploy)`)}`);
     }
     else {
-        console.log(`${muted('Auth:')} ${success(auth.email)}`);
+        console.log(`${muted('Auth:')} ${success(auth.email)}${probe === 'unreachable' ? ` ${muted('(unverified — API unreachable)')}` : ''}`);
     }
     if (queueDelivered > 0) {
         console.log(`${muted('Bug queue:')} ${success(`delivered ${queueDelivered} queued bug report${queueDelivered === 1 ? '' : 's'}`)}`);

package/dist/commands/test.js

@@ -206,6 +206,13 @@ export const testCommand = new Command('test')
         console.log(clrError(`Run failed: ${data.errorMessage}`));
         console.log('');
     }
+    // What the isolated test DB reset did (tables truncated, test.preserve
+    // list, seeds re-applied) - so "expected N rows, got 0" reads as "the
+    // reset truncated that table", not as a mystery.
+    if (data.dbSummary) {
+        console.log(muted(`Test db: ${data.dbSummary}`));
+        console.log('');
+    }
     // Failures recap. Results stream incrementally above, but agents usually
     // read this output through a `tail` window, so anything printed early is
     // lost - restate every failure (name + assertion message) right before

package/dist/commands/uninstall.js

@@ -12,14 +12,14 @@ import { Command } from 'commander';
 import { existsSync, rmSync, unlinkSync, readFileSync, writeFileSync } from 'fs';
 import { homedir, platform as osPlatform } from 'os';
 import { join, resolve } from 'path';
-import { spawnSyncCommand } from '../platform.js';
+import { spawnSyncCommand, resolveCommand } from '../platform.js';
 import { post } from '../api.js';
 import { getAuth } from '../auth.js';
 import { confirm, getAutoConfirm } from '../utils.js';
 import { bold, brand, dim, success, error as clrError, muted } from '../colors.js';
 import * as relayState from '../relay/state.js';
 import { planFor, UnsupportedPlatformError } from '../relay/installers.js';
-import { GIPITY_PLUGIN_ID, GIPITY_MARKETPLACE_NAME, stripGipityHooks } from '../setup.js';
+import { GIPITY_PLUGIN_ID, GIPITY_MARKETPLACE_NAME, stripGipityHooks, grokInstallState, agentSkillsState, AGENTS_SKILLS_DIR } from '../setup.js';
 /** Remove Gipity's entries from the user-scope Claude Code settings: the
  *  plugin enablement, the marketplace registration, and any legacy hook
  *  blocks older CLI versions wrote there. Surgical - everything else in the
@@ -219,7 +219,29 @@ export const uninstallCommand = new Command('uninstall')
     else {
         console.log(`${muted('No Gipity entries in Claude Code settings.')}`);
     }
-    // 5. Wipe ~/.gipity/.
+    // 4b. Uninstall the Gipity plugin from Grok Build and remove the skills
+    //     the CLI copied into the cross-agent ~/.agents/skills dir for Codex.
+    //     Both best-effort: neither existing is the common case.
+    if (grokInstallState().exists) {
+        spawnSyncCommand(resolveCommand('grok'), ['plugin', 'uninstall', 'gipity', '--confirm'], {
+            stdio: 'ignore',
+            timeout: 60_000,
+        });
+        console.log(`${success('Gipity plugin removed from Grok.')}`);
+    }
+    const agentSkills = agentSkillsState();
+    if (agentSkills.skills.length) {
+        for (const name of agentSkills.skills) {
+            // Only names our manifest recorded - never someone else's skills.
+            try {
+                rmSync(join(AGENTS_SKILLS_DIR, name), { recursive: true, force: true });
+            }
+            catch { /* best-effort */ }
+        }
+        console.log(`${success(`Removed ${agentSkills.skills.length} Gipity skills from ~/.agents/skills.`)}`);
+    }
+    // 5. Wipe ~/.gipity/ (this also removes the agent-hooks scripts and the
+    //    agent-skills manifest, which live under it).
     if (existsSync(gipityDir)) {
         try {
             rmSync(gipityDir, { recursive: true, force: true });

package/dist/flag-aliases.js

@@ -28,6 +28,7 @@ export const FLAG_ALIASES = {
     '--src': '--source-dir',
     '--srcdir': '--source-dir',
     '--parallel': '--concurrency',
+    '--no-sync-output': '--discard-output',
     '--max': '--limit',
     '--from': '--since',
     '--after': '--since',