gipity 1.1.3 → 1.1.5

package/dist/index.js

@@ -3929,6 +3929,41 @@ var init_colors = __esm({
 
 // src/utils.ts
 import { createInterface } from "readline";
+import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+function isWsl() {
+  if (process.platform !== "linux") return false;
+  if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) return true;
+  try {
+    return /microsoft/i.test(readFileSync("/proc/version", "utf-8"));
+  } catch {
+    return false;
+  }
+}
+function findWindowsTwinProject(projectRoot, usersBase = "/mnt/c/Users") {
+  try {
+    const name = basename(projectRoot);
+    if (!name) return null;
+    const realRoot = realpathSync(projectRoot);
+    for (const user of readdirSync(usersBase)) {
+      if (WINDOWS_PSEUDO_USERS.has(user)) continue;
+      const candidate = join(usersBase, user, "GipityProjects", name);
+      try {
+        if (!statSync(candidate).isDirectory()) continue;
+        if (realpathSync(candidate) === realRoot) continue;
+        return candidate;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function wslPathToWindows(p) {
+  const m = p.match(/^\/mnt\/([a-z])\/(.*)$/);
+  if (!m) return p;
+  return `${m[1].toUpperCase()}:\\${m[2].replace(/\//g, "\\")}`;
+}
 function decodeJwtExp(token) {
   try {
     const parts = token.split(".");
@@ -3944,10 +3979,10 @@ function prompt(question) {
     return Promise.reject(new Error(`prompt() called without a TTY: ${question.trim()}`));
   }
   const rl2 = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve20) => {
+  return new Promise((resolve19) => {
     rl2.question(question, (answer) => {
       rl2.close();
-      resolve20(answer.trim());
+      resolve19(answer.trim());
     });
   });
 }
@@ -3972,12 +4007,12 @@ async function confirm(question, opts = {}) {
     return false;
   }
   const hint = defaultYes ? dim("[Y/n]") : dim("[y/N]");
-  process.stdout.write(`${question} ${hint} `);
+  process.stdout.write(`${question} ${hint}: `);
   const { stdin } = process;
   const wasRaw = stdin.isRaw ?? false;
   stdin.setRawMode(true);
   stdin.resume();
-  return new Promise((resolve20) => {
+  return new Promise((resolve19) => {
     stdin.once("data", (key) => {
       stdin.setRawMode(wasRaw);
       stdin.pause();
@@ -3992,12 +4027,12 @@ async function confirm(question, opts = {}) {
       else if (k7 === "n") answer = false;
       else answer = defaultYes;
       console.log(answer ? "y" : "n");
-      resolve20(answer);
+      resolve19(answer);
     });
   });
 }
 function pickOne(label2, max, defaultIdx = 1) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve19) => {
     process.stdout.write(`  ${bold(label2)} (1-${max}) [${bold(String(defaultIdx))}]: `);
     const { stdin } = process;
     const wasRaw = stdin.isRaw ?? false;
@@ -4013,15 +4048,15 @@ function pickOne(label2, max, defaultIdx = 1) {
       }
       if (ch === "\r" || ch === "\n") {
         console.log(String(defaultIdx));
-        return resolve20(defaultIdx);
+        return resolve19(defaultIdx);
       }
       const n = parseInt(ch, 10);
       if (n >= 1 && n <= max) {
         console.log(String(n));
-        return resolve20(n);
+        return resolve19(n);
       }
       console.log(String(defaultIdx));
-      resolve20(defaultIdx);
+      resolve19(defaultIdx);
     });
   });
 }
@@ -4030,11 +4065,12 @@ function formatSize(bytes) {
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
-var _autoConfirm;
+var WINDOWS_PSEUDO_USERS, _autoConfirm;
 var init_utils = __esm({
   "src/utils.ts"() {
     "use strict";
     init_colors();
+    WINDOWS_PSEUDO_USERS = /* @__PURE__ */ new Set(["All Users", "Default", "Default User", "Public", "desktop.ini"]);
     _autoConfirm = false;
   }
 });
@@ -4052,14 +4088,14 @@ __export(auth_exports, {
   saveAuth: () => saveAuth,
   sessionExpired: () => sessionExpired
 });
-import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync, chmodSync, openSync, closeSync } from "fs";
-import { join } from "path";
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, existsSync, unlinkSync, chmodSync, openSync, closeSync } from "fs";
+import { join as join2 } from "path";
 import { homedir } from "os";
 function getAuth() {
   if (cached) return cached;
   if (!existsSync(AUTH_FILE)) return null;
   try {
-    cached = JSON.parse(readFileSync(AUTH_FILE, "utf-8"));
+    cached = JSON.parse(readFileSync2(AUTH_FILE, "utf-8"));
     return cached;
   } catch {
     return null;
@@ -4068,7 +4104,7 @@ function getAuth() {
 function readAuthFresh() {
   if (!existsSync(AUTH_FILE)) return null;
   try {
-    return JSON.parse(readFileSync(AUTH_FILE, "utf-8"));
+    return JSON.parse(readFileSync2(AUTH_FILE, "utf-8"));
   } catch {
     return null;
   }
@@ -4119,7 +4155,7 @@ async function acquireRefreshLock() {
       };
     } catch {
       try {
-        const pid = parseInt(readFileSync(AUTH_LOCK_FILE, "utf-8").trim(), 10);
+        const pid = parseInt(readFileSync2(AUTH_LOCK_FILE, "utf-8").trim(), 10);
         if (pid && !isNaN(pid)) {
           try {
             process.kill(pid, 0);
@@ -4209,9 +4245,9 @@ var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
     init_utils();
-    AUTH_DIR = process.env.GIPITY_DIR || join(homedir(), ".gipity");
-    AUTH_FILE = join(AUTH_DIR, "auth.json");
-    AUTH_LOCK_FILE = join(AUTH_DIR, "auth.lock");
+    AUTH_DIR = process.env.GIPITY_DIR || join2(homedir(), ".gipity");
+    AUTH_FILE = join2(AUTH_DIR, "auth.json");
+    AUTH_LOCK_FILE = join2(AUTH_DIR, "auth.lock");
     cached = null;
     delay = (ms2) => new Promise((r) => setTimeout(r, ms2));
     LOCK_WAIT_MS = 1e4;
@@ -5370,8 +5406,8 @@ var require_streamx = __commonJS({
             return this;
           },
           next() {
-            return new Promise(function(resolve20, reject) {
-              promiseResolve = resolve20;
+            return new Promise(function(resolve19, reject) {
+              promiseResolve = resolve19;
               promiseReject = reject;
               const data = stream.read();
               if (data !== null) ondata(data);
@@ -5401,11 +5437,11 @@ var require_streamx = __commonJS({
         }
         function destroy(err) {
           stream.destroy(err);
-          return new Promise((resolve20, reject) => {
-            if (stream._duplexState & DESTROYED) return resolve20({ value: void 0, done: true });
+          return new Promise((resolve19, reject) => {
+            if (stream._duplexState & DESTROYED) return resolve19({ value: void 0, done: true });
             stream.once("close", function() {
               if (err) reject(err);
-              else resolve20({ value: void 0, done: true });
+              else resolve19({ value: void 0, done: true });
             });
           });
         }
@@ -5449,8 +5485,8 @@ var require_streamx = __commonJS({
         const writes = pending + (ws2._duplexState & WRITE_WRITING ? 1 : 0);
         if (writes === 0) return Promise.resolve(true);
         if (state.drains === null) state.drains = [];
-        return new Promise((resolve20) => {
-          state.drains.push({ writes, resolve: resolve20 });
+        return new Promise((resolve19) => {
+          state.drains.push({ writes, resolve: resolve19 });
         });
       }
       write(data) {
@@ -5555,10 +5591,10 @@ var require_streamx = __commonJS({
       cb2(null);
     }
     function pipelinePromise(...streams) {
-      return new Promise((resolve20, reject) => {
+      return new Promise((resolve19, reject) => {
         return pipeline(...streams, (err) => {
           if (err) return reject(err);
-          resolve20();
+          resolve19();
         });
       });
     }
@@ -6213,16 +6249,16 @@ var require_extract = __commonJS({
           entryCallback = null;
           cb2(err);
         }
-        function onnext(resolve20, reject) {
+        function onnext(resolve19, reject) {
           if (error2) {
             return reject(error2);
           }
           if (entryStream) {
-            resolve20({ value: entryStream, done: false });
+            resolve19({ value: entryStream, done: false });
             entryStream = null;
             return;
           }
-          promiseResolve = resolve20;
+          promiseResolve = resolve19;
           promiseReject = reject;
           consumeCallback(null);
           if (extract3._finished && promiseResolve) {
@@ -6250,11 +6286,11 @@ var require_extract = __commonJS({
         function destroy(err) {
           extract3.destroy(err);
           consumeCallback(err);
-          return new Promise((resolve20, reject) => {
-            if (extract3.destroyed) return resolve20({ value: void 0, done: true });
+          return new Promise((resolve19, reject) => {
+            if (extract3.destroyed) return resolve19({ value: void 0, done: true });
             extract3.once("close", function() {
               if (err) reject(err);
-              else resolve20({ value: void 0, done: true });
+              else resolve19({ value: void 0, done: true });
             });
           });
         }
@@ -6535,13 +6571,13 @@ var require_tar_stream = __commonJS({
 });
 
 // src/client-context.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { resolve, dirname } from "path";
 import { fileURLToPath } from "url";
 function cliVersion() {
   try {
     const dir = dirname(fileURLToPath(import.meta.url));
-    const pkg2 = JSON.parse(readFileSync2(resolve(dir, "../package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync3(resolve(dir, "../package.json"), "utf-8"));
     return typeof pkg2.version === "string" ? pkg2.version : "unknown";
   } catch {
     return "unknown";
@@ -6707,7 +6743,7 @@ async function postForTarEntries(path5, body, retried = false) {
   if (!res.body) throw new ApiError(500, "EMPTY_RESPONSE", "Server returned no body");
   const extract3 = tar.extract();
   const entries = [];
-  const done = new Promise((resolve20, reject) => {
+  const done = new Promise((resolve19, reject) => {
     extract3.on("entry", (header, stream, next) => {
       const chunks = [];
       stream.on("data", (c) => chunks.push(c));
@@ -6718,7 +6754,7 @@ async function postForTarEntries(path5, body, retried = false) {
       stream.on("error", reject);
       stream.resume();
     });
-    extract3.on("finish", () => resolve20());
+    extract3.on("finish", () => resolve19());
     extract3.on("error", reject);
   });
   Readable.fromWeb(res.body).pipe(extract3);
@@ -6928,7 +6964,7 @@ __export(config_exports, {
   setApiBaseOverride: () => setApiBaseOverride,
   shouldIgnore: () => shouldIgnore
 });
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
 import { dirname as dirname2, resolve as resolve2 } from "path";
 function setApiBaseOverride(url) {
   apiBaseOverride = url;
@@ -6986,7 +7022,7 @@ function getConfig() {
   const path5 = getConfigPath();
   if (!path5) return null;
   try {
-    cached3 = JSON.parse(readFileSync3(path5, "utf-8"));
+    cached3 = JSON.parse(readFileSync4(path5, "utf-8"));
     return cached3;
   } catch {
     return null;
@@ -31863,9 +31899,9 @@ var {
 // src/index.ts
 init_config();
 init_utils();
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync28 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname13, resolve as resolve19 } from "path";
+import { dirname as dirname14, resolve as resolve18 } from "path";
 
 // src/helpers/output.ts
 var frameOpen = false;
@@ -31970,12 +32006,10 @@ Kits are reusable building blocks added to an existing app, not whole templates
     - \`gipity add chatbot\` - Drop-in chatbot - configurable persona, scope guardrails, static knowledge (20k budget), streaming responses. Headless engine + bubble widget; bring your own UI if you want. Works in any app.
     - \`gipity add audio-align\` - Audio + lyrics -> word-level timing JSON. Demucs vocal isolation + MMS_FA forced alignment, runs as a Modal L4 GPU job (~$0.01 per 3-min song). For karaoke captions, subtitling, language learning, dubbing alignment.
     - \`gipity add i18n\` - Multi-language for web apps - language picker, locale persistence, RTL, plural/translation lookup. Scaffolds src/js/strings.js and wires it up; move your copy there and read it with t('key'). Web only.
-    - \`gipity add records\` - Registry-driven records: declare objects/fields as data, get generic CRUD functions with validation, full-text search, soft delete, ACTOR provenance, and an audit event spine - every write is transactional (row + event). Field types include relations ({id,label}), currency, emails/phones/links composites. Ships backend functions + migrations. Needs a database (web-fullstack/api template). See the \`app-records\` skill.
-    - \`gipity add views\` - Generic UI over records-kit objects: sortable/filterable table with full-text search, create/edit/delete forms with type-appropriate widgets, kanban board with drag-to-update. Renders entirely from the field registry - zero per-object UI code. Requires the records kit. See the \`app-records\` skill.
-    - \`gipity add agent-api\` - Make your app agent-operable: named API keys (kit_api_keys) let agents and scripts write through the records kit's single write path with AGENT/API actor attribution - machine writes land on the same audit spine as human edits. Requires the records kit. See the \`app-records\` skill.
     - \`gipity add contacts\` - Source-agnostic contact data layer for lead-gen/CRM apps: import people from LinkedIn CSV + Gmail + pasted lists, resolve duplicates into one person while keeping EVERY value from every source with provenance (multi-valued attributes, never overwrites). Exact email/URL auto-merge; fuzzy name+company goes to a human merge-review queue (reversible). Re-imports detect job changes and emit signals. User-definable tags, full-text search, and a transactional event spine. Ships backend functions + migrations. Needs a database (web-fullstack/api template).
     - \`gipity add stripe\` - Charge your app's end-users for one-time purchases and subscriptions via Stripe. Owner connects their own Stripe account through Gipity-hosted onboarding (no API keys to paste); money lands in their account, Gipity takes a small platform fee. Ships a buy-button / pricing component, a subscription-status helper for gating UI, a webhook-verified fulfillment function, and the payments/subscriptions tables. The platform brokers checkout + signature-verified webhooks. Needs a database (web-fullstack/api template).
-    - \`gipity add notify\` - Web push notifications for any web app, including iOS home-screen web apps (iOS 16.4+). The platform owns the VAPID keys, encryption, and delivery \u2014 no keys to paste, no crypto, no server. Ships a <gipity-notify-button>, a service worker, and a PWA manifest; the device subscribes itself and self-heals stale subscriptions. Send from a function with the injected notify() service (one flat credit per send, owner-billed) or test with \`gipity notify test\`. Works in any template \u2014 no database required.`;
+    - \`gipity add notify\` - Web push notifications for any web app, including iOS home-screen web apps (iOS 16.4+). The platform owns the VAPID keys, encryption, and delivery \u2014 no keys to paste, no crypto, no server. Ships a <gipity-notify-button>, a service worker, and a PWA manifest; the device subscribes itself and self-heals stale subscriptions. Send from a function with the injected notify() service (one flat credit per send, owner-billed) or test with \`gipity notify test\`. Works in any template \u2014 no database required.
+    - \`gipity add servicenow\` - Use ServiceNow tables as a data source: OAuth (client-credentials) authenticated polling pull into a local Postgres mirror (sn_records, any table, configurable), plus write-back into ServiceNow via the Table API. Optional real-time sync layers a ServiceNow Business Rule + Script Include on top, pushing changes to a webhook the instant they happen. Ships a cron workflow for the pull cycle, sn-pull/sn-write/sn-webhook functions, and setup scripts that automate the ServiceNow-side configuration. Needs a database (web-fullstack/api template).`;
 var SKILLS_CONTENT = `# Gipity Integration
 
 Gipity is the cloud platform your project runs on - hosting, databases, deployment, file storage, code execution, workflows, and monitoring. Gip is the cloud agent that runs on Gipity.
@@ -32083,12 +32117,14 @@ Write files locally - Gipity's editor hooks (installed into Claude Code, Grok, a
 
 To keep local-only material (research clones, scratch data, vendored references) in the project directory without syncing or deploying it, list it in a \`.gipityignore\` at the project root - gitignore-style, one pattern per line, \`#\` comments. Ignored paths are invisible to sync in both directions; anything that already synced before being ignored stays on the server until you delete it.
 
+**WSL trap: user-dropped files may be in a Windows-side twin.** On WSL, a same-named folder often exists at \`C:\\Users\\<name>\\GipityProjects\\<project>\` (visible as \`/mnt/c/Users/<name>/GipityProjects/<project>\`) - from Windows Explorer it looks like "the project folder", so users drop new files (audio, images) there. Nothing syncs from it. If the user says files are "in the project" but you can't find them, check that path before searching wider; \`gipity sync\` prints a notice when such a twin exists.
+
 ### Where files go: deploy only ships \`src/\`
 
 Deploy is opt-in, not opt-out: the \`files\` phase uploads **only** what's under \`src/\` (plus \`functions/\` and \`migrations/\` as backend, not CDN files). Anything else at the project root is kept but never deployed. Put each kind of file in the right bucket so scratch and reference material can't bloat a deploy:
 
 - **\`src/\`** - the app itself. Synced **and** deployed to the CDN. Only app code, assets, and pages belong here.
-- **\`tmp/\`** - ephemeral scratch: file conversions, intermediate outputs, design staging. **Already ignored** (never synced, never deployed) - the one place to do throwaway work. Use this single root. (\`*_tmp/\` dirs and \`.gipityscratch/\` are auto-ignored too, as a safety net, so legacy scattered scratch like \`_vsd_tmp/\` can't leak - but write new scratch to \`tmp/\`, not scattered dirs.) Because it never syncs, \`tmp/\` is also never mirrored into the sandbox: **don't stage \`gipity sandbox run\` inputs here** - the sandbox won't see them. Stage inputs under \`src/\`/\`docs/\` and delete them after.
+- **\`tmp/\`** - ephemeral scratch: file conversions, intermediate outputs, design staging. **Already ignored** (never synced, never deployed) - the one place to do throwaway work. Use this single root. Leave scratch files where they are when you're done; there's nothing to clean up (no \`rm\` turn) - they're invisible to sync and deploy. (\`*_tmp/\` dirs and \`.gipityscratch/\` are auto-ignored too, as a safety net, so legacy scattered scratch like \`_vsd_tmp/\` can't leak - but write new scratch to \`tmp/\`, not scattered dirs.) Because it never syncs, \`tmp/\` is also never mirrored into the sandbox: **don't stage \`gipity sandbox run\` inputs here** - the sandbox won't see them. Stage inputs under \`src/\`/\`docs/\` and delete them after.
 - **\`docs/\`** - reference material you want to keep: UI/architecture diagrams, design decks, notes, ADRs. Synced and versioned on the server (backed up, rollback-able) but **never deployed**, because it's outside \`src/\`. This is the home for "keep forever, don't ship" artifacts.
 - **\`tests/\`** - \`*.test.js\` suites. Synced, run by \`gipity test\`, never deployed. \`gipity test list [path]\` lists the test files (and what a filter selects) without running them.
 
@@ -32104,7 +32140,7 @@ App services skills (load before calling \`/services/*\` endpoints):
 - \`app-audio\` - sound effects, music, transcription
 - \`app-auth\` - sign in with Gipity, popup vs redirect
 - \`app-files\` - uploads, variants, file listing
-- \`app-image\` - text-to-image only (no input image / editing); providers, sizes, aspect ratios
+- \`app-image\` - text-to-image AND instruction editing (pass \`images\` to edit an uploaded photo); providers, sizes, aspect ratios
 - \`app-llm\` - chat completions, streaming, image input
 - \`app-location\` - user location & reverse geocoding for deployed apps (first-party - no third-party geocoder)
 - \`app-notify\` - web push notifications for deployed apps (incl. iOS home-screen web apps) - notify kit + injected notify() service, platform owns the keys
@@ -32119,6 +32155,7 @@ App development skills:
 - \`app-debugging\` - debug a deployed app: page inspect/eval, screenshots, function logs
 - \`app-development\` - functions, database, and API
 - \`app-import\` - import apps from GitHub/.gip bundles (incl. Vercel/Replit/Lovable porting) and export any project as a portable .gip - app_import tool, gipity save/load
+- \`app-records\` - Gipity Records: declared tables \u2192 validated CRUD, provenance, workflows, auto UI
 - \`app-testing\` - testing deployed app functions (ctx.fn.call/callAs, the isolated test DB)
 - \`deploy\` - the deploy pipeline & gipity.yaml manifest
 - \`jobs\` - long-running CPU + GPU compute jobs (Python / Node / bash)
@@ -32127,7 +32164,6 @@ App development skills:
 - \`web-ui-patterns\` - default Gipity look (theme tokens) + web UI recipes - feeds, copy-to-clipboard
 
 Kit skills (reusable building blocks - \`gipity add <kit>\`):
-- \`app-records\` - the records + views kits: registry-driven CRUD with search + audit history, and generated tables/kanban/forms (gipity add records)
 - \`audio-align\` - the audio-align kit: forced alignment of audio + lyrics into word-level timing JSON
 - \`chatbot\` - the chatbot kit: persona + scope guardrails + static knowledge, bubble widget or headless engine
 
@@ -32156,13 +32192,13 @@ init_colors();
 
 // src/bug-queue.ts
 init_api();
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "fs";
+import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
-var QUEUE_DIR = join2(process.env.GIPITY_DIR || join2(homedir2(), ".gipity"), "bug-queue");
+var QUEUE_DIR = join3(process.env.GIPITY_DIR || join3(homedir2(), ".gipity"), "bug-queue");
 function queueBugReport(report) {
   mkdirSync2(QUEUE_DIR, { recursive: true, mode: 448 });
-  const file = join2(QUEUE_DIR, `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`);
+  const file = join3(QUEUE_DIR, `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`);
   writeFileSync3(file, JSON.stringify(report, null, 2), { mode: 384 });
 }
 function isRetryableFailure(err) {
@@ -32174,12 +32210,12 @@ function isRetryableFailure(err) {
 async function flushBugQueue() {
   if (!existsSync3(QUEUE_DIR)) return 0;
   let delivered = 0;
-  for (const file of readdirSync(QUEUE_DIR)) {
+  for (const file of readdirSync2(QUEUE_DIR)) {
     if (!file.endsWith(".json")) continue;
-    const path5 = join2(QUEUE_DIR, file);
+    const path5 = join3(QUEUE_DIR, file);
     let report;
     try {
-      report = JSON.parse(readFileSync4(path5, "utf-8"));
+      report = JSON.parse(readFileSync5(path5, "utf-8"));
     } catch {
       try {
         unlinkSync2(path5);
@@ -32202,6 +32238,70 @@ async function flushBugQueue() {
   return delivered;
 }
 
+// src/login-flow.ts
+init_api();
+init_auth();
+init_config();
+init_utils();
+init_colors();
+function newAccountWouldBeUnexpected(email, priorAuth) {
+  return !!getConfig() || priorAuth?.email.toLowerCase() === email.toLowerCase().trim();
+}
+function warnBeforeCodeIfUnexpectedNewAccount(isNewUser, email, indent = "") {
+  if (isNewUser !== true) return;
+  const priorAuth = getAuth();
+  if (!newAccountWouldBeUnexpected(email, priorAuth)) return;
+  const config = getConfig();
+  console.log(`${indent}${warning(`No existing Gipity account for ${email} \u2014 entering the code will CREATE a new one.`)}`);
+  if (config) {
+    console.log(`${indent}${muted(`This directory is linked to project ${config.projectSlug} (account ${config.accountSlug}). If you meant to log into that account, stop and re-check the email before entering the code.`)}`);
+  }
+}
+function warnIfUnexpectedNewAccount(isNewUser, email, priorAuth, indent = "") {
+  if (isNewUser !== true) return;
+  if (!newAccountWouldBeUnexpected(email, priorAuth)) return;
+  const config = getConfig();
+  console.log(`${indent}${warning(`Logged into a NEW, empty account for ${email} \u2014 no prior account existed for this email.`)}`);
+  if (config) {
+    console.log(`${indent}${muted(`This directory is linked to project ${config.projectSlug} (account ${config.accountSlug}), which the new account does not own \u2014 project / skill / sync commands will fail with "not found".`)}`);
+  }
+  console.log(`${indent}${muted("If you expected an existing account, run: gipity status  \u2014 then gipity login again with the correct email.")}`);
+}
+async function interactiveLogin() {
+  const email = await prompt("  Email: ");
+  if (!email) {
+    console.error(`
+  ${error("Email required.")}`);
+    process.exit(1);
+  }
+  const sendRes = await publicPost("/auth/login", { email });
+  console.log("  Check your email for a 6-digit code.\n");
+  warnBeforeCodeIfUnexpectedNewAccount(sendRes.isNewUser, email, "  ");
+  const code = await prompt("  Code: ");
+  if (!code) {
+    console.error(`
+  ${error("Code required.")}`);
+    process.exit(1);
+  }
+  const priorAuth = getAuth();
+  const res = await publicPost("/auth/verify", { email, code });
+  const exp = decodeJwtExp(res.accessToken);
+  if (!exp) {
+    console.error(`
+  ${error("Invalid token received.")}`);
+    process.exit(1);
+  }
+  const expiresAt = new Date(exp * 1e3).toISOString();
+  saveAuth({ accessToken: res.accessToken, refreshToken: res.refreshToken, email, expiresAt });
+  console.log(`  ${success(`Logged in (${email}).`)}`);
+  warnIfUnexpectedNewAccount(res.isNewUser, email, priorAuth, "  ");
+  const delivered = await flushBugQueue().catch(() => 0);
+  if (delivered > 0) {
+    console.log(`  ${muted(`Delivered ${delivered} queued bug report${delivered === 1 ? "" : "s"}.`)}`);
+  }
+  return getAuth();
+}
+
 // src/commands/login.ts
 var loginCommand = new Command("login").description("Log in or sign up").option("--email <email>", "Email address").option("--code <code>", "Verification code").action(async (opts) => {
   try {
@@ -32212,9 +32312,10 @@ var loginCommand = new Command("login").description("Log in or sign up").option(
       return;
     }
     if (email && !code) {
-      await publicPost("/auth/login", { email });
+      const sendRes2 = await publicPost("/auth/login", { email });
       console.log("Check your email for a 6-digit code.");
       console.log(muted(`Then run: gipity login --email ${email} --code <code>`));
+      warnBeforeCodeIfUnexpectedNewAccount(sendRes2.isNewUser, email);
       return;
     }
     console.log("Enter your email to log in or create an account.");
@@ -32225,9 +32326,10 @@ var loginCommand = new Command("login").description("Log in or sign up").option(
       console.error(error("Email required."));
       process.exit(1);
     }
-    await publicPost("/auth/login", { email });
+    const sendRes = await publicPost("/auth/login", { email });
     console.log("");
     console.log("Check your email for a 6-digit code.");
+    warnBeforeCodeIfUnexpectedNewAccount(sendRes.isNewUser, email);
     code = await prompt("Code: ");
     await verify(email, code);
   } catch (err) {
@@ -32236,6 +32338,7 @@ var loginCommand = new Command("login").description("Log in or sign up").option(
   }
 });
 async function verify(email, code) {
+  const priorAuth = getAuth();
   const res = await publicPost("/auth/verify", { email, code });
   const exp = decodeJwtExp(res.accessToken);
   if (!exp) {
@@ -32250,6 +32353,7 @@ async function verify(email, code) {
     expiresAt
   });
   console.log(success(`Logged in (${email}).`));
+  warnIfUnexpectedNewAccount(res.isNewUser, email, priorAuth);
   const delivered = await flushBugQueue().catch(() => 0);
   if (delivered > 0) {
     console.log(muted(`Delivered ${delivered} queued bug report${delivered === 1 ? "" : "s"}.`));
@@ -32295,8 +32399,8 @@ function run(label2, action) {
 init_api();
 init_config();
 init_utils();
-import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5, statSync, lstatSync, unlinkSync as unlinkSync3, readdirSync as readdirSync3, rmdirSync, readFileSync as readFileSync6, renameSync, openSync as openSync2, closeSync as closeSync2, utimesSync, realpathSync } from "fs";
-import { join as join4, relative, dirname as dirname4, extname as extname2, resolve as resolve4, sep } from "path";
+import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync5, statSync as statSync2, lstatSync, unlinkSync as unlinkSync3, readdirSync as readdirSync4, rmdirSync, readFileSync as readFileSync7, renameSync, openSync as openSync2, closeSync as closeSync2, utimesSync, realpathSync as realpathSync2 } from "fs";
+import { join as join5, relative, dirname as dirname4, extname as extname2, resolve as resolve4, sep } from "path";
 import { hostname } from "os";
 import { createHash as createHash2 } from "crypto";
 
@@ -32359,25 +32463,25 @@ async function hashFile(path5) {
   const hash = createHash("sha256");
   let size = 0;
   const stream = createReadStream(path5);
-  await new Promise((resolve20, reject) => {
+  await new Promise((resolve19, reject) => {
     stream.on("data", (chunk) => {
       const buf = chunk;
       hash.update(buf);
       size += buf.length;
     });
-    stream.on("end", () => resolve20());
+    stream.on("end", () => resolve19());
     stream.on("error", reject);
   });
   return { sha256: hash.digest("hex"), size };
 }
 function readRange(path5, start, end) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve19, reject) => {
     const chunks = [];
     const stream = createReadStream(path5, { start, end });
     stream.on("data", (c) => {
       chunks.push(c);
     });
-    stream.on("end", () => resolve20(Buffer.concat(chunks)));
+    stream.on("end", () => resolve19(Buffer.concat(chunks)));
     stream.on("error", reject);
   });
 }
@@ -32410,9 +32514,9 @@ var UploadConflictError = class extends Error {
   path;
 };
 async function uploadOneFile(projectGuid, localPath, virtualPath, opts = {}) {
-  const { sha256: sha2562, size } = await hashFile(localPath);
+  const { sha256, size } = await hashFile(localPath);
   const mime = opts.mime ?? guessMime(virtualPath);
-  const initBody = { path: virtualPath, size, sha256: sha2562, mime };
+  const initBody = { path: virtualPath, size, sha256, mime };
   if (opts.expectedServerVersion !== void 0) {
     initBody.expected_server_version = opts.expectedServerVersion;
   }
@@ -32540,9 +32644,9 @@ async function uploadCompleteBatch(projectGuid, items) {
 
 // src/setup.ts
 init_platform();
-import { resolve as resolve3, join as join3, dirname as dirname3 } from "path";
+import { resolve as resolve3, join as join4, dirname as dirname3 } from "path";
 import { homedir as homedir3, tmpdir } from "os";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync5, mkdtempSync, rmSync, cpSync, readdirSync as readdirSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync6, mkdtempSync, rmSync, cpSync, readdirSync as readdirSync3 } from "fs";
 init_config();
 var PRIMER_FILES = {
   claude: "CLAUDE.md",
@@ -32657,14 +32761,14 @@ function stripGipityHooks(settings) {
 function readSettingsFile(path5) {
   if (!existsSync4(path5)) return {};
   try {
-    return JSON.parse(readFileSync5(path5, "utf-8"));
+    return JSON.parse(readFileSync6(path5, "utf-8"));
   } catch {
     return {};
   }
 }
 function ensureGipityPlugin(force = false) {
-  const claudeDir = join3(homedir3(), ".claude");
-  const settingsPath = join3(claudeDir, "settings.json");
+  const claudeDir = join4(homedir3(), ".claude");
+  const settingsPath = join4(claudeDir, "settings.json");
   const settings = readSettingsFile(settingsPath);
   let changed = stripGipityHooks(settings);
   const marketplaces = settings.extraKnownMarketplaces ?? (settings.extraKnownMarketplaces = {});
@@ -32696,8 +32800,8 @@ function versionGte(have, want) {
 }
 function userScopeInstallState() {
   try {
-    const p = join3(homedir3(), ".claude", "plugins", "installed_plugins.json");
-    const data = JSON.parse(readFileSync5(p, "utf-8"));
+    const p = join4(homedir3(), ".claude", "plugins", "installed_plugins.json");
+    const data = JSON.parse(readFileSync6(p, "utf-8"));
     const entries = data?.plugins?.[GIPITY_PLUGIN_ID];
     if (!Array.isArray(entries)) return { exists: false, current: false };
     const userEntries = entries.filter((e) => e?.scope === "user");
@@ -32734,8 +32838,8 @@ function ensureGipityPluginInstalled() {
 }
 function grokInstallState() {
   try {
-    const p = join3(homedir3(), ".grok", "installed-plugins", "registry.json");
-    const data = JSON.parse(readFileSync5(p, "utf-8"));
+    const p = join4(homedir3(), ".grok", "installed-plugins", "registry.json");
+    const data = JSON.parse(readFileSync6(p, "utf-8"));
     const versions = [];
     for (const repo of Object.values(data?.repos ?? {})) {
       const v7 = repo?.plugins?.gipity?.version;
@@ -32760,12 +32864,12 @@ function ensureGrokPluginInstalled() {
     console.log("Installed the Gipity plugin for Grok (skills + file-sync hooks).");
   }
 }
-var AGENTS_SKILLS_DIR = join3(homedir3(), ".agents", "skills");
-var AGENT_HOOKS_DIR = join3(homedir3(), ".gipity", "agent-hooks");
-var AGENT_SKILLS_MANIFEST = join3(homedir3(), ".gipity", "agent-skills.json");
+var AGENTS_SKILLS_DIR = join4(homedir3(), ".agents", "skills");
+var AGENT_HOOKS_DIR = join4(homedir3(), ".gipity", "agent-hooks");
+var AGENT_SKILLS_MANIFEST = join4(homedir3(), ".gipity", "agent-skills.json");
 function agentSkillsState() {
   try {
-    const m = JSON.parse(readFileSync5(AGENT_SKILLS_MANIFEST, "utf-8"));
+    const m = JSON.parse(readFileSync6(AGENT_SKILLS_MANIFEST, "utf-8"));
     return {
       current: typeof m?.version === "string" && versionGte(m.version, GIPITY_PLUGIN_VERSION),
       skills: Array.isArray(m?.skills) ? m.skills : []
@@ -32777,36 +32881,36 @@ function agentSkillsState() {
 function ensureAgentSkillsInstalled() {
   if (agentSkillsState().current) return;
   if (!binaryOnPath("git")) return;
-  const tmp = mkdtempSync(join3(tmpdir(), "gipity-skills-"));
+  const tmp = mkdtempSync(join4(tmpdir(), "gipity-skills-"));
   try {
     const clone = spawnSyncCommand(
       resolveCommand("git"),
-      ["clone", "--depth", "1", `https://github.com/${GIPITY_MARKETPLACE_REPO}.git`, join3(tmp, "repo")],
+      ["clone", "--depth", "1", `https://github.com/${GIPITY_MARKETPLACE_REPO}.git`, join4(tmp, "repo")],
       { stdio: "ignore", timeout: 12e4 }
     );
     if (clone.status !== 0) return;
-    const repo = join3(tmp, "repo");
+    const repo = join4(tmp, "repo");
     let version = GIPITY_PLUGIN_VERSION;
     try {
-      const manifest = JSON.parse(readFileSync5(join3(repo, ".claude-plugin", "plugin.json"), "utf-8"));
+      const manifest = JSON.parse(readFileSync6(join4(repo, ".claude-plugin", "plugin.json"), "utf-8"));
       if (typeof manifest?.version === "string") version = manifest.version;
     } catch {
     }
-    const skillsSrc = join3(repo, "skills");
+    const skillsSrc = join4(repo, "skills");
     const names = [];
-    for (const entry of readdirSync2(skillsSrc, { withFileTypes: true })) {
+    for (const entry of readdirSync3(skillsSrc, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      if (!existsSync4(join3(skillsSrc, entry.name, "SKILL.md"))) continue;
+      if (!existsSync4(join4(skillsSrc, entry.name, "SKILL.md"))) continue;
       mkdirSync3(AGENTS_SKILLS_DIR, { recursive: true });
-      cpSync(join3(skillsSrc, entry.name), join3(AGENTS_SKILLS_DIR, entry.name), {
+      cpSync(join4(skillsSrc, entry.name), join4(AGENTS_SKILLS_DIR, entry.name), {
         recursive: true,
         force: true
       });
       names.push(entry.name);
     }
     mkdirSync3(AGENT_HOOKS_DIR, { recursive: true });
-    for (const script of readdirSync2(join3(repo, "hooks", "scripts"))) {
-      cpSync(join3(repo, "hooks", "scripts", script), join3(AGENT_HOOKS_DIR, script), { force: true });
+    for (const script of readdirSync3(join4(repo, "hooks", "scripts"))) {
+      cpSync(join4(repo, "hooks", "scripts", script), join4(AGENT_HOOKS_DIR, script), { force: true });
     }
     writeFileSync4(AGENT_SKILLS_MANIFEST, JSON.stringify({ version, skills: names }, null, 2) + "\n");
     console.log(`Installed ${names.length} Gipity skills for Codex (~/.agents/skills).`);
@@ -32816,8 +32920,8 @@ function ensureAgentSkillsInstalled() {
   }
 }
 function applyCodexHooks(existing) {
-  const launcher = join3(AGENT_HOOKS_DIR, "launch.sh");
-  const cmd = (script, ...args) => [`sh "${launcher}" "${join3(AGENT_HOOKS_DIR, script)}"`, ...args].join(" ");
+  const launcher = join4(AGENT_HOOKS_DIR, "launch.sh");
+  const cmd = (script, ...args) => [`sh "${launcher}" "${join4(AGENT_HOOKS_DIR, script)}"`, ...args].join(" ");
   const wanted = [
     { event: "PostToolUse", matcher: "Edit|Write", command: cmd("sync-push.cjs"), timeout: 30 },
     { event: "UserPromptSubmit", command: cmd("sync-pull.cjs"), timeout: 300 },
@@ -32855,8 +32959,8 @@ function setupCodexHooks() {
   if (process.platform === "win32") return;
   const cwd = resolve3(process.cwd());
   if (cwd === resolve3(homedir3())) return;
-  const path5 = join3(cwd, ".codex", "hooks.json");
-  const existing = existsSync4(path5) ? readFileSync5(path5, "utf-8") : null;
+  const path5 = join4(cwd, ".codex", "hooks.json");
+  const existing = existsSync4(path5) ? readFileSync6(path5, "utf-8") : null;
   const next = applyCodexHooks(existing);
   if (next === null) return;
   mkdirSync3(dirname3(path5), { recursive: true });
@@ -32876,9 +32980,9 @@ function setupClaudeHooks() {
   ensureGipityPlugin();
   const cwd = resolve3(process.cwd());
   if (cwd === resolve3(homedir3())) return;
-  const claudeDir = join3(cwd, ".claude");
+  const claudeDir = join4(cwd, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
-  const settingsPath = join3(claudeDir, "settings.json");
+  const settingsPath = join4(claudeDir, "settings.json");
   const settings = readSettingsFile(settingsPath);
   stripGipityHooks(settings);
   const perms = settings.permissions || {};
@@ -32925,7 +33029,7 @@ function applySkillsBlock(existing, apiBase2 = DEFAULT_API_BASE) {
 function writeSkillsFile(relPath, wrap) {
   const path5 = resolve3(process.cwd(), relPath);
   mkdirSync3(dirname3(path5), { recursive: true });
-  const existing = existsSync4(path5) ? readFileSync5(path5, "utf-8") : null;
+  const existing = existsSync4(path5) ? readFileSync6(path5, "utf-8") : null;
   const baseNext = applySkillsBlock(existing, resolveApiBase());
   const next = wrap && existing === null ? wrap(baseNext) : baseNext;
   if (next !== existing) writeFileSync4(path5, next);
@@ -32968,7 +33072,7 @@ function applyAiderConf(existing) {
 function setupAiderMd() {
   writeSkillsFile(PRIMER_FILES.aider);
   const path5 = resolve3(process.cwd(), AIDER_CONF_FILE);
-  const existing = existsSync4(path5) ? readFileSync5(path5, "utf-8") : null;
+  const existing = existsSync4(path5) ? readFileSync6(path5, "utf-8") : null;
   const next = applyAiderConf(existing);
   if (next !== null) writeFileSync4(path5, next);
 }
@@ -33010,7 +33114,7 @@ function setupGitignore() {
   const gitignorePath = resolve3(process.cwd(), ".gitignore");
   const entries = [".gipity/", ".gipity.json", ...SCRATCH_IGNORE];
   if (existsSync4(gitignorePath)) {
-    let content = readFileSync5(gitignorePath, "utf-8");
+    let content = readFileSync6(gitignorePath, "utf-8");
     const lines = content.split(/\r?\n/);
     const toAdd = entries.filter((e) => !lines.includes(e));
     if (toAdd.length > 0) {
@@ -33038,11 +33142,11 @@ var BULK_DELETE_FRACTION = 0.25;
 var DOWNLOAD_IDLE_MS = 3e4;
 function syncStatePath() {
   const configPath = getConfigPath();
-  return join4(dirname4(configPath), ".gipity", "sync-state.json");
+  return join5(dirname4(configPath), ".gipity", "sync-state.json");
 }
 function lockPath() {
   const configPath = getConfigPath();
-  return join4(dirname4(configPath), ".gipity", "sync.lock");
+  return join5(dirname4(configPath), ".gipity", "sync.lock");
 }
 function projectDir() {
   const configPath = getConfigPath();
@@ -33056,8 +33160,8 @@ function isLockReclaimable(path5, now = Date.now()) {
   let raw;
   let mtimeMs;
   try {
-    raw = readFileSync6(path5, "utf-8").trim();
-    mtimeMs = statSync(path5).mtimeMs;
+    raw = readFileSync7(path5, "utf-8").trim();
+    mtimeMs = statSync2(path5).mtimeMs;
   } catch {
     return false;
   }
@@ -33116,7 +33220,7 @@ async function acquireLock(progress) {
         );
       }
       if (!waitSpinner) {
-        waitSpinner = progress?.spinner("Waiting for another sync to finish\u2026") ?? null;
+        waitSpinner = progress?.spinner("Waiting for another sync to finish...") ?? null;
       }
       await new Promise((r) => setTimeout(r, LOCK_POLL_MS2));
     }
@@ -33126,7 +33230,7 @@ function readBaseline(projectGuid) {
   const path5 = syncStatePath();
   if (!existsSync5(path5)) return { projectGuid, files: {}, lastFullSync: null };
   try {
-    const parsed = JSON.parse(readFileSync6(path5, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(path5, "utf-8"));
     if (parsed.projectGuid !== projectGuid) {
       return { projectGuid, files: {}, lastFullSync: null };
     }
@@ -33150,25 +33254,25 @@ function walkLocal(root, ignorePatterns, baseline) {
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync3(dir, { withFileTypes: true });
+      entries = readdirSync4(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = join4(dir, entry.name);
+      const full = join5(dir, entry.name);
       const rel2 = relative(root, full).replace(/\\/g, "/");
       if (shouldIgnore(rel2, ignorePatterns)) continue;
       if (entry.isDirectory()) {
-        if (existsSync5(join4(full, CONFIG_FILE2))) continue;
+        if (existsSync5(join5(full, CONFIG_FILE2))) continue;
         walk(full);
       } else if (entry.isFile()) {
         try {
-          const stat2 = statSync(full);
+          const stat2 = statSync2(full);
           const size = stat2.size;
           const mtime = stat2.mtime.toISOString();
           const prior = baseline[rel2];
-          const sha2562 = prior && prior.size === size && prior.mtime === mtime ? prior.sha256 : void 0;
-          result.set(rel2, { size, mtime, sha256: sha2562 });
+          const sha256 = prior && prior.size === size && prior.mtime === mtime ? prior.sha256 : void 0;
+          result.set(rel2, { size, mtime, sha256 });
         } catch {
         }
       }
@@ -33182,8 +33286,8 @@ async function ensureLocalHashes(root, local, paths) {
     const info2 = local.get(path5);
     if (!info2 || info2.sha256) continue;
     try {
-      const { sha256: sha2562 } = await hashFile(join4(root, path5));
-      info2.sha256 = sha2562;
+      const { sha256 } = await hashFile(join5(root, path5));
+      info2.sha256 = sha256;
     } catch {
     }
   }
@@ -33198,10 +33302,10 @@ function resolveInRoot(root, relPath) {
     throw new Error(`Refusing path outside project root: ${relPath}`);
   }
   try {
-    const rootReal = realpathSync(rootResolved);
+    const rootReal = realpathSync2(rootResolved);
     let ancestor = full;
     while (!existsSync5(ancestor) && dirname4(ancestor) !== ancestor) ancestor = dirname4(ancestor);
-    const ancestorReal = realpathSync(ancestor);
+    const ancestorReal = realpathSync2(ancestor);
     if (ancestorReal !== rootReal && !ancestorReal.startsWith(rootReal + sep)) {
       throw new Error(`Refusing path outside project root (symlink escape): ${relPath}`);
     }
@@ -33229,7 +33333,7 @@ async function fetchRemote(projectGuid) {
 function extractTarToMap(stream, idleMs, onBytes, keep) {
   const extract3 = tar2.extract();
   const files = /* @__PURE__ */ new Map();
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve19, reject) => {
     let settled = false;
     let idle;
     const arm = () => {
@@ -33265,7 +33369,7 @@ function extractTarToMap(stream, idleMs, onBytes, keep) {
       });
       entryStream.resume();
     });
-    extract3.on("finish", () => done(resolve20, files));
+    extract3.on("finish", () => done(resolve19, files));
     extract3.on("error", (e) => done(reject, e));
     stream.on("error", (e) => done(reject, e));
     arm();
@@ -33489,9 +33593,9 @@ Plan deletes ${totalDeletes} files (${Math.round(fraction * 100)}% of the tree).
 }
 var GIPITY_IGNORE_FILE = ".gipityignore";
 function readGipityIgnore(root) {
-  const path5 = join4(root, GIPITY_IGNORE_FILE);
+  const path5 = join5(root, GIPITY_IGNORE_FILE);
   if (!existsSync5(path5)) return [];
-  return readFileSync6(path5, "utf8").split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => line.replace(/^\.\//, "").replace(/^\//, ""));
+  return readFileSync7(path5, "utf8").split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map((line) => line.replace(/^\.\//, "").replace(/^\//, ""));
 }
 function effectiveIgnore(root, configIgnore) {
   const base = configIgnore && configIgnore.length ? configIgnore : DEFAULT_SYNC_IGNORE;
@@ -33532,9 +33636,9 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
   const config = { projectGuid, ignore: ignore2 };
   const p = opts.progress;
   const baseline = readBaseline(projectGuid);
-  p?.phase("Scanning local files\u2026");
+  p?.phase("Scanning local files...");
   const local = walkLocal(root, ignore2, baseline.files);
-  p?.phase("Checking Gipity for changes\u2026");
+  p?.phase("Checking Gipity for changes...");
   const remote = await fetchRemote(projectGuid);
   for (const path5 of [...remote.keys()]) {
     if (shouldIgnore(path5, ignore2)) remote.delete(path5);
@@ -33545,7 +33649,7 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
     const r = remote.get(path5);
     if (r?.sha256 || baseline.files[path5]) needHash.push(path5);
   }
-  if (needHash.length) p?.phase(`Hashing ${needHash.length} file${needHash.length === 1 ? "" : "s"}\u2026`);
+  if (needHash.length) p?.phase(`Hashing ${needHash.length} file${needHash.length === 1 ? "" : "s"}...`);
   await ensureLocalHashes(root, local, needHash);
   const planned = plan(local, remote, baseline.files);
   if (opts.plan) {
@@ -33631,13 +33735,13 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
         if (buf) downloadedBytes.set(a.path, buf);
       }
     } catch (err) {
-      errors.push(`Bulk download incomplete (${err.message}); recovering files individually\u2026`);
+      errors.push(`Bulk download incomplete (${err.message}); recovering files individually...`);
     } finally {
       p?.finish();
     }
     const missing = wantedDownloads.filter((a) => !downloadedBytes.has(a.path));
     if (missing.length) {
-      p?.phase(`Recovering ${missing.length} file${missing.length === 1 ? "" : "s"} the bulk download dropped\u2026`);
+      p?.phase(`Recovering ${missing.length} file${missing.length === 1 ? "" : "s"} the bulk download dropped...`);
       for (const a of missing) {
         const expectedSha = remote.get(a.path)?.sha256 ?? void 0;
         let buf = null;
@@ -33679,7 +33783,7 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
     if (currentBytes) {
       mkdirSync4(dirname4(full), { recursive: true });
       writeFileSync5(full, currentBytes);
-      const stat2 = statSync(full);
+      const stat2 = statSync2(full);
       baseline.files[a.path] = {
         size: stat2.size,
         mtime: stat2.mtime.toISOString(),
@@ -33695,12 +33799,12 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
         renamedRel,
         { expectedServerVersion: null }
       );
-      const stat2 = statSync(renamedFull);
-      const { sha256: sha2562 } = await hashFile(renamedFull);
+      const stat2 = statSync2(renamedFull);
+      const { sha256 } = await hashFile(renamedFull);
       baseline.files[renamedRel] = {
         size: stat2.size,
         mtime: stat2.mtime.toISOString(),
-        sha256: sha2562,
+        sha256,
         serverVersion: result.serverVersion
       };
     } catch (e) {
@@ -33736,7 +33840,7 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
     }
     mkdirSync4(dirname4(full), { recursive: true });
     writeFileSync5(full, buf);
-    const stat2 = statSync(full);
+    const stat2 = statSync2(full);
     local.set(a.path, { size: stat2.size, mtime: stat2.mtime.toISOString(), sha256: void 0 });
     baseline.files[a.path] = {
       size: stat2.size,
@@ -33767,7 +33871,7 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
     if (buf) {
       mkdirSync4(dirname4(full), { recursive: true });
       writeFileSync5(full, buf);
-      const stat2 = statSync(full);
+      const stat2 = statSync2(full);
       baseline.files[a.path] = {
         size: stat2.size,
         mtime: stat2.mtime.toISOString(),
@@ -33781,12 +33885,12 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
       const result = await uploadOneFile(config.projectGuid, renamed, a.renamedLocalTo, {
         expectedServerVersion: null
       });
-      const stat2 = statSync(renamed);
-      const { sha256: sha2562 } = await hashFile(renamed);
+      const stat2 = statSync2(renamed);
+      const { sha256 } = await hashFile(renamed);
       baseline.files[a.renamedLocalTo] = {
         size: stat2.size,
         mtime: stat2.mtime.toISOString(),
-        sha256: sha2562,
+        sha256,
         serverVersion: result.serverVersion
       };
     } catch (err) {
@@ -33820,14 +33924,14 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
         continue;
       }
       try {
-        const stat2 = statSync(full);
+        const stat2 = statSync2(full);
         if (stat2.size > UPLOAD_MAX_BYTES) {
           errors.push(`Upload failed for ${a.path}: file exceeds the 30 GB upload limit`);
           onBytes?.(a.localSize ?? 0);
           continue;
         }
-        const sha2562 = local.get(a.path)?.sha256 ?? (await hashFile(full)).sha256;
-        prepared.push({ a, full, size: stat2.size, mtime: stat2.mtime.toISOString(), sha256: sha2562 });
+        const sha256 = local.get(a.path)?.sha256 ?? (await hashFile(full)).sha256;
+        prepared.push({ a, full, size: stat2.size, mtime: stat2.mtime.toISOString(), sha256 });
       } catch (e) {
         errors.push(`Upload failed for ${a.path}: ${e.message}`);
         onBytes?.(a.localSize ?? 0);
@@ -33974,13 +34078,13 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
             const full = resolveInRoot(root, a.path);
             mkdirSync4(dirname4(full), { recursive: true });
             writeFileSync5(full, buf);
-            const stat2 = statSync(full);
-            const { sha256: sha2562 } = await hashFile(full);
+            const stat2 = statSync2(full);
+            const { sha256 } = await hashFile(full);
             const current = typeof err.data?.current_server_version === "number" ? err.data.current_server_version : null;
             baseline.files[a.path] = {
               size: stat2.size,
               mtime: stat2.mtime.toISOString(),
-              sha256: sha2562,
+              sha256,
               serverVersion: current ?? a.expectedServerVersion ?? 0
             };
             errors.push(`Could not delete ${a.path}: server has a newer version - restored the server copy locally (delete it again and re-sync to confirm)`);
@@ -34024,7 +34128,7 @@ async function syncInner(projectGuid, root, ignore2, opts, interactive) {
 function cleanupEmptyDirs(root, emptiedDirs) {
   const isEmpty = (dir) => {
     try {
-      return readdirSync3(dir).length === 0;
+      return readdirSync4(dir).length === 0;
     } catch {
       return false;
     }
@@ -34059,12 +34163,12 @@ async function pushFile(filePath) {
     const result = await uploadOneFile(config.projectGuid, filePath, rel2, {
       expectedServerVersion: baseEntry ? baseEntry.serverVersion : null
     });
-    const stat2 = statSync(filePath);
-    const { sha256: sha2562 } = await hashFile(filePath);
+    const stat2 = statSync2(filePath);
+    const { sha256 } = await hashFile(filePath);
     baseline.files[rel2] = {
       size: stat2.size,
       mtime: stat2.mtime.toISOString(),
-      sha256: sha2562,
+      sha256,
       serverVersion: result.serverVersion
     };
     writeBaseline(baseline);
@@ -34251,6 +34355,89 @@ async function syncBeforeAction(opts) {
   }
 }
 
+// src/helpers/body.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+function readStdin() {
+  if (process.stdin.isTTY) return "";
+  try {
+    return readFileSync8(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function readFileField(spec) {
+  const eq2 = spec.indexOf("=");
+  if (eq2 === -1) {
+    throw new Error(`Invalid --file '${spec}': expected field=@path (e.g. --file image=@receipt.png).`);
+  }
+  const field = spec.slice(0, eq2).trim();
+  let path5 = spec.slice(eq2 + 1);
+  if (path5.startsWith("@")) path5 = path5.slice(1);
+  if (!field) throw new Error(`Invalid --file '${spec}': missing field name before '='.`);
+  if (!path5) throw new Error(`Invalid --file '${spec}': missing file path after '='.`);
+  try {
+    return [field, { data: readFileSync8(path5).toString("base64"), media_type: guessMime(path5) }];
+  } catch (e) {
+    throw new Error(`Cannot read --file '${path5}': ${e.message}`);
+  }
+}
+function resolveBody(raw, fileSpecs) {
+  const body = resolveJsonBody(raw);
+  if (!fileSpecs || fileSpecs.length === 0) return body;
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    throw new Error("--file needs an object body to attach into (got a non-object JSON body).");
+  }
+  const obj = body;
+  for (const spec of fileSpecs) {
+    const [field, attachment] = readFileField(spec);
+    obj[field] = attachment;
+  }
+  return obj;
+}
+function resolveJsonBody(raw) {
+  if (raw == null || raw === "") return {};
+  let source;
+  let origin;
+  if (raw === "-" || raw === "@-") {
+    source = readStdin();
+    origin = "stdin";
+    if (source.trim() === "") {
+      throw new Error("No JSON on stdin (pipe a body in, e.g. `cat body.json | gipity fn call foo -d -`).");
+    }
+  } else if (raw.startsWith("@")) {
+    const path5 = raw.slice(1);
+    try {
+      source = readFileSync8(path5, "utf-8");
+    } catch (e) {
+      throw new Error(`Cannot read body file '${path5}': ${e.message}`);
+    }
+    origin = `file '${path5}'`;
+  } else {
+    source = raw;
+    origin = "inline JSON";
+  }
+  try {
+    return JSON.parse(source);
+  } catch (e) {
+    throw new Error(`Invalid JSON in ${origin}: ${e.message}`);
+  }
+}
+
+// src/helpers/duration.ts
+var UNIT_TO_MS = { ms: 1, s: 1e3, m: 6e4 };
+function parseDuration(raw, unit) {
+  if (raw === void 0) return null;
+  const m = raw.trim().match(/^(\d+(?:\.\d+)?)\s*(ms|s|m)?$/i);
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  if (!Number.isFinite(n)) return null;
+  const suffix = m[2]?.toLowerCase();
+  if (!suffix) return { value: n, hadSuffix: false };
+  const ms2 = n * UNIT_TO_MS[suffix];
+  const value = unit === "ms" ? ms2 : ms2 / 1e3;
+  return { value, hadSuffix: true };
+}
+
 // src/commands/token.ts
 var tokenCommand = new Command("token").description("Manage API tokens").addHelpText("after", "\nLong-lived agent API tokens (gip_at_*) for headless agents and CI.");
 var fmtDate = (d) => d ? new Date(d).toLocaleDateString() : "never";
@@ -34301,23 +34488,23 @@ tokenCommand.command("revoke <short_guid>").alias("rm").description("Revoke an a
 init_api();
 init_config();
 init_auth();
-import { basename, resolve as resolve7, dirname as dirname5 } from "path";
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { basename as basename2, resolve as resolve7, dirname as dirname5 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
 init_colors();
 init_utils();
 
 // src/adopt-cwd.ts
 init_api();
-import { readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join8, resolve as resolve6, sep as sep2, parse as parsePath } from "path";
+import { readdirSync as readdirSync6, statSync as statSync4 } from "fs";
+import { join as join9, resolve as resolve6, sep as sep2, parse as parsePath } from "path";
 import { homedir as homedir6 } from "os";
 
 // src/project-setup.ts
 init_config();
 
 // src/template-vars.ts
-import { promises as fs, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
-import { join as join5, relative as relative2, extname as extname3 } from "path";
+import { promises as fs, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { join as join6, relative as relative2, extname as extname3 } from "path";
 var SUBSTITUTABLE_EXTS = /* @__PURE__ */ new Set([
   ".html",
   ".htm",
@@ -34383,18 +34570,18 @@ function* walkTextFiles(root) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = readdirSync4(dir, { withFileTypes: true });
+      entries = readdirSync5(dir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (isSyncIgnored(entry.name)) continue;
-      const full = join5(dir, entry.name);
+      const full = join6(dir, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile()) {
         try {
-          if (!statSync2(full).isFile()) continue;
+          if (!statSync3(full).isFile()) continue;
         } catch {
           continue;
         }
@@ -34411,7 +34598,7 @@ async function substituteDir(dir, vars) {
   for (const rel2 of walkTextFiles(dir)) {
     const ext = extname3(rel2).toLowerCase();
     if (!SUBSTITUTABLE_EXTS.has(ext)) continue;
-    const abs = join5(dir, rel2);
+    const abs = join6(dir, rel2);
     let content;
     try {
       content = await fs.readFile(abs, "utf-8");
@@ -34477,18 +34664,18 @@ async function finalizeLocalProject(opts) {
 }
 
 // src/relay/paths.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join6, resolve as resolve5 } from "path";
+import { join as join7, resolve as resolve5 } from "path";
 function getProjectsRoot() {
-  const settingsPath = join6(homedir4(), ".gipity", "settings.json");
-  const defaultDir = join6(homedir4(), "GipityProjects");
+  const settingsPath = join7(homedir4(), ".gipity", "settings.json");
+  const defaultDir = join7(homedir4(), "GipityProjects");
   try {
     if (existsSync6(settingsPath)) {
-      const settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync9(settingsPath, "utf-8"));
       if (settings.projectsDir) return resolve5(settings.projectsDir);
     } else {
-      mkdirSync5(join6(homedir4(), ".gipity"), { recursive: true });
+      mkdirSync5(join7(homedir4(), ".gipity"), { recursive: true });
       writeFileSync6(settingsPath, JSON.stringify({ projectsDir: defaultDir }, null, 2) + "\n");
     }
   } catch {
@@ -34497,11 +34684,11 @@ function getProjectsRoot() {
 }
 
 // src/relay/state.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync7, chmodSync as chmodSync2, unlinkSync as unlinkSync4 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6, existsSync as existsSync7, chmodSync as chmodSync2, unlinkSync as unlinkSync4 } from "fs";
+import { join as join8 } from "path";
 import { homedir as homedir5 } from "os";
-var RELAY_DIR = process.env.GIPITY_DIR || join7(homedir5(), ".gipity");
-var RELAY_FILE = join7(RELAY_DIR, "relay.json");
+var RELAY_DIR = process.env.GIPITY_DIR || join8(homedir5(), ".gipity");
+var RELAY_FILE = join8(RELAY_DIR, "relay.json");
 var FILE_MODE = 384;
 function emptyState() {
   return { device: null, paused: false };
@@ -34509,7 +34696,7 @@ function emptyState() {
 function loadState() {
   if (!existsSync7(RELAY_FILE)) return emptyState();
   try {
-    const raw = JSON.parse(readFileSync8(RELAY_FILE, "utf-8"));
+    const raw = JSON.parse(readFileSync10(RELAY_FILE, "utf-8"));
     return {
       device: raw.device ?? null,
       paused: Boolean(raw.paused),
@@ -34594,7 +34781,7 @@ function diagnosticsConsented() {
   if (env && env !== "0" && env.toLowerCase() !== "false") return false;
   return loadState().diagnostics_consent !== false;
 }
-var RELAY_PID_FILE = join7(RELAY_DIR, "relay.pid");
+var RELAY_PID_FILE = join8(RELAY_DIR, "relay.pid");
 function getDaemonPidPath() {
   return RELAY_PID_FILE;
 }
@@ -34611,7 +34798,7 @@ function clearDaemonPid() {
 function isDaemonRunning() {
   if (!existsSync7(RELAY_PID_FILE)) return false;
   try {
-    const raw = readFileSync8(RELAY_PID_FILE, "utf-8").trim();
+    const raw = readFileSync10(RELAY_PID_FILE, "utf-8").trim();
     const pid = parseInt(raw, 10);
     if (!pid || isNaN(pid)) {
       try {
@@ -34651,17 +34838,17 @@ function scanForAdoption(cwd) {
     if (truncated) return;
     let entries;
     try {
-      entries = readdirSync5(dir);
+      entries = readdirSync6(dir);
     } catch {
       return;
     }
     for (const name of entries) {
       if (truncated) return;
       if (isSyncIgnored(name)) continue;
-      const full = join8(dir, name);
+      const full = join9(dir, name);
       let st2;
       try {
-        st2 = statSync3(full);
+        st2 = statSync4(full);
       } catch {
         continue;
       }
@@ -34687,7 +34874,7 @@ function scanForAdoption(cwd) {
 function isLikelyEmpty(cwd) {
   let entries;
   try {
-    entries = readdirSync5(cwd);
+    entries = readdirSync6(cwd);
   } catch {
     return true;
   }
@@ -34725,18 +34912,18 @@ function canAdoptCwd(cwd) {
 function countGitRepoChildren(dir) {
   let entries;
   try {
-    entries = readdirSync5(dir);
+    entries = readdirSync6(dir);
   } catch {
     return 0;
   }
   let count = 0;
   for (const name of entries.slice(0, 50)) {
     if (name.startsWith(".")) continue;
-    const child = join8(dir, name);
+    const child = join9(dir, name);
     try {
-      if (!statSync3(child).isDirectory()) continue;
-      const gitPath = join8(child, ".git");
-      if (statSync3(gitPath)) count++;
+      if (!statSync4(child).isDirectory()) continue;
+      const gitPath = join9(child, ".git");
+      if (statSync4(gitPath)) count++;
     } catch {
     }
     if (count >= 3) return count;
@@ -34750,7 +34937,7 @@ function formatCwdLabel(cwd) {
   if (norm.startsWith(home + sep2)) {
     const tail = norm.slice(home.length + 1).split(sep2);
     if (tail.length <= 2) return "~/" + tail.join("/");
-    return "~/\u2026/" + tail.slice(-2).join("/");
+    return "~/.../" + tail.slice(-2).join("/");
   }
   const parts = norm.split(sep2).filter(Boolean);
   if (parts.length <= 1) return norm;
@@ -34915,7 +35102,7 @@ Working with an existing Gipity project:
         process.exit(1);
       }
     }
-    const projectName = (name || basename(cwd)).slice(0, 100);
+    const projectName = (name || basename2(cwd)).slice(0, 100);
     const projectSlug = slugify(projectName);
     if (!projectSlug) {
       console.error(error("Could not derive a valid project slug. Provide a name: gipity init my-app"));
@@ -34957,7 +35144,7 @@ Working with an existing Gipity project:
     if (adopted.applied > 0) console.log(`Synced ${adopted.applied} change${adopted.applied > 1 ? "s" : ""} with Gipity.`);
     if (opts.capture === false) {
       try {
-        const cfg = JSON.parse(readFileSync9(resolve7(cwd, ".gipity.json"), "utf-8"));
+        const cfg = JSON.parse(readFileSync11(resolve7(cwd, ".gipity.json"), "utf-8"));
         cfg.captureHooks = false;
         saveConfigAt(cwd, cfg);
       } catch {
@@ -34991,15 +35178,15 @@ init_auth();
 init_api();
 init_config();
 init_colors();
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
-import { join as join9, resolve as resolve8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync12 } from "fs";
+import { join as join10, resolve as resolve8 } from "path";
 import { homedir as homedir7 } from "os";
 function checkGipityPlugin() {
-  const path5 = join9(homedir7(), ".claude", "settings.json");
+  const path5 = join10(homedir7(), ".claude", "settings.json");
   let settings = {};
   if (existsSync9(path5)) {
     try {
-      settings = JSON.parse(readFileSync10(path5, "utf-8"));
+      settings = JSON.parse(readFileSync12(path5, "utf-8"));
     } catch {
     }
   }
@@ -35012,12 +35199,14 @@ function checkGipityPlugin() {
   return { missing, ok: missing.length === 0, stale };
 }
 async function probeAuth(loggedIn) {
-  if (!loggedIn && !usingEnvToken()) return "none";
-  if (!usingEnvToken() && sessionExpired()) return "expired";
-  const timeout = new Promise((res) => setTimeout(() => res("unreachable"), 5e3).unref?.());
+  if (!loggedIn && !usingEnvToken()) return { state: "none", account: null };
+  if (!usingEnvToken() && sessionExpired()) return { state: "expired", account: null };
+  const timeout = new Promise(
+    (res) => setTimeout(() => res({ state: "unreachable", account: null }), 5e3).unref?.()
+  );
   const call = get("/users/me").then(
-    () => "ok",
-    (err) => err instanceof ApiError && err.statusCode === 401 ? "rejected" : "unreachable"
+    (res) => ({ state: "ok", account: res.data?.accountSlug ?? null }),
+    (err) => ({ state: err instanceof ApiError && err.statusCode === 401 ? "rejected" : "unreachable", account: null })
   );
   return Promise.race([call, timeout]);
 }
@@ -35029,6 +35218,8 @@ var statusCommand = new Command("status").alias("whoami").description("Show proj
   const hookCheck = config ? checkGipityPlugin() : null;
   const queueDelivered = auth && !sessionExpired() ? await flushBugQueue().catch(() => 0) : 0;
   const probe = await probeAuth(!!auth);
+  const accountMismatch = probe.state === "ok" && !!config && !!probe.account && probe.account !== config.accountSlug;
+  const apiBaseInUse = resolveApiBase();
   if (opts.json) {
     console.log(JSON.stringify({
       project: config ? {
@@ -35036,17 +35227,21 @@ var statusCommand = new Command("status").alias("whoami").description("Show proj
         slug: config.projectSlug,
         account: config.accountSlug,
         apiBase: config.apiBase,
+        apiBaseInUse,
         url: liveUrl(config)
       } : null,
       // `valid` reflects the refresh token (the real session) - access
       // tokens auto-renew, so their expiry must not read as "invalid".
       // `probe` is what one live call just proved: 'rejected' means every
       // authenticated command will fail even though `valid` reads true.
+      // 'mismatch' overrides 'ok' when the live account isn't the one that
+      // owns this project - `valid` still reads true (the token IS valid).
       auth: auth || usingEnvToken() ? {
         email: auth?.email,
+        account: probe.account,
         source: usingEnvToken() ? "agent-token" : "session",
-        valid: usingEnvToken() ? probe !== "rejected" : !sessionExpired(),
-        probe
+        valid: usingEnvToken() ? probe.state !== "rejected" : !sessionExpired(),
+        probe: accountMismatch ? "mismatch" : probe.state
       } : null,
       plugin: hookCheck
     }, null, 2));
@@ -35059,18 +35254,25 @@ var statusCommand = new Command("status").alias("whoami").description("Show proj
     console.log(`${muted("Account:")} ${config.accountSlug}`);
     console.log(`${muted("Live:")} ${liveUrl(config)}`);
     console.log(`${muted("API:")} ${config.apiBase}`);
+    if (apiBaseInUse !== config.apiBase) {
+      console.log(`${muted("API (in use):")} ${warning(apiBaseInUse)} ${muted("(overrides .gipity.json \u2014 GIPITY_API_BASE / --api-base / allowlist)")}`);
+    }
     if (config.agentGuid) console.log(`${muted("Agent:")} ${config.agentGuid}`);
   }
   if (usingEnvToken()) {
-    console.log(`${muted("Auth:")} ${probe === "rejected" ? warning("agent API token (GIPITY_TOKEN) rejected by the server \u2014 mint a new one: gipity skill read agent-deploy") : success("agent API token (GIPITY_TOKEN)")}${probe === "unreachable" ? ` ${muted("(unverified \u2014 API unreachable)")}` : ""}`);
+    console.log(`${muted("Auth:")} ${probe.state === "rejected" ? warning("agent API token (GIPITY_TOKEN) rejected by the server \u2014 mint a new one: gipity skill read agent-deploy") : success("agent API token (GIPITY_TOKEN)")}${probe.state === "unreachable" ? ` ${muted("(unverified \u2014 API unreachable)")}` : ""}`);
   } else if (!auth) {
     console.log(`${muted("Auth:")} ${warning("not logged in. Run: gipity login")}`);
-  } else if (probe === "expired") {
+  } else if (probe.state === "expired") {
     console.log(`${muted("Auth:")} ${warning(`session expired for ${auth.email}. Run: gipity login (headless/CI: set GIPITY_TOKEN \u2014 gipity skill read agent-deploy)`)}`);
-  } else if (probe === "rejected") {
+  } else if (probe.state === "rejected") {
     console.log(`${muted("Auth:")} ${warning(`session for ${auth.email} was rejected by the server. Run: gipity login (headless/CI: set GIPITY_TOKEN \u2014 gipity skill read agent-deploy)`)}`);
   } else {
-    console.log(`${muted("Auth:")} ${success(auth.email)}${probe === "unreachable" ? ` ${muted("(unverified \u2014 API unreachable)")}` : ""}`);
+    console.log(`${muted("Auth:")} ${success(auth.email)}${probe.state === "unreachable" ? ` ${muted("(unverified \u2014 API unreachable)")}` : ""}`);
+  }
+  if (accountMismatch) {
+    console.log(`${muted("Account:")} ${warning(`logged-in account (${probe.account}) differs from this project's account (${config.accountSlug}). If you didn't expect this you may be logged into the wrong account \u2014 run: gipity login`)}`);
+    console.log(muted("(If this project was shared with you via gipity rbac, this is expected.)"));
   }
   if (queueDelivered > 0) {
     console.log(`${muted("Bug queue:")} ${success(`delivered ${queueDelivered} queued bug report${queueDelivered === 1 ? "" : "s"}`)}`);
@@ -35101,7 +35303,10 @@ var statusCommand = new Command("status").alias("whoami").description("Show proj
 });
 
 // src/commands/sync.ts
+import { dirname as dirname6 } from "node:path";
 init_colors();
+init_utils();
+init_config();
 var syncCommand = new Command("sync").description("Sync files").addHelpText("after", "\nAdd a .gipityignore at the project root to exclude paths (gitignore-style).").option("--plan", "Print the plan without applying any changes").option("--force", "Bypass the bulk-deletion guard").option("--prune", "Remove files that exist on Gipity but not locally (applies the bulk deletes the guard defers)").option("--json", "Output as JSON").action(async (opts) => {
   try {
     const progress = opts.json ? void 0 : createProgressReporter();
@@ -35114,6 +35319,16 @@ var syncCommand = new Command("sync").description("Sync files").addHelpText("aft
         console.log(`
 ${result.applied} action${result.applied > 1 ? "s" : ""} applied.`);
       }
+      if (isWsl()) {
+        const configPath = getConfigPath();
+        const twin = configPath ? findWindowsTwinProject(dirname6(configPath)) : null;
+        if (twin) {
+          console.log(muted(
+            `
+Note: a Windows-side copy of this project exists at ${wslPathToWindows(twin)} and is NOT synced. If you added files there, move them into this folder so they sync.`
+          ));
+        }
+      }
       if (result.deferredDeletes > 0) {
         console.log(muted(
           `
@@ -35159,106 +35374,60 @@ var pushCommand = new Command("push").description("Push one or more files").argu
 });
 
 // src/commands/upload.ts
+init_api();
 init_config();
-import { statSync as statSync4, readdirSync as readdirSync6 } from "fs";
-import { join as join10, basename as basename2, posix, resolve as resolve10, dirname as dirname6 } from "path";
+import { statSync as statSync5 } from "fs";
+import { basename as basename3 } from "path";
 init_utils();
 init_colors();
-function walkFiles(root) {
-  const out = [];
-  const stack = [root];
-  while (stack.length) {
-    const dir = stack.pop();
-    for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-      const full = join10(dir, entry.name);
-      if (entry.isDirectory()) stack.push(full);
-      else if (entry.isFile()) out.push(full);
-    }
-  }
-  return out;
-}
-function destFor(localFile, srcRoot, destRoot) {
-  const rel2 = localFile.slice(srcRoot.length).replace(/\\/g, "/").replace(/^\/+/, "");
-  return posix.join(destRoot.replace(/\\/g, "/").replace(/\/$/, ""), rel2);
-}
-var uploadCommand = new Command("upload").description("Upload files").argument("<src>", "Local source file or directory").argument("[dest]", "Destination path in the project (defaults to /)").option("-r, --recursive", "Upload a directory recursively").option("--mime <type>", "Override the content-type (default: detect from extension)").option("--concurrency <n>", `Parallel files (default ${UPLOAD_CONCURRENCY})`).option("--dry-run", "Print what would be uploaded; do not call the network").option("--project <guid-or-slug>", "Target a specific project instead of cwd / Home").action(async (src, destArg, opts) => {
+var uploadCommand = new Command("upload").description(`Upload a local file and print a durable, worker-reachable URL for it.
+
+The URL works immediately - no \`gipity deploy\` - and any job or function can
+fetch it. Use it to hand a GPU/CPU job a real input file when testing end-to-end:
+
+  gipity upload song.mp3
+  gipity job submit split-stems --data '{"audio_url":"<printed url>"}'
+
+By default the file is PUBLIC: a plain \`media.gipity.ai\` CDN url that resolves
+from anywhere, so a cloud worker can always fetch it. Pass --private for a
+token-signed serve url instead (reachable only by holders of the url).`).argument("<file>", "Local file to upload").option("--private", "Store as a private token-signed serve URL instead of a public CDN url").option("--content-type <mime>", "Override the content type (default: detected from the file extension)").option("--json", "Output as JSON").action((file, opts) => run("Upload", async () => {
+  const { config } = await resolveProjectContext();
+  let size;
   try {
-    const { config } = await resolveProjectContext({ projectOverride: opts.project });
-    const dest = destArg ?? "/";
-    const srcStat = statSync4(src);
-    const planned = [];
-    if (srcStat.isDirectory()) {
-      if (!opts.recursive) {
-        throw new Error(`${src} is a directory - pass -r/--recursive to upload it`);
-      }
-      const srcAbs = resolve10(src);
-      const sliceRoot = dirname6(srcAbs);
-      for (const file of walkFiles(src)) {
-        planned.push({
-          localPath: file,
-          virtualPath: destFor(resolve10(file), sliceRoot, dest),
-          size: statSync4(file).size
-        });
-      }
-    } else if (srcStat.isFile()) {
-      const looksLikeDir = dest.endsWith("/") || opts.recursive === true;
-      const virtualPath = looksLikeDir ? posix.join(dest.replace(/\/$/, ""), basename2(src)) : dest;
-      planned.push({ localPath: src, virtualPath, size: srcStat.size });
-    } else {
-      throw new Error(`${src} is neither a regular file nor a directory`);
-    }
-    if (planned.length === 0) {
-      console.log("Nothing to upload (0 files).");
-      return;
-    }
-    const totalBytes = planned.reduce((s, f) => s + f.size, 0);
-    console.log(`Plan: ${planned.length} file${planned.length > 1 ? "s" : ""}, ${formatSize(totalBytes)}`);
-    for (const f of planned) {
-      console.log(`${f.localPath} ${dim("\u2192")} ${f.virtualPath} (${formatSize(f.size)})`);
-    }
-    if (opts.dryRun) {
-      console.log("\n--dry-run: skipping all network calls.");
-      return;
-    }
-    const concurrency = Math.max(1, parseInt(opts.concurrency ?? String(UPLOAD_CONCURRENCY), 10));
-    const uploadOpts = { mime: opts.mime };
-    let cursor = 0;
-    let uploaded = 0, skipped = 0, resumed = 0, failed = 0;
-    const workers = [];
-    for (let w = 0; w < Math.min(concurrency, planned.length); w++) {
-      workers.push((async () => {
-        while (true) {
-          const idx = cursor++;
-          if (idx >= planned.length) return;
-          const f = planned[idx];
-          try {
-            const result = await uploadOneFile(config.projectGuid, f.localPath, f.virtualPath, uploadOpts);
-            if (result.status === "skipped") {
-              skipped++;
-              console.log(`${dim("skip")} ${f.virtualPath} (already current)`);
-            } else if (result.status === "resumed") {
-              resumed++;
-              console.log(`${dim("resumed")} ${f.virtualPath} v${result.version}`);
-            } else {
-              uploaded++;
-              console.log(`${dim("uploaded")} ${f.virtualPath} v${result.version}`);
-            }
-          } catch (err) {
-            failed++;
-            console.error(error(`  fail ${f.virtualPath}: ${err.message}`));
-          }
-        }
-      })());
-    }
-    await Promise.all(workers);
-    console.log(`
-Uploaded: ${uploaded}, Resumed: ${resumed}, Skipped: ${skipped}, Failed: ${failed}`);
-    if (failed > 0) process.exit(1);
+    const st2 = statSync5(file);
+    if (!st2.isFile()) throw new Error("not a regular file");
+    size = st2.size;
   } catch (err) {
-    console.error(error(`Upload failed: ${err.message}`));
-    process.exit(1);
+    throw new Error(`can't read ${file}: ${err.message}`);
+  }
+  if (size === 0) throw new Error(`${file} is empty - nothing to upload.`);
+  const filename = basename3(file);
+  const contentType = opts.contentType || guessMime(file);
+  const doUpload = async () => {
+    const init = await post(`/api/${config.projectGuid}/uploads/init`, {
+      filename,
+      content_type: contentType,
+      size,
+      public: !opts.private
+    });
+    const fields = await transferToS3(file, size, contentType, init.data);
+    const completeBody = {
+      upload_guid: init.data.upload_guid
+    };
+    if ("parts" in fields) completeBody.parts = fields.parts;
+    const comp = await post(`/api/${config.projectGuid}/uploads/complete`, completeBody);
+    return comp.data;
+  };
+  const data = opts.json ? await doUpload() : await withSpinner(`Uploading ${filename} (${formatSize(size)})...`, doUpload, { done: null });
+  if (opts.json) {
+    console.log(JSON.stringify(data));
+    return;
   }
-});
+  console.log(success(`Uploaded ${data.name} (${formatSize(data.size)})`));
+  console.log(`  ${brand(data.url)}`);
+  console.log(muted(`  Durable, worker-reachable URL - pass it straight to a job/function as an input URL.`));
+  console.log(muted(`  ${data.is_public ? "public (CDN)" : "private (token-signed)"} \xB7 guid: ${data.guid}`));
+}));
 
 // src/commands/deploy.ts
 init_api();
@@ -35273,7 +35442,7 @@ init_colors();
 init_auth();
 
 // src/commands/page-eval.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 init_api();
 init_colors();
 init_auth();
@@ -35282,8 +35451,8 @@ init_config();
 // src/page-fixtures.ts
 init_api();
 init_config();
-import { readFileSync as readFileSync11, statSync as statSync5, existsSync as existsSync10, readdirSync as readdirSync7 } from "node:fs";
-import { basename as basename3, resolve as resolve11, relative as relative3, join as join11 } from "node:path";
+import { readFileSync as readFileSync13, statSync as statSync6, existsSync as existsSync10, readdirSync as readdirSync7 } from "node:fs";
+import { basename as basename4, resolve as resolve10, relative as relative3, join as join11 } from "node:path";
 var FIND_SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", ".gipity", "dist", "build", ".next", "coverage"]);
 function findByBasename(root, name, limit = 3) {
   const hits = [];
@@ -35309,22 +35478,22 @@ function findByBasename(root, name, limit = 3) {
   return hits;
 }
 function assertLocalAsset(flag, localPath) {
-  const abs = resolve11(localPath);
+  const abs = resolve10(localPath);
   if (existsSync10(abs)) return;
   const root = getProjectRoot() ?? process.cwd();
-  const elsewhere = findByBasename(root, basename3(localPath)).filter((p) => p !== abs);
+  const elsewhere = findByBasename(root, basename4(localPath)).filter((p) => p !== abs);
   const found = elsewhere.length ? `
 That file DOES exist here \u2014 pass this path instead:
 ${elsewhere.map((p) => `  ${flag} ${relative3(process.cwd(), p) || p}`).join("\n")}` : `
-Nothing named "${basename3(localPath)}" under ${root} either. Generate a frame with \`gipity generate image "<description>" -o ${localPath}\`, or check the path.`;
+Nothing named "${basename4(localPath)}" under ${root} either. Generate a frame with \`gipity generate image "<description>" -o ${localPath}\`, or check the path.`;
   throw new Error(
     `${flag} ${localPath}: no such file \u2014 looked for ${abs} (relative paths resolve against the current directory, ${process.cwd()}).${found}`
   );
 }
 async function uploadPublicFixture(projectGuid, localPath, flag = "--fixture") {
   assertLocalAsset(flag, localPath);
-  const name = basename3(localPath);
-  const size = statSync5(localPath).size;
+  const name = basename4(localPath);
+  const size = statSync6(localPath).size;
   const contentType = guessMime(localPath);
   const init = await post(
     `/api/${projectGuid}/uploads/init`,
@@ -35336,7 +35505,7 @@ async function uploadPublicFixture(projectGuid, localPath, flag = "--fixture") {
   const res = await fetch(init.data.url, {
     method: "PUT",
     headers: { "Content-Type": contentType },
-    body: readFileSync11(localPath)
+    body: readFileSync13(localPath)
   });
   if (!res.ok) {
     throw new Error(`upload of fixture "${name}" failed: ${res.status} ${res.statusText}`);
@@ -35356,7 +35525,7 @@ function assertCameraFile(localPath) {
   const ext = localPath.slice(localPath.lastIndexOf(".")).toLowerCase();
   if (CAMERA_EXTS.includes(ext)) return;
   throw new Error(
-    `--camera ${basename3(localPath)}: unsupported file type "${ext || "(none)"}" \u2014 the camera feed must be an image or video (${CAMERA_EXTS.join(", ")}).
+    `--camera ${basename4(localPath)}: unsupported file type "${ext || "(none)"}" \u2014 the camera feed must be an image or video (${CAMERA_EXTS.join(", ")}).
 A still image is played as a looping single-frame feed, which is what a gesture/pose/object model needs.
 No frame to hand? Generate one: gipity generate image "a hand making a closed fist, palm to camera, plain background"`
   );
@@ -35409,7 +35578,7 @@ function summarizeExpr(expr) {
   const oneLine = meaningful.length <= 1;
   if (oneLine && expr.trim().length <= EXPR_ECHO_MAX_CHARS) return expr.trim();
   const first = (meaningful[0] ?? "").trim();
-  const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 1)}\u2026` : first;
+  const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 3)}...` : first;
   const shape = oneLine ? `(${expr.trim().length} chars)` : `(+${meaningful.length - 1} more ${meaningful.length - 1 === 1 ? "line" : "lines"}, ${expr.trim().length} chars)`;
   return `${head} ${shape}`;
 }
@@ -35435,6 +35604,9 @@ function capWaitForTimeoutMs(raw) {
   ));
   return WAIT_FOR_MAX_MS;
 }
+function readScriptFile(pathArg) {
+  return readFileSync14(pathArg === "-" ? 0 : pathArg, "utf8");
+}
 function parsesAsExpression(s) {
   try {
     new Function(`return (${s}
@@ -35455,6 +35627,7 @@ var CAMERA_SETUP_BUDGET_MS = 3e4;
 var EVAL_SCRIPT_BUDGET_MS = 3e4;
 var EVAL_SCRIPT_BUDGET_CAMERA_MS = 45e3;
 var EVAL_SCRIPT_BUDGET_MAX_MS = 9e4;
+var EVAL_SCRIPT_BUDGET_MIN_MS = 1e3;
 function capScriptBudgetMs(rawTimeout, hasMedia) {
   const fallback = hasMedia ? EVAL_SCRIPT_BUDGET_CAMERA_MS : EVAL_SCRIPT_BUDGET_MS;
   if (rawTimeout === void 0) return fallback;
@@ -35466,7 +35639,7 @@ function capScriptBudgetMs(rawTimeout, hasMedia) {
     ));
     return EVAL_SCRIPT_BUDGET_MAX_MS;
   }
-  return Math.max(1e3, parsed);
+  return Math.max(EVAL_SCRIPT_BUDGET_MIN_MS, parsed);
 }
 function evalWorkBudgetMs(o) {
   const script = o.scriptBudgetMs ?? (o.hasCamera ? EVAL_SCRIPT_BUDGET_CAMERA_MS : EVAL_SCRIPT_BUDGET_MS);
@@ -35528,14 +35701,14 @@ function evalExecTimeoutMessage(result, budgetMs) {
 If the slow part is a ONE-TIME page init (a WASM/model download, a big asset, a first-frame pipeline warm-up), do NOT split the body across several 'page eval' calls \u2014 every call is a fresh page load that re-pays that init, so each one hits this same wall. Have the page kick it off on load (not behind a click) and absorb it in the pre-eval window instead.`;
 }
 var JS_DECOY_FLAGS = ["--js", "--javascript", "--script", "--code", "--expr", "--eval", "--exec", "--action"];
-var pageEvalCommand = new Command("eval").description("Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead").argument("<url>", "URL to load").argument("[expr]", `JavaScript to evaluate in page context (inline expression or statement body; await works, and the trailing expression is returned automatically \u2014 REPL-style \u2014 so no explicit return is needed; result is JSON-serialized). Omit when using --file. Time budget: the body has ${EVAL_SCRIPT_BUDGET_MS / 1e3}s to finish after page load (${EVAL_SCRIPT_BUDGET_CAMERA_MS / 1e3}s with --camera) - raise it with --timeout, max ${EVAL_SCRIPT_BUDGET_MAX_MS / 1e3}s.`).option("--file <path>", `Read the script body from a file instead of the inline <expr> arg (mutually exclusive). Runs as an async function body, so top-level return/await work. Same post-load budget as <expr> (--timeout).`).option(
+var pageEvalCommand = new Command("eval").description("Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead").argument("<url>", "URL to load").argument("[expr]", `JavaScript to evaluate in page context (inline expression or statement body; await works, and the trailing expression is returned automatically \u2014 REPL-style \u2014 so no explicit return is needed; result is JSON-serialized). Omit when using --file. Time budget: the body has ${EVAL_SCRIPT_BUDGET_MS / 1e3}s to finish after page load (${EVAL_SCRIPT_BUDGET_CAMERA_MS / 1e3}s with --camera) - raise it with --timeout, max ${EVAL_SCRIPT_BUDGET_MAX_MS / 1e3}s.`).option("--file <path>", `Read the script body from a file instead of the inline <expr> arg (mutually exclusive), or --file - to read it from stdin (pipe a heredoc: --file - <<'EOF' ... EOF) with no tmp file. Runs as an async function body, so top-level return/await work. Same post-load budget as <expr> (--timeout).`).option(
   "--step <expr>",
   `Run another expression against the SAME loaded page, after <expr> (repeat, max ${MAX_EVAL_STEPS}). Whatever that page load paid for \u2014 a vision model coming up, a game booting, a socket connecting \u2014 stays up for every step, so an N-part check costs ONE page load instead of N. Each step gets its own in-page budget and its own reported result.`,
   (val, prev) => [...prev, val],
   []
 ).option(
   "--fixture <path>",
-  "Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. Repeat for several files (single-value so it never swallows the inline <expr>).",
+  'Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. The hosted URL has permissive CORS, so `new Image(); img.crossOrigin="anonymous"; img.src=fixtureUrl` decodes untainted for a canvas/pixel read - this is the UPLOAD analog of --camera: feed a known photo/video to a file-upload vision app (web-vision-detect) and run its detector, no need to deploy a throwaway test asset into the app. Repeat for several files (single-value so it never swallows the inline <expr>).',
   (val, prev) => [...prev, val],
   []
 ).option(
@@ -35546,7 +35719,7 @@ var pageEvalCommand = new Command("eval").description("Evaluate JS in a real bro
   `Play a local image or video (.png/.jpg/.webp/.mp4/.webm/.y4m/.mjpeg) as the browser's WEBCAM feed, so a camera app's real pipeline (getUserMedia \u2192 MediaPipe/YOLOX \u2192 your app logic) runs headlessly on a frame you choose. Implies --fake-media and waits ${CAMERA_DEFAULT_WAIT_MS / 1e3}s for the vision model to load. No frame handy? gipity generate image "a hand making a closed fist, palm to camera".`
 ).option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so a voice/camera app runs headlessly instead of hitting its no-camera path. The feed is a built-in test pattern (and a tone) \u2014 nothing a vision model can recognize; to drive a vision app use --camera <path> instead.").option("--wait <ms>", "Sleep this many ms after DOMContentLoaded before evaluating (lets late async work settle; max 30000). With --wait-for, it elapses AFTER the selector appears - gate, then settle.", "500").option("--wait-for <selector>", `Wait until this CSS selector appears before evaluating, then evaluate (deterministic - beats guessing a --wait). Gate on the state you are ASSERTING, not just a ready flag: '#verdict:not(:empty)' returns the instant the round lands, where a fixed wait snapshots mid-sequence. Same flag on page inspect/screenshot. Max ${WAIT_FOR_MAX_MS}ms (--wait-timeout).`).option("--wait-timeout <ms>", `Max ms to wait for --wait-for before giving up (max ${WAIT_FOR_MAX_MS})`, "5000").option(
   "--timeout <ms>",
-  `How long the script itself may run IN the page - its own await/setTimeout pauses count (default ${EVAL_SCRIPT_BUDGET_MS}, ${EVAL_SCRIPT_BUDGET_CAMERA_MS} with --camera/--fake-media; max ${EVAL_SCRIPT_BUDGET_MAX_MS}). Raise it to trace a sequence that unfolds over time (a game round, an animation). Distinct from --wait, which only sleeps BEFORE the script.`
+  `How long the script itself may run IN the page. Bare number = MILLISECONDS (so 90s = 90000, NOT 90); or pass an explicit unit that means the same on both this and \`sandbox run --timeout\` \u2014 --timeout 90s. Its own await/setTimeout pauses count (default ${EVAL_SCRIPT_BUDGET_MS}, ${EVAL_SCRIPT_BUDGET_CAMERA_MS} with --camera/--fake-media; floor 1000, max ${EVAL_SCRIPT_BUDGET_MAX_MS}). Raise it to trace a sequence that unfolds over time (a game round, an animation). Distinct from --wait, which only sleeps BEFORE the script.`
 ).option("--auth", "Evaluate signed in as you (your Gipity account), so a page behind a Sign-in-with-Gipity login is reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor \u2014 nothing carries over from earlier --auth runs.").option("--json", "Output as JSON").action((url, exprArg, opts) => run("Page eval", async () => {
   const decoy = JS_DECOY_FLAGS.find((f) => opts[f.slice(2)] !== void 0);
   if (decoy) {
@@ -35570,9 +35743,9 @@ var pageEvalCommand = new Command("eval").description("Evaluate JS in a real bro
   let expr = exprArg;
   if (opts.file) {
     try {
-      expr = readFileSync12(opts.file, "utf8");
+      expr = readScriptFile(opts.file);
     } catch {
-      pageEvalCommand.error(`error: Cannot read file: ${opts.file}`);
+      pageEvalCommand.error(opts.file === "-" ? `error: --file - reads the script from stdin, but stdin was empty/unreadable - pipe it in, e.g. gipity page eval "<url>" --file - <<'EOF' ... EOF` : `error: Cannot read file: ${opts.file}`);
     }
   }
   if (opts.reload !== void 0 && opts.reloadFile) {
@@ -35581,7 +35754,7 @@ var pageEvalCommand = new Command("eval").description("Evaluate JS in a real bro
   let reloadExpr = opts.reload;
   if (opts.reloadFile) {
     try {
-      reloadExpr = readFileSync12(opts.reloadFile, "utf8");
+      reloadExpr = readScriptFile(opts.reloadFile);
     } catch {
       pageEvalCommand.error(`error: Cannot read file: ${opts.reloadFile}`);
     }
@@ -35592,6 +35765,20 @@ var pageEvalCommand = new Command("eval").description("Evaluate JS in a real bro
       `error: at most ${MAX_EVAL_STEPS} --step expressions ride on one page load (got ${steps.length}) \u2014 do more per step, or split this into two evals`
     );
   }
+  if (opts.timeout !== void 0) {
+    const dur = parseDuration(opts.timeout, "ms");
+    if (dur?.hadSuffix) opts.timeout = String(Math.round(dur.value));
+  }
+  if (opts.timeout !== void 0) {
+    const t = parseInt(opts.timeout, 10);
+    if (Number.isFinite(t) && t > 0 && t < EVAL_SCRIPT_BUDGET_MIN_MS) {
+      const overMax = t * 1e3 > EVAL_SCRIPT_BUDGET_MAX_MS;
+      const asMs = Math.min(t * 1e3, EVAL_SCRIPT_BUDGET_MAX_MS);
+      throw new Error(
+        `--timeout is in MILLISECONDS (got ${t}, under the ${EVAL_SCRIPT_BUDGET_MIN_MS}ms in-page floor). Unlike \`sandbox run --timeout\` (seconds), page eval's is ms \u2014 or pass an explicit unit that means the same on both: --timeout ${t}s. ${t} looks like seconds, so for ${t} second${t === 1 ? "" : "s"} pass --timeout ${t}s (= ${asMs}ms)${overMax ? ` (${t}s is over the ${EVAL_SCRIPT_BUDGET_MAX_MS / 1e3}s max, so this is the ceiling)` : ""}.`
+      );
+    }
+  }
   let waitMs = capWaitMs(opts.wait, url);
   const waitForTimeoutMs = capWaitForTimeoutMs(opts.waitTimeout);
   const hasMedia = !!opts.camera || !!opts.fakeMedia;
@@ -35620,12 +35807,12 @@ var pageEvalCommand = new Command("eval").description("Evaluate JS in a real bro
       projectGuid = config.projectGuid;
     }
     if (opts.camera) {
-      console.log(muted(`Hosting camera feed ${opts.camera}\u2026`));
+      console.log(muted(`Hosting camera feed ${opts.camera}...`));
       camera = await uploadCameraFeed(projectGuid, opts.camera);
     }
     if (fixturePaths.length) {
       for (const p of fixturePaths) {
-        console.log(muted(`Hosting fixture ${p}\u2026`));
+        console.log(muted(`Hosting fixture ${p}...`));
         hosted.push(await uploadPublicFixture(projectGuid, p));
       }
       const map = {};
@@ -35706,7 +35893,7 @@ ${hint}`);
     }
     if (camera) console.log(`${muted("Camera:")} ${camera.name} ${muted("(played as the webcam feed; getUserMedia resolves)")}`);
     if (hosted.length) console.log(`${muted("Fixtures:")} ${hosted.map((h) => h.name).join(", ")}`);
-    console.error(opts.file ? `${muted("Script:")} ${opts.file}` : `${muted("Expression:")} ${summarizeExpr(expr)}`);
+    console.error(opts.file ? `${muted("Script:")} ${opts.file === "-" ? "(stdin)" : opts.file}` : `${muted("Expression:")} ${summarizeExpr(expr)}`);
     console.log(`
 ${result.trim() ? result : muted("(empty result)")}`);
     if (noValue) console.log(muted(`
@@ -35739,7 +35926,7 @@ ${bold("After reload")} ${muted("(page reloaded in place \u2014 storage preserve
   }
 }));
 for (const f of JS_DECOY_FLAGS) pageEvalCommand.addOption(new Option(`${f} <value>`).hideHelp());
-pageEvalCommand.addHelpText("after", `
+pageEvalCommand.addHelpText("after", (context) => context.error ? "" : `
 Examples:
   gipity page eval "https://dev.gipity.ai/me/app/" "document.title"
   # Functionally test a page's own code paths: save a script that drives the UI
@@ -35775,6 +35962,16 @@ Examples:
     "window.__vision.gesture()" \\
     --step "document.getElementById('see').textContent" \\
     --step "({ score: score.textContent, verdict: verdict.textContent })"
+  # File-UPLOAD vision app (web-vision-detect, no camera)? --fixture is the analog of
+  # --camera: it hosts your test photo at a CORS-permissive URL, so you feed the kit's
+  # detector a known image and read back the labels - no deploying a throwaway asset into
+  # the app tree (and no cleanup redeploy). crossOrigin='anonymous' keeps the canvas clean.
+  gipity generate image "street scene: three people, two cars, one dog" -o street.jpg
+  gipity page eval "https://dev.gipity.ai/me/app/" --fixture street.jpg \\
+    "const { createDetector } = await import('./packages/web-vision-detect/index.js'); \\
+     const det = await createDetector({ model: 'nano' }); \\
+     const img = new Image(); img.crossOrigin = 'anonymous'; img.src = fixtureUrl; await img.decode(); \\
+     const { detections } = await det.detect(img); return detections.map(d => d.label);"
 
 Module resolution: dynamic import() specifiers starting with ./ or ../ resolve
 against the PAGE URL, so import('./packages/i18n/index.js') loads the app's own
@@ -35942,14 +36139,25 @@ var WAIT_FOR_MAX_MS2 = 15e3;
 var WAIT_FOR_DEFAULT_MS = 15e3;
 var MAX_POST_LOAD_DELAY_MS = 3e4;
 var CAMERA_DEFAULT_DELAY_MS = 15e3;
-var pageScreenshotCommand = new Command("screenshot").description("Screenshot a web page").argument("<url>", "URL to screenshot").option("--device <names>", `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(", ")} (comma-separated or repeat flag). mobile/tablet emulate a real touch device \u2014 touch events, mobile user-agent, DPR \u2014 so touch-gated mobile UI actually renders.`, appendOption, []).option("--viewport <dims>", "Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag), e.g. --viewport 390x844 for a phone-sized window", appendOption, []).option("--wait <ms>", `Sleep this many ms after DOMContentLoaded before capturing (default 1000, max ${MAX_POST_LOAD_DELAY_MS}). With --camera it defaults to ${CAMERA_DEFAULT_DELAY_MS} so the vision model is up. Same flag as page eval/inspect.`).option("--wait-for <selector>", `Wait until this CSS selector appears before capturing, then capture (deterministic - beats guessing a --wait). Same flag as page eval/inspect. Gate on what you are photographing ('[data-vision="ready"]', '#verdict:not(:empty)'). Max ${WAIT_FOR_MAX_MS2}ms (--wait-timeout).`).option("--wait-timeout <ms>", `Max ms to wait for --wait-for before giving up (default ${WAIT_FOR_DEFAULT_MS}, max ${WAIT_FOR_MAX_MS2}). Timing out is reported - the capture still happens, so you see the state it got stuck in.`).option("--action <js>", `Run JS in the page before capturing \u2014 e.g. click a button to enter a state ("document.getElementById('play').click()"). Runs as an async function body, so const/await and app-relative import('./\u2026') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.`).option("--full", "Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.").option("-o, --output <file>", "Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)").option("--no-reload-between", "Skip reload between viewports (faster, lower fidelity - only safe for static pages)").option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps render headlessly. The video feed is a built-in test pattern \u2014 to capture what the app does with a REAL frame (a hand, a face, an object), use --camera <path> instead.").option("--camera <path>", "Play a local image or video (.png/.jpg/.webp/.mp4/.webm/.y4m/.mjpeg) as the browser's WEBCAM feed, then capture \u2014 so the shot shows the app reacting to a frame you chose (detected gesture, boxes, labels). Implies --fake-media.").option("--auth", "Capture the page signed in as you (your Gipity account), so UI behind a Sign-in-with-Gipity login is shown. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor \u2014 nothing carries over from earlier --auth runs.").option("--ephemeral", "Skip the project screenshot history: do not persist this capture to Gipity (screenshots/ in the project). Local file is still written.").option("--json", "Output JSON metadata instead of a friendly summary").addOption(new Option("--post-load-delay <ms>", "Alias for --wait").hideHelp()).addOption(new Option("--full-page", "Alias for --full").hideHelp()).addOption(new Option("--width <px>", "Alias: --viewport WxH").hideHelp()).addOption(new Option("--height <px>", "Alias: --viewport WxH").hideHelp()).action((url, opts) => run("Page screenshot", async () => {
+var pageScreenshotCommand = new Command("screenshot").description("Screenshot a web page").argument("<url>", "URL to screenshot").option("--device <names>", `Device preset(s): ${Object.keys(DEVICE_PRESETS).join(", ")} (comma-separated or repeat flag). mobile/tablet emulate a real touch device \u2014 touch events, mobile user-agent, DPR \u2014 so touch-gated mobile UI actually renders.`, appendOption, []).option("--viewport <dims>", "Raw viewport(s): WxH or WxH@dpr (comma-separated or repeat flag), e.g. --viewport 390x844 for a phone-sized window", appendOption, []).option("--wait <ms>", `Sleep this many ms after DOMContentLoaded before capturing (default 1000, max ${MAX_POST_LOAD_DELAY_MS}). With --camera it defaults to ${CAMERA_DEFAULT_DELAY_MS} so the vision model is up. Same flag as page eval/inspect.`).option("--wait-for <selector>", `Wait until this CSS selector appears before capturing, then capture (deterministic - beats guessing a --wait). Same flag as page eval/inspect. Gate on what you are photographing ('[data-vision="ready"]', '#verdict:not(:empty)'). Max ${WAIT_FOR_MAX_MS2}ms (--wait-timeout).`).option("--wait-timeout <ms>", `Max ms to wait for --wait-for before giving up (default ${WAIT_FOR_DEFAULT_MS}, max ${WAIT_FOR_MAX_MS2}). Timing out is reported - the capture still happens, so you see the state it got stuck in.`).option("--action <js>", `Run JS in the page before capturing - e.g. click a button to enter a state ("document.getElementById('play').click()"). Runs as an async function body, so const/await and app-relative import('./...') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.`).option("--file <path>", "Read the pre-capture script from a file instead of inline --action (mutually exclusive), or --file - to read it from stdin (pipe a heredoc: --file - <<'EOF' ... EOF) with no tmp file. For a multi-step driver - click through a flow, wait for it to render - then capture. Same async-function-body semantics as --action; same --file flag as page eval.").option("--full", "Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.").option("-o, --output <file>", "Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)").option("--no-reload-between", "Skip reload between viewports (faster, lower fidelity - only safe for static pages)").option("--fake-media", "Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so voice/camera apps render headlessly. The video feed is a built-in test pattern \u2014 to capture what the app does with a REAL frame (a hand, a face, an object), use --camera <path> instead.").option("--camera <path>", "Play a local image or video (.png/.jpg/.webp/.mp4/.webm/.y4m/.mjpeg) as the browser's WEBCAM feed, then capture \u2014 so the shot shows the app reacting to a frame you chose (detected gesture, boxes, labels). Implies --fake-media.").option("--auth", "Capture the page signed in as you (your Gipity account), so UI behind a Sign-in-with-Gipity login is shown. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor \u2014 nothing carries over from earlier --auth runs.").option("--ephemeral", "Skip the project screenshot history: do not persist this capture to Gipity (screenshots/ in the project). Local file is still written.").option("--json", "Output JSON metadata instead of a friendly summary").addOption(new Option("--post-load-delay <ms>", "Alias for --wait").hideHelp()).addOption(new Option("--full-page", "Alias for --full").hideHelp()).addOption(new Option("--width <px>", "Alias: --viewport WxH").hideHelp()).addOption(new Option("--height <px>", "Alias: --viewport WxH").hideHelp()).action((url, opts) => run("Page screenshot", async () => {
   const aliasFlag = ACTION_ALIAS_FLAGS.find((f) => opts[f.slice(2)] !== void 0);
   if (aliasFlag) {
     console.error(muted(
       `Note: treating ${aliasFlag} as --action \u2014 it runs your JS in the page before the capture. --action is the canonical flag.`
     ));
   }
-  const actionScript = [opts.action, ...ACTION_ALIAS_FLAGS.map((f) => opts[f.slice(2)])].filter(Boolean).join("\n");
+  const inlineAction = [opts.action, ...ACTION_ALIAS_FLAGS.map((f) => opts[f.slice(2)])].filter(Boolean).join("\n");
+  if (opts.file && inlineAction) {
+    throw new Error("Pass either --file <path> or an inline --action script, not both");
+  }
+  let actionScript = inlineAction;
+  if (opts.file) {
+    try {
+      actionScript = readScriptFile(opts.file);
+    } catch {
+      throw new Error(opts.file === "-" ? `--file - reads the pre-capture script from stdin, but stdin was empty/unreadable - pipe it in, e.g. gipity page screenshot "<url>" --file - <<'EOF' ... EOF` : `Cannot read file: ${opts.file}`);
+    }
+  }
   const delayRaw = opts.wait ?? opts.postLoadDelay;
   const chosenDelay = delayRaw !== void 0;
   let postLoadDelayMs = chosenDelay ? parseInt(String(delayRaw), 10) : 1e3;
@@ -36015,7 +36223,7 @@ var pageScreenshotCommand = new Command("screenshot").description("Screenshot a
   if (opts.camera) {
     assertCameraFile(opts.camera);
     if (!projectGuid) throw new Error("--camera needs a linked project (the frame is hosted for the browser to fetch) \u2014 run `gipity link` first.");
-    console.log(muted(`Hosting camera feed ${opts.camera}\u2026`));
+    console.log(muted(`Hosting camera feed ${opts.camera}...`));
     camera = await uploadCameraFeed(projectGuid, opts.camera);
   }
   const preCapture = [
@@ -36040,7 +36248,7 @@ var pageScreenshotCommand = new Command("screenshot").description("Screenshot a
   let entries;
   try {
     try {
-      entries = opts.json ? await doShoot() : await withSpinner("Capturing\u2026", doShoot, { done: null });
+      entries = opts.json ? await doShoot() : await withSpinner("Capturing...", doShoot, { done: null });
     } catch (err) {
       throw preCapture ? new Error(augmentSandboxTimeout(err.message)) : err;
     }
@@ -36162,9 +36370,17 @@ Waiting for the page to reach a state before the shot?
 
 Capturing a state that needs an interaction (start a game, open a menu, dismiss a modal)?
   Use --action to run JS in the page before the shot \u2014 it fires after the wait
-  (and after any --wait-for gate), then settles again so the result has painted. Do
-  NOT hand-roll a 'page eval' that returns a base64 image: the eval result is capped
-  (~16KB) and truncates the PNG.
+  (and after any --wait-for gate), then settles again so the result has painted. For
+  a multi-step driver (click, wait, click) pipe it as a heredoc with --file - (same
+  as 'page eval') instead of cramming it into one inline string:
+    gipity page screenshot "https://dev.gipity.ai/me/app/" --file - <<'EOF'
+    document.getElementById('load-sample').click();
+    await new Promise(r => setTimeout(r, 500));
+    document.getElementById('run').click();
+    await new Promise(r => setTimeout(r, 2000));
+    EOF
+  Do NOT hand-roll a 'page eval' that returns a base64 image: the eval result is
+  capped (~16KB) and truncates the PNG.
 
 Capturing an off-screen region or reading element data?
     \u2022 --full captures the ENTIRE scrollable page (then crop to the region).
@@ -36184,10 +36400,10 @@ function shortUrl(url, truncate = true, maxLen = 100) {
     result = url;
   }
   if (!truncate || result.length <= maxLen) return result;
-  const keep = maxLen - 1;
+  const keep = maxLen - 3;
   const headLen = Math.ceil(keep / 2);
   const tailLen = Math.floor(keep / 2);
-  return result.slice(0, headLen) + "\u2026" + result.slice(-tailLen);
+  return result.slice(0, headLen) + "..." + result.slice(-tailLen);
 }
 var pageInspectCommand = new Command("inspect").description("Inspect a web page (console, failed resources, timing, layout overflow). ONE passive load - to verify realtime/presence across concurrent clients use `page test --observe`").argument("<url>", "URL to inspect").option("--wait <ms>", "Sleep this many ms after DOMContentLoaded before capturing (lets late async/LCP work settle; max 30000)", "500").option("--wait-for <selector>", "Wait until this CSS selector appears before capturing (deterministic; replaces --wait)").option("--wait-timeout <ms>", "Max ms to wait for --wait-for before giving up", "5000").option("--json", "Output as JSON").option("--no-reprobe", "Skip the automatic second probe that filters one-time transient console errors - roughly halves inspect time on a page with any console error, at the cost of possibly reporting a cold-load transient as real").option("--no-truncate", "Show full URLs instead of truncating long ones with middle-ellipsis").option("--all", "Include render-blocking, large resources, oversized images, overflow culprits, and LCP detail").option("--no-fake-media", "Inspect with NO camera or microphone present, so a getUserMedia app takes its no-device error path (use this only when that fallback IS what you're inspecting)").option("--device <name>", `Inspect as a real touch device: ${TOUCH_DEVICES.join(", ")}. Emulates touch events, mobile user-agent and DPR, so a touch-gated mobile layout is what gets inspected.`).option("--auth", "Load the page signed in as you (your Gipity account), so pages behind a Sign-in-with-Gipity login are reachable. Only works for apps using Sign in with Gipity, hosted on *.gipity.ai. Without this flag the page loads as a genuinely anonymous, signed-out visitor \u2014 nothing carries over from earlier --auth runs.").addOption(new Option("--screenshot [path]", "Capture a screenshot").hideHelp()).action((url, opts) => {
   if (opts.screenshot !== void 0) {
@@ -36213,7 +36429,17 @@ async function inspectPage(url, opts = {}) {
     auth: opts.auth || void 0
   };
   const res = await post(`/tools/browser/inspect`, inspectBody);
-  const b7 = res.data;
+  const b7 = res?.data;
+  if (!b7 || typeof b7 !== "object") {
+    if (opts.json) {
+      console.log(JSON.stringify({ url, captured: false, note: "inspector returned no page data" }));
+      return;
+    }
+    console.log(`${brand("Inspecting")} ${bold(url)}`);
+    console.log(warning("Captured no page data \u2014 the page returned an empty response."));
+    console.log(muted("The page may have failed to load, redirected away, or rendered nothing server-side. Retry once; if it persists pass --wait-for <selector> to wait for a specific element to appear, or --auth if it is behind Sign in with Gipity."));
+    return;
+  }
   const isPlatformLog = (entry) => {
     const urlPart = entry.replace(/\s*\([^)]*\)\s*$/, "");
     try {
@@ -36269,6 +36495,9 @@ async function inspectPage(url, opts = {}) {
   console.log(`${muted("Title:")} ${b7.title || "(none)"}`);
   console.log(`${muted("Elements:")} ${b7.elementCount || 0}`);
   console.log(`${muted("Page weight:")} ${info(formatSize(b7.totalBytes || 0))}`);
+  if ((b7.elementCount || 0) === 0 && !b7.title) {
+    console.log(`${warning("\u26A0 Rendered no DOM (0 elements, no title)")} ${muted("\u2014 the client-side render likely had not run yet (try --wait-for <selector>), the page failed to load, or it is behind a sign-in gate (try --auth).")}`);
+  }
   console.log(`
 ${bold("Timing:")}`);
   console.log(`${muted("TTFB:")} ${timing.ttfb}ms`);
@@ -36388,7 +36617,7 @@ var deployCommand = new Command("deploy").description("Deploy to dev or prod").a
     force: opts.force,
     only: opts.only?.split(",").map((s) => s.trim())
   });
-  const res = opts.json ? await doDeploy() : await withSpinner(`Deploying to ${target}\u2026`, doDeploy, { done: null });
+  const res = opts.json ? await doDeploy() : await withSpinner(`Deploying to ${target}...`, doDeploy, { done: null });
   const d = res.data;
   const inspectAfter = async () => {
     if (!opts.inspect) return;
@@ -36455,7 +36684,7 @@ var deployCommand = new Command("deploy").description("Deploy to dev or prod").a
     console.log(success(`\u2713 Deployed to ${target}`) + muted(` (${d.elapsedMs}ms)`));
     if (d.url) console.log(`${muted("Live:")} ${brand(d.url)}`);
     if (d.phases?.some((p) => p.name === "functions")) {
-      console.log(`${muted("Functions:")} POST ${brand(`${config.apiBase}/api/${config.projectGuid}/fn/<name>`)}`);
+      console.log(`${muted("Functions:")} POST ${brand(`${resolveApiBase()}/api/${config.projectGuid}/fn/<name>`)}`);
       console.log(muted("  (same address on dev and prod; names: gipity fn list; verify the public path: gipity fn call <name> --anon)"));
     }
     await inspectAfter();
@@ -36640,8 +36869,8 @@ memoryCommand.command("delete <topic>").description("Delete a topic").option("--
 // src/commands/sandbox.ts
 init_api();
 init_config();
-import { readFileSync as readFileSync13, existsSync as existsSync11, statSync as statSync6, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname8, extname as extname4, relative as relative4, resolve as resolve12, sep as sep3 } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync11, statSync as statSync7, mkdirSync as mkdirSync8, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, extname as extname4, relative as relative4, resolve as resolve11, sep as sep3 } from "path";
 init_colors();
 var LANG_MAP = {
   js: "javascript",
@@ -36750,6 +36979,32 @@ function explainSplitArgs(args) {
   );
   return lines.join("\n");
 }
+var SCRATCH_DIR_PATTERNS = SCRATCH_IGNORE.map((p) => p.replace(/\/$/, "")).filter(Boolean).map((p) => p.replace(/[.]/g, "\\.").replace(/\*/g, "[A-Za-z0-9._-]*"));
+function scratchRefsInCode(code) {
+  const dirs = SCRATCH_DIR_PATTERNS.join("|");
+  if (!dirs) return [];
+  const re2 = new RegExp(`(?:\\/work\\/|(?<![\\w/.]))(?:${dirs})\\/[A-Za-z0-9._\\-\\/]+`, "g");
+  return [...new Set((code.match(re2) ?? []).map((m) => m.replace(/^\/work\//, "")))];
+}
+function isWriteTarget(code, p) {
+  const path5 = p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const m = new RegExp(`(?:\\/work\\/)?${path5}(?![\\w./-])`).exec(code);
+  if (!m) return false;
+  const idx = m.index;
+  const before = code.slice(Math.max(0, idx - 40), idx);
+  if (/(?:^|[\s'"`;(])(?:-o|-of|--out(?:put)?[= ]|>>?|tee(?:\s+-a)?)\s*['"`]?(?:\/work\/)?$/.test(before)) return true;
+  const segStart = Math.max(
+    code.lastIndexOf("&&", idx),
+    code.lastIndexOf("||", idx),
+    code.lastIndexOf(";", idx),
+    code.lastIndexOf("|", idx),
+    code.lastIndexOf("\n", idx)
+  );
+  const seg = code.slice(segStart + 1, idx).replace(/^[\s&|;]+/, "");
+  const cmd = /^\s*([A-Za-z0-9_./-]+)/.exec(seg)?.[1]?.split("/").pop()?.toLowerCase();
+  const afterInputFlag = /(?:^|[\s'"`])(?:-i|--input)[= ]\s*['"`]?$/.test(before);
+  return cmd === "ffmpeg" && !afterInputFlag;
+}
 function resolveRelativeCwd() {
   const configPath = getConfigPath();
   if (!configPath) return void 0;
@@ -36759,7 +37014,7 @@ function resolveRelativeCwd() {
   return rel2.split(/[\\/]/).filter(Boolean).join("/");
 }
 var sandboxCommand = new Command("sandbox").description("Run code in a sandbox");
-sandboxCommand.command("run [args...]").description("Run code").option("--language <language>", "Language: js, py, or bash (required unless pinned by an interpreter token or --file extension)").option("--file <path>", "Read the code body from a file instead of the inline <code> arg; --language is inferred from the extension when not given").addOption(new Option("--code <code>", "Alias for the positional inline <code> arg").hideHelp()).option("--timeout <seconds>", "Execution timeout in seconds", "30").option(
+sandboxCommand.command("run [args...]").description("Run code").option("--language <language>", "Language: js, py, or bash (required unless pinned by an interpreter token or --file extension)").option("--file <path>", "Read the code body from a file instead of the inline <code> arg; --language is inferred from the extension when not given").addOption(new Option("--code <code>", "Alias for the positional inline <code> arg").hideHelp()).addOption(new Option("-c, --cmd <code>", 'Inline code (bash idiom: `sandbox run bash -c "<code>"`)').hideHelp()).addOption(new Option("-e, --eval <code>", 'Inline code (node idiom: `sandbox run node -e "<code>"`)').hideHelp()).option("--timeout <seconds>", "Execution timeout. Bare number = seconds; or pass an explicit unit that means the same on both this and `page eval --timeout`, e.g. --timeout 90s.", "30").option(
   "--input <path>",
   "Narrow to specific project files instead of auto-mirroring the whole tree (repeatable). Use this only for >1 GB projects or when you want surgical control.",
   (v7, prev) => [...prev ?? [], v7]
@@ -36803,6 +37058,8 @@ Examples:
   $ gipity sandbox run --file build_report.py
   $ gipity sandbox run python build_report.py   # same thing, interpreter shorthand
   $ gipity sandbox run bash "echo hi; ffmpeg -version"   # inline, language pinned
+  $ gipity sandbox run bash -c "ffmpeg -version"         # the bash -c idiom also works
+  $ gipity sandbox run node -e "console.log(process.version)"  # and node -e
 
   # Surgical: only these files are mirrored in
   $ gipity sandbox run --language bash \\
@@ -36820,17 +37077,20 @@ GCC/Rust).
   let inlineCode;
   let filePath = opts.file;
   let langFromInterp;
-  if (opts.code !== void 0) {
-    if (args.length) {
-      console.error(error("Pass the code once: either positionally or via --code, not both"));
+  const flagCode = opts.code ?? opts.cmd ?? opts.eval;
+  if (flagCode !== void 0) {
+    const leadIsInterp = args.length === 1 && INTERPRETERS[args[0].toLowerCase()] !== void 0;
+    if (args.length > (leadIsInterp ? 1 : 0)) {
+      console.error(error("Pass the code once: either positionally or via --code/--cmd/-c/--eval/-e, not both"));
       process.exit(1);
     }
-    args = [opts.code];
+    const interp = leadIsInterp ? args[0] : opts.cmd !== void 0 ? "bash" : opts.eval !== void 0 ? "node" : void 0;
+    args = interp ? [interp, flagCode] : [flagCode];
   }
   if (args.length >= 2 && INTERPRETERS[args[0].toLowerCase()] !== void 0) {
     langFromInterp = INTERPRETERS[args[0].toLowerCase()];
     const rest = args.slice(1).join(" ");
-    if (existsSync11(rest) && statSync6(rest).isFile()) filePath = rest;
+    if (existsSync11(rest) && statSync7(rest).isFile()) filePath = rest;
     else inlineCode = rest;
   } else if (args.length === 1) {
     inlineCode = args[0];
@@ -36839,7 +37099,9 @@ GCC/Rust).
     process.exit(1);
   }
   if (inlineCode !== void 0 && filePath) {
-    console.error(error("Pass either an inline <code> arg or --file <path>, not both"));
+    console.error(error("Pass the code ONE way, not both: an inline <code> arg OR --file <path>."));
+    console.error(dim("  inline:  gipity sandbox run bash 'echo hi'"));
+    console.error(dim("  file:    gipity sandbox run --file script.sh"));
     process.exit(1);
   }
   if (inlineCode === void 0 && !filePath) {
@@ -36849,7 +37111,7 @@ GCC/Rust).
   let source = inlineCode;
   if (filePath) {
     try {
-      source = readFileSync13(filePath, "utf8");
+      source = readFileSync15(filePath, "utf8");
     } catch {
       console.error(error(`Cannot read file: ${filePath}`));
       process.exit(1);
@@ -36862,7 +37124,8 @@ GCC/Rust).
     process.exit(1);
   }
   const { config } = await resolveProjectContext();
-  const timeout = parseInt(opts.timeout, 10);
+  const durOpt = parseDuration(opts.timeout, "s");
+  const timeout = durOpt ? Math.max(1, Math.round(durOpt.value)) : parseInt(opts.timeout, 10);
   const cwd = resolveRelativeCwd();
   const scratchInputs = (opts.input ?? []).filter(
     (p) => shouldIgnore(p.replace(/\\/g, "/").replace(/^\.\//, ""), SCRATCH_IGNORE)
@@ -36873,6 +37136,18 @@ GCC/Rust).
     console.error(dim("  Stage inputs at a real project path (src/, docs/, assets/) and delete them afterward."));
     process.exit(1);
   }
+  if (source) {
+    const scratchReads = scratchRefsInCode(source).filter(
+      (p) => shouldIgnore(p, SCRATCH_IGNORE) && existsSync11(resolve11(process.cwd(), p)) && !isWriteTarget(source, p)
+    );
+    if (scratchReads.length) {
+      console.error(error(`Scratch files are never mirrored into the sandbox, so it can't read: ${scratchReads.join(", ")}`));
+      console.error(dim(`  ${SCRATCH_IGNORE.join(", ")} are ignored by sync, so the sandbox never sees them.`));
+      console.error(dim("  Stage the input at a real project path (src/, docs/, assets/) and delete it afterward."));
+      console.error(dim("  (Writing OUTPUT under tmp/ is fine \u2014 scratch outputs come back to your local tmp/.)"));
+      process.exit(1);
+    }
+  }
   if (getConfigPath()) {
     await sync({ interactive: false, progress: opts.json ? void 0 : createProgressReporter() });
   }
@@ -36888,17 +37163,17 @@ GCC/Rust).
     // wire name for --discard-output.)
     noSyncOutput: discardOutput.length ? discardOutput : void 0
   });
-  const res = opts.json ? await doRun() : await withSpinner("Running in sandbox\u2026", doRun, { done: null });
+  const res = opts.json ? await doRun() : await withSpinner("Running in sandbox...", doRun, { done: null });
   const pulledLocal = !!(res.data.outputFiles?.length && getConfigPath());
   if (pulledLocal) {
     await sync({ interactive: false, progress: opts.json ? void 0 : createProgressReporter() });
   }
   const scratchWritten = [];
   if (res.data.scratchFiles?.length) {
-    const base = resolve12(getProjectRoot() ?? process.cwd());
+    const base = resolve11(getProjectRoot() ?? process.cwd());
     for (const f of res.data.scratchFiles) {
       const rel2 = f.path.replace(/\\/g, "/");
-      const abs = resolve12(base, rel2);
+      const abs = resolve11(base, rel2);
       if (abs !== base && !abs.startsWith(base + sep3)) continue;
       mkdirSync8(dirname8(abs), { recursive: true });
       writeFileSync9(abs, Buffer.from(f.contentBase64, "base64"));
@@ -36924,7 +37199,7 @@ GCC/Rust).
     }
     if (res.data.outputFiles && res.data.outputFiles.length > 0) {
       const projectRoot = getProjectRoot();
-      const landed = (f) => pulledLocal && !!projectRoot && existsSync11(resolve12(projectRoot, f));
+      const landed = (f) => pulledLocal && !!projectRoot && existsSync11(resolve11(projectRoot, f));
       const onDisk = res.data.outputFiles.filter(landed);
       const notOnDisk = res.data.outputFiles.filter((f) => !landed(f));
       if (onDisk.length > 0) {
@@ -36936,6 +37211,12 @@ GCC/Rust).
         for (const f of notOnDisk) console.log(`${f}`);
         if (pulledLocal) console.log(dim("Not pulled locally - run 'gipity sync' to fetch them."));
       }
+      const rootStrays = [...onDisk, ...notOnDisk].filter((f) => !f.includes("/"));
+      if (rootStrays.length > 0) {
+        console.log(dim(`
+Note: ${rootStrays.join(", ")} landed at the project root and will deploy with the files phase.`));
+        console.log(dim("For a throwaway probe or fixture, write it under tmp/ instead - scratch outputs stay on local disk and never sync or deploy."));
+      }
     }
     if (scratchWritten.length > 0) {
       console.log("\nScratch outputs (local only - never synced or deployed):");
@@ -36945,7 +37226,27 @@ GCC/Rust).
       console.log(dim("\nDiscarded (--discard-output):"));
       for (const f of res.data.skippedOutputFiles) console.log(dim(`${f}`));
     }
+    if (res.data.exitCode === 0) {
+      const emptyScratch = (res.data.scratchFiles ?? []).filter((f) => f.contentBase64.length === 0).map((f) => f.path.replace(/\\/g, "/"));
+      const root = getProjectRoot();
+      const emptyOutputs = pulledLocal && root ? (res.data.outputFiles ?? []).filter((f) => {
+        try {
+          return statSync7(resolve11(root, f)).size === 0;
+        } catch {
+          return false;
+        }
+      }) : [];
+      const empties = [.../* @__PURE__ */ new Set([...emptyScratch, ...emptyOutputs])];
+      if (empties.length > 0) {
+        console.error(dim(`Note: ${empties.join(", ")} was written but is empty (0 bytes) - the command exited 0 but likely failed silently (a broken filter, or an out-of-memory kill the shell swallowed). Re-check the command, or shrink the job if it may have run out of memory.`));
+      }
+    }
     if (res.data.exitCode !== 0) {
+      if (res.data.exitCode === 137) {
+        console.error(error("The sandbox process was killed (exit 137) - it ran out of memory."));
+        console.error(dim("  Shrink the job: for ffmpeg, downscale (-vf scale=640:-2) and add -preset ultrafast;"));
+        console.error(dim("  for ImageMagick, lower -density/-resize. Process in smaller chunks if it still OOMs."));
+      }
       process.exit(res.data.exitCode);
     }
   }
@@ -36962,7 +37263,7 @@ var chatCommand = new Command("chat").description("Send a message to your agent"
     const endpoint = useExisting ? `/conversations/${config.conversationGuid}/messages` : "/conversations";
     const body = useExisting ? { content: message, projectGuid: config.projectGuid } : { agentGuid: config.agentGuid, content: message, projectGuid: config.projectGuid };
     const doChat = () => post(endpoint, body);
-    const res = opts.json ? await doChat() : await withSpinner("Thinking\u2026", doChat, { done: null });
+    const res = opts.json ? await doChat() : await withSpinner("Thinking...", doChat, { done: null });
     if (!oneOff && res.data.conversationGuid !== config.conversationGuid) {
       saveConfig({ ...config, conversationGuid: res.data.conversationGuid });
     }
@@ -37361,7 +37662,7 @@ function printStepRuns(steps, emptyNote) {
   }
 }
 var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
-var sleep2 = (ms2) => new Promise((resolve20) => setTimeout(resolve20, ms2));
+var sleep2 = (ms2) => new Promise((resolve19) => setTimeout(resolve19, ms2));
 async function waitForRun(wfGuid, prevGuid, timeoutSec) {
   const deadline = Date.now() + timeoutSec * 1e3;
   let runGuid;
@@ -37448,7 +37749,7 @@ workflowCommand.command("run <name>").description("Trigger a workflow (add --wai
   }
   if (r.status !== "completed") process.exit(1);
 }));
-workflowCommand.command("runs <name> [runGuid]").description("List recent runs, or pass a run guid (wr_\u2026) to see that run's per-step outputs").option("--json", "Output as JSON").action((name, runGuid, _opts, cmd) => run("Runs", async () => {
+workflowCommand.command("runs <name> [runGuid]").description("List recent runs, or pass a run guid (wr_...) to see that run's per-step outputs").option("--json", "Output as JSON").action((name, runGuid, _opts, cmd) => run("Runs", async () => {
   const opts = mergedOpts(cmd);
   const wf2 = await resolveWorkflow(name);
   if (runGuid) {
@@ -37821,6 +38122,19 @@ fileCommand.command("cat <path>").description("Read a file").option("--json", "O
     process.stdout.write(res.data.content);
   }
 }));
+fileCommand.command("url <path>").description("Durable public URL for a project file - no deploy needed. Reachable by browsers, GPU jobs, and external services the moment the file syncs; ideal for throwaway test fixtures (delete the file to revoke the link).").option("--download", "URL forces a download (Content-Disposition: attachment)").option("--json", "Output as JSON").action((path5, opts) => run("Url", async () => {
+  const { config } = await resolveProjectContext();
+  const qs = new URLSearchParams({ path: path5 });
+  if (opts.download) qs.set("download", "1");
+  const res = await get(
+    `/projects/${config.projectGuid}/files/url?${qs.toString()}`
+  );
+  if (opts.json) {
+    console.log(JSON.stringify(res.data));
+  } else {
+    console.log(res.data.url);
+  }
+}));
 fileCommand.command("tree [path]").description("Show the file tree").option("--json", "Output as JSON").action((path5, opts) => run("Tree", async () => {
   const { config } = await resolveProjectContext();
   const query = path5 ? `?path=${encodeURIComponent(path5)}` : "";
@@ -37921,7 +38235,7 @@ function printUsage(d) {
     for (const p of d.projects) {
       const name = p.projectName ?? "(no project)";
       row(
-        name.length > 16 ? `${name.slice(0, 15)}\u2026` : name,
+        name.length > 16 ? `${name.slice(0, 13)}...` : name,
         formatBytes(p.liveBytes),
         `${p.liveFiles.toLocaleString()} files`
       );
@@ -37930,7 +38244,7 @@ function printUsage(d) {
       const shownBytes = d.projects.reduce((n, p) => n + p.liveBytes, 0);
       const shownFiles = d.projects.reduce((n, p) => n + p.liveFiles, 0);
       row(
-        `\u2026and ${hidden.toLocaleString()} more`,
+        `...and ${hidden.toLocaleString()} more`,
         formatBytes(totals.liveBytes - shownBytes),
         `${(totals.liveFiles - shownFiles).toLocaleString()} files`
       );
@@ -37982,50 +38296,11 @@ storageCommand.command("retention").description("View or adjust your file versio
 init_platform();
 init_auth();
 init_api();
-import { join as join17, dirname as dirname10, resolve as resolve14, basename as basename4, sep as sep5 } from "path";
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync12, renameSync as renameSync2, readdirSync as readdirSync8, statSync as statSync7 } from "fs";
+import { join as join17, dirname as dirname10, resolve as resolve13, basename as basename5, sep as sep5 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync12, renameSync as renameSync2, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
 import { homedir as homedir12 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { randomUUID } from "crypto";
-
-// src/login-flow.ts
-init_api();
-init_auth();
-init_utils();
-init_colors();
-async function interactiveLogin() {
-  const email = await prompt("  Email: ");
-  if (!email) {
-    console.error(`
-  ${error("Email required.")}`);
-    process.exit(1);
-  }
-  await publicPost("/auth/login", { email });
-  console.log("  Check your email for a 6-digit code.\n");
-  const code = await prompt("  Code: ");
-  if (!code) {
-    console.error(`
-  ${error("Code required.")}`);
-    process.exit(1);
-  }
-  const res = await publicPost("/auth/verify", { email, code });
-  const exp = decodeJwtExp(res.accessToken);
-  if (!exp) {
-    console.error(`
-  ${error("Invalid token received.")}`);
-    process.exit(1);
-  }
-  const expiresAt = new Date(exp * 1e3).toISOString();
-  saveAuth({ accessToken: res.accessToken, refreshToken: res.refreshToken, email, expiresAt });
-  console.log(`  ${success(`Logged in (${email}).`)}`);
-  const delivered = await flushBugQueue().catch(() => 0);
-  if (delivered > 0) {
-    console.log(`  ${muted(`Delivered ${delivered} queued bug report${delivered === 1 ? "" : "s"}.`)}`);
-  }
-  return getAuth();
-}
-
-// src/commands/build.ts
 init_config();
 
 // src/prompts.ts
@@ -38131,7 +38406,6 @@ function buildFreshWrap(contextBlock, userMsg) {
 // src/relay/onboarding.ts
 init_utils();
 init_colors();
-import { readFileSync as readFileSync15 } from "node:fs";
 
 // src/relay/installers.ts
 import { homedir as homedir8, platform as osPlatform } from "os";
@@ -38302,13 +38576,13 @@ function windowsTaskPlan(cliPath) {
 init_platform();
 init_api();
 import { hostname as hostname3, userInfo, platform as osPlatform2 } from "os";
-import { resolve as resolve13, dirname as dirname9 } from "path";
+import { resolve as resolve12, dirname as dirname9 } from "path";
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
 
 // src/relay/machine-id.ts
 import { createHash as createHash3 } from "crypto";
 import { execFileSync } from "child_process";
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { hostname as hostname2, platform, arch } from "os";
 function rawMachineId() {
   const override = process.env.GIPITY_RELAY_MACHINE_ID?.trim();
@@ -38317,7 +38591,7 @@ function rawMachineId() {
     if (platform() === "linux") {
       for (const path5 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
         try {
-          const id2 = readFileSync14(path5, "utf-8").trim();
+          const id2 = readFileSync16(path5, "utf-8").trim();
           if (id2) return `linux:${id2}`;
         } catch {
         }
@@ -38364,7 +38638,7 @@ function friendlyDeviceName() {
   return host || `My ${kind}`;
 }
 function resolveCliPath() {
-  return resolve13(process.argv[1] ?? "gipity");
+  return resolve12(process.argv[1] ?? "gipity");
 }
 async function pairDevice(opts = {}) {
   const existing = getDevice();
@@ -38437,15 +38711,6 @@ function removeAutostart(opts = {}) {
 
 // src/relay/onboarding.ts
 var ensureDaemonRunning = startDaemon;
-function isWsl() {
-  if (process.platform !== "linux") return false;
-  if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP) return true;
-  try {
-    return /microsoft/i.test(readFileSync15("/proc/version", "utf-8"));
-  } catch {
-    return false;
-  }
-}
 async function runRelaySetup(opts) {
   const alreadyAnswered = getRelayEnabled() !== void 0;
   if (opts.mode === "offer-once" && alreadyAnswered) {
@@ -38461,12 +38726,12 @@ async function runRelaySetup(opts) {
       console.log("");
       console.log(`  ${success("Registered as")} ${bold(existingDevice.name)} ${muted(`(${existingDevice.guid})`)}`);
       if (isPaused()) {
-        console.log(`  ${dim("The relay is paused \u2014 resume it with")} ${brand("gipity relay resume")}${dim(".")}`);
+        console.log(`  ${dim("The relay is paused - resume it with")} ${brand("gipity relay resume")}${dim(".")}`);
       } else {
         console.log(`  ${dim("The relay is running. Open")} ${brand("gipity.ai")}${dim(" and type `/claude` to drive Claude Code here.")}`);
       }
       console.log("");
-      console.log(`  ${dim("To register this computer again \u2014 for example under a different name \u2014")}`);
+      console.log(`  ${dim("To register this computer again (for example under a different name),")}`);
       console.log(`  ${dim("unregister it first, then re-run setup:")}`);
       console.log(`      ${brand("gipity relay revoke")}   ${dim("# unpairs this computer and removes the login service")}`);
       console.log(`      ${brand("gipity connect")}        ${dim("# register it again (asks for a new name)")}`);
@@ -38476,28 +38741,29 @@ async function runRelaySetup(opts) {
   }
   if (opts.mode === "run-now") {
     console.log(`  ${bold("Set up this computer as a relay")}`);
-    console.log(`  ${dim("A relay runs your coding agent (Claude Code, Codex, or Grok) here so you can drive it from the web (")}${brand("gipity.ai")}${dim(") on any browser.")}`);
-    console.log(`  ${dim("It uses your Claude, Codex, or Grok subscription \u2014 the cheapest way to pay for tokens.")}`);
+    console.log(`  ${dim("Gipity drives the coding agents on this computer from the web (")}${brand("gipity.ai")}${dim(")")}`);
+    console.log(`  ${dim("on any browser, desktop or phone. Uses your Claude, Codex, or Grok")}`);
+    console.log(`  ${dim("subscription - the cheapest way to pay for tokens.")}`);
   } else {
-    console.log(`  ${bold("Remote control of your coding agent")}`);
-    console.log(`  ${dim("Drive your coding agent on this computer from the web (")}${brand("gipity.ai")}${dim(") on any browser (desktop or phone).")}`);
-    console.log("");
-    console.log(`  ${dim("Enable now (takes 2 seconds) or turn on later with")} ${brand("gipity connect")}`);
+    console.log(`  ${bold("Optional:")} ${dim("Gipity can drive the coding agents on this computer from the")}`);
+    console.log(`  ${dim("web (")}${brand("gipity.ai")}${dim(") on any browser, desktop or phone. Like Claude Code remote")}`);
+    console.log(`  ${dim("control, but one pane for all your coding agents.")}`);
   }
   console.log("");
-  const promptText = opts.mode === "run-now" ? "  Set up remote control on this computer?" : "  Enable remote control?";
+  const promptText = opts.mode === "run-now" ? "  Set up remote control on this computer" : "  Enable remote control";
   const enable = await confirm(promptText, { default: "yes" });
   if (!enable) {
     setRelayEnabled(false);
-    console.log(`  ${muted("Skipped.")}`);
+    console.log(`  ${muted("Skipped. Turn on later with")} ${brand("gipity connect")}${muted(".")}`);
     console.log("");
     return false;
   }
+  console.log("");
   const defaultName = friendlyDeviceName();
   const rawName = await prompt(`  Device name [${bold(defaultName)}]: `);
   const name = (rawName || defaultName).trim();
   if (!name || name.length > 100) {
-    console.error(`  ${error("Device name must be 1\u2013100 non-whitespace characters. Skipping.")}`);
+    console.error(`  ${error("Device name must be 1-100 non-whitespace characters. Skipping.")}`);
     setRelayEnabled(false);
     return false;
   }
@@ -38510,11 +38776,9 @@ async function runRelaySetup(opts) {
     console.error(`  ${dim("Skipping for now - we'll offer again next time. Or turn it on with `gipity connect`.")}`);
     return false;
   }
-  const startNow = await confirm("  Start the relay now (and on future `gipity build` runs)?", { default: "yes" });
-  if (startNow) {
-    startDaemon();
-  }
-  const autostartOs = await confirm("  Also start at OS login (auto-start with Windows / macOS / Linux)?", { default: "yes" });
+  startDaemon();
+  console.log("");
+  const autostartOs = await confirm("  Also start at OS login", { default: "yes" });
   if (autostartOs) {
     try {
       const res = installAutostart();
@@ -38526,8 +38790,6 @@ async function runRelaySetup(opts) {
         } else {
           console.log(`  ${muted("Autostart install returned non-zero - you can run")} ${brand("gipity relay install")} ${muted("later.")}`);
         }
-      } else {
-        console.log(`  ${success("Auto-start installed.")} ${dim(res.summary)}`);
       }
     } catch (err) {
       if (err instanceof UnsupportedPlatformError) {
@@ -38538,16 +38800,12 @@ async function runRelaySetup(opts) {
     }
   }
   if (getDiagnosticsConsent() === void 0) {
-    const diag = await confirm(
-      "  Share anonymous diagnostics (CPU/GPU/memory/disk/versions) to improve reliability?",
-      { default: "yes" }
-    );
+    console.log("");
+    const diag = await confirm("  Share anonymous diagnostics info", { default: "yes" });
     setDiagnosticsConsent(diag);
-    console.log(`  ${dim(diag ? "Thanks - no personal data or file paths are ever sent. Turn off anytime with `gipity relay diagnostics off`." : "Diagnostics off. Turn on anytime with `gipity relay diagnostics on`.")}`);
   }
   console.log("");
-  console.log(`  ${success(`Registered as ${bold(device.name)} (${device.guid}).`)}`);
-  console.log(`  ${dim("In the Gipity web CLI, type `/claude` to dispatch messages to this PC.")}`);
+  console.log(`  ${success(`Done! ${bold(device.name)} is set up. New chats from gipity.ai can now execute here.`)}`);
   console.log("");
   return true;
 }
@@ -38690,9 +38948,8 @@ function padR(s, width) {
 }
 function leadingEllipsify(s, maxW) {
   if (s.length <= maxW) return s;
-  if (maxW <= 1) return s.slice(-maxW);
-  if (maxW <= 3) return "\u2026".padStart(maxW);
-  return "\u2026" + s.slice(-(maxW - 1));
+  if (maxW <= 4) return s.slice(-maxW);
+  return "..." + s.slice(-(maxW - 3));
 }
 function center(s, width) {
   const gap = width - visLen(s);
@@ -39002,14 +39259,14 @@ function getAdapterBySource(source) {
 }
 
 // src/prefs.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
 import { homedir as homedir11 } from "os";
 import { join as join16 } from "path";
 var PREFS_PATH = join16(homedir11(), ".gipity", "prefs.json");
 function readPrefs() {
   if (!existsSync13(PREFS_PATH)) return {};
   try {
-    const parsed = JSON.parse(readFileSync16(PREFS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(PREFS_PATH, "utf-8"));
     return {
       lastAgent: typeof parsed.lastAgent === "string" ? parsed.lastAgent : void 0
     };
@@ -39034,7 +39291,7 @@ function readOwnPkg(fromDir) {
     const p = join17(d, "package.json");
     if (existsSync14(p)) {
       try {
-        const pkg2 = JSON.parse(readFileSync17(p, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync18(p, "utf-8"));
         if (pkg2.name === "gipity") return pkg2;
       } catch {
       }
@@ -39045,7 +39302,7 @@ function readOwnPkg(fromDir) {
 var __clPkg = readOwnPkg(__clDir);
 function reportSyncResult(result) {
   if (result.aborted) {
-    console.log(`  ${warning("Merge cancelled \u2014 this folder was NOT synced with the project.")}`);
+    console.log(`  ${warning("Merge cancelled - this folder was NOT synced with the project.")}`);
     console.log(`  ${muted("For a clean copy, quit and open the project in an empty folder. To merge anyway, run `gipity sync`.")}`);
     return;
   }
@@ -39053,9 +39310,9 @@ function reportSyncResult(result) {
     console.log(`  Synced ${result.applied} change${result.applied > 1 ? "s" : ""} with Gipity.`);
   }
   if (result.errors.length) {
-    console.log(`  ${warning(`Sync finished with ${result.errors.length} problem${result.errors.length === 1 ? "" : "s"} \u2014 your local copy may be incomplete:`)}`);
+    console.log(`  ${warning(`Sync finished with ${result.errors.length} problem${result.errors.length === 1 ? "" : "s"} - your local copy may be incomplete:`)}`);
     for (const e of result.errors.slice(0, 8)) console.log(`    - ${e}`);
-    if (result.errors.length > 8) console.log(`    \u2026and ${result.errors.length - 8} more.`);
+    if (result.errors.length > 8) console.log(`    ...and ${result.errors.length - 8} more.`);
     console.log(`  ${muted("Nothing was deleted. Re-run `gipity sync` to finish the pull.")}`);
   }
 }
@@ -39088,7 +39345,7 @@ function localFsFallback(dir) {
         let isDir = false;
         let size = 0;
         try {
-          const st2 = statSync7(join17(d, name));
+          const st2 = statSync8(join17(d, name));
           isDir = st2.isDirectory();
           size = st2.isFile() ? st2.size : 0;
         } catch {
@@ -39108,7 +39365,7 @@ function localFsFallback(dir) {
     }
   };
   walk(dir, 0);
-  const topLevel = topLevelEntries.length ? topLevelEntries.slice(0, 20).join(", ") + (topLevelEntries.length > 20 ? ", \u2026" : "") : "(empty directory)";
+  const topLevel = topLevelEntries.length ? topLevelEntries.slice(0, 20).join(", ") + (topLevelEntries.length > 20 ? ", ..." : "") : "(empty directory)";
   return { fileCount, folderCount, totalBytes, topLevel };
 }
 async function buildProjectContextBlock2(opts) {
@@ -39131,7 +39388,7 @@ function hasStreamJsonFlag(args) {
 function markFolderTrusted(dir) {
   try {
     const file = join17(homedir12(), ".claude.json");
-    const cfg = existsSync14(file) ? JSON.parse(readFileSync17(file, "utf-8")) : {};
+    const cfg = existsSync14(file) ? JSON.parse(readFileSync18(file, "utf-8")) : {};
     if (typeof cfg !== "object" || cfg === null) return;
     if (typeof cfg.projects !== "object" || cfg.projects === null) cfg.projects = {};
     const entry = typeof cfg.projects[dir] === "object" && cfg.projects[dir] !== null ? cfg.projects[dir] : {};
@@ -39256,7 +39513,7 @@ async function runLaunch(cmdName, cmdCfg, opts) {
     let existing = getConfig();
     let forceAdoptCwd = false;
     if (existing && !opts.newProject && !opts.project && !nonInteractive) {
-      const cwdHasConfig = existsSync14(resolve14(process.cwd(), ".gipity.json"));
+      const cwdHasConfig = existsSync14(resolve13(process.cwd(), ".gipity.json"));
       if (!cwdHasConfig && isLikelyEmpty(process.cwd())) {
         const ancestorRoot = dirname10(getConfigPath());
         console.log(`  ${bold("You are inside an existing Gipity project.")}
@@ -39334,6 +39591,7 @@ async function runLaunch(cmdName, cmdCfg, opts) {
         console.log(`  ${warning("Could not sync files (will retry on next prompt):")} ${err.message}`);
       }
       setupProjectTools();
+      if (!nonInteractive) console.log(`  ${muted("Installed Gipity plugin, skills, and hooks.")}`);
       if (nonInteractive) {
         headlessNewProject = isNewProject;
       } else {
@@ -39406,7 +39664,7 @@ async function runLaunch(cmdName, cmdCfg, opts) {
       let agentGuid = "";
       const result = forceAdoptCwd ? { kind: "adopt-cwd" } : projects.length > 0 ? await pickOrCreateProject(projects, existingSlugs) : { kind: "create-new", project: await createNewProject(existingSlugs) };
       if (result.kind === "adopt-cwd") {
-        const cwdBase = basename4(process.cwd());
+        const cwdBase = basename5(process.cwd());
         const adoptSlug = slugify(cwdBase) || "project";
         const adoptName = (cwdBase || adoptSlug).slice(0, 100);
         accountSlug = await getAccountSlug();
@@ -39458,6 +39716,7 @@ async function runLaunch(cmdName, cmdCfg, opts) {
       }
       initialPrompt = "";
       setupProjectTools();
+      if (!nonInteractive) console.log(`  ${muted("Installed Gipity plugin, skills, and hooks.")}`);
       console.log(`  ${success(`Project "${project.name}" ready.`)}
 `);
     }
@@ -39553,9 +39812,8 @@ async function runLaunch(cmdName, cmdCfg, opts) {
     }
     if (!nonInteractive) {
       console.log(`  ${bold("Launching Claude Code, powered by Gipity.")}`);
-      console.log(`  ${muted("Just tell Claude what you'd like to build or do - everything Claude can do,")}`);
-      console.log(`  ${muted("plus hosting, databases, and live deploys on Gipity.")}`);
       if (convGuidForHooks) {
+        console.log("");
         console.log(`  ${muted(`This session is saved to Gipity - watch it live at ${brand("prompt.gipity.ai")}. (--no-capture on init to disable.)`)}`);
       }
       console.log("");
@@ -39653,10 +39911,8 @@ async function pickAgent(lastUsed) {
   console.log(`  ${bold("Which coding agent?")}
 `);
   AGENT_ADAPTERS.forEach((a, i) => {
-    const installed = binaryOnPath(a.binary) || a.key === "claude" && isClaudeInstalled();
     const notes = [];
     if (a.key === lastUsed) notes.push("last used");
-    if (!installed) notes.push(a.ensureInstalled ? "not installed - we'll install it" : "not installed");
     if (a.key === "codex" && !a.hooksSupportedOnPlatform(process.platform)) {
       notes.push("session recording unavailable on Windows");
     }
@@ -39769,9 +40025,8 @@ Sending to ${adapter.displayName}: ${message}
   } else {
     agentArgs = [...adapter.buildInteractiveArgs({ resume, model }), ...extras];
     console.log(`  ${bold(`Launching ${adapter.displayName}, powered by Gipity.`)}`);
-    console.log(`  ${muted(`Just tell ${adapter.displayName} what you'd like to build or do - plus hosting,`)}`);
-    console.log(`  ${muted("databases, and live deploys on Gipity.")}`);
     if (convGuid) {
+      console.log("");
       console.log(`  ${muted(`This session is saved to Gipity - watch it live at ${brand("prompt.gipity.ai")}. (--no-capture on init to disable.)`)}`);
     }
     if (adapter.oneTimeSetupNote) {
@@ -39831,32 +40086,39 @@ async function pickOrCreateProject(projects, existingSlugs) {
   const cwd = process.cwd();
   const showAdopt = canAdoptCwd(cwd);
   const reserved = showAdopt ? 2 : 1;
-  const maxRecent = 9 - reserved - 1;
-  const recent = filtered.slice(0, maxRecent);
-  const hasMore = filtered.length > recent.length;
+  const fitsAll = filtered.length <= 9 - reserved;
+  const hasMore = !fitsAll;
+  const searchSlot = hasMore ? reserved + 1 : 0;
+  const projectBase = reserved + (hasMore ? 1 : 0);
+  const recent = fitsAll ? filtered : filtered.slice(0, 9 - reserved - 2);
+  const moreSlot = hasMore ? projectBase + recent.length + 1 : 0;
   while (true) {
     const newProjectLabel = formatNewProjectLabel(existingSlugs);
     console.log(`  ${bold("Choose project to open:")}
 `);
-    console.log(`    ${bold("1.")} Create new project          ${muted(`(${newProjectLabel})`)}`);
+    console.log(`    ${bold("1.")} ${info("Create new project")}          ${muted(`(${newProjectLabel})`)}`);
     if (showAdopt) {
-      console.log(`    ${bold("2.")} Use this directory          ${muted(`(${formatCwdLabel(cwd)})`)}`);
+      console.log(`    ${bold("2.")} ${info("Use this directory")}          ${muted(`(${formatCwdLabel(cwd)})`)}`);
+    }
+    if (hasMore) {
+      console.log(`    ${bold(`${searchSlot}.`)} ${info("Search projects")} ${muted(`(${filtered.length} total)`)}`);
     }
     recent.forEach(
-      (p, i) => console.log(`    ${bold(`${i + reserved + 1}.`)} ${p.name} ${muted(`(${p.slug})`)}`)
+      (p, i) => console.log(`    ${bold(`${projectBase + i + 1}.`)} ${p.name} ${muted(`(${p.slug})`)}`)
     );
     if (hasMore) {
-      console.log(`    ${bold(`${recent.length + reserved + 1}.`)} Show all projects`);
+      console.log(`    ${bold(`${moreSlot}.`)} ${info("Show more")}`);
     }
     console.log("");
-    const maxOption = recent.length + reserved + (hasMore ? 1 : 0);
+    const maxOption = projectBase + recent.length + (hasMore ? 1 : 0);
     const idx = await pickOne("Choose", maxOption, 1);
-    if (idx > reserved && idx <= recent.length + reserved) {
-      return { kind: "pick", project: recent[idx - reserved - 1] };
+    if (idx > projectBase && idx <= projectBase + recent.length) {
+      return { kind: "pick", project: recent[idx - projectBase - 1] };
     }
-    if (hasMore && idx === recent.length + reserved + 1) {
-      const picked = await pickFromAll(filtered);
+    if (hasMore && (idx === searchSlot || idx === moreSlot)) {
+      const picked = await browseProjects(filtered, { search: idx === searchSlot });
       if (picked) return { kind: "pick", project: picked };
+      console.log("");
       continue;
     }
     if (showAdopt && idx === 2) {
@@ -39871,17 +40133,62 @@ async function pickOrCreateProject(projects, existingSlugs) {
     return { kind: "create-new", project };
   }
 }
-async function pickFromAll(filtered) {
+var PROJECT_PAGE_SIZE = 10;
+function searchProjects(all, query) {
+  const q = query.trim().toLowerCase();
+  if (!q) return all;
+  return all.filter((p) => p.name.toLowerCase().includes(q) || p.slug.toLowerCase().includes(q));
+}
+async function browseProjects(all, opts = {}) {
+  let items = all;
+  let heading = "All projects";
+  const runSearch = async () => {
+    const q = await prompt(`  ${bold("Search projects:")} `);
+    if (!q) return false;
+    const matches = searchProjects(all, q);
+    if (matches.length === 0) {
+      console.log(`  ${muted(`No projects match "${q}".`)}`);
+      return false;
+    }
+    items = matches;
+    heading = `Projects matching "${q}"`;
+    return true;
+  };
   console.log("");
-  console.log(`  ${bold("All projects:")}
+  if (opts.search && !await runSearch()) return null;
+  let shown = 0;
+  while (true) {
+    if (shown < items.length) {
+      const page = items.slice(shown, shown + PROJECT_PAGE_SIZE);
+      if (shown === 0) console.log(`  ${bold(`${heading}`)} ${muted(`(${items.length})`)}
 `);
-  console.log(`    ${bold("1.")} Create new project`);
-  filtered.forEach((p, i) => console.log(`    ${bold(`${i + 2}.`)} ${p.name} ${muted(`(${p.slug})`)}`));
-  console.log("");
-  const allChoice = await prompt(`  Choose (1-${filtered.length + 1}): `);
-  const allIdx = parseInt(allChoice, 10);
-  if (allIdx >= 2 && allIdx <= filtered.length + 1) return filtered[allIdx - 2];
-  return null;
+      page.forEach(
+        (p, i) => console.log(`    ${bold(`${String(shown + i + 1).padStart(3)}.`)} ${p.name} ${muted(`(${p.slug})`)}`)
+      );
+      shown += page.length;
+      console.log("");
+    }
+    const more = shown < items.length;
+    const hints = [
+      more ? `Enter = next ${Math.min(PROJECT_PAGE_SIZE, items.length - shown)}` : null,
+      "number = open",
+      "s = search",
+      "q = back"
+    ].filter(Boolean).join(" \xB7 ");
+    const answer = (await prompt(`  ${bold("Choose")} ${muted(`(${hints})`)}: `)).toLowerCase();
+    if (answer === "" && more) continue;
+    if (answer === "" || answer === "q") return null;
+    if (answer === "s") {
+      if (await runSearch()) {
+        shown = 0;
+        console.log("");
+      }
+      continue;
+    }
+    const n = parseInt(answer, 10);
+    if (Number.isInteger(n) && n >= 1 && n <= shown) return items[n - 1];
+    console.log(`  ${muted("Type one of the numbers above, Enter for more, s to search, or q to go back.")}`);
+  }
 }
 function formatNewProjectLabel(existingSlugs) {
   const slug = suggestProjectName(existingSlugs);
@@ -39990,12 +40297,10 @@ var KITS = [
   { key: "chatbot", hint: "drop-in chatbot - persona, guardrails, streaming responses" },
   { key: "audio-align", hint: "audio + lyrics -> word-level timing JSON (GPU job)" },
   { key: "i18n", hint: "multi-language web apps - language picker, RTL, translations" },
-  { key: "records", hint: "registry-driven data plane - generic CRUD, validation, search, audit spine" },
-  { key: "views", hint: "registry-driven UI over records - table, forms, kanban" },
-  { key: "agent-api", hint: "named API keys for agent/script writes through the records kit" },
   { key: "contacts", hint: "multi-source contact layer - LinkedIn/Gmail import, dedupe with provenance" },
   { key: "stripe", hint: "charge your users - Stripe checkout, subscriptions, brokered webhooks" },
-  { key: "notify", hint: "web push notifications - platform-owned keys, works on iOS home screen" }
+  { key: "notify", hint: "web push notifications - platform-owned keys, works on iOS home screen" },
+  { key: "servicenow", hint: "ServiceNow tables as a data source - OAuth pull/write-back/real-time sync" }
 ];
 
 // src/commands/add.ts
@@ -40151,7 +40456,7 @@ var addCommand = new Command("add").description("Add a template or kit").argumen
     console.error(muted(isKit ? "Installing kit (server-side install pipeline)..." : "Installing (server writes files + generates favicons; first add for a title can take ~10s)..."));
   }
   const doAdd = () => post(`/projects/${config.projectGuid}/add`, body);
-  const res = opts.json ? await doAdd() : await withSpinner("Installing\u2026", doAdd, { done: null });
+  const res = opts.json ? await doAdd() : await withSpinner("Installing...", doAdd, { done: null });
   const syncResult = await sync({ interactive: false, progress: opts.json ? void 0 : createProgressReporter() });
   const data = res.data;
   if (opts.json) {
@@ -40199,7 +40504,7 @@ var removeCommand = new Command("remove").description("Remove a kit").argument("
     }
   }
   const doRemove = () => post(`/projects/${config.projectGuid}/remove`, { name: kit });
-  const res = opts.json ? await doRemove() : await withSpinner("Removing\u2026", doRemove, { done: null });
+  const res = opts.json ? await doRemove() : await withSpinner("Removing...", doRemove, { done: null });
   const data = res.data;
   const syncResult = await sync({
     interactive: false,
@@ -40249,7 +40554,7 @@ function dispositionFilename(headers) {
 var saveCommand = new Command("save").description("Save this app as a portable .gip bundle").argument("[output]", "Output .gip path, or a directory to write <slug>.gip into (default: ./<slug>.gip)").option("--json", "Output as JSON").addHelpText("after", "\nRestore anywhere with `gipity load <file>.gip` - it always creates a NEW project.").action((output, opts) => run("Save", async () => {
   const config = requireConfig();
   const doExport = () => downloadWithHeaders(`/projects/${config.projectGuid}/export`);
-  const { buffer, headers } = opts.json ? await doExport() : await withSpinner("Exporting\u2026", doExport, { done: null });
+  const { buffer, headers } = opts.json ? await doExport() : await withSpinner("Exporting...", doExport, { done: null });
   const filename = dispositionFilename(headers) ?? `${config.projectSlug}.gip`;
   let dest = path2.resolve(output ?? filename);
   if (output && fs3.existsSync(dest) && fs3.statSync(dest).isDirectory()) {
@@ -40257,14 +40562,14 @@ var saveCommand = new Command("save").description("Save this app as a portable .
   }
   fs3.mkdirSync(path2.dirname(dest), { recursive: true });
   fs3.writeFileSync(dest, buffer);
-  const sha2562 = createHash4("sha256").update(buffer).digest("hex");
+  const sha256 = createHash4("sha256").update(buffer).digest("hex");
   const skipped = Number(headers.get("x-gip-skipped") ?? 0);
   const entries = zipEntryCount(buffer);
   if (opts.json) {
     console.log(JSON.stringify({
       path: dest,
       bytes: buffer.length,
-      sha256: sha2562,
+      sha256,
       ...entries !== null ? { entries } : {},
       skipped
     }));
@@ -40274,7 +40579,7 @@ var saveCommand = new Command("save").description("Save this app as a portable .
   console.log(`  Path:     ${dest}`);
   console.log(`  Size:     ${formatBytes(buffer.length)}`);
   if (entries !== null) console.log(`  Entries:  ${entries} (including the bundle manifest)`);
-  console.log(`  SHA-256:  ${sha2562}`);
+  console.log(`  SHA-256:  ${sha256}`);
   if (skipped > 0) {
     console.log("");
     console.warn(warning(`${skipped} file(s) were skipped (unreadable or over 100 MB) - this bundle is partial.`));
@@ -40391,7 +40696,7 @@ var loadCommand = new Command("load").description("Create a new app from a .gip
     };
   }
   if (opts.inspect) {
-    const res = opts.json ? await doInspect() : await withSpinner("Inspecting\u2026", doInspect, { done: null });
+    const res = opts.json ? await doInspect() : await withSpinner("Inspecting...", doInspect, { done: null });
     if (opts.json) {
       console.log(JSON.stringify(res.data));
       return;
@@ -40399,7 +40704,7 @@ var loadCommand = new Command("load").description("Create a new app from a .gip
     printInspect(res.data, source);
     return;
   }
-  const { data, partial } = opts.json ? await doImport() : await withSpinner("Importing\u2026", doImport, { done: null });
+  const { data, partial } = opts.json ? await doImport() : await withSpinner("Importing...", doImport, { done: null });
   const project = data.project;
   const dir = path3.join(getProjectsRoot(), project.slug);
   fs4.mkdirSync(dir, { recursive: true });
@@ -40800,7 +41105,7 @@ ${error(`\u26A0 ${problems} error/crash line(s) flagged above`)}`
   );
   if (problems > 0) process.exitCode = 1;
 }
-var pageTestCommand = new Command("test").description("Multi-client realtime check: load a URL in N concurrent headless clients; flag console errors, or drive an action and observe shared state (--observe)").argument("<url>", "Deployed URL to load in every client. {{label}}/{{i}} substitute per client in both modes (e.g. ?name=Bot{{i}}, or ?role={{label}} with --labels host,join), so one invocation can give each client a distinct role.").option("--clients <n>", "Number of headless clients to launch", "2").option("--stagger <s>", "Seconds between client starts (passive default 12; interactive default 0)").option("--wait <ms>", "Passive mode: ms each client stays open after load (max 30000)", "24000").option("--observe <expr>", "Interactive: JS expression sampled in each client to read shared state (e.g. presence count). Switches on interactive mode.").option("--action <expr>", "Interactive: one-time JS run in each client before observing (e.g. fill a name + submit). {{label}}/{{i}} are substituted per client.").option("--labels <csv>", "Per-client labels substituted for {{label}} in the URL/--action/--observe (default client-0, client-1, \u2026)").option("--hold <ms>", `Interactive: total observe window per client (${MIN_HOLD_MS}-${MAX_HOLD_MS}ms)`, "8000").option("--samples <k>", "Interactive: number of observations across the hold window (2-30)", "6").option("--wait-for <selector>", "Interactive: wait for this CSS selector before running --action (deterministic readiness gate)").option("--json", "Output as JSON").addHelpText("after", `
+var pageTestCommand = new Command("test").description("Multi-client realtime check: load a URL in N concurrent headless clients; flag console errors, or drive an action and observe shared state (--observe)").argument("<url>", "Deployed URL to load in every client. {{label}}/{{i}} substitute per client in both modes (e.g. ?name=Bot{{i}}, or ?role={{label}} with --labels host,join), so one invocation can give each client a distinct role.").option("--clients <n>", "Number of headless clients to launch", "2").option("--stagger <s>", "Seconds between client starts (passive default 12; interactive default 0)").option("--wait <ms>", "Passive mode: ms each client stays open after load (max 30000)", "24000").option("--observe <expr>", "Interactive: JS expression sampled in each client to read shared state (e.g. presence count). Switches on interactive mode.").option("--action <expr>", "Interactive: one-time JS run in each client before observing (e.g. fill a name + submit). {{label}}/{{i}} are substituted per client.").option("--labels <csv>", "Per-client labels substituted for {{label}} in the URL/--action/--observe (default client-0, client-1, ...)").option("--hold <ms>", `Interactive: total observe window per client (${MIN_HOLD_MS}-${MAX_HOLD_MS}ms)`, "8000").option("--samples <k>", "Interactive: number of observations across the hold window (2-30)", "6").option("--wait-for <selector>", "Interactive: wait for this CSS selector before running --action (deterministic readiness gate)").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   # Passive: load in 3 staggered clients, flag console errors
   gipity page test "https://dev.gipity.ai/me/app/" --clients 3 --stagger 8
@@ -40858,9 +41163,6 @@ function looksLikeHtml(body) {
   const head = body.slice(0, 300).toLowerCase();
   return /<!doctype html|<html[\s>]/.test(head);
 }
-function sha256(s) {
-  return createHash5("sha256").update(s).digest("hex");
-}
 function baseWithSlash(url) {
   return url.endsWith("/") ? url : url + "/";
 }
@@ -40870,8 +41172,14 @@ function resolveUrl(base, path5) {
 async function fetchRaw(url) {
   try {
     const res = await fetch(url, { redirect: "follow" });
-    const body = await res.text();
-    return { status: res.status, contentType: res.headers.get("content-type"), body };
+    const buf = Buffer.from(await res.arrayBuffer());
+    return {
+      status: res.status,
+      contentType: res.headers.get("content-type"),
+      body: buf.toString("utf-8"),
+      bytes: buf.length,
+      sha256: createHash5("sha256").update(buf).digest("hex")
+    };
   } catch {
     return null;
   }
@@ -40883,17 +41191,16 @@ async function probeShell(base) {
   return {
     served: r.status >= 200 && r.status < 300,
     status: r.status,
-    sha256: sha256(r.body),
+    sha256: r.sha256,
     isHtml: looksLikeHtml(r.body)
   };
 }
 function classify(path5, r, shell) {
   if (!r) return { status: null, contentType: null, bytes: 0, verdict: "MISSING", detail: "fetch failed (host unreachable)" };
-  const bytes = Buffer.byteLength(r.body);
-  const base = { status: r.status, contentType: r.contentType, bytes };
+  const base = { status: r.status, contentType: r.contentType, bytes: r.bytes };
   if (r.status >= 400) return { ...base, verdict: "MISSING", detail: `HTTP ${r.status}` };
   const expect = expectedType(path5);
-  if (shell.served && shell.sha256 && sha256(r.body) === shell.sha256) {
+  if (shell.served && shell.sha256 && r.sha256 === shell.sha256) {
     return { ...base, verdict: "MISSING", detail: `HTTP ${r.status} but served the SPA shell (file not deployed)` };
   }
   if (expect && expect !== "html" && looksLikeHtml(r.body)) {
@@ -40909,7 +41216,7 @@ var TAG = {
   "MISSING": error("MISSING   "),
   "WRONG-TYPE": warning("WRONG-TYPE")
 };
-var pageFetchCommand = new Command("fetch").description("Verify deployed non-rendered files (llms.txt, AGENTS.md, robots.txt, served JSON\u2026) really exist - catches the static-host trap where a missing file returns 200 with the SPA shell instead of a 404").argument("<url>", "Deployed app base URL; file paths resolve relative to it").argument("<paths...>", "One or more file paths to verify, e.g. llms.txt AGENTS.md robots.txt").option("--json", "Output as JSON").action((url, paths, opts) => run("Page fetch", async () => {
+var pageFetchCommand = new Command("fetch").description("Verify deployed non-rendered files (llms.txt, AGENTS.md, robots.txt, served JSON...) really exist - catches the static-host trap where a missing file returns 200 with the SPA shell instead of a 404").argument("<url>", "Deployed app base URL; file paths resolve relative to it").argument("<paths...>", "One or more file paths to verify, e.g. llms.txt AGENTS.md robots.txt").option("--json", "Output as JSON").action((url, paths, opts) => run("Page fetch", async () => {
   const shell = await probeShell(url);
   const results = [];
   for (const p of paths) {
@@ -40958,7 +41265,7 @@ init_api();
 init_config();
 init_colors();
 init_utils();
-var recordsCommand = new Command("records").description("Manage records-kit data (registry-driven CRUD)");
+var recordsCommand = new Command("records").description("Manage app records (Gipity Records - validated CRUD with audit history)");
 recordsCommand.command("list").description("List record tables").option("--json", "Output as JSON").action((opts) => run("List", async () => {
   const config = requireConfig();
   const res = await get(`/api/${config.projectGuid}/records-config`);
@@ -41017,6 +41324,16 @@ recordsCommand.command("get <table> <id>").description("Get a record").option("-
   const res = await get(`/api/${config.projectGuid}/records/${table}/${id2}`);
   console.log(opts.json ? JSON.stringify(res.data) : JSON.stringify(res.data, null, 2));
 }));
+recordsCommand.command("history <table> <id>").description("Audit history for a record (who/what changed it, with English summaries)").option("--limit <n>", "Max events", "20").option("--json", "Output as JSON").action((table, id2, opts) => run("History", async () => {
+  const config = requireConfig();
+  const res = await get(
+    `/api/${config.projectGuid}/records/${table}/${id2}/history?limit=${encodeURIComponent(opts.limit)}`
+  );
+  printList(res.data, opts, "No history for this record.", (e) => {
+    const summary = e.detail?.summary || `${e.action} ${e.entity_type} ${e.entity_id}`;
+    return `${muted(e.created_at)}  ${bold(e.source || "-")}  ${summary}`;
+  });
+}));
 recordsCommand.command("create <table>").description("Create a record").requiredOption("--data <json>", "JSON object with field values").option("--json", "Output as JSON").action((table, opts) => run("Create", async () => {
   const config = requireConfig();
   const data = JSON.parse(opts.data);
@@ -41055,7 +41372,7 @@ fnCommand.command("list").description("List functions").option("--json", "Output
 ${muted(f.description)}` : line;
   });
   if (!opts.json && res.data.length > 0) {
-    console.log(muted(`Endpoint: POST ${config.apiBase}/api/${config.projectGuid}/fn/<name>  (same on dev and prod; public path: gipity fn call <name> --anon)`));
+    console.log(muted(`Endpoint: POST ${resolveApiBase()}/api/${config.projectGuid}/fn/<name>  (same on dev and prod; public path: gipity fn call <name> --anon)`));
   }
 }));
 fnCommand.command("logs <name>").description("Show recent logs").option("--limit <n>", "Max entries", "20").option("--json", "Output as JSON").action((name, opts) => run("Logs", async () => {
@@ -41094,10 +41411,9 @@ async function callAnon(projectGuid, name, body) {
     appToken ? { "X-App-Token": appToken } : void 0
   );
 }
-fnCommand.command("call <name> [body]").description("Call a function").option("--data <json>", "JSON request body").option("--anon", "Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account").option("--field <path>", "Print only this field of the result (dot path, e.g. items.0.short_guid)").option("--json", "Output as JSON").action((name, bodyArg, opts) => run("Call", async () => {
+fnCommand.command("call <name> [body]").description("Call a function").option("-d, --data <json>", "JSON request body: inline JSON, @file to read a file, or @- / - for stdin").option("--file <field=@path>", "Attach a file as { data, media_type } under <field> (the vision/media service shape), repeatable, e.g. --file image=@receipt.png", (v7, acc) => (acc || []).concat(v7)).option("--anon", "Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account").option("--field <path>", "Print only this field of the result (dot path, e.g. items.0.short_guid)").option("--json", "Output as JSON").action((name, bodyArg, opts) => run("Call", async () => {
   const config = requireConfig();
-  const raw = bodyArg || opts.data || "{}";
-  const body = JSON.parse(raw);
+  const body = resolveBody(bodyArg || opts.data, opts.file);
   const path5 = `/api/${config.projectGuid}/fn/${encodeURIComponent(name)}`;
   if (opts.anon) {
     console.error(muted("Auth: anonymous visitor (the public path a signed-out user hits)"));
@@ -41145,9 +41461,13 @@ var SERVICES = [
   { name: "location/ip", method: "POST", desc: "IP geolocation ({ ip? })" },
   { name: "location/geocode", method: "POST", desc: "Reverse geocode ({ lat, lon })" }
 ];
-var serviceCommand = new Command("service").description("Call an app service (llm, tts, image, transcribe, ...)").addHelpText("after", "\nCall a Gipity app service: LLM, image, music, TTS, and more.");
-serviceCommand.command("list").description("List callable app services").action(() => run("Services", async () => {
+var serviceCommand = new Command("service").description("Call an app service (llm, tts, image, transcribe, ...)").addHelpText("after", "\nCall a Gipity app service: LLM, image, music, TTS, and more.\nPer-service docs: gipity skill read app-llm | app-tts | app-image | app-video | app-audio (transcribe, sound, music) | app-location");
+serviceCommand.command("list").description("List callable app services").option("--json", "Output the service list as JSON").action((opts) => run("Services", async () => {
   requireConfig();
+  if (opts.json) {
+    console.log(JSON.stringify(SERVICES));
+    return;
+  }
   const width = SERVICES.reduce((m, s) => Math.max(m, s.name.length), 0);
   console.log('Call one with `gipity service call <name> \'{"json":"body"}\'`');
   console.log(muted("(GET endpoints like llm/models, tts/voices take --get and no body)"));
@@ -41187,7 +41507,7 @@ secretsCommand.command("list").alias("ls").description("List secret names (never
   }
   console.log(bold(`${res.data.length} ${scope} secret${res.data.length === 1 ? "" : "s"}:`));
   for (const s of res.data) {
-    const masked = s.preview ? muted(`\u2026${s.preview}`) : muted("(hidden)");
+    const masked = s.preview ? muted(`...${s.preview}`) : muted("(hidden)");
     console.log(`  ${s.name}  ${masked}  ${muted(`updated ${new Date(s.updated_at).toLocaleDateString()}`)}`);
   }
 }));
@@ -41466,10 +41786,9 @@ jobCommand.command("list").description("List jobs").option("--json", "Output as
 ${muted(j7.description)}` : line;
   });
 }));
-jobCommand.command("submit <name> [body]").description("Submit a job (returns a run guid; poll with `job status <guid>`)").option("--data <json>", "JSON input body").option("--idempotency-key <key>", "Idempotency key (replays return the existing run)").option("--json", "Output as JSON").action((name, bodyArg, opts) => run("Submit", async () => {
+jobCommand.command("submit <name> [body]").description("Submit a job (returns a run guid; block on it with `job wait <guid>`)").option("-d, --data <json>", "JSON input body: inline JSON, @file to read a file, or @- / - for stdin").option("--file <field=@path>", "Attach a file as { data, media_type } under <field> (the vision/media service shape), repeatable, e.g. --file image=@scan.png", (v7, acc) => (acc || []).concat(v7)).option("--idempotency-key <key>", "Idempotency key (replays return the existing run)").option("--json", "Output as JSON").action((name, bodyArg, opts) => run("Submit", async () => {
   const config = requireConfig();
-  const raw = bodyArg || opts.data || "{}";
-  const input = JSON.parse(raw);
+  const input = resolveBody(bodyArg || opts.data, opts.file);
   const body = { input };
   if (opts.idempotencyKey) body.idempotency_key = opts.idempotencyKey;
   const res = await post(
@@ -41481,6 +41800,10 @@ jobCommand.command("submit <name> [body]").description("Submit a job (returns a
   } else {
     const tag = res.data.replayed ? warning(" (replayed)") : "";
     console.log(`${bold(res.data.run_guid)}  ${muted(res.data.status)}${tag}`);
+    const TERMINAL = /* @__PURE__ */ new Set(["success", "failed", "cancelled", "canceled", "error"]);
+    if (!TERMINAL.has(res.data.status)) {
+      console.error(muted(`Block until it finishes: gipity job wait ${res.data.run_guid}`));
+    }
   }
 }));
 jobCommand.command("status <runGuid>").description("Show status of a job run").option("--json", "Output as JSON").action((runGuid, opts) => run("Status", async () => {
@@ -41493,11 +41816,56 @@ jobCommand.command("status <runGuid>").description("Show status of a job run").o
   const r = res.data;
   const statusColor = r.status === "success" ? success : r.status === "failed" ? error : muted;
   console.log(`${statusColor(r.status)}  ${muted(r.guid)}`);
-  if (r.progress_pct != null) console.log(`progress: ${Math.round(r.progress_pct * 100)}%${r.progress_message ? ` (${r.progress_message})` : ""}`);
+  if (r.progress_pct != null) {
+    const prog = `${Math.round(r.progress_pct * 100)}%${r.progress_message ? ` (${r.progress_message})` : ""}`;
+    const failedish = r.status === "failed" || r.status === "cancelled" || r.status === "canceled" || r.status === "error";
+    console.log(failedish ? `last progress before ${r.status}: ${prog}` : `progress: ${prog}`);
+  }
   if (r.duration_ms != null) console.log(`duration: ${r.duration_ms}ms`);
   if (r.error) console.log(`${error("error:")} ${r.error}`);
   if (r.output) console.log(`output: ${JSON.stringify(r.output)}`);
 }));
+jobCommand.command("wait <runGuid>").description("Block until a job run finishes, or exit at --timeout so the shell never hangs (poll again to keep waiting)").option("--timeout <seconds>", "Max seconds to wait before giving up and reporting current progress. Bare number = seconds; an explicit unit (90s) means the same here and on `sandbox run --timeout`.", "90").option("--interval <seconds>", "Seconds between polls", "3").option("--json", "Output as JSON").action((runGuid, opts) => run("Wait", async () => {
+  const config = requireConfig();
+  const TERMINAL = /* @__PURE__ */ new Set(["success", "failed", "cancelled", "canceled", "error"]);
+  const durOpt = parseDuration(opts.timeout, "s");
+  const timeoutSec = durOpt ? Math.max(1, Math.round(durOpt.value)) : parseInt(opts.timeout, 10);
+  const timeout = Number.isFinite(timeoutSec) && timeoutSec > 0 ? timeoutSec : 90;
+  const interval = Math.max(1, parseInt(opts.interval, 10) || 3);
+  const deadline = Date.now() + timeout * 1e3;
+  const fetchRun = async () => (await get(`/projects/${config.projectGuid}/jobs/runs/${encodeURIComponent(runGuid)}`)).data;
+  let r = await fetchRun();
+  let lastProgress = "";
+  while (!TERMINAL.has(r.status) && Date.now() < deadline) {
+    if (!opts.json) {
+      const prog = r.progress_pct != null ? `${Math.round(r.progress_pct * 100)}%${r.progress_message ? ` (${r.progress_message})` : ""}` : r.status;
+      if (prog !== lastProgress) {
+        console.error(muted(`... ${prog}`));
+        lastProgress = prog;
+      }
+    }
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    await new Promise((res) => setTimeout(res, Math.min(interval * 1e3, remaining)));
+    r = await fetchRun();
+  }
+  const done = TERMINAL.has(r.status);
+  if (opts.json) {
+    console.log(JSON.stringify(done ? r : { ...r, waiting: true, timed_out: true }));
+  } else if (!done) {
+    const prog = r.progress_pct != null ? ` ${Math.round(r.progress_pct * 100)}%` : "";
+    console.log(`${warning("still running")}${prog}${r.progress_message ? ` (${r.progress_message})` : ""}  ${muted(runGuid)}`);
+    console.log(muted(`Not finished after ${timeout}s. Run \`gipity job wait ${runGuid}\` again to keep waiting.`));
+  } else {
+    const statusColor = r.status === "success" ? success : error;
+    console.log(`${statusColor(r.status)}  ${muted(r.guid)}`);
+    if (r.duration_ms != null) console.log(`duration: ${r.duration_ms}ms`);
+    if (r.error) console.log(`${error("error:")} ${r.error}`);
+    if (r.output) console.log(`output: ${JSON.stringify(r.output)}`);
+  }
+  if (!done) process.exit(2);
+  if (r.status !== "success") process.exit(1);
+}));
 jobCommand.command("runs <name>").description("List recent runs for a job").option("--limit <n>", "Max entries", "20").option("--json", "Output as JSON").action((name, opts) => run("Runs", async () => {
   const config = requireConfig();
   const res = await get(
@@ -41512,19 +41880,44 @@ jobCommand.command("runs <name>").description("List recent runs for a job").opti
 ${error(`error: ${r.error}`)}` : line;
   });
 }));
-jobCommand.command("logs <runGuid>").description("Stream live logs for a job run (--no-follow for a one-shot snapshot)").option("--follow", "Stream via SSE (default)", true).option("--no-follow", "One-shot snapshot of run state instead of streaming").option("--json", "Output as JSON").action((runGuid, opts) => run("Logs", async () => {
+jobCommand.command("logs <runGuid>").description("Stream live logs for a job run (--no-follow for a one-shot snapshot)").option("--follow", "Stream via SSE (default)", true).option("--no-follow", "One-shot snapshot of run state instead of streaming").option("--timeout <seconds>", "Stop streaming after N seconds and exit cleanly, so a bounded peek at the live log never hangs the shell (no shell `timeout` wrapper needed). Bare number = seconds; unit (20s) also accepted.").option("--json", "Output as JSON").action((runGuid, opts) => run("Logs", async () => {
   const config = requireConfig();
   if (!opts.follow) {
     const res2 = await get(`/projects/${config.projectGuid}/jobs/runs/${encodeURIComponent(runGuid)}`);
     console.log(opts.json ? JSON.stringify(res2.data) : JSON.stringify(res2.data, null, 2));
     return;
   }
+  let peekSeconds = 0;
+  if (opts.timeout != null) {
+    const dur = parseDuration(String(opts.timeout), "s");
+    const secs = dur ? dur.value : parseFloat(String(opts.timeout));
+    peekSeconds = Number.isFinite(secs) && secs > 0 ? secs : 0;
+  }
   const url = `${getBaseUrl()}/projects/${config.projectGuid}/jobs/runs/${encodeURIComponent(runGuid)}/logs/stream`;
   const authHeader = await getAuthHeader();
   const headers = { "Accept": "text/event-stream" };
   if (authHeader) headers.Authorization = authHeader;
-  const res = await fetch(url, { headers });
+  const controller = new AbortController();
+  let peekTimer;
+  let peekedOut = false;
+  if (peekSeconds > 0) {
+    peekTimer = setTimeout(() => {
+      peekedOut = true;
+      controller.abort();
+    }, peekSeconds * 1e3);
+  }
+  let res;
+  try {
+    res = await fetch(url, { headers, signal: controller.signal });
+  } catch (e) {
+    if (peekedOut) {
+      console.error(muted(`... still streaming after ${peekSeconds}s. Run \`gipity job logs ${runGuid} --timeout ${Math.round(peekSeconds)}\` again to keep watching, or \`gipity job wait ${runGuid}\` to block until it finishes.`));
+      return;
+    }
+    throw e;
+  }
   if (!res.ok || !res.body) {
+    if (peekTimer) clearTimeout(peekTimer);
     console.error(error(`Failed to open stream: HTTP ${res.status}`));
     process.exit(1);
   }
@@ -41533,8 +41926,21 @@ jobCommand.command("logs <runGuid>").description("Stream live logs for a job run
   let buffer = "";
   let currentEvent = "";
   while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
+    let chunk;
+    try {
+      chunk = await reader.read();
+    } catch (e) {
+      if (peekedOut) {
+        console.error(muted(`... still streaming after ${peekSeconds}s. Run \`gipity job logs ${runGuid} --timeout ${Math.round(peekSeconds)}\` again to keep watching, or \`gipity job wait ${runGuid}\` to block until it finishes.`));
+        return;
+      }
+      throw e;
+    }
+    const { done, value } = chunk;
+    if (done) {
+      if (peekTimer) clearTimeout(peekTimer);
+      break;
+    }
     buffer += decoder.decode(value, { stream: true });
     let nl2;
     while ((nl2 = buffer.indexOf("\n")) >= 0) {
@@ -41546,9 +41952,9 @@ jobCommand.command("logs <runGuid>").description("Stream live logs for a job run
         const dataRaw = line.slice(5).trim();
         if (currentEvent === "log") {
           try {
-            const { type, chunk } = JSON.parse(dataRaw);
-            if (type === "stderr") process.stderr.write(error(chunk));
-            else process.stdout.write(chunk);
+            const { type, chunk: chunk2 } = JSON.parse(dataRaw);
+            if (type === "stderr") process.stderr.write(error(chunk2));
+            else process.stdout.write(chunk2);
           } catch {
           }
         } else if (currentEvent === "status") {
@@ -41588,11 +41994,11 @@ jobCommand.command("cancel <runGuid>").description("Cancel a queued or running j
   }
 }));
 jobCommand.command("run-local <name>").description("Run the job in a local Docker container against your local filesystem (no platform round-trip)").option("--image <image>", "Docker image to run inside", "easyclaw/sandbox:latest").option("--no-deps", "Skip pip/npm install even if a deps file is present").action(async (name, opts) => {
-  const { existsSync: existsSync24, statSync: statSync10 } = await import("node:fs");
-  const { resolve: resolve20, join: join26 } = await import("node:path");
+  const { existsSync: existsSync24, statSync: statSync12 } = await import("node:fs");
+  const { resolve: resolve19, join: join27 } = await import("node:path");
   const { spawnCommand: spawnCommand2, spawnSyncCommand: spawnSyncCommand2 } = await Promise.resolve().then(() => (init_platform(), platform_exports));
-  const jobDir = resolve20(process.cwd(), "jobs", name);
-  if (!existsSync24(jobDir) || !statSync10(jobDir).isDirectory()) {
+  const jobDir = resolve19(process.cwd(), "jobs", name);
+  if (!existsSync24(jobDir) || !statSync12(jobDir).isDirectory()) {
     console.error(error(`jobs/${name}/ not found in current directory`));
     process.exit(1);
   }
@@ -41613,7 +42019,7 @@ jobCommand.command("run-local <name>").description("Run the job in a local Docke
     },
     { file: "main.sh", runtime: "bash", entry: "bash" }
   ];
-  const picked = variants.find((v7) => existsSync24(join26(jobDir, v7.file)));
+  const picked = variants.find((v7) => existsSync24(join27(jobDir, v7.file)));
   if (!picked) {
     console.error(error(`No main.py / main.js / main.sh found under jobs/${name}/`));
     process.exit(1);
@@ -41638,7 +42044,7 @@ jobCommand.command("run-local <name>").description("Run the job in a local Docke
     "-v",
     `${jobDir}:/work`
   ];
-  const needsDeps = opts.deps !== false && picked.depsFile && picked.installCmd && existsSync24(join26(jobDir, picked.depsFile));
+  const needsDeps = opts.deps !== false && picked.depsFile && picked.installCmd && existsSync24(join27(jobDir, picked.depsFile));
   const handlerCmd = `${picked.entry} /work/${picked.file}`;
   let shellCmd;
   if (needsDeps && picked.installCmd) {
@@ -41813,8 +42219,8 @@ emailCommand.command("log").description("Recent email() sends from your app").op
 init_api();
 init_config();
 init_colors();
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolvePath2, dirname as dirname11, relative as relative5, isAbsolute } from "path";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync13, readFileSync as readFileSync19 } from "fs";
+import { resolve as resolvePath2, dirname as dirname11, relative as relative5, isAbsolute, basename as basename6 } from "path";
 
 // src/provider-docs.ts
 var IMAGE_GEMINI_ASPECT_RATIOS = `1:1, 16:9, 9:16, 4:3, 3:4, 3:2, 2:3, 4:5, 5:4, 21:9`;
@@ -41828,11 +42234,12 @@ var TTS_PROVIDER_DESCRIPTIONS = {
 var VIDEO_MODELS_DOC = `veo-3.1-generate-preview (best quality, up to 4K, ~$0.40/sec), veo-3.1-fast-generate-preview (faster, ~$0.10/sec), veo-3.1-lite-generate-preview (budget, ~$0.05/sec), gemini-omni-flash-preview (3-10s @ 720p, conversational editing, ~$0.10/sec)`;
 
 // src/commands/generate.ts
-async function downloadFile(url, filename) {
+async function downloadFile(url, filename, explicit) {
   const res = await fetch(url);
   if (!res.ok) throw new Error(`Download failed: ${res.status}`);
   const buffer = Buffer.from(await res.arrayBuffer());
-  const outPath = correctExtension(filename, buffer);
+  const outPath = explicit ? filename : correctExtension(filename, buffer);
+  if (explicit) noteFormatMismatch(filename, buffer);
   ensureOutputDir(outPath);
   writeFileSync13(outPath, buffer);
   const savedPath = resolvePath2(outPath);
@@ -41867,6 +42274,16 @@ function correctExtension(filename, buf) {
   ));
   return corrected;
 }
+function noteFormatMismatch(filename, buf) {
+  const actual = sniffExt(buf);
+  if (!actual) return;
+  const dot = filename.lastIndexOf(".");
+  const asked = dot > 0 ? filename.slice(dot + 1).toLowerCase() : "";
+  if (!asked || canonicalExt(asked) === actual) return;
+  console.error(muted(
+    `Note: ${basename6(filename)} holds ${formatName(actual)} bytes though its name ends .${asked} \u2014 that's fine (browsers and image/video/edit tools sniff the bytes, not the name). Saved at the exact path you requested; reference it as-is.`
+  ));
+}
 function ensureOutputDir(output) {
   const dir = dirname11(resolvePath2(output));
   try {
@@ -41886,22 +42303,46 @@ async function pushGenerated(savedPath) {
     console.error(muted(`Note: couldn't sync to the cloud automatically (${err.message}). Run \`gipity sync\` before referencing this file in \`gipity sandbox run\`.`));
   }
 }
-var imageCommand = new Command("image").description(`Generate an image from a text prompt using AI.
+function readInputImages(paths) {
+  return paths.map((p) => {
+    let buf;
+    try {
+      buf = readFileSync19(p);
+    } catch (e) {
+      throw new Error(`can't read --input image ${p} (${e.code || e.message}).`);
+    }
+    const mime = guessMime(p);
+    if (!mime.startsWith("image/")) {
+      throw new Error(`--input ${p} is not an image (${mime}). Edit inputs must be image files.`);
+    }
+    return { data: buf.toString("base64"), mime_type: mime };
+  });
+}
+var imageCommand = new Command("image").description(`Generate an image from a text prompt, or EDIT existing images with --input.
 
 Models: ${IMAGE_MODELS_DOC}
 
+Editing (--input): pass one or more source images and the prompt becomes an edit
+instruction applied to them - "make it night time", "add a hat", "remove the car
+in the background", or compose several inputs together. Editing routes to Gemini
+automatically. This is the first-party way to exercise the image-edit flow from
+the CLI; the CLI reads the file bytes itself, so there is no base64/argv fiddling.
+
 Gemini-specific options:
   --aspect-ratio   Control output shape: ${IMAGE_GEMINI_ASPECT_RATIOS}
   --image-size     Control resolution: ${IMAGE_GEMINI_SIZES} (default: 1K)
 
 Examples:
   gipity generate image "a cat wearing a top hat"
+  gipity generate image "make it night time" --input photo.jpg -o edited.png
+  gipity generate image "put the person in the first photo into the second scene" --input person.png --input scene.png
   gipity generate image "landscape sunset" --provider gemini --aspect-ratio 16:9 --image-size 2K
   gipity generate image "product photo" --provider openai --model gpt-image-2 --size 1536x1024 --quality high
-  gipity generate image "abstract art" --provider bfl --model flux-2-pro -o art.png`).argument("<prompt>", "Text description of the image to generate").option("--provider <provider>", "Image provider: openai, bfl, or gemini (default: bfl)").option("--model <model>", "Model ID (see provider list above)").option("--size <size>", 'Dimensions as WxH, e.g. "1024x1024" (OpenAI/BFL)').option("--quality <quality>", "Quality: low|medium|high|auto (gpt-image-2)").option("--aspect-ratio <ratio>", "Aspect ratio (Gemini only): 1:1, 16:9, 9:16, 4:3, 3:4, 3:2, 2:3, 4:5, 5:4, 21:9").option("--image-size <size>", "Output resolution (Gemini only): 512, 1K, 2K, 4K").option("--seed <n>", "Deterministic seed (BFL only): reuse one seed to keep a set of images visually coherent", (v7) => parseInt(v7, 10)).option("-o, --output <file>", "Output path (default ./generated.png). For an image your app ships, write it into the source tree so it deploys, e.g. -o src/assets/images/hero.png; the cwd default is fine for one-off generation.").option("--json", "Output as JSON").action(async (prompt2, opts) => {
+  gipity generate image "abstract art" --provider bfl --model flux-2-pro -o art.png`).argument("<prompt>", "Text description of the image, or (with --input) the edit instruction to apply").option("--input <file>", "Source image to edit/compose (repeatable). With --input the prompt is an edit instruction; routes to Gemini.", (v7, acc) => (acc || []).concat(v7)).option("--provider <provider>", "Image provider: openai, bfl, or gemini (default: bfl)").option("--model <model>", "Model ID (see provider list above)").option("--size <size>", 'Dimensions as WxH, e.g. "1024x1024" (OpenAI/BFL)').option("--quality <quality>", "Quality: low|medium|high|auto (gpt-image-2)").option("--aspect-ratio <ratio>", "Aspect ratio (Gemini only): 1:1, 16:9, 9:16, 4:3, 3:4, 3:2, 2:3, 4:5, 5:4, 21:9").option("--image-size <size>", "Output resolution (Gemini only): 512, 1K, 2K, 4K").option("--seed <n>", "Deterministic seed (BFL only): reuse one seed to keep a set of images visually coherent", (v7) => parseInt(v7, 10)).option("-o, --output <file>", "Output path (default ./generated.png). For an image your app ships, write it into the source tree so it deploys, e.g. -o src/assets/images/hero.png; the cwd default is fine for one-off generation.").option("--json", "Output as JSON").action(async (prompt2, opts) => {
   try {
     const { config } = await resolveProjectContext();
     if (opts.output) ensureOutputDir(opts.output);
+    const inputImages = opts.input ? readInputImages(opts.input) : void 0;
     const doGenerate = () => post(`/projects/${config.projectGuid}/generate/image`, {
       prompt: prompt2,
       provider: opts.provider,
@@ -41910,12 +42351,14 @@ Examples:
       quality: opts.quality,
       aspect_ratio: opts.aspectRatio,
       image_size: opts.imageSize,
-      seed: Number.isFinite(opts.seed) ? opts.seed : void 0
+      seed: Number.isFinite(opts.seed) ? opts.seed : void 0,
+      input_images: inputImages
     });
-    const result = opts.json ? await doGenerate() : await withSpinner("Generating image\u2026", doGenerate, { done: null });
+    const verb = inputImages ? "Editing image..." : "Generating image...";
+    const result = opts.json ? await doGenerate() : await withSpinner(verb, doGenerate, { done: null });
     const ext = result.content_type.includes("png") ? "png" : "jpg";
     const filename = opts.output || `generated.${ext}`;
-    const savedPath = await downloadFile(result.url, filename);
+    const savedPath = await downloadFile(result.url, filename, !!opts.output);
     if (opts.json) {
       console.log(JSON.stringify({ ...result, saved: savedPath }));
     } else {
@@ -41957,9 +42400,9 @@ Examples:
       aspect_ratio: opts.aspect,
       resolution: opts.resolution
     });
-    const result = opts.json ? await doGenerate() : await withSpinner("Generating video\u2026", doGenerate, { done: null });
+    const result = opts.json ? await doGenerate() : await withSpinner("Generating video...", doGenerate, { done: null });
     const filename = opts.output || "generated.mp4";
-    const savedPath = await downloadFile(result.url, filename);
+    const savedPath = await downloadFile(result.url, filename, !!opts.output);
     if (opts.json) {
       console.log(JSON.stringify({ ...result, saved: savedPath }));
     } else {
@@ -42005,9 +42448,9 @@ Examples:
       language: opts.language,
       speakers
     });
-    const result = opts.json ? await doGenerate() : await withSpinner("Generating speech\u2026", doGenerate, { done: null });
+    const result = opts.json ? await doGenerate() : await withSpinner("Generating speech...", doGenerate, { done: null });
     const filename = opts.output || "speech.mp3";
-    const savedPath = await downloadFile(result.url, filename);
+    const savedPath = await downloadFile(result.url, filename, !!opts.output);
     if (opts.json) {
       console.log(JSON.stringify({ ...result, saved: savedPath }));
     } else {
@@ -42044,9 +42487,9 @@ Examples:
       model: opts.model,
       instrumental: !opts.vocals
     });
-    const result = opts.json ? await doGenerate() : await withSpinner("Generating music\u2026", doGenerate, { done: null });
+    const result = opts.json ? await doGenerate() : await withSpinner("Generating music...", doGenerate, { done: null });
     const filename = opts.output || "music.mp3";
-    const savedPath = await downloadFile(result.url, filename);
+    const savedPath = await downloadFile(result.url, filename, !!opts.output);
     if (opts.json) {
       console.log(JSON.stringify({ ...result, saved: savedPath }));
     } else {
@@ -42082,9 +42525,9 @@ Examples:
       duration_seconds: opts.duration,
       prompt_influence: opts.influence
     });
-    const result = opts.json ? await doGenerate() : await withSpinner("Generating sound effect\u2026", doGenerate, { done: null });
+    const result = opts.json ? await doGenerate() : await withSpinner("Generating sound effect...", doGenerate, { done: null });
     const filename = opts.output || "sound.mp3";
-    const savedPath = await downloadFile(result.url, filename);
+    const savedPath = await downloadFile(result.url, filename, !!opts.output);
     if (opts.json) {
       console.log(JSON.stringify({ ...result, saved: savedPath }));
     } else {
@@ -42103,14 +42546,14 @@ var generateCommand = new Command("generate").description("Generate images, vide
 init_api();
 init_config();
 init_colors();
-import { existsSync as existsSync15, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync20 } from "fs";
 import { join as join18 } from "path";
 function readInstalledKitReadme(name) {
   const root = getProjectRoot() ?? process.cwd();
   const kitDir = join18(root, "src", "packages", name);
   if (!existsSync15(join18(kitDir, "package.json"))) return null;
   const readme = join18(kitDir, "README.md");
-  return existsSync15(readme) ? readFileSync18(readme, "utf-8") : null;
+  return existsSync15(readme) ? readFileSync20(readme, "utf-8") : null;
 }
 var skillCommand = new Command("skill").description("Task docs - read the matching skill before building");
 skillCommand.command("list").description("List skills").option("--json", "Output as JSON").action((opts) => run("List", async () => {
@@ -42284,14 +42727,14 @@ var domainCommand = new Command("domain").description("Manage custom domains").a
 
 // src/commands/realtime.ts
 import { existsSync as existsSync16 } from "fs";
-import { dirname as dirname12, resolve as resolve15 } from "path";
+import { dirname as dirname12, resolve as resolve14 } from "path";
 init_api();
 init_config();
 init_colors();
 function hasDeployManifest() {
   const cfgPath = getConfigPath();
   if (!cfgPath) return false;
-  return existsSync16(resolve15(dirname12(cfgPath), "gipity.yaml"));
+  return existsSync16(resolve14(dirname12(cfgPath), "gipity.yaml"));
 }
 var roomCommand = new Command("room").description("Manage realtime rooms").argument("[action]", "list | create | delete | info", "list").argument("[name]", "room name (for create | delete | info)").option("--type <type>", "room type for create: state | relay", "state").option("--auth <level>", "auth level for create: public | user", "public").option("--max-clients <n>", "max clients for create (1-200)").option("--json", "Output as JSON").action((action, name, opts) => run("Realtime room", async () => {
   const config = requireConfig();
@@ -42391,6 +42834,16 @@ function printSkippedCandidates(skipped) {
   if (skipped.length > 10) console.log(muted(`  ... and ${skipped.length - 10} more`));
   console.log(muted('Run frontend/kit module tests in the sandbox: gipity sandbox run bash "node <file>"'));
 }
+function undeployedFunctionsFromFailures(results) {
+  const names = /* @__PURE__ */ new Set();
+  for (const r of results) {
+    if (r.status !== "failed" || !r.error) continue;
+    if (!/404\b/.test(r.error) || !/not\s+found/i.test(r.error)) continue;
+    const m = r.error.match(/Function ['"]?([\w-]+)['"]? (?:not found|failed)/i);
+    if (m) names.add(m[1]);
+  }
+  return [...names];
+}
 var LONG_RUN_MS = 6e4;
 async function pollTestStatus(projectGuid, runGuid, opts) {
   const startTime = Date.now();
@@ -42459,7 +42912,7 @@ async function pollTestStatus(projectGuid, runGuid, opts) {
           const elapsed = Math.round((now - startTime) / 1e3);
           const progress = data.totalFiles === 0 ? "starting up" : `${data.completedFiles}/${data.totalFiles} files`;
           const tally = data.passed + data.failed > 0 ? ` (${data.passed} passed${data.failed > 0 ? `, ${data.failed} failed` : ""} so far)` : "";
-          console.log(muted(`  \u2026 still running \u2014 ${progress}${tally}, ${elapsed}s elapsed`));
+          console.log(muted(`  ... still running - ${progress}${tally}, ${elapsed}s elapsed`));
           if (now - startTime >= LONG_RUN_MS && !longRunHintShown) {
             longRunHintShown = true;
             console.log(muted("  Note: progressing, not hung. LLM-backed tests can take minutes. To verify one function fast, use `gipity fn call <name>`; narrow this suite with `gipity test <path>`."));
@@ -42467,7 +42920,7 @@ async function pollTestStatus(projectGuid, runGuid, opts) {
         }
       }
     }
-    await new Promise((resolve20) => setTimeout(resolve20, getPollInterval()));
+    await new Promise((resolve19) => setTimeout(resolve19, getPollInterval()));
   }
 }
 var testCommand = new Command("test").description("Run tests").argument("[path]", 'Test path filter (e.g. "api", "e2e/portal")').option("--filter <path>", "Alias for the positional test path filter").option("--timeout <ms>", "Per-test timeout in ms", "30000").option("--retry <n>", "Retry failed tests N times", "0").option("--no-sync", "Skip sync-up before tests").option("--json", "Output as JSON").action((pathFilter, opts) => run("Test", async () => {
@@ -42532,6 +42985,15 @@ var testCommand = new Command("test").description("Run tests").argument("[path]"
     }
     console.log("");
   }
+  const undeployed = undeployedFunctionsFromFailures(data.results);
+  if (undeployed.length > 0) {
+    const list = undeployed.map((n) => `'${n}'`).join(", ");
+    console.log(warning(
+      `${undeployed.length === 1 ? "Function" : "Functions"} ${list} 404'd: tests call functions against the DEPLOYED build, and ${undeployed.length === 1 ? "this one is" : "these are"} not deployed yet.`
+    ));
+    console.log(muted("Deploy first, then re-run: gipity deploy dev && gipity test"));
+    console.log("");
+  }
   const parts = [];
   if (data.passed > 0) parts.push(success(`${data.passed} passed`));
   if (data.failed > 0) parts.push(error(`${data.failed} failed`));
@@ -42681,12 +43143,12 @@ var locationCommand = new Command("location").description("Show location").argum
 }));
 
 // src/commands/doctor.ts
-import { existsSync as existsSync18, readFileSync as readFileSync20, statSync as statSync8 } from "fs";
-import { join as join20, resolve as resolve16 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync22, statSync as statSync9 } from "fs";
+import { join as join20, resolve as resolve15 } from "path";
 import { homedir as homedir14 } from "os";
 
 // src/updater/state.ts
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14, existsSync as existsSync17 } from "fs";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14, existsSync as existsSync17 } from "fs";
 import { join as join19 } from "path";
 import { homedir as homedir13 } from "os";
 var GIPITY_DIR = join19(homedir13(), ".gipity");
@@ -42711,7 +43173,7 @@ function ensureDir() {
 function readState() {
   if (!existsSync17(STATE_FILE)) return { ...DEFAULT_STATE };
   try {
-    return { ...DEFAULT_STATE, ...JSON.parse(readFileSync19(STATE_FILE, "utf-8")) };
+    return { ...DEFAULT_STATE, ...JSON.parse(readFileSync21(STATE_FILE, "utf-8")) };
   } catch {
     return { ...DEFAULT_STATE };
   }
@@ -42723,7 +43185,7 @@ function writeState(state) {
 function readSettings() {
   if (!existsSync17(SETTINGS_FILE)) return { ...DEFAULT_SETTINGS };
   try {
-    return { ...DEFAULT_SETTINGS, ...JSON.parse(readFileSync19(SETTINGS_FILE, "utf-8")) };
+    return { ...DEFAULT_SETTINGS, ...JSON.parse(readFileSync21(SETTINGS_FILE, "utf-8")) };
   } catch {
     return { ...DEFAULT_SETTINGS };
   }
@@ -42759,7 +43221,7 @@ function localVersion() {
   const pkgPath = join20(LOCAL_PKG_DIR, "package.json");
   if (!existsSync18(pkgPath)) return null;
   try {
-    return JSON.parse(readFileSync20(pkgPath, "utf-8")).version ?? null;
+    return JSON.parse(readFileSync22(pkgPath, "utf-8")).version ?? null;
   } catch {
     return null;
   }
@@ -42767,7 +43229,7 @@ function localVersion() {
 function shimVersion() {
   try {
     const url = new URL("../../package.json", import.meta.url);
-    return JSON.parse(readFileSync20(url, "utf-8")).version;
+    return JSON.parse(readFileSync22(url, "utf-8")).version;
   } catch {
     return "unknown";
   }
@@ -42850,7 +43312,7 @@ var doctorCommand = new Command("doctor").description("Check install + environme
   console.log(`${muted("claude code     ")} installed ${yn(env.claude.installed)} \xB7 authenticated ${yn(env.claude.authenticated)}`);
   const autostartLabel = env.relay.autostart === null ? muted("n/a") : yn(env.relay.autostart);
   console.log(`${muted("relay           ")} paired ${yn(env.relay.paired)} \xB7 running ${yn(env.relay.running)} \xB7 autostart ${autostartLabel}${env.relay.paused ? warning(" \xB7 paused") : ""}${env.relay.device ? muted(`  (${env.relay.device.name})`) : ""}`);
-  if (existsSync18(resolve16(process.cwd(), ".codex", "hooks.json"))) {
+  if (existsSync18(resolve15(process.cwd(), ".codex", "hooks.json"))) {
     console.log(`${muted("codex hooks     ")} ${warning("written")} - session capture needs a one-time approval: run /hooks inside Codex in this project`);
   }
   console.log(`${muted("ready           ")} ${env.ready ? success("yes") : warning("no - run `gipity build` (or the desktop app) to finish setup")}`);
@@ -42870,14 +43332,68 @@ var doctorCommand = new Command("doctor").description("Check install + environme
   console.log(`${muted("last check      ")} ${rel(state.lastCheckAt)}`);
   console.log(`${muted("last error      ")} ${state.lastError ? error(state.lastError) : dim("none")}`);
   console.log(`${muted("state file      ")} ${existsSync18(STATE_FILE) ? STATE_FILE : dim("(none yet)")}`);
-  console.log(`${muted("update log      ")} ${existsSync18(UPDATE_LOG) ? `${UPDATE_LOG} (${statSync8(UPDATE_LOG).size} bytes)` : dim("(none yet)")}`);
+  console.log(`${muted("update log      ")} ${existsSync18(UPDATE_LOG) ? `${UPDATE_LOG} (${statSync9(UPDATE_LOG).size} bytes)` : dim("(none yet)")}`);
   console.log("");
   console.log(dim("Force an update with: gipity update"));
 });
 
 // src/updater/check.ts
-import { appendFileSync, existsSync as existsSync19 } from "fs";
+import { appendFileSync } from "fs";
+
+// src/updater/install.ts
+import { existsSync as existsSync19, mkdirSync as mkdirSync15, rmSync as rmSync2, statSync as statSync10, unlinkSync as unlinkSync5, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname13, join as join21 } from "path";
 init_platform();
+var UPDATE_LOCK = join21(GIPITY_DIR, "update.lock");
+var LOCK_STALE_MS2 = 10 * 60 * 1e3;
+function npmInstallGipity(version) {
+  const res = spawnSyncCommand(resolveCommand("npm"), ["install", "--no-audit", "--no-fund", "--ignore-scripts", `gipity@${version}`], {
+    cwd: LOCAL_DIR,
+    stdio: ["ignore", "ignore", "pipe"],
+    encoding: "utf-8"
+  });
+  return {
+    ok: res.status === 0 && existsSync19(LOCAL_ENTRY),
+    status: res.status,
+    stderr: (res.stderr || "").toString(),
+    spawnError: res.error
+  };
+}
+var WEDGE_CODES = /\b(ENOTEMPTY|EEXIST|ENOTDIR|EISDIR|EJSONPARSE)\b/;
+function isWedged(stderr) {
+  return WEDGE_CODES.test(stderr);
+}
+function resetLocalTree(dir = LOCAL_DIR) {
+  mkdirSync15(dir, { recursive: true });
+  rmSync2(join21(dir, "node_modules"), { recursive: true, force: true });
+  rmSync2(join21(dir, "package-lock.json"), { force: true });
+  writeFileSync15(join21(dir, "package.json"), JSON.stringify({ name: "gipity-local", private: true, version: "0.0.0" }, null, 2));
+}
+function acquireUpdateLock(lockPath2 = UPDATE_LOCK) {
+  mkdirSync15(dirname13(lockPath2), { recursive: true });
+  try {
+    writeFileSync15(lockPath2, String(process.pid), { flag: "wx" });
+    return true;
+  } catch {
+    try {
+      if (Date.now() - statSync10(lockPath2).mtimeMs > LOCK_STALE_MS2) {
+        unlinkSync5(lockPath2);
+        writeFileSync15(lockPath2, String(process.pid), { flag: "wx" });
+        return true;
+      }
+    } catch {
+    }
+    return false;
+  }
+}
+function releaseUpdateLock(lockPath2 = UPDATE_LOCK) {
+  try {
+    unlinkSync5(lockPath2);
+  } catch {
+  }
+}
+
+// src/updater/check.ts
 var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
 function log(line) {
   try {
@@ -42906,12 +43422,24 @@ async function fetchLatestVersion() {
   return json.version;
 }
 function installVersion(version) {
-  const res = spawnSyncCommand(resolveCommand("npm"), ["install", "--silent", "--no-audit", "--no-fund", "--ignore-scripts", `gipity@${version}`], {
-    cwd: LOCAL_DIR,
-    stdio: "ignore"
-  });
-  if (res.error) log(`npm spawn failed: ${res.error.message}`);
-  return res.status === 0 && existsSync19(LOCAL_ENTRY);
+  let res = npmInstallGipity(version);
+  if (!res.ok && !res.spawnError && isWedged(res.stderr)) {
+    log(`wedged install tree detected; wiping node_modules and retrying:
+${res.stderr.trim().slice(-2e3)}`);
+    resetLocalTree();
+    res = npmInstallGipity(version);
+    if (res.ok) log("clean reinstall succeeded");
+  }
+  if (res.ok) return { ok: true };
+  if (res.spawnError) {
+    log(`npm spawn failed: ${res.spawnError.message}`);
+    return { ok: false, detail: res.spawnError.message };
+  }
+  if (res.stderr.trim()) log(`npm stderr (exit ${res.status}):
+${res.stderr.trim().slice(-2e3)}`);
+  if (res.status === 0) return { ok: false, detail: "npm succeeded but the installed package is missing dist/index.js" };
+  const firstLine = res.stderr.split("\n").map((l7) => l7.trim()).find((l7) => l7.length > 0) || `npm exit ${res.status}`;
+  return { ok: false, detail: firstLine.length > 160 ? firstLine.slice(0, 157) + "..." : firstLine };
 }
 async function runCheck(opts = {}) {
   const state = readState();
@@ -42944,17 +43472,27 @@ async function runCheck(opts = {}) {
     log(`up-to-date (current=${current}, latest=${latest})`);
     return { updated: false, reason: "up-to-date" };
   }
+  if (!acquireUpdateLock()) {
+    log("skipped: another update is already in progress");
+    return { updated: false, reason: "another update is already in progress" };
+  }
   log(`upgrading ${current} \u2192 ${latest}`);
-  const ok = installVersion(latest);
   state.lastCheckAt = Date.now();
-  if (ok) {
+  writeState(state);
+  let install;
+  try {
+    install = installVersion(latest);
+  } finally {
+    releaseUpdateLock();
+  }
+  if (install.ok) {
     state.installedVersion = latest;
     state.lastError = null;
     writeState(state);
     log(`upgraded to ${latest}`);
     return { updated: true, from: current, to: latest };
   }
-  state.lastError = `npm install gipity@${latest} failed`;
+  state.lastError = `npm install gipity@${latest} failed` + (install.detail ? `: ${install.detail}` : "");
   writeState(state);
   log(state.lastError);
   return { updated: false, reason: state.lastError };
@@ -42978,6 +43516,10 @@ var updateCommand = new Command("update").description("Update the CLI").action(a
     console.log(success("Already on the latest version."));
   } else {
     console.log(warning(`No update applied: ${result.reason}`));
+    if (result.reason?.startsWith("npm install")) {
+      console.log(dim("Full npm output: ~/.gipity/update.log"));
+      console.log(dim("If it keeps failing, delete ~/.gipity/local and run any gipity command to reinstall."));
+    }
   }
 });
 
@@ -42985,17 +43527,17 @@ var updateCommand = new Command("update").description("Update the CLI").action(a
 init_api();
 init_utils();
 init_colors();
-import { existsSync as existsSync22, readFileSync as readFileSync23, unlinkSync as unlinkSync7 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync25, unlinkSync as unlinkSync8 } from "fs";
 import { spawn as spawn2 } from "child_process";
 
 // src/relay/daemon.ts
 init_platform();
 init_config();
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync16, existsSync as existsSync21, readFileSync as readFileSync22, writeFileSync as writeFileSync15, chmodSync as chmodSync3, closeSync as closeSync4, openSync as openSync4, unlinkSync as unlinkSync6 } from "fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync17, existsSync as existsSync21, readFileSync as readFileSync24, writeFileSync as writeFileSync16, chmodSync as chmodSync3, closeSync as closeSync4, openSync as openSync4, unlinkSync as unlinkSync7 } from "fs";
 import { stat, readFile } from "fs/promises";
 import { createInterface as createInterface2 } from "readline";
 import { homedir as homedir16, hostname as hostname5, platform as osPlatform3, loadavg as loadavg2, freemem as freemem2, totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 init_auth();
 init_api();
 
@@ -43752,20 +44294,20 @@ init_platform();
 init_client_context();
 import { cpus, freemem, totalmem, loadavg, release, uptime, homedir as homedir15 } from "os";
 import { statfsSync, readdirSync as readdirSync9 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var PROBE_TIMEOUT_MS = 4e3;
 function parseVersion(out) {
   const m = out.match(/\d+\.\d+(?:\.\d+)?(?:[-.\w]*)?/);
   return m ? m[0] : void 0;
 }
 function runProbe(cmd, args) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve19) => {
     let out = "";
     let settled = false;
     const done = (s) => {
       if (!settled) {
         settled = true;
-        resolve20(s);
+        resolve19(s);
       }
     };
     let child;
@@ -43819,7 +44361,7 @@ async function detectGpu() {
 function diskUsage() {
   try {
     if (typeof statfsSync !== "function") return void 0;
-    const st2 = statfsSync(join21(homedir15(), "GipityProjects"), { bigint: false });
+    const st2 = statfsSync(join22(homedir15(), "GipityProjects"), { bigint: false });
     if (!st2 || !st2.bsize) return void 0;
     return { total: st2.bsize * st2.blocks, free: st2.bsize * st2.bavail };
   } catch {
@@ -43833,7 +44375,7 @@ function diskUsage() {
 }
 function localProjectCount() {
   try {
-    return readdirSync9(join21(homedir15(), "GipityProjects"), { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).length;
+    return readdirSync9(join22(homedir15(), "GipityProjects"), { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).length;
   } catch {
     return void 0;
   }
@@ -43964,8 +44506,8 @@ var SessionPool = class {
     const done = new Promise((r) => {
       markDone = r;
     });
-    return new Promise((resolve20, reject) => {
-      const turn = { onMessage: p.onMessage, resolve: resolve20, reject, interruptRequested: false, wasHot, done, markDone };
+    return new Promise((resolve19, reject) => {
+      const turn = { onMessage: p.onMessage, resolve: resolve19, reject, interruptRequested: false, wasHot, done, markDone };
       session.current = turn;
       session.state = "running";
       session.lastActivityAt = Date.now();
@@ -44142,7 +44684,7 @@ var SessionPool = class {
 // src/relay/daemon.ts
 init_config();
 init_api();
-var RELAY_LOG_PATH = join23(homedir16(), ".gipity", "relay.log");
+var RELAY_LOG_PATH = join24(homedir16(), ".gipity", "relay.log");
 var HEARTBEAT_INTERVAL_MS = parseInt(process.env.GIPITY_RELAY_HEARTBEAT_MS || "60000", 10);
 var DIAGNOSTICS_INTERVAL_MS = parseInt(process.env.GIPITY_RELAY_DIAGNOSTICS_MS || String(24 * 60 * 60 * 1e3), 10);
 var LONG_POLL_TIMEOUT_MS = parseInt(process.env.GIPITY_RELAY_POLL_TIMEOUT_MS || "35000", 10);
@@ -44259,8 +44801,8 @@ function log2(level, msg, extra) {
   const pretty = `${C7.dim(hhmmss())} ${badge(level)} ${C7.bold(msg)}${formatExtra(extra)}`;
   process.stderr.write(pretty + "\n");
   try {
-    const dir = join23(homedir16(), ".gipity");
-    mkdirSync16(dir, { recursive: true });
+    const dir = join24(homedir16(), ".gipity");
+    mkdirSync17(dir, { recursive: true });
     lockLogPerms(dir, RELAY_LOG_PATH);
     const json = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), level, msg, ...extra ?? {} });
     appendFileSync3(RELAY_LOG_PATH, json + "\n");
@@ -44384,10 +44926,10 @@ async function heartbeatLoop(ctx) {
     }
     await Promise.race([
       sleep4(HEARTBEAT_INTERVAL_MS, ctx.abort.signal),
-      new Promise((resolve20) => {
+      new Promise((resolve19) => {
         heartbeatPoke = () => {
           heartbeatPoke = null;
-          resolve20();
+          resolve19();
         };
       })
     ]);
@@ -44431,9 +44973,9 @@ async function dispatchLoop(ctx, opts) {
     while (inflight.size >= MAX_CONCURRENT_DISPATCHES && !ctx.abort.signal.aborted) {
       await Promise.race([
         ...inflight,
-        new Promise((resolve20) => {
-          if (ctx.abort.signal.aborted) return resolve20();
-          ctx.abort.signal.addEventListener("abort", () => resolve20(), { once: true });
+        new Promise((resolve19) => {
+          if (ctx.abort.signal.aborted) return resolve19();
+          ctx.abort.signal.addEventListener("abort", () => resolve19(), { once: true });
         })
       ]);
     }
@@ -44660,7 +45202,7 @@ function isSafeSessionId(s) {
 function transcriptPathFor(cwd, sessionId) {
   if (!isSafeSessionId(sessionId)) return null;
   const slug = cwd.replace(/[^a-zA-Z0-9]/g, "-");
-  return join23(homedir16(), ".claude", "projects", slug, `${sessionId}.jsonl`);
+  return join24(homedir16(), ".claude", "projects", slug, `${sessionId}.jsonl`);
 }
 function formatDuration(ms2) {
   const totalSec = ms2 / 1e3;
@@ -45114,11 +45656,11 @@ async function resolveCwdForProject(d) {
     throw new Error(`Invalid project slug: ${JSON.stringify(d.project_slug)}`);
   }
   const root = getProjectsRoot();
-  const path5 = join23(root, d.project_slug);
-  const configPath = join23(path5, ".gipity.json");
+  const path5 = join24(root, d.project_slug);
+  const configPath = join24(path5, ".gipity.json");
   if (existsSync21(configPath)) {
     try {
-      const cfg = JSON.parse(readFileSync22(configPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync24(configPath, "utf-8"));
       if (cfg.projectGuid === d.project_guid) return { cwd: path5, bootstrapped: false };
       log2("warn", "project dir exists but guid mismatch - using it anyway", {
         path: path5,
@@ -45130,9 +45672,9 @@ async function resolveCwdForProject(d) {
     }
   }
   log2("info", "bootstrapping new project dir", { slug: d.project_slug, path: path5 });
-  mkdirSync16(path5, { recursive: true });
+  mkdirSync17(path5, { recursive: true });
   const apiBase2 = getApiBaseOverride() || DEFAULT_API_BASE;
-  writeFileSync15(configPath, JSON.stringify({
+  writeFileSync16(configPath, JSON.stringify({
     projectGuid: d.project_guid,
     projectSlug: d.project_slug,
     accountSlug: d.account_slug,
@@ -45209,7 +45751,7 @@ async function killRunningForConv(convGuid) {
     }
   }
   const graceTimers = [];
-  const escalate = new Promise((resolve20) => {
+  const escalate = new Promise((resolve19) => {
     const t = setTimeout(() => {
       for (const e of matches) {
         log2("warn", "previous dispatch ignored SIGTERM - escalating to SIGKILL", { conv: convGuid });
@@ -45218,7 +45760,7 @@ async function killRunningForConv(convGuid) {
         } catch {
         }
       }
-      resolve20();
+      resolve19();
     }, KILL_GRACE_MS);
     graceTimers.push(t);
   });
@@ -45229,7 +45771,7 @@ async function killRunningForConv(convGuid) {
 }
 async function spawnSync2(cwd, timeoutMs, onSpawn) {
   const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || resolveCommand("gipity");
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve19, reject) => {
     const child = spawnCommand(cmd, ["sync", "--json"], {
       cwd,
       env: childEnv(),
@@ -45253,7 +45795,7 @@ async function spawnSync2(cwd, timeoutMs, onSpawn) {
         } catch {
         }
         try {
-          unlinkSync6(join23(cwd, ".gipity", "sync.lock"));
+          unlinkSync7(join24(cwd, ".gipity", "sync.lock"));
         } catch {
         }
         finish(() => reject(new Error(`timed out after ${Math.round(timeoutMs / 1e3)}s`)));
@@ -45269,7 +45811,7 @@ async function spawnSync2(cwd, timeoutMs, onSpawn) {
     child.on("exit", (code) => finish(() => {
       if (code === 0) {
         log2("info", "sync done", { cwd, stdoutLen });
-        resolve20();
+        resolve19();
       } else {
         reject(new Error(`gipity sync exited ${code}${stderrBuf ? `: ${stderrBuf.trim().slice(0, 300)}` : ""}`));
       }
@@ -45281,7 +45823,7 @@ async function spawnGipityClaude(args, cwd, d, queue, meta) {
   const cmd = process.env.GIPITY_RELAY_CLAUDE_CMD || resolveCommand("gipity");
   const fullArgs = streamJson ? [...args, "--output-format", "stream-json", "--verbose", "--include-partial-messages"] : [...args];
   const env = streamJson ? childEnv({ GIPITY_CONVERSATION_GUID: d.conversation_guid, GIPITY_CAPTURE: "off" }) : childEnv({ GIPITY_CONVERSATION_GUID: d.conversation_guid });
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve19, reject) => {
     const child = spawnCommand(cmd, fullArgs, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
     let resolveExited = () => {
     };
@@ -45461,7 +46003,7 @@ async function spawnGipityClaude(args, cwd, d, queue, meta) {
       void postProgress(d.conversation_guid, buildProgressPayload(false));
       if (ownQueue) await q.close();
       cleanup();
-      resolve20({
+      resolve19({
         exitCode: code ?? 1,
         killed,
         runtimeLimit,
@@ -45475,10 +46017,10 @@ async function runDispatchSync(d, cwd) {
   let killed = false;
   try {
     await spawnSync2(cwd, PROJECT_SYNC_TIMEOUT_MS, (child) => {
-      const exited = new Promise((resolve20) => {
+      const exited = new Promise((resolve19) => {
         child.once("exit", (_code, signal) => {
           if (signal === "SIGTERM") killed = true;
-          resolve20();
+          resolve19();
         });
       });
       running.set(d.short_guid, { child, convGuid: d.conversation_guid, exited });
@@ -45509,18 +46051,18 @@ function killDispatch(shortGuid) {
   return false;
 }
 function sleep4(ms2, signal) {
-  return new Promise((resolve20) => {
-    if (signal?.aborted) return resolve20();
+  return new Promise((resolve19) => {
+    if (signal?.aborted) return resolve19();
     let onAbort = null;
     const t = setTimeout(() => {
       if (onAbort && signal) signal.removeEventListener("abort", onAbort);
-      resolve20();
+      resolve19();
     }, ms2);
     if (signal) {
       onAbort = () => {
         clearTimeout(t);
         signal.removeEventListener("abort", onAbort);
-        resolve20();
+        resolve19();
       };
       signal.addEventListener("abort", onAbort, { once: true });
     }
@@ -45694,7 +46236,7 @@ relayCommand.command("stop").description("Stop the background service").option("
     console.log(muted("Background service isn't running."));
     return;
   }
-  const pid = parseInt(readFileSync23(pidPath, "utf-8").trim(), 10);
+  const pid = parseInt(readFileSync25(pidPath, "utf-8").trim(), 10);
   if (!pid || isNaN(pid)) {
     console.error(error("PID file is empty or malformed."));
     process.exit(1);
@@ -45705,7 +46247,7 @@ relayCommand.command("stop").description("Stop the background service").option("
     if (err?.code === "ESRCH") {
       console.log(muted(`PID ${pid} not running - cleaning up stale PID file.`));
       try {
-        unlinkSync7(pidPath);
+        unlinkSync8(pidPath);
       } catch {
       }
       return;
@@ -45819,7 +46361,7 @@ relayCommand.command("revoke").description("Revoke and forget this device").acti
   }
   const pidPath = getDaemonPidPath();
   if (existsSync22(pidPath)) {
-    const pid = parseInt(readFileSync23(pidPath, "utf-8").trim(), 10);
+    const pid = parseInt(readFileSync25(pidPath, "utf-8").trim(), 10);
     if (pid && !isNaN(pid)) {
       try {
         process.kill(pid, "SIGTERM");
@@ -45838,7 +46380,7 @@ relayCommand.command("log").description("Tail the service log").option("-n, --li
   }
   const lines = parseInt(opts.lines, 10) || 100;
   try {
-    const all = readFileSync23(path5, "utf-8").split("\n");
+    const all = readFileSync25(path5, "utf-8").split("\n");
     const tail = all.slice(-lines - 1).join("\n");
     process.stdout.write(tail);
   } catch (err) {
@@ -45891,9 +46433,7 @@ var connectCommand = new Command("connect").alias("setup").description("Connect
     console.log("");
     const enabled = await runRelaySetup({ mode: "run-now" });
     if (enabled) {
-      const running2 = isRelayEnabled() && !isPaused();
-      console.log(`  ${success("Done")} \u2014 your relay ${running2 ? "is running in the background" : "is set up"} and will start with your computer.`);
-      console.log(`  ${muted("Open")} ${brand("gipity.ai")} ${muted("and start a chat to drive your coding agent here. Manage it with `gipity relay status`.")}`);
+      console.log(`  ${muted("Manage it anytime with `gipity relay status`.")}`);
     } else {
       console.log(`  ${muted("No relay set up. Run `gipity connect` again anytime, or `gipity build` to start building.")}`);
     }
@@ -45911,15 +46451,15 @@ init_api();
 init_auth();
 init_utils();
 init_colors();
-import { existsSync as existsSync23, rmSync as rmSync3, unlinkSync as unlinkSync8, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync23, rmSync as rmSync4, unlinkSync as unlinkSync9, readFileSync as readFileSync26, writeFileSync as writeFileSync17 } from "fs";
 import { homedir as homedir17, platform as osPlatform4 } from "os";
-import { join as join24, resolve as resolve18 } from "path";
+import { join as join25, resolve as resolve17 } from "path";
 function removeGipityPluginConfig() {
-  const settingsPath = join24(homedir17(), ".claude", "settings.json");
+  const settingsPath = join25(homedir17(), ".claude", "settings.json");
   if (!existsSync23(settingsPath)) return false;
   let settings;
   try {
-    settings = JSON.parse(readFileSync24(settingsPath, "utf-8"));
+    settings = JSON.parse(readFileSync26(settingsPath, "utf-8"));
   } catch {
     return false;
   }
@@ -45934,7 +46474,7 @@ function removeGipityPluginConfig() {
     if (Object.keys(settings.extraKnownMarketplaces).length === 0) delete settings.extraKnownMarketplaces;
     changed = true;
   }
-  if (changed) writeFileSync16(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  if (changed) writeFileSync17(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return changed;
 }
 function removeInstallerPathLines() {
@@ -45942,11 +46482,11 @@ function removeInstallerPathLines() {
   const marker = "# Added by the Gipity installer";
   const touched = [];
   for (const name of [".bashrc", ".zshrc", ".profile"]) {
-    const rc2 = join24(homedir17(), name);
+    const rc2 = join25(homedir17(), name);
     if (!existsSync23(rc2)) continue;
     let text;
     try {
-      text = readFileSync24(rc2, "utf-8");
+      text = readFileSync26(rc2, "utf-8");
     } catch {
       continue;
     }
@@ -45956,7 +46496,7 @@ function removeInstallerPathLines() {
     );
     if (kept.length === lines.length) continue;
     try {
-      writeFileSync16(rc2, kept.join("\n"));
+      writeFileSync17(rc2, kept.join("\n"));
       touched.push(rc2);
     } catch {
     }
@@ -45968,7 +46508,7 @@ function tildify2(p) {
   return p === home || p.startsWith(home + "/") ? "~" + p.slice(home.length) : p;
 }
 function resolveCliPath2() {
-  return resolve18(process.argv[1] ?? "gipity");
+  return resolve17(process.argv[1] ?? "gipity");
 }
 async function stopDaemon() {
   if (!isDaemonRunning()) return;
@@ -46004,7 +46544,7 @@ function removeServiceUnit() {
     }
     if (existsSync23(plan2.path)) {
       try {
-        unlinkSync8(plan2.path);
+        unlinkSync9(plan2.path);
       } catch {
       }
     }
@@ -46025,8 +46565,8 @@ async function revokeDeviceBestEffort() {
 }
 var uninstallCommand = new Command("uninstall").description("Uninstall Gipity").option("--yes", "Skip confirmation prompts").action(async (opts) => {
   const autoYes = opts.yes || getAutoConfirm();
-  const gipityDir = join24(homedir17(), ".gipity");
-  const launcherBin = join24(gipityDir, "launcher", "bin", "gipity");
+  const gipityDir = join25(homedir17(), ".gipity");
+  const launcherBin = join25(gipityDir, "launcher", "bin", "gipity");
   const installedViaLauncher = existsSync23(launcherBin);
   console.log(`${bold("Gipity uninstall")} - this will:`);
   console.log(`\u2022 Stop the running relay daemon (if any)`);
@@ -46073,7 +46613,7 @@ var uninstallCommand = new Command("uninstall").description("Uninstall Gipity").
   if (agentSkills.skills.length) {
     for (const name of agentSkills.skills) {
       try {
-        rmSync3(join24(AGENTS_SKILLS_DIR, name), { recursive: true, force: true });
+        rmSync4(join25(AGENTS_SKILLS_DIR, name), { recursive: true, force: true });
       } catch {
       }
     }
@@ -46081,7 +46621,7 @@ var uninstallCommand = new Command("uninstall").description("Uninstall Gipity").
   }
   if (existsSync23(gipityDir)) {
     try {
-      rmSync3(gipityDir, { recursive: true, force: true });
+      rmSync4(gipityDir, { recursive: true, force: true });
       console.log(`${success(`Removed ${gipityDir}/`)}`);
     } catch (err) {
       console.error(`${error(`Could not remove ${gipityDir}: ${err?.message || err}`)}`);
@@ -46225,7 +46765,7 @@ gmailCommand.command("send").description("Send a new email from your Gmail").req
   const recap = opts.to.join(", ") + (opts.cc.length ? `, cc: ${opts.cc.join(", ")}` : "");
   printResult(`Sent from your Gmail to ${recap}.`, opts, { sent: true, to: opts.to });
 }));
-gmailCommand.command("reply").description("Reply to a Gmail thread. Get thread-id + message-id from `gmail search`.").requiredOption("--thread-id <id>", "Thread ID (from `gmail search`)").requiredOption("--message-id <id>", "Message ID being replied to (In-Reply-To)").requiredOption("--to <email>", "Recipient (repeatable)", collect2, []).option("--cc <email>", "Cc recipient (repeatable)", collect2, []).option("--bcc <email>", "Bcc recipient (repeatable)", collect2, []).option("--reply-to <email>", "Reply-To header address").requiredOption("--subject <s>", 'Subject (usually "Re: \u2026" of the original)').requiredOption("--body <text>", "Reply body (you compose the quote header)").option("--json", "Output as JSON").action((opts) => run("Reply", async () => {
+gmailCommand.command("reply").description("Reply to a Gmail thread. Get thread-id + message-id from `gmail search`.").requiredOption("--thread-id <id>", "Thread ID (from `gmail search`)").requiredOption("--message-id <id>", "Message ID being replied to (In-Reply-To)").requiredOption("--to <email>", "Recipient (repeatable)", collect2, []).option("--cc <email>", "Cc recipient (repeatable)", collect2, []).option("--bcc <email>", "Bcc recipient (repeatable)", collect2, []).option("--reply-to <email>", "Reply-To header address").requiredOption("--subject <s>", 'Subject (usually "Re: ..." of the original)').requiredOption("--body <text>", "Reply body (you compose the quote header)").option("--json", "Output as JSON").action((opts) => run("Reply", async () => {
   if (!opts.to.length) throw new Error("--to is required (pass at least one)");
   const payload = {
     thread_id: opts.threadId,
@@ -46242,7 +46782,7 @@ gmailCommand.command("reply").description("Reply to a Gmail thread. Get thread-i
 }));
 
 // src/commands/text.ts
-import { readFileSync as readFileSync25 } from "fs";
+import { readFileSync as readFileSync27 } from "fs";
 init_colors();
 
 // src/helpers/text-analysis.ts
@@ -46397,10 +46937,10 @@ function areAnagrams(a, b7) {
 
 // src/commands/text.ts
 function resolveInput(args, opts) {
-  if (opts.file) return readFileSync25(opts.file, "utf-8");
+  if (opts.file) return readFileSync27(opts.file, "utf-8");
   if (args.length) return args.join(" ");
   try {
-    return readFileSync25(0, "utf-8");
+    return readFileSync27(0, "utf-8");
   } catch {
     return "";
   }
@@ -46606,8 +47146,8 @@ function collectRealFlags(argv2, program3) {
 }
 
 // src/trace.ts
-import { openSync as openSync5, writeSync, mkdirSync as mkdirSync17 } from "fs";
-import { join as join25 } from "path";
+import { openSync as openSync5, writeSync, mkdirSync as mkdirSync18 } from "fs";
+import { join as join26 } from "path";
 import { homedir as homedir18 } from "os";
 var TRACE_KEY = /* @__PURE__ */ Symbol.for("gipity.traceOutput");
 function installOutputTrace(label2) {
@@ -46619,10 +47159,10 @@ function installOutputTrace(label2) {
       existing.emit({ event: "reenter", label: label2 });
       return;
     }
-    const dir = join25(process.env.GIPITY_DIR || join25(homedir18(), ".gipity"), "trace");
-    mkdirSync17(dir, { recursive: true });
+    const dir = join26(process.env.GIPITY_DIR || join26(homedir18(), ".gipity"), "trace");
+    mkdirSync18(dir, { recursive: true });
     const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", "_").replace(/:/g, "-");
-    const fd2 = openSync5(join25(dir, `${stamp}-pid${process.pid}.jsonl`), "a");
+    const fd2 = openSync5(join26(dir, `${stamp}-pid${process.pid}.jsonl`), "a");
     const emit = (rec) => {
       try {
         writeSync(fd2, JSON.stringify({ t: (/* @__PURE__ */ new Date()).toISOString(), ...rec }) + "\n");
@@ -46657,12 +47197,12 @@ function installOutputTrace(label2) {
 
 // src/index.ts
 installOutputTrace("index");
-var __dirname = dirname13(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(resolve19(__dirname, "../package.json"), "utf-8"));
+var __dirname = dirname14(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync28(resolve18(__dirname, "../package.json"), "utf-8"));
 function versionLabel() {
   const base = `v${pkg.version}`;
   try {
-    const info2 = JSON.parse(readFileSync26(resolve19(__dirname, "build-info.json"), "utf-8"));
+    const info2 = JSON.parse(readFileSync28(resolve18(__dirname, "build-info.json"), "utf-8"));
     if (info2?.sha) return `${base} (dev ${info2.sha}${info2.dirty ? ", modified" : ""})`;
   } catch {
   }
@@ -46867,6 +47407,19 @@ function resolveTargetCommand(argv2) {
   }
   return cmd;
 }
+Command.prototype._excessArguments = function(receivedArgs) {
+  if (this._allowExcessArguments) return;
+  const expected = this.registeredArguments.length;
+  const excess = receivedArgs.slice(expected);
+  const forSubcommand = this.parent ? ` for '${this.name()}'` : "";
+  const list = excess.map((a) => `'${a}'`).join(", ");
+  let message = `error: unexpected extra argument${excess.length === 1 ? "" : "s"} ${list}${forSubcommand}.`;
+  const kv2 = excess.map((a) => /^([A-Za-z][\w-]*)=/.exec(a)).find(Boolean);
+  if (kv2) {
+    message += ` Options are passed as \`--${kv2[1]} <value>\`, not \`${kv2[1]}=...\` - did you mean \`--${kv2[1]}\`?`;
+  }
+  this.error(message, { code: "commander.excessArguments" });
+};
 function enableHelpAfterError(cmd) {
   cmd.configureOutput({
     // Render the offending command's full help (via outputHelp, so addHelpText