gipity 1.1.4 → 1.1.6

package/dist/commands/key.js

@@ -0,0 +1,91 @@
+import { Command } from 'commander';
+import { get, post, del } from '../api.js';
+import { resolveProjectContext } from '../config.js';
+import { bold, muted, success, warning } from '../colors.js';
+import { run, printList } from '../helpers/index.js';
+/**
+ * Project API keys - the revocable secret a script, cron, or agent sends as
+ * `X-Api-Key` to write to YOUR app without a browser login.
+ *
+ * These are per-project and app-facing; `gipity token` mints account-level
+ * agent tokens (gip_at_*) that drive the CLI itself. Without this command the
+ * only mint path was raw curl, so agents asked for "a key I can generate and
+ * revoke" built their own key table instead of using the platform's.
+ */
+export const keyCommand = new Command('key')
+    .description('Manage project API keys for scripts and agents (X-Api-Key)')
+    .addHelpText('after', `
+Give a script, cron, or agent write access to your app without a login:
+
+  gipity key create "laptop importer" --role editor
+  # the script sends:  X-Api-Key: <the key printed once above>
+
+Inside a function the caller shows up as ctx.auth.via === 'api_key' with
+ctx.auth.apiKeyName set to the key's name - stamp that on rows to tell
+script-written entries from hand-entered ones. Never build your own key table.
+
+Account-level tokens that run the CLI headlessly are a different thing: see
+gipity token --help.`);
+const fmtDate = (d) => (d ? new Date(d).toLocaleDateString() : 'never');
+const projectOpt = ['--project <guid-or-slug>', 'Target a specific project instead of cwd / Home'];
+async function projectGuid(opts) {
+    const { config } = await resolveProjectContext({ projectOverride: opts.project });
+    return config.projectGuid;
+}
+keyCommand
+    .command('create <name>')
+    .description('Mint a project API key (shown once). Give it a name you will recognize later')
+    .option('--role <role>', 'viewer | editor | owner (default: viewer)', 'viewer')
+    .option('--expires-days <n>', 'Days until the key expires (default: never)')
+    .option(...projectOpt)
+    .option('--json', 'Output as JSON')
+    .action((name, opts) => run('Create', async () => {
+    const body = { name, role: opts.role };
+    if (opts.expiresDays !== undefined) {
+        const days = parseInt(opts.expiresDays, 10);
+        if (!Number.isFinite(days) || days <= 0)
+            throw new Error('--expires-days must be a positive number of days');
+        body.expires_in_days = days;
+    }
+    const res = await post(`/projects/${await projectGuid(opts)}/api-keys`, body);
+    const k = res.data;
+    if (opts.json) {
+        console.log(JSON.stringify(k));
+        return;
+    }
+    const expNote = k.expires_at ? ` (expires ${fmtDate(k.expires_at)})` : ' (never expires)';
+    console.log(success(`Created API key ${bold(k.short_guid)} "${k.name}" as ${k.role}${muted(expNote)}.`));
+    console.log('');
+    console.log(k.key);
+    console.log('');
+    console.log(muted('Send it from your script on every request:'));
+    console.log(muted(`  curl -H "X-Api-Key: ${k.key}" ...`));
+    console.log(muted(`Revoke it any time: gipity key revoke ${k.short_guid}`));
+    console.log('');
+    console.log(warning('Copy it now - it will not be shown again.'));
+}));
+keyCommand
+    .command('list')
+    .alias('ls')
+    .description('List this project\'s API keys (values are never shown again)')
+    .option(...projectOpt)
+    .option('--json', 'Output as JSON')
+    .action((opts) => run('List', async () => {
+    const res = await get(`/projects/${await projectGuid(opts)}/api-keys`);
+    printList(res.data, opts, 'No API keys. Mint one with: gipity key create "my script" --role editor', (k) => `${bold(k.short_guid)}  ${k.name}  ${muted(`${k.role}  ${k.prefix}…  last used ${fmtDate(k.last_used_at)}  expires ${fmtDate(k.expires_at)}`)}`);
+}));
+keyCommand
+    .command('revoke <short_guid>')
+    .alias('rm')
+    .description('Revoke a project API key (instant, irreversible)')
+    .option(...projectOpt)
+    .option('--json', 'Output as JSON')
+    .action((shortGuid, opts) => run('Revoke', async () => {
+    await del(`/projects/${await projectGuid(opts)}/api-keys/${encodeURIComponent(shortGuid)}`);
+    if (opts.json) {
+        console.log(JSON.stringify({ short_guid: shortGuid, revoked: true }));
+        return;
+    }
+    console.log(success(`Revoked API key ${bold(shortGuid)}.`));
+}));
+//# sourceMappingURL=key.js.map

package/dist/commands/load.js

@@ -152,7 +152,7 @@ export const loadCommand = new Command('load')
     if (opts.inspect) {
         const res = opts.json
             ? await doInspect()
-            : await withSpinner('Inspecting…', doInspect, { done: null });
+            : await withSpinner('Inspecting...', doInspect, { done: null });
         if (opts.json) {
             console.log(JSON.stringify(res.data));
             return;
@@ -162,7 +162,7 @@ export const loadCommand = new Command('load')
     }
     const { data, partial } = opts.json
         ? await doImport()
-        : await withSpinner('Importing…', doImport, { done: null });
+        : await withSpinner('Importing...', doImport, { done: null });
     const project = data.project;
     // Materialize a local dir and link it, exactly like `gipity project create`:
     // `.gipity.json` is written directly inside the new dir, then a soft sync

package/dist/commands/login.js

@@ -4,6 +4,7 @@ import { publicPost } from '../api.js';
 import { prompt, decodeJwtExp } from '../utils.js';
 import { success, error as clrError, muted } from '../colors.js';
 import { flushBugQueue } from '../bug-queue.js';
+import { warnBeforeCodeIfUnexpectedNewAccount, warnIfUnexpectedNewAccount } from '../login-flow.js';
 export const loginCommand = new Command('login')
     .description('Log in or sign up')
     .option('--email <email>', 'Email address')
@@ -19,9 +20,10 @@ export const loginCommand = new Command('login')
         }
         // Email only → send code and exit (non-interactive step 1)
         if (email && !code) {
-            await publicPost('/auth/login', { email });
+            const sendRes = await publicPost('/auth/login', { email });
             console.log('Check your email for a 6-digit code.');
             console.log(muted(`Then run: gipity login --email ${email} --code <code>`));
+            warnBeforeCodeIfUnexpectedNewAccount(sendRes.isNewUser, email);
             return;
         }
         // Fully interactive flow
@@ -34,9 +36,10 @@ export const loginCommand = new Command('login')
             console.error(clrError('Email required.'));
             process.exit(1);
         }
-        await publicPost('/auth/login', { email });
+        const sendRes = await publicPost('/auth/login', { email });
         console.log('');
         console.log('Check your email for a 6-digit code.');
+        warnBeforeCodeIfUnexpectedNewAccount(sendRes.isNewUser, email);
         code = await prompt('Code: ');
         await verify(email, code);
     }
@@ -46,6 +49,7 @@ export const loginCommand = new Command('login')
     }
 });
 async function verify(email, code) {
+    const priorAuth = getAuth();
     const res = await publicPost('/auth/verify', { email, code });
     const exp = decodeJwtExp(res.accessToken);
     if (!exp) {
@@ -60,6 +64,7 @@ async function verify(email, code) {
         expiresAt,
     });
     console.log(success(`Logged in (${email}).`));
+    warnIfUnexpectedNewAccount(res.isNewUser, email, priorAuth);
     // A fresh session is the clearest "we're reconnected" signal - clear any bug
     // reports that got stranded while this account's session was expired/offline.
     const delivered = await flushBugQueue().catch(() => 0);

package/dist/commands/page-eval.js

@@ -106,7 +106,7 @@ export function summarizeExpr(expr) {
     if (oneLine && expr.trim().length <= EXPR_ECHO_MAX_CHARS)
         return expr.trim();
     const first = (meaningful[0] ?? '').trim();
-    const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 1)}…` : first;
+    const head = first.length > EXPR_ECHO_MAX_CHARS ? `${first.slice(0, EXPR_ECHO_MAX_CHARS - 3)}...` : first;
     const shape = oneLine
         ? `(${expr.trim().length} chars)`
         : `(+${meaningful.length - 1} more ${meaningful.length - 1 === 1 ? 'line' : 'lines'}, ${expr.trim().length} chars)`;
@@ -257,6 +257,31 @@ export function budgetOverrunHint(reason, usedBudgetMs) {
         `(up to ${EVAL_SCRIPT_BUDGET_MAX_MS}), e.g. --timeout ${EVAL_SCRIPT_BUDGET_MAX_MS} — ` +
         `or gate on a ready signal instead: --wait-for '<selector>' --wait-timeout ${MAX_WAIT_MS}.`;
 }
+/** The server aborts a script whose page navigated out from under it, and tells
+ *  the caller to "split the check into two evals". For the case that actually
+ *  produces this (seed state, reload, assert the state came back), that advice
+ *  sends the caller down the wrong road: two evals are two independent page
+ *  sessions, so the second one has to re-seed before it can read anything, and
+ *  the thing being verified (a real reload restoring real persisted state) is
+ *  never exercised. `--reload` is the primitive for it: one page load, reloaded
+ *  IN PLACE with storage preserved, second expression against the post-reload
+ *  DOM. Name it here, at the exact moment the caller hand-rolled it. */
+export function navigationAbortHint(reason) {
+    if (!/navigated or reloaded/i.test(reason))
+        return null;
+    return `If you were verifying that state SURVIVES a reload, that is what --reload is for (one command, one page): ` +
+        `gipity page eval "<url>" '<seed/assert expr>' --reload '<assert-restored expr>'. ` +
+        `It reloads the page in place (localStorage/sessionStorage/cookies preserved) and reports the second result ` +
+        `separately. Splitting into two 'page eval' calls does NOT do this: each call is its own browser session, so ` +
+        `the second one starts from empty storage and never exercises the restore path.`;
+}
+/** True when the submitted script already drives the app's clock itself
+ *  (`core.advance(seconds)` on the 3D templates, the imported `advance(seconds)`
+ *  on the 2D one). Such a script does not care what the renderer paints at, so
+ *  the slow-render warning below has nothing to tell it. Exported for tests. */
+export function stepsDeterministically(script) {
+    return /\badvance\s*\(/.test(script);
+}
 /** The headless browser paints slowly, and what that MEANS depends on what the
  *  page is doing — so the one-size warning was actively misleading on a --camera
  *  run. A vision app has no loop to step: its pipeline is driven by camera
@@ -273,6 +298,8 @@ export function budgetOverrunHint(reason, usedBudgetMs) {
  *  deterministic way to wait (--wait-for) instead of inviting a wall-clock
  *  escalation that is guaranteed to be wasted. Exported for tests. */
 export function slowRenderMessage(fps, o) {
+    if (!o.camera && stepsDeterministically(o.script ?? ''))
+        return null;
     if (o.camera) {
         const frames = Math.max(1, Math.round(fps * (o.waitMs / 1000)));
         return `${warning('⚠ Slow render:')} page painted at ${fps} fps, so the app's vision pipeline ran on roughly `
@@ -379,10 +406,10 @@ export const pageEvalCommand = new Command('eval')
     .description('Evaluate JS in a real browser on a page (DOM, computed styles, element rects; inline expr or --file script). ONE client per call - to verify realtime/presence across concurrent clients use `page test --observe` instead')
     .argument('<url>', 'URL to load')
     .argument('[expr]', `JavaScript to evaluate in page context (inline expression or statement body; await works, and the trailing expression is returned automatically — REPL-style — so no explicit return is needed; result is JSON-serialized). Omit when using --file. Time budget: the body has ${EVAL_SCRIPT_BUDGET_MS / 1000}s to finish after page load (${EVAL_SCRIPT_BUDGET_CAMERA_MS / 1000}s with --camera) - raise it with --timeout, max ${EVAL_SCRIPT_BUDGET_MAX_MS / 1000}s.`)
-    .option('--file <path>', `Read the script body from a file instead of the inline <expr> arg (mutually exclusive), or --file - to read it from stdin (pipe a heredoc: --file - <<'EOF' … EOF) with no tmp file. Runs as an async function body, so top-level return/await work. Same post-load budget as <expr> (--timeout).`)
+    .option('--file <path>', `Read the script body from a file instead of the inline <expr> arg (mutually exclusive), or --file - to read it from stdin (pipe a heredoc: --file - <<'EOF' ... EOF) with no tmp file. Runs as an async function body, so top-level return/await work. Same post-load budget as <expr> (--timeout).`)
     .option('--step <expr>', `Run another expression against the SAME loaded page, after <expr> (repeat, max ${MAX_EVAL_STEPS}). Whatever that page load paid for — a vision model coming up, a game booting, a socket connecting — stays up for every step, so an N-part check costs ONE page load instead of N. Each step gets its own in-page budget and its own reported result.`, (val, prev) => [...prev, val], [])
     .option('--fixture <path>', 'Host a local file and expose it to the eval as `fixtureUrl` (and under `fixtures` by basename) to fetch in-page. For verifying a render/parse path against a real binary (an MP3, an image) - no size limit, auto-deleted after the run. The hosted URL has permissive CORS, so `new Image(); img.crossOrigin="anonymous"; img.src=fixtureUrl` decodes untainted for a canvas/pixel read - this is the UPLOAD analog of --camera: feed a known photo/video to a file-upload vision app (web-vision-detect) and run its detector, no need to deploy a throwaway test asset into the app. Repeat for several files (single-value so it never swallows the inline <expr>).', (val, prev) => [...prev, val], [])
-    .option('--reload <expr>', 'After the first eval, reload the page IN PLACE (localStorage/sessionStorage/cookies preserved) and evaluate this second expression against the post-reload DOM. One command verifies persisted state survives a reload: seed/assert state with <expr>, then assert the restored UI here.')
+    .option('--reload <expr>', 'After the first eval, reload the page IN PLACE (localStorage/sessionStorage/cookies preserved) and evaluate this second expression against the post-reload DOM. One command verifies persisted state survives a reload ("remember it when I come back"): seed/assert state with <expr>, then assert the restored UI here. This is the ONLY way to check that - reloading inside the body aborts the eval (the result is lost with the old page), and two separate `page eval` calls are two fresh browser profiles, so the second starts from empty storage.')
     .option('--reload-file <path>', 'Read the post-reload expression from a file instead of inline --reload (mutually exclusive)')
     .option('--camera <path>', `Play a local image or video (.png/.jpg/.webp/.mp4/.webm/.y4m/.mjpeg) as the browser's WEBCAM feed, so a camera app's real pipeline (getUserMedia → MediaPipe/YOLOX → your app logic) runs headlessly on a frame you choose. Implies --fake-media and waits ${CAMERA_DEFAULT_WAIT_MS / 1000}s for the vision model to load. No frame handy? gipity generate image "a hand making a closed fist, palm to camera".`)
     .option('--fake-media', 'Grant a synthetic microphone + camera and auto-accept the getUserMedia prompt, so a voice/camera app runs headlessly instead of hitting its no-camera path. The feed is a built-in test pattern (and a tone) — nothing a vision model can recognize; to drive a vision app use --camera <path> instead.')
@@ -426,7 +453,7 @@ export const pageEvalCommand = new Command('eval')
         }
         catch {
             pageEvalCommand.error(opts.file === '-'
-                ? 'error: --file - reads the script from stdin, but stdin was empty/unreadable — pipe it in, e.g. gipity page eval "<url>" --file - <<\'EOF\' … EOF'
+                ? 'error: --file - reads the script from stdin, but stdin was empty/unreadable - pipe it in, e.g. gipity page eval "<url>" --file - <<\'EOF\' ... EOF'
                 : `error: Cannot read file: ${opts.file}`);
         }
     }
@@ -540,12 +567,12 @@ export const pageEvalCommand = new Command('eval')
             projectGuid = config.projectGuid;
         }
         if (opts.camera) {
-            console.log(muted(`Hosting camera feed ${opts.camera}…`));
+            console.log(muted(`Hosting camera feed ${opts.camera}...`));
             camera = await uploadCameraFeed(projectGuid, opts.camera);
         }
         if (fixturePaths.length) {
             for (const p of fixturePaths) {
-                console.log(muted(`Hosting fixture ${p}…`));
+                console.log(muted(`Hosting fixture ${p}...`));
                 hosted.push(await uploadPublicFixture(projectGuid, p));
             }
             const map = {};
@@ -589,7 +616,10 @@ export const pageEvalCommand = new Command('eval')
             // raises it — and the flag is what the caller needs next. Name it, with
             // the value THIS run used, so the retry is an edit rather than a guess.
             const msg = err?.message ?? '';
-            const hint = budgetOverrunHint(msg, scriptBudgetMs);
+            const hint = budgetOverrunHint(msg, scriptBudgetMs)
+                // A script aborted by its own reload is nearly always a persistence
+                // check hand-rolled without --reload; point at the flag that does it.
+                ?? (reloadExpr === undefined ? navigationAbortHint(msg) : null);
             if (!hint)
                 throw err;
             throw new Error(`${msg}\n${hint}`);
@@ -632,8 +662,17 @@ export const pageEvalCommand = new Command('eval')
         // page's rAF loop is its clock, and engines cap the per-frame delta, so
         // `setTimeout(2000)` may advance only a fraction of a second of app time.
         // Without this line the eval returns a plausible-looking false negative.
+        // A script that already steps the loop itself is immune to all of that, so
+        // slowRenderMessage returns null for it rather than prescribing the fix it
+        // is already applying.
         if (d.slowRender) {
-            console.log(slowRenderMessage(d.slowRender.fps, { camera: !!camera, waitMs }));
+            const slow = slowRenderMessage(d.slowRender.fps, {
+                camera: !!camera,
+                waitMs,
+                script: [expr, ...steps, reloadExpr ?? ''].join('\n'),
+            });
+            if (slow)
+                console.log(slow);
         }
         // Identity line on EVERY run: without it an agent can't distinguish
         // "signed-in eval" from "--auth silently no-op'd against the anonymous

package/dist/commands/page-fetch.js

@@ -30,9 +30,6 @@ function looksLikeHtml(body) {
     const head = body.slice(0, 300).toLowerCase();
     return /<!doctype html|<html[\s>]/.test(head);
 }
-function sha256(s) {
-    return createHash('sha256').update(s).digest('hex');
-}
 function baseWithSlash(url) {
     return url.endsWith('/') ? url : url + '/';
 }
@@ -43,8 +40,16 @@ function resolveUrl(base, path) {
 async function fetchRaw(url) {
     try {
         const res = await fetch(url, { redirect: 'follow' });
-        const body = await res.text();
-        return { status: res.status, contentType: res.headers.get('content-type'), body };
+        // Read raw bytes, not text(): decoding binary as UTF-8 turns every invalid
+        // byte into a 3-byte replacement char, inflating the measured size ~1.7x.
+        const buf = Buffer.from(await res.arrayBuffer());
+        return {
+            status: res.status,
+            contentType: res.headers.get('content-type'),
+            body: buf.toString('utf-8'),
+            bytes: buf.length,
+            sha256: createHash('sha256').update(buf).digest('hex'),
+        };
     }
     catch {
         return null; // DNS failure, connection refused, etc.
@@ -59,21 +64,20 @@ async function probeShell(base) {
     return {
         served: r.status >= 200 && r.status < 300,
         status: r.status,
-        sha256: sha256(r.body),
+        sha256: r.sha256,
         isHtml: looksLikeHtml(r.body),
     };
 }
 function classify(path, r, shell) {
     if (!r)
         return { status: null, contentType: null, bytes: 0, verdict: 'MISSING', detail: 'fetch failed (host unreachable)' };
-    const bytes = Buffer.byteLength(r.body);
-    const base = { status: r.status, contentType: r.contentType, bytes };
+    const base = { status: r.status, contentType: r.contentType, bytes: r.bytes };
     // Honest 404/5xx - the file simply isn't there.
     if (r.status >= 400)
         return { ...base, verdict: 'MISSING', detail: `HTTP ${r.status}` };
     const expect = expectedType(path);
     // 1) Served the catch-all shell verbatim → 200, but the file isn't deployed.
-    if (shell.served && shell.sha256 && sha256(r.body) === shell.sha256) {
+    if (shell.served && shell.sha256 && r.sha256 === shell.sha256) {
         return { ...base, verdict: 'MISSING', detail: `HTTP ${r.status} but served the SPA shell (file not deployed)` };
     }
     // 2) Asked for a non-HTML asset but got an HTML body → a per-path shell variant.
@@ -92,7 +96,7 @@ const TAG = {
     'WRONG-TYPE': warning('WRONG-TYPE'),
 };
 export const pageFetchCommand = new Command('fetch')
-    .description('Verify deployed non-rendered files (llms.txt, AGENTS.md, robots.txt, served JSON…) really exist - catches the static-host trap where a missing file returns 200 with the SPA shell instead of a 404')
+    .description('Verify deployed non-rendered files (llms.txt, AGENTS.md, robots.txt, served JSON...) really exist - catches the static-host trap where a missing file returns 200 with the SPA shell instead of a 404')
     .argument('<url>', 'Deployed app base URL; file paths resolve relative to it')
     .argument('<paths...>', 'One or more file paths to verify, e.g. llms.txt AGENTS.md robots.txt')
     .option('--json', 'Output as JSON')

package/dist/commands/page-inspect.js

@@ -26,10 +26,10 @@ function shortUrl(url, truncate = true, maxLen = 100) {
     }
     if (!truncate || result.length <= maxLen)
         return result;
-    const keep = maxLen - 1;
+    const keep = maxLen - 3;
     const headLen = Math.ceil(keep / 2);
     const tailLen = Math.floor(keep / 2);
-    return result.slice(0, headLen) + '…' + result.slice(-tailLen);
+    return result.slice(0, headLen) + '...' + result.slice(-tailLen);
 }
 export const pageInspectCommand = new Command('inspect')
     .description('Inspect a web page (console, failed resources, timing, layout overflow). ONE passive load - to verify realtime/presence across concurrent clients use `page test --observe`')

package/dist/commands/page-screenshot.js

@@ -235,8 +235,8 @@ export const pageScreenshotCommand = new Command('screenshot')
     .option('--wait <ms>', `Sleep this many ms after DOMContentLoaded before capturing (default 1000, max ${MAX_POST_LOAD_DELAY_MS}). With --camera it defaults to ${CAMERA_DEFAULT_DELAY_MS} so the vision model is up. Same flag as page eval/inspect.`)
     .option('--wait-for <selector>', `Wait until this CSS selector appears before capturing, then capture (deterministic - beats guessing a --wait). Same flag as page eval/inspect. Gate on what you are photographing ('[data-vision="ready"]', '#verdict:not(:empty)'). Max ${WAIT_FOR_MAX_MS}ms (--wait-timeout).`)
     .option('--wait-timeout <ms>', `Max ms to wait for --wait-for before giving up (default ${WAIT_FOR_DEFAULT_MS}, max ${WAIT_FOR_MAX_MS}). Timing out is reported - the capture still happens, so you see the state it got stuck in.`)
-    .option('--action <js>', 'Run JS in the page before capturing — e.g. click a button to enter a state ("document.getElementById(\'play\').click()"). Runs as an async function body, so const/await and app-relative import(\'./…\') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.')
-    .option('--file <path>', 'Read the pre-capture script from a file instead of inline --action (mutually exclusive), or --file - to read it from stdin (pipe a heredoc: --file - <<\'EOF\' … EOF) with no tmp file. For a multi-step driver — click through a flow, wait for it to render — then capture. Same async-function-body semantics as --action; same --file flag as page eval.')
+    .option('--action <js>', 'Run JS in the page before capturing - e.g. click a button to enter a state ("document.getElementById(\'play\').click()"). Runs as an async function body, so const/await and app-relative import(\'./...\') work. Runs after the post-load delay, then settles again before the shot. If it throws, the capture still happens and the failure is reported.')
+    .option('--file <path>', 'Read the pre-capture script from a file instead of inline --action (mutually exclusive), or --file - to read it from stdin (pipe a heredoc: --file - <<\'EOF\' ... EOF) with no tmp file. For a multi-step driver - click through a flow, wait for it to render - then capture. Same async-function-body semantics as --action; same --file flag as page eval.')
     .option('--full', 'Capture the full scrollable page (default: viewport only). Scrolls the page through first so scroll-reveal/fade-in-on-scroll (IntersectionObserver) sections render into the shot instead of capturing blank.')
     .option('-o, --output <file>', 'Output path (single viewport only; default .gipity/screenshots/ss-<host>-<timestamp>.png)')
     .option('--no-reload-between', 'Skip reload between viewports (faster, lower fidelity - only safe for static pages)')
@@ -283,7 +283,7 @@ export const pageScreenshotCommand = new Command('screenshot')
         }
         catch {
             throw new Error(opts.file === '-'
-                ? "--file - reads the pre-capture script from stdin, but stdin was empty/unreadable — pipe it in, e.g. gipity page screenshot \"<url>\" --file - <<'EOF' … EOF"
+                ? "--file - reads the pre-capture script from stdin, but stdin was empty/unreadable - pipe it in, e.g. gipity page screenshot \"<url>\" --file - <<'EOF' ... EOF"
                 : `Cannot read file: ${opts.file}`);
         }
     }
@@ -372,7 +372,7 @@ export const pageScreenshotCommand = new Command('screenshot')
         assertCameraFile(opts.camera);
         if (!projectGuid)
             throw new Error('--camera needs a linked project (the frame is hosted for the browser to fetch) — run `gipity link` first.');
-        console.log(muted(`Hosting camera feed ${opts.camera}…`));
+        console.log(muted(`Hosting camera feed ${opts.camera}...`));
         camera = await uploadCameraFeed(projectGuid, opts.camera);
     }
     // The pre-capture script the server runs after the post-load delay: the
@@ -407,7 +407,7 @@ export const pageScreenshotCommand = new Command('screenshot')
         try {
             entries = opts.json
                 ? await doShoot()
-                : await withSpinner('Capturing…', doShoot, { done: null });
+                : await withSpinner('Capturing...', doShoot, { done: null });
         }
         catch (err) {
             // The sandbox budget covers the WHOLE capture — load, --action, settle,

package/dist/commands/page-test.js

@@ -268,7 +268,7 @@ export const pageTestCommand = new Command('test')
     // Interactive mode (--observe drives it):
     .option('--observe <expr>', 'Interactive: JS expression sampled in each client to read shared state (e.g. presence count). Switches on interactive mode.')
     .option('--action <expr>', 'Interactive: one-time JS run in each client before observing (e.g. fill a name + submit). {{label}}/{{i}} are substituted per client.')
-    .option('--labels <csv>', 'Per-client labels substituted for {{label}} in the URL/--action/--observe (default client-0, client-1, …)')
+    .option('--labels <csv>', 'Per-client labels substituted for {{label}} in the URL/--action/--observe (default client-0, client-1, ...)')
     .option('--hold <ms>', `Interactive: total observe window per client (${MIN_HOLD_MS}-${MAX_HOLD_MS}ms)`, '8000')
     .option('--samples <k>', 'Interactive: number of observations across the hold window (2-30)', '6')
     .option('--wait-for <selector>', 'Interactive: wait for this CSS selector before running --action (deterministic readiness gate)')

package/dist/commands/records.js

@@ -1,5 +1,6 @@
 import { Command } from 'commander';
-import { get, post, put, patch, del } from '../api.js';
+import { get, post, put, patch, del, publicRequest, mintAppToken } from '../api.js';
+import { getAuth } from '../auth.js';
 import { requireConfig } from '../config.js';
 import { bold, muted } from '../colors.js';
 import { run, printList, printResult } from '../helpers/index.js';
@@ -10,6 +11,33 @@ import { confirm } from '../utils.js';
 // /projects/<guid>/records mirror.)
 export const recordsCommand = new Command('records')
     .description('Manage app records (Gipity Records - validated CRUD with audit history)');
+const ANON_FLAG = '--anon';
+const ANON_HELP = 'Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account';
+/** One HTTP surface for every records subcommand, so `--anon` is a persona
+ *  switch rather than a different code path. Anonymous calls mint the same
+ *  short-lived app token the browser SDK uses and send no owner credentials -
+ *  this is exactly what a signed-out visitor's request looks like, so a 401 here
+ *  is the true answer for an auth-gated table. The persona goes to stderr so
+ *  stdout stays parseable; without it, "verify the anonymous path" silently runs
+ *  as the owner and the public path never gets exercised. */
+async function recordsHttp(opts) {
+    const config = requireConfig();
+    if (!opts.anon) {
+        const who = getAuth()?.email;
+        console.error(muted(`Auth: calling as ${who ?? 'your signed-in account'} (the owner persona; use ${ANON_FLAG} for the public visitor path)`));
+        return { guid: config.projectGuid, get, post, put, patch, del };
+    }
+    console.error(muted('Auth: anonymous visitor (the public path a signed-out user hits)'));
+    const headers = await mintAppToken(config.projectGuid);
+    return {
+        guid: config.projectGuid,
+        get: (path) => publicRequest('GET', path, undefined, headers),
+        post: (path, body) => publicRequest('POST', path, body, headers),
+        put: (path, body) => publicRequest('PUT', path, body, headers),
+        patch: (path, body) => publicRequest('PATCH', path, body, headers),
+        del: (path, body) => publicRequest('DELETE', path, body, headers),
+    };
+}
 recordsCommand
     .command('list')
     .description('List record tables')
@@ -57,9 +85,10 @@ recordsCommand
     .option('--limit <n>', 'Max rows', '20')
     .option('--offset <n>', 'Offset', '0')
     .option('--fields <fields>', 'Comma-separated column names')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, opts) => run('Query', async () => {
-    const config = requireConfig();
+    const api = await recordsHttp(opts);
     const params = new URLSearchParams();
     if (opts.filter)
         params.set('filter', opts.filter);
@@ -69,7 +98,7 @@ recordsCommand
     params.set('offset', opts.offset);
     if (opts.fields)
         params.set('fields', opts.fields);
-    const res = await get(`/api/${config.projectGuid}/records/${table}?${params}`);
+    const res = await api.get(`/api/${api.guid}/records/${table}?${params}`);
     if (opts.json) {
         console.log(JSON.stringify(res));
     }
@@ -85,21 +114,26 @@ recordsCommand
 recordsCommand
     .command('get <table> <id>')
     .description('Get a record')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, id, opts) => run('Get', async () => {
-    const config = requireConfig();
-    const res = await get(`/api/${config.projectGuid}/records/${table}/${id}`);
+    const api = await recordsHttp(opts);
+    const res = await api.get(`/api/${api.guid}/records/${table}/${id}`);
     console.log(opts.json ? JSON.stringify(res.data) : JSON.stringify(res.data, null, 2));
 }));
 recordsCommand
-    .command('history <table> <id>')
-    .description('Audit history for a record (who/what changed it, with English summaries)')
+    .command('history <table> [id]')
+    .description('Audit history (who/what changed it, with English summaries). Omit <id> for the whole table\'s feed.')
     .option('--limit <n>', 'Max events', '20')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, id, opts) => run('History', async () => {
-    const config = requireConfig();
-    const res = await get(`/api/${config.projectGuid}/records/${table}/${id}/history?limit=${encodeURIComponent(opts.limit)}`);
-    printList(res.data, opts, 'No history for this record.', e => {
+    const api = await recordsHttp(opts);
+    // Table-wide feed when no id is given - the same endpoint an activity/history
+    // view reads, so verifying it needs no hand-built HTTP call.
+    const scope = id ? `${table}/${encodeURIComponent(id)}` : table;
+    const res = await api.get(`/api/${api.guid}/records/${scope}/history?limit=${encodeURIComponent(opts.limit)}`);
+    printList(res.data, opts, id ? 'No history for this record.' : `No history for "${table}".`, e => {
         const summary = e.detail?.summary || `${e.action} ${e.entity_type} ${e.entity_id}`;
         return `${muted(e.created_at)}  ${bold(e.source || '-')}  ${summary}`;
     });
@@ -108,34 +142,38 @@ recordsCommand
     .command('create <table>')
     .description('Create a record')
     .requiredOption('--data <json>', 'JSON object with field values')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, opts) => run('Create', async () => {
-    const config = requireConfig();
+    const api = await recordsHttp(opts);
     const data = JSON.parse(opts.data);
-    const res = await post(`/api/${config.projectGuid}/records/${table}`, data);
+    const res = await api.post(`/api/${api.guid}/records/${table}`, data);
     printResult(`Created: ${JSON.stringify(res.data)}`, opts, res.data);
 }));
 recordsCommand
     .command('update <table> <id>')
     .description('Update a record')
     .requiredOption('--data <json>', 'JSON object with fields to update')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, id, opts) => run('Update', async () => {
-    const config = requireConfig();
+    const api = await recordsHttp(opts);
     const data = JSON.parse(opts.data);
-    const res = await put(`/api/${config.projectGuid}/records/${table}/${id}`, data);
+    const res = await api.put(`/api/${api.guid}/records/${table}/${id}`, data);
     printResult(`Updated: ${JSON.stringify(res.data)}`, opts, res.data);
 }));
 recordsCommand
     .command('delete <table> <id>')
     .description('Delete a record')
-    .action((table, id) => run('Delete', async () => {
+    .option(ANON_FLAG, ANON_HELP)
+    .option('--json', 'Output as JSON')
+    .action((table, id, opts) => run('Delete', async () => {
     if (!await confirm(`Delete record ${id} from "${table}"?`)) {
-        console.log('Cancelled.');
+        printResult('Cancelled.', opts, { table, id, deleted: false, cancelled: true });
         return;
     }
-    const config = requireConfig();
-    await del(`/api/${config.projectGuid}/records/${table}/${id}`);
-    printResult('Deleted.', { json: false });
+    const api = await recordsHttp(opts);
+    const res = await api.del(`/api/${api.guid}/records/${table}/${id}`);
+    printResult('Deleted.', opts, res?.data ?? { table, id, deleted: true });
 }));
 //# sourceMappingURL=records.js.map

package/dist/commands/remove.js

@@ -22,7 +22,7 @@ export const removeCommand = new Command('remove')
     const doRemove = () => post(`/projects/${config.projectGuid}/remove`, { name: kit });
     const res = opts.json
         ? await doRemove()
-        : await withSpinner('Removing…', doRemove, { done: null });
+        : await withSpinner('Removing...', doRemove, { done: null });
     const data = res.data;
     // Pull the kit's deletions locally. Whitelist ONLY the kit's own removed files
     // so they bypass the bulk-delete guard (the removal is explicit), while any

package/dist/commands/sandbox.js

@@ -464,7 +464,7 @@ GCC/Rust).
     });
     const res = opts.json
         ? await doRun()
-        : await withSpinner('Running in sandbox…', doRun, { done: null });
+        : await withSpinner('Running in sandbox...', doRun, { done: null });
     // Pull sandbox-written outputs down to the local cwd automatically. The
     // server has already mirrored them into the project (VFS) and handed back
     // the exact list, so honoring it here means files land locally without a

package/dist/commands/save.js

@@ -52,7 +52,7 @@ export const saveCommand = new Command('save')
     const doExport = () => downloadWithHeaders(`/projects/${config.projectGuid}/export`);
     const { buffer, headers } = opts.json
         ? await doExport()
-        : await withSpinner('Exporting…', doExport, { done: null });
+        : await withSpinner('Exporting...', doExport, { done: null });
     const filename = dispositionFilename(headers) ?? `${config.projectSlug}.gip`;
     let dest = path.resolve(output ?? filename);
     if (output && fs.existsSync(dest) && fs.statSync(dest).isDirectory()) {

package/dist/commands/secrets.js

@@ -34,7 +34,7 @@ secretsCommand
     }
     console.log(bold(`${res.data.length} ${scope} secret${res.data.length === 1 ? '' : 's'}:`));
     for (const s of res.data) {
-        const masked = s.preview ? muted(`…${s.preview}`) : muted('(hidden)');
+        const masked = s.preview ? muted(`...${s.preview}`) : muted('(hidden)');
         console.log(`  ${s.name}  ${masked}  ${muted(`updated ${new Date(s.updated_at).toLocaleDateString()}`)}`);
     }
 }));

package/dist/commands/service.js

@@ -21,7 +21,7 @@ const SERVICES = [
 ];
 export const serviceCommand = new Command('service')
     .description('Call an app service (llm, tts, image, transcribe, ...)')
-    .addHelpText('after', '\nCall a Gipity app service: LLM, image, music, TTS, and more.');
+    .addHelpText('after', '\nCall a Gipity app service: LLM, image, music, TTS, and more.\nPer-service docs: gipity skill read app-llm | app-tts | app-image | app-video | app-audio (transcribe, sound, music) | app-location');
 serviceCommand
     .command('list')
     .description('List callable app services')

package/dist/commands/setup.js

@@ -19,8 +19,7 @@ import { Command } from 'commander';
 import { getAuth, sessionExpired, refreshTokenIfNeeded } from '../auth.js';
 import { interactiveLogin } from '../login-flow.js';
 import { runRelaySetup } from '../relay/onboarding.js';
-import * as relayState from '../relay/state.js';
-import { bold, brand, success, muted, error as clrError } from '../colors.js';
+import { bold, muted, error as clrError } from '../colors.js';
 export const connectCommand = new Command('connect')
     .alias('setup') // legacy name, kept working but not advertised
     .description('Connect this computer to gipity.ai so the web CLI can drive it (no project, no launch)')
@@ -46,11 +45,10 @@ export const connectCommand = new Command('connect')
         console.log('');
         // ── Step 2: Relay setup (always run — the user asked for it) ───────
         const enabled = await runRelaySetup({ mode: 'run-now' });
-        // ── Step 3: Done. No project, no Claude Code launch. ──────────────
+        // ── Step 3: Done. No project, no Claude Code launch. The shared flow
+        // already printed its own "Done!" line - just add the manage hint. ──
         if (enabled) {
-            const running = relayState.isRelayEnabled() && !relayState.isPaused();
-            console.log(`  ${success('Done')} — your relay ${running ? 'is running in the background' : 'is set up'} and will start with your computer.`);
-            console.log(`  ${muted('Open')} ${brand('gipity.ai')} ${muted('and start a chat to drive your coding agent here. Manage it with `gipity relay status`.')}`);
+            console.log(`  ${muted('Manage it anytime with `gipity relay status`.')}`);
         }
         else {
             console.log(`  ${muted('No relay set up. Run `gipity connect` again anytime, or `gipity build` to start building.')}`);