gipity 1.1.5 → 1.1.6

package/dist/commands/records.js

@@ -1,5 +1,6 @@
 import { Command } from 'commander';
-import { get, post, put, patch, del } from '../api.js';
+import { get, post, put, patch, del, publicRequest, mintAppToken } from '../api.js';
+import { getAuth } from '../auth.js';
 import { requireConfig } from '../config.js';
 import { bold, muted } from '../colors.js';
 import { run, printList, printResult } from '../helpers/index.js';
@@ -10,6 +11,33 @@ import { confirm } from '../utils.js';
 // /projects/<guid>/records mirror.)
 export const recordsCommand = new Command('records')
     .description('Manage app records (Gipity Records - validated CRUD with audit history)');
+const ANON_FLAG = '--anon';
+const ANON_HELP = 'Call as an anonymous visitor (the public path a signed-out user hits) instead of as your signed-in account';
+/** One HTTP surface for every records subcommand, so `--anon` is a persona
+ *  switch rather than a different code path. Anonymous calls mint the same
+ *  short-lived app token the browser SDK uses and send no owner credentials -
+ *  this is exactly what a signed-out visitor's request looks like, so a 401 here
+ *  is the true answer for an auth-gated table. The persona goes to stderr so
+ *  stdout stays parseable; without it, "verify the anonymous path" silently runs
+ *  as the owner and the public path never gets exercised. */
+async function recordsHttp(opts) {
+    const config = requireConfig();
+    if (!opts.anon) {
+        const who = getAuth()?.email;
+        console.error(muted(`Auth: calling as ${who ?? 'your signed-in account'} (the owner persona; use ${ANON_FLAG} for the public visitor path)`));
+        return { guid: config.projectGuid, get, post, put, patch, del };
+    }
+    console.error(muted('Auth: anonymous visitor (the public path a signed-out user hits)'));
+    const headers = await mintAppToken(config.projectGuid);
+    return {
+        guid: config.projectGuid,
+        get: (path) => publicRequest('GET', path, undefined, headers),
+        post: (path, body) => publicRequest('POST', path, body, headers),
+        put: (path, body) => publicRequest('PUT', path, body, headers),
+        patch: (path, body) => publicRequest('PATCH', path, body, headers),
+        del: (path, body) => publicRequest('DELETE', path, body, headers),
+    };
+}
 recordsCommand
     .command('list')
     .description('List record tables')
@@ -57,9 +85,10 @@ recordsCommand
     .option('--limit <n>', 'Max rows', '20')
     .option('--offset <n>', 'Offset', '0')
     .option('--fields <fields>', 'Comma-separated column names')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, opts) => run('Query', async () => {
-    const config = requireConfig();
+    const api = await recordsHttp(opts);
     const params = new URLSearchParams();
     if (opts.filter)
         params.set('filter', opts.filter);
@@ -69,7 +98,7 @@ recordsCommand
     params.set('offset', opts.offset);
     if (opts.fields)
         params.set('fields', opts.fields);
-    const res = await get(`/api/${config.projectGuid}/records/${table}?${params}`);
+    const res = await api.get(`/api/${api.guid}/records/${table}?${params}`);
     if (opts.json) {
         console.log(JSON.stringify(res));
     }
@@ -85,21 +114,26 @@ recordsCommand
 recordsCommand
     .command('get <table> <id>')
     .description('Get a record')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, id, opts) => run('Get', async () => {
-    const config = requireConfig();
-    const res = await get(`/api/${config.projectGuid}/records/${table}/${id}`);
+    const api = await recordsHttp(opts);
+    const res = await api.get(`/api/${api.guid}/records/${table}/${id}`);
     console.log(opts.json ? JSON.stringify(res.data) : JSON.stringify(res.data, null, 2));
 }));
 recordsCommand
-    .command('history <table> <id>')
-    .description('Audit history for a record (who/what changed it, with English summaries)')
+    .command('history <table> [id]')
+    .description('Audit history (who/what changed it, with English summaries). Omit <id> for the whole table\'s feed.')
     .option('--limit <n>', 'Max events', '20')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, id, opts) => run('History', async () => {
-    const config = requireConfig();
-    const res = await get(`/api/${config.projectGuid}/records/${table}/${id}/history?limit=${encodeURIComponent(opts.limit)}`);
-    printList(res.data, opts, 'No history for this record.', e => {
+    const api = await recordsHttp(opts);
+    // Table-wide feed when no id is given - the same endpoint an activity/history
+    // view reads, so verifying it needs no hand-built HTTP call.
+    const scope = id ? `${table}/${encodeURIComponent(id)}` : table;
+    const res = await api.get(`/api/${api.guid}/records/${scope}/history?limit=${encodeURIComponent(opts.limit)}`);
+    printList(res.data, opts, id ? 'No history for this record.' : `No history for "${table}".`, e => {
         const summary = e.detail?.summary || `${e.action} ${e.entity_type} ${e.entity_id}`;
         return `${muted(e.created_at)}  ${bold(e.source || '-')}  ${summary}`;
     });
@@ -108,34 +142,38 @@ recordsCommand
     .command('create <table>')
     .description('Create a record')
     .requiredOption('--data <json>', 'JSON object with field values')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, opts) => run('Create', async () => {
-    const config = requireConfig();
+    const api = await recordsHttp(opts);
     const data = JSON.parse(opts.data);
-    const res = await post(`/api/${config.projectGuid}/records/${table}`, data);
+    const res = await api.post(`/api/${api.guid}/records/${table}`, data);
     printResult(`Created: ${JSON.stringify(res.data)}`, opts, res.data);
 }));
 recordsCommand
     .command('update <table> <id>')
     .description('Update a record')
     .requiredOption('--data <json>', 'JSON object with fields to update')
+    .option(ANON_FLAG, ANON_HELP)
     .option('--json', 'Output as JSON')
     .action((table, id, opts) => run('Update', async () => {
-    const config = requireConfig();
+    const api = await recordsHttp(opts);
     const data = JSON.parse(opts.data);
-    const res = await put(`/api/${config.projectGuid}/records/${table}/${id}`, data);
+    const res = await api.put(`/api/${api.guid}/records/${table}/${id}`, data);
     printResult(`Updated: ${JSON.stringify(res.data)}`, opts, res.data);
 }));
 recordsCommand
     .command('delete <table> <id>')
     .description('Delete a record')
-    .action((table, id) => run('Delete', async () => {
+    .option(ANON_FLAG, ANON_HELP)
+    .option('--json', 'Output as JSON')
+    .action((table, id, opts) => run('Delete', async () => {
     if (!await confirm(`Delete record ${id} from "${table}"?`)) {
-        console.log('Cancelled.');
+        printResult('Cancelled.', opts, { table, id, deleted: false, cancelled: true });
         return;
     }
-    const config = requireConfig();
-    await del(`/api/${config.projectGuid}/records/${table}/${id}`);
-    printResult('Deleted.', { json: false });
+    const api = await recordsHttp(opts);
+    const res = await api.del(`/api/${api.guid}/records/${table}/${id}`);
+    printResult('Deleted.', opts, res?.data ?? { table, id, deleted: true });
 }));
 //# sourceMappingURL=records.js.map

package/dist/commands/token.js

@@ -4,7 +4,12 @@ import { bold, muted, success, warning } from '../colors.js';
 import { run, printList } from '../helpers/index.js';
 export const tokenCommand = new Command('token')
     .description('Manage API tokens')
-    .addHelpText('after', '\nLong-lived agent API tokens (gip_at_*) for headless agents and CI.');
+    .addHelpText('after', `
+Long-lived agent API tokens (gip_at_*) for headless agents and CI - they drive
+the gipity CLI as YOU.
+
+To let a script or cron write to one app instead, mint a project API key:
+gipity key create "my script" --role editor (sent as X-Api-Key).`);
 const fmtDate = (d) => (d ? new Date(d).toLocaleDateString() : 'never');
 tokenCommand
     .command('create')

package/dist/commands/uninstall.js

@@ -19,7 +19,7 @@ import { confirm, getAutoConfirm } from '../utils.js';
 import { bold, brand, dim, success, error as clrError, muted } from '../colors.js';
 import * as relayState from '../relay/state.js';
 import { planFor, UnsupportedPlatformError } from '../relay/installers.js';
-import { GIPITY_PLUGIN_ID, GIPITY_MARKETPLACE_NAME, stripGipityHooks, grokInstallState, agentSkillsState, AGENTS_SKILLS_DIR } from '../setup.js';
+import { GIPITY_PLUGIN_ID, GIPITY_MARKETPLACE_NAME, stripGipityHooks, grokInstallState, agentSkillsState, AGENTS_SKILLS_DIR, agySkillsState, AGY_SKILLS_DIR, } from '../setup.js';
 /** Remove Gipity's entries from the user-scope Claude Code settings: the
  *  plugin enablement, the marketplace registration, and any legacy hook
  *  blocks older CLI versions wrote there. Surgical - everything else in the
@@ -240,6 +240,19 @@ export const uninstallCommand = new Command('uninstall')
         }
         console.log(`${success(`Removed ${agentSkills.skills.length} Gipity skills from ~/.agents/skills.`)}`);
     }
+    // 4c. Remove the skills the CLI copied into Antigravity's own global
+    //     skill root (~/.gemini/config/skills - a different directory from
+    //     Codex's ~/.agents/skills, see setup.ts).
+    const agySkills = agySkillsState();
+    if (agySkills.skills.length) {
+        for (const name of agySkills.skills) {
+            try {
+                rmSync(join(AGY_SKILLS_DIR, name), { recursive: true, force: true });
+            }
+            catch { /* best-effort */ }
+        }
+        console.log(`${success(`Removed ${agySkills.skills.length} Gipity skills from ~/.gemini/config/skills.`)}`);
+    }
     // 5. Wipe ~/.gipity/ (this also removes the agent-hooks scripts and the
     //    agent-skills manifest, which live under it).
     if (existsSync(gipityDir)) {

package/dist/hooks/capture-runner.js

@@ -51,6 +51,7 @@ import { getConfig } from '../config.js';
 import { parseTranscript as parseClaudeTranscript, } from '../capture/sources/claude-code.js';
 import { parseTranscript as parseCodexTranscript } from '../capture/sources/codex.js';
 import { parseTranscript as parseGrokTranscript } from '../capture/sources/grok.js';
+import { parseTranscript as parseAgyTranscript } from '../capture/sources/agy.js';
 const CAPTURE_DIR = join(homedir(), '.gipity', 'capture-state');
 const INGEST_BATCH_MAX = 100; // server caps at 200; stay comfortably under
 export const CAPTURE_SOURCES = {
@@ -77,6 +78,14 @@ export const CAPTURE_SOURCES = {
             return join(homedir(), '.grok', 'sessions', encodeURIComponent(cwd), hook.session_id, 'chat_history.jsonl');
         },
     },
+    agy: {
+        serverSource: 'agy',
+        displayName: 'Antigravity',
+        // agy hook payloads always carry transcriptPath directly (no derivation
+        // needed, unlike Grok) - the agy-specific hook wrapper normalizes it into
+        // this HookInput's transcript_path before invoking this runner.
+        parse: (content, afterUuid, hook) => parseAgyTranscript(content, afterUuid, { conversationId: hook.session_id }),
+    },
 };
 // PostToolUse fires after every tool call. We flush on it so a session that is
 // killed/crashes mid-run (e.g. a long headless `gipity claude -p` build that
@@ -430,9 +439,10 @@ async function handleSessionEnd(convGuid, src, hook) {
     if (hook.session_id)
         deleteSessionMap(hook.session_id);
 }
-// Codex has no SessionEnd hook, so its capture-state/session-map files are
-// never cleaned by handleSessionEnd. Sweep anything stale on the way through
-// - the files are tiny, so a generous TTL is fine; a live session's state is
+// Codex and agy have no SessionEnd-equivalent hook, so their capture-state/
+// session-map files are never cleaned by handleSessionEnd. Sweep anything
+// stale on the way through - the files are tiny, so a generous TTL is fine; a
+// live session's state is
 // rewritten on every flush and never gets this old.
 const STATE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 function sweepStaleState() {
@@ -455,8 +465,10 @@ function sweepStaleState() {
 }
 /** Normalize a raw hook payload to snake_case HookInput. Claude Code and
  *  Codex deliver snake_case (`session_id`, `transcript_path`, `cwd`); Grok
- *  Build delivers camelCase (`sessionId`, `hookEventName`, …). Accept both
- *  so one runner serves every harness. */
+ *  Build delivers camelCase (`sessionId`, `hookEventName`, …); agy calls its
+ *  session id `conversationId` (its own hook payload has no session/cwd/event
+ *  fields under any other name - see cli/src/agents/agy.ts). Accept all of
+ *  these so one runner serves every harness. */
 export function normalizeHookInput(raw) {
     if (!raw || typeof raw !== 'object')
         return {};
@@ -469,7 +481,7 @@ export function normalizeHookInput(raw) {
         return undefined;
     };
     const hook = {
-        session_id: pick('session_id', 'sessionId'),
+        session_id: pick('session_id', 'sessionId', 'conversationId'),
         transcript_path: pick('transcript_path', 'transcriptPath'),
         cwd: pick('cwd', 'workingDirectory'),
         hook_event_name: pick('hook_event_name', 'hookEventName'),
@@ -509,8 +521,8 @@ async function main() {
         if (derived)
             hook.transcript_path = derived;
     }
-    // Opportunistic hygiene: Codex never fires session-end, so its state
-    // files are TTL-swept instead of deleted at end-of-session.
+    // Opportunistic hygiene: Codex and agy never fire session-end, so their
+    // state files are TTL-swept instead of deleted at end-of-session.
     sweepStaleState();
     const convGuid = await resolveConvGuid(hook, src.serverSource);
     if (!convGuid)