@nodii/dev 0.6.20 → 0.6.22

package/README.md

@@ -12,9 +12,30 @@ Linux only (the launcher is a POSIX shell script).
 nodii-dev login                      # opens the approval page in your browser
 nodii-dev login --no-browser         # prints the link and code instead
 nodii-dev login --scope devops.issues.read,devops.issues.write   # narrower grant
+nodii-dev login --force              # replace the machine's sign-in (never from a lane)
 nodii-dev agent register --name my-agent
 ```
 
+A machine has **one sign-in**. The refresh credential is kept in the keychain
+under the OAuth client, not beside a config file, so every config path on the
+machine (`NODII_DEV_CONFIG_PATH`) shares it. `login` checks it first: when the
+shared access token is live or the refresh credential refreshes, it prints
+"You're already signed in as PERSON on this machine." and exits 0 without a
+device flow, from any config path, an empty or new one included (it writes
+the routing there, without an agent). A sign-in nodii-auth no longer accepts
+(`invalid_grant`), or a refresh it refuses outright, is named, then replaced
+by a device flow. If nodii-auth cannot be reached, or the keychain cannot be
+read, `login` stops: that says nothing about the sign-in. A different
+`--scope` replaces the one sign-in, so with a valid one it needs `--force`.
+`login --force` starts a device flow whatever the machine holds and names the
+person it replaces. A lane's config (`lane-*.json`) never starts a device
+flow (`--force`, or `login` over a dead sign-in: the coordinator signs in) and
+refuses `logout`; both end the one sign-in for every lane.
+`agent register` on a fresh, empty config path takes the machine's sign-in the
+same way (the OAuth client and hosts from the machine's newest config, the
+person and installation from the token; `NODII_DEV_*` variables override),
+so a new lane needs no login and no hand-seeded config.
+
 `nodii-dev` talks only to Dev, through the platform edge
 (`https://platform.nucleus-cloud.in/devops/*`), signed in as the platform
 tenant's nodii-dev OAuth app (D1368). There is no other host and no other way
@@ -62,7 +83,7 @@ Dev failures print Dev's error code to stderr and exit non-zero.
 ## Commands
 
 ```text
-nodii-dev login [--no-browser] [--scope KEYS]
+nodii-dev login [--no-browser] [--scope KEYS] [--force]
 nodii-dev logout
 nodii-dev whoami                   # OAuth identity plus the registered agent
 nodii-dev config show
@@ -82,7 +103,8 @@ nodii-dev issues list [--service ID] [--project KEY] [--status STATUS]
 nodii-dev issues show ISSUE
 nodii-dev issues create --service ID --title TEXT [--body TEXT|--body-file FILE]
                         [--kind KIND] [--priority PRIORITY] [--project KEY]
-nodii-dev issues update ISSUE [the same mutable fields]
+nodii-dev issues update ISSUE [the same mutable fields] [--comment TEXT|--comment-file FILE]
+nodii-dev issues comment ISSUE --body TEXT|--body-file FILE   # commentOnIssue, on the issue's activity feed
 nodii-dev issues claim ISSUE [--ttl MINUTES]
 nodii-dev issues release ISSUE [--note TEXT]
 nodii-dev issues transition ISSUE --to todo|in_progress|in_review|blocked|done|wont_do
@@ -280,7 +302,9 @@ nodii-dev hook print-settings         # prints managed-settings JSON; writes not
 
 nodii-dev lane start KEY --title TEXT --kind dev_fix|new_build|docs_change|uat_fix|prod_fix
                      --side backend|frontend|both [--repo REPO] [--issue ISSUE]
-nodii-dev lane step KEY --side backend|frontend --start|--done|--block STEP
+nodii-dev lane step KEY --side backend|frontend --start|--done|--block STEP [--reason TEXT]
+                    # --reason is kept as a lane note; on a step already blocked,
+                    # --block --reason records the new reason (Dev issue 125 moves it onto the step)
 nodii-dev lane evidence KEY --pr|--commit|--figma|--deploy|--dev-check REF
 nodii-dev lane heartbeat KEY [--note TEXT]
 nodii-dev lane review KEY

package/dist/cli.js

@@ -15,11 +15,9 @@ import {
   writeConfig,
 } from "./core.js";
 import {
-  DEFAULT_AUTH_URL,
-  DEFAULT_CLIENT_ID,
-  DEFAULT_EDGE_URL,
-  PLATFORM_TENANT,
-  deviceLogin,
+  adoptMachineSignIn,
+  login as signIn,
+  refuseFromLane,
   revokeOAuth,
 } from "./oauth.js";
 import { heartbeatCurrentLane, postHook, postHookFailure, preHook, settingsSnippet, workflowSuggestion } from "./hooks.js";
@@ -79,11 +77,14 @@ const HELP = `nodii-dev ${VERSION}
 
 Usage: nodii-dev <command> [options] [--json]
 
-  login | logout | whoami | config show
+  login [--force] | logout | whoami | config show
+                                        # login says so when the machine is already signed in; --force
+                                        # replaces that one sign-in (never from a lane)
   doctor [--figma-file KEY] [--json]    # preflight: sign-in, agent, permissions, machine, repo, lane slots
                                         # and, given a key (or NODII_DEV_FIGMA_FILE), that Figma file's registration
   agent register --name NAME | agent heartbeat
   issues list|show|create|update|claim|release
+  issues comment ISSUE --body TEXT      # or --body-file FILE; issues update --comment TEXT|--comment-file FILE adds one too
   issues transition ISSUE --to STATUS [--reason TEXT] [--dev-check REF]
                                         # blocked and wont_do need --reason; done needs --dev-check
   inbox list|show
@@ -134,7 +135,8 @@ Usage: nodii-dev <command> [options] [--json]
   rules cap TOKENS                      # operator: set the core token cap (default 3000)
 
   lane start <key> --title TEXT --kind KIND --side SIDE [--repo REPO] [--issue ISSUE]
-  lane step <key> --side SIDE --start|--done|--block <step>
+  lane step <key> --side SIDE --start|--done|--block <step> [--reason TEXT]
+                                        # --block --reason on a blocked step records its new reason
   lane evidence <key> --pr|--commit|--figma|--deploy|--dev-check REF
   lane heartbeat|review|land|verify|prioritize|deprioritize|stop <key>
   lane non-issue <key> --reason TEXT --evidence TEXT --reroute KEY[,KEY]|none
@@ -199,18 +201,22 @@ async function login(flags, json) {
         "nodii-dev talks only to Dev, through the platform edge, signed in as the platform tenant's OAuth app. Run `nodii-dev login`.",
       2,
     );
-  const previous = await readConfig(false);
-  const result = await deviceLogin({
-    clientId: flags["client-id"] ?? process.env.NODII_DEV_OAUTH_CLIENT_ID ?? previous?.clientId ?? DEFAULT_CLIENT_ID,
-    authUrl: flags["auth-url"] ?? process.env.NODII_DEV_AUTH_URL ?? DEFAULT_AUTH_URL,
-    edgeUrl: flags["edge-url"] ?? process.env.NODII_DEV_EDGE_URL ?? DEFAULT_EDGE_URL,
-    tenantHint: flags["tenant-hint"] ?? process.env.NODII_DEV_PLATFORM_TENANT_ID ?? PLATFORM_TENANT,
+  const result = await signIn({
+    force: flags.force === true,
+    previous: await readConfig(false),
+    clientId: flags["client-id"] ?? process.env.NODII_DEV_OAUTH_CLIENT_ID,
+    authUrl: flags["auth-url"] ?? process.env.NODII_DEV_AUTH_URL,
+    edgeUrl: flags["edge-url"] ?? process.env.NODII_DEV_EDGE_URL,
+    tenantHint: flags["tenant-hint"] ?? process.env.NODII_DEV_PLATFORM_TENANT_ID,
     noBrowser: Boolean(flags["no-browser"]),
     scope: flags.scope,
     output: json ? console.error : console.log,
-    previous,
   });
-  return emit({ loggedIn: true, provider: "oauth", credentialStorage: result.storage, agentId: result.agentId }, json,
+  if (result.alreadySignedIn)
+    return emit({ loggedIn: true, alreadySignedIn: true, provider: "oauth", person: result.person, agentId: result.agentId }, json,
+      `You're already signed in${result.person ? ` as ${result.person}` : ""} on this machine.${result.agentId ? "" : " Run `nodii-dev agent register --name NAME` next."}`);
+  return emit({ loggedIn: true, alreadySignedIn: false, provider: "oauth", person: result.person, credentialStorage: result.storage, agentId: result.agentId,
+    ...(result.replaced !== undefined ? { replaced: result.replaced } : {}), ...(result.replacedDeadSignIn ? { replacedDeadSignIn: result.replacedDeadSignIn } : {}) }, json,
     result.agentId
       ? `OAuth login complete; refresh credential stored in ${result.storage}. Kept agent registration ${result.agentId}.`
       : `OAuth login complete; refresh credential stored in ${result.storage}. Run \`nodii-dev agent register --name NAME\` next.`);
@@ -237,6 +243,18 @@ async function issues(action, args, f, json) {
   if (action === "show")
     return emit(await devRequest("GET", `/api/v1/issues/${encode(ref)}`), json);
   const config = await readConfig();
+  // commentOnIssue. `issues update --comment` sent no field PATCH accepts (HTTP 400): a comment is its own route.
+  const commentBody = async (name) => {
+    const body = await bodyFlag(f, name);
+    if (typeof body !== "string" || !body.trim())
+      throw new CliError("USAGE", `issues ${action} ISSUE --${name} TEXT (or --${name}-file FILE)`, 2);
+    if (body.length > COMMENT_MAX) throw new CliError("USAGE", `The comment is ${body.length} characters; Dev keeps at most ${COMMENT_MAX}.`, 2);
+    return body;
+  };
+  const comment = (key, body) => devRequest("POST", `/api/v1/issues/${encode(key)}/comment`, { body, onBehalfOf: config.person });
+  if (action === "comment") return emit(await comment(ref, await commentBody("body")), json, `${ref}: comment added.`);
+  // Read and checked before anything is sent, so a bad comment changes nothing.
+  const note = ["create", "update"].includes(action) && (f.comment !== undefined || f["comment-file"] !== undefined) ? await commentBody("comment") : undefined;
   if (action === "create" || action === "update") {
     const bodyMd = await bodyFlag(f);
     const payload = {
@@ -257,11 +275,23 @@ async function issues(action, args, f, json) {
         ].filter(([, v]) => v !== undefined),
       ),
     };
+    // An update with nothing to PATCH but a comment is only the comment.
+    if (action === "update" && note !== undefined && Object.keys(payload).every((k) => k === "onBehalfOf"))
+      return emit(await comment(ref, note), json, `${ref}: comment added.`);
     const result = await devRequest(
       action === "create" ? "POST" : "PATCH",
       action === "create" ? "/api/v1/issues" : `/api/v1/issues/${encode(ref)}`,
       payload,
     );
+    // After the write, so a refused create or update leaves no comment behind.
+    if (note !== undefined) {
+      const key = result.data?.key ?? ref;
+      try {
+        await comment(key, note);
+      } catch (error) {
+        throw new CliError("COMMENT_FAILED", `${key} was ${action}d, but the comment was not posted (${error?.code ?? "error"}: ${error?.message ?? error}). Post it with \`nodii-dev issues comment ${key} --body TEXT\`.`, 1, { issue: result.data ?? null });
+      }
+    }
     return emit(
       result,
       json,
@@ -296,6 +326,8 @@ async function issues(action, args, f, json) {
   throw new CliError("USAGE", `Unknown issues action: ${action}`, 2);
 }
 
+// commentOnIssue's body limit.
+const COMMENT_MAX = 10_000;
 const ISSUE_STATUSES = ["todo", "in_progress", "in_review", "blocked", "done", "wont_do"];
 // A blocked reason names who or what clears it: "cleared by", "unblocks", "waiting on", "until".
 const CLEARED_BY = /\b(clear(s|ed)?|unblock(s|ed)?|wait(s|ing)? (on|for)|until)\b/i;
@@ -391,9 +423,19 @@ export async function main(argv = process.argv.slice(2)) {
   }
   if (command === "login") return login(f, json);
   if (command === "logout") {
+    refuseFromLane("logout");
     const c = await readConfig(false);
     if (c) {
-      try { await revokeOAuth(c); } finally { await deleteCredentials(); }
+      try {
+        await revokeOAuth(c);
+      } catch (error) {
+        // A keychain that cannot be read still holds the credential: keep the
+        // config, so logout can revoke it once the keychain is unlocked.
+        if (error?.code === "KEYCHAIN_UNAVAILABLE") throw error;
+        await deleteCredentials();
+        throw error;
+      }
+      await deleteCredentials();
     } else await deleteCredentials();
     return emit({ loggedOut: true }, json, "Logged out.");
   }
@@ -485,13 +527,15 @@ export async function main(argv = process.argv.slice(2)) {
   if (command === "agent") {
     if (["lane-limit", "grant", "revoke"].includes(action))
       return emitCommand(await agentWorkflowCommand(action, rest, f));
-    const c = await readConfig();
+    // A fresh, empty config path takes the machine's sign-in (Dev issue 110).
+    const name = action === "register" ? requireFlag(f, "name") : undefined;
+    const c = action === "register" ? (await readConfig(false)) ?? (await adoptMachineSignIn()) : await readConfig();
     if (action === "register") {
       // POST /api/v1/agents is the registration route the edge exposes; Dev
       // binds the agent to the OAuth person, app and installation itself.
       const result = await devRequest("POST", "/api/v1/agents", {
         sessionId: f.session ?? crypto.randomUUID(),
-        name: requireFlag(f, "name"),
+        name,
       });
       await writeConfig({ ...c, agentId: result.data.id });
       // Dev ignores a self-claimed service: staff bind agents to services

package/dist/core.js

@@ -4,7 +4,7 @@ import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 
-export const VERSION = "0.6.20";
+export const VERSION = "0.6.22";
 export const configPath = () =>
   process.env.NODII_DEV_CONFIG_PATH ??
   join(homedir(), ".config/nodii-dev/config.json");
@@ -33,7 +33,13 @@ export const isOAuthConfig = (config) =>
 export async function readConfig(required = true) {
   let config;
   try {
-    config = JSON.parse(await readFile(configPath(), "utf8"));
+    const text = await readFile(configPath(), "utf8");
+    // An empty file is a config path made ready for a new agent, not a login.
+    if (!text.trim()) {
+      if (!required) return null;
+      throw new Error("empty");
+    }
+    config = JSON.parse(text);
   } catch (error) {
     if (!required && error?.code === "ENOENT") return null;
     throw new CliError("NOT_LOGGED_IN", "Run `nodii-dev login` first.", 2);
@@ -193,7 +199,7 @@ export async function checkLogin() {
 export const encode = (value) => encodeURIComponent(value);
 // Switches never take the next token as their value, so
 // `docs upload --wait rulebook/` keeps rulebook/ as a path.
-const SWITCHES = new Set(["json", "wait", "dry-run", "check", "all", "fleet", "help", "yes", "mine", "no-browser", "include-drafts", "drafted", "library", "async", "sync"]);
+const SWITCHES = new Set(["json", "wait", "dry-run", "check", "all", "fleet", "help", "yes", "mine", "no-browser", "include-drafts", "drafted", "library", "async", "sync", "force"]);
 export function parseArgs(argv) {
   const flags = {};
   const args = [];

package/dist/doctor.js

@@ -48,7 +48,7 @@ export function grantReason(grant = {}) {
   return "unspecified";
 }
 
-async function readConfigFile(path) {
+export async function readConfigFile(path) {
   let raw;
   try {
     raw = await readFile(path, "utf8");
@@ -56,6 +56,8 @@ async function readConfigFile(path) {
     if (error?.code === "ENOENT") return null;
     return { unreadable: error?.code ?? String(error) };
   }
+  // An empty file is a path made ready for a new agent (`agent register` adopts the machine's sign-in).
+  if (!raw.trim()) return null;
   try { return JSON.parse(raw); } catch { return {}; }
 }
 
@@ -106,8 +108,9 @@ export async function doctorCommand(deps = {}) {
     try {
       await (deps.loadRefreshToken ?? loadRefreshToken)(config.clientId);
       stored = true;
-    } catch {
-      checks.push(missing("signed_in", "no stored sign-in credential for this app in the keychain", loginFix));
+    } catch (error) {
+      if (error?.code === "KEYCHAIN_UNAVAILABLE") checks.push(missing("signed_in", "the keychain could not be read (locked or access denied)", "unlock the login keychain, then rerun"));
+      else checks.push(missing("signed_in", "no stored sign-in credential for this app in the keychain", loginFix));
     }
     if (stored) {
       try {

package/dist/lanes.js

@@ -4,6 +4,8 @@ import { CliError, encode, devRequest, query, readConfig, requireFlag } from "./
 
 const execFileAsync = promisify(execFile);
 const via = { via: "nodii-dev" };
+// heartbeatLane's note limit.
+const BLOCK_NOTE_MAX = 500;
 
 const need = (value, usage) => {
   if (!value) throw new CliError("USAGE", usage, 2);
@@ -131,11 +133,31 @@ export async function laneCommand(action, args, flags, { request = devRequest, c
     if (selected.length !== 1) throw new CliError("USAGE", "lane step needs exactly one of --start, --done, or --block.", 2);
     const side = requireFlag(flags, "side");
     const stepRef = need(flags[selected[0]] === true ? args[1] : flags[selected[0]], "lane step needs <key> --side <side> --start|--done|--block <step>");
+    const reason = typeof flags.reason === "string" ? flags.reason.trim() : "";
+    if (flags.reason !== undefined && (selected[0] !== "block" || !reason)) throw new CliError("USAGE", "--reason TEXT goes with --block.", 2);
     const lane = (await request("GET", `/api/v1/lanes/${encode(id)}`)).data;
     const step = lane.steps.find((x) => x.side === side && (x.id === stepRef || x.stepKey === stepRef));
     if (!step) throw new CliError("STEP_NOT_FOUND", `No ${side} step ${stepRef} on ${ref}.`, 1);
+    // Dev's blockLaneStep stores no reason and refuses a step that is already
+    // blocked (INVALID_STEP_STATE), so the reason is a lane heartbeat note
+    // until Dev issue 125 lets the step carry it.
+    const note = reason && `blocked ${side}/${step.stepKey}: ${reason}`;
+    if (note.length > BLOCK_NOTE_MAX) throw new CliError("USAGE", `--reason is too long: Dev keeps ${BLOCK_NOTE_MAX} characters of a lane note, and this one is ${note.length}.`, 2);
+    const recordReason = () => request("POST", `/api/v1/lanes/${encode(id)}/heartbeat`, { note, ...via });
+    if (selected[0] === "block" && step.state === "blocked") {
+      if (!reason) throw new CliError("USAGE", `${side}/${step.stepKey} on ${ref} is already blocked; pass --reason TEXT to record its new reason.`, 2);
+      await recordReason();
+      return { payload: { data: step, reason }, human: `${ref}: ${side}/${step.stepKey} is still blocked; new reason recorded.` };
+    }
     const payload = await request("POST", `/api/v1/lanes/${encode(id)}/steps/${encode(step.id)}/${selected[0]}`, via);
-    return { payload, human: `${ref}: ${side}/${step.stepKey} ${selected[0]}` };
+    if (reason) {
+      try {
+        await recordReason();
+      } catch (error) {
+        throw new CliError(error?.code ?? "LANE_NOTE_FAILED", `${side}/${step.stepKey} on ${ref} is blocked, but its reason was not recorded (${error?.message ?? error}). Run the same --block --reason again to record it.`, 1);
+      }
+    }
+    return { payload: reason ? { ...payload, reason } : payload, human: `${ref}: ${side}/${step.stepKey} ${selected[0]}${reason ? `: ${reason}` : ""}` };
   }
   if (action === "evidence") {
     const body = evidence(flags);

package/dist/oauth.js

@@ -1,9 +1,9 @@
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rm, stat, utimes } from "node:fs/promises";
+import { mkdir, open, readdir, readFile, rm, stat, utimes } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { dirname, join } from "node:path";
-import { CliError, configPath, readConfig, writeConfig } from "./core.js";
+import { basename, dirname, join, resolve } from "node:path";
+import { CliError, authProvider, configPath, isOAuthConfig, readConfig, writeConfig } from "./core.js";
 
 // nodii-auth is reached through the platform edge (/oauth/device/authorize and
 // /oauth/token are public there), so auth and API calls share one host.
@@ -40,7 +40,7 @@ function run(command, args, { input } = {}) {
     child.stdout.on("data", (chunk) => { stdout += chunk; });
     child.stderr.on("data", () => {}); // Credential helpers can echo secrets in diagnostics.
     child.on("error", reject);
-    child.on("close", (code) => code === 0 ? resolve(stdout) : reject(new Error(`${command} failed`)));
+    child.on("close", (code) => code === 0 ? resolve(stdout) : reject(Object.assign(new Error(`${command} failed`), { exitCode: code })));
     if (input) child.stdin.end(input);
   });
 }
@@ -157,11 +157,20 @@ export async function storeRefreshToken(clientId, token, os = platform(), keycha
   return stored;
 }
 
+const SECURITY_NOT_FOUND = 44;
+
 export async function loadRefreshToken(clientId, os = platform(), keychain = {}) {
   try {
     const token = await keychainLoad(account(clientId), os, keychain);
     if (token) return token;
-  } catch {}
+  } catch (error) {
+    // `security` exits 44 for an item that is not there. Any other exit is a
+    // keychain that could not be read (locked, access denied): not a missing
+    // sign-in, so `login` must not replace it. `secret-tool lookup` exits 1
+    // for both, so on Linux the two cannot be told apart.
+    if (os === "darwin" && Number.isInteger(error?.exitCode) && error.exitCode !== SECURITY_NOT_FOUND)
+      throw new CliError("KEYCHAIN_UNAVAILABLE", "The keychain could not be read (locked or access denied); the saved sign-in was kept. Unlock it and retry.", 1);
+  }
   throw new CliError("OAUTH_LOGIN_REQUIRED", "OAuth credentials are unavailable; run `nodii-dev login` again.", 2);
 }
 
@@ -271,22 +280,150 @@ export async function deviceLogin({ clientId, authUrl = DEFAULT_AUTH_URL, edgeUr
     return stored;
   }, { clientId });
   const claims = decodeClaims(token.access_token);
-  const person = claims.sub ?? null;
-  const installationId = claims.metadata?.oauth_app_installation_id ?? claims.oauth_app_installation_id ?? null;
+  const { person, installationId } = signedInAs(claims);
   const agentId = keptAgent(previous, { clientId, person, installationId, edgeUrl });
   await writeConfig({ authProvider: "oauth", authUrl, edgeUrl, clientId, tenantHint, agentId, person, installationId });
   return { storage, claims, agentId };
 }
 
+/** Who an access token's claims sign in, and through which installation. */
+export const signedInAs = (claims) => ({ person: claims.sub ?? null, installationId: claims.metadata?.oauth_app_installation_id ?? claims.oauth_app_installation_id ?? null });
+
 export function decodeClaims(token) {
   try { return JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8")); } catch { return {}; }
 }
 
+// ONE sign-in per machine (Dev issue 110). The refresh credential is kept in
+// the keychain under the OAuth client, not beside a config file, so every
+// config path on the machine shares it, an empty or new one included. A config
+// adds only routing (auth and edge URLs, tenant) and the agent.
+export const configHome = () => join(homedir(), ".config/nodii-dev");
+
+/** The OAuth configs in the config home and its agents/ other than the one in use, newest first. */
+export async function machineConfigs({ home = configHome(), current = configPath() } = {}) {
+  const agents = join(home, "agents");
+  const names = await readdir(agents).catch(() => []);
+  const files = new Set([resolve(home, "config.json"), ...names.filter((n) => n.endsWith(".json")).map((n) => resolve(agents, n))]);
+  files.delete(resolve(current));
+  const found = await Promise.all([...files].map(async (file) => {
+    try {
+      const config = JSON.parse(await readFile(file, "utf8"));
+      return isOAuthConfig(config) && config.clientId ? { config, mtime: (await stat(file)).mtimeMs } : null;
+    } catch {
+      return null;
+    }
+  }));
+  return found.filter(Boolean).sort((a, b) => b.mtime - a.mtime).map((x) => x.config);
+}
+
+/**
+ * The machine's sign-in for an OAuth client. `valid` when the shared access
+ * token is live or the keychain refresh credential refreshes; `dead` when
+ * nodii-auth refused the credential (invalid_grant); `refused` when it refused
+ * the refresh otherwise; `none` when the keychain holds none. Any other failure
+ * (auth unreachable, a refresh busy, a keychain that cannot be read) throws: it
+ * says nothing about the sign-in, so nothing may replace it. `check: false`
+ * only reads who the machine's configs name (state `unchecked`), without a
+ * refresh. `config` is the routing to write, never with an agent.
+ */
+export async function machineSignIn({ current = null, clientId, authUrl, edgeUrl, tenantHint, check = true, provider, configs = machineConfigs } = {}) {
+  // The client named, else the config's, else the machine's newest, else nodii-dev's own.
+  const wanted = clientId ?? (isOAuthConfig(current) ? current.clientId : undefined);
+  const known = isOAuthConfig(current) && (!wanted || current.clientId === wanted) ? current
+    : (await configs()).find((c) => !wanted || c.clientId === wanted) ?? null;
+  const id = wanted ?? known?.clientId ?? DEFAULT_CLIENT_ID;
+  // The credential is checked against the host it came from (a config's), so
+  // a refresh is never sent to another auth server, whose invalid_grant would
+  // clear the machine's one credential. A new device flow uses the current
+  // defaults instead (see login).
+  const config = { authProvider: "oauth", authUrl: authUrl ?? known?.authUrl ?? DEFAULT_AUTH_URL, edgeUrl: edgeUrl ?? known?.edgeUrl ?? DEFAULT_EDGE_URL,
+    clientId: id, tenantHint: tenantHint ?? known?.tenantHint ?? PLATFORM_TENANT };
+  const person = known?.person ?? null;
+  if (!check) return { state: "unchecked", person, config };
+  let token;
+  try {
+    token = await (provider ?? (await authProvider())).accessToken(config);
+  } catch (error) {
+    // nodii-auth refusing the refresh outright (a JSON 4xx other than
+    // invalid_grant, e.g. invalid_client) cannot be fixed by retrying either.
+    if (error?.code === "OAUTH_REFRESH_FAILED") return { state: "refused", person, refusal: error.details?.refusal ?? "refused", config };
+    if (error?.code !== "OAUTH_LOGIN_REQUIRED") throw error;
+    return error.details?.grant ? { state: "dead", person, grant: error.details.grant, config } : { state: "none", person, config };
+  }
+  const claims = signedInAs(decodeClaims(token));
+  const signedIn = claims.person ?? person;
+  const installationId = claims.installationId ?? (known?.person === signedIn ? known.installationId ?? null : null);
+  return { state: "valid", person: signedIn, config: { ...config, person: signedIn, installationId } };
+}
+
+const sameSignIn = (a, b) => isOAuthConfig(a) && ["authUrl", "edgeUrl", "clientId", "tenantHint", "person", "installationId"].every((k) => (a[k] ?? null) === (b[k] ?? null));
+
+/**
+ * `login --force` and `logout` replace or end the machine's one sign-in, for
+ * every lane at once, so a lane's config (named `lane-*.json`, as the
+ * coordinator names them) refuses both.
+ */
+export function refuseFromLane(command, path = configPath()) {
+  if (basename(path).startsWith("lane-"))
+    throw new CliError("USAGE", `${command} would end the machine's one sign-in for every lane; a lane never runs it. Ask the coordinator.`, 2);
+}
+
+/**
+ * `nodii-dev login`. A machine that already holds a valid sign-in says so and
+ * starts no device flow, writing its routing into an empty config path (the
+ * agent is kept only if it is bound to that same sign-in). A dead sign-in is
+ * named, then replaced by a device flow. `force` starts a device flow whatever
+ * the machine holds and names whom it replaces; a lane's config (named
+ * `lane-*.json`, as the coordinator names them) refuses it.
+ */
+export async function login({ force = false, previous = null, clientId, authUrl, edgeUrl, tenantHint, noBrowser, scope, output = console.log,
+  machine = machineSignIn, device = deviceLogin, write = writeConfig, path = configPath() } = {}) {
+  if (force) refuseFromLane("login --force", path);
+  const found = await machine({ current: previous, clientId, authUrl, edgeUrl, tenantHint, check: !force });
+  if (found.state === "valid") {
+    if (scope !== undefined)
+      throw new CliError("USAGE", `You're already signed in as ${found.person} on this machine. A different --scope replaces that one sign-in for every config path: ${basename(path).startsWith("lane-") ? "ask the coordinator" : "pass --force with it"}.`, 2);
+    if (sameSignIn(previous, found.config)) return { alreadySignedIn: true, person: found.person, agentId: previous.agentId ?? null };
+    const agentId = keptAgent(previous, found.config);
+    await write({ ...found.config, agentId });
+    return { alreadySignedIn: true, person: found.person, agentId };
+  }
+  // A lane never starts a device flow: it would replace every lane's sign-in, and no one watches a lane's terminal.
+  refuseFromLane("login (a new device sign-in)", path);
+  if (found.state === "dead")
+    output(`The saved sign-in${found.person ? ` of ${found.person}` : ""} on this machine is no longer accepted by nodii-auth (${found.grant?.error ?? "invalid_grant"}: expired, revoked or replayed). Starting a new sign-in.`);
+  if (found.state === "refused")
+    output(`nodii-auth refused to refresh the saved sign-in${found.person ? ` of ${found.person}` : ""} on this machine (${found.refusal}). Starting a new sign-in.`);
+  if (force) output(found.person ? `This replaces the sign-in of ${found.person} on this machine, for every config path that uses it.` : "This replaces the machine's sign-in, if it holds one (no config here names a person).");
+  // A new sign-in goes to the flags' hosts or the current defaults, as login always did, never an old config's.
+  const result = await device({ clientId: found.config.clientId, authUrl: authUrl ?? DEFAULT_AUTH_URL, edgeUrl: edgeUrl ?? DEFAULT_EDGE_URL, tenantHint: tenantHint ?? PLATFORM_TENANT,
+    noBrowser, scope, output, previous });
+  const dead = { dead: found.grant?.error ?? "invalid_grant", refused: found.refusal }[found.state];
+  return { ...result, alreadySignedIn: false, person: result.claims?.sub ?? null, ...(force ? { replaced: found.person ?? null } : {}),
+    ...(dead ? { replacedDeadSignIn: { person: found.person ?? null, error: dead } } : {}) };
+}
+
+/**
+ * The config for a command that needs a sign-in on a config path that has
+ * none yet (`agent register` on a fresh lane path): the machine's valid
+ * sign-in, written there without an agent.
+ */
+export async function adoptMachineSignIn({ machine = machineSignIn, write = writeConfig, env = process.env } = {}) {
+  const found = await machine({ clientId: env.NODII_DEV_OAUTH_CLIENT_ID, authUrl: env.NODII_DEV_AUTH_URL, edgeUrl: env.NODII_DEV_EDGE_URL, tenantHint: env.NODII_DEV_PLATFORM_TENANT_ID });
+  if (found.state !== "valid")
+    throw new CliError("NOT_LOGGED_IN", {
+      dead: "This machine's sign-in is no longer accepted by nodii-auth (invalid_grant). Run `nodii-dev login` first.",
+      refused: `nodii-auth refused to refresh this machine's sign-in (${found.refusal}). Run \`nodii-dev login\` first.`,
+    }[found.state] ?? "No sign-in on this machine. Run `nodii-dev login` first.", 2);
+  await write(found.config);
+  return found.config;
+}
+
 // ONE lock per OAuth client per user, beside the Keychain item it guards. It
 // used to live next to the config file, so two processes with different
 // NODII_DEV_CONFIG_PATH values shared the credential but not the lock.
 export function refreshLockPath(clientId = DEFAULT_CLIENT_ID) {
-  return join(homedir(), ".config/nodii-dev", `oauth-refresh-${String(clientId).replace(/[^A-Za-z0-9_.-]/g, "_")}.lock`);
+  return join(configHome(), `oauth-refresh-${String(clientId).replace(/[^A-Za-z0-9_.-]/g, "_")}.lock`);
 }
 
 const LOCK_STALE_MS = 30_000;
@@ -510,10 +647,11 @@ export class OAuthAuthProvider {
     this.#expiresAt = cached.expiresAt;
     return true;
   }
-  async accessToken() {
+  /** `given`: the routing to use instead of the config file (a sign-in found on the machine). */
+  async accessToken(given) {
     if (this.#accessToken && Date.now() < this.#expiresAt - 30_000) return this.#accessToken;
     this.#refreshPromise ??= (async () => {
-      const config = await readConfig();
+      const config = given ?? await readConfig();
       // Another process may have refreshed already: its access token is shared.
       if (this.#usable(await this.loadAccess(config.clientId))) return this.#accessToken;
       return this.lock(async ({ held } = {}) => {
@@ -599,7 +737,7 @@ export class OAuthAuthProvider {
     if (kind === "retry")
       throw new CliError("OAUTH_REFRESH_UNAVAILABLE", `Could not refresh the sign-in (${describe(result)}) after ${attempts} attempt${attempts === 1 ? "" : "s"}; the saved credential was kept. Retry the command shortly.`, 1);
     if (kind === "refused")
-      throw new CliError("OAUTH_REFRESH_FAILED", `nodii-auth refused the refresh (${describe(result)}); the saved credential was kept.`, 1);
+      throw new CliError("OAUTH_REFRESH_FAILED", `nodii-auth refused the refresh (${describe(result)}); the saved credential was kept.`, 1, { refusal: describe(result) });
     const body = result.body;
     for (let attempt = 1; ; attempt++) {
       try { await this.storeToken(config.clientId, body.refresh_token); break; } catch (error) {

package/dist/vendor/ds-conformance.mjs

@@ -30,7 +30,7 @@
 //     it until it returns [] (each round can reveal instances inside slot
 //     content).
 
-export const VERSION = "1.0.4";
+export const VERSION = "1.0.9";
 
 /** @typedef {{ nodeId: string, check: string, detail: string }} Finding */
 /**
@@ -135,22 +135,18 @@ const NOT_A_TABLE = /\blist page\b/i;
 const CUSTOMER_HEADER =
   /^(customer|client|contact|lead|applicant|candidate)s?( name)?$/i;
 const EXTERNAL_PLANE = /customer portal|partner room|external/i;
-// The viewer's own record (R5): the App Frame sidebar footer, the user menu
-// and the profile. Not any footer: a dialog or table footer can list others.
-const SELF_CONTAINER =
-  /sidebar ?footer|user button|user menu|account menu|profile|\b(my|own) (account|tokens?|security|sessions?|settings|notification settings|records?)\b/i;
-// A frame the screen marks as the viewer's own: "[self]", "(self)", a
-// trailing "· self", or "(you)".
-const SELF_MARK = /\[self\]|\(self\)|·\s*self\s*$|\(you\)/i;
-// Where the screens show who the viewer is: the App Frame footer, the user
-// and account menus, and frames marked self or named my/own.
-const VIEWER_PLACE =
-  /sidebar ?footer|user button|user menu|account menu|\b(my|own) (profile|account|tokens?|security|sessions?|settings)\b/i;
-const SELF_TEXT = /\(you\)|^you$/i;
-const SIGNED_IN = /^(signed in( as\b.*)?|not you\?.*)$/i;
-// The signed-in account card (Account Context, kind=Account) shows the
-// viewer's own email.
-const SELF_COMPONENT = /^account context$/i;
+const APP_FRAME_COMPONENT_SET_KEY = "e725461fd9786a3f1527ddee0ee764e9dcead46b";
+const PERSON_NAME_COMPONENT_SET_KEY =
+  "08370f38bcbbcf88eaf3a6923dc91b5de5f38ea0";
+const TABLE_COMPONENT_SET_KEY = "7ccc1dbb6ebd149fb9aaf42b9c638f5ce7169638";
+const TABLE_CELL_COMPONENT_SET_KEY = "528898c19702ed4b169d023de30380e05169dfa5";
+const ITEM_COMPONENT_SET_KEY = "46abc8cb0d57c22a365da94a03cfd72a0b089b87";
+const SELF_COMPONENT_SET_KEYS = new Set([
+  "af8df2e85ba4d53b26b28ffa69f264758a50fe66", // Account Context
+  "470b2b5fd91dcae681d3d38c0297c71df3bb998f", // Account Menu
+  "8499452873bccfe5d2f29b5322fc1ca18cb103cc", // Profile Name Card
+  "6c1e074dcf69aee388e0300584da09735e314cc3", // Delete Account Card
+]);
 const NOT_A_PERSON = /^(you|the team)$/i;
 const MASKED = /[*•●]/;
 const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
@@ -164,6 +160,9 @@ const PHONE = /(?<![\w.+\-/])\+?\(?\d[\d ().-]{7,}\d(?![\w\-/])/g;
 const LOCAL_PHONE = /^(\(\d{3,5}\)[ .-]?|\d{3,5}[ .-])\d{3,5}([ .-]\d{2,5})?$/;
 const DATE = /^(\d{4}-\d{2}-\d{2}|\d{1,2}[-/.]\d{1,2}[-/.]\d{2,4})/;
 const ROLE_ANNOTATION = /\[role:([a-z0-9._-]+)\]/gi;
+// Published Dialog component-set key. A node id would break when the set is
+// moved; the key is the stable reference shared across library consumers.
+const DIALOG_COMPONENT_SET_KEY = "55d4155c4bce0136e9a3740ecc7174f9bd01727c";
 // otherPersonRevealed is about people (Dev issue 116): a value is judged
 // by the field it fills. A tenant's business contact (support phone or
 // email, caller or sender id, business address) is not personal.
@@ -242,6 +241,13 @@ const styleKeys = (node, styles) => {
 function fieldValue(node, field, styles) {
   if (STYLE_FIELD.test(field) || field === "styles")
     return styleKeys(node, styles);
+  // Figma names the override `fontName`; REST exposes its two values in the
+  // text node's TypeStyle rather than as a direct FontName property.
+  if (field === "fontName")
+    return {
+      family: node?.style?.fontFamily,
+      style: node?.style?.fontStyle,
+    };
   if (TEXT_STYLE_FIELDS.has(field) || field.startsWith("lineHeight"))
     return node?.style?.[field];
   // An image fill's picture is content (DEC-0048): only its scale mode,
@@ -420,7 +426,13 @@ function outOfScopeRoot(n, parent, componentLabel, memo) {
     if (hit) return hit;
     let kind = /** @type {"kit" | "other" | "none"} */ ("none");
     if (emailKitPart(x, parent, componentLabel)) kind = "kit";
-    else if (x.type === "INSTANCE") kind = "other";
+    else if (
+      x.type === "INSTANCE" ||
+      x.type === "TEXT" ||
+      visiblePaints(x.fills) ||
+      visiblePaints(x.strokes)
+    )
+      kind = "other";
     else
       for (const c of x.children ?? []) {
         const k = placed(c);
@@ -435,7 +447,16 @@ function outOfScopeRoot(n, parent, componentLabel, memo) {
   };
   // An email is named so; an editor's workspace around it, or an app screen
   // holding a kit part, stays in scope.
-  return EMAIL_FRAME.test(n.name ?? "") && placed(n) === "kit"
+  let content = /** @type {"kit" | "other" | "none"} */ ("none");
+  for (const child of n.children ?? []) {
+    const kind = placed(child);
+    if (kind === "other") {
+      content = "other";
+      break;
+    }
+    if (kind === "kit") content = "kit";
+  }
+  return EMAIL_FRAME.test(n.name ?? "") && content === "kit"
     ? `email ${n.name}`
     : null;
 }
@@ -506,6 +527,59 @@ function matchesRole(a, inst, role, library) {
   });
 }
 
+/** The Dialog instance's Body slot, matched by its stable property name. */
+function dialogBody(a, inst) {
+  if (a.setOf(inst)?.key !== DIALOG_COMPONENT_SET_KEY) return null;
+  return (
+    (inst.children ?? []).find((child) => {
+      if (child.type !== "SLOT") return false;
+      const property = child.componentPropertyReferences?.slotContentId;
+      return /^body(?:#|$)/i.test(property ?? "") || /^body$/i.test(child.name);
+    }) ?? null
+  );
+}
+
+/** A text sublayer whose characters this instance changes through a TEXT prop. */
+function textPropertyOverrideTarget(a, from, node) {
+  if (node.type !== "TEXT") return false;
+  const property = node.componentPropertyReferences?.characters;
+  if (typeof property !== "string") return false;
+  for (const ancestor of a.ancestors(node)) {
+    if (
+      ancestor.type === "INSTANCE" &&
+      ancestor.componentProperties?.[property]?.type === "TEXT"
+    )
+      return true;
+    if (ancestor === from) break;
+  }
+  return false;
+}
+
+/**
+ * A look field Figma auto-writes when a TEXT component property is set: the
+ * typography fields and the text's variable bindings (typography and its fill
+ * colour). Only skipped when equal to the main (checked by the caller).
+ */
+function autoTextPropertyField(node, field) {
+  if (
+    field === "fontSize" ||
+    field === "fontName" ||
+    field === "letterSpacing" ||
+    field.startsWith("lineHeight")
+  )
+    return true;
+  if (field !== "boundVariables") return false;
+  const keys = Object.keys(node.boundVariables ?? {});
+  return (
+    keys.length > 0 &&
+    keys.every((key) =>
+      /^(font(Family|Size|Style|Weight)|letterSpacing|lineHeight|fills)$/.test(
+        key,
+      ),
+    )
+  );
+}
+
 /** Characters the screen chose: its own text, or an overridden label. */
 function screenText(a, n, overridden) {
   return !a.composed(n) || overridden.has(n.id);
@@ -558,24 +632,15 @@ export function checkConformance({
   const analyses = Object.values(nodes ?? {})
     .filter((entry) => entry?.document)
     .map((entry) => analyse(entry, mains, library));
-  // The viewer (R5): the email and phone the screens show in the viewer's
-  // own places (the App Frame footer, a frame marked self). The same value
-  // anywhere else is still the viewer's own.
+  // The viewer (R5): identifiers inside the structural self set. The same
+  // value anywhere else is still the viewer's own.
   const viewer = new Set();
   for (const a of analyses)
     for (const n of a.byId.values()) {
       if (n.type !== "TEXT" || a.out.has(n.id)) continue;
       const ids = identifiers(textOf(n));
       if (ids.length === 0) continue;
-      if (
-        a
-          .ancestors(n)
-          .some(
-            (x) =>
-              VIEWER_PLACE.test(x.name ?? "") || SELF_MARK.test(x.name ?? ""),
-          )
-      )
-        for (const id of ids) viewer.add(id);
+      if (isSelf(a, n)) for (const id of ids) viewer.add(id);
     }
 
   for (const a of analyses) {
@@ -628,12 +693,15 @@ export function checkConformance({
       let slotDefault;
       const differ = [];
       const equal = [];
+      const textPropertyTarget = textPropertyOverrideTarget(a, from, node);
       for (const field of [...fields].sort()) {
         if (ALLOWED_FIELDS.has(field)) continue;
         if (exemptPaint(a, from, node, field)) continue;
         const mine = fieldValue(node, field, a.styles);
         const theirs = fieldValue(mainNode, field, mainStyles);
         if (sameValue(mine, theirs)) {
+          if (textPropertyTarget && autoTextPropertyField(node, field))
+            continue;
           equal.push(field);
           continue;
         }
@@ -677,6 +745,25 @@ export function checkConformance({
         for (const r of roles)
           if (matchesRole(a, n, r, library)) usedRoles.add(r.role);
 
+      // roleMismatch (operator ruling, 30 Oct): a Dialog is for a form,
+      // list or other body content. A title, description and actions alone
+      // ask a question, which is the Alert Dialog role.
+      if (n.type === "INSTANCE") {
+        const body = dialogBody(a, n);
+        if (
+          a.setOf(n)?.key === DIALOG_COMPONENT_SET_KEY &&
+          (!body ||
+            !a.shown(body) ||
+            !(body.children ?? []).some((child) => a.shown(child)))
+        )
+          push(
+            findings,
+            n.id,
+            "roleMismatch",
+            "Dialog Body is empty or hidden; use Alert Dialog",
+          );
+      }
+
       // tableHeaderFill (DEC-0036): every header cell keeps the library fill.
       if (n.type === "INSTANCE" && headerCell(a, n)) {
         const main = mains[n.componentId]?.document;
@@ -1096,42 +1183,94 @@ function handDrawnButton(n) {
   const words = buttonText(n).split(/\s+/).filter(Boolean);
   return words.length > 0 && words.length <= 3;
 }
+function variantValue(n, property) {
+  for (const [name, value] of Object.entries(n.componentProperties ?? {}))
+    if (
+      name.split("#", 1)[0] === property &&
+      value?.type === "VARIANT" &&
+      typeof value.value === "string"
+    )
+      return value.value;
+  const value = n.variantProperties?.[property];
+  return typeof value === "string" ? value : null;
+}
+function selfPersonName(a, n) {
+  return (
+    n.type === "INSTANCE" &&
+    a.setOf(n)?.key === PERSON_NAME_COMPONENT_SET_KEY &&
+    variantValue(n, "state") === "self"
+  );
+}
+function selfRow(a, n) {
+  const up = a.ancestors(n);
+  const tableAt = up.findIndex(
+    (x) => x.type === "INSTANCE" && a.setOf(x)?.key === TABLE_COMPONENT_SET_KEY,
+  );
+  if (tableAt !== -1) {
+    if (tableAt < 2) return null;
+    const body = up[tableAt - 1];
+    const row = up[tableAt - 2];
+    const cells = row.children ?? [];
+    if (
+      a.parent.get(row.id)?.id !== body.id ||
+      a.parent.get(body.id)?.id !== up[tableAt].id ||
+      cells.length === 0 ||
+      !cells.every(
+        (cell) =>
+          cell.type === "INSTANCE" &&
+          a.setOf(cell)?.key === TABLE_CELL_COMPONENT_SET_KEY,
+      )
+    )
+      return null;
+    return row;
+  }
+
+  return (
+    up.find(
+      (x) =>
+        x.type === "INSTANCE" && a.setOf(x)?.key === ITEM_COMPONENT_SET_KEY,
+    ) ?? null
+  );
+}
 function isSelf(a, n) {
   const up = a.ancestors(n);
+  if (up.some((x) => selfPersonName(a, x))) return true;
   if (
     up.some(
-      (x) => SELF_CONTAINER.test(x.name ?? "") || SELF_MARK.test(x.name ?? ""),
+      (x) =>
+        x.type === "INSTANCE" && SELF_COMPONENT_SET_KEYS.has(a.setOf(x)?.key),
     )
   )
     return true;
-  const accountCard = (x) => {
-    const set =
-      x.type === "INSTANCE"
-        ? a.componentLabel(x)
-        : x.type === "COMPONENT"
-          ? a.parent.get(x.id)?.name
-          : null;
-    if (!SELF_COMPONENT.test(set ?? "")) return false;
-    const name = x.type === "INSTANCE" ? a.componentOf(x)?.name : x.name;
-    const kind = x.componentProperties?.kind?.value;
-    return (
-      kind === "Account" || /(^|,\s*)kind=account(\s*,|$)/i.test(name ?? "")
-    );
-  };
-  if (up.some(accountCard)) return true;
-  const siblings = a.parent.get(n.id)?.children ?? [];
+
+  // INTERIM: identify a Table row from its direct Table-cell children, or a
+  // list row from its Item instance. Switch to the published Table Row key
+  // when DESIGN-SYSTEM-160 ships.
+  const row = selfRow(a, n);
   if (
-    [n, ...siblings].some((x) => x.type === "TEXT" && SELF_TEXT.test(textOf(x)))
+    row &&
+    [...indexTree(row).byId.values()].some((x) => selfPersonName(a, x))
   )
     return true;
-  // "Signed in" or "Not you?" in the same card: the nearest instance or
-  // component holding it, never a whole row or screen.
-  const card = up.find((x) => x.type === "INSTANCE" || x.type === "COMPONENT");
-  return card
-    ? [...indexTree(card).byId.values()].some(
-        (x) => x.type === "TEXT" && SIGNED_IN.test(textOf(x)),
-      )
-    : false;
+
+  // INTERIM: switch this slot rule to the footer-user component key when
+  // DESIGN-SYSTEM-159 ships.
+  const slotAt = up.findIndex((x) => {
+    if (x.type !== "SLOT") return false;
+    // Figma formerly exposed the slot reference as mainComponent; current
+    // REST responses use slotContentId. Accept both so a library republish
+    // cannot turn the viewer's own identifiers into another-person findings.
+    const property =
+      x.componentPropertyReferences?.slotContentId ??
+      x.componentPropertyReferences?.mainComponent;
+    return (
+      typeof property === "string" &&
+      property.split("#", 1)[0] === "sidebarFooter"
+    );
+  });
+  if (slotAt === -1) return false;
+  const owner = up.slice(slotAt + 1).find((x) => x.type === "INSTANCE");
+  return owner ? a.setOf(owner)?.key === APP_FRAME_COMPONENT_SET_KEY : false;
 }
 function revealedByPermission(a, n) {
   return [n, ...a.ancestors(n)].some((x) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.20",
+  "version": "0.6.22",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {