@notis_ai/cli 0.2.0-beta.102.1 → 0.2.0-beta.107.1

package/README.md

@@ -281,13 +281,19 @@ Examples:
 
 ### `npx --package @notis_ai/cli@latest -- notis tools link <toolkit>`
 
-Get the URL to connect an integration toolkit.
+Connect or reconnect an integration toolkit.
 
-When to use: Use this when a tool requires authentication with an external service.
+When to use: Use this when a tool requires authentication or an active connection must be replaced.
+
+Options:
+- `--reconnect` — Replace the existing account instead of adding another connection.
+- `--connection-id <id>` — Exact connection id to replace when multiple accounts exist.
+- `--label <label>` — Account label for a new or replacement connection.
+- `--credentials <json>` — Credential JSON object, @file path, or - for stdin. Prefer stdin so secrets do not enter shell history.
 
 Examples:
 - `npx --package @notis_ai/cli@latest -- notis tools link github`
-- `npx --package @notis_ai/cli@latest -- notis tools link gmail --json`
+- `npx --package @notis_ai/cli@latest -- notis tools link dataforseo --reconnect --credentials - < credentials.json`
 
 
 ## Meta Commands

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.0-beta.102.1",
+  "version": "0.2.0-beta.107.1",
   "description": "Agent-first Notis CLI for apps and generic tool execution",
   "type": "module",
   "bin": {

package/skills/notis-apps/SKILL.md

@@ -48,6 +48,7 @@ npx --package @notis_ai/cli@latest -- notis apps ...
 - Build standard pages in `app/`. Do not write raw `views/<slug>/index.js` files.
 - Keep navigation in `notis.config.ts` `routes`; each route needs a stable `slug`.
 - Reference existing databases by slug in `notis.config.ts`; do not assume deploy creates databases automatically.
+- Every native database is owned by exactly one app. Creating one with `LOCAL_NOTIS_DATABASE_UPSERT_DATABASE` requires the owning app's slug or id in the `app` argument (create the app first with `LOCAL_NOTIS_CREATE_APP` if needed); deleting an app deletes its databases and their documents.
 - Declare runtime tool access in `notis.config.ts` `tools`.
 - Use `@notis/sdk` hooks instead of direct runtime access.
 - Do not rely on `window.__NOTIS_RUNTIME__` or portal-owned DOM hooks.

package/skills/notis-cli/SKILL.md

@@ -140,8 +140,9 @@ This is the main escape hatch for:
    - `npx --package @notis_ai/cli@latest -- notis tools exec <tool-name> --arguments '<json>'`
 6. If multiple independent calls are needed, use:
    - `npx --package @notis_ai/cli@latest -- notis tools exec-parallel '<json-array>'`
-7. If the toolkit is not connected yet, generate the connection URL:
+7. If the toolkit is not connected yet, start its connection flow:
    - `npx --package @notis_ai/cli@latest -- notis tools link <toolkit>`
+   - For a revoked or invalid credential-based connection, reconnect with credential JSON on stdin: `npx --package @notis_ai/cli@latest -- notis tools link <toolkit> --reconnect --credentials -`
 
 ### Tool access rules
 
@@ -150,6 +151,8 @@ This is the main escape hatch for:
 - When you know the tool name but not the argument shape, use `npx --package @notis_ai/cli@latest -- notis tools describe` or `--get-schema` before execution.
 - Use `--dry-run` before mutating calls when you want schema validation without execution.
 - If a toolkit is missing, use `npx --package @notis_ai/cli@latest -- notis tools link <toolkit>` to start the connection flow.
+- Use `--reconnect` to replace an existing connection. If multiple accounts exist, select one with `--connection-id <id>`.
+- For API keys, basic auth, or other credential JSON, prefer `--credentials -` and pipe or redirect stdin. Avoid inline secrets because they can enter shell history and process listings.
 
 ### Toolkit mental model
 
@@ -202,6 +205,12 @@ Connect a missing toolkit:
 npx --package @notis_ai/cli@latest -- notis tools link github
 ```
 
+Reconnect a credential-based toolkit without putting the secret in shell history:
+
+```bash
+npx --package @notis_ai/cli@latest -- notis tools link dataforseo --reconnect --credentials - < credentials.json
+```
+
 ## Native database access
 
 Native Notis databases are accessed through the generic tool workflow, not a first-class database command group. Use these canonical tool names:
@@ -209,7 +218,7 @@ Native Notis databases are accessed through the generic tool workflow, not a fir
 - `LOCAL_NOTIS_DATABASE_LIST_DATABASES` -- list databases accessible to the current profile
 - `LOCAL_NOTIS_DATABASE_GET_DATABASE` -- inspect read-only metadata and schema detail
 - `LOCAL_NOTIS_DATABASE_QUERY` -- query documents from a database
-- `LOCAL_NOTIS_DATABASE_UPSERT_DATABASE` -- create or update a database schema
+- `LOCAL_NOTIS_DATABASE_UPSERT_DATABASE` -- create or update a database schema. Every database belongs to a Notis app: creation requires the owning app's slug or id in the `app` argument (create the app first with `LOCAL_NOTIS_CREATE_APP` if needed)
 
 Example workflow before building an app:
 

package/skills/notis-query/cli.md

@@ -13,7 +13,7 @@ For CI, hosted agents, or internal scripts, pass a non-persisted token with `NOT
 - `LOCAL_NOTIS_DATABASE_LIST_DATABASES` — list native databases.
 - `LOCAL_NOTIS_DATABASE_GET_DATABASE` — inspect one database schema.
 - `LOCAL_NOTIS_DATABASE_QUERY` — query native database documents.
-- `LOCAL_NOTIS_DATABASE_UPSERT_DATABASE` — create or update database schema.
+- `LOCAL_NOTIS_DATABASE_UPSERT_DATABASE` — create or update database schema. Creation requires the owning app's slug or id in the `app` argument (every database belongs to a Notis app).
 
 ## Workflow
 

package/src/command-specs/tools.js

@@ -342,43 +342,48 @@ async function toolsExecParallelHandler(ctx) {
 }
 
 async function toolsLinkHandler(ctx) {
-  const apiBase = ctx.runtime.apiBase.replace(/\/+$/, '');
-  let portalBase;
-  try {
-    const parsed = new URL(apiBase);
-    if (parsed.hostname.startsWith('api.')) {
-      parsed.hostname = parsed.hostname.replace(/^api\./, 'app.');
-      portalBase = parsed.origin;
-    } else if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1') {
-      const apiPort = parseInt(parsed.port, 10) || 80;
-      parsed.port = String(apiPort === 3001 ? 3000 : apiPort);
-      portalBase = parsed.origin;
-    } else {
-      portalBase = apiBase;
-    }
-  } catch {
-    portalBase = apiBase.replace('api.', 'app.');
+  const credentials = ctx.options.credentials
+    ? await resolveJsonInput(ctx.options.credentials, 'credentials')
+    : undefined;
+  if (credentials !== undefined && (typeof credentials !== 'object' || credentials === null || Array.isArray(credentials))) {
+    throw usageError('credentials must be a JSON object');
+  }
+
+  const arguments_ = {
+    toolkit: ctx.args.toolkit,
+    ...(ctx.options.reconnect ? { reconnect: true } : {}),
+    ...(ctx.options.connectionId ? { reconnect_connection_id: ctx.options.connectionId } : {}),
+    ...(ctx.options.label ? { label: ctx.options.label } : {}),
+    ...(credentials ? { credentials } : {}),
+  };
+  const idempotencyKey = nextIdempotencyKey(ctx.globalOptions);
+  const result = await runToolCommand({
+    runtime: ctx.runtime,
+    toolName: 'LOCAL_NOTIS_AUTHENTIFY',
+    arguments_,
+    mutating: true,
+    idempotencyKey,
+  });
+  const payload = result.payload || {};
+  if (payload.status === 'error') {
+    throw usageError(payload.message || `Failed to connect ${ctx.args.toolkit}`, payload);
   }
-  const portalUrl = `${portalBase}/integrations?connect=${encodeURIComponent(ctx.args.toolkit)}`;
+  const authUrl = payload.redirect_url || payload.integrations_url || payload.url || null;
 
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
     data: {
-      toolkit: ctx.args.toolkit,
-      auth_url: portalUrl,
+      ...payload,
+      auth_url: authUrl,
     },
-    humanSummary: `Open this URL to connect ${ctx.args.toolkit}`,
+    humanSummary: ctx.options.reconnect
+      ? `Reconnected ${ctx.args.toolkit}`
+      : `Started connection for ${ctx.args.toolkit}`,
     hints: [
       { command: 'notis tools toolkits', reason: 'Verify the toolkit is connected after setup' },
     ],
-    renderHuman: () =>
-      [
-        `Connect ${ctx.args.toolkit}:`,
-        `  ${portalUrl}`,
-        '',
-        'After connecting, verify with:',
-        '  notis tools toolkits',
-      ].join('\n'),
+    meta: { mutating: true, idempotency_key: idempotencyKey },
+    renderHuman: () => JSON.stringify({ ...payload, auth_url: authUrl }, null, 2),
   });
 }
 
@@ -481,19 +486,27 @@ export const toolsCommandSpecs = [
   },
   {
     command_path: ['tools', 'link'],
-    summary: 'Get the URL to connect an integration toolkit.',
-    when_to_use: 'Use this when a tool requires authentication with an external service.',
+    summary: 'Connect or reconnect an integration toolkit.',
+    when_to_use: 'Use this when a tool requires authentication or an active connection must be replaced.',
     args_schema: {
       arguments: [{ token: '<toolkit>', description: 'Toolkit name to connect (e.g. github, gmail, slack).' }],
-      options: [],
+      options: [
+        { flags: '--reconnect', description: 'Replace the existing account instead of adding another connection.' },
+        { flags: '--connection-id <id>', key: 'connectionId', description: 'Exact connection id to replace when multiple accounts exist.' },
+        { flags: '--label <label>', description: 'Account label for a new or replacement connection.' },
+        { flags: '--credentials <json>', description: 'Credential JSON object, @file path, or - for stdin. Prefer stdin so secrets do not enter shell history.' },
+      ],
     },
-    examples: ['notis tools link github', 'notis tools link gmail --json'],
-    output_schema: 'Returns the authentication URL for the specified toolkit.',
-    mutates: false,
-    idempotent: true,
-    require_auth: false,
+    examples: [
+      'notis tools link github',
+      'notis tools link dataforseo --reconnect --credentials - < credentials.json',
+    ],
+    output_schema: 'Returns the connection result and an authentication URL when provider authorization is still required.',
+    mutates: true,
+    idempotent: false,
+    require_auth: true,
     related_commands: ['notis tools toolkits', 'notis tools search <query>'],
-    backend_call: { type: 'local' },
+    backend_call: { type: 'tool', name: 'LOCAL_NOTIS_AUTHENTIFY' },
     handler: toolsLinkHandler,
   },
 ];