@notis_ai/cli 0.2.0-beta.107.1 → 0.2.0-beta.113.1

package/src/runtime/output.js

@@ -22,6 +22,13 @@ function formatTable(rows, columns) {
   return [header, divider, ...body].join('\n');
 }
 
+function formatHint(hint) {
+  if (typeof hint?.message === 'string' && hint.message) {
+    return `  ${hint.message}`;
+  }
+  return `  ${hint?.command || ''}  ${hint?.reason || ''}`.trimEnd();
+}
+
 function yamlScalar(value) {
   if (value === null || value === undefined) {
     return 'null';
@@ -94,6 +101,14 @@ export class OutputManager {
     process.stderr.write(`${message}\n`);
   }
 
+  emitProgress({ phase, message, requestId = null }) {
+    if (this.runtime.quiet) {
+      return;
+    }
+    const suffix = requestId ? ` (${requestId})` : '';
+    process.stderr.write(`[${phase}] ${message}${suffix}\n`);
+  }
+
   emitSuccess({
     ok = true,
     command,
@@ -116,7 +131,10 @@ export class OutputManager {
       meta: {
         profile: this.runtime.profileName,
         api_base: this.runtime.apiBase,
-        mutating: Boolean(meta.mutating),
+        mutating:
+          meta.mutating === true
+            ? true
+            : (meta.mutating === false ? false : null),
         ...meta,
       },
     };
@@ -142,7 +160,7 @@ export class OutputManager {
     }
 
     if (hints.length) {
-      const lines = hints.map((hint) => `  ${hint.command}  ${hint.reason}`);
+      const lines = hints.map(formatHint);
       process.stdout.write(`\nNext:\n${lines.join('\n')}\n`);
     }
 
@@ -171,7 +189,7 @@ export class OutputManager {
 
     process.stderr.write(`Error: ${error.message}\n`);
     for (const hint of error.hints || []) {
-      process.stderr.write(`  ${hint.command}  ${hint.reason}\n`);
+      process.stderr.write(`${formatHint(hint)}\n`);
     }
     return error.exitCode || EXIT_CODES.unexpected;
   }

package/src/runtime/profiles.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, parse, resolve } from 'node:path';
 import { CliError, EXIT_CODES } from './errors.js';
 import { getDesktopAuthRecovery } from './desktop-auth.js';
 
@@ -9,6 +9,8 @@ export const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
 export const WORKSPACE_DIR = join(CONFIG_DIR, 'workspace');
 export const DEFAULT_API_BASE = 'https://api.notis.ai';
 export const DEFAULT_PROFILE = 'default';
+const WORKTREE_RUNTIME_FILENAME = join('.context', 'notis-runtime.json');
+const WORKTREE_ROUTING_FILENAME = join('.context', 'notis-routing.json');
 const LOCAL_DEFAULT_API_BASES = new Set([
   'http://localhost:3001',
   'http://127.0.0.1:3001',
@@ -77,17 +79,121 @@ export function normalizeConfig(rawConfig = {}) {
   };
 }
 
-export function loadConfig() {
-  if (!existsSync(CONFIG_FILE)) {
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function findUp(filename, startDir = process.cwd()) {
+  let current = resolve(startDir);
+  const root = parse(current).root;
+  while (true) {
+    const candidate = join(current, filename);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+    if (current === root) {
+      return null;
+    }
+    current = dirname(current);
+  }
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function resolveWorktreeRuntime(startDir = process.cwd()) {
+  if (
+    process.env.NODE_ENV === 'test' &&
+    process.env.NOTIS_TEST_DISABLE_WORKTREE_ROUTING === '1'
+  ) {
+    return null;
+  }
+  const runtimePath = findUp(WORKTREE_RUNTIME_FILENAME, startDir);
+  const routingPath = findUp(WORKTREE_ROUTING_FILENAME, startDir);
+  const routing = routingPath ? readJsonFile(routingPath) : null;
+
+  if (!runtimePath) {
+    if (routing?.mode === 'local-only') {
+      throw new CliError({
+        code: 'dev_runtime_unavailable',
+        message: `This worktree is local-only, but its dev.sh runtime is not active`,
+        exitCode: EXIT_CODES.network,
+        hints: [
+          { message: 'Start ./dev.sh in this worktree, then retry the command.' },
+          { message: `Routing policy: ${routingPath}` },
+        ],
+      });
+    }
+    return null;
+  }
+
+  const runtime = readJsonFile(runtimePath);
+  const apiBase = typeof runtime?.api_base === 'string' ? runtime.api_base.replace(/\/+$/, '') : '';
+  const configFile = typeof runtime?.config_file === 'string' ? runtime.config_file : '';
+  const pid = Number(runtime?.dev_pid);
+  if (
+    runtime?.mode !== 'local-only' ||
+    !isLocalApiBase(apiBase) ||
+    !configFile ||
+    !processIsAlive(pid)
+  ) {
+    throw new CliError({
+      code: 'dev_runtime_unavailable',
+      message: 'The local-only worktree runtime is stale or invalid',
+      exitCode: EXIT_CODES.network,
+      hints: [
+        { message: 'Restart ./dev.sh in this worktree, then retry the command.' },
+        { message: `Runtime lease: ${runtimePath}` },
+      ],
+    });
+  }
+
+  return {
+    ...runtime,
+    api_base: apiBase,
+    config_file: resolve(dirname(runtimePath), configFile),
+    runtime_path: runtimePath,
+    routing_path: routingPath,
+  };
+}
+
+export function resolveConfigFile(runtime = null) {
+  if (runtime?.config_file) {
+    return runtime.config_file;
+  }
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve(envConfigFile);
+  }
+  return CONFIG_FILE;
+}
+
+export function loadConfig(runtime = null) {
+  const configFile = resolveConfigFile(runtime);
+  if (!existsSync(configFile)) {
     return normalizeConfig({});
   }
 
-  return normalizeConfig(JSON.parse(readFileSync(CONFIG_FILE, 'utf-8')));
+  return normalizeConfig(JSON.parse(readFileSync(configFile, 'utf-8')));
 }
 
-export function saveConfig(config) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_FILE, JSON.stringify(normalizeConfig(config), null, 2));
+export function saveConfig(config, runtime = null) {
+  const configFile = resolveConfigFile(runtime);
+  mkdirSync(dirname(configFile), { recursive: true });
+  writeFileSync(configFile, JSON.stringify(normalizeConfig(config), null, 2), { mode: 0o600 });
 }
 
 export function getProfile(config, profileName) {
@@ -194,16 +300,65 @@ export function resolveTimeoutMs(globalOptions = {}) {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 30000;
 }
 
-export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true } = {}) {
-  const config = loadConfig();
+export function parseDebugEntitlementOverride(value = process.env.NOTIS_DEBUG_ENTITLEMENT_OVERRIDE) {
+  if (!value) {
+    return null;
+  }
+  const candidates = [value];
+  try {
+    candidates.push(Buffer.from(value, 'base64url').toString('utf-8'));
+  } catch {
+    // The plain JSON candidate below will provide the actionable error.
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return parsed;
+      }
+    } catch {
+      // Try the next supported encoding.
+    }
+  }
+  throw new CliError({
+    code: 'debug_entitlement_override_invalid',
+    message: 'NOTIS_DEBUG_ENTITLEMENT_OVERRIDE must be a JSON object or base64url-encoded JSON object.',
+    exitCode: EXIT_CODES.usage,
+  });
+}
+
+export function resolveRuntimeProfile(
+  globalOptions = {},
+  { requireAuth = true, includeDebugEntitlementOverride = true } = {},
+) {
+  const worktreeRuntime = resolveWorktreeRuntime();
+  const config = loadConfig(worktreeRuntime);
   const profileName = getCurrentProfileName(config, globalOptions.profile);
-  const apiBase = getApiBase(config, profileName, globalOptions.apiBase);
-  const jwt = getJwt(config, profileName);
+  const requestedApiBase = globalOptions.apiBase;
+  if (
+    worktreeRuntime &&
+    requestedApiBase &&
+    requestedApiBase.replace(/\/+$/, '') !== worktreeRuntime.api_base
+  ) {
+    throw new CliError({
+      code: 'dev_runtime_route_mismatch',
+      message: `This local-only worktree cannot route to ${requestedApiBase}`,
+      exitCode: EXIT_CODES.usage,
+      hints: [{ message: `Expected local API: ${worktreeRuntime.api_base}` }],
+    });
+  }
+  const apiBase = worktreeRuntime
+    ? worktreeRuntime.api_base
+    : getApiBase(config, profileName, globalOptions.apiBase);
+  const jwt = worktreeRuntime ? getProfile(config, profileName).jwt : getJwt(config, profileName);
   const profile = getProfile(config, profileName);
   const agentMode = isAgentMode(globalOptions);
   const nonInteractive = isNonInteractive(globalOptions);
   const outputMode = resolveOutputMode(globalOptions);
   const timeoutMs = resolveTimeoutMs(globalOptions);
+  const debugEntitlementOverride = includeDebugEntitlementOverride
+    ? parseDebugEntitlementOverride()
+    : null;
 
   if (requireAuth && !jwt) {
     const recovery = getDesktopAuthRecovery({
@@ -218,22 +373,38 @@ export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true }
       hints: recovery.hints,
     });
   }
+  if (
+    worktreeRuntime?.expected_user_id &&
+    getJwtSubject(jwt) !== worktreeRuntime.expected_user_id
+  ) {
+    throw new CliError({
+      code: 'dev_runtime_identity_mismatch',
+      message: 'The scoped dev credential does not belong to this worktree test user',
+      exitCode: EXIT_CODES.auth,
+      hints: [
+        { message: 'Restart ./dev.sh to restore the approved worktree identity.' },
+        { message: `Expected user: ${worktreeRuntime.expected_user_id}` },
+      ],
+    });
+  }
 
   // An explicit NOTIS_JWT is a complete credential override. Use it verbatim
   // and never replace it with a token later synced by the desktop profile.
-  const usingEnvJwt = Boolean(process.env.NOTIS_JWT);
+  const usingEnvJwt = !worktreeRuntime && Boolean(process.env.NOTIS_JWT);
   return {
     config,
     profileName,
     apiBase,
     jwt,
-    credentialSource: usingEnvJwt ? 'env' : 'profile',
+    credentialSource: worktreeRuntime ? 'worktree' : usingEnvJwt ? 'env' : 'profile',
     desktopAppName: usingEnvJwt ? undefined : profile.desktop_app_name,
     desktopPid: usingEnvJwt ? undefined : profile.desktop_pid,
     agentMode,
     nonInteractive,
     outputMode,
     timeoutMs,
+    debugEntitlementOverride,
+    worktreeRuntime,
   };
 }
 
@@ -251,6 +422,20 @@ export function getJwtExpiration(jwt) {
   }
 }
 
+export function getJwtSubject(jwt) {
+  if (typeof jwt !== 'string' || !jwt) {
+    return null;
+  }
+  try {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    return typeof payload.sub === 'string' && payload.sub ? payload.sub : null;
+  } catch {
+    return null;
+  }
+}
+
 export function isJwtExpired(jwt, nowSeconds = Math.floor(Date.now() / 1000)) {
   const expiration = getJwtExpiration(jwt);
   return expiration !== null && expiration <= nowSeconds;

package/src/runtime/transport.js

@@ -4,6 +4,7 @@ import { CliError, EXIT_CODES } from './errors.js';
 import {
   DEFAULT_PROFILE,
   getProfile,
+  getJwtSubject,
   isJwtExpired,
   loadConfig,
 } from './profiles.js';
@@ -149,7 +150,7 @@ function reloadJwtFromConfig(runtime) {
   const profileName = runtime.profileName || DEFAULT_PROFILE;
   let profile;
   try {
-    profile = getProfile(loadConfig(), profileName);
+    profile = getProfile(loadConfig(runtime.worktreeRuntime), profileName);
   } catch {
     return false;
   }
@@ -157,6 +158,18 @@ function reloadJwtFromConfig(runtime) {
   if (!nextJwt || nextJwt === runtime.jwt) {
     return false;
   }
+  const expectedUserId = runtime.worktreeRuntime?.expected_user_id;
+  if (expectedUserId && getJwtSubject(nextJwt) !== expectedUserId) {
+    throw new CliError({
+      code: 'dev_runtime_identity_mismatch',
+      message: 'The refreshed scoped dev credential does not belong to this worktree test user',
+      exitCode: EXIT_CODES.auth,
+      hints: [
+        { message: 'Restart ./dev.sh to restore the approved worktree identity.' },
+        { message: `Expected user: ${expectedUserId}` },
+      ],
+    });
+  }
   runtime.jwt = nextJwt;
   runtime.desktopAppName = profile.desktop_app_name;
   runtime.desktopPid = profile.desktop_pid;
@@ -318,6 +331,9 @@ export async function callTool({
       cwd: process.cwd(),
       agent_mode: runtime.agentMode,
       cli_version: runtime.cliVersion,
+      ...(runtime.debugEntitlementOverride
+        ? { debug_entitlement_override: runtime.debugEntitlementOverride }
+        : {}),
     },
   };