@notis_ai/cli 0.2.0-beta.112.1 → 0.2.0-beta.113.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.0-beta.112.1",
+  "version": "0.2.0-beta.113.1",
   "description": "Agent-first Notis CLI for apps and generic tool execution",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -5,7 +5,12 @@ import { Command } from 'commander';
 import { COMMAND_SPECS, GROUP_SUMMARIES } from './command-specs/index.js';
 import { OutputManager } from './runtime/output.js';
 import { asCliError } from './runtime/errors.js';
-import { resolveRuntimeProfile, workspacePath } from './runtime/profiles.js';
+import {
+  DEFAULT_PROFILE,
+  resolveOutputMode,
+  resolveRuntimeProfile,
+  workspacePath,
+} from './runtime/profiles.js';
 
 // Read the version from package.json: the publish pipeline bumps the manifest
 // (scripts/release-utils.js applyVersion), so a hardcoded string here goes
@@ -74,6 +79,33 @@ function buildRuntime(globalOptions, spec) {
   };
 }
 
+function buildErrorRuntime(globalOptions) {
+  try {
+    return {
+      ...resolveRuntimeProfile(globalOptions, {
+        requireAuth: false,
+        includeDebugEntitlementOverride: false,
+      }),
+      cliVersion: CLI_VERSION,
+      color: globalOptions.color !== false,
+      quiet: Boolean(globalOptions.quiet),
+      verbose: Boolean(globalOptions.verbose),
+      workspacePath,
+    };
+  } catch {
+    return {
+      profileName: globalOptions.profile || DEFAULT_PROFILE,
+      apiBase: null,
+      outputMode: resolveOutputMode(globalOptions),
+      cliVersion: CLI_VERSION,
+      color: globalOptions.color !== false,
+      quiet: Boolean(globalOptions.quiet),
+      verbose: Boolean(globalOptions.verbose),
+      workspacePath,
+    };
+  }
+}
+
 function attachSpec(program, parentMap, spec, specs) {
   const parent = ensureParentCommand(program, parentMap, spec.command_path.slice(0, -1));
   const leaf = spec.command_path[spec.command_path.length - 1];
@@ -121,17 +153,7 @@ function attachSpec(program, parentMap, spec, specs) {
       });
       process.exitCode = typeof exitCode === 'number' ? exitCode : 0;
     } catch (error) {
-      const runtime = {
-        ...resolveRuntimeProfile(globalOptions, {
-          requireAuth: false,
-          includeDebugEntitlementOverride: false,
-        }),
-        cliVersion: CLI_VERSION,
-        color: globalOptions.color !== false,
-        quiet: Boolean(globalOptions.quiet),
-        verbose: Boolean(globalOptions.verbose),
-        workspacePath,
-      };
+      const runtime = buildErrorRuntime(globalOptions);
       const output = new OutputManager(runtime);
       const cliError = asCliError(error);
       process.exitCode = output.emitError({

package/src/runtime/output.js

@@ -22,6 +22,13 @@ function formatTable(rows, columns) {
   return [header, divider, ...body].join('\n');
 }
 
+function formatHint(hint) {
+  if (typeof hint?.message === 'string' && hint.message) {
+    return `  ${hint.message}`;
+  }
+  return `  ${hint?.command || ''}  ${hint?.reason || ''}`.trimEnd();
+}
+
 function yamlScalar(value) {
   if (value === null || value === undefined) {
     return 'null';
@@ -153,7 +160,7 @@ export class OutputManager {
     }
 
     if (hints.length) {
-      const lines = hints.map((hint) => `  ${hint.command}  ${hint.reason}`);
+      const lines = hints.map(formatHint);
       process.stdout.write(`\nNext:\n${lines.join('\n')}\n`);
     }
 
@@ -182,7 +189,7 @@ export class OutputManager {
 
     process.stderr.write(`Error: ${error.message}\n`);
     for (const hint of error.hints || []) {
-      process.stderr.write(`  ${hint.command}  ${hint.reason}\n`);
+      process.stderr.write(`${formatHint(hint)}\n`);
     }
     return error.exitCode || EXIT_CODES.unexpected;
   }

package/src/runtime/profiles.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join, parse, resolve } from 'node:path';
 import { CliError, EXIT_CODES } from './errors.js';
 import { getDesktopAuthRecovery } from './desktop-auth.js';
 
@@ -9,6 +9,8 @@ export const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
 export const WORKSPACE_DIR = join(CONFIG_DIR, 'workspace');
 export const DEFAULT_API_BASE = 'https://api.notis.ai';
 export const DEFAULT_PROFILE = 'default';
+const WORKTREE_RUNTIME_FILENAME = join('.context', 'notis-runtime.json');
+const WORKTREE_ROUTING_FILENAME = join('.context', 'notis-routing.json');
 const LOCAL_DEFAULT_API_BASES = new Set([
   'http://localhost:3001',
   'http://127.0.0.1:3001',
@@ -77,17 +79,121 @@ export function normalizeConfig(rawConfig = {}) {
   };
 }
 
-export function loadConfig() {
-  if (!existsSync(CONFIG_FILE)) {
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function findUp(filename, startDir = process.cwd()) {
+  let current = resolve(startDir);
+  const root = parse(current).root;
+  while (true) {
+    const candidate = join(current, filename);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+    if (current === root) {
+      return null;
+    }
+    current = dirname(current);
+  }
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function resolveWorktreeRuntime(startDir = process.cwd()) {
+  if (
+    process.env.NODE_ENV === 'test' &&
+    process.env.NOTIS_TEST_DISABLE_WORKTREE_ROUTING === '1'
+  ) {
+    return null;
+  }
+  const runtimePath = findUp(WORKTREE_RUNTIME_FILENAME, startDir);
+  const routingPath = findUp(WORKTREE_ROUTING_FILENAME, startDir);
+  const routing = routingPath ? readJsonFile(routingPath) : null;
+
+  if (!runtimePath) {
+    if (routing?.mode === 'local-only') {
+      throw new CliError({
+        code: 'dev_runtime_unavailable',
+        message: `This worktree is local-only, but its dev.sh runtime is not active`,
+        exitCode: EXIT_CODES.network,
+        hints: [
+          { message: 'Start ./dev.sh in this worktree, then retry the command.' },
+          { message: `Routing policy: ${routingPath}` },
+        ],
+      });
+    }
+    return null;
+  }
+
+  const runtime = readJsonFile(runtimePath);
+  const apiBase = typeof runtime?.api_base === 'string' ? runtime.api_base.replace(/\/+$/, '') : '';
+  const configFile = typeof runtime?.config_file === 'string' ? runtime.config_file : '';
+  const pid = Number(runtime?.dev_pid);
+  if (
+    runtime?.mode !== 'local-only' ||
+    !isLocalApiBase(apiBase) ||
+    !configFile ||
+    !processIsAlive(pid)
+  ) {
+    throw new CliError({
+      code: 'dev_runtime_unavailable',
+      message: 'The local-only worktree runtime is stale or invalid',
+      exitCode: EXIT_CODES.network,
+      hints: [
+        { message: 'Restart ./dev.sh in this worktree, then retry the command.' },
+        { message: `Runtime lease: ${runtimePath}` },
+      ],
+    });
+  }
+
+  return {
+    ...runtime,
+    api_base: apiBase,
+    config_file: resolve(dirname(runtimePath), configFile),
+    runtime_path: runtimePath,
+    routing_path: routingPath,
+  };
+}
+
+export function resolveConfigFile(runtime = null) {
+  if (runtime?.config_file) {
+    return runtime.config_file;
+  }
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve(envConfigFile);
+  }
+  return CONFIG_FILE;
+}
+
+export function loadConfig(runtime = null) {
+  const configFile = resolveConfigFile(runtime);
+  if (!existsSync(configFile)) {
     return normalizeConfig({});
   }
 
-  return normalizeConfig(JSON.parse(readFileSync(CONFIG_FILE, 'utf-8')));
+  return normalizeConfig(JSON.parse(readFileSync(configFile, 'utf-8')));
 }
 
-export function saveConfig(config) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_FILE, JSON.stringify(normalizeConfig(config), null, 2));
+export function saveConfig(config, runtime = null) {
+  const configFile = resolveConfigFile(runtime);
+  mkdirSync(dirname(configFile), { recursive: true });
+  writeFileSync(configFile, JSON.stringify(normalizeConfig(config), null, 2), { mode: 0o600 });
 }
 
 export function getProfile(config, profileName) {
@@ -225,10 +331,26 @@ export function resolveRuntimeProfile(
   globalOptions = {},
   { requireAuth = true, includeDebugEntitlementOverride = true } = {},
 ) {
-  const config = loadConfig();
+  const worktreeRuntime = resolveWorktreeRuntime();
+  const config = loadConfig(worktreeRuntime);
   const profileName = getCurrentProfileName(config, globalOptions.profile);
-  const apiBase = getApiBase(config, profileName, globalOptions.apiBase);
-  const jwt = getJwt(config, profileName);
+  const requestedApiBase = globalOptions.apiBase;
+  if (
+    worktreeRuntime &&
+    requestedApiBase &&
+    requestedApiBase.replace(/\/+$/, '') !== worktreeRuntime.api_base
+  ) {
+    throw new CliError({
+      code: 'dev_runtime_route_mismatch',
+      message: `This local-only worktree cannot route to ${requestedApiBase}`,
+      exitCode: EXIT_CODES.usage,
+      hints: [{ message: `Expected local API: ${worktreeRuntime.api_base}` }],
+    });
+  }
+  const apiBase = worktreeRuntime
+    ? worktreeRuntime.api_base
+    : getApiBase(config, profileName, globalOptions.apiBase);
+  const jwt = worktreeRuntime ? getProfile(config, profileName).jwt : getJwt(config, profileName);
   const profile = getProfile(config, profileName);
   const agentMode = isAgentMode(globalOptions);
   const nonInteractive = isNonInteractive(globalOptions);
@@ -251,16 +373,30 @@ export function resolveRuntimeProfile(
       hints: recovery.hints,
     });
   }
+  if (
+    worktreeRuntime?.expected_user_id &&
+    getJwtSubject(jwt) !== worktreeRuntime.expected_user_id
+  ) {
+    throw new CliError({
+      code: 'dev_runtime_identity_mismatch',
+      message: 'The scoped dev credential does not belong to this worktree test user',
+      exitCode: EXIT_CODES.auth,
+      hints: [
+        { message: 'Restart ./dev.sh to restore the approved worktree identity.' },
+        { message: `Expected user: ${worktreeRuntime.expected_user_id}` },
+      ],
+    });
+  }
 
   // An explicit NOTIS_JWT is a complete credential override. Use it verbatim
   // and never replace it with a token later synced by the desktop profile.
-  const usingEnvJwt = Boolean(process.env.NOTIS_JWT);
+  const usingEnvJwt = !worktreeRuntime && Boolean(process.env.NOTIS_JWT);
   return {
     config,
     profileName,
     apiBase,
     jwt,
-    credentialSource: usingEnvJwt ? 'env' : 'profile',
+    credentialSource: worktreeRuntime ? 'worktree' : usingEnvJwt ? 'env' : 'profile',
     desktopAppName: usingEnvJwt ? undefined : profile.desktop_app_name,
     desktopPid: usingEnvJwt ? undefined : profile.desktop_pid,
     agentMode,
@@ -268,6 +404,7 @@ export function resolveRuntimeProfile(
     outputMode,
     timeoutMs,
     debugEntitlementOverride,
+    worktreeRuntime,
   };
 }
 
@@ -285,6 +422,20 @@ export function getJwtExpiration(jwt) {
   }
 }
 
+export function getJwtSubject(jwt) {
+  if (typeof jwt !== 'string' || !jwt) {
+    return null;
+  }
+  try {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    return typeof payload.sub === 'string' && payload.sub ? payload.sub : null;
+  } catch {
+    return null;
+  }
+}
+
 export function isJwtExpired(jwt, nowSeconds = Math.floor(Date.now() / 1000)) {
   const expiration = getJwtExpiration(jwt);
   return expiration !== null && expiration <= nowSeconds;

package/src/runtime/transport.js

@@ -4,6 +4,7 @@ import { CliError, EXIT_CODES } from './errors.js';
 import {
   DEFAULT_PROFILE,
   getProfile,
+  getJwtSubject,
   isJwtExpired,
   loadConfig,
 } from './profiles.js';
@@ -149,7 +150,7 @@ function reloadJwtFromConfig(runtime) {
   const profileName = runtime.profileName || DEFAULT_PROFILE;
   let profile;
   try {
-    profile = getProfile(loadConfig(), profileName);
+    profile = getProfile(loadConfig(runtime.worktreeRuntime), profileName);
   } catch {
     return false;
   }
@@ -157,6 +158,18 @@ function reloadJwtFromConfig(runtime) {
   if (!nextJwt || nextJwt === runtime.jwt) {
     return false;
   }
+  const expectedUserId = runtime.worktreeRuntime?.expected_user_id;
+  if (expectedUserId && getJwtSubject(nextJwt) !== expectedUserId) {
+    throw new CliError({
+      code: 'dev_runtime_identity_mismatch',
+      message: 'The refreshed scoped dev credential does not belong to this worktree test user',
+      exitCode: EXIT_CODES.auth,
+      hints: [
+        { message: 'Restart ./dev.sh to restore the approved worktree identity.' },
+        { message: `Expected user: ${expectedUserId}` },
+      ],
+    });
+  }
   runtime.jwt = nextJwt;
   runtime.desktopAppName = profile.desktop_app_name;
   runtime.desktopPid = profile.desktop_pid;