@notis_ai/cli 0.2.0-beta.154.1 → 0.2.0-beta.156.1

package/dist/agent-hooks/notis-agent-hook.mjs

@@ -979,7 +979,7 @@ var require_suggestSimilar = __commonJS({
 // node_modules/commander/lib/command.js
 var require_command = __commonJS({
   "node_modules/commander/lib/command.js"(exports) {
-    var EventEmitter = __require("node:events").EventEmitter;
+    var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
     var path3 = __require("node:path");
     var fs3 = __require("node:fs");
@@ -989,7 +989,7 @@ var require_command = __commonJS({
     var { Help: Help2 } = require_help();
     var { Option: Option2, DualOptions } = require_option();
     var { suggestSimilar } = require_suggestSimilar();
-    var Command2 = class _Command extends EventEmitter {
+    var Command2 = class _Command extends EventEmitter2 {
       /**
        * Initialize a new `Command`.
        *
@@ -3796,15 +3796,22 @@ async function downloadSkillBundle(bundleUrl) {
   }
   return Buffer.from(await response.arrayBuffer());
 }
-async function updateAgentTargets(serverUrl, jwt, skillId, targets) {
+async function updateAgentTargets(serverUrl, jwt, skillId, targets, expectedUpdatedAt) {
   return requestJson(`${serverUrl}/portal_skills/agent-targets`, jwt, {
     method: "PATCH",
     body: {
       skill_id: skillId,
-      agent_targets: targets
+      agent_targets: targets,
+      ...expectedUpdatedAt ? { expected_updated_at: expectedUpdatedAt } : {}
     }
   });
 }
+function agentFailureLabel(agent) {
+  return AGENT_FAILURE_LABELS[agent] ?? agent;
+}
+function agentFolderFailureName(agent) {
+  return `${agentFailureLabel(agent)} skills folder`;
+}
 async function removeForeignAccountSymlinks(skillsDir, options = {}) {
   const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
   const currentRoot = path2.resolve(skillsDir);
@@ -3865,8 +3872,9 @@ async function isManagedSymlink(linkPath, managedRoots) {
     const target = await fs2.readlink(linkPath);
     const resolvedTarget = path2.resolve(path2.dirname(linkPath), target);
     return managedRoots.some((root) => resolvedTarget === root || resolvedTarget.startsWith(`${root}${path2.sep}`));
-  } catch {
-    return false;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
   }
 }
 async function ensureCorrectSymlink(linkPath, targetPath) {
@@ -3882,7 +3890,8 @@ async function ensureCorrectSymlink(linkPath, targetPath) {
     } else {
       return "blocked";
     }
-  } catch {
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
   }
   const relativePath = path2.relative(path2.dirname(linkPath), targetPath);
   await fs2.symlink(relativePath, linkPath);
@@ -3894,19 +3903,26 @@ function defaultAgentSkillDirs(skillsDir) {
     ...EXTERNAL_AGENT_SKILL_DIRS
   };
 }
-async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots) {
+async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, failures, agent) {
   let removed = 0;
   try {
     await fs2.mkdir(agentDir, { recursive: true });
     const existingEntries = await fs2.readdir(agentDir, { withFileTypes: true });
     for (const entry of existingEntries) {
       const entryPath = path2.join(agentDir, entry.name);
-      if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
-        await fs2.unlink(entryPath);
-        removed += 1;
+      try {
+        if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") {
+          failures.push({ name: entry.name, error: `${agentFailureLabel(agent)}: could not remove skill link (${error.message})` });
+        }
       }
     }
-  } catch {
+  } catch (error) {
+    failures.push({ name: agentFolderFailureName(agent), error: `Could not read agent skills directory (${error.message})` });
   }
   return removed;
 }
@@ -3951,7 +3967,7 @@ async function detectDeletedAgentSymlinks(cloudSkills, previousState, skillsDir
         continue;
       }
       const previous = previousState.skills[skill.name];
-      if (!previous) {
+      if (!previous || previous.cloudId !== skill.id || previous.verifiedAgentLinks?.[agent] !== true || !skill.updated_at || previous.cloudUpdatedAt !== skill.updated_at) {
         continue;
       }
       const cloudTargets = normalizeAgentTargets(skill.agent_targets);
@@ -3982,7 +3998,9 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
   const result = {
     linked: 0,
     removed: 0,
-    skipped: 0
+    skipped: 0,
+    verifiedAgentLinks: {},
+    failures: []
   };
   const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
   const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
@@ -4017,21 +4035,34 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
       result.skipped += desiredByAgent[agent].size;
       continue;
     }
-    await fs2.mkdir(agentDir, { recursive: true });
+    try {
+      await fs2.mkdir(agentDir, { recursive: true });
+    } catch (error) {
+      result.failures.push({ name: agentFolderFailureName(agent), error: `Could not create agent skills directory (${error.message})` });
+      continue;
+    }
     const desiredSkills = desiredByAgent[agent];
     if (options.removeUndesired !== false) {
-      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots);
+      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, result.failures, agent);
     }
     for (const skillName of desiredSkills) {
       const targetPath = path2.join(skillsDir, skillName);
       const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
       try {
-        await fs2.access(targetPath);
+        if (!(await fs2.stat(path2.join(targetPath, "SKILL.md"))).isFile()) throw new Error("Missing SKILL.md");
       } catch {
         result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: SKILL.md is missing or unreadable` });
+        continue;
+      }
+      let syncOutcome;
+      try {
+        syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
+      } catch (error) {
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: could not create skill link (${error.message})` });
         continue;
       }
-      const syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
       if (syncOutcome === "linked") {
         result.linked += 1;
       } else if (syncOutcome === "blocked") {
@@ -4039,9 +4070,13 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
           `[skill-sync] Could not link "${skillName}" for ${agent}: non-symlink entry blocks ${linkPath}`
         );
         result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: an existing file or folder blocks the skill link` });
       } else {
         result.skipped += 1;
       }
+      if (syncOutcome !== "blocked") {
+        result.verifiedAgentLinks[skillName] = { ...result.verifiedAgentLinks[skillName], [agent]: true };
+      }
     }
   }
   if (options.removeUndesired !== false && !Object.values(agentSkillDirs).some(
@@ -4050,7 +4085,9 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
     result.removed += await removeUndesiredManagedSymlinks(
       legacyGlobalSkillsDir,
       /* @__PURE__ */ new Set(),
-      managedRoots
+      managedRoots,
+      result.failures,
+      "legacy"
     );
   }
   return result;
@@ -4149,7 +4186,7 @@ function shouldWriteCloudSkill(cloudSkill, localSkills, previousState) {
   const localChangedSinceLastSync = !previous || previous.folderHash !== localSkill.folderHash;
   return !localChangedSinceLastSync && Boolean(cloudHash) && cloudHash !== localSkill.folderHash;
 }
-function buildSyncState(pullResponse, localSkills, lastSyncedAt) {
+function buildSyncState(pullResponse, localSkills, lastSyncedAt, verifiedAgentLinks = {}) {
   const localSkillMap = toSkillMap(localSkills);
   const skills = Object.fromEntries(
     pullResponse.skills.map((skill) => {
@@ -4160,6 +4197,8 @@ function buildSyncState(pullResponse, localSkills, lastSyncedAt) {
           cloudId: skill.id,
           folderHash: localSkill?.folderHash || skill.skill_folder_hash || "",
           agentTargets: normalizeAgentTargets(skill.agent_targets),
+          verifiedAgentLinks: skill.status === "active" ? verifiedAgentLinks[skill.name] ?? {} : {},
+          cloudUpdatedAt: skill.updated_at,
           syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
         }
       ];
@@ -4215,7 +4254,7 @@ function applyLegacyFirstRunState(localSkills, scopedState, legacyState) {
     skills: migratedSkills
   };
 }
-async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps) {
+async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps, failures = []) {
   const localSkillMap = toSkillMap(localSkills);
   const warnSkillSync = (message, error) => {
     console.warn(`[Notis] ${message}`, error);
@@ -4231,6 +4270,8 @@ async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previo
       onWarning: warnSkillSync
     })) {
       downloaded += 1;
+    } else {
+      failures.push({ name: cloudSkill.name, error: "Skill content could not be downloaded or written; sync will retry" });
     }
   }
   return downloaded;
@@ -4258,25 +4299,42 @@ async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies
   assertSkillsPullAuthorized(pullResponse);
   const previousState = await deps.readSyncState(syncPaths);
   const localSkills = await deps.scanLocalSkills(syncPaths);
+  const failedDownloads = [];
   const downloaded = await writePulledSkillsToScopedMirror(
     pullResponse,
     localSkills,
     previousState,
     syncPaths,
-    deps
+    deps,
+    failedDownloads
   );
   const finalLocalSkills = await deps.scanLocalSkills(syncPaths);
   const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
   const relinkSkillNames = new Set(options.relinkSkillNames || []);
+  const failures = [...failedDownloads];
+  const verifiedLinks = {};
+  for (const skill of pullResponse.skills) {
+    const previous = previousState.skills[skill.name];
+    if (skill.updated_at && previous?.cloudId === skill.id && previous.cloudUpdatedAt === skill.updated_at) {
+      verifiedLinks[skill.name] = { ...previous.verifiedAgentLinks };
+    }
+  }
   if (relinkSkillNames.size > 0) {
-    await deps.syncSymlinks(
+    const relinked = await deps.syncSymlinks(
       pullResponse.skills.filter((skill) => relinkSkillNames.has(skill.name)),
       syncPaths.skillsDir,
       { removeUndesired: false }
     );
+    failures.push(...(relinked.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    ));
+    for (const name of relinkSkillNames) {
+      verifiedLinks[name] = relinked.verifiedAgentLinks?.[name] ?? {};
+    }
   }
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
   await deps.writeSyncState(
-    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt),
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks),
     syncPaths
   );
   return {
@@ -4284,10 +4342,11 @@ async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies
     downloaded,
     deleted: 0,
     removed: 0,
-    lastSyncedAt
+    lastSyncedAt,
+    ...failures.length ? { failedLinks: failures } : {}
   };
 }
-async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps) {
+async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps, failures) {
   if (isEmptySyncState(scopedState)) {
     return 0;
   }
@@ -4299,22 +4358,6 @@ async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previo
   if (deletions.length === 0) {
     return 0;
   }
-  const latestSkillsById = new Map(pullResponse.skills.map((skill) => [skill.id, skill]));
-  let fresh = null;
-  try {
-    fresh = await deps.pullSkills(serverUrl, jwt);
-  } catch (error) {
-    console.warn(
-      "[skill-sync] Could not re-pull latest agent targets before deactivation; using the top-of-sync snapshot.",
-      error
-    );
-  }
-  if (fresh) {
-    assertSkillsPullAuthorized(fresh);
-    for (const skill of fresh.skills) {
-      latestSkillsById.set(skill.id, skill);
-    }
-  }
   const agentsBySkill = /* @__PURE__ */ new Map();
   for (const deletion of deletions) {
     const entry = agentsBySkill.get(deletion.skillId) ?? {
@@ -4324,31 +4367,35 @@ async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previo
     entry.agents.add(deletion.agent);
     agentsBySkill.set(deletion.skillId, entry);
   }
-  const inMemoryById = new Map(pullResponse.skills.map((skill) => [skill.id, skill]));
+  const fresh = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(fresh);
+  Object.assign(pullResponse, fresh);
+  let needsRefresh = false;
   let deactivated = 0;
   for (const [skillId, { skillName, agents }] of agentsBySkill) {
-    const latest = latestSkillsById.get(skillId);
-    if (!latest) {
-      continue;
-    }
-    const nextTargets = { ...normalizeAgentTargets(latest.agent_targets) };
-    for (const agent of agents) {
-      nextTargets[agent] = false;
-    }
+    const skill = pullResponse.skills.find((item) => item.id === skillId);
+    const previous = previousState.skills[skillName];
+    if (!skill?.updated_at || previous?.cloudUpdatedAt !== skill.updated_at) continue;
+    const patch = Object.fromEntries([...agents].map((agent) => [agent, false]));
     try {
-      await deps.updateAgentTargets(serverUrl, jwt, skillId, nextTargets);
-      const inMemory = inMemoryById.get(skillId);
-      if (inMemory) {
-        inMemory.agent_targets = nextTargets;
+      const saved = await deps.updateAgentTargets(serverUrl, jwt, skillId, patch, skill.updated_at);
+      if (saved.success !== true || !saved.updated_at?.trim() || saved.updated_at === skill.updated_at || !["notis", "claude_code", "cursor", "codex"].every((agent) => typeof saved.agent_targets?.[agent] === "boolean") || ![...agents].every((agent) => saved.agent_targets[agent] === false)) {
+        throw new Error("Assignment update did not return a verified saved revision");
       }
+      skill.agent_targets = saved.agent_targets;
+      skill.updated_at = saved.updated_at;
       deactivated += agents.size;
     } catch (error) {
-      console.warn(
-        `[skill-sync] Failed to deactivate "${skillName}" for ${[...agents].join(", ")} after local symlink deletion:`,
-        error
-      );
+      needsRefresh = true;
+      failures.push({ name: skillName, error: "Could not save the local agent removal; refreshed saved assignments" });
+      console.warn(`[skill-sync] Assignment changed or could not be saved for "${skillName}"; refreshing before reconciliation.`, error);
     }
   }
+  if (needsRefresh) {
+    const refreshed = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(refreshed);
+    Object.assign(pullResponse, refreshed);
+  }
   return deactivated;
 }
 async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
@@ -4391,6 +4438,18 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
   );
   const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES2]);
+  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
+  const assignmentFailures = [];
+  const deactivated = syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
+    serverUrl,
+    jwt,
+    pullResponse,
+    scopedState,
+    scopedState,
+    syncPaths.skillsDir,
+    deps,
+    assignmentFailures
+  ) : 0;
   const authUserId = decodeJwtSubject(jwt);
   let previousAuthState = null;
   if (authUserId && authUserId !== syncUserId) {
@@ -4405,22 +4464,12 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     protectedSkillNames
   });
   const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES2.has(skill.name));
-  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
   const previousState = withoutBaseSkillState(applyLegacyFirstRunState(
     localSkills,
     scopedState,
     isEmptySyncState(scopedState) ? !previousAuthState || isEmptySyncState(previousAuthState) ? await deps.readLegacySyncState(syncPaths) : previousAuthState : null
   ));
-  const deactivated = await deactivateDeletedAgentSkills(
-    serverUrl,
-    jwt,
-    pullResponse,
-    previousState,
-    scopedState,
-    syncPaths.skillsDir,
-    deps
-  );
-  await deps.syncSymlinks(
+  const gatheredSymlinkResult = await deps.syncSymlinks(
     buildLocalSymlinkCandidates(pullResponse, localSkills, previousState),
     syncPaths.skillsDir
   );
@@ -4451,21 +4500,25 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
       deleted += 1;
     }
   }
+  const failedDownloads = [];
   const downloaded = await writePulledSkillsToScopedMirror(
     pullResponse,
     localSkills,
     previousState,
     syncPaths,
-    deps
+    deps,
+    failedDownloads
   );
   const finalLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES2.has(skill.name));
   const symlinkResult = await deps.syncSymlinks(
     buildLocalSymlinkCandidates(pullResponse, finalLocalSkills, previousState),
     syncPaths.skillsDir
   );
+  const verifiedLinks = { ...symlinkResult.verifiedAgentLinks ?? {} };
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
   const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
   await deps.writeSyncState(
-    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt),
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks),
     syncPaths
   );
   return {
@@ -4475,14 +4528,17 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     downloaded,
     deleted,
     deactivated,
-    linked: symlinkResult.linked,
-    removed: foreignLinksRemoved + symlinkResult.removed,
+    linked: gatheredSymlinkResult.linked + symlinkResult.linked,
+    removed: foreignLinksRemoved + gatheredSymlinkResult.removed + symlinkResult.removed,
     skipped: symlinkResult.skipped,
+    failedLinks: [...assignmentFailures, ...failedDownloads, ...(symlinkResult.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    )],
     lastSyncedAt,
     failedPushes
   };
 }
-var DEFAULT_AGENT_TARGETS, HOME_DIR, execFileAsync, AGENTS_DIR, LEGACY_AGENTS_SKILLS_DIR, NOTIS_SKILL_SYNC_ROOT, LEGACY_NOTIS_SYNC_STATE_PATH, AGENTS_SKILLS_DIR, SKILL_LOCK_PATH, DEFAULT_SYNC_STATE, EXCLUDED_TOP_LEVEL_ROOT_NAMES, DEFAULT_SYNC_PATHS, HOME_DIR2, EXTERNAL_AGENT_SKILL_DIRS, EXTERNAL_AGENTS, BASE_SKILL_NAMES2, DEFAULT_RUN_SKILL_SYNC_DEPS;
+var DEFAULT_AGENT_TARGETS, HOME_DIR, execFileAsync, AGENTS_DIR, LEGACY_AGENTS_SKILLS_DIR, NOTIS_SKILL_SYNC_ROOT, LEGACY_NOTIS_SYNC_STATE_PATH, AGENTS_SKILLS_DIR, SKILL_LOCK_PATH, DEFAULT_SYNC_STATE, EXCLUDED_TOP_LEVEL_ROOT_NAMES, DEFAULT_SYNC_PATHS, HOME_DIR2, EXTERNAL_AGENT_SKILL_DIRS, EXTERNAL_AGENTS, AGENT_FAILURE_LABELS, BASE_SKILL_NAMES2, DEFAULT_RUN_SKILL_SYNC_DEPS;
 var init_skill_sync = __esm({
   "dist/skill-sync/index.js"() {
     DEFAULT_AGENT_TARGETS = {
@@ -4541,6 +4597,12 @@ var init_skill_sync = __esm({
       codex: path2.join(HOME_DIR2, ".codex", "skills")
     };
     EXTERNAL_AGENTS = Object.keys(EXTERNAL_AGENT_SKILL_DIRS);
+    AGENT_FAILURE_LABELS = {
+      claude_code: "Claude Code",
+      cursor: "Cursor",
+      codex: "Codex",
+      legacy: "legacy ~/.agents/skills"
+    };
     BASE_SKILL_NAMES2 = /* @__PURE__ */ new Set(["notis-apps", "notis-query", "notis-cli"]);
     DEFAULT_RUN_SKILL_SYNC_DEPS = {
       fetchSyncSettings,
@@ -4566,7 +4628,7 @@ var init_skill_sync = __esm({
 // src/cli.js
 import { readFileSync as readFileSync21 } from "node:fs";
 import { dirname as dirname18, join as join19 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
 
 // node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
@@ -7721,7 +7783,7 @@ async function directDeploy(projectDir, appId) {
 
 // src/runtime/app-dev-server.js
 import { createServer } from "node:http";
-import { execFileSync as execFileSync2, spawn as spawn2 } from "node:child_process";
+import { execFileSync as execFileSync2, spawn as spawn3 } from "node:child_process";
 import {
   appendFileSync,
   existsSync as existsSync7,
@@ -7735,7 +7797,7 @@ import {
 import { freemem, loadavg, totalmem } from "node:os";
 import { dirname as dirname6, join as join7, resolve as resolve5 } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/runtime/app-dev-sessions.js
 import { randomUUID as randomUUID3 } from "node:crypto";
@@ -8900,6 +8962,40 @@ function captureDesktopHostOwnership({
   };
 }
 
+// src/runtime/app-dev-build.js
+import { spawn as spawn2 } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+async function startAppDevBuild(cwd, command = "npm", args = ["run", "build", "--", "--watch"]) {
+  const supervisor = spawn2(process.execPath, [fileURLToPath3(new URL("./app-dev-build-supervisor.js", import.meta.url))], {
+    cwd,
+    stdio: ["ignore", "inherit", "inherit", "ipc"],
+    env: { ...process.env, ELECTRON_RUN_AS_NODE: "1", NOTIS_DEV: "1" }
+  });
+  const build = new EventEmitter();
+  build.pid = null;
+  build.exitCode = null;
+  build.signalCode = null;
+  build.kill = (signal = "SIGTERM") => supervisor.kill(signal);
+  await new Promise((resolve10, reject) => {
+    supervisor.once("error", reject);
+    supervisor.once("exit", (code, signal) => {
+      build.exitCode = code;
+      build.signalCode = signal;
+      reject(new Error(`Build supervisor exited before startup (${code ?? signal})`));
+      build.emit("exit", code, signal);
+    });
+    supervisor.once("message", ({ pid }) => {
+      build.pid = pid;
+      resolve10();
+    });
+    supervisor.send({ command, args }, (error) => {
+      if (error) reject(error);
+    });
+  });
+  return build;
+}
+
 // src/runtime/app-dev-server.js
 var CONTENT_TYPES = {
   ".js": "application/javascript; charset=utf-8",
@@ -8907,7 +9003,7 @@ var CONTENT_TYPES = {
   ".map": "application/json; charset=utf-8"
 };
 var MAX_JSON_BODY_BYTES = 64 * 1024;
-var RUNTIME_DIR = dirname6(fileURLToPath3(import.meta.url));
+var RUNTIME_DIR = dirname6(fileURLToPath4(import.meta.url));
 var CLI_ROOT2 = resolve5(RUNTIME_DIR, "../..");
 var REPO_ROOT = resolve5(RUNTIME_DIR, "../../../..");
 var HARNESS_TEMPLATE_PATH = join7(CLI_ROOT2, "template", ".harness", "index.html.tmpl");
@@ -8948,7 +9044,7 @@ function readProcessGroupRssBytes(groupPids) {
 async function terminateBuildProcessTree(child, {
   platform = process.platform,
   signalProcess = process.kill,
-  spawnProcess = spawn2,
+  spawnProcess = spawn3,
   graceMs = BUILD_PROCESS_STOP_GRACE_MS
 } = {}) {
   const pid = child?.pid;
@@ -9755,12 +9851,7 @@ data: ${JSON.stringify({ slug, at: Date.now() })}
       await prepareArtifactBuild(state.projectDir);
       watchManifestInputs(state);
       pollForBundleAndWatch(state);
-      const buildProcess = spawn2("npm", ["run", "build", "--", "--watch"], {
-        cwd: state.projectDir,
-        detached: process.platform !== "win32",
-        stdio: "inherit",
-        env: { ...process.env, NOTIS_DEV: "1" }
-      });
+      const buildProcess = await startAppDevBuild(state.projectDir);
       state.buildProcess = buildProcess;
       for (let attempt = 0; attempt < 5 && !state.watcherOwnership; attempt += 1) {
         state.watcherOwnership = captureDesktopWatcherOwnership({
@@ -10122,7 +10213,7 @@ function discoverRegisteredAppProjects(options = {}) {
 }
 
 // src/runtime/agent-browser.js
-import { spawn as spawn3, spawnSync } from "node:child_process";
+import { spawn as spawn4, spawnSync } from "node:child_process";
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 var PREPARE_CAPTURE_SCRIPT = "(() => { const s = document.getElementById('harness-status'); if (s) s.style.display = 'none'; const r = document.getElementById('root'); if (r) { r.style.paddingTop = '0'; r.style.minHeight = '0'; } document.body.style.minHeight = '0'; document.documentElement.style.minHeight = '0'; return true; })()";
@@ -10215,7 +10306,7 @@ function commandError(phase, result) {
 }
 function runAgentBrowser(args, { timeoutMs = 3e4 } = {}) {
   return new Promise((resolvePromise) => {
-    const child = spawn3("agent-browser", args, {
+    const child = spawn4("agent-browser", args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: process.env
     });
@@ -10748,9 +10839,9 @@ function getCliMode() {
 }
 
 // src/runtime/store-screenshot.js
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 var STORE_SCREENSHOT_ASPECT = 16 / 10;
-var SHARED_BACKDROP_PATH = fileURLToPath4(
+var SHARED_BACKDROP_PATH = fileURLToPath5(
   new URL("./assets/store-screenshot-dark.png", import.meta.url)
 );
 var ACCENT_PALETTES = {
@@ -10924,8 +11015,8 @@ import {
 import { createServer as createServer3 } from "node:http";
 import { homedir as homedir6 } from "node:os";
 import { basename as basename2, dirname as dirname10, join as join11 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { execFileSync as execFileSync3, spawn as spawn4 } from "node:child_process";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { execFileSync as execFileSync3, spawn as spawn5 } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 var DEFAULT_CLI_OAUTH_SCOPES = [
   "notis:read",
@@ -11462,7 +11553,7 @@ function browserOpenCommand(url, platform = process.platform) {
 function openBrowser(url) {
   const { command, args } = browserOpenCommand(url);
   try {
-    const child = spawn4(command, args, { detached: true, stdio: "ignore" });
+    const child = spawn5(command, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -11638,7 +11729,7 @@ async function publishForegroundAuthorization(runtime, authorization) {
     releaseListenerGlobalLock(globalLock);
   }
 }
-var LISTENER_SCRIPT = fileURLToPath5(new URL("./login-listener.js", import.meta.url));
+var LISTENER_SCRIPT = fileURLToPath6(new URL("./login-listener.js", import.meta.url));
 var LISTENER_SCRIPT_NAME = "login-listener.js";
 var LISTENER_HANDSHAKE_TIMEOUT_MS = 1e4;
 var LISTENER_START_LOCK_STALE_MS = LISTENER_HANDSHAKE_TIMEOUT_MS * 2;
@@ -11938,7 +12029,7 @@ async function startDetachedLoopbackListener(runtime, {
   }
   let child;
   try {
-    child = spawn4(process.execPath, [LISTENER_SCRIPT, payloadFile, identityToken], {
+    child = spawn5(process.execPath, [LISTENER_SCRIPT, payloadFile, identityToken], {
       detached: true,
       windowsHide: true,
       // An IPC channel only so the child can report the port it bound. Every
@@ -13739,7 +13830,7 @@ function runtimeCallLabel(call) {
   }
   return call?.op || "runtime call";
 }
-function assertHarnessResult(result, route, databaseSlugs, mode = "stub") {
+function assertHarnessResult(result, route, databaseSlugs, mode = "stub", capabilities = {}) {
   const assertions = [];
   if (result.tool_error) {
     assertions.push({
@@ -13778,7 +13869,7 @@ function assertHarnessResult(result, route, databaseSlugs, mode = "stub") {
   );
   for (const call of databaseQueries) {
     const databaseSlug = call?.args?.arguments?.database_slug;
-    if (databaseSlug && !declaredDatabaseSet.has(databaseSlug)) {
+    if (databaseSlug && !declaredDatabaseSet.has(databaseSlug) && capabilities.workspaceDatabases !== "read") {
       assertions.push({
         ok: false,
         code: "undeclared_database_query",
@@ -14872,7 +14963,8 @@ ${listing.errors.map((error) => `  - ${error}`).join("\n")}`);
           result,
           route,
           declaredDatabaseSlugs(appConfig, manifest, route),
-          mode
+          mode,
+          manifest.capabilities || appConfig.capabilities || {}
         );
         return {
           ...result,
@@ -14897,7 +14989,8 @@ ${listing.errors.map((error) => `  - ${error}`).join("\n")}`);
           result,
           route,
           declaredDatabaseSlugs(appConfig, manifest, route),
-          mode
+          mode,
+          manifest.capabilities || appConfig.capabilities || {}
         );
         results.push({
           route: route.slug,
@@ -16036,6 +16129,11 @@ function classifySqlMutation(query) {
 }
 function classifyToolMutation(toolName, args = {}) {
   const normalized = localNotisToolSlug(toolName).toUpperCase();
+  if (normalized === "LOCAL_NOTIS_SANDBOX_PREVIEW") {
+    if (args.action === "status") return false;
+    if (["register", "open", "heartbeat", "stop"].includes(args.action)) return true;
+    return null;
+  }
   if (normalized.includes("EXECUTE_SQL") && typeof args.query === "string") {
     const query = args.query.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/--[^\n]*/g, " ").trim();
     const sqlClassification = classifySqlMutation(query);
@@ -16504,7 +16602,7 @@ var toolsCommandSpecs = [
 
 // src/command-specs/meta.js
 import { dirname as dirname12 } from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // src/runtime/help.js
 function canonicalCommandName(spec) {
@@ -16567,7 +16665,7 @@ function doctorToolRoundtripRuntime(runtime) {
     timeoutMs: Math.max(runtime.timeoutMs || 0, DOCTOR_TOOL_ROUNDTRIP_TIMEOUT_MS)
   };
 }
-function doctorChannelSummary(runtime, moduleDirectory = dirname12(fileURLToPath6(import.meta.url))) {
+function doctorChannelSummary(runtime, moduleDirectory = dirname12(fileURLToPath7(import.meta.url))) {
   const decision = resolveChannelSwitch({
     runningVersion: runtime.cliVersion,
     profile: {
@@ -16782,7 +16880,7 @@ var metaCommandSpecs = [
 // src/command-specs/onboarding.js
 import { readFileSync as readFileSync17 } from "node:fs";
 import { dirname as dirname15, join as join15 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
 
 // src/command-specs/agents.js
 import { createHash as createHash6 } from "node:crypto";
@@ -16801,8 +16899,8 @@ import {
 import { createHash as createHash4 } from "node:crypto";
 import { homedir as homedir7 } from "node:os";
 import { dirname as dirname13, join as join13 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
-var HERE = dirname13(fileURLToPath7(import.meta.url));
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+var HERE = dirname13(fileURLToPath8(import.meta.url));
 var INSTRUCTIONS_PATH = join13(HERE, "..", "..", "skills", "notis-cli", "AGENT_INSTRUCTIONS.md");
 var HOOK_BUNDLE_PATH = join13(HERE, "..", "..", "dist", "agent-hooks", "notis-agent-hook.mjs");
 var START_MARKER = "<!-- notis-cli:instructions:start -->";
@@ -17641,7 +17739,7 @@ var authCommandSpecs = [
 ];
 
 // src/command-specs/onboarding.js
-var HERE2 = dirname15(fileURLToPath8(import.meta.url));
+var HERE2 = dirname15(fileURLToPath9(import.meta.url));
 var BUNDLED_BRIEF_PATH = join15(HERE2, "..", "..", "skills", "notis-onboarding", "BRIEF.md");
 async function fetchOnboardingState(runtime) {
   try {
@@ -19536,13 +19634,13 @@ import {
 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { dirname as dirname16, join as join17, relative as relative5, resolve as resolve9 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
 var BASE_SKILL_NAMES = Object.freeze([
   "notis-apps",
   "notis-query",
   "notis-cli"
 ]);
-var HERE3 = dirname16(fileURLToPath9(import.meta.url));
+var HERE3 = dirname16(fileURLToPath10(import.meta.url));
 function resolveBundledBaseSkillsRoot({ resourcesPath = process.resourcesPath } = {}) {
   const sourceCheckout = resolve9(HERE3, "../../../../server/skills");
   const packaged = resolve9(HERE3, "../../dist/base-skills");
@@ -19850,11 +19948,12 @@ async function syncSkillsHandler(ctx) {
     honorSyncEnabled: Boolean(ctx.options.electronRepeat),
     runAccountSync: runSkillSync2
   });
+  const failures = [...result.failedPushes || [], ...result.failedLinks || []];
   return ctx.output.emitSuccess({
     command: "skills sync",
     data: result,
-    humanSummary: result.syncEnabled ? `Synced account skills and kept ${result.baseSkills.length} base skills current.` : `Automatic Desktop sync is off; kept ${result.baseSkills.length} base skills current.`,
-    renderHuman: () => result.syncEnabled ? `Skills synced. Base skills current: ${result.baseSkills.join(", ")}.` : `Automatic Desktop sync is off. Base skills remain current: ${result.baseSkills.join(", ")}.`
+    humanSummary: failures.length ? `Skill sync completed with ${failures.length} reported failures; inspect failedPushes and failedLinks.` : result.syncEnabled ? `Synced account skills and kept ${result.baseSkills.length} base skills current.` : `Automatic Desktop sync is off; kept ${result.baseSkills.length} base skills current.`,
+    renderHuman: () => failures.length ? `Skill sync needs attention: ${failures.map((failure) => `${failure.name}: ${failure.error}`).join("; ")}` : result.syncEnabled ? `Skills synced. Base skills current: ${result.baseSkills.join(", ")}.` : `Automatic Desktop sync is off. Base skills remain current: ${result.baseSkills.join(", ")}.`
   });
 }
 var skillsCommandSpecs = [
@@ -19990,7 +20089,7 @@ async function reportCliCommand({
 // src/cli.js
 function readCliVersion() {
   try {
-    const manifestPath = join19(dirname18(fileURLToPath10(import.meta.url)), "..", "package.json");
+    const manifestPath = join19(dirname18(fileURLToPath11(import.meta.url)), "..", "package.json");
     const version = JSON.parse(readFileSync21(manifestPath, "utf-8")).version;
     if (typeof version === "string" && version.trim()) {
       return version.trim();