@notis_ai/cli 0.2.0-beta.156.1 → 0.2.0-beta.158.1

package/src/runtime/app-test-server.js

@@ -0,0 +1,292 @@
+/** Temporary, explicit app verification/screenshot server. Never mounts a Workspace app. */
+import { createServer } from 'node:http';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { exportNameFromPath, getBundleDir, loadAppConfig, readManifest } from './app-platform.js';
+
+const CONTENT_TYPES = { '.js': 'application/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.map': 'application/json; charset=utf-8' };
+const CLI_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const REPO_ROOT = resolve(CLI_ROOT, '../..');
+const HARNESS_TEMPLATE_PATH = join(CLI_ROOT, 'template', '.harness', 'index.html.tmpl');
+const FALLBACK_REACT_VERSION = '19.0.0';
+
+function extFor(pathname) {
+  const idx = pathname.lastIndexOf('.');
+  return idx === -1 ? '' : pathname.slice(idx);
+}
+
+function isAllowedOrigin(origin) {
+  if (!origin) return true;
+  try {
+    const parsed = new URL(origin);
+    if (parsed.protocol === 'notis-app:') return true;
+    if (!['http:', 'https:'].includes(parsed.protocol)) return false;
+    return ['localhost', '127.0.0.1', '::1', '[::1]'].includes(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+function corsHeaders(origin) {
+  const allowOrigin = origin && isAllowedOrigin(origin) ? origin : '*';
+  return {
+    'Access-Control-Allow-Origin': allowOrigin,
+    'Access-Control-Allow-Methods': 'GET, HEAD, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Cache-Control',
+    'Cache-Control': 'no-store',
+  };
+}
+
+function safeJoin(baseDir, relPath) {
+  const normalized = relPath.replace(/\\/g, '/').replace(/^\/+/, '');
+  if (normalized.includes('..')) return null;
+  return join(baseDir, normalized);
+}
+
+function scriptJson(value) {
+  return JSON.stringify(value)
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029');
+}
+
+function readJsonFile(path) {
+  if (!existsSync(path)) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(path, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function reactVersionFromPeer(peerRange) {
+  if (typeof peerRange !== 'string' || !peerRange) {
+    return FALLBACK_REACT_VERSION;
+  }
+  const exact = peerRange.match(/\d+\.\d+\.\d+/);
+  if (exact && !/[<>=~^*x]/i.test(peerRange.replace(exact[0], ''))) {
+    return exact[0];
+  }
+  if (peerRange.includes('19') || peerRange.includes('18')) {
+    return FALLBACK_REACT_VERSION;
+  }
+  return FALLBACK_REACT_VERSION;
+}
+
+function resolveHarnessReactVersion(projectDir) {
+  const candidates = [
+    join(projectDir, 'node_modules', '@notis', 'sdk', 'package.json'),
+    join(REPO_ROOT, 'packages', 'sdk', 'package.json'),
+    join(CLI_ROOT, 'template', 'packages', 'sdk', 'package.json'),
+  ];
+  for (const candidate of candidates) {
+    const pkg = readJsonFile(candidate);
+    const peer = pkg?.peerDependencies?.react;
+    if (peer) {
+      return reactVersionFromPeer(peer);
+    }
+  }
+  return FALLBACK_REACT_VERSION;
+}
+
+function titleFromSlug(slug) {
+  return String(slug || '')
+    .replace(/[-_]+/g, ' ')
+    .replace(/\b\w/g, (char) => char.toUpperCase());
+}
+
+function normalizeDatabaseDescriptors(databases) {
+  return (Array.isArray(databases) ? databases : [])
+    .map((entry) => {
+      if (typeof entry === 'string') {
+        return {
+          slug: entry,
+          title: titleFromSlug(entry),
+          description: null,
+          icon: null,
+          properties: [],
+        };
+      }
+      if (entry && typeof entry === 'object' && typeof entry.slug === 'string') {
+        return {
+          slug: entry.slug,
+          title: entry.title || titleFromSlug(entry.slug),
+          description: entry.description || null,
+          icon: entry.icon || null,
+          properties: Array.isArray(entry.properties) ? entry.properties : [],
+        };
+      }
+      return null;
+    })
+    .filter(Boolean);
+}
+
+function normalizeToolDescriptors(tools) {
+  return (Array.isArray(tools) ? tools : [])
+    .map((entry) => {
+      if (typeof entry === 'string') {
+        return { name: entry };
+      }
+      if (entry && typeof entry === 'object' && typeof entry.name === 'string') {
+        return entry;
+      }
+      return null;
+    })
+    .filter(Boolean);
+}
+
+function defaultRouteForManifest(manifest) {
+  const routes = Array.isArray(manifest?.routes) ? manifest.routes : [];
+  return routes.find((route) => route?.default) || routes[0] || null;
+}
+
+function findHarnessRoute(manifest, routeSlug) {
+  const routes = Array.isArray(manifest?.routes) ? manifest.routes : [];
+  if (!routeSlug) {
+    return defaultRouteForManifest(manifest);
+  }
+  return routes.find((route) => route?.slug === routeSlug) || null;
+}
+
+function buildHarnessDescriptor({ state, manifest, appConfig, route, scenario = null }) {
+  const databases = normalizeDatabaseDescriptors(
+    Array.isArray(appConfig?.databases) && appConfig.databases.length
+      ? appConfig.databases
+      : manifest.databases,
+  );
+  const tools = normalizeToolDescriptors(
+    Array.isArray(appConfig?.tools) && appConfig.tools.length
+      ? appConfig.tools
+      : manifest.tools,
+  );
+
+  return {
+    app: {
+      id: state.appId || 'harness-app',
+      slug: state.slug,
+      name: manifest.app?.name || appConfig?.name || state.slug,
+      icon: manifest.app?.icon || appConfig?.icon || null,
+      description: manifest.app?.description || appConfig?.description || null,
+    },
+    route: {
+      slug: route.slug,
+      path: route.path || '/',
+      name: route.name || titleFromSlug(route.slug),
+      icon: route.icon || null,
+      parentSlug: route.parentSlug || null,
+      default: Boolean(route.default),
+      resourceDeepLinks: route.resourceDeepLinks === true,
+      collection: route.collection || null,
+    },
+    databases,
+    context: { collectionItem: null, resourceId: null, screenshotScenario: scenario },
+    tools,
+  };
+}
+
+function plainObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+/**
+ * Resolve the fixture payload injected into one harness page load.
+ *
+ * A scenario may override individual `tools` / `requests` keys on top of the
+ * file-level defaults, which is how one route renders both its populated and
+ * its empty state. Each capture is its own page load, so a shallow per-key
+ * merge is all the isolation a scenario needs.
+ */
+function harnessFixtures(projectDir, scenario) {
+  const fixtureConfig = readJsonFile(join(projectDir, 'metadata', 'screenshot-fixtures.json')) || {};
+  const scenarios = plainObject(fixtureConfig.scenarios);
+  const selected = scenario ? plainObject(scenarios[scenario]) : null;
+  return {
+    tools: { ...plainObject(fixtureConfig.tools), ...plainObject(selected?.tools) },
+    requests: { ...plainObject(fixtureConfig.requests), ...plainObject(selected?.requests) },
+    scenario: selected && Object.keys(selected).length > 0 ? selected : null,
+  };
+}
+
+function renderHarnessHtml({ state, manifest, appConfig, route, harnessOptions, scenario = null }) {
+  const template = readFileSync(HARNESS_TEMPLATE_PATH, 'utf-8');
+  const descriptor = buildHarnessDescriptor({ state, manifest, appConfig, route, scenario });
+  const routeExport = route.export_name || route.exportName || exportNameFromPath(route.path || '/');
+  const replacements = {
+    '{{REACT_VERSION}}': resolveHarnessReactVersion(state.projectDir),
+    '{{ROUTE_EXPORT}}': scriptJson(routeExport),
+    '{{RUNTIME_DESCRIPTOR}}': scriptJson(descriptor),
+    '{{MODE}}': scriptJson(harnessOptions.mode || 'stub'),
+    '{{API_BASE}}': scriptJson(harnessOptions.apiBase || null),
+    '{{JWT}}': scriptJson(harnessOptions.jwt || null),
+    '{{FIXTURES}}': scriptJson(harnessFixtures(state.projectDir, scenario)),
+  };
+  let html = template;
+  for (const [token, value] of Object.entries(replacements)) {
+    html = html.replaceAll(token, value);
+  }
+  return html;
+}
+
+
+/** Serve only explicitly supplied built projects, without discovery or filesystem watchers. */
+export async function startAppTestServer({ apps, port, harness = {} }) {
+  if (!Array.isArray(apps) || !apps.length) throw new Error('At least one built app is required.');
+  const states = new Map();
+  for (const app of apps) {
+    states.set(app.slug, {
+      ...app,
+      manifest: readManifest(app.projectDir),
+      appConfig: await loadAppConfig(app.projectDir),
+      bundleDir: getBundleDir(app.projectDir),
+    });
+  }
+  const server = createServer((req, res) => {
+    const headers = corsHeaders(req.headers.origin || '');
+    const respond = (status, content, contentType = 'text/plain; charset=utf-8') => {
+      res.writeHead(status, { ...headers, 'Content-Type': contentType });
+      res.end(req.method === 'HEAD' ? undefined : content);
+    };
+    try {
+      if (req.headers.origin && !isAllowedOrigin(req.headers.origin)) return respond(403, 'origin not allowed');
+      if (req.method === 'OPTIONS') return respond(204, '');
+      if (!['GET', 'HEAD'].includes(req.method)) return respond(405, 'method not allowed');
+      const url = new URL(req.url || '/', 'http://127.0.0.1');
+      if (url.pathname === '/healthz') return respond(200, JSON.stringify({ ok: true }), 'application/json');
+      const match = url.pathname.match(/^\/a\/([^/]+)\/(.*)$/);
+      const state = match && states.get(decodeURIComponent(match[1]));
+      if (!state) return respond(404, 'not found');
+      if (match[2] === 'harness') {
+        const route = findHarnessRoute(state.manifest, url.searchParams.get('route') || '');
+        if (!route) return respond(404, 'unknown route');
+        return respond(200, renderHarnessHtml({ state, manifest: state.manifest, appConfig: state.appConfig, route, harnessOptions: harness, scenario: url.searchParams.get('scenario') }), 'text/html; charset=utf-8');
+      }
+      if (match[2].startsWith('bundle/')) {
+        const relativePath = decodeURIComponent(match[2].slice('bundle/'.length));
+        const file = safeJoin(state.bundleDir, relativePath);
+        if (!file || !existsSync(file) || !statSync(file).isFile()) return respond(404, 'not found');
+        return respond(200, readFileSync(file), CONTENT_TYPES[extFor(file)] || 'application/octet-stream');
+      }
+      return respond(404, 'not found');
+    } catch (error) {
+      return respond(500, error instanceof Error ? error.message : String(error));
+    }
+  });
+  await new Promise((accept, reject) => {
+    server.once('error', reject);
+    server.listen(port, '127.0.0.1', () => { server.off('error', reject); accept(); });
+  });
+  let closing;
+  return {
+    port: server.address().port,
+    close() {
+      closing ||= new Promise((accept) => {
+        server.close(accept);
+        server.closeAllConnections?.();
+      });
+      return closing;
+    },
+  };
+}

package/src/runtime/profiles.js

@@ -228,8 +228,11 @@ function processIsAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (error) {
+    // Sandboxed children may be allowed to observe the worktree lease but not
+    // signal its dev.sh supervisor. POSIX EPERM proves that the PID exists;
+    // ESRCH (and every other probe failure) does not.
+    return error?.code === 'EPERM';
   }
 }
 

package/src/runtime/skill-sync/cloud-client.ts

@@ -9,6 +9,7 @@ async function requestJson<T>(
   options: { method?: string; body?: JsonBody } = {},
 ): Promise<T> {
   const response = await fetch(url, {
+    signal: AbortSignal.timeout(90_000),
     method: options.method || 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -59,7 +60,7 @@ export async function pushChangedSkills(
 }
 
 export async function downloadSkillBundle(bundleUrl: string): Promise<Buffer> {
-  const response = await fetch(bundleUrl);
+  const response = await fetch(bundleUrl, { signal: AbortSignal.timeout(90_000) });
   if (!response.ok) {
     const text = await response.text();
     throw new Error(`GET ${bundleUrl} → ${response.status}: ${text}`);

package/src/runtime/skill-sync/index.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import type {
   AgentTargets,
   LocalSkill,
@@ -33,6 +34,7 @@ import {
 } from "./symlink-manager";
 import { getPushCandidates } from "./sync-plan";
 import { writeCloudSkillWithBundleFallback } from "./write-cloud-skill";
+export { fetchSyncSettings } from './cloud-client';
 
 export interface RunSkillSyncResult {
   syncEnabled: boolean;
@@ -147,7 +149,17 @@ function decodeJwtSubject(jwt: string): string | null {
   }
 }
 
-function shouldWriteCloudSkill(
+function cloudContentHash(skill: SyncPullResponse['skills'][number]): string {
+  return createHash('sha256').update(JSON.stringify({
+    md: skill.skill_md,
+    hash: skill.skill_folder_hash,
+    source: skill.skill_source_url,
+    files: skill.bundle_files?.slice().sort((a, b) => a.path.localeCompare(b.path)),
+    hydrationFailed: skill.bundle_hydration_failed === true,
+  })).digest('hex');
+}
+
+export function shouldWriteCloudSkill(
   cloudSkill: SyncPullResponse["skills"][number],
   localSkills: Map<string, LocalSkill>,
   previousState: NotisSyncState,
@@ -159,17 +171,20 @@ function shouldWriteCloudSkill(
     return true;
   }
 
+  const previous = previousState.skills[skillName];
+  if (previous?.folderHash === localSkill.folderHash
+    && previous.cloudContentHash === cloudContentHash(cloudSkill)) return false;
+
   if (cloudSkill.source === "curated") {
     return cloudHash ? cloudHash !== localSkill.folderHash : true;
   }
 
-  const previous = previousState.skills[skillName];
   const localChangedSinceLastSync =
     !previous || previous.folderHash !== localSkill.folderHash;
   return (
     !localChangedSinceLastSync &&
-    Boolean(cloudHash) &&
-    cloudHash !== localSkill.folderHash
+    ((Boolean(cloudHash) && cloudHash !== localSkill.folderHash)
+      || Boolean(previous?.cloudContentHash && previous.cloudContentHash !== cloudContentHash(cloudSkill)))
   );
 }
 
@@ -178,6 +193,7 @@ function buildSyncState(
   localSkills: LocalSkill[],
   lastSyncedAt: string | null,
   verifiedAgentLinks: Record<string, Partial<AgentTargets>> = {},
+  failedContentNames: ReadonlySet<string> = new Set(),
 ): NotisSyncState {
   const localSkillMap = toSkillMap(localSkills);
   const skills = Object.fromEntries(
@@ -191,6 +207,8 @@ function buildSyncState(
           agentTargets: normalizeAgentTargets(skill.agent_targets),
           verifiedAgentLinks: skill.status === "active" ? verifiedAgentLinks[skill.name] ?? {} : {},
           cloudUpdatedAt: skill.updated_at,
+          ...(!failedContentNames.has(skill.name) && !skill.skill_source_url
+            ? { cloudContentHash: cloudContentHash(skill) } : {}),
           syncedAt: lastSyncedAt || new Date().toISOString(),
         },
       ];
@@ -392,7 +410,7 @@ export async function materializeCloudSkillsForLocalShell(
   for (const failure of failedDownloads) delete verifiedLinks[failure.name];
 
   await deps.writeSyncState(
-    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks),
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks, new Set(failedDownloads.map(item => item.name))),
     syncPaths,
   );
 
@@ -629,7 +647,7 @@ export async function runSkillSync(
   const lastSyncedAt = pullResponse.last_synced_at || new Date().toISOString();
 
   await deps.writeSyncState(
-    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks),
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks, new Set(failedDownloads.map(item => item.name))),
     syncPaths,
   );
 

package/src/runtime/skill-sync/types.ts

@@ -12,6 +12,8 @@ export interface SyncedSkill {
   /** Actual readable managed links, never inferred from desired targets. */
   verifiedAgentLinks?: Partial<AgentTargets>;
   cloudUpdatedAt?: string;
+  /** Content accepted on disk; independent of server-specific folder hash formats. */
+  cloudContentHash?: string;
   syncedAt: string;
 }
 

package/src/runtime/skill-sync-service.js

@@ -0,0 +1,109 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isValidProfileName, loadConfig } from './profiles.js';
+import { withSkillSyncLock } from './sync-skills.js';
+
+export const SKILL_SYNC_SERVICE_LABEL = 'ai.notis.skills-sync';
+const bundlePath = fileURLToPath(new URL('../../dist/skill-sync-worker.mjs', import.meta.url));
+
+function atomicWrite(target, value, mode = 0o600) {
+  mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+  const temporary = `${target}.${process.pid}.tmp`;
+  writeFileSync(temporary, value, { mode });
+  renameSync(temporary, target);
+}
+
+function xml(value) {
+  return String(value).replaceAll('&', '&amp;').replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&apos;');
+}
+
+export async function maybeInstallSkillSyncService(runtime, {
+  config = loadConfig(), install = installSkillSyncService,
+  fetchSettings, refresh,
+} = {}) {
+  if (process.platform !== 'darwin' || runtime.credentialKind !== 'oauth'
+    || config.current_profile !== runtime.profileName
+    || !['https://api.notis.ai', 'https://api-beta.notis.ai'].includes(runtime.apiBase)) return;
+  // Ordinary commands must not steal another explicitly bound account's job.
+  const plist = join(homedir(), 'Library', 'LaunchAgents', `${SKILL_SYNC_SERVICE_LABEL}.plist`);
+  if (existsSync(plist)) {
+    const saved = readFileSync(plist, 'utf8');
+    if (runtime.oauthUserId && [runtime.profileName, runtime.apiBase, runtime.oauthUserId]
+      .every(value => saved.includes(`<string>${xml(value)}</string>`))) return install(runtime);
+    return;
+  }
+  const refreshCredential = refresh || (await import('./oauth.js')).ensureFreshOAuthCredential;
+  await refreshCredential(runtime);
+  const getSettings = fetchSettings || (await import('../../dist/skill-sync/index.js')).fetchSyncSettings;
+  const settings = await getSettings(runtime.apiBase, runtime.jwt);
+  if (settings.sync_enabled && settings.user_id === runtime.oauthUserId) return install(runtime);
+}
+
+export async function installSkillSyncService(runtime, options = {}) {
+  if ((options.platform || process.platform) !== 'darwin') return { status: 'unsupported_platform' };
+  if (runtime.credentialKind !== 'oauth' || !runtime.oauthUserId
+    || !['https://api.notis.ai', 'https://api-beta.notis.ai'].includes(runtime.apiBase)) {
+    return { status: 'skipped_non_personal_profile' };
+  }
+  // Registration upgrades must not kill a worker holding the filesystem lock,
+  // nor race another CLI registering the same LaunchAgent.
+  return withSkillSyncLock(() => installSkillSyncServiceLocked(runtime, options),
+    options.home ? { home: options.home } : {});
+}
+
+async function installSkillSyncServiceLocked(runtime, {
+  home = homedir(), platform = process.platform, nodePath = process.execPath,
+  source = bundlePath, run = spawnSync, uid = process.getuid?.(),
+} = {}) {
+  // A single explicitly selected personal account owns global agent folders.
+  // Development and hosted credentials must never enroll a machine-wide job.
+  if (platform !== 'darwin') return { status: 'unsupported_platform' };
+  if (runtime.credentialKind !== 'oauth' || runtime.envCredentialOverride
+    || !isValidProfileName(runtime.profileName)
+    || !['https://api.notis.ai', 'https://api-beta.notis.ai'].includes(runtime.apiBase)) {
+    return { status: 'skipped_non_personal_profile' };
+  }
+  const root = join(home, '.notis', 'skills', 'service');
+  const bundle = readFileSync(source);
+  const digest = createHash('sha256').update(bundle).digest('hex');
+  const installedBundle = join(root, 'runtime', digest, 'worker.mjs');
+  if (!existsSync(installedBundle)
+    || !readFileSync(installedBundle).equals(bundle)) atomicWrite(installedBundle, bundle, 0o500);
+  const args = [nodePath, installedBundle, runtime.profileName, runtime.apiBase, runtime.oauthUserId];
+  if (!runtime.oauthUserId) return { status: 'skipped_missing_account' };
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>${SKILL_SYNC_SERVICE_LABEL}</string>
+<key>ProgramArguments</key><array>${args.map(value => `<string>${xml(value)}</string>`).join('')}</array>
+<key>WorkingDirectory</key><string>${xml(root)}</string>
+<key>StartInterval</key><integer>60</integer>
+<key>ProcessType</key><string>Background</string>
+</dict></plist>
+`;
+  const plistPath = join(home, 'Library', 'LaunchAgents', `${SKILL_SYNC_SERVICE_LABEL}.plist`);
+  const domain = `gui/${uid}`;
+  const target = `${domain}/${SKILL_SYNC_SERVICE_LABEL}`;
+  const unchanged = existsSync(plistPath) && readFileSync(plistPath, 'utf8') === plist;
+  const loaded = run('/bin/launchctl', ['print', target], { encoding: 'utf8', timeout: 5000 });
+  if (unchanged && loaded.status === 0) return { status: 'installed', intervalSeconds: 60, profile: runtime.profileName };
+  if (loaded.status === 0) {
+    const stopped = run('/bin/launchctl', ['bootout', target], { encoding: 'utf8', timeout: 5000 });
+    if (stopped.status !== 0) throw new Error('Could not update the existing automatic skill sync job');
+  }
+  atomicWrite(plistPath, plist);
+  let started;
+  // launchd may finish tearing down an old registration after bootout returns.
+  for (let attempt = 0; attempt < 10; attempt++) {
+    started = run('/bin/launchctl', ['bootstrap', domain, plistPath], { encoding: 'utf8', timeout: 5000 });
+    if (started.status === 0) break;
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+  if (started?.status !== 0) throw new Error('Could not register automatic skill sync with macOS');
+  return { status: 'installed', intervalSeconds: 60, profile: runtime.profileName };
+}

package/src/skill-sync-worker-entry.js

@@ -0,0 +1,2 @@
+import { main } from './skill-sync-worker.js';
+await main();

package/src/skill-sync-worker.js

@@ -0,0 +1,50 @@
+import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveRuntimeProfile } from './runtime/profiles.js';
+import { ensureFreshOAuthCredential } from './runtime/oauth.js';
+import { runSkillSync, fetchSyncSettings } from '../dist/skill-sync/index.js';
+import { withSkillSyncLock } from './runtime/sync-skills.js';
+
+export async function runAutomaticSkillSync({ profile, apiBase, userId }, {
+  resolveRuntime = resolveRuntimeProfile, refresh = ensureFreshOAuthCredential,
+  settings = fetchSyncSettings, sync = runSkillSync, lock = withSkillSyncLock,
+} = {}) {
+  const runtime = resolveRuntime({ profile }, { requireAuth: true });
+  if (runtime.credentialKind !== 'oauth' || runtime.apiBase !== apiBase
+    || runtime.oauthUserId !== userId) throw new Error('Automatic skill sync account changed; run notis skills sync to rebind');
+  await refresh(runtime);
+  const saved = await settings(runtime.apiBase, runtime.jwt);
+  if (saved.user_id !== userId) throw new Error('Automatic skill sync identity mismatch');
+  // Do not gather, unlink foreign accounts or write anything when opted out.
+  if (!saved.sync_enabled) return { status: 'disabled' };
+  const result = await lock(() => sync(runtime.apiBase, runtime.jwt, {
+    fetchSyncSettings: async () => saved,
+  }, { honorSyncEnabled: true }));
+  return { status: (result.failedLinks?.length || result.failedPushes?.length) ? 'partial' : 'synced', ...result };
+}
+
+export async function main(args = process.argv.slice(2)) {
+  const [profile, apiBase, userId] = args;
+  const root = join(homedir(), '.notis', 'skills', 'service');
+  const record = (value) => {
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const target = join(root, 'status.json');
+    const temporary = `${target}.${process.pid}.tmp`;
+    writeFileSync(temporary, JSON.stringify({ ...value, profile, at: new Date().toISOString() }, null, 2), { mode: 0o600 });
+    renameSync(temporary, target);
+  };
+  const deadline = setTimeout(() => {
+    record({ status: 'error', code: 'sync_timeout' });
+    process.exit(1);
+  }, 240_000);
+  try {
+    record(await runAutomaticSkillSync({ profile, apiBase, userId }));
+  } catch (error) {
+    // Persist only a classified error, never a bearer, signed URL or response body.
+    record({ status: 'error', code: error.code || 'sync_failed' });
+    process.exitCode = 1;
+  } finally {
+    clearTimeout(deadline);
+  }
+}