@notis_ai/cli 0.2.0-beta.178.1 → 0.2.0-beta.1792022492092.1

package/src/command-specs/tools.js

@@ -2,7 +2,6 @@ import { accessSync, constants as fsConstants, createReadStream, existsSync, rea
 import { createHash } from 'node:crypto';
 import { basename } from 'node:path';
 import { usageError } from '../runtime/errors.js';
-import { assertToolNotDelegated } from '../runtime/delegated-context.js';
 import {
   COMPOSIO_GET_TOOL_SCHEMAS,
   COMPOSIO_MULTI_EXECUTE_TOOL,
@@ -386,9 +385,6 @@ async function toolsDescribeHandler(ctx) {
 
 async function toolsExecHandler(ctx) {
   const requestedToolName = localNotisToolSlug(ctx.args.toolName);
-  // `tools exec` is the escape hatch around every first-class command, so the
-  // hand-over guard has to live here too or it guards nothing.
-  assertToolNotDelegated(requestedToolName);
   let targetMutating = classifyToolMutation(requestedToolName);
   ensureLongRunningToolTimeout(ctx, requestedToolName);
   ctx.output.emitProgress({
@@ -504,8 +500,6 @@ async function toolsExecParallelHandler(ctx) {
     if (!call.tool_name || typeof call.tool_name !== 'string') {
       throw usageError(`calls[${i}] missing required "tool_name" string`);
     }
-    // A batch is just as good an escape hatch as a single exec.
-    assertToolNotDelegated(localNotisToolSlug(call.tool_name));
   }
   ensureLongRunningToolTimeout(ctx, calls.map((call) => localNotisToolSlug(call.tool_name)));
 

package/src/command-specs/views.js

@@ -0,0 +1,69 @@
+import { httpRequest } from '../runtime/transport.js';
+import { usageError } from '../runtime/errors.js';
+import { renderViewWithCliRuntime } from '../runtime/view-render.js';
+import { resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export function viewRenderCommandSpec({ screenshotOnly = false } = {}) {
+  const command_path = screenshotOnly ? ['spaces', 'screenshot'] : ['views', 'render'];
+  return {
+    command_path, summary: screenshotOnly ? 'Capture a full-height PNG of a live view with your current access.' : 'Render a live view as Markdown and a full-height PNG with your current access.',
+    when_to_use: 'Check the actual deployed view; writes are blocked and current access is checked again before any output is saved.',
+    args_schema: { arguments: [{ token: '<url>', key: 'url', description: 'Current view-qualified or record link.' }], options: [
+      ...(!screenshotOnly ? [{ flags: '--outputs <kinds>', description: 'Comma-separated markdown,screenshot (default both).' }] : []),
+      { flags: '--width <pixels>', description: '1440 (default) or 390.' },
+      { flags: '--output-dir <path>', description: 'New output directory; defaults to a unique .notis/renders directory. Existing files are never overwritten.' },
+    ] }, examples: [screenshotOnly ? 'notis spaces screenshot <view-link> --width 390' : 'notis views render <view-link> --outputs markdown,screenshot'],
+    mutates: false, idempotent: true, require_auth: true,
+    backend_call: { type: 'http', path: '/portal_view_render/prepare' },
+    async handler(ctx) {
+      const outputs = screenshotOnly ? ['screenshot'] : (ctx.options.outputs || 'markdown,screenshot').split(',');
+      if (!outputs.length || new Set(outputs).size !== outputs.length || outputs.some(value => !['markdown', 'screenshot'].includes(value))) {
+        throw usageError('Choose markdown, screenshot, or markdown,screenshot.');
+      }
+      const width = ctx.options.width === undefined ? 1440 : Number(ctx.options.width);
+      const directory = resolve(ctx.options.outputDir || `.notis/renders/${randomUUID()}`);
+      const controller = new AbortController(), cancel = () => controller.abort();
+      process.once('SIGINT', cancel); process.once('SIGTERM', cancel);
+      try {
+        const { result, artifacts } = await renderViewWithCliRuntime({ runtime: ctx.runtime,
+          url: ctx.args.url, outputs, width, directory, signal: controller.signal });
+        const data = { ...result, artifacts };
+        if (data.screenshot) {
+          const { data_base64: _bytes, ...metadata } = data.screenshot;
+          data.screenshot = { ...metadata, path: artifacts.screenshot };
+        }
+        return ctx.output.emitSuccess({ command: command_path.join(' '), data,
+          humanSummary: `Rendered ${result.url}. Saved ${Object.values(artifacts).join(' and ')}.`, meta: { mutating: false } });
+      } finally { process.removeListener('SIGINT', cancel); process.removeListener('SIGTERM', cancel); }
+    },
+  };
+}
+
+export const viewsCommandSpecs = [{
+  command_path: ['views', 'find'],
+  summary: 'Find the views you can open for a record, database, view link, Space or search.',
+  when_to_use: 'Get fresh view-qualified links and declared URL parameters before citing or opening a view.',
+  args_schema: { options: [
+    { flags: '--record-key <id>', description: 'Find views that show this exact native record.' },
+    { flags: '--database-id <id>', description: 'Find views over this database.' },
+    { flags: '--url <url>', description: 'Resolve this view link and its current parameters.' },
+    { flags: '--space-id <id>', description: 'Describe this Space view.' },
+    { flags: '--query <text>', description: 'Search accessible view names, descriptions and readable context.' },
+  ] },
+  examples: ['notis views find --record-key <record-key>', 'notis views find --url <view-link>', 'notis views find --query inbox'],
+  mutates: false, idempotent: true, require_auth: true,
+  backend_call: { type: 'http', path: '/portal_spaces/find-views' },
+  async handler(ctx) {
+    const options = { record_key: ctx.options.recordKey, database_id: ctx.options.databaseId,
+      url: ctx.options.url, space_id: ctx.options.spaceId, query: ctx.options.query };
+    const selected = Object.entries(options).filter(([, value]) => value !== undefined);
+    if (selected.length !== 1 || typeof selected[0][1] !== 'string' || !selected[0][1].trim()) {
+      throw usageError('Choose exactly one of --record-key, --database-id, --url, --space-id or --query.');
+    }
+    const result = await httpRequest({ runtime: ctx.runtime, method: 'POST', path: '/portal_spaces/find-views',
+      body: Object.fromEntries(selected), spacesProtocol: 1 });
+    return ctx.output.emitSuccess({ command: 'views find', data: result.payload,
+      humanSummary: JSON.stringify(result.payload, null, 2), meta: { mutating: false, request_id: result.requestId } });
+  },
+}, viewRenderCommandSpec()];

package/src/runtime/agent-browser.js

@@ -1,19 +1,15 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
-
-export const HIDE_HARNESS_STATUS_SCRIPT =
-  "(() => { const el = document.getElementById('harness-status'); if (el) el.style.opacity = '0'; return true; })()";
+import { contentCapturePlan, MEASURE_SCREENSHOT_CONTENT_SCRIPT, SAFE_VIEWPORT_HEIGHT_SCRIPT } from './screenshot-framing.js';
 
 /**
- * Prepare the mounted harness page for a listing capture: remove the debug
- * banner and the layout the harness adds around the app (top padding for the
- * banner, 100vh min-height) so content height can be measured and framed
- * without artificial whitespace.
+ * Prepare the mounted harness page for a listing capture: remove the 100vh
+ * min-height the harness adds around the app so content height can be
+ * measured and framed without artificial whitespace.
  */
 const PREPARE_CAPTURE_SCRIPT =
-  "(() => { const s = document.getElementById('harness-status'); if (s) s.style.display = 'none';" +
-  " const r = document.getElementById('root'); if (r) { r.style.paddingTop = '0'; r.style.minHeight = '0'; }" +
+  "(() => { const r = document.getElementById('root'); if (r) r.style.minHeight = '0';" +
   " document.body.style.minHeight = '0'; document.documentElement.style.minHeight = '0'; return true; })()";
 
 const FONTS_STATUS_SCRIPT =
@@ -135,9 +131,11 @@ function runAgentBrowser(args, { timeoutMs = 30_000 } = {}) {
     let stdout = '';
     let stderr = '';
     let timedOut = false;
+    let hardStop;
     const timer = setTimeout(() => {
       timedOut = true;
       child.kill('SIGTERM');
+      hardStop = setTimeout(() => child.kill('SIGKILL'), 2000);
     }, timeoutMs);
 
     child.stdout.on('data', (chunk) => {
@@ -147,7 +145,7 @@ function runAgentBrowser(args, { timeoutMs = 30_000 } = {}) {
       stderr += chunk.toString();
     });
     child.on('error', (error) => {
-      clearTimeout(timer);
+      clearTimeout(timer); clearTimeout(hardStop);
       resolvePromise({
         exitCode: 1,
         stdout,
@@ -156,7 +154,7 @@ function runAgentBrowser(args, { timeoutMs = 30_000 } = {}) {
       });
     });
     child.on('close', (code) => {
-      clearTimeout(timer);
+      clearTimeout(timer); clearTimeout(hardStop);
       resolvePromise({
         exitCode: timedOut ? 124 : (code ?? 1),
         stdout,
@@ -229,10 +227,17 @@ export async function runHarnessRoute({
   snapshotPath = null,
   designViewports = DEFAULT_DESIGN_VIEWPORTS,
   waitForRuntime = false,
+  signal,
 }) {
+  const cancelled = () => ({ mounted: false, renderStarted: false, runtimeCalls: [],
+    errors: [{ phase: 'browser', message: 'Verification cancelled.' }], snapshotPath: null, tool_error: null });
+  if (signal?.aborted) return cancelled();
   const opened = await runAgentBrowser(['--session', sessionName, 'open', url], {
     timeoutMs: Math.min(Math.max(timeoutMs, 5000), 30_000),
   });
+  // Let an in-flight open settle before the owner closes its browser. Closing
+  // concurrently with open can leave a newly launched browser behind.
+  if (signal?.aborted) return cancelled();
   if (opened.exitCode !== 0) {
     return {
       mounted: false,
@@ -246,7 +251,7 @@ export async function runHarnessRoute({
 
   const deadline = Date.now() + timeoutMs;
   let readySince = null;
-  while (Date.now() < deadline) {
+  while (Date.now() < deadline && !signal?.aborted) {
     const lastRead = await readHarness(sessionName, 5000);
     if (!lastRead.ok) {
       readySince = null;
@@ -263,6 +268,8 @@ export async function runHarnessRoute({
     await delay(250);
   }
 
+  if (signal?.aborted) return cancelled();
+
   const finalRead = await readHarness(sessionName, 5000);
   if (!finalRead.ok) {
     return {
@@ -322,18 +329,18 @@ export async function runHarnessRoute({
 
 /**
  * Open a harness route, wait for it to mount, then capture a PNG screenshot of
- * the rendered app. Output is always exactly `width` x `height` physical
- * pixels (default 2000x1250, the 16:10 the listing validator expects), but the
- * CSS viewport is fitted to the rendered content height: short pages render
- * larger (no dead whitespace below the app), tall pages get more room before
- * cropping. The deviceScaleFactor maps the fitted CSS viewport back onto the
- * fixed output frame. Used by `notis apps screenshot`.
+ * the rendered app. Raw captures retain exact requested pixel dimensions.
+ * Framed captures can select the complete bounded app or a width-fitted first
+ * screen; the Store compositor normalizes them to the final listing size.
+ * Device scaling keeps text sharp at that size without changing app styles.
+ * Used by `notis apps screenshot`.
  */
 export async function captureHarnessScreenshot({
   url,
   sessionName,
   screenshotPath,
   focusSelector = null,
+  frameContent = false,
   width = 2000,
   height = 1250,
   timeoutMs = 15_000,
@@ -433,13 +440,50 @@ export async function captureHarnessScreenshot({
 
   // Let the route settle (async data, resize transitions) before the capture.
   await delay(500);
+
+  let contentBounds = null;
+  if (frameContent && !focusSelector) {
+    const measured = await runAgentBrowser(
+      ['--session', sessionName, '--json', 'eval', MEASURE_SCREENSHOT_CONTENT_SCRIPT],
+      { timeoutMs: 5000 },
+    );
+    if (measured.exitCode === 0) {
+      try {
+        const bounds = parseHarnessFromEval(measured.stdout);
+        if (bounds?.selector === '[data-notis-screenshot-content]'
+          && Number.isFinite(bounds.width) && bounds.width > 0
+          && Number.isFinite(bounds.height) && bounds.height > 0) {
+          contentBounds = bounds;
+        }
+      } catch { /* Keep the complete viewport if layout measurement is unavailable. */ }
+    }
+  }
+  let captureFocus = focusSelector || contentBounds?.selector || null;
+  if (contentBounds && scaledViewport) {
+    const plan = contentCapturePlan(contentBounds, framing || initial, width, height);
+    if (await setViewport(sessionName, plan.width, plan.height, plan.scale)) {
+      await delay(300);
+      if (!plan.focus) {
+        const safeHeight = await evalNumber(sessionName, SAFE_VIEWPORT_HEIGHT_SCRIPT, plan.height);
+        if (safeHeight < plan.height && await setViewport(sessionName, plan.width, safeHeight, plan.scale)) {
+          plan.height = safeHeight;
+        }
+      }
+      captureFocus = plan.focus ? contentBounds.selector : null;
+      framing = {
+        ...(framing || {}), ...plan, content_bounds: contentBounds,
+        capture_mode: plan.focus ? 'content' : 'width-fit-viewport',
+      };
+      await delay(300);
+    }
+  }
   const designResult = await evalDesignAssertions(sessionName, { viewport: 'capture' });
   const design = Array.isArray(designResult) ? designResult : [];
 
   mkdirSync(dirname(screenshotPath), { recursive: true });
   const screenshotArgs = ['--session', sessionName, 'screenshot'];
-  if (focusSelector) {
-    screenshotArgs.push(focusSelector);
+  if (captureFocus) {
+    screenshotArgs.push(captureFocus);
   }
   screenshotArgs.push(screenshotPath, '--screenshot-format', 'png');
   const shot = await runAgentBrowser(screenshotArgs, { timeoutMs: 15_000 });
@@ -451,7 +495,13 @@ export async function captureHarnessScreenshot({
   // capture came out wrong (e.g. the browser ignored the scale factor),
   // recapture once at a plain fixed viewport.
   const dimensions = pngDimensions(screenshotPath);
-  if (!focusSelector && framing && (!dimensions || dimensions.width !== width || dimensions.height !== height)) {
+  const expectedDimensions = framing?.capture_mode === 'width-fit-viewport'
+    ? { width: Math.round(framing.width * framing.scale), height: Math.round(framing.height * framing.scale) }
+    : { width, height };
+  // Fractional browser scaling can round one pixel either way. Framed output
+  // is normalized by the compositor; raw captures still require exact pixels.
+  const tolerance = frameContent ? 1 : 0;
+  if (!captureFocus && framing && (!dimensions || Math.abs(dimensions.width - expectedDimensions.width) > tolerance || Math.abs(dimensions.height - expectedDimensions.height) > tolerance)) {
     await setViewport(sessionName, width, height);
     await delay(300);
     const retry = await runAgentBrowser(
@@ -464,10 +514,11 @@ export async function captureHarnessScreenshot({
     framing = null;
   }
 
-  if (focusSelector) {
+  if (captureFocus) {
     framing = {
       ...(framing || {}),
-      focus_selector: focusSelector,
+      focus_selector: captureFocus,
+      content_bounds: contentBounds,
       source_dimensions: dimensions,
     };
   }
@@ -485,10 +536,22 @@ export async function captureHarnessScreenshot({
 }
 
 export async function closeAgentBrowserSession(sessionName) {
-  const result = await runAgentBrowser(['--session', sessionName, 'close'], {
-    timeoutMs: 5000,
-  });
-  return result.exitCode === 0;
+  return (await closeAgentBrowserSessionResult(sessionName)).ok;
+}
+
+export async function closeAgentBrowserSessionResult(sessionName) {
+  const started = Date.now();
+  // agent-browser waits up to 30s for CDP Browser.close and then up to 5s
+  // for its owned Chrome process. Do not kill the client at the start of the
+  // provider's shutdown grace period and lose its actual close acknowledgement.
+  const result = await runAgentBrowser(['--session', sessionName, '--json', 'close'], { timeoutMs: 40_000 });
+  let acknowledged = false;
+  try {
+    const reply = parseAgentBrowserJson(result.stdout);
+    acknowledged = reply?.success === true && reply?.data?.closed === true;
+  } catch { /* Missing acknowledgement is a failed cleanup, never a pass. */ }
+  return { ok: result.exitCode === 0 && acknowledged, exit_code: result.exitCode,
+    timed_out: Boolean(result.timedOut), duration_ms: Date.now() - started };
 }
 
 // ---------------------------------------------------------------------------
@@ -538,7 +601,7 @@ export const DESIGN_ASSERTIONS_SCRIPT = `(() => {
   };
   const all = Array.from(root.querySelectorAll('*'));
   for (const el of all) {
-    if (el.id === 'harness-status' || !visible(el) || isControl(el)) continue;
+    if (!visible(el) || isControl(el)) continue;
     if (isBox(el)) {
       let p = el.parentElement; let depth = 0;
       while (p && p !== root && depth < 6) { if (!isControl(p) && isBox(p)) { push('nested_border_box', el); break; } p = p.parentElement; depth += 1; }
@@ -555,7 +618,7 @@ export const DESIGN_ASSERTIONS_SCRIPT = `(() => {
     const text = (node.textContent || '').trim();
     if (!text) continue;
     const el = node.parentElement;
-    if (!el || el.closest('#harness-status') || !visible(el)) continue;
+    if (!el || !visible(el)) continue;
     const size = parseFloat(getComputedStyle(el).fontSize);
     if (size > 0 && size < 12) push('text_below_12px', el, { font_size: size });
     if (/^Loading(\\.{3}|\\u2026)?(\\s|$)/.test(text)) push('loading_placeholder_after_mount', el);

package/src/runtime/app-boundary-validator.js

@@ -3,6 +3,7 @@ import { dirname, extname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { usageError } from './errors.js';
+import { maskSerializedJsonData } from './app-data-literals.js';
 
 const moduleDir = dirname(fileURLToPath(import.meta.url));
 
@@ -136,7 +137,7 @@ function validateTextFile(relPath, content) {
     return applyRules(content, rules.css, relPath);
   }
   if (extension === '.js' || extension === '.jsx' || extension === '.ts' || extension === '.tsx') {
-    return applyRules(content, rules.javascript, relPath);
+    return applyRules(maskSerializedJsonData(content, extension), rules.javascript, relPath);
   }
   return [];
 }
@@ -311,7 +312,9 @@ export function collectDesignViolationsForFile(relPath, content, config = getCom
   if (!matchesAny(normalized, config.include)) return [];
   if (matchesAny(normalized, config.exclude)) return [];
 
-  const lines = content.split('\n');
+  const checked = ['.js', '.jsx', '.ts', '.tsx'].includes(extname(normalized))
+    ? maskSerializedJsonData(content, extname(normalized)) : content;
+  const lines = checked.split('\n');
   const violations = [];
   for (const rule of config.rules) {
     if (rule.include && !matchesAny(normalized, rule.include)) continue;
@@ -319,12 +322,12 @@ export function collectDesignViolationsForFile(relPath, content, config = getCom
 
     const matches = [];
     if (rule.scope === 'file') {
-      const match = rule.regex.exec(content);
+      const match = rule.regex.exec(checked);
       if (match) matches.push(match.index);
     } else {
       rule.regex.lastIndex = 0;
       let match;
-      while ((match = rule.regex.exec(content)) !== null) {
+      while ((match = rule.regex.exec(checked)) !== null) {
         matches.push(match.index);
         if (match[0].length === 0) rule.regex.lastIndex += 1;
       }

package/src/runtime/app-data-literals.js

@@ -0,0 +1,82 @@
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+let babelParse;
+
+function isJsonParse(node) {
+  const callee = node.callee;
+  return node.type === 'CallExpression' && callee?.type === 'MemberExpression' && !callee.computed
+    && callee.object?.type === 'Identifier' && callee.object.name === 'JSON'
+    && callee.property?.type === 'Identifier' && callee.property.name === 'parse';
+}
+
+function dataContext(ancestors) {
+  if (ancestors.some(node => node.type === 'JSXAttribute')) return false;
+  for (let index = ancestors.length - 1; index >= 0; index -= 1) {
+    const node = ancestors[index];
+    if (node.type === 'JSXAttribute' || node.type === 'ImportDeclaration'
+      || node.type === 'ImportExpression' || node.type === 'TSImportType'
+      || node.type === 'ExportAllDeclaration' || node.type === 'ExportNamedDeclaration'
+      || node.type === 'NewExpression' || node.type === 'TaggedTemplateExpression'
+      || node.type === 'MemberExpression' || node.type === 'OptionalMemberExpression') return false;
+    if (node.type === 'CallExpression' || node.type === 'OptionalCallExpression') {
+      if (!isJsonParse(node)) return false;
+    }
+    if (['VariableDeclarator', 'ExportDefaultDeclaration', 'ReturnStatement'].includes(node.type)) return true;
+    if (node.type === 'ExpressionStatement') return false;
+  }
+  return false;
+}
+
+/**
+ * Serialized JSON is data, not source: a review may quote forbidden host code
+ * or historical styles. Mask only complete object/array JSON literal values in
+ * data-expression positions. Keep ordinary strings, import/call/selector and
+ * JSX attribute contexts, and every template expression under the existing
+ * rules. Parsing errors (or a missing parser) retain the original checks.
+ * Source/archive bytes are never rewritten; offsets and line breaks survive.
+ */
+export function maskSerializedJsonData(content, extension = '.js') {
+  let ast;
+  try {
+    babelParse ||= require('@babel/parser').parse;
+    ast = babelParse(content, {
+      sourceType: 'unambiguous',
+      allowReturnOutsideFunction: true,
+      plugins: [...(['.ts', '.tsx'].includes(extension) ? ['typescript'] : []),
+        ...(extension !== '.ts' ? ['jsx'] : [])],
+    });
+  } catch { return content; }
+  const ranges = [];
+  const pending = [[ast, []]];
+  while (pending.length) {
+    const [node, ancestors] = pending.pop();
+    if (!node || typeof node !== 'object') continue;
+    const literal = node.type === 'StringLiteral' ? node.value
+      : node.type === 'TemplateLiteral' && node.expressions.length === 0 ? node.quasis[0]?.value.cooked : null;
+    if (typeof literal === 'string' && dataContext(ancestors)) {
+      try {
+        const value = JSON.parse(literal);
+        if (value !== null && typeof value === 'object') {
+          ranges.push([node.start, node.end]);
+          continue;
+        }
+      } catch { /* Ordinary/non-JSON strings keep their original checks. */ }
+    }
+    const parents = [...ancestors, node];
+    for (const [key, value] of Object.entries(node)) {
+      if (['loc', 'extra', 'tokens', 'comments', 'errors'].includes(key)) continue;
+      if (Array.isArray(value)) {
+        for (const child of value) if (child?.type) pending.push([child, parents]);
+      } else if (value?.type) pending.push([value, parents]);
+    }
+  }
+  let cursor = 0;
+  const result = [];
+  for (const [start, end] of ranges.sort((a, b) => a[0] - b[0])) {
+    result.push(content.slice(cursor, start), content.slice(start, end).replace(/[^\r\n]/g, ' '));
+    cursor = end;
+  }
+  result.push(content.slice(cursor));
+  return result.join('');
+}