@notis_ai/cli 0.2.0-beta.197.1 → 0.2.0-beta.198.1

package/dist/view-renderer/src/host.tsx

@@ -131,9 +131,11 @@ async function start() {
     captureContextSelection() {}, registerTopBarSearch() {}, setTopBarSearchValue() {}, setTopBarSearchLoading() {},
     publishActiveResource(value) { activeMarkdown = value?.snapshot?.format === 'markdown' && typeof value.snapshot.content === 'string' ? value.snapshot.content : null; },
     // The document page renders as its read-only snapshot: no toolbar, live session or saves.
+    // A note opened with the HTML viewer shows its one stored HTML file, never the editor.
     ui: { DocumentEditor, RecordProperties, HtmlFrame, ReportFrame, ShareControl: () => null,
-      DocumentPage: ({ recordKey, className, header, properties }) => <DocumentEditor recordKey={recordKey} className={className}
-        variant={header === false ? 'body' : 'full'} showProperties={properties !== 'hidden'} />,
+      DocumentPage: ({ recordKey, className, header, properties, viewer }) => viewer === 'html'
+        ? <HtmlFrame recordKey={recordKey} className={className} />
+        : <DocumentEditor recordKey={recordKey} className={className} variant={header === false ? 'body' : 'full'} showProperties={properties !== 'hidden'} />,
       MarkdownEditor: ({ value }) => <Markdown value={value} /> },
     callAction(id, inputs = {}) {
       if (!Object.hasOwn(authority.actions, id) || authority.actions[id].readOnly !== true) return denied();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.0-beta.197.1",
+  "version": "0.2.0-beta.198.1",
   "description": "Agent-first Notis CLI for apps and generic tool execution",
   "type": "module",
   "bin": {

package/skills/notis-apps/cli.md

@@ -20,7 +20,7 @@ or no-deploy requests stop at local artifacts without remote mutation. Store pub
 
 ## Reports and HTML
 
-New reports are independent Space views. Existing database report payloads render inside their database's main view. Use the installed HTML Space's saving Skill for self-contained HTML. See the canonical product guidance for build, revision, native file and view-link rules.
+Interactive reports are independent Space views. Save self-contained HTML pages and reports in Notis Notes with its Save HTML Skill; pages and reports saved before Spaces open there too. See the canonical product guidance for build, revision, native file and view-link rules.
 
 ## Commands
 

package/src/command-specs/auth.js

@@ -133,9 +133,9 @@ export const authCommandSpecs = [
   },
   {
     command_path: ['logout'],
-    summary: 'Revoke and remove the OAuth credential for one CLI profile.',
+    summary: 'Sign this computer out of one CLI profile: revoke and remove its OAuth credential.',
     when_to_use:
-      'Use this to disconnect a single account. Other profiles keep their credentials unless you pass --all-profiles.',
+      'Use this to disconnect a single account on this computer. Its sign-ins on other computers stay, and other profiles keep their credentials unless you pass --all-profiles.',
     args_schema: {
       arguments: [],
       options: [

package/src/command-specs/profile.js

@@ -1,3 +1,5 @@
+import { spawn } from 'node:child_process';
+import { CHANNEL_SWITCH_ENV } from '../runtime/channel.js';
 import { CliError, EXIT_CODES } from '../runtime/errors.js';
 import { quoteShellArgument } from '../runtime/auth-recovery.js';
 import {
@@ -114,6 +116,44 @@ async function listHandler(ctx) {
   });
 }
 
+const SKILL_SYNC_API_BASE_PATTERN = /^https:\/\/api(?:-beta)?\.notis\.ai\/?$/;
+
+// Overrides that belong to this `profile use` run. Inherited, a NOTIS_JWT would
+// sync its own account into the agent folders under the named profile.
+const RELINK_DROPPED_ENV = ['NOTIS_JWT', 'NOTIS_API_BASE', 'NOTIS_PROFILE', CHANNEL_SWITCH_ENV];
+
+// The new default's skills take over the agent folders (Claude Code, Codex,
+// Cursor) now rather than at the next automatic sync. Detached, so the switch
+// itself stays instant; a failure waits for that next sync.
+export function relinkSkillsInBackground(name, profile, {
+  env = process.env,
+  argv = process.argv,
+  execPath = process.execPath,
+  spawnImpl = spawn,
+} = {}) {
+  // Never from a test run: a detached sync would outlive it and reach the real API.
+  if (env.NODE_ENV === 'test' || env.NODE_TEST_CONTEXT || !argv[1]) return false;
+  if (!profile?.oauth_access_token && !profile?.oauth_refresh_token) return false;
+  if (!SKILL_SYNC_API_BASE_PATTERN.test(String(profile.api_base || ''))) return false;
+  // Like the automatic sync, the relink runs as the named profile alone: its
+  // credential, its endpoint and the CLI build for its channel.
+  const childEnv = { ...env };
+  for (const key of RELINK_DROPPED_ENV) delete childEnv[key];
+  try {
+    const child = spawnImpl(
+      execPath,
+      [argv[1], 'skills', 'sync', '--json', '--profile', name],
+      { detached: true, stdio: 'ignore', env: childEnv },
+    );
+    child.on('error', () => {});
+    child.unref();
+    return true;
+  } catch {
+    // The next automatic sync relinks.
+    return false;
+  }
+}
+
 async function useHandler(ctx) {
   const requested = ctx.args.name;
   const config = loadConfig();
@@ -132,6 +172,7 @@ async function useHandler(ctx) {
   const worktreeOverride = Boolean(worktreeRuntime);
   const worktreeBlocked = Boolean(worktreeUnavailable);
   const authenticated = profileHasCredential(profile);
+  if (authenticated) relinkSkillsInBackground(requested, profile);
 
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
@@ -298,7 +339,7 @@ export const profileCommandSpecs = [
     command_path: ['profile', 'use'],
     summary: 'Switch the default profile without signing any profile out.',
     when_to_use:
-      'Use this to change which account and API subsequent commands target. Every other profile keeps its credential.',
+      'Use this to change which account and API subsequent commands target. Every other profile keeps its credential. Its skills replace the previous default\'s in the agent folders (Claude Code, Codex, Cursor) straight away.',
     args_schema: {
       arguments: [{ token: '<name>', key: 'name', description: 'Profile to make active.' }],
       options: [],

package/src/command-specs/skills.js

@@ -1,4 +1,4 @@
-import { getJwtSubject } from '../runtime/profiles.js';
+import { getCurrentProfileName, getJwtSubject, loadConfig } from '../runtime/profiles.js';
 import { reconcileAllSkills } from '../runtime/sync-skills.js';
 import { ensureFreshOAuthCredential } from '../runtime/oauth.js';
 import { installSkillSyncService } from '../runtime/skill-sync-service.js';
@@ -82,6 +82,15 @@ async function loadSkillSyncEngine() {
   return import('../../dist/skill-sync/index.js');
 }
 
+function cliDefaultOwnsAgentFolders(runtime) {
+  if (runtime.profileSource !== 'explicit' || !runtime.profileName) return true;
+  try {
+    return runtime.profileName === getCurrentProfileName(loadConfig());
+  } catch {
+    return true;
+  }
+}
+
 export async function syncSkillsHandler(ctx, {
   refresh = ensureFreshOAuthCredential, loadEngine = loadSkillSyncEngine,
   reconcile = reconcileAllSkills, install = installSkillSyncService,
@@ -95,6 +104,9 @@ export async function syncSkillsHandler(ctx, {
     jwt: ctx.runtime.jwt,
     userId: settings.user_id || userId,
     honorSyncEnabled: Boolean(ctx.options.electronRepeat),
+    // Only the CLI default's skills go into the agent folders; another profile
+    // syncs its own folder.
+    linkAgentFolders: cliDefaultOwnsAgentFolders(ctx.runtime),
     runAccountSync: (serverUrl, jwt, dependencies, options) => runSkillSync(
       serverUrl, jwt, { ...dependencies, fetchSyncSettings: async () => settings }, options,
     ),

package/src/runtime/computer-identity.d.ts

@@ -0,0 +1,30 @@
+export interface ComputerIdentity {
+  /** Stable UUID v4 for this computer, shared by every account on it. */
+  computerId: string;
+  /** The name the user chose, or null to use the computer's own name. */
+  name: string | null;
+  /** The computer's own name (macOS Computer Name, else the host name). */
+  defaultName: string;
+  /** `name ?? defaultName`, what the server and the user see. */
+  displayName: string;
+}
+
+export interface ComputerIdentityOptions {
+  /** The CLI config file computer.json sits next to. Defaults to NOTIS_CLI_CONFIG_FILE or ~/.notis/config.json. */
+  configFile?: string;
+  platform?: NodeJS.Platform;
+  hostname?: () => string;
+  readMacComputerName?: () => string | null;
+}
+
+export const COMPUTER_IDENTITY_VERSION: number;
+export const COMPUTER_NAME_MAX_LENGTH: number;
+
+export function computerIdentityFile(configFile?: string): string;
+export function normalizeComputerName(value: unknown): string | null;
+export function defaultComputerName(options?: ComputerIdentityOptions): string;
+export function readComputerIdentity(options?: ComputerIdentityOptions): ComputerIdentity;
+export function setComputerName(
+  name: string | null,
+  options?: ComputerIdentityOptions,
+): ComputerIdentity;

package/src/runtime/computer-identity.js

@@ -0,0 +1,151 @@
+import { randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { hostname as osHostname } from 'node:os';
+import { dirname, join } from 'node:path';
+import { resolveCliConfigFile, withConfigFileWriteLock } from './config-lock.js';
+
+// This computer's identity, shared by the CLI and Desktop: one stable id per
+// computer (the server keeps one CLI sign-in and one local shell connection per
+// computer) and the name the user sees for it. It lives next to the CLI config
+// file, so NOTIS_CLI_CONFIG_FILE moves it too, and is written under the same
+// lock as the config.
+export const COMPUTER_IDENTITY_VERSION = 1;
+export const COMPUTER_NAME_MAX_LENGTH = 64;
+const COMPUTER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const FALLBACK_COMPUTER_NAME = 'Computer';
+
+export function computerIdentityFile(configFile = resolveCliConfigFile()) {
+  return join(dirname(configFile), 'computer.json');
+}
+
+/**
+ * Trim, collapse whitespace and cap at 64 characters. Returns null for a name
+ * that is empty after cleanup, which means "use the computer's own name".
+ */
+export function normalizeComputerName(value) {
+  if (typeof value !== 'string') return null;
+  const collapsed = value.replace(/\s+/gu, ' ').trim();
+  if (!collapsed) return null;
+  // Count code points so a cut never splits a character in two.
+  const characters = Array.from(collapsed);
+  if (characters.length <= COMPUTER_NAME_MAX_LENGTH) return collapsed;
+  return characters.slice(0, COMPUTER_NAME_MAX_LENGTH).join('').trim();
+}
+
+function readMacComputerName() {
+  try {
+    return execFileSync('/usr/sbin/scutil', ['--get', 'ComputerName'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2_000,
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The computer's own name: the macOS Computer Name, else the host name without
+ * a trailing `.local`.
+ */
+export function defaultComputerName(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform === 'darwin') {
+    const macName = normalizeComputerName((options.readMacComputerName ?? readMacComputerName)());
+    if (macName) return macName;
+  }
+  let host = '';
+  try {
+    host = String((options.hostname ?? osHostname)() || '');
+  } catch {
+    host = '';
+  }
+  return normalizeComputerName(host.replace(/\.local\.?$/iu, '')) || FALLBACK_COMPUTER_NAME;
+}
+
+function parseIdentityFile(file) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  return raw;
+}
+
+function validStored(raw) {
+  if (!raw || raw.version !== COMPUTER_IDENTITY_VERSION) return null;
+  if (typeof raw.computer_id !== 'string' || !COMPUTER_ID_PATTERN.test(raw.computer_id)) return null;
+  return {
+    computerId: raw.computer_id.toLowerCase(),
+    name: normalizeComputerName(raw.name),
+  };
+}
+
+function writeIdentityFile(file, stored) {
+  mkdirSync(dirname(file), { recursive: true });
+  const contents = {
+    version: COMPUTER_IDENTITY_VERSION,
+    computer_id: stored.computerId,
+    ...(stored.name ? { name: stored.name } : {}),
+  };
+  const temporaryFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryFile, `${JSON.stringify(contents, null, 2)}\n`, { mode: 0o600 });
+  renameSync(temporaryFile, file);
+}
+
+function withIdentity(stored, options) {
+  const defaultName = defaultComputerName(options);
+  return {
+    computerId: stored.computerId,
+    name: stored.name,
+    defaultName,
+    displayName: stored.name ?? defaultName,
+  };
+}
+
+// Under the config lock: re-read so two first reads agree on one id, then
+// create (or repair) the file only when it holds no valid identity.
+function readOrCreateLocked(configFile, file) {
+  const raw = parseIdentityFile(file);
+  const existing = validStored(raw);
+  if (existing) return existing;
+  const created = {
+    computerId: randomUUID(),
+    // A file with a broken id keeps the name the user chose.
+    name: normalizeComputerName(raw?.name),
+  };
+  writeIdentityFile(file, created);
+  return created;
+}
+
+/**
+ * Read this computer's identity, creating `computer.json` on first read.
+ */
+export function readComputerIdentity(options = {}) {
+  const configFile = options.configFile ?? resolveCliConfigFile();
+  const file = computerIdentityFile(configFile);
+  const stored = validStored(parseIdentityFile(file))
+    ?? withConfigFileWriteLock(configFile, () => readOrCreateLocked(configFile, file));
+  return withIdentity(stored, options);
+}
+
+/**
+ * Rename this computer for every account on it. An empty name goes back to the
+ * computer's own name.
+ */
+export function setComputerName(name, options = {}) {
+  const configFile = options.configFile ?? resolveCliConfigFile();
+  const file = computerIdentityFile(configFile);
+  const stored = withConfigFileWriteLock(configFile, () => {
+    const current = readOrCreateLocked(configFile, file);
+    const next = { computerId: current.computerId, name: normalizeComputerName(name) };
+    if (next.name !== current.name) {
+      writeIdentityFile(file, next);
+    }
+    return next;
+  });
+  return withIdentity(stored, options);
+}

package/src/runtime/config-lock.js

@@ -0,0 +1,135 @@
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+
+// Cross-process write lock over ~/.notis/config.json. Independent `notis`
+// processes (a `login` in one terminal and a `tools exec` in another) and
+// Desktop all rewrite the files in this directory, so the lock directory name
+// and these three timings are the whole coordination protocol. Desktop keeps a
+// TypeScript copy in electron/src/notis-config-file.ts. Guarded by the
+// concurrency test in packages/cli/test/runtime-auth.test.js.
+const CONFIG_WRITE_LOCK_TIMEOUT_MS = 5_000;
+const CONFIG_WRITE_LOCK_STALE_MS = 2_000;
+const CONFIG_WRITE_LOCK_POLL_MS = 10;
+
+/**
+ * The shared CLI config file. NOTIS_CLI_CONFIG_FILE moves it (and every file
+ * kept next to it, such as computer.json) for tests and isolated runtimes.
+ */
+export function resolveCliConfigFile() {
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve(envConfigFile);
+  }
+  return join(homedir(), '.notis', 'config.json');
+}
+
+// The lock records who holds it and when they took it. Reclaiming a stale lock
+// by mtime alone is not safe: the reclaimer cannot tell an abandoned lock from
+// one it is about to steal from a live writer, and the victim's own release
+// would then delete the thief's lock and admit a third writer. Both sides are
+// on the same host, so the stored timestamp and Date.now() share a clock.
+function readLockOwner(lockDirectory) {
+  try {
+    return JSON.parse(readFileSync(join(lockDirectory, 'owner'), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function lockDirectoryMtime(lockDirectory) {
+  try {
+    return statSync(lockDirectory).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+function publishConfigWriteLock(lockDirectory, ownerId) {
+  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
+  try {
+    mkdirSync(candidateDirectory);
+    writeFileSync(
+      join(candidateDirectory, 'owner'),
+      JSON.stringify({ id: ownerId, at: Date.now() }),
+      { mode: 0o600 },
+    );
+    try {
+      renameSync(candidateDirectory, lockDirectory);
+      return true;
+    } catch (error) {
+      if (!existsSync(lockDirectory)) throw error;
+      return false;
+    }
+  } finally {
+    rmSync(candidateDirectory, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Run `callback(configFile)` while holding `<configFile>.write-lock`.
+ */
+export function withConfigFileWriteLock(configFile, callback) {
+  const lockDirectory = `${configFile}.write-lock`;
+  const ownerId = `${process.pid}.${randomUUID()}`;
+  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
+  mkdirSync(dirname(configFile), { recursive: true });
+  for (;;) {
+    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
+      break;
+    }
+
+    const owner = readLockOwner(lockDirectory);
+    const observedMtime = lockDirectoryMtime(lockDirectory);
+    const ownerIsStale =
+      owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
+    const ownerlessIsStale =
+      !owner
+      && observedMtime !== null
+      && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
+    if (ownerIsStale || ownerlessIsStale) {
+      try {
+        const currentOwner = readLockOwner(lockDirectory);
+        const ownerUnchanged = owner?.id
+          ? currentOwner?.id === owner.id
+          : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
+        if (ownerUnchanged) {
+          rmSync(lockDirectory, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        // Losing the reclaim race is normal; fall through and keep waiting.
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update ${configFile}`);
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      CONFIG_WRITE_LOCK_POLL_MS,
+    );
+  }
+  try {
+    return callback(configFile);
+  } finally {
+    try {
+      // Never release a lock that was reclaimed from us while we worked.
+      if (readLockOwner(lockDirectory)?.id === ownerId) {
+        rmSync(lockDirectory, { recursive: true, force: true });
+      }
+    } catch {
+      // The lock may already have been removed after an interrupted write.
+    }
+  }
+}

package/src/runtime/oauth.js

@@ -21,6 +21,7 @@ import { execFileSync, spawn } from 'node:child_process';
 import { createInterface } from 'node:readline/promises';
 
 import { CliError, EXIT_CODES, usageError } from './errors.js';
+import { readComputerIdentity } from './computer-identity.js';
 import { getAuthRecovery, quoteShellArgument } from './auth-recovery.js';
 import {
   channelFromProfile,
@@ -674,7 +675,19 @@ function storedOAuthMetadata(runtime, profile) {
   };
 }
 
-function buildAuthorizeUrl(metadata, {
+// This computer's id and name, so the server keeps one CLI sign-in per
+// computer and lists it as "Notis CLI on <computer>". Best effort: a sign-in
+// without them still works and maps to the shared legacy grant.
+function cliDeviceParams() {
+  try {
+    const identity = readComputerIdentity({ configFile: resolveConfigFile() });
+    return { device_id: identity.computerId, device_name: identity.displayName };
+  } catch {
+    return {};
+  }
+}
+
+export function buildAuthorizeUrl(metadata, {
   redirectUri,
   challenge,
   state,
@@ -689,6 +702,9 @@ function buildAuthorizeUrl(metadata, {
   url.searchParams.set('code_challenge', challenge);
   url.searchParams.set('code_challenge_method', 'S256');
   url.searchParams.set('state', state);
+  for (const [key, value] of Object.entries(cliDeviceParams())) {
+    url.searchParams.set(key, value);
+  }
   return url.toString();
 }
 
@@ -2473,6 +2489,7 @@ export async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
           refresh_token: profile.oauth_refresh_token,
           client_id: profile.oauth_client_id,
           resource: metadata.resource,
+          ...cliDeviceParams(),
         }),
       },
       fetchImpl,

package/src/runtime/profiles.js

@@ -1,16 +1,14 @@
-import { randomUUID } from 'node:crypto';
 import {
   existsSync,
   mkdirSync,
   readFileSync,
   renameSync,
-  rmSync,
-  statSync,
   writeFileSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, parse, resolve } from 'node:path';
 import { CliError, EXIT_CODES } from './errors.js';
+import { withConfigFileWriteLock } from './config-lock.js';
 import { getAuthRecovery, quoteShellArgument } from './auth-recovery.js';
 import { channelFromProfile, cliCommandForChannel, isReleaseChannel } from './channel.js';
 
@@ -34,14 +32,6 @@ const WORKTREE_RUNTIME_FILENAME = join('.context', 'notis-runtime.json');
 const WORKTREE_ROUTING_FILENAME = join('.context', 'notis-routing.json');
 const LOCAL_API_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
 const LIVE_API_HOSTS = new Set(['api.notis.ai', 'api-beta.notis.ai']);
-// Cross-process write lock over ~/.notis/config.json. Independent `notis`
-// processes (a `login` in one terminal and a `tools exec` in another) all
-// rewrite this file, so the lock directory name and these three timings are the
-// whole coordination protocol. Guarded by the concurrency test in
-// packages/cli/test/runtime-auth.test.js.
-const CONFIG_WRITE_LOCK_TIMEOUT_MS = 5_000;
-const CONFIG_WRITE_LOCK_STALE_MS = 2_000;
-const CONFIG_WRITE_LOCK_POLL_MS = 10;
 
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
@@ -372,103 +362,11 @@ function writeRawConfig(configFile, config) {
   renameSync(temporaryFile, configFile);
 }
 
-// The lock records who holds it and when they took it. Reclaiming a stale lock
-// by mtime alone is not safe: the reclaimer cannot tell an abandoned lock from
-// one it is about to steal from a live writer, and the victim's own release
-// would then delete the thief's lock and admit a third writer. Both sides are
-// on the same host, so the stored timestamp and Date.now() share a clock.
-function readLockOwner(lockDirectory) {
-  try {
-    return JSON.parse(readFileSync(join(lockDirectory, 'owner'), 'utf-8'));
-  } catch {
-    return null;
-  }
-}
-
-function lockDirectoryMtime(lockDirectory) {
-  try {
-    return statSync(lockDirectory).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-
-function publishConfigWriteLock(lockDirectory, ownerId) {
-  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
-  try {
-    mkdirSync(candidateDirectory);
-    writeFileSync(
-      join(candidateDirectory, 'owner'),
-      JSON.stringify({ id: ownerId, at: Date.now() }),
-      { mode: 0o600 },
-    );
-    try {
-      renameSync(candidateDirectory, lockDirectory);
-      return true;
-    } catch (error) {
-      if (!existsSync(lockDirectory)) throw error;
-      return false;
-    }
-  } finally {
-    rmSync(candidateDirectory, { recursive: true, force: true });
-  }
-}
-
+// Independent `notis` processes and Desktop all rewrite this file. The lock
+// protocol lives in config-lock.js, shared with computer.json and mirrored by
+// Desktop.
 function withConfigWriteLock(callback) {
-  const configFile = resolveConfigFile();
-  const lockDirectory = `${configFile}.write-lock`;
-  const ownerId = `${process.pid}.${randomUUID()}`;
-  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
-  mkdirSync(dirname(configFile), { recursive: true });
-  for (;;) {
-    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
-      break;
-    }
-
-    const owner = readLockOwner(lockDirectory);
-    const observedMtime = lockDirectoryMtime(lockDirectory);
-    const ownerIsStale =
-      owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
-    const ownerlessIsStale =
-      !owner
-      && observedMtime !== null
-      && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
-    if (ownerIsStale || ownerlessIsStale) {
-      try {
-        const currentOwner = readLockOwner(lockDirectory);
-        const ownerUnchanged = owner?.id
-          ? currentOwner?.id === owner.id
-          : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
-        if (ownerUnchanged) {
-          rmSync(lockDirectory, { recursive: true, force: true });
-          continue;
-        }
-      } catch {
-        // Losing the reclaim race is normal; fall through and keep waiting.
-      }
-    }
-    if (Date.now() >= deadline) {
-      throw new Error(`Timed out waiting to update ${configFile}`);
-    }
-    Atomics.wait(
-      new Int32Array(new SharedArrayBuffer(4)),
-      0,
-      0,
-      CONFIG_WRITE_LOCK_POLL_MS,
-    );
-  }
-  try {
-    return callback(configFile);
-  } finally {
-    try {
-      // Never release a lock that was reclaimed from us while we worked.
-      if (readLockOwner(lockDirectory)?.id === ownerId) {
-        rmSync(lockDirectory, { recursive: true, force: true });
-      }
-    } catch {
-      // The lock may already have been removed after an interrupted write.
-    }
-  }
+  return withConfigFileWriteLock(resolveConfigFile(), callback);
 }
 
 export function saveConfig(config) {