@notis_ai/cli 0.2.0-beta.197.1 → 0.2.0-beta.198.1

package/src/runtime/skill-sync/index.ts

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
-import { join } from 'node:path';
+import { promises as fs } from 'node:fs';
+import { dirname, join } from 'node:path';
 import type {
   AgentTargets,
   LocalSkill,
@@ -11,7 +12,7 @@ import type {
 } from "./types";
 import { normalizeAgentTargets } from "./types";
 import { assertNativePull, checkedNativeReference, isNativeSkill, nativeState } from './native-identity';
-import { bindNativeFolders, hasNativeFolderHistory, nativeLinkRows, nativeLocalReady, previousNativeState, retainMissingNativeState } from './native-plan';
+import { bindNativeFolders, hasNativeFolderHistory, nativeLinkRows, nativeLocalReady, pendingLegacyUpgrade, previousNativeState, retainMissingNativeState } from './native-plan';
 import {
   downloadSkillBundle,
   fetchSyncSettings,
@@ -65,6 +66,10 @@ export interface RunSkillSyncOptions {
   honorSyncEnabled?: boolean;
   /** All account paths, scanner roots and agent links use this explicit home. */
   syncHome?: string;
+  /** False when another account is the CLI default: sync this account's own
+   * folder only and leave the agent folders (Claude Code, Codex, Cursor) to the
+   * default's skills. Defaults to true. */
+  linkAgentFolders?: boolean;
 }
 
 const BASE_SKILL_NAMES = new Set(['notis-apps', 'notis-query', 'notis-cli']);
@@ -143,6 +148,58 @@ const DEFAULT_RUN_SKILL_SYNC_DEPS: RunSkillSyncDependencies = {
   updateAgentTargets,
 };
 
+// Another account is the CLI default and owns the agent folders: this account
+// syncs its own folder without linking, unlinking or adopting anything there.
+const MIRROR_ONLY_DEPS: Pick<
+  RunSkillSyncDependencies,
+  'removeForeignAccountSymlinks' | 'removeAllSymlinksForSkill' | 'syncSymlinks'
+> = {
+  removeForeignAccountSymlinks: async () => 0,
+  removeAllSymlinksForSkill: async () => 0,
+  syncSymlinks: async () => ({ linked: 0, removed: 0, skipped: 0, verifiedAgentLinks: {} }),
+};
+
+/**
+ * The account linking now owns the agent folders, so the links the other
+ * accounts on this computer last verified are gone. Forget them: otherwise that
+ * account's next linking sync would read each missing link as the user removing
+ * the skill and deactivate it.
+ */
+async function forgetOtherAccountsAgentLinks(
+  paths: ReturnType<typeof getSkillSyncPathsForUser>,
+): Promise<void> {
+  const usersDir = dirname(dirname(paths.syncStatePath));
+  let entries: import('node:fs').Dirent[];
+  try {
+    entries = await fs.readdir(usersDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const statePath = join(usersDir, entry.name, '.notis-sync.json');
+    if (statePath === paths.syncStatePath) continue;
+    let state: { skills?: Record<string, { verifiedAgentLinks?: unknown }> } | null = null;
+    try {
+      state = JSON.parse(await fs.readFile(statePath, 'utf8'));
+    } catch {
+      continue;
+    }
+    if (!state || typeof state !== 'object' || !state.skills || typeof state.skills !== 'object') continue;
+    let changed = false;
+    for (const skill of Object.values(state.skills)) {
+      if (skill && typeof skill === 'object' && 'verifiedAgentLinks' in skill) {
+        delete skill.verifiedAgentLinks;
+        changed = true;
+      }
+    }
+    if (!changed) continue;
+    const temporaryPath = `${statePath}.${process.pid}.${Date.now()}.tmp`;
+    await fs.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+    await fs.rename(temporaryPath, statePath);
+  }
+}
+
 export function isolatedLinkOptions(paths: ReturnType<typeof getSkillSyncPathsForUser>) {
   if (!paths.isolatedNamespace && !paths.homeDir) return undefined;
   const root = paths.isolatedNamespace
@@ -299,6 +356,11 @@ function buildSyncState(
       const localSkill = localSkillMap.get(skill.name);
       const appliedCloudFolderHash = appliedRevisions[skill.name];
       const appliedFileList = appliedFiles[skill.name];
+      if (pendingLegacyUpgrade(skill, localSkill, previousState)) {
+        // Keep the legacy baseline so the upgrade retries; never mark a usable folder unavailable.
+        const { nativeUnavailable: _unavailable, ...previous } = previousNativeState(previousState, skill)!;
+        return [skill.name, { ...previous, verifiedAgentLinks: verifiedAgentLinks[skill.name] ?? {} }];
+      }
       if (isNativeSkill(skill) && !nativeLocalReady(skill, localSkill)) {
         const previous = previousNativeState(previousState, skill);
         return [skill.name, { ...(previous || {
@@ -368,7 +430,7 @@ function buildLocalSymlinkCandidates(
       };
     });
 
-  return [...nativeLinkRows(pullResponse, localSkills), ...localOnlySkills];
+  return [...nativeLinkRows(pullResponse, localSkills, previousState), ...localOnlySkills];
 }
 
 function isEmptySyncState(state: NotisSyncState): boolean {
@@ -428,6 +490,10 @@ async function writePulledSkillsToScopedMirror(
   for (const cloudSkill of selectCloudSkillsToApply(pullResponse.skills)) {
     const local = localSkillMap.get(cloudSkill.name);
     const acknowledged = isNativeSkill(cloudSkill) && local && acknowledgedNative.get(cloudSkill.id) === local.folderHash;
+    // An unchanged pre-native folder has no applied-file record, so the files it shares
+    // with the incoming native Skill are the previous sync's output, not local edits.
+    const legacyBaseline = Boolean(local && pendingLegacyUpgrade(cloudSkill, local, previousState)
+      && previousNativeState(previousState, cloudSkill)?.folderHash === local.folderHash);
     if (!acknowledged && !shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
       if (isNativeSkill(cloudSkill) && !nativeLocalReady(cloudSkill, local)) {
         failures.push({ name: cloudSkill.name, error: 'Local native Skill changes were retained; resolve the version or identity conflict before using them.' });
@@ -443,6 +509,7 @@ async function writePulledSkillsToScopedMirror(
           // produced locally and survives this one.
           previouslyApplied: previousNativeState(previousState, skill)?.appliedFiles,
           ...(isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {}),
+          ...(legacyBaseline ? { legacyBaseline } : {}),
         }),
       onWarning: warnSkillSync,
     });
@@ -542,7 +609,7 @@ export async function materializeCloudSkillsForLocalShell(
   }
   if (relinkSkillNames.size > 0) {
     const relinked = await deps.syncSymlinks(
-      nativeLinkRows(pullResponse, finalLocalSkills).filter((skill) => relinkSkillNames.has(skill.name)),
+      nativeLinkRows(pullResponse, finalLocalSkills, previousState).filter((skill) => relinkSkillNames.has(skill.name)),
       syncPaths.skillsDir,
       { ...isolatedLinkOptions(syncPaths), removeUndesired: false },
     );
@@ -580,7 +647,8 @@ export async function materializeCloudSkillsForLocalShell(
   for (const [name, previous] of Object.entries(previousState.skills)) {
     if (!previous.nativeReference && !previous.nativeUnavailable) continue;
     const current = pullResponse.skills.find(skill => skill.id === previous.cloudId);
-    if (!current || !nativeLocalReady(current, finalLocalSkills.find(local => local.name === current.name))) {
+    const local = current && finalLocalSkills.find(row => row.name === current.name);
+    if (!current || (!nativeLocalReady(current, local) && !pendingLegacyUpgrade(current, local, previousState))) {
       removed += await deps.removeAllSymlinksForSkill(name, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
     }
   }
@@ -702,9 +770,11 @@ export async function runSkillSync(
   dependencies: Partial<RunSkillSyncDependencies> = {},
   options: RunSkillSyncOptions = {},
 ): Promise<RunSkillSyncResult> {
+  const linkAgentFolders = options.linkAgentFolders !== false;
   const deps = {
     ...DEFAULT_RUN_SKILL_SYNC_DEPS,
     ...dependencies,
+    ...(linkAgentFolders ? {} : MIRROR_ONLY_DEPS),
   };
   const syncSettings: SyncSettings = await deps.fetchSyncSettings(
     serverUrl,
@@ -749,6 +819,9 @@ export async function runSkillSync(
   const foreignLinksRemoved = await deps.removeForeignAccountSymlinks(
     syncPaths.skillsDir, isolatedLinkOptions(syncPaths),
   );
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
+    await forgetOtherAccountsAgentLinks(syncPaths);
+  }
 
   const cloudCuratedSkillNames = new Set(
     pullResponse.skills
@@ -758,7 +831,9 @@ export async function runSkillSync(
   const protectedSkillNames = new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES]);
   const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
   const assignmentFailures: SkillSyncFailure[] = [];
-  const deactivated = !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true
+  // A mirror-only sync has no links by design, so none of them is missing.
+  const deactivated = linkAgentFolders && !syncPaths.isolatedNamespace
+    && syncSettings.agent_targets_conditional_updates === true
     ? await deactivateDeletedAgentSkills(
         serverUrl, jwt, pullResponse, scopedState, scopedState, syncPaths.skillsDir, deps, assignmentFailures, isolatedLinkOptions(syncPaths),
       )
@@ -774,7 +849,8 @@ export async function runSkillSync(
       protectedSkillNames,
     });
   }
-  if (!syncPaths.isolatedNamespace) {
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
+    // Skills found loose in the agent folders belong to the account linking them.
     await deps.gatherTopLevelLocalSkills(syncPaths, { protectedSkillNames });
   }
   const localSkills = (await deps.scanLocalSkills(syncPaths))

package/src/runtime/skill-sync/local-scanner.ts

@@ -1052,7 +1052,7 @@ async function pathExists(targetPath: string): Promise<boolean> {
 async function replaceSkillDirectoryAtomically(
   skillDir: string,
   populateDir: (stagingDir: string) => Promise<void>,
-  preserve?: { previouslyApplied?: readonly string[]; expectedFolderHash?: string; native?: boolean },
+  preserve?: { previouslyApplied?: readonly string[]; expectedFolderHash?: string; native?: boolean; legacyBaseline?: boolean },
 ): Promise<void> {
   const parentDir = path.dirname(skillDir);
   const skillName = path.basename(skillDir);
@@ -1084,7 +1084,8 @@ async function replaceSkillDirectoryAtomically(
     await populateDir(stagingDir);
 
     if (preserve && (await pathExists(skillDir))) {
-      await preserveUnmanagedFiles(skillDir, stagingDir, preserve.previouslyApplied, preserve.native);
+      await preserveUnmanagedFiles(skillDir, stagingDir, preserve.previouslyApplied,
+        preserve.native && !preserve.legacyBaseline);
     }
 
     if (preserve?.native) {
@@ -1178,7 +1179,7 @@ export async function writeCloudSkillToDisk(
   skill: CloudSkill,
   bundleBytes?: Buffer,
   paths: SkillSyncPaths = DEFAULT_SYNC_PATHS,
-  options: { previouslyApplied?: readonly string[]; expectedFolderHash?: string } = {},
+  options: { previouslyApplied?: readonly string[]; expectedFolderHash?: string; legacyBaseline?: boolean } = {},
 ): Promise<SkillWriteOutcome | false> {
   if (isNativeSkill(skill)) {
     assertNativePull({ skills: [{ ...skill, name: 'native-' + skill.id }], skill_sync_protocol: 2, sync_scope: skill.native_scope,
@@ -1190,7 +1191,9 @@ export async function writeCloudSkillToDisk(
     safeName(skill.name, paths.skillsDir),
   );
   const preserve = { previouslyApplied: options.previouslyApplied, expectedFolderHash: options.expectedFolderHash,
-    native: isNativeSkill(skill) };
+    native: isNativeSkill(skill),
+    // An unchanged legacy folder upgrading in place: shared files take the cloud version.
+    legacyBaseline: isNativeSkill(skill) && options.legacyBaseline === true && options.expectedFolderHash !== undefined };
 
   if (bundleBytes?.length) {
     const bundlePath = path.join(

package/src/runtime/skill-sync/native-plan.ts

@@ -34,9 +34,20 @@ export function nativeLocalReady(skill: CloudSkill, local?: LocalSkill): boolean
     && sameNativeReference(local.nativeReference, skill.native_reference));
 }
 
-export function nativeLinkRows(response: SyncPullResponse, locals: LocalSkill[]): CloudSkill[] {
-  return response.skills.map(skill => isNativeSkill(skill) && !nativeLocalReady(skill, locals.find(row => row.name === skill.name))
-    ? { ...skill, status: 'disabled' } : skill);
+/** A pre-native folder (no identity marker, no native state) the cloud now serves
+ * as a native Skill. It stays usable as before until its upgrade write lands. */
+export function pendingLegacyUpgrade(skill: CloudSkill, local: LocalSkill | undefined, state: NotisSyncState): boolean {
+  if (!isNativeSkill(skill) || !local || local.nativeReference || local.cloudId) return false;
+  const previous = previousNativeState(state, skill);
+  return Boolean(previous && !previous.nativeReference);
+}
+
+export function nativeLinkRows(response: SyncPullResponse, locals: LocalSkill[], state?: NotisSyncState): CloudSkill[] {
+  return response.skills.map(skill => {
+    const local = locals.find(row => row.name === skill.name);
+    return isNativeSkill(skill) && !nativeLocalReady(skill, local) && !(state && pendingLegacyUpgrade(skill, local, state))
+      ? { ...skill, status: 'disabled' } : skill;
+  });
 }
 
 export function retainMissingNativeState(previous: NotisSyncState, next: NotisSyncState): NotisSyncState {

package/src/runtime/sync-skills.d.ts

@@ -30,8 +30,10 @@ export function reconcileAllSkills<T extends object>(options: {
     serverUrl: string,
     jwt: string,
     dependencies: Record<string, never>,
-    options: { honorSyncEnabled: boolean },
+    options: { honorSyncEnabled: boolean; syncHome?: string; linkAgentFolders?: boolean },
   ) => Promise<T>;
   reconcileBase?: (options: { userId?: string | null; home?: string }) => BaseSkillReconcileResult;
   lockOptions?: Omit<SkillSyncLockOptions, 'home'>;
+  /** False syncs the account's own folder only; another account owns the agent folders. */
+  linkAgentFolders?: boolean;
 }): Promise<T & ReconcileAllSkillsResult>;

package/src/runtime/sync-skills.js

@@ -211,14 +211,22 @@ export async function reconcileAllSkills({
   runAccountSync,
   reconcileBase = reconcileBaseSkills,
   lockOptions = {},
+  linkAgentFolders = true,
 }) {
   return withSkillSyncLock(async () => {
-    const base = reconcileBase({ userId, ...(home ? { home } : {}) });
+    // Base skills are linked from the account that owns the agent folders.
+    const base = linkAgentFolders
+      ? reconcileBase({ userId, ...(home ? { home } : {}) })
+      : { skills: [], installed: 0, linked: 0, unchanged: 0, backups: [] };
     const account = await runAccountSync(
       serverUrl,
       jwt,
       {},
-      { honorSyncEnabled, ...(home ? { syncHome: home } : {}) },
+      {
+        honorSyncEnabled,
+        ...(home ? { syncHome: home } : {}),
+        ...(linkAgentFolders ? {} : { linkAgentFolders: false }),
+      },
     );
     return {
       ...account,

package/src/skill-sync-worker.js

@@ -1,14 +1,23 @@
 import { mkdirSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { resolveRuntimeProfile } from './runtime/profiles.js';
+import { getCurrentProfileName, loadConfig, resolveRuntimeProfile } from './runtime/profiles.js';
 import { ensureFreshOAuthCredential } from './runtime/oauth.js';
 import { runSkillSync, fetchSyncSettings } from '../dist/skill-sync/index.js';
 import { withSkillSyncLock } from './runtime/sync-skills.js';
 
+function currentCliProfile() {
+  try {
+    return getCurrentProfileName(loadConfig());
+  } catch {
+    return null;
+  }
+}
+
 export async function runAutomaticSkillSync({ profile, apiBase, userId }, {
   resolveRuntime = resolveRuntimeProfile, refresh = ensureFreshOAuthCredential,
   settings = fetchSyncSettings, sync = runSkillSync, lock = withSkillSyncLock,
+  currentProfile = currentCliProfile,
 } = {}) {
   const runtime = resolveRuntime({ profile }, { requireAuth: true });
   if (runtime.credentialKind !== 'oauth' || runtime.apiBase !== apiBase
@@ -18,9 +27,12 @@ export async function runAutomaticSkillSync({ profile, apiBase, userId }, {
   if (saved.user_id !== userId) throw new Error('Automatic skill sync identity mismatch');
   // Do not gather, unlink foreign accounts or write anything when opted out.
   if (!saved.sync_enabled) return { status: 'disabled' };
+  // The service stays bound to its profile; after `notis profile use` moves the
+  // default away, it keeps that account's folder in sync without linking it.
+  const linkAgentFolders = (currentProfile() ?? profile) === profile;
   const result = await lock(() => sync(runtime.apiBase, runtime.jwt, {
     fetchSyncSettings: async () => saved,
-  }, { honorSyncEnabled: true }));
+  }, { honorSyncEnabled: true, ...(linkAgentFolders ? {} : { linkAgentFolders: false }) }));
   return { status: (result.failedLinks?.length || result.failedPushes?.length) ? 'partial' : 'synced', ...result };
 }