@notis_ai/cli 0.2.0-beta.20.1 → 0.2.0-beta.32.1

package/src/runtime/app-platform.js

@@ -7,18 +7,29 @@
  */
 
 import { spawn } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, cpSync, readdirSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, rmSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { gunzipSync } from 'node:zlib';
 
 import { usageError } from './errors.js';
+import { validateArtifactBoundary, validateProjectBoundary } from './app-boundary-validator.js';
 
 const NOTIS_DIR = '.notis';
 const STATE_FILE = join(NOTIS_DIR, 'state.json');
 const OUTPUT_DIR = join(NOTIS_DIR, 'output');
 const BUNDLE_DIR = join(OUTPUT_DIR, 'bundle');
 const MANIFEST_FILE = join(OUTPUT_DIR, 'manifest.json');
+const SOURCE_COPY_EXCLUDES = new Set([
+  'node_modules',
+  '.notis',
+  '.git',
+  'dist',
+  'package-lock.json',
+  'tsconfig.tsbuildinfo',
+  '.DS_Store',
+]);
 let appConfigImportNonce = 0;
 
 // ---------------------------------------------------------------------------
@@ -29,6 +40,47 @@ export function resolveProjectDir(inputDir = '.') {
   return resolve(process.cwd(), inputDir);
 }
 
+export function getBundleDir(projectDir) {
+  return join(projectDir, BUNDLE_DIR);
+}
+
+export function resolveBuiltBundleDir(projectDir) {
+  const bundleDir = getBundleDir(projectDir);
+  if (existsSync(join(bundleDir, 'app.js'))) {
+    return bundleDir;
+  }
+  return null;
+}
+
+function normalizeShadowScopedCss(css) {
+  return css
+    // Tailwind preflight emits `html,:host` in v3. Inside a shadow tree we want
+    // the shadow host itself to carry those defaults.
+    .replace(/html\s*,\s*:host\s*\{/g, ':host{')
+    .replace(/:root\s*,\s*:host\s*\{/g, ':host{')
+    .replace(/:root\s*\{/g, ':host{')
+    .replace(/html\s*\{/g, ':host{')
+    // Shadow trees do not contain a body element. Route those defaults to the
+    // app root contract instead so authors still get the expected reset.
+    .replace(/body\s*\{/g, '[data-notis-app-root]{');
+}
+
+function normalizeBundleStylesheets(projectDir) {
+  const bundleDir = join(projectDir, BUNDLE_DIR);
+  if (!existsSync(bundleDir)) {
+    return;
+  }
+
+  for (const entry of readdirSync(bundleDir)) {
+    if (!entry.endsWith('.css')) {
+      continue;
+    }
+    const cssPath = join(bundleDir, entry);
+    const normalizedCss = normalizeShadowScopedCss(readFileSync(cssPath, 'utf-8'));
+    writeFileSync(cssPath, normalizedCss);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Config loading
 // ---------------------------------------------------------------------------
@@ -38,11 +90,24 @@ export function resolveProjectDir(inputDir = '.') {
  * approach: we read the file, transpile with the project's TypeScript compiler
  * when available, then evaluate as ESM.
  */
+function stripNotisSdkImports(source) {
+  return source
+    .replace(/import\s+type\s+[\s\S]*?from\s+['"][^'"]*['"]\s*;?/g, '')
+    .replace(/import\s*{[\s\S]*?\bdefineNotisApp\b[\s\S]*?}\s+from\s+['"]@notis\/sdk\/config['"]\s*;?/g, '')
+    .replace(/defineNotisApp\s*\(/g, '(');
+}
+
 function transpileTsConfigSource(source, configPath) {
+  // Strip the @notis/sdk/config import unconditionally. The SDK package often
+  // points its `exports` at raw .ts source, which Node cannot import from the
+  // temp .mjs file we emit below. `defineNotisApp` is just an identity helper,
+  // so removing the import and replacing the call with a parens-wrapped
+  // expression preserves the config value without ever resolving the SDK.
+  const stripped = stripNotisSdkImports(source);
   const requireFromConfig = createRequire(`file://${configPath}`);
   try {
     const ts = requireFromConfig('typescript');
-    const transpiled = ts.transpileModule(source, {
+    const transpiled = ts.transpileModule(stripped, {
       compilerOptions: {
         module: ts.ModuleKind.ESNext,
         target: ts.ScriptTarget.ES2020,
@@ -51,10 +116,7 @@ function transpileTsConfigSource(source, configPath) {
     });
     return transpiled.outputText;
   } catch {
-    return source
-      .replace(/import\s+type\s+[\s\S]*?from\s+['"][^'"]*['"]\s*;?/g, '')
-      .replace(/import\s*{[\s\S]*?\bdefineNotisApp\b[\s\S]*?}\s+from\s+['"]@notis\/sdk\/config['"]\s*;?/g, '')
-      .replace(/defineNotisApp\s*\(/, '(');
+    return stripped;
   }
 }
 
@@ -181,7 +243,7 @@ export async function runProjectScript({ projectDir, scriptName, env = {}, stdio
  * Derive an export name from a route path.
  * '/' -> 'index', '/inbox' -> 'inbox', '/my-tasks' -> 'myTasks'
  */
-function exportNameFromPath(routePath) {
+export function exportNameFromPath(routePath) {
   if (routePath === '/') return 'index';
   const slug = routePath.replace(/^\//, '').replace(/\//g, '-');
   const identifier = slug
@@ -236,11 +298,88 @@ function autoDetectRoutes(projectDir) {
   return routes;
 }
 
+function validateConfiguredRoutes(routes) {
+  if (routes.length === 0) {
+    return;
+  }
+
+  const slugSet = new Set();
+  let defaultCount = 0;
+
+  for (const route of routes) {
+    if (!route.slug || typeof route.slug !== 'string') {
+      throw usageError(`Route "${route.path}" must define a slug.`);
+    }
+    if (slugSet.has(route.slug)) {
+      throw usageError(`Duplicate route slug "${route.slug}".`);
+    }
+    slugSet.add(route.slug);
+    if (route.default) {
+      defaultCount += 1;
+    }
+  }
+
+  if (defaultCount !== 1) {
+    throw usageError(`Expected exactly one default route, received ${defaultCount}.`);
+  }
+
+  for (const route of routes) {
+    if (route.parentSlug && !slugSet.has(route.parentSlug)) {
+      throw usageError(
+        `Route "${route.slug}" references unknown parentSlug "${route.parentSlug}".`,
+      );
+    }
+    const collection = route.collection || null;
+    if (
+      collection?.sidebar?.mode === 'tree' &&
+      (!collection.parentProperty || typeof collection.parentProperty !== 'string')
+    ) {
+      throw usageError(
+        `Tree collection route "${route.slug}" must define collection.parentProperty.`,
+      );
+    }
+  }
+
+  const childrenByParent = new Map();
+  for (const route of routes) {
+    if (!route.parentSlug) {
+      continue;
+    }
+    const children = childrenByParent.get(route.parentSlug) || [];
+    children.push(route.slug);
+    childrenByParent.set(route.parentSlug, children);
+  }
+
+  for (const route of routes) {
+    const seen = new Set([route.slug]);
+    let current = route.parentSlug || null;
+    while (current) {
+      if (seen.has(current)) {
+        throw usageError(`Route parent cycle detected at "${route.slug}".`);
+      }
+      seen.add(current);
+      current = routes.find((candidate) => candidate.slug === current)?.parentSlug || null;
+    }
+  }
+
+  for (const route of routes) {
+    if (
+      route.collection?.sidebar?.mode === 'tree' &&
+      (childrenByParent.get(route.slug) || []).length > 0
+    ) {
+      throw usageError(
+        `Tree collection route "${route.slug}" cannot also define static child routes.`,
+      );
+    }
+  }
+}
+
 function resolveConfiguredRoutes(appConfig, projectDir) {
   const configuredRoutes = Array.isArray(appConfig.routes) ? appConfig.routes : [];
+  validateConfiguredRoutes(configuredRoutes);
   const routes = configuredRoutes.map((route) => ({
     ...route,
-    slug: route.slug || slugFromPath(route.path),
+    slug: route.slug,
     export_name: route.exportName || route.export_name || exportNameFromPath(route.path),
   }));
   return routes.length > 0 ? routes : autoDetectRoutes(projectDir);
@@ -273,13 +412,14 @@ function generateEntryFile(projectDir, routes) {
 /**
  * Generate the manifest from app config and build output.
  */
-function generateManifest(appConfig, projectDir) {
+export function generateManifest(appConfig, projectDir) {
   const routes = resolveConfiguredRoutes(appConfig, projectDir).map((route) => {
     const entry = {
       path: route.path,
-      slug: route.slug || slugFromPath(route.path),
+      slug: route.slug,
       name: route.name,
       icon: route.icon || null,
+      parentSlug: route.parentSlug || null,
       default: route.default || false,
       export_name: route.exportName || route.export_name || exportNameFromPath(route.path),
       collection: route.collection || null,
@@ -314,6 +454,7 @@ function generateManifest(appConfig, projectDir) {
  * Build the app bundle: generate entry file, run `vite build`, package into .notis/output/.
  */
 export async function buildArtifact(projectDir) {
+  validateProjectBoundary(projectDir);
   const appConfig = await loadAppConfig(projectDir);
 
   // Auto-detect or use configured routes
@@ -328,12 +469,16 @@ export async function buildArtifact(projectDir) {
     scriptName: 'build',
   });
 
-  // Verify output
-  const bundleDir = join(projectDir, BUNDLE_DIR);
-  const jsPath = join(bundleDir, 'app.js');
-  if (!existsSync(jsPath)) {
-    throw usageError('Vite build did not produce .notis/output/bundle/app.js. Check your vite.config.ts.');
+  // Verify the canonical `.notis/output/bundle` packaging contract.
+  const builtBundleDir = resolveBuiltBundleDir(projectDir);
+  if (!builtBundleDir) {
+    throw usageError(
+      'Vite build did not produce app.js in .notis/output/bundle. Check your vite.config.ts.',
+    );
   }
+  normalizeBundleStylesheets(projectDir);
+
+  validateArtifactBoundary(readArtifactFiles(projectDir));
 
   // Generate manifest
   const manifest = generateManifest(appConfig, projectDir);
@@ -430,6 +575,8 @@ export function collectArtifactFiles(projectDir) {
     throw usageError('No build output found. Run "notis apps build" first.');
   }
 
+  validateArtifactBoundary(readArtifactFiles(projectDir));
+
   const files = {};
 
   function walk(dir, prefix) {
@@ -449,6 +596,143 @@ export function collectArtifactFiles(projectDir) {
   return files;
 }
 
+function shouldExcludeSourceEntry(name) {
+  return SOURCE_COPY_EXCLUDES.has(name) || name.startsWith('.env');
+}
+
+function readSourceFiles(projectDir) {
+  const files = {};
+
+  function walk(dir, prefix) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (shouldExcludeSourceEntry(entry.name) || entry.isSymbolicLink()) {
+        continue;
+      }
+      const fullPath = join(dir, entry.name);
+      const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(fullPath, relPath);
+      } else if (entry.isFile()) {
+        files[relPath] = readFileSync(fullPath);
+      }
+    }
+  }
+
+  walk(projectDir, '');
+  return files;
+}
+
+export function collectSourceFiles(projectDir) {
+  const files = readSourceFiles(projectDir);
+  const encoded = {};
+  for (const [relPath, content] of Object.entries(files)) {
+    encoded[relPath] = content.toString('base64');
+  }
+  return encoded;
+}
+
+function cleanTarPath(name) {
+  const cleaned = String(name || '').replace(/\\/g, '/').replace(/^\/+/, '');
+  const parts = cleaned.split('/').filter(Boolean);
+  if (!parts.length || parts.includes('..')) {
+    throw usageError(`Refusing to extract unsafe path from source archive: ${name}`);
+  }
+  return parts.join('/');
+}
+
+function extractTarGz(buffer, targetDir) {
+  const tar = gunzipSync(buffer);
+  let offset = 0;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    offset += 512;
+    if (header.every((byte) => byte === 0)) {
+      break;
+    }
+
+    const name = header.subarray(0, 100).toString('utf-8').replace(/\0.*$/, '');
+    const prefix = header.subarray(345, 500).toString('utf-8').replace(/\0.*$/, '');
+    const fullName = prefix ? `${prefix}/${name}` : name;
+    const sizeRaw = header.subarray(124, 136).toString('utf-8').replace(/\0.*$/, '').trim();
+    const size = Number.parseInt(sizeRaw || '0', 8);
+    const typeFlag = header[156];
+    const relPath = cleanTarPath(fullName);
+    const outputPath = join(targetDir, relPath);
+
+    if (typeFlag === 53) {
+      mkdirSync(outputPath, { recursive: true });
+    } else {
+      mkdirSync(dirname(outputPath), { recursive: true });
+      writeFileSync(outputPath, tar.subarray(offset, offset + size));
+    }
+
+    offset += Math.ceil(size / 512) * 512;
+  }
+}
+
+export async function pullAppSource({
+  apiBase,
+  jwt,
+  appId,
+  targetDir,
+  version = 'latest',
+  force = false,
+}) {
+  if (existsSync(targetDir) && readdirSync(targetDir).length > 0) {
+    if (!force) {
+      throw usageError(`Target directory is not empty: ${targetDir}. Pass --force to overwrite it.`);
+    }
+    rmSync(targetDir, { recursive: true, force: true });
+  }
+  mkdirSync(targetDir, { recursive: true });
+
+  const params = new URLSearchParams({ app_id: appId, version: String(version || 'latest') });
+  const response = await fetch(`${apiBase.replace(/\/$/, '')}/portal_apps/source?${params.toString()}`, {
+    headers: { Authorization: `Bearer ${jwt}` },
+  });
+  if (!response.ok) {
+    const data = await response.json().catch(() => ({}));
+    throw usageError(typeof data?.error === 'string' ? data.error : `Failed to pull app source (${response.status}).`);
+  }
+
+  const contentDisposition = response.headers.get('content-disposition') || '';
+  const versionMatch = /-v(\d+)\.tar\.gz/i.exec(contentDisposition);
+  const pulledVersion = versionMatch ? Number.parseInt(versionMatch[1], 10) : null;
+  extractTarGz(Buffer.from(await response.arrayBuffer()), targetDir);
+  writeLinkedState(targetDir, {
+    app_id: appId,
+    linked_at: new Date().toISOString(),
+  });
+
+  return { projectDir: targetDir, version: pulledVersion || version };
+}
+
+function readArtifactFiles(projectDir) {
+  const outputDir = join(projectDir, OUTPUT_DIR);
+  if (!existsSync(outputDir)) {
+    throw usageError('No build output found. Run "notis apps build" first.');
+  }
+
+  const files = {};
+
+  function walk(dir, prefix) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(fullPath, relPath);
+      } else {
+        files[relPath] = readFileSync(fullPath);
+      }
+    }
+  }
+
+  walk(outputDir, '');
+  return files;
+}
+
 // ---------------------------------------------------------------------------
 // Direct deploy (bypasses backend server)
 // ---------------------------------------------------------------------------
@@ -525,6 +809,46 @@ async function uploadToStorage(supabaseUrl, supabaseKey, bucket, storagePath, co
   }
 }
 
+async function ensureStorageBucket(supabaseUrl, supabaseKey, bucket, options = {}) {
+  const encodedBucket = encodeURIComponent(bucket);
+  const headers = {
+    'Authorization': `Bearer ${supabaseKey}`,
+    'apikey': supabaseKey,
+  };
+  const inspectResponse = await fetch(`${supabaseUrl}/storage/v1/bucket/${encodedBucket}`, {
+    headers,
+  });
+  if (inspectResponse.ok) {
+    return;
+  }
+  if (inspectResponse.status !== 404) {
+    const text = await inspectResponse.text().catch(() => '');
+    throw new Error(`Failed to inspect storage bucket ${bucket} (${inspectResponse.status}): ${text}`);
+  }
+
+  const createResponse = await fetch(`${supabaseUrl}/storage/v1/bucket`, {
+    method: 'POST',
+    headers: {
+      ...headers,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      id: bucket,
+      name: bucket,
+      public: Boolean(options.public),
+    }),
+  });
+  if (createResponse.ok) {
+    return;
+  }
+
+  const text = await createResponse.text().catch(() => '');
+  if (createResponse.status === 409 || /already exists|duplicate/i.test(text)) {
+    return;
+  }
+  throw new Error(`Failed to create storage bucket ${bucket} (${createResponse.status}): ${text}`);
+}
+
 /**
  * Get the current app manifest version from the apps table.
  */
@@ -582,14 +906,18 @@ const CONTENT_TYPE_MAP = {
 export async function directDeploy(projectDir, appId) {
   const { supabaseUrl, supabaseKey } = resolveSupabaseCredentials();
   const manifest = readManifest(projectDir);
+  const artifactFiles = readArtifactFiles(projectDir);
+  const sourceFiles = readSourceFiles(projectDir);
+  validateArtifactBoundary(artifactFiles);
 
   // Get current version and increment
   const { currentVersion } = await getAppCurrentVersion(supabaseUrl, supabaseKey, appId);
   const newVersion = currentVersion + 1;
 
   // Upload all files from the output directory
-  const outputDir = join(projectDir, OUTPUT_DIR);
   const bucket = 'app-code';
+  await ensureStorageBucket(supabaseUrl, supabaseKey, bucket, { public: false });
+  await ensureStorageBucket(supabaseUrl, supabaseKey, 'app-source', { public: false });
 
   async function uploadDir(dir, prefix) {
     const entries = readdirSync(dir, { withFileTypes: true });
@@ -608,7 +936,14 @@ export async function directDeploy(projectDir, appId) {
     }
   }
 
-  await uploadDir(outputDir, '');
+  await uploadDir(join(projectDir, OUTPUT_DIR), '');
+
+  for (const [relPath, content] of Object.entries(sourceFiles)) {
+    const ext = relPath.includes('.') ? `.${relPath.split('.').pop()}` : '';
+    const contentType = CONTENT_TYPE_MAP[ext] || 'application/octet-stream';
+    const storagePath = `${appId}/v${newVersion}/${relPath}`;
+    await uploadToStorage(supabaseUrl, supabaseKey, 'app-source', storagePath, content, contentType);
+  }
 
   // Update the app record -- include storage_prefix so the portal can resolve bundle URLs
   const storagePrefix = `${appId}/v${newVersion}/`;

package/src/runtime/cli-mode.generated.js

@@ -0,0 +1,4 @@
+// Auto-generated on npm publish.
+// Committed value is 'local' so in-repo runs target localhost.
+// scripts/set-cli-mode.js rewrites this to 'published' before the npm publish step.
+export const MODE = 'local';

package/src/runtime/cli-mode.js

@@ -0,0 +1,29 @@
+/**
+ * CLI mode detection for `notis apps dev`.
+ *
+ * The repo-local CLI package targets localhost; the published npm CLI package
+ * targets app.notis.ai. Mode is baked into `cli-mode.generated.js` at publish
+ * time — no runtime flag is needed (and none is exposed to end users, so a
+ * crafted env var can't trick a published CLI into opening a localhost portal
+ * that isn't running).
+ *
+ * The `NOTIS_CLI_MODE` env var is honored for internal testing only.
+ */
+
+import { MODE as BAKED_MODE } from './cli-mode.generated.js';
+
+export function getCliMode() {
+  const override = process.env.NOTIS_CLI_MODE;
+  if (override === 'local' || override === 'published') {
+    return override;
+  }
+  return BAKED_MODE === 'published' ? 'published' : 'local';
+}
+
+export function getDefaultApiBase(mode = getCliMode()) {
+  return mode === 'local' ? 'http://localhost:3001' : 'https://api.notis.ai';
+}
+
+export function getDefaultPortalOrigin(mode = getCliMode()) {
+  return mode === 'local' ? 'http://localhost:3000' : 'https://app.notis.ai';
+}

package/src/runtime/output.js

@@ -95,6 +95,7 @@ export class OutputManager {
   }
 
   emitSuccess({
+    ok = true,
     command,
     data = {},
     humanSummary,
@@ -105,7 +106,7 @@ export class OutputManager {
     renderHuman,
   }) {
     const envelope = {
-      ok: true,
+      ok: Boolean(ok),
       command,
       data,
       human_summary: humanSummary,
@@ -177,4 +178,3 @@ export class OutputManager {
 }
 
 export { formatTable };
-

package/src/runtime/ports.js

@@ -0,0 +1,15 @@
+import { createServer } from 'node:http';
+
+export async function getAvailablePort() {
+  const server = createServer();
+  await new Promise((resolvePromise, rejectPromise) => {
+    server.once('error', rejectPromise);
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', rejectPromise);
+      resolvePromise();
+    });
+  });
+  const { port } = server.address();
+  await new Promise((resolvePromise) => server.close(resolvePromise));
+  return port;
+}

package/src/runtime/profiles.js

@@ -12,6 +12,7 @@ const LOCAL_DEFAULT_API_BASES = new Set([
   'http://localhost:3001',
   'http://127.0.0.1:3001',
 ]);
+const LOCAL_API_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
 
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
@@ -29,6 +30,13 @@ export function normalizeConfig(rawConfig = {}) {
       profiles[name] = {
         jwt: typeof profile.jwt === 'string' ? profile.jwt : undefined,
         api_base: typeof profile.api_base === 'string' ? profile.api_base : undefined,
+        auth_mode: profile.auth_mode === 'dev_portal' ? profile.auth_mode : undefined,
+        refresh_token:
+          typeof profile.refresh_token === 'string' ? profile.refresh_token : undefined,
+        access_expires_at:
+          typeof profile.access_expires_at === 'number' ? profile.access_expires_at : undefined,
+        refresh_expires_at:
+          typeof profile.refresh_expires_at === 'number' ? profile.refresh_expires_at : undefined,
       };
     }
 
@@ -51,6 +59,12 @@ export function normalizeConfig(rawConfig = {}) {
       [DEFAULT_PROFILE]: {
         jwt: typeof raw.jwt === 'string' ? raw.jwt : undefined,
         api_base: typeof raw.api_base === 'string' ? raw.api_base : undefined,
+        auth_mode: raw.auth_mode === 'dev_portal' ? raw.auth_mode : undefined,
+        refresh_token: typeof raw.refresh_token === 'string' ? raw.refresh_token : undefined,
+        access_expires_at:
+          typeof raw.access_expires_at === 'number' ? raw.access_expires_at : undefined,
+        refresh_expires_at:
+          typeof raw.refresh_expires_at === 'number' ? raw.refresh_expires_at : undefined,
       },
     },
   };
@@ -90,6 +104,18 @@ export function ensureProfile(config, profileName) {
   return normalized;
 }
 
+function isLocalApiBase(value) {
+  if (typeof value !== 'string' || !value) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return ['http:', 'https:'].includes(parsed.protocol) && LOCAL_API_HOSTS.has(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
 export function getApiBase(config, profileName, override) {
   if (override) {
     return override;
@@ -103,12 +129,12 @@ export function getApiBase(config, profileName, override) {
   const conductorPort = Number.parseInt(process.env.CONDUCTOR_PORT || '', 10);
 
   // Conductor assigns dynamic local ports. When a workspace is running under
-  // Conductor, treat the legacy localhost:3001 profile value as stale and
-  // transparently retarget the CLI at the active backend port.
+  // Conductor, treat saved localhost profile values as stale and transparently
+  // retarget the CLI at the active backend port.
   if (
     Number.isInteger(conductorPort) &&
     conductorPort > 0 &&
-    (!profileApiBase || LOCAL_DEFAULT_API_BASES.has(profileApiBase))
+    (!profileApiBase || LOCAL_DEFAULT_API_BASES.has(profileApiBase) || isLocalApiBase(profileApiBase))
   ) {
     return `http://localhost:${conductorPort + 1}`;
   }
@@ -166,6 +192,7 @@ export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true }
   const profileName = getCurrentProfileName(config, globalOptions.profile);
   const apiBase = getApiBase(config, profileName, globalOptions.apiBase);
   const jwt = getJwt(config, profileName);
+  const profile = getProfile(config, profileName);
   const agentMode = isAgentMode(globalOptions);
   const nonInteractive = isNonInteractive(globalOptions);
   const outputMode = resolveOutputMode(globalOptions);
@@ -190,6 +217,10 @@ export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true }
     profileName,
     apiBase,
     jwt,
+    authMode: profile.auth_mode,
+    refreshToken: profile.refresh_token,
+    accessExpiresAt: profile.access_expires_at,
+    refreshExpiresAt: profile.refresh_expires_at,
     agentMode,
     nonInteractive,
     outputMode,