@notis_ai/cli 0.2.0-beta.57.1 → 0.2.0-beta.92.1

package/config/notis_app_boundary_rules.json

@@ -0,0 +1,50 @@
+{
+  "javascript": [
+    {
+      "pattern": "window\\.__NOTIS_RUNTIME__",
+      "message": "window.__NOTIS_RUNTIME__ is forbidden; rely on the portal-injected NotisProvider runtime."
+    },
+    {
+      "pattern": "document\\.(?:body|head|documentElement)\\b",
+      "message": "document.body, document.head, and document.documentElement are forbidden; apps must stay inside the app surface."
+    },
+    {
+      "pattern": "document\\.(?:querySelector|querySelectorAll|getElementById|getElementsByClassName|getElementsByTagName)\\s*\\(\\s*(['\"`])[^\\n]*\\[data-notis-",
+      "message": "querying portal-owned [data-notis-*] hooks is forbidden."
+    },
+    {
+      "pattern": "createPortal\\s*\\(",
+      "message": "React portals are unsupported in Notis apps until a shadow-safe overlay contract exists."
+    },
+    {
+      "pattern": "@radix-ui/react-portal",
+      "message": "@radix-ui/react-portal is unsupported in Notis apps until a shadow-safe overlay contract exists."
+    },
+    {
+      "pattern": "PortalPrimitive",
+      "message": "Radix portal primitives are unsupported in Notis apps until a shadow-safe overlay contract exists."
+    }
+  ],
+  "css": [
+    {
+      "pattern": ":root\\b",
+      "message": ":root selectors are forbidden; styles must stay inside the app surface."
+    },
+    {
+      "pattern": "(^|[\\s,>+~])html(?=[\\s.#[:{>+~,]|$)",
+      "message": "html selectors are forbidden; styles must stay inside the app surface."
+    },
+    {
+      "pattern": "(^|[\\s,>+~])body(?=[\\s.#[:{>+~,]|$)",
+      "message": "body selectors are forbidden; styles must stay inside the app surface."
+    },
+    {
+      "pattern": "\\[data-notis-(?!app-root\\b)[^\\]]*\\]",
+      "message": "portal-owned [data-notis-*] selectors are forbidden. Use [data-notis-app-root] only for the app surface itself."
+    },
+    {
+      "pattern": "\\[data-sidebar(?:=[^\\]]+)?\\]",
+      "message": "portal sidebar selectors are forbidden."
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.0-beta.57.1",
+  "version": "0.2.0-beta.92.1",
   "description": "Agent-first Notis CLI for apps and generic tool execution",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "files": [
     "bin/",
+    "config/",
     "dist/",
     "src/",
     "skills/",
@@ -21,6 +22,7 @@
     "prepack": "npm run build",
     "release:prepare": "npm run build && node ./scripts/prepare-publish.js --apply",
     "cli:set-mode": "node ./scripts/set-cli-mode.js",
+    "smoke": "node ./scripts/smoke-package.js",
     "test": "node --test"
   },
   "engines": {

package/src/cli.js

@@ -1,10 +1,29 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { Command } from 'commander';
 import { COMMAND_SPECS, GROUP_SUMMARIES } from './command-specs/index.js';
 import { OutputManager } from './runtime/output.js';
 import { asCliError } from './runtime/errors.js';
 import { resolveRuntimeProfile, workspacePath } from './runtime/profiles.js';
 
-const CLI_VERSION = '0.2.0';
+// Read the version from package.json: the publish pipeline bumps the manifest
+// (scripts/release-utils.js applyVersion), so a hardcoded string here goes
+// stale on every release.
+function readCliVersion() {
+  try {
+    const manifestPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
+    const version = JSON.parse(readFileSync(manifestPath, 'utf-8')).version;
+    if (typeof version === 'string' && version.trim()) {
+      return version.trim();
+    }
+  } catch {
+    // Fall through to the placeholder below.
+  }
+  return '0.0.0';
+}
+
+const CLI_VERSION = readCliVersion();
 
 function buildHelpFooter(spec) {
   const lines = [

package/src/runtime/app-boundary-validator.js

@@ -4,10 +4,30 @@ import { fileURLToPath } from 'node:url';
 
 import { usageError } from './errors.js';
 
-const RULES_PATH = resolve(
-  dirname(fileURLToPath(import.meta.url)),
-  '../../../../server/config/notis_app_boundary_rules.json',
-);
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+
+// Candidate locations for the app boundary rules, in priority order:
+//  1. The monorepo server source (always fresh during local development).
+//  2. The copy bundled into the published package at build time (see
+//     scripts/copy-boundary-rules.js + package.json "files": config/). When the
+//     CLI is installed via npm, candidate 1 escapes the package and is absent,
+//     so the bundled copy is used. This is what was missing before: the package
+//     shipped only the escaping path and crashed with ENOENT on any command.
+export const RULES_PATH_CANDIDATES = [
+  resolve(moduleDir, '../../../../server/config/notis_app_boundary_rules.json'),
+  resolve(moduleDir, '../../config/notis_app_boundary_rules.json'),
+];
+
+export function resolveRulesPath() {
+  for (const candidate of RULES_PATH_CANDIDATES) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  // Fall back to the bundled-copy path so any error message points inside the
+  // package rather than at an escaping monorepo path.
+  return RULES_PATH_CANDIDATES[RULES_PATH_CANDIDATES.length - 1];
+}
 
 const SOURCE_FILE_EXTENSIONS = new Set(['.js', '.jsx', '.ts', '.tsx', '.css', '.scss', '.sass', '.pcss']);
 const IGNORED_SOURCE_DIRS = new Set([
@@ -20,20 +40,50 @@ const IGNORED_SOURCE_DIRS = new Set([
   'coverage',
 ]);
 
-function loadBoundaryRules() {
-  return JSON.parse(readFileSync(RULES_PATH, 'utf-8'));
-}
-
 function compileRules(entries) {
-  return (entries || []).map((entry) => ({
+  // Tolerate a rules object whose javascript/css field is a non-array (a corrupt
+  // file can parse to {"javascript":"x"}); coerce anything non-array to [] so
+  // getCompiledRules degrades to an empty rule set instead of throwing on .map.
+  return (Array.isArray(entries) ? entries : []).map((entry) => ({
     regex: new RegExp(entry.pattern, 'm'),
     message: entry.message,
   }));
 }
 
-const boundaryRules = loadBoundaryRules();
-const javascriptRules = compileRules(boundaryRules.javascript);
-const cssRules = compileRules(boundaryRules.css);
+// Loaded lazily on first validation rather than at module import time: a
+// missing rules file must not prevent the whole CLI from booting (every
+// command imports this module transitively). The server re-validates on
+// save/deploy, so an empty client-side rule set degrades gracefully.
+let compiledRules = null;
+
+function getCompiledRules() {
+  if (compiledRules) {
+    return compiledRules;
+  }
+  let boundaryRules = { javascript: [], css: [] };
+  try {
+    const parsed = JSON.parse(readFileSync(resolveRulesPath(), 'utf-8'));
+    // Keep the safe default unless the file is a real rules object: a valid but
+    // non-object payload (null, a number, an array) would otherwise throw on the
+    // `.javascript`/`.css` deref below, reintroducing the boot crash this guards.
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      boundaryRules = parsed;
+    } else {
+      process.stderr.write(
+        'Warning: Notis app boundary rules are not a rules object; skipping local boundary checks.\n',
+      );
+    }
+  } catch (error) {
+    process.stderr.write(
+      `Warning: could not load Notis app boundary rules (${error.message}); skipping local boundary checks.\n`,
+    );
+  }
+  compiledRules = {
+    javascript: compileRules(boundaryRules.javascript),
+    css: compileRules(boundaryRules.css),
+  };
+  return compiledRules;
+}
 
 function collectProjectFiles(projectDir, dir, results) {
   if (!existsSync(dir)) {
@@ -81,11 +131,12 @@ function applyRules(content, rules, relPath) {
 
 function validateTextFile(relPath, content) {
   const extension = extname(relPath);
+  const rules = getCompiledRules();
   if (extension === '.css' || extension === '.scss' || extension === '.sass' || extension === '.pcss') {
-    return applyRules(content, cssRules, relPath);
+    return applyRules(content, rules.css, relPath);
   }
   if (extension === '.js' || extension === '.jsx' || extension === '.ts' || extension === '.tsx') {
-    return applyRules(content, javascriptRules, relPath);
+    return applyRules(content, rules.javascript, relPath);
   }
   return [];
 }