@notis_ai/cli 0.2.0-beta.76.1 → 0.2.0-beta.95.1

package/src/runtime/app-boundary-validator.js

@@ -40,20 +40,50 @@ const IGNORED_SOURCE_DIRS = new Set([
   'coverage',
 ]);
 
-function loadBoundaryRules() {
-  return JSON.parse(readFileSync(resolveRulesPath(), 'utf-8'));
-}
-
 function compileRules(entries) {
-  return (entries || []).map((entry) => ({
+  // Tolerate a rules object whose javascript/css field is a non-array (a corrupt
+  // file can parse to {"javascript":"x"}); coerce anything non-array to [] so
+  // getCompiledRules degrades to an empty rule set instead of throwing on .map.
+  return (Array.isArray(entries) ? entries : []).map((entry) => ({
     regex: new RegExp(entry.pattern, 'm'),
     message: entry.message,
   }));
 }
 
-const boundaryRules = loadBoundaryRules();
-const javascriptRules = compileRules(boundaryRules.javascript);
-const cssRules = compileRules(boundaryRules.css);
+// Loaded lazily on first validation rather than at module import time: a
+// missing rules file must not prevent the whole CLI from booting (every
+// command imports this module transitively). The server re-validates on
+// save/deploy, so an empty client-side rule set degrades gracefully.
+let compiledRules = null;
+
+function getCompiledRules() {
+  if (compiledRules) {
+    return compiledRules;
+  }
+  let boundaryRules = { javascript: [], css: [] };
+  try {
+    const parsed = JSON.parse(readFileSync(resolveRulesPath(), 'utf-8'));
+    // Keep the safe default unless the file is a real rules object: a valid but
+    // non-object payload (null, a number, an array) would otherwise throw on the
+    // `.javascript`/`.css` deref below, reintroducing the boot crash this guards.
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      boundaryRules = parsed;
+    } else {
+      process.stderr.write(
+        'Warning: Notis app boundary rules are not a rules object; skipping local boundary checks.\n',
+      );
+    }
+  } catch (error) {
+    process.stderr.write(
+      `Warning: could not load Notis app boundary rules (${error.message}); skipping local boundary checks.\n`,
+    );
+  }
+  compiledRules = {
+    javascript: compileRules(boundaryRules.javascript),
+    css: compileRules(boundaryRules.css),
+  };
+  return compiledRules;
+}
 
 function collectProjectFiles(projectDir, dir, results) {
   if (!existsSync(dir)) {
@@ -101,11 +131,12 @@ function applyRules(content, rules, relPath) {
 
 function validateTextFile(relPath, content) {
   const extension = extname(relPath);
+  const rules = getCompiledRules();
   if (extension === '.css' || extension === '.scss' || extension === '.sass' || extension === '.pcss') {
-    return applyRules(content, cssRules, relPath);
+    return applyRules(content, rules.css, relPath);
   }
   if (extension === '.js' || extension === '.jsx' || extension === '.ts' || extension === '.tsx') {
-    return applyRules(content, javascriptRules, relPath);
+    return applyRules(content, rules.javascript, relPath);
   }
   return [];
 }

package/src/runtime/app-dev-server.js

@@ -25,13 +25,17 @@ import {
   loadAppConfig,
   prepareArtifactBuild,
   readManifest,
+  readLinkedState,
+  writeLinkedState,
 } from './app-platform.js';
+import { linkAppDevSessionTarget } from './app-dev-sessions.js';
 
 const CONTENT_TYPES = {
   '.js': 'application/javascript; charset=utf-8',
   '.css': 'text/css; charset=utf-8',
   '.map': 'application/json; charset=utf-8',
 };
+const MAX_JSON_BODY_BYTES = 64 * 1024;
 const RUNTIME_DIR = dirname(fileURLToPath(import.meta.url));
 const CLI_ROOT = resolve(RUNTIME_DIR, '../..');
 const REPO_ROOT = resolve(RUNTIME_DIR, '../../../..');
@@ -59,7 +63,7 @@ function corsHeaders(origin) {
   const allowOrigin = origin && isAllowedOrigin(origin) ? origin : '*';
   return {
     'Access-Control-Allow-Origin': allowOrigin,
-    'Access-Control-Allow-Methods': 'GET, OPTIONS',
+    'Access-Control-Allow-Methods': 'GET, HEAD, POST, OPTIONS',
     'Access-Control-Allow-Headers': 'Content-Type, Cache-Control',
     'Cache-Control': 'no-store',
   };
@@ -97,6 +101,32 @@ function readJsonFile(path) {
   }
 }
 
+function readRequestJson(req) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    let body = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => {
+      body += chunk;
+      if (Buffer.byteLength(body, 'utf8') > MAX_JSON_BODY_BYTES) {
+        rejectPromise(new Error('request body too large'));
+        req.destroy();
+      }
+    });
+    req.on('end', () => {
+      if (!body.trim()) {
+        resolvePromise({});
+        return;
+      }
+      try {
+        resolvePromise(JSON.parse(body));
+      } catch {
+        rejectPromise(new Error('invalid JSON body'));
+      }
+    });
+    req.on('error', rejectPromise);
+  });
+}
+
 function reactVersionFromPeer(peerRange) {
   if (typeof peerRange !== 'string' || !peerRange) {
     return FALLBACK_REACT_VERSION;
@@ -243,7 +273,7 @@ function renderHarnessHtml({ state, manifest, appConfig, route, harnessOptions }
 /**
  * Start the dev server for one or more apps.
  *
- * @param {{apps: Array<{slug: string, projectDir: string, appId?: string, userId?: string}>, port: number, watch?: boolean, harness?: { mode?: string, apiBase?: string, jwt?: string }, log?: (m: string) => void, logError?: (m: string) => void}} options
+ * @param {{apps: Array<{slug: string, projectDir: string, appId?: string, targetAppId?: string, userId?: string}>, port: number, watch?: boolean, harness?: { mode?: string, apiBase?: string, jwt?: string }, log?: (m: string) => void, logError?: (m: string) => void}} options
  */
 export async function startAppDevServer({
   apps,
@@ -263,6 +293,7 @@ export async function startAppDevServer({
       slug: app.slug,
       projectDir: app.projectDir,
       appId: app.appId || null,
+      targetAppId: app.targetAppId || null,
       userId: app.userId || null,
       canonicalBundleDir: getBundleDir(app.projectDir),
       bundleDir: null,
@@ -385,6 +416,63 @@ export async function startAppDevServer({
     }
 
     if (req.method !== 'GET' && req.method !== 'HEAD') {
+      if (req.method === 'POST') {
+        const routed = matchAppRoute(url.pathname);
+        const state = routed ? appState.get(routed.slug) : null;
+        if (state && routed.rest === 'link') {
+          void (async () => {
+            try {
+              const body = await readRequestJson(req);
+              const appId = typeof body.app_id === 'string' ? body.app_id.trim() : '';
+              if (!appId) {
+                res.writeHead(400, {
+                  ...headers,
+                  'Content-Type': 'application/json; charset=utf-8',
+                });
+                res.end(JSON.stringify({ error: 'app_id is required' }));
+                return;
+              }
+
+              const currentState = readLinkedState(state.projectDir) || {};
+              const now = new Date().toISOString();
+              writeLinkedState(state.projectDir, {
+                ...currentState,
+                app_id: appId,
+                dev_app_id: state.appId || currentState.dev_app_id,
+                linked_at: currentState.linked_at || now,
+                dev_linked_at: currentState.dev_linked_at || now,
+                updated_at: now,
+              });
+              state.targetAppId = appId;
+              linkAppDevSessionTarget({
+                appId: state.appId,
+                devSlug: state.slug,
+                targetAppId: appId,
+                lastHeartbeatAt: now,
+              });
+              const response = {
+                ok: true,
+                app_id: appId,
+                dev_app_id: state.appId || null,
+                target_app_id: appId,
+              };
+              res.writeHead(200, {
+                ...headers,
+                'Content-Type': 'application/json; charset=utf-8',
+              });
+              res.end(JSON.stringify(response));
+            } catch (error) {
+              const message = error instanceof Error ? error.message : String(error);
+              res.writeHead(400, {
+                ...headers,
+                'Content-Type': 'application/json; charset=utf-8',
+              });
+              res.end(JSON.stringify({ error: message }));
+            }
+          })();
+          return;
+        }
+      }
       res.writeHead(405, headers);
       res.end('method not allowed');
       return;
@@ -394,6 +482,7 @@ export async function startAppDevServer({
       const now = new Date().toISOString();
       const sessions = Array.from(appState.values()).map((state) => ({
         appId: state.appId,
+        targetAppId: state.targetAppId || undefined,
         userId: state.userId,
         devSlug: state.slug,
         bundleBaseUrl: `http://127.0.0.1:${port}/a/${state.slug}`,
@@ -446,6 +535,7 @@ export async function startAppDevServer({
         const manifest = readManifest(state.projectDir);
         const payload = {
           app_id: state.appId,
+          target_app_id: state.targetAppId || null,
           dev_slug: state.slug,
           manifest,
           files: collectArtifactFiles(state.projectDir),

package/src/runtime/app-dev-sessions.js

@@ -1,33 +1,78 @@
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { dirname, join, parse as parsePath } from 'node:path';
 import { CONFIG_DIR } from './profiles.js';
 
 export const DEFAULT_APP_DEV_SESSIONS_FILE = join(CONFIG_DIR, 'app-dev-sessions.json');
 export const APP_DEV_SESSIONS_FILE = DEFAULT_APP_DEV_SESSIONS_FILE;
 export const APP_DEV_SESSIONS_VERSION = 1;
 
+/**
+ * Walk up from `startDir` looking for a workspace-scoped dev-sessions registry.
+ *
+ * The Notis desktop (and Conductor) reads a PER-WORKSPACE registry at
+ * `<workspace>/.context/app-dev-sessions.json` (it points its own `apps dev`
+ * at it via `NOTIS_APP_DEV_SESSIONS_FILE`). When a coding agent runs
+ * `apps dev` manually it does not inherit that env var, so its session would
+ * otherwise land in the global `~/.notis` registry and never appear in the
+ * desktop's Local development sidebar. Resolving the nearest `.context`
+ * registry keeps agent-run and desktop-run sessions in the same file.
+ *
+ * Returns the registry path if a `.context/` directory is found in `startDir`
+ * or an ancestor (stopping at the home directory / filesystem root), else null.
+ */
+export function findWorkspaceAppDevSessionsFile(startDir = process.cwd()) {
+  let dir = startDir;
+  const home = homedir();
+  const { root } = parsePath(dir);
+  // Bounded walk; `.context` lives at the workspace root, never above $HOME.
+  for (let depth = 0; depth < 64; depth += 1) {
+    if (existsSync(join(dir, '.context'))) {
+      return join(dir, '.context', 'app-dev-sessions.json');
+    }
+    if (dir === home || dir === root) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
 export function getAppDevSessionsFile(filePath) {
   if (filePath) {
     return filePath;
   }
   const envPath = process.env.NOTIS_APP_DEV_SESSIONS_FILE;
-  return typeof envPath === 'string' && envPath.trim()
-    ? envPath.trim()
-    : DEFAULT_APP_DEV_SESSIONS_FILE;
+  if (typeof envPath === 'string' && envPath.trim()) {
+    return envPath.trim();
+  }
+  const workspaceFile = findWorkspaceAppDevSessionsFile();
+  if (workspaceFile) {
+    return workspaceFile;
+  }
+  return DEFAULT_APP_DEV_SESSIONS_FILE;
 }
 
 function normalizeSessions(raw) {
   if (!raw || typeof raw !== 'object' || !Array.isArray(raw.sessions)) {
     return [];
   }
-  return raw.sessions.filter((session) =>
-    session &&
-    typeof session === 'object' &&
-    typeof session.sessionId === 'string' &&
-    typeof session.appId === 'string' &&
-    typeof session.bundleBaseUrl === 'string',
-  );
+  return raw.sessions
+    .filter((session) =>
+      session &&
+      typeof session === 'object' &&
+      typeof session.sessionId === 'string' &&
+      typeof session.appId === 'string' &&
+      typeof session.bundleBaseUrl === 'string',
+    )
+    .map((session) => {
+      if (typeof session.targetAppId === 'string' && session.targetAppId.trim()) {
+        return { ...session, targetAppId: session.targetAppId.trim() };
+      }
+      const { targetAppId: _targetAppId, ...rest } = session;
+      return rest;
+    });
 }
 
 export function readAppDevSessions(filePath) {
@@ -80,6 +125,27 @@ export function heartbeatAppDevSession(sessionId, lastHeartbeatAt, filePath) {
   return writeAppDevSessions(registry, filePath);
 }
 
+export function linkAppDevSessionTarget({ appId, devSlug, targetAppId, lastHeartbeatAt = new Date().toISOString() }, filePath) {
+  const target = typeof targetAppId === 'string' ? targetAppId.trim() : '';
+  if (!target) {
+    return readAppDevSessions(filePath);
+  }
+  const registry = readAppDevSessions(filePath);
+  registry.sessions = registry.sessions.map((session) => {
+    const matchesApp = appId && session.appId === appId;
+    const matchesSlug = devSlug && session.devSlug === devSlug;
+    if (!matchesApp || !matchesSlug) {
+      return session;
+    }
+    return {
+      ...session,
+      targetAppId: target,
+      lastHeartbeatAt,
+    };
+  });
+  return writeAppDevSessions(registry, filePath);
+}
+
 export function removeAppDevSession(sessionId, filePath) {
   const registry = readAppDevSessions(filePath);
   registry.sessions = registry.sessions.filter((session) => session.sessionId !== sessionId);

package/src/runtime/app-platform.js

@@ -324,10 +324,6 @@ function imageAssetMeta(projectDir, relPath, { maxBytes, recommendedRatio = 1.6
 
 export function discoverMetadataAssets(projectDir) {
   const metadataDir = join(projectDir, METADATA_DIR);
-  const coverPath = join(METADATA_DIR, 'cover.png');
-  const cover = existsSync(join(projectDir, coverPath))
-    ? imageAssetMeta(projectDir, coverPath, { maxBytes: 5 * 1024 * 1024 })
-    : null;
   const screenshots = [];
 
   if (existsSync(metadataDir)) {
@@ -346,7 +342,6 @@ export function discoverMetadataAssets(projectDir) {
 
   screenshots.sort((a, b) => a.index - b.index);
   return {
-    cover,
     screenshots: screenshots.slice(0, 6),
   };
 }
@@ -364,14 +359,8 @@ export function inspectListingReadiness(projectDir, appConfig = null) {
   if (categories.length === 0) {
     warnings.push(`Listing category missing in notis.config.ts. Use one of: ${NOTIS_APP_CATEGORIES.join(', ')}.`);
   }
-  if (!metadata.cover) {
-    warnings.push('Listing cover missing at metadata/cover.png.');
-  } else {
-    errors.push(...metadata.cover.errors);
-    warnings.push(...metadata.cover.warnings);
-  }
   if (metadata.screenshots.length < 3) {
-    warnings.push(`Listing screenshots: ${metadata.screenshots.length}/3 minimum in metadata/screenshot-N.png.`);
+    warnings.push(`Listing screenshots: ${metadata.screenshots.length}/3 minimum in metadata/screenshot-N.png. Run \`notis apps screenshot\` to generate them.`);
   }
   for (const screenshot of metadata.screenshots) {
     errors.push(...screenshot.errors);
@@ -379,7 +368,7 @@ export function inspectListingReadiness(projectDir, appConfig = null) {
   }
 
   return {
-    ready: errors.length === 0 && Boolean(config.tagline) && categories.length > 0 && Boolean(metadata.cover) && metadata.screenshots.length >= 1,
+    ready: errors.length === 0 && Boolean(config.tagline) && categories.length > 0 && metadata.screenshots.length >= 1,
     warnings,
     errors,
     metadata,
@@ -621,15 +610,6 @@ export function generateManifest(appConfig, projectDir) {
   const appSlug = safeKebab(appConfig.name);
   const displayTitle = appConfig.title || appConfig.displayName || appConfig.name;
   const listingMedia = {
-    cover: metadata.cover
-      ? {
-          path: metadata.cover.path,
-          content_type: metadata.cover.content_type,
-          width: metadata.cover.width,
-          height: metadata.cover.height,
-          bytes: metadata.cover.bytes,
-        }
-      : null,
     screenshots: metadata.screenshots.map((screenshot) => ({
       path: screenshot.path,
       content_type: screenshot.content_type,
@@ -647,6 +627,7 @@ export function generateManifest(appConfig, projectDir) {
       slug: appSlug || null,
       description: appConfig.description || null,
       icon: appConfig.icon || null,
+      accent: appConfig.accent || null,
       title: displayTitle,
       tagline: appConfig.tagline || null,
       categories,
@@ -721,7 +702,7 @@ function copyMetadataAssets(projectDir) {
   mkdirSync(outputMetadataDir, { recursive: true });
   for (const entry of readdirSync(metadataDir, { withFileTypes: true })) {
     if (!entry.isFile()) continue;
-    if (entry.name !== 'cover.png' && !/^screenshot-\d+\.png$/i.test(entry.name)) {
+    if (!/^screenshot-\d+\.png$/i.test(entry.name)) {
       continue;
     }
     cpSync(join(metadataDir, entry.name), join(outputMetadataDir, entry.name));
@@ -1259,6 +1240,7 @@ async function updateAppVersion(supabaseUrl, supabaseKey, appId, newVersion, man
     },
     body: JSON.stringify({
       manifest: { ...manifest, version: newVersion },
+      accent: manifest?.app?.accent ?? null,
       updated_at: new Date().toISOString(),
     }),
   });