@notis_ai/cli 0.2.0-beta.95.1 → 0.2.0-beta.99.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.0-beta.95.1",
+  "version": "0.2.0-beta.99.1",
   "description": "Agent-first Notis CLI for apps and generic tool execution",
   "type": "module",
   "bin": {

package/skills/notis-cli/SKILL.md

@@ -239,6 +239,15 @@ Most importantly: if you do not currently have the tool you need, especially for
 
 ## Troubleshooting
 
+### CLI returns `auth_expired`
+
+Local CLI auth is renewed by Notis Desktop. In JSON/agent mode, follow the
+first hint exactly: on macOS it is an executable `open -a 'Notis'` (or
+`open -a 'Notis Beta'`) command when the owning desktop app is not running.
+Wait for the app to restore the signed-in session, then rerun the original
+command. Do not copy refresh tokens into commands or try to refresh the shared
+desktop session yourself.
+
 ### Deploy fails with "network_error" or "fetch failed"
 
 The backend server at `http://localhost:3001` is not running. Solutions:

package/src/command-specs/meta.js

@@ -1,5 +1,7 @@
 import { COMPOSIO_SEARCH_TOOLS, healthCheck, probeAuth } from './helpers.js';
 import { findCommandSpec, formatDescribe } from '../runtime/help.js';
+import { createExpiredAuthError } from '../runtime/desktop-auth.js';
+import { isJwtExpired } from '../runtime/profiles.js';
 
 async function doctorHandler(ctx) {
   const checks = {
@@ -9,7 +11,9 @@ async function doctorHandler(ctx) {
     tool_roundtrip: 'unknown',
   };
 
-  checks.auth = ctx.runtime.jwt ? 'configured' : 'missing';
+  checks.auth = ctx.runtime.jwt
+    ? (isJwtExpired(ctx.runtime.jwt) ? 'expired' : 'configured')
+    : 'missing';
 
   try {
     await healthCheck(ctx.runtime);
@@ -30,8 +34,10 @@ async function doctorHandler(ctx) {
   const hints = [];
   if (checks.auth === 'missing') {
     hints.push({ command: 'Open the Notis desktop app and sign in', reason: 'Configure CLI credentials' });
+  } else if (checks.auth === 'expired') {
+    hints.push(...createExpiredAuthError(ctx.runtime).hints);
   }
-  if (checks.health === 'error') {
+  if (checks.health === 'error' && checks.auth !== 'expired') {
     hints.push({ command: 'Open the Notis desktop app and sign in again', reason: 'Refresh local CLI configuration' });
   }
   if (checks.tool_roundtrip === 'error') {

package/src/runtime/desktop-auth.js

@@ -0,0 +1,93 @@
+import { CliError, EXIT_CODES } from './errors.js';
+
+function isPidRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+function quoteShellArgument(value) {
+  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
+}
+
+function defaultDesktopAppName(apiBase) {
+  try {
+    return new URL(apiBase).hostname === 'api-beta.notis.ai' ? 'Notis Beta' : 'Notis';
+  } catch {
+    return 'Notis';
+  }
+}
+
+export function getDesktopAuthRecovery(runtime) {
+  const desktopRunning = isPidRunning(runtime.desktopPid);
+  const appName = runtime.desktopAppName || defaultDesktopAppName(runtime.apiBase);
+  let command = 'Start the Notis desktop app';
+  if (process.platform === 'darwin') {
+    command = `open -a ${quoteShellArgument(appName)}`;
+  }
+
+  return {
+    desktopRunning,
+    appName,
+    hints: [
+      {
+        command,
+        reason: desktopRunning
+          ? `Bring ${appName} forward so it can renew CLI authentication, then retry`
+          : `Start ${appName} to renew expired CLI authentication, then retry`,
+      },
+      {
+        command: 'notis doctor',
+        reason: 'Retry the auth and API checks after the desktop app is ready',
+      },
+    ],
+  };
+}
+
+export function createExpiredAuthError(runtime) {
+  if (runtime.credentialSource === 'env') {
+    return new CliError({
+      code: 'auth_expired',
+      message: 'NOTIS_JWT is expired',
+      exitCode: EXIT_CODES.auth,
+      details: { credential_source: 'env' },
+      hints: [
+        {
+          command: 'Set NOTIS_JWT to a fresh token',
+          reason: 'The explicit environment credential overrides desktop-managed auth',
+        },
+      ],
+    });
+  }
+
+  const recovery = getDesktopAuthRecovery(runtime);
+  return new CliError({
+    code: 'auth_expired',
+    message: 'Notis CLI authentication has expired',
+    exitCode: EXIT_CODES.auth,
+    details: {
+      credential_source: 'desktop',
+      desktop_running: recovery.desktopRunning,
+      desktop_app_name: recovery.appName,
+    },
+    hints: recovery.hints,
+  });
+}
+
+export function createInvalidAuthHints(runtime) {
+  if (runtime?.credentialSource === 'env') {
+    return [
+      {
+        command: 'Set NOTIS_JWT to a fresh token',
+        reason: 'The explicit environment credential was rejected',
+      },
+    ];
+  }
+  return getDesktopAuthRecovery(runtime || {}).hints;
+}

package/src/runtime/profiles.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { CliError, EXIT_CODES } from './errors.js';
+import { getDesktopAuthRecovery } from './desktop-auth.js';
 
 export const CONFIG_DIR = join(homedir(), '.notis');
 export const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
@@ -37,6 +38,9 @@ export function normalizeConfig(rawConfig = {}) {
           typeof profile.access_expires_at === 'number' ? profile.access_expires_at : undefined,
         refresh_expires_at:
           typeof profile.refresh_expires_at === 'number' ? profile.refresh_expires_at : undefined,
+        desktop_app_name:
+          typeof profile.desktop_app_name === 'string' ? profile.desktop_app_name : undefined,
+        desktop_pid: typeof profile.desktop_pid === 'number' ? profile.desktop_pid : undefined,
       };
     }
 
@@ -65,6 +69,9 @@ export function normalizeConfig(rawConfig = {}) {
           typeof raw.access_expires_at === 'number' ? raw.access_expires_at : undefined,
         refresh_expires_at:
           typeof raw.refresh_expires_at === 'number' ? raw.refresh_expires_at : undefined,
+        desktop_app_name:
+          typeof raw.desktop_app_name === 'string' ? raw.desktop_app_name : undefined,
+        desktop_pid: typeof raw.desktop_pid === 'number' ? raw.desktop_pid : undefined,
       },
     },
   };
@@ -199,34 +206,30 @@ export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true }
   const timeoutMs = resolveTimeoutMs(globalOptions);
 
   if (requireAuth && !jwt) {
+    const recovery = getDesktopAuthRecovery({
+      apiBase,
+      desktopAppName: profile.desktop_app_name,
+      desktopPid: profile.desktop_pid,
+    });
     throw new CliError({
       code: 'auth_missing',
       message: `No JWT configured for profile ${profileName}`,
       exitCode: EXIT_CODES.auth,
-      hints: [
-        {
-          command: 'Open the Notis desktop app and sign in',
-          reason: 'Set NOTIS_JWT or sign in through the Notis desktop app',
-        },
-      ],
+      hints: recovery.hints,
     });
   }
 
-  // An explicit NOTIS_JWT is a complete credential override: use it verbatim and do
-  // NOT attempt a stored-profile dev_portal token refresh (whose refresh_token may be
-  // stale or belong to a different session). Without this, a long-lived shell with an
-  // expired profile refresh_token fails every command with invalid_grant even though
-  // the supplied NOTIS_JWT is valid.
+  // An explicit NOTIS_JWT is a complete credential override. Use it verbatim
+  // and never replace it with a token later synced by the desktop profile.
   const usingEnvJwt = Boolean(process.env.NOTIS_JWT);
   return {
     config,
     profileName,
     apiBase,
     jwt,
-    authMode: usingEnvJwt ? 'jwt' : profile.auth_mode,
-    refreshToken: usingEnvJwt ? undefined : profile.refresh_token,
-    accessExpiresAt: usingEnvJwt ? undefined : profile.access_expires_at,
-    refreshExpiresAt: usingEnvJwt ? undefined : profile.refresh_expires_at,
+    credentialSource: usingEnvJwt ? 'env' : 'profile',
+    desktopAppName: usingEnvJwt ? undefined : profile.desktop_app_name,
+    desktopPid: usingEnvJwt ? undefined : profile.desktop_pid,
     agentMode,
     nonInteractive,
     outputMode,
@@ -234,6 +237,25 @@ export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true }
   };
 }
 
+export function getJwtExpiration(jwt) {
+  if (typeof jwt !== 'string' || !jwt) {
+    return null;
+  }
+  try {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    return typeof payload.exp === 'number' ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+
+export function isJwtExpired(jwt, nowSeconds = Math.floor(Date.now() / 1000)) {
+  const expiration = getJwtExpiration(jwt);
+  return expiration !== null && expiration <= nowSeconds;
+}
+
 export function workspacePath(appId) {
   return join(WORKSPACE_DIR, appId);
 }

package/src/runtime/transport.js

@@ -3,11 +3,11 @@ import { createReadStream } from 'node:fs';
 import { CliError, EXIT_CODES } from './errors.js';
 import {
   DEFAULT_PROFILE,
-  ensureProfile,
   getProfile,
+  isJwtExpired,
   loadConfig,
-  saveConfig,
 } from './profiles.js';
+import { createExpiredAuthError, createInvalidAuthHints } from './desktop-auth.js';
 
 function escapeMultipartHeaderValue(value) {
   return String(value ?? '')
@@ -76,7 +76,7 @@ function createMultipartFileUpload(payload, bindingMetadata, fileBindings) {
   };
 }
 
-function normalizeBackendError(status, payload) {
+function normalizeBackendError(status, payload, runtime) {
   const backendError = payload?.error;
   const message =
     backendError?.message ||
@@ -91,10 +91,7 @@ function normalizeBackendError(status, payload) {
       message,
       exitCode: EXIT_CODES.auth,
       hints: [
-        {
-          command: 'Open the Notis desktop app and sign in',
-          reason: 'Open the Notis desktop app to refresh CLI auth, or set NOTIS_JWT',
-        },
+        ...createInvalidAuthHints(runtime),
       ],
       details: payload || {},
     });
@@ -145,46 +142,10 @@ function normalizeBackendError(status, payload) {
   });
 }
 
-function shouldAttemptDevPortalRefresh(runtime, { force = false } = {}) {
-  if (runtime.authMode !== 'dev_portal' || !runtime.refreshToken || !runtime.apiBase) {
-    return false;
-  }
-
-  if (force) {
-    return true;
-  }
-
-  if (typeof runtime.accessExpiresAt !== 'number' || runtime.accessExpiresAt <= 0) {
+function reloadJwtFromConfig(runtime) {
+  if (runtime.credentialSource === 'env') {
     return false;
   }
-
-  const thresholdSeconds = 60;
-  return runtime.accessExpiresAt - Math.floor(Date.now() / 1000) <= thresholdSeconds;
-}
-
-function persistDevPortalRuntimeAuth(runtime, session) {
-  const config = ensureProfile(loadConfig(), runtime.profileName || DEFAULT_PROFILE);
-  const profileName = runtime.profileName || DEFAULT_PROFILE;
-  config.current_profile = profileName;
-  config.profiles[profileName] = {
-    ...config.profiles[profileName],
-    jwt: session.access_token,
-    api_base: runtime.apiBase,
-    auth_mode: 'dev_portal',
-    refresh_token: session.refresh_token,
-    access_expires_at: session.access_expires_at,
-    refresh_expires_at: session.refresh_expires_at,
-  };
-  saveConfig(config);
-
-  runtime.jwt = session.access_token;
-  runtime.authMode = 'dev_portal';
-  runtime.refreshToken = session.refresh_token;
-  runtime.accessExpiresAt = session.access_expires_at;
-  runtime.refreshExpiresAt = session.refresh_expires_at;
-}
-
-function reloadJwtFromConfig(runtime) {
   const profileName = runtime.profileName || DEFAULT_PROFILE;
   let profile;
   try {
@@ -197,39 +158,8 @@ function reloadJwtFromConfig(runtime) {
     return false;
   }
   runtime.jwt = nextJwt;
-  runtime.authMode = profile.auth_mode;
-  runtime.refreshToken = profile.refresh_token;
-  runtime.accessExpiresAt = profile.access_expires_at;
-  runtime.refreshExpiresAt = profile.refresh_expires_at;
-  return true;
-}
-
-async function maybeRefreshDevPortalAuth(runtime, { force = false } = {}) {
-  if (!shouldAttemptDevPortalRefresh(runtime, { force })) {
-    return false;
-  }
-
-  const response = await fetch(`${runtime.apiBase}/portal_auth/dev-refresh`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'X-Notis-CLI-Version': runtime.cliVersion,
-    },
-    body: JSON.stringify({ refresh_token: runtime.refreshToken }),
-  });
-
-  let payload = null;
-  try {
-    payload = await response.json();
-  } catch {
-    payload = null;
-  }
-
-  if (!response.ok || !payload?.session?.access_token || !payload?.session?.refresh_token) {
-    throw normalizeBackendError(response.status, payload);
-  }
-
-  persistDevPortalRuntimeAuth(runtime, payload.session);
+  runtime.desktopAppName = profile.desktop_app_name;
+  runtime.desktopPid = profile.desktop_pid;
   return true;
 }
 
@@ -241,7 +171,14 @@ export async function httpRequest({
   multipart = false,
   requireAuth = true,
 }) {
-  await maybeRefreshDevPortalAuth(runtime);
+  // The desktop renderer is the single owner of the rotating Supabase refresh
+  // token. Each CLI request only consumes the newest access token it synced to
+  // disk, avoiding refresh-token races between independent CLI processes and
+  // the running desktop session.
+  reloadJwtFromConfig(runtime);
+  if (requireAuth && isJwtExpired(runtime.jwt)) {
+    throw createExpiredAuthError(runtime);
+  }
 
   let controller = new AbortController();
   let timeout = setTimeout(() => controller.abort(), runtime.timeoutMs);
@@ -298,8 +235,7 @@ export async function httpRequest({
     }
 
     if (response.status === 401) {
-      const refreshed = (await maybeRefreshDevPortalAuth(runtime, { force: true }))
-        || reloadJwtFromConfig(runtime);
+      const refreshed = reloadJwtFromConfig(runtime) && !isJwtExpired(runtime.jwt);
       if (refreshed) {
         if (requireAuth && runtime.jwt) {
           headers.Authorization = `Bearer ${runtime.jwt}`;
@@ -324,7 +260,10 @@ export async function httpRequest({
     clearTimeout(timeout);
 
     if (!response.ok) {
-      throw normalizeBackendError(response.status, payload);
+      if (response.status === 401 && isJwtExpired(runtime.jwt)) {
+        throw createExpiredAuthError(runtime);
+      }
+      throw normalizeBackendError(response.status, payload, runtime);
     }
 
     return {