@notis_ai/cli 0.2.13 → 0.2.15

package/src/command-specs/onboarding.js

@@ -11,6 +11,8 @@ import {
 } from '../runtime/profiles.js';
 import { ensureFreshOAuthCredential, loginWithOAuth } from '../runtime/oauth.js';
 import { runToolCommand } from './helpers.js';
+import { loginAgentAuthorizationPresentation } from './auth.js';
+import { installLocalAgentContext } from './agents.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const BUNDLED_BRIEF_PATH = join(HERE, '..', '..', 'skills', 'notis-onboarding', 'BRIEF.md');
@@ -86,6 +88,44 @@ function isAuthenticated(runtime) {
     && !credentialIsExpired(runtime, getProfile(loadConfig(), runtime.profileName));
 }
 
+function renderAgentSetup(results) {
+  const configured = (results || []).filter((result) => result?.agent && result?.instructions);
+  if (!configured.length) return '';
+  const lines = configured.map((result) => {
+    const label = result.agent === 'claude-code' ? 'Claude Code' : 'Codex';
+    const instructions = result.instructions?.status || 'skipped';
+    const memoryStatus = result.memory_hook?.status || 'skipped';
+    const memory = memoryStatus === 'preserved'
+      ? 'memory hooks not changed'
+      : `memory recall and capture ${memoryStatus}`;
+    return `- ${label}: instructions ${instructions}; ${memory}`;
+  });
+  if (configured.some((result) => (
+    result.agent === 'codex'
+    && ['installed', 'updated', 'unchanged'].includes(result.memory_hook?.status)
+  ))) {
+    lines.push('- Codex: open /hooks once and trust the Notis hooks before they can run.');
+  }
+  return ['## Coding-agent setup', ...lines].join('\n');
+}
+
+function agentSetupHints(results) {
+  const hints = [];
+  if ((results || []).some((result) => (
+    result.agent === 'codex'
+    && ['installed', 'updated', 'unchanged'].includes(result.memory_hook?.status)
+  ))) {
+    hints.push({ message: 'In Codex, open /hooks once and trust the Notis hooks.' });
+  }
+  if ((results || []).some((result) => result.status === 'not_detected')) {
+    hints.push({ command: 'notis agents install', reason: 'Configure Codex and Claude Code later if they were not detected now' });
+  }
+  if ((results || []).some((result) => result.memory_hook?.status === 'preserved')) {
+    hints.push({ command: 'notis agents install', reason: 'Explicitly enable Notis memory recall and completed-turn capture' });
+  }
+  return hints;
+}
+
 /**
  * What an authenticated `start` reports.
  *
@@ -105,9 +145,20 @@ async function authenticatedResult(ctx) {
     onboarding_complete: onboardingComplete,
     ...(state ? { known_settings: state.settings, missing_settings: state.missingSettings } : {}),
   };
+  try {
+    base.agent_setup = installLocalAgentContext(ctx, {
+      onlyExisting: true,
+      memoryHooks: null,
+    });
+  } catch {
+    // Authentication and onboarding remain usable if a local vendor config is
+    // malformed or read-only. `notis agents install` reports the exact path.
+    base.agent_setup = [];
+  }
 
   if (onboardingComplete) {
     const name = state?.settings?.full_name;
+    const setupSummary = renderAgentSetup(base.agent_setup);
     return ctx.output.emitSuccess({
       command: 'start',
       data: { ...base, brief: null, brief_source: null },
@@ -120,20 +171,27 @@ async function authenticatedResult(ctx) {
           '',
           'This account has already completed onboarding. Do not run an onboarding',
           'flow and do not call LOCAL_NOTIS_COMPLETE_TUTORIAL.',
+          ...(setupSummary ? ['', setupSummary] : []),
         ].join('\n'),
       hints: [
         { command: 'notis whoami', reason: 'Show the account and its connected toolkits' },
         { command: 'notis tools search "<what you need>"', reason: 'Find a tool and get on with the task' },
+        ...agentSetupHints(base.agent_setup),
       ],
     });
   }
 
   const brief = await fetchBrief(ctx.runtime.apiBase, ctx.runtime.timeoutMs);
+  const setupSummary = renderAgentSetup(base.agent_setup);
   return ctx.output.emitSuccess({
     command: 'start',
     data: { ...base, brief: brief.markdown, brief_source: brief.source },
     humanSummary: `Notis CLI is authenticated for profile "${ctx.runtime.profileName}". Onboarding is not complete.`,
-    renderHuman: () => brief.markdown || 'Notis CLI is authenticated.',
+    renderHuman: () => [
+      brief.markdown || 'Notis CLI is authenticated.',
+      setupSummary,
+    ].filter(Boolean).join('\n\n'),
+    hints: agentSetupHints(base.agent_setup),
   });
 }
 
@@ -166,8 +224,13 @@ async function startHandler(ctx) {
   // Browser authorization is the whole signup path: it creates the account when
   // the address is new and authorizes this machine either way. There is nothing
   // for the CLI to collect up front, and nothing to wait on afterwards.
-  const authorization = await loginWithOAuth(runtime, { browser: true }, output);
+  const authorization = await loginWithOAuth(
+    runtime,
+    { browser: true, mode: options.mode, reusePersistedCredential: true },
+    output,
+  );
   if (authorization?.agentAuthorization) {
+    const presentation = loginAgentAuthorizationPresentation(authorization.agentAuthorization);
     return output.emitSuccess({
       command: 'start',
       data: {
@@ -175,8 +238,7 @@ async function startHandler(ctx) {
         profile: runtime.profileName,
         ...authorization.agentAuthorization,
       },
-      humanSummary: 'Open the authorization URL to create or access the Notis account.',
-      renderHuman: () => `Authorize Notis CLI: ${authorization.agentAuthorization.authorize_url}`,
+      ...presentation,
     });
   }
 
@@ -205,16 +267,18 @@ export const onboardingCommandSpecs = [
       arguments: [],
       options: [
         { flags: '--brief-only', description: 'Print the onboarding brief for an already-signed-in profile.' },
+        { flags: '--mode <mode>', description: 'auto (default) hands the browser callback to a background listener when this command cannot wait; browser waits in-process; code shows a one-time code to copy.' },
       ],
     },
     examples: [
       'notis start',
       'notis start --profile work',
+      'notis start --mode browser',
       'notis start --brief-only',
       'notis start --json',
     ],
     output_schema:
-      'Returns {authenticated, profile, api_base, onboarding_complete, known_settings, missing_settings, brief, brief_source} once signed in — brief is null when onboarding_complete is true — or {authorize_url, expires_in, redeem_command} while waiting for browser authorization.',
+      'Returns {authenticated, profile, api_base, onboarding_complete, known_settings, missing_settings, agent_setup, brief, brief_source} once signed in — brief is null when onboarding_complete is true — or {authorize_url, expires_in, hand_off, ...} while waiting for browser authorization. hand_off is "browser_callback" when signing in finishes the login by itself (re-run confirm_command to see it land) or "code" when the user must be asked for the code the page shows and it redeemed with redeem_command.',
     mutates: true,
     idempotent: true,
     require_auth: false,

package/src/command-specs/skills.js

@@ -0,0 +1,56 @@
+import { getJwtSubject } from '../runtime/profiles.js';
+import { reconcileAllSkills } from '../runtime/sync-skills.js';
+
+async function loadSkillSyncEngine() {
+  return import('../../dist/skill-sync/index.js');
+}
+
+async function syncSkillsHandler(ctx) {
+  const userId = ctx.runtime.oauthUserId || getJwtSubject(ctx.runtime.jwt);
+  const { runSkillSync } = await loadSkillSyncEngine();
+  const result = await reconcileAllSkills({
+    serverUrl: ctx.runtime.apiBase,
+    jwt: ctx.runtime.jwt,
+    userId,
+    honorSyncEnabled: Boolean(ctx.options.electronRepeat),
+    runAccountSync: runSkillSync,
+  });
+
+  return ctx.output.emitSuccess({
+    command: 'skills sync',
+    data: result,
+    humanSummary: result.syncEnabled
+      ? `Synced account skills and kept ${result.baseSkills.length} base skills current.`
+      : `Automatic Desktop sync is off; kept ${result.baseSkills.length} base skills current.`,
+    renderHuman: () => result.syncEnabled
+      ? `Skills synced. Base skills current: ${result.baseSkills.join(', ')}.`
+      : `Automatic Desktop sync is off. Base skills remain current: ${result.baseSkills.join(', ')}.`,
+  });
+}
+
+export const skillsCommandSpecs = [
+  {
+    command_path: ['skills', 'sync'],
+    summary: 'Synchronize account skills and keep the three Notis base skills current.',
+    when_to_use:
+      'Run manually whenever local agent skills should be reconciled. Manual runs ignore the Desktop automatic-sync preference.',
+    args_schema: {
+      arguments: [],
+      options: [
+        {
+          flags: '--electron-repeat',
+          description: 'Honor the automatic Desktop sync preference (used by Notis Desktop).',
+        },
+      ],
+    },
+    examples: ['notis skills sync', 'notis skills sync --json'],
+    output_schema:
+      'Returns account sync counts plus baseSkills, baseInstalled, baseLinked, and baseBackups.',
+    mutates: true,
+    idempotent: true,
+    require_auth: true,
+    related_commands: ['notis login', 'notis start', 'notis doctor'],
+    backend_call: { type: 'local', name: 'skill_sync' },
+    handler: syncSkillsHandler,
+  },
+];

package/src/command-specs/tools.js

@@ -2,6 +2,7 @@ import { accessSync, constants as fsConstants, createReadStream, existsSync, rea
 import { createHash } from 'node:crypto';
 import { basename } from 'node:path';
 import { usageError } from '../runtime/errors.js';
+import { assertToolNotDelegated } from '../runtime/delegated-context.js';
 import {
   COMPOSIO_GET_TOOL_SCHEMAS,
   COMPOSIO_MULTI_EXECUTE_TOOL,
@@ -380,6 +381,9 @@ async function toolsDescribeHandler(ctx) {
 
 async function toolsExecHandler(ctx) {
   const requestedToolName = localNotisToolSlug(ctx.args.toolName);
+  // `tools exec` is the escape hatch around every first-class command, so the
+  // hand-over guard has to live here too or it guards nothing.
+  assertToolNotDelegated(requestedToolName);
   let targetMutating = classifyToolMutation(requestedToolName);
   ensureLongRunningToolTimeout(ctx, requestedToolName);
   ctx.output.emitProgress({
@@ -495,6 +499,8 @@ async function toolsExecParallelHandler(ctx) {
     if (!call.tool_name || typeof call.tool_name !== 'string') {
       throw usageError(`calls[${i}] missing required "tool_name" string`);
     }
+    // A batch is just as good an escape hatch as a single exec.
+    assertToolNotDelegated(localNotisToolSlug(call.tool_name));
   }
   ensureLongRunningToolTimeout(ctx, calls.map((call) => localNotisToolSlug(call.tool_name)));
 

package/src/runtime/agent-memory-state.js

@@ -0,0 +1,126 @@
+import { createHash } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const MAX_SEEN_HASHES = 500;
+const MAX_PROMPT_CHARS = 12_000;
+
+function hash(value) {
+  return createHash('sha256').update(String(value || '')).digest('hex').slice(0, 24);
+}
+
+function statePath(sessionId, home = homedir()) {
+  if (!sessionId) return null;
+  return join(home, '.notis', 'agent-memory-hooks', `${hash(sessionId)}.json`);
+}
+
+function readState(sessionId, home) {
+  const filePath = statePath(sessionId, home);
+  if (!filePath || !existsSync(filePath)) return { seen: [], pending: null };
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+    return parsed && typeof parsed === 'object'
+      ? {
+          seen: Array.isArray(parsed.seen) ? parsed.seen.filter((item) => typeof item === 'string') : [],
+          pending: parsed.pending && typeof parsed.pending === 'object' ? parsed.pending : null,
+          identity: parsed.identity && typeof parsed.identity === 'object' ? parsed.identity : null,
+        }
+      : { seen: [], pending: null };
+  } catch {
+    return { seen: [], pending: null };
+  }
+}
+
+function inputIdentity(input) {
+  const profile = typeof input?.profile_name === 'string' ? input.profile_name : '';
+  const account = typeof input?.account_id === 'string' ? input.account_id : '';
+  const apiBase = typeof input?.api_base === 'string' ? input.api_base : '';
+  return profile && account && apiBase ? { profile, account, apiBase } : null;
+}
+
+function identityMatches(left, right) {
+  return (!left && !right) || Boolean(
+    left && right
+      && left.profile === right.profile
+      && left.account === right.account
+      && left.apiBase === right.apiBase,
+  );
+}
+
+function stateForInput(sessionId, input, home) {
+  const state = readState(sessionId, home);
+  const identity = inputIdentity(input);
+  if (identityMatches(state.identity, identity)) return state;
+  return { seen: [], pending: null, identity };
+}
+
+function writeState(sessionId, state, home) {
+  const filePath = statePath(sessionId, home);
+  if (!filePath) return;
+  mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+  const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+  renameSync(temporaryPath, filePath);
+}
+
+export function rememberPendingTurn(input, home = homedir()) {
+  const sessionId = input?.session_id;
+  const prompt = typeof input?.prompt === 'string' ? input.prompt.trim() : '';
+  if (!sessionId || !prompt || ['/', '!', '#'].includes(prompt[0])) return;
+  const state = stateForInput(sessionId, input, home);
+  state.pending = {
+    prompt: prompt.slice(0, MAX_PROMPT_CHARS),
+    turn_id: typeof input?.turn_id === 'string' ? input.turn_id : null,
+    cwd: typeof input?.cwd === 'string' ? input.cwd : null,
+    recorded_at: new Date().toISOString(),
+  };
+  writeState(sessionId, state, home);
+}
+
+export function pendingTurn(input, home = homedir()) {
+  const sessionId = input?.session_id;
+  const state = readState(sessionId, home);
+  const identity = inputIdentity(input);
+  if (!identityMatches(state.identity, identity)) {
+    if (sessionId) writeState(sessionId, { seen: [], pending: null, identity }, home);
+    return null;
+  }
+  if (!state.pending) return null;
+  if (state.pending.turn_id && input?.turn_id && state.pending.turn_id !== input.turn_id) return null;
+  return state.pending;
+}
+
+export function completePendingTurn(input, home = homedir()) {
+  const sessionId = input?.session_id;
+  if (!sessionId) return;
+  const filePath = statePath(sessionId, home);
+  if (!filePath || !existsSync(filePath)) return;
+  const state = readState(sessionId, home);
+  if (!state.pending) return;
+  state.pending = null;
+  writeState(sessionId, state, home);
+}
+
+export function freshRecallItems(input, items, home = homedir()) {
+  const sessionId = input?.session_id;
+  if (!sessionId) return items;
+  const state = stateForInput(sessionId, input, home);
+  const seen = new Set(state.seen);
+  const fresh = [];
+  for (const item of items) {
+    const fingerprint = hash(item);
+    if (seen.has(fingerprint)) continue;
+    seen.add(fingerprint);
+    fresh.push(item);
+  }
+  state.seen = [...seen].slice(-MAX_SEEN_HASHES);
+  writeState(sessionId, state, home);
+  return fresh;
+}