@notis_ai/cli 0.2.14 → 0.2.15

package/src/command-specs/auth.js

@@ -1,14 +1,28 @@
 import { loginWithOAuth, logoutOAuth } from '../runtime/oauth.js';
+import { installLocalAgentContext } from './agents.js';
 
 async function loginHandler(ctx) {
   const result = await loginWithOAuth(ctx.runtime, ctx.options, ctx.output);
   if (result.agentAuthorization) {
+    const presentation = loginAgentAuthorizationPresentation(result.agentAuthorization);
     return ctx.output.emitSuccess({
       command: 'login',
       data: result.agentAuthorization,
-      humanSummary: 'Open the authorization URL in a browser to continue.',
+      ...presentation,
     });
   }
+  let agentSetup = [];
+  const setupWarnings = [];
+  try {
+    // Login may add static CLI guidance, but automatic capture is a separate
+    // explicit choice made through `notis agents install`.
+    agentSetup = installLocalAgentContext(ctx, {
+      onlyExisting: true,
+      memoryHooks: null,
+    });
+  } catch (error) {
+    setupWarnings.push(`Notis CLI login succeeded, but local agent context setup failed: ${error.message}`);
+  }
   return ctx.output.emitSuccess({
     command: 'login',
     data: {
@@ -20,14 +34,38 @@ async function loginHandler(ctx) {
       scopes: result.profile.oauth_scopes,
       access_expires_at: result.profile.oauth_access_expires_at,
       refresh_expires_at: result.profile.oauth_refresh_expires_at,
+      agent_setup: agentSetup,
     },
     humanSummary: `Notis CLI is authorized for profile "${ctx.runtime.profileName}".`,
+    warnings: setupWarnings,
     hints: [
       { command: 'notis profile list', reason: 'See every account this machine can switch between' },
+      { command: 'notis agents install', reason: 'Install or refresh Notis context for Codex and Claude Code' },
     ],
   });
 }
 
+export function loginAgentAuthorizationPresentation(authorization) {
+  const browserHandOff = authorization?.hand_off === 'browser_callback';
+  const nextCommand = browserHandOff
+    ? authorization?.confirm_command
+    : authorization?.redeem_command;
+  return {
+    humanSummary: browserHandOff
+      ? 'Give the user the authorization URL. Signing in there completes it — there is no code to ask them for.'
+      : 'Give the user the authorization URL, then ask them for the code it shows.',
+    hints: nextCommand
+      ? [{
+        command: nextCommand,
+        reason: browserHandOff
+          ? 'Confirm the account once they have finished in the browser'
+          : 'Redeem the code shown in the browser',
+      }]
+      : [],
+    renderHuman: () => `Authorize Notis CLI: ${authorization.authorize_url}`,
+  };
+}
+
 async function logoutHandler(ctx) {
   const result = await logoutOAuth(ctx.runtime, {
     allProfiles: Boolean(ctx.options.allProfiles),
@@ -38,12 +76,24 @@ async function logoutHandler(ctx) {
       oauth_connected: false,
       cleared_profiles: result.profiles,
     },
-    humanSummary: ctx.options.allProfiles
-      ? 'OAuth credentials were removed from all CLI profiles.'
-      : `OAuth credentials were removed from profile "${ctx.runtime.profileName}".`,
+    humanSummary: logoutHumanSummary(result, {
+      allProfiles: Boolean(ctx.options.allProfiles),
+      profileName: ctx.runtime.profileName,
+    }),
   });
 }
 
+export function logoutHumanSummary(result, { allProfiles, profileName }) {
+  if (allProfiles) {
+    return result.profiles.length > 0
+      ? 'OAuth state was cleared from all connected or pending CLI profiles.'
+      : 'No OAuth credentials were connected in any CLI profile.';
+  }
+  return result.profiles.includes(profileName)
+    ? `OAuth state was cleared for profile "${profileName}", including any pending authorization.`
+    : `No OAuth credential was connected for profile "${profileName}".`;
+}
+
 export const authCommandSpecs = [
   {
     command_path: ['login'],
@@ -55,8 +105,9 @@ export const authCommandSpecs = [
       options: [
         { flags: '--no-browser', description: 'Print the authorization URL without opening a browser.' },
         { flags: '--print-url', description: 'Print the authorization URL even when opening a browser.' },
-        { flags: '--paste-code', description: 'Use the copy-paste callback for SSH and headless machines.' },
-        { flags: '--timeout-seconds <n>', description: 'How long to wait for authorization (default 300).' },
+        { flags: '--mode <mode>', description: 'auto (default) hands the browser callback to a background listener when this command cannot wait; browser waits in-process; code shows a one-time code to copy.' },
+        { flags: '--paste-code', description: 'Alias for --mode code.' },
+        { flags: '--timeout-seconds <n>', description: 'Authorization lifetime in seconds (default 300 while waiting in a terminal; 1800 for detached or code hand-offs).' },
         { flags: '--scope <scope>', description: 'OAuth permission to request (repeatable).', collect: true },
         { flags: '--code <code>', description: 'Redeem the code shown in the browser after a non-interactive login.' },
       ],
@@ -66,11 +117,12 @@ export const authCommandSpecs = [
       'notis login --profile work',
       'notis login --profile beta --api-base https://api-beta.notis.ai',
       'notis login --no-browser --print-url',
-      'notis login --paste-code',
+      'notis login --mode browser',
+      'notis login --mode code',
       'notis login --code 4f3c2b1a',
     ],
     output_schema:
-      'Returns credential_source, profile, api_base, user_id, scopes, and credential expiries; agent mode returns authorize_url and expires_in.',
+      'Returns credential_source, profile, api_base, user_id, scopes, and credential expiries; non-blocking agent, machine-output, or non-interactive modes return authorize_url, expires_in, and hand_off ("browser_callback" needs no code, "code" must be redeemed with redeem_command).',
     mutates: true,
     idempotent: true,
     require_auth: false,
@@ -87,14 +139,15 @@ export const authCommandSpecs = [
     args_schema: {
       arguments: [],
       options: [
-        { flags: '--all-profiles', description: 'Remove OAuth credentials from every CLI profile.' },
+        { flags: '--all-profiles', description: 'Clear OAuth credentials and pending authorizations from every CLI profile.' },
       ],
     },
     examples: ['notis logout', 'notis logout --profile work', 'notis logout --all-profiles'],
-    output_schema: 'Returns oauth_connected=false and the profiles whose OAuth credentials were removed.',
+    output_schema: 'Returns oauth_connected=false and the profiles whose OAuth credentials or pending authorizations were cleared.',
     mutates: true,
     idempotent: true,
     require_auth: false,
+    allow_unknown_profile: true,
     related_commands: ['notis login', 'notis profile list'],
     backend_call: { type: 'oauth', name: 'revocation' },
     handler: logoutHandler,

package/src/command-specs/index.js

@@ -7,11 +7,15 @@ import { smokeCommandSpecs } from './smoke.js';
 import { authCommandSpecs } from './auth.js';
 import { profileCommandSpecs } from './profile.js';
 import { handoverCommandSpecs } from './handover.js';
+import { agentsCommandSpecs } from './agents.js';
+import { skillsCommandSpecs } from './skills.js';
 
 export const GROUP_SUMMARIES = {
   apps: 'Develop, deploy, and submit Notis Apps.',
+  agents: 'Install Notis context into local coding agents.',
   handover: 'Hand the branch you are on to a Notis agent, hosted or your own Codex/Claude.',
   tools: 'Discover and execute generic tools exposed through Notis.',
+  skills: 'Keep Notis and local-agent skills synchronized.',
   profile: 'Switch between signed-in accounts and their API endpoints.',
   debug: 'Inspect effective runtime context, worker identity, and trace costs.',
   smoke: 'Run deterministic connected-service smoke tests with guaranteed cleanup.',
@@ -21,6 +25,8 @@ export const COMMAND_SPECS = [
   ...authCommandSpecs,
   ...profileCommandSpecs,
   ...onboardingCommandSpecs,
+  ...agentsCommandSpecs,
+  ...skillsCommandSpecs,
   ...appsCommandSpecs,
   ...handoverCommandSpecs,
   ...toolsCommandSpecs,

package/src/command-specs/onboarding.js

@@ -11,6 +11,8 @@ import {
 } from '../runtime/profiles.js';
 import { ensureFreshOAuthCredential, loginWithOAuth } from '../runtime/oauth.js';
 import { runToolCommand } from './helpers.js';
+import { loginAgentAuthorizationPresentation } from './auth.js';
+import { installLocalAgentContext } from './agents.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const BUNDLED_BRIEF_PATH = join(HERE, '..', '..', 'skills', 'notis-onboarding', 'BRIEF.md');
@@ -86,6 +88,44 @@ function isAuthenticated(runtime) {
     && !credentialIsExpired(runtime, getProfile(loadConfig(), runtime.profileName));
 }
 
+function renderAgentSetup(results) {
+  const configured = (results || []).filter((result) => result?.agent && result?.instructions);
+  if (!configured.length) return '';
+  const lines = configured.map((result) => {
+    const label = result.agent === 'claude-code' ? 'Claude Code' : 'Codex';
+    const instructions = result.instructions?.status || 'skipped';
+    const memoryStatus = result.memory_hook?.status || 'skipped';
+    const memory = memoryStatus === 'preserved'
+      ? 'memory hooks not changed'
+      : `memory recall and capture ${memoryStatus}`;
+    return `- ${label}: instructions ${instructions}; ${memory}`;
+  });
+  if (configured.some((result) => (
+    result.agent === 'codex'
+    && ['installed', 'updated', 'unchanged'].includes(result.memory_hook?.status)
+  ))) {
+    lines.push('- Codex: open /hooks once and trust the Notis hooks before they can run.');
+  }
+  return ['## Coding-agent setup', ...lines].join('\n');
+}
+
+function agentSetupHints(results) {
+  const hints = [];
+  if ((results || []).some((result) => (
+    result.agent === 'codex'
+    && ['installed', 'updated', 'unchanged'].includes(result.memory_hook?.status)
+  ))) {
+    hints.push({ message: 'In Codex, open /hooks once and trust the Notis hooks.' });
+  }
+  if ((results || []).some((result) => result.status === 'not_detected')) {
+    hints.push({ command: 'notis agents install', reason: 'Configure Codex and Claude Code later if they were not detected now' });
+  }
+  if ((results || []).some((result) => result.memory_hook?.status === 'preserved')) {
+    hints.push({ command: 'notis agents install', reason: 'Explicitly enable Notis memory recall and completed-turn capture' });
+  }
+  return hints;
+}
+
 /**
  * What an authenticated `start` reports.
  *
@@ -105,9 +145,20 @@ async function authenticatedResult(ctx) {
     onboarding_complete: onboardingComplete,
     ...(state ? { known_settings: state.settings, missing_settings: state.missingSettings } : {}),
   };
+  try {
+    base.agent_setup = installLocalAgentContext(ctx, {
+      onlyExisting: true,
+      memoryHooks: null,
+    });
+  } catch {
+    // Authentication and onboarding remain usable if a local vendor config is
+    // malformed or read-only. `notis agents install` reports the exact path.
+    base.agent_setup = [];
+  }
 
   if (onboardingComplete) {
     const name = state?.settings?.full_name;
+    const setupSummary = renderAgentSetup(base.agent_setup);
     return ctx.output.emitSuccess({
       command: 'start',
       data: { ...base, brief: null, brief_source: null },
@@ -120,20 +171,27 @@ async function authenticatedResult(ctx) {
           '',
           'This account has already completed onboarding. Do not run an onboarding',
           'flow and do not call LOCAL_NOTIS_COMPLETE_TUTORIAL.',
+          ...(setupSummary ? ['', setupSummary] : []),
         ].join('\n'),
       hints: [
         { command: 'notis whoami', reason: 'Show the account and its connected toolkits' },
         { command: 'notis tools search "<what you need>"', reason: 'Find a tool and get on with the task' },
+        ...agentSetupHints(base.agent_setup),
       ],
     });
   }
 
   const brief = await fetchBrief(ctx.runtime.apiBase, ctx.runtime.timeoutMs);
+  const setupSummary = renderAgentSetup(base.agent_setup);
   return ctx.output.emitSuccess({
     command: 'start',
     data: { ...base, brief: brief.markdown, brief_source: brief.source },
     humanSummary: `Notis CLI is authenticated for profile "${ctx.runtime.profileName}". Onboarding is not complete.`,
-    renderHuman: () => brief.markdown || 'Notis CLI is authenticated.',
+    renderHuman: () => [
+      brief.markdown || 'Notis CLI is authenticated.',
+      setupSummary,
+    ].filter(Boolean).join('\n\n'),
+    hints: agentSetupHints(base.agent_setup),
   });
 }
 
@@ -166,8 +224,13 @@ async function startHandler(ctx) {
   // Browser authorization is the whole signup path: it creates the account when
   // the address is new and authorizes this machine either way. There is nothing
   // for the CLI to collect up front, and nothing to wait on afterwards.
-  const authorization = await loginWithOAuth(runtime, { browser: true }, output);
+  const authorization = await loginWithOAuth(
+    runtime,
+    { browser: true, mode: options.mode, reusePersistedCredential: true },
+    output,
+  );
   if (authorization?.agentAuthorization) {
+    const presentation = loginAgentAuthorizationPresentation(authorization.agentAuthorization);
     return output.emitSuccess({
       command: 'start',
       data: {
@@ -175,8 +238,7 @@ async function startHandler(ctx) {
         profile: runtime.profileName,
         ...authorization.agentAuthorization,
       },
-      humanSummary: 'Open the authorization URL to create or access the Notis account.',
-      renderHuman: () => `Authorize Notis CLI: ${authorization.agentAuthorization.authorize_url}`,
+      ...presentation,
     });
   }
 
@@ -205,16 +267,18 @@ export const onboardingCommandSpecs = [
       arguments: [],
       options: [
         { flags: '--brief-only', description: 'Print the onboarding brief for an already-signed-in profile.' },
+        { flags: '--mode <mode>', description: 'auto (default) hands the browser callback to a background listener when this command cannot wait; browser waits in-process; code shows a one-time code to copy.' },
       ],
     },
     examples: [
       'notis start',
       'notis start --profile work',
+      'notis start --mode browser',
       'notis start --brief-only',
       'notis start --json',
     ],
     output_schema:
-      'Returns {authenticated, profile, api_base, onboarding_complete, known_settings, missing_settings, brief, brief_source} once signed in — brief is null when onboarding_complete is true — or {authorize_url, expires_in, redeem_command} while waiting for browser authorization.',
+      'Returns {authenticated, profile, api_base, onboarding_complete, known_settings, missing_settings, agent_setup, brief, brief_source} once signed in — brief is null when onboarding_complete is true — or {authorize_url, expires_in, hand_off, ...} while waiting for browser authorization. hand_off is "browser_callback" when signing in finishes the login by itself (re-run confirm_command to see it land) or "code" when the user must be asked for the code the page shows and it redeemed with redeem_command.',
     mutates: true,
     idempotent: true,
     require_auth: false,

package/src/command-specs/skills.js

@@ -0,0 +1,56 @@
+import { getJwtSubject } from '../runtime/profiles.js';
+import { reconcileAllSkills } from '../runtime/sync-skills.js';
+
+async function loadSkillSyncEngine() {
+  return import('../../dist/skill-sync/index.js');
+}
+
+async function syncSkillsHandler(ctx) {
+  const userId = ctx.runtime.oauthUserId || getJwtSubject(ctx.runtime.jwt);
+  const { runSkillSync } = await loadSkillSyncEngine();
+  const result = await reconcileAllSkills({
+    serverUrl: ctx.runtime.apiBase,
+    jwt: ctx.runtime.jwt,
+    userId,
+    honorSyncEnabled: Boolean(ctx.options.electronRepeat),
+    runAccountSync: runSkillSync,
+  });
+
+  return ctx.output.emitSuccess({
+    command: 'skills sync',
+    data: result,
+    humanSummary: result.syncEnabled
+      ? `Synced account skills and kept ${result.baseSkills.length} base skills current.`
+      : `Automatic Desktop sync is off; kept ${result.baseSkills.length} base skills current.`,
+    renderHuman: () => result.syncEnabled
+      ? `Skills synced. Base skills current: ${result.baseSkills.join(', ')}.`
+      : `Automatic Desktop sync is off. Base skills remain current: ${result.baseSkills.join(', ')}.`,
+  });
+}
+
+export const skillsCommandSpecs = [
+  {
+    command_path: ['skills', 'sync'],
+    summary: 'Synchronize account skills and keep the three Notis base skills current.',
+    when_to_use:
+      'Run manually whenever local agent skills should be reconciled. Manual runs ignore the Desktop automatic-sync preference.',
+    args_schema: {
+      arguments: [],
+      options: [
+        {
+          flags: '--electron-repeat',
+          description: 'Honor the automatic Desktop sync preference (used by Notis Desktop).',
+        },
+      ],
+    },
+    examples: ['notis skills sync', 'notis skills sync --json'],
+    output_schema:
+      'Returns account sync counts plus baseSkills, baseInstalled, baseLinked, and baseBackups.',
+    mutates: true,
+    idempotent: true,
+    require_auth: true,
+    related_commands: ['notis login', 'notis start', 'notis doctor'],
+    backend_call: { type: 'local', name: 'skill_sync' },
+    handler: syncSkillsHandler,
+  },
+];

package/src/runtime/agent-memory-state.js

@@ -0,0 +1,126 @@
+import { createHash } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const MAX_SEEN_HASHES = 500;
+const MAX_PROMPT_CHARS = 12_000;
+
+function hash(value) {
+  return createHash('sha256').update(String(value || '')).digest('hex').slice(0, 24);
+}
+
+function statePath(sessionId, home = homedir()) {
+  if (!sessionId) return null;
+  return join(home, '.notis', 'agent-memory-hooks', `${hash(sessionId)}.json`);
+}
+
+function readState(sessionId, home) {
+  const filePath = statePath(sessionId, home);
+  if (!filePath || !existsSync(filePath)) return { seen: [], pending: null };
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, 'utf-8'));
+    return parsed && typeof parsed === 'object'
+      ? {
+          seen: Array.isArray(parsed.seen) ? parsed.seen.filter((item) => typeof item === 'string') : [],
+          pending: parsed.pending && typeof parsed.pending === 'object' ? parsed.pending : null,
+          identity: parsed.identity && typeof parsed.identity === 'object' ? parsed.identity : null,
+        }
+      : { seen: [], pending: null };
+  } catch {
+    return { seen: [], pending: null };
+  }
+}
+
+function inputIdentity(input) {
+  const profile = typeof input?.profile_name === 'string' ? input.profile_name : '';
+  const account = typeof input?.account_id === 'string' ? input.account_id : '';
+  const apiBase = typeof input?.api_base === 'string' ? input.api_base : '';
+  return profile && account && apiBase ? { profile, account, apiBase } : null;
+}
+
+function identityMatches(left, right) {
+  return (!left && !right) || Boolean(
+    left && right
+      && left.profile === right.profile
+      && left.account === right.account
+      && left.apiBase === right.apiBase,
+  );
+}
+
+function stateForInput(sessionId, input, home) {
+  const state = readState(sessionId, home);
+  const identity = inputIdentity(input);
+  if (identityMatches(state.identity, identity)) return state;
+  return { seen: [], pending: null, identity };
+}
+
+function writeState(sessionId, state, home) {
+  const filePath = statePath(sessionId, home);
+  if (!filePath) return;
+  mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+  const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+  renameSync(temporaryPath, filePath);
+}
+
+export function rememberPendingTurn(input, home = homedir()) {
+  const sessionId = input?.session_id;
+  const prompt = typeof input?.prompt === 'string' ? input.prompt.trim() : '';
+  if (!sessionId || !prompt || ['/', '!', '#'].includes(prompt[0])) return;
+  const state = stateForInput(sessionId, input, home);
+  state.pending = {
+    prompt: prompt.slice(0, MAX_PROMPT_CHARS),
+    turn_id: typeof input?.turn_id === 'string' ? input.turn_id : null,
+    cwd: typeof input?.cwd === 'string' ? input.cwd : null,
+    recorded_at: new Date().toISOString(),
+  };
+  writeState(sessionId, state, home);
+}
+
+export function pendingTurn(input, home = homedir()) {
+  const sessionId = input?.session_id;
+  const state = readState(sessionId, home);
+  const identity = inputIdentity(input);
+  if (!identityMatches(state.identity, identity)) {
+    if (sessionId) writeState(sessionId, { seen: [], pending: null, identity }, home);
+    return null;
+  }
+  if (!state.pending) return null;
+  if (state.pending.turn_id && input?.turn_id && state.pending.turn_id !== input.turn_id) return null;
+  return state.pending;
+}
+
+export function completePendingTurn(input, home = homedir()) {
+  const sessionId = input?.session_id;
+  if (!sessionId) return;
+  const filePath = statePath(sessionId, home);
+  if (!filePath || !existsSync(filePath)) return;
+  const state = readState(sessionId, home);
+  if (!state.pending) return;
+  state.pending = null;
+  writeState(sessionId, state, home);
+}
+
+export function freshRecallItems(input, items, home = homedir()) {
+  const sessionId = input?.session_id;
+  if (!sessionId) return items;
+  const state = stateForInput(sessionId, input, home);
+  const seen = new Set(state.seen);
+  const fresh = [];
+  for (const item of items) {
+    const fingerprint = hash(item);
+    if (seen.has(fingerprint)) continue;
+    seen.add(fingerprint);
+    fresh.push(item);
+  }
+  state.seen = [...seen].slice(-MAX_SEEN_HASHES);
+  writeState(sessionId, state, home);
+  return fresh;
+}