@notis_ai/cli 0.2.18 → 0.2.20

package/src/runtime/transport.js

@@ -2,7 +2,6 @@ import { randomUUID } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { dirname } from 'node:path';
 import { CliError, EXIT_CODES } from './errors.js';
-import { delegatedContextReason } from './delegated-context.js';
 import {
   credentialIsExpired,
   getJwtExpiration,
@@ -14,6 +13,16 @@ import {
 } from './profiles.js';
 import { createExpiredAuthError, createInvalidAuthHints } from './auth-recovery.js';
 import { refreshOAuthCredential } from './oauth.js';
+import { findUpsell, renderUpsell } from './upsell.js';
+import {
+  callCarriesToolRequestId,
+  canReplayRequest,
+  findToolOutcomeUnknown,
+  isTransientFailure,
+  retriesEnabled,
+  waitForNextAttempt,
+  withAttempts,
+} from './retry.js';
 
 function escapeMultipartHeaderValue(value) {
   return String(value ?? '')
@@ -82,10 +91,30 @@ function createMultipartFileUpload(payload, bindingMetadata, fileBindings) {
   };
 }
 
-function normalizeBackendError(status, payload, runtime) {
+// The Spaces client protocol this CLI speaks. The server refuses every other
+// version with a 410 `client_update_required` answer, so an older CLI is told
+// to update instead of half-working.
+export const SPACES_PROTOCOL = 2;
+export const CLI_UPDATE_COMMAND = 'npx --package @notis_ai/cli@latest -- notis';
+
+export function normalizeBackendError(status, payload, runtime) {
   const backendError = payload?.error;
+  if (backendError === 'client_update_required') {
+    return new CliError({
+      code: 'cli_update_required',
+      message: `This Notis CLI is too old for Spaces. Run the latest one with: ${CLI_UPDATE_COMMAND}`,
+      exitCode: EXIT_CODES.usage,
+      details: payload || {},
+      hints: [{ command: CLI_UPDATE_COMMAND, reason: 'Run your command again with the latest Notis CLI' }],
+    });
+  }
+  // Space errors answer {error: <stable code>, message: <readable text>}: show
+  // the text (it can name the Space involved); the code stays in details.
+  const codedMessage = typeof backendError === 'string' && /^[a-z][a-z0-9_]*$/.test(backendError)
+    && typeof payload?.message === 'string' && payload.message ? payload.message : null;
   const message =
     backendError?.message ||
+    codedMessage ||
     backendError ||
     payload?.message ||
     payload?.error ||
@@ -115,6 +144,19 @@ function normalizeBackendError(status, payload, runtime) {
   }
 
   if (status === 403) {
+    const upsellBody = findUpsell(payload);
+    if (upsellBody) {
+      // Same code as every 403 so callers that treat a refusal as "not
+      // available" keep working; the message and hints are the shared upsell.
+      const rendered = renderUpsell(upsellBody, { apiBase: runtime?.apiBase });
+      return new CliError({
+        code: 'forbidden',
+        message: rendered.text,
+        exitCode: EXIT_CODES.auth,
+        details: { ...(payload || {}), upsell: rendered.upsell },
+        hints: rendered.hints,
+      });
+    }
     return new CliError({
       code: 'forbidden',
       message,
@@ -258,6 +300,9 @@ export async function httpRequest({
   body,
   multipart = false,
   requireAuth = true,
+  spacesProtocol,
+  // This attempt's own limit; defaults to the whole --timeout-ms budget.
+  timeoutMs = runtime.timeoutMs,
 }) {
   // Refresh before spending the credential rather than after a rejection: the
   // rotating refresh token is shared with every other `notis` process reading
@@ -281,18 +326,19 @@ export async function httpRequest({
   }
 
   let controller = new AbortController();
-  let timeout = setTimeout(() => controller.abort(), runtime.timeoutMs);
+  let timeout = setTimeout(() => controller.abort(), timeoutMs);
   const requestId = `req_${randomUUID().replace(/-/g, '')}`;
   const resetTimeout = () => {
     clearTimeout(timeout);
     controller = new AbortController();
-    timeout = setTimeout(() => controller.abort(), runtime.timeoutMs);
+    timeout = setTimeout(() => controller.abort(), timeoutMs);
   };
 
   const headers = {
     'X-Notis-CLI-Version': runtime.cliVersion,
     'X-Notis-Request-Id': requestId,
   };
+  if (spacesProtocol) headers['X-Notis-Spaces-Protocol'] = String(SPACES_PROTOCOL);
   if (!multipart) {
     headers['Content-Type'] = 'application/json';
   }
@@ -378,7 +424,10 @@ export async function httpRequest({
       ) {
         throw createExpiredAuthError(runtime);
       }
-      throw normalizeBackendError(response.status, payload, runtime);
+      const backendError = normalizeBackendError(response.status, payload, runtime);
+      // Kept off the serialized error; the retry policy reads the HTTP status.
+      backendError.httpStatus = response.status;
+      throw backendError;
     }
 
     // A successful status is not a successful tool call until its response
@@ -430,48 +479,93 @@ export async function callTool({
   idempotencyKey,
   fileBindings = [],
 }) {
-  const requestId = idempotencyKey || (runtime.mutating ? randomUUID() : null);
-  const payload = {
+  const firstKey = idempotencyKey || (runtime.mutating ? randomUUID() : null);
+  const buildPayload = (key) => ({
     tool_name: toolName,
     arguments: argumentsPayload,
-    idempotency_key: requestId,
+    idempotency_key: key,
     cli_context: {
       output_mode: runtime.outputMode,
       profile: runtime.profileName,
       cwd: process.cwd(),
       agent_mode: runtime.agentMode,
       cli_version: runtime.cliVersion,
-      // Reported so the server can refuse work-handing tools from a run Notis
-      // is itself driving. Advisory -- a determined agent can unset the markers
-      // -- so the server treats it as one layer, not the whole guard.
-      ...(delegatedContextReason() ? { delegated_context: true } : {}),
       ...(runtime.debugEntitlementOverride
         ? { debug_entitlement_override: runtime.debugEntitlementOverride }
         : {}),
     },
-  };
+  });
 
-  if (Array.isArray(fileBindings) && fileBindings.length) {
-    const bindingMetadata = fileBindings.map((binding) => {
+  const hasFiles = Array.isArray(fileBindings) && fileBindings.length > 0;
+  const bindingMetadata = hasFiles
+    ? fileBindings.map((binding) => {
       const {
         contentType,
         localPath,
         ...metadata
       } = binding;
       return metadata;
-    });
+    })
+    : [];
 
-    return httpRequest({
+  const send = (key, timeoutMs) => (hasFiles
+    ? httpRequest({
       runtime,
       path: '/cli_tools',
-      body: () => createMultipartFileUpload(payload, bindingMetadata, fileBindings),
+      // A function, so every attempt streams the files again from the start.
+      body: () => createMultipartFileUpload(buildPayload(key), bindingMetadata, fileBindings),
       multipart: true,
-    });
+      timeoutMs,
+    })
+    : httpRequest({
+      runtime,
+      path: '/cli_tools',
+      body: buildPayload(key),
+      timeoutMs,
+    }));
+
+  if (!retriesEnabled(runtime)) {
+    let result;
+    try {
+      result = await send(firstKey, runtime.timeoutMs);
+    } catch (error) {
+      throw isTransientFailure(error) ? withAttempts(error, 1) : error;
+    }
+    return { ...result, idempotencyKey: firstKey, attempts: 1 };
   }
 
-  return httpRequest({
-    runtime,
-    path: '/cli_tools',
-    body: payload,
-  });
+  // --timeout-ms bounds the whole call, every attempt included.
+  const budgetMs = runtime.timeoutMs;
+  const deadline = Date.now() + budgetMs;
+  let key = firstKey;
+  for (let attempt = 1; ; attempt += 1) {
+    let result;
+    try {
+      result = await send(key, Math.max(1, deadline - Date.now()));
+    } catch (error) {
+      const transient = isTransientFailure(error);
+      if (
+        transient
+        && canReplayRequest({ mutating: runtime.mutating, idempotencyKey: key })
+        && await waitForNextAttempt({ attempt, deadline, budgetMs })
+      ) {
+        continue;
+      }
+      throw transient ? withAttempts(error, attempt) : error;
+    }
+
+    // The stored answer under this key is the unknown outcome itself, so only
+    // a fresh key reaches the tool again; its request_id receipt dedupes it.
+    if (
+      runtime.mutating
+      && key
+      && findToolOutcomeUnknown(result.payload)
+      && callCarriesToolRequestId(argumentsPayload)
+      && await waitForNextAttempt({ attempt, deadline, budgetMs })
+    ) {
+      key = randomUUID();
+      continue;
+    }
+    return { ...result, idempotencyKey: key, attempts: attempt };
+  }
 }

package/src/runtime/upsell.js

@@ -0,0 +1,219 @@
+// One renderer for every upgrade_required refusal the CLI shows. The server
+// builds the body (server/lib/tool_entitlements.py entitlement_upgrade_required_body,
+// plus Cloud Computer overrides); this module only finds it in a payload and
+// turns it into the lines and hints a person or agent acts on.
+
+const UPSELL_CODES = new Set([
+  'entitlement_upgrade_required',
+  'cloud_computer_team_limit',
+]);
+
+const NESTED_KEYS = ['error', 'details', 'data', 'result', 'response', 'entitlement_access'];
+
+const PORTAL_ORIGINS = {
+  'api.notis.ai': 'https://app.notis.ai',
+  'api-beta.notis.ai': 'https://beta.notis.ai',
+};
+
+function isUpsellBody(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  if (value.upgrade_required === true) return true;
+  return typeof value.code === 'string' && UPSELL_CODES.has(value.code)
+    && (typeof value.message === 'string' || value.next_action);
+}
+
+function parseJsonString(value) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('{')) return null;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+}
+
+// Returns the upsell body inside a tool result, a COMPOSIO_MULTI_EXECUTE_TOOL
+// envelope or a backend error payload, or null when there is none.
+export function findUpsell(value, depth = 0) {
+  if (depth > 8 || value === null || value === undefined) return null;
+  const parsed = parseJsonString(value);
+  if (parsed) return findUpsell(parsed, depth + 1);
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = findUpsell(item, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (typeof value !== 'object') return null;
+  if (isUpsellBody(value)) {
+    // A backend error wraps the body as {code, message, details: {...body}}:
+    // prefer the inner body, which carries next_action.
+    const inner = value.details && typeof value.details === 'object' ? findUpsell(value.details, depth + 1) : null;
+    return inner && inner.next_action && !value.next_action ? { ...value, ...inner } : value;
+  }
+  for (const key of NESTED_KEYS) {
+    if (key in value) {
+      const found = findUpsell(value[key], depth + 1);
+      if (found) return found;
+    }
+  }
+  if (Array.isArray(value.results)) return findUpsell(value.results, depth + 1);
+  return null;
+}
+
+export function portalOriginFor(apiBase) {
+  try {
+    return PORTAL_ORIGINS[new URL(apiBase).hostname] || null;
+  } catch {
+    return null;
+  }
+}
+
+function planLabel(plan) {
+  if (typeof plan !== 'string' || !plan.trim()) return null;
+  const value = plan.trim().replace(/[_-]+/g, ' ');
+  return value.charAt(0).toUpperCase() + value.slice(1);
+}
+
+function formatPrice(price) {
+  if (price === null || price === undefined || price === '') return null;
+  if (typeof price === 'string' || typeof price === 'number') return String(price);
+  if (typeof price !== 'object') return null;
+  if (typeof price.label === 'string' && price.label) return price.label;
+  const parts = [];
+  if (price.monthly_usd !== undefined && price.monthly_usd !== null) parts.push(`$${price.monthly_usd} a month`);
+  if (price.yearly_usd !== undefined && price.yearly_usd !== null) parts.push(`$${price.yearly_usd} a year`);
+  if (price.hourly_usd !== undefined && price.hourly_usd !== null) parts.push(`$${price.hourly_usd} an hour`);
+  return parts.length ? parts.join(', ') : null;
+}
+
+function formatUnlocks(unlocks) {
+  if (typeof unlocks === 'string' && unlocks.trim()) return [unlocks.trim()];
+  if (Array.isArray(unlocks)) return unlocks.filter((item) => typeof item === 'string' && item.trim());
+  return [];
+}
+
+function upgradeLink(body, apiBase) {
+  const url = typeof body.upgrade_url === 'string' && body.upgrade_url ? body.upgrade_url : '/subscribe';
+  if (/^https?:\/\//.test(url)) return url;
+  const origin = portalOriginFor(apiBase);
+  return origin ? `${origin}${url.startsWith('/') ? '' : '/'}${url}` : null;
+}
+
+// Portal routes a next_action may name with `page` instead of a full url.
+const ACTION_PAGES = {
+  billing: { path: '/settings/billing', where: 'Settings, then Billing' },
+};
+
+const SUPPORT_URL = 'mailto:support@notis.ai';
+
+function portalLink(path, apiBase) {
+  const origin = portalOriginFor(apiBase);
+  return origin ? `${origin}${path}` : null;
+}
+
+function toolCommand(tool, args = {}) {
+  return `notis tools exec ${tool} --arguments '${JSON.stringify(args)}'`;
+}
+
+// Builds {message, lines, hints, upsell} for one upsell body. `lines` is the
+// readable block for people; `hints` follow the CLI's {command, reason} shape
+// so agents see the same next step in machine output.
+export function renderUpsell(body, { apiBase } = {}) {
+  const plan = planLabel(body.required_plan);
+  const message = typeof body.message === 'string' && body.message
+    ? body.message
+    : (plan ? `Upgrade to ${plan} to use this.` : 'This needs a paid plan.');
+  const lines = [message];
+  const hints = [];
+
+  const unlocks = formatUnlocks(body.unlocks);
+  if (unlocks.length) {
+    lines.push(plan ? `${plan} unlocks:` : 'The plan unlocks:');
+    for (const item of unlocks) lines.push(`  - ${item}`);
+  }
+  const price = formatPrice(body.price);
+  if (price) lines.push(`Price: ${price}`);
+
+  const nextAction = body.next_action && typeof body.next_action === 'object' ? body.next_action : {};
+  const link = upgradeLink(body, apiBase);
+  const portalHint = {
+    command: toolCommand('LOCAL_NOTIS_GET_PORTAL_URL', { page: 'subscribe' }),
+    reason: 'Get the upgrade page link',
+  };
+  let actionUrl = null;
+
+  switch (nextAction.action) {
+    case 'contact_billing_owner': {
+      const ask = typeof nextAction.message === 'string' && nextAction.message
+        ? nextAction.message
+        : 'Ask your team owner to upgrade.';
+      lines.push(`Ask your team owner: ${ask}`);
+      hints.push({ message: `Ask your team owner: ${ask}` });
+      break;
+    }
+    case 'activate_paid_billing':
+    case 'switch_trial_plan': {
+      const tool = nextAction.tool || 'LOCAL_NOTIS_ACTIVATE_PAID_BILLING';
+      const args = nextAction.action === 'switch_trial_plan' && nextAction.target_plan
+        ? { target_plan: nextAction.target_plan }
+        : {};
+      const command = toolCommand(tool, args);
+      lines.push(`Start my plan now: ${command}`);
+      if (link) lines.push(`Or open the upgrade page: ${link}`);
+      hints.push({ command, reason: 'Start my plan now' });
+      if (!link) hints.push(portalHint);
+      break;
+    }
+    case 'update_card': {
+      const label = nextAction.label || 'Update card';
+      const page = ACTION_PAGES[nextAction.page] || ACTION_PAGES.billing;
+      actionUrl = /^https?:\/\//.test(nextAction.url || '') ? nextAction.url : portalLink(page.path, apiBase);
+      if (actionUrl) {
+        lines.push(`${label}: ${actionUrl}`);
+        hints.push({ message: `${label}: ${actionUrl}` });
+      } else {
+        lines.push(`${label}: open ${page.where}, in the Notis app.`);
+        hints.push({ command: toolCommand('LOCAL_NOTIS_GET_PORTAL_URL', { page: page.path }), reason: 'Get the billing page link' });
+      }
+      break;
+    }
+    case 'contact_us': {
+      const label = nextAction.label || 'Contact us';
+      actionUrl = typeof nextAction.url === 'string' && nextAction.url ? nextAction.url : SUPPORT_URL;
+      lines.push(`${label}: ${actionUrl}`);
+      hints.push({ message: `${label}: ${actionUrl}` });
+      break;
+    }
+    case 'retry_entitlement_check':
+      lines.push('Your plan could not be checked right now. Try again in a moment.');
+      break;
+    default: {
+      if (link) {
+        lines.push(`Open the upgrade page: ${link}`);
+        hints.push({ message: `Open the upgrade page: ${link}` });
+      } else {
+        lines.push('Open the upgrade page in the Notis app.');
+        hints.push(portalHint);
+      }
+    }
+  }
+
+  return {
+    message,
+    lines,
+    text: lines.join('\n'),
+    hints,
+    upsell: {
+      code: body.code || 'entitlement_upgrade_required',
+      entitlement: body.entitlement || null,
+      required_plan: body.required_plan || null,
+      lock: body.lock || null,
+      upgrade_url: link || body.upgrade_url || '/subscribe',
+      next_action: nextAction.action || null,
+      ...(actionUrl ? { action_url: actionUrl } : {}),
+    },
+  };
+}

package/src/runtime/view-render.js

@@ -0,0 +1,49 @@
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile, unlink } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { httpRequest } from './transport.js';
+import { CliError, EXIT_CODES, usageError } from './errors.js';
+
+async function rendererLibrary() {
+  const packaged = new URL('../../dist/view-renderer/src/index.js', import.meta.url);
+  if (existsSync(fileURLToPath(packaged))) return import(packaged.href);
+  const development = new URL('../../../view-renderer/src/index.js', import.meta.url);
+  if (existsSync(fileURLToPath(development))) return import(development.href);
+  throw usageError('The shared view renderer is missing. Rebuild or reinstall this CLI package.');
+}
+
+/** Root command registration supplies flags/output formatting; this adapter holds no browser JWT. */
+export async function renderViewWithCliRuntime({ runtime, url, outputs = ['markdown', 'screenshot'], width = 1440,
+  directory, signal, loadLibrary = rendererLibrary, request = httpRequest }) {
+  if (typeof url !== 'string' || !url.trim() || ![390, 1440].includes(width)) throw usageError('Choose a view link and width 390 or 1440.');
+  const ticket = (await request({ runtime, method: 'POST', path: '/portal_view_render/prepare', spacesProtocol: true,
+    body: { url, outputs, width }, signal })).payload;
+  if (typeof ticket?.credential !== 'string') throw usageError('The short-lived render ticket is missing.');
+  const library = await loadLibrary();
+  const broker = library.createRemoteRenderBroker({ apiBase: runtime.apiBase, credential: ticket.credential });
+  let result;
+  try {
+    result = await library.renderView({ broker, outputs, width, signal });
+    await broker.complete(result, { signal });
+  }
+  catch (error) {
+    if (error instanceof library.ViewRenderError) throw new CliError({ code: error.code,
+      message: error.message, exitCode: EXIT_CODES.backend, retryable: error.status >= 500 || error.status === 429, cause: error });
+    throw error;
+  }
+  if (!directory) return { result, artifacts: null };
+  const root = resolve(directory), created = [], artifacts = {};
+  await mkdir(root, { recursive: true });
+  try {
+    for (const [kind, name, bytes] of [
+      ['markdown', 'view.md', result.markdown === undefined ? undefined : Buffer.from(result.markdown, 'utf8')],
+      ['screenshot', 'view.png', result.screenshot ? Buffer.from(result.screenshot.data_base64, 'base64') : undefined],
+    ]) {
+      if (bytes === undefined) continue;
+      const path = join(root, name);
+      await writeFile(path, bytes, { flag: 'wx', mode: 0o600 }); created.push(path); artifacts[kind] = path;
+    }
+  } catch (error) { await Promise.allSettled(created.map(path => unlink(path))); throw error; }
+  return { result, artifacts };
+}

package/src/skill-sync-worker-entry.js

@@ -0,0 +1,2 @@
+import { main } from './skill-sync-worker.js';
+await main();

package/src/skill-sync-worker.js

@@ -0,0 +1,114 @@
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { getCurrentProfileName, getProfile, loadConfig, resolveRuntimeProfile } from './runtime/profiles.js';
+import { ensureFreshOAuthCredential } from './runtime/oauth.js';
+import { runSkillSync, fetchSyncSettings } from '../dist/skill-sync/index.js';
+import { withSkillSyncLock } from './runtime/sync-skills.js';
+
+// The server rejected the stored sign-in itself. Presenting it again can only
+// fail the same way, so the worker waits for the sign-in to change instead of
+// asking every minute (docs/no-dead-ends.md).
+const REJECTED_SIGN_IN_CODES = new Set(['invalid_grant', 'invalid_client', 'unauthorized_client']);
+
+function currentCliProfile() {
+  try {
+    return getCurrentProfileName(loadConfig());
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A fingerprint of the profile's stored sign-in that changes whenever it is
+ * renewed or replaced, by any process, and holds no credential.
+ */
+export function signInFingerprint(profileName, config = loadConfig()) {
+  const profile = getProfile(config, profileName);
+  if (!profile.oauth_client_id && !profile.oauth_access_expires_at) return null;
+  return createHash('sha256').update(JSON.stringify([
+    profile.oauth_issuer ?? null,
+    profile.oauth_client_id ?? null,
+    profile.oauth_user_id ?? null,
+    profile.oauth_access_expires_at ?? null,
+    profile.oauth_refresh_expires_at ?? null,
+  ])).digest('hex').slice(0, 16);
+}
+
+export async function runAutomaticSkillSync({ profile, apiBase, userId }, {
+  resolveRuntime = resolveRuntimeProfile, refresh = ensureFreshOAuthCredential,
+  settings = fetchSyncSettings, sync = runSkillSync, lock = withSkillSyncLock,
+  currentProfile = currentCliProfile,
+} = {}) {
+  const runtime = resolveRuntime({ profile }, { requireAuth: true });
+  if (runtime.credentialKind !== 'oauth' || runtime.apiBase !== apiBase
+    || runtime.oauthUserId !== userId) throw new Error('Automatic skill sync account changed; run notis skills sync to rebind');
+  await refresh(runtime);
+  const saved = await settings(runtime.apiBase, runtime.jwt);
+  if (saved.user_id !== userId) throw new Error('Automatic skill sync identity mismatch');
+  // Do not gather, unlink foreign accounts or write anything when opted out.
+  if (!saved.sync_enabled) return { status: 'disabled' };
+  // The service stays bound to its profile; after `notis profile use` moves the
+  // default away, it keeps that account's folder in sync without linking it.
+  const linkAgentFolders = (currentProfile() ?? profile) === profile;
+  const result = await lock(() => sync(runtime.apiBase, runtime.jwt, {
+    fetchSyncSettings: async () => saved,
+  }, { honorSyncEnabled: true, ...(linkAgentFolders ? {} : { linkAgentFolders: false }) }));
+  return { status: (result.failedLinks?.length || result.failedPushes?.length) ? 'partial' : 'synced', ...result };
+}
+
+function readStatus(target) {
+  try {
+    return JSON.parse(readFileSync(target, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export async function main(args = process.argv.slice(2), {
+  home = homedir(), run = runAutomaticSkillSync, fingerprint = signInFingerprint,
+  deadlineMs = 240_000,
+} = {}) {
+  const [profile, apiBase, userId] = args;
+  const root = join(home, '.notis', 'skills', 'service');
+  const target = join(root, 'status.json');
+  const record = (value) => {
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const temporary = `${target}.${process.pid}.tmp`;
+    writeFileSync(temporary, JSON.stringify({ ...value, profile, at: new Date().toISOString() }, null, 2), { mode: 0o600 });
+    renameSync(temporary, target);
+  };
+  let signIn = null;
+  try {
+    signIn = fingerprint(profile);
+  } catch {
+    signIn = null;
+  }
+  const previous = readStatus(target);
+  if (
+    signIn
+    && previous?.status === 'error'
+    && previous.profile === profile
+    && REJECTED_SIGN_IN_CODES.has(previous.code)
+    && previous.sign_in === signIn
+  ) {
+    // Same rejected sign-in: wait for `notis login`, or for any process to
+    // renew it, before presenting it again.
+    return;
+  }
+  const deadline = setTimeout(() => {
+    record({ status: 'error', code: 'sync_timeout' });
+    process.exit(1);
+  }, deadlineMs);
+  try {
+    record(await run({ profile, apiBase, userId }));
+  } catch (error) {
+    // Persist only a classified error, never a bearer, signed URL or response body.
+    const code = error.code || 'sync_failed';
+    record({ status: 'error', code, ...(REJECTED_SIGN_IN_CODES.has(code) && signIn ? { sign_in: signIn } : {}) });
+    process.exitCode = 1;
+  } finally {
+    clearTimeout(deadline);
+  }
+}