@notis_ai/cli 0.2.2 → 0.2.3

package/src/command-specs/tools.js

@@ -1,13 +1,18 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { accessSync, constants as fsConstants, createReadStream, existsSync, readFileSync, statSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { basename } from 'node:path';
 import { usageError } from '../runtime/errors.js';
 import {
+  COMPOSIO_GET_TOOL_SCHEMAS,
+  COMPOSIO_MULTI_EXECUTE_TOOL,
+  COMPOSIO_SEARCH_TOOLS,
+  fetchToolDiscovery,
   fetchToolkits,
   fetchToolSchema,
+  localNotisToolSlug,
   nextIdempotencyKey,
   parseJson,
   parseMaybeJson,
-  normalizeToolkits,
-  resolveSearchToolkits,
   runToolCommand,
   validateArguments,
 } from './helpers.js';
@@ -36,15 +41,98 @@ async function resolveJsonInput(value, label) {
 
 const LONG_RUNNING_TOOL_TIMEOUT_MS = 600000;
 const LONG_RUNNING_TOOL_NAMES = new Set([
-  'notis-default-generate_image_openai',
-  'notis-default-edit_image_openai',
-  'notis-default-generate_image_gemini',
-  'notis-default-edit_image_gemini',
+  'LOCAL_NOTIS_GENERATE_IMAGE_OPENAI',
+  'LOCAL_NOTIS_EDIT_IMAGE_OPENAI',
+  'LOCAL_NOTIS_GENERATE_IMAGE_GEMINI',
+  'LOCAL_NOTIS_EDIT_IMAGE_GEMINI',
 ]);
 
+const EXTENSION_CONTENT_TYPES = new Map([
+  ['.pdf', 'application/pdf'],
+  ['.png', 'image/png'],
+  ['.jpg', 'image/jpeg'],
+  ['.jpeg', 'image/jpeg'],
+  ['.gif', 'image/gif'],
+  ['.webp', 'image/webp'],
+  ['.txt', 'text/plain'],
+  ['.csv', 'text/csv'],
+  ['.json', 'application/json'],
+  ['.md', 'text/markdown'],
+]);
+
+function guessContentType(filePath) {
+  const lower = filePath.toLowerCase();
+  const dotIndex = lower.lastIndexOf('.');
+  if (dotIndex === -1) return 'application/octet-stream';
+  return EXTENSION_CONTENT_TYPES.get(lower.slice(dotIndex)) || 'application/octet-stream';
+}
+
+async function hashFileSha256(localPath) {
+  const hash = createHash('sha256');
+  for await (const chunk of createReadStream(localPath)) {
+    hash.update(chunk);
+  }
+  return hash.digest('hex');
+}
+
+async function parseFileBindingSpec(spec, index) {
+  if (typeof spec !== 'string' || !spec.trim()) {
+    throw usageError('--file must be formatted as <argument-path>=<local-path>');
+  }
+
+  const equalsIndex = spec.indexOf('=');
+  if (equalsIndex <= 0 || equalsIndex === spec.length - 1) {
+    throw usageError('--file must be formatted as <argument-path>=<local-path>');
+  }
+
+  const argumentPath = spec.slice(0, equalsIndex).trim();
+  const localPath = spec.slice(equalsIndex + 1).trim();
+  if (!argumentPath) {
+    throw usageError('--file argument path is required');
+  }
+  if (!localPath) {
+    throw usageError('--file local path is required');
+  }
+  if (!existsSync(localPath)) {
+    throw usageError(`File not found: ${localPath}`);
+  }
+
+  let stats;
+  try {
+    stats = statSync(localPath);
+    accessSync(localPath, fsConstants.R_OK);
+  } catch {
+    throw usageError(`File is not readable: ${localPath}`);
+  }
+  if (!stats.isFile()) {
+    throw usageError(`File is not a regular file: ${localPath}`);
+  }
+
+  const sha256 = await hashFileSha256(localPath);
+  const fileBasename = basename(localPath);
+  const fieldName = `file_${index}`;
+
+  return {
+    argument_path: argumentPath,
+    field_name: fieldName,
+    basename: fileBasename,
+    size: stats.size,
+    sha256,
+    contentType: guessContentType(fileBasename),
+    localPath,
+  };
+}
+
+async function parseFileBindings(rawFileOptions) {
+  const values = Array.isArray(rawFileOptions)
+    ? rawFileOptions
+    : (rawFileOptions ? [rawFileOptions] : []);
+  return Promise.all(values.map((value, index) => parseFileBindingSpec(value, index)));
+}
+
 function ensureLongRunningToolTimeout(ctx, toolNames) {
   const names = Array.isArray(toolNames) ? toolNames : [toolNames];
-  if (!names.some((name) => LONG_RUNNING_TOOL_NAMES.has(name))) {
+  if (!names.some((name) => LONG_RUNNING_TOOL_NAMES.has(localNotisToolSlug(name)))) {
     return;
   }
   ctx.runtime.timeoutMs = Math.max(ctx.runtime.timeoutMs || 0, LONG_RUNNING_TOOL_TIMEOUT_MS);
@@ -57,27 +145,55 @@ async function toolsToolkitsHandler(ctx) {
     data: { toolkits },
     humanSummary: `Found ${toolkits.length} toolkits`,
     hints: [
-      { command: 'notis tools search <query>', reason: 'Search for tools in these toolkits' },
+      { command: 'notis tools search <query>', reason: 'Search canonical tools and schemas' },
     ],
-    renderHuman: () => toolkits.map((entry) => `${entry.id}  ${entry.description}`).join('\n'),
+    renderHuman: () =>
+      toolkits
+        .map((entry) => {
+          const status = entry.has_active_connection ? 'connected' : 'needs auth';
+          return `${entry.id}  ${status}  ${entry.description}`;
+        })
+        .join('\n'),
   });
 }
 
+function discoveryToolRows(payload) {
+  const schemas = payload.tool_schemas || {};
+  const statuses = new Map(
+    (payload.toolkit_connection_statuses || [])
+      .filter((entry) => entry && typeof entry.toolkit === 'string')
+      .map((entry) => [entry.toolkit, entry])
+  );
+  const seen = new Set();
+  const rows = [];
+  for (const result of payload.results || []) {
+    for (const name of [...(result.primary_tool_slugs || []), ...(result.related_tool_slugs || [])]) {
+      if (!name || seen.has(name)) continue;
+      seen.add(name);
+      const schema = schemas[name] || {};
+      const toolkit = schema.toolkit || name.split('-').slice(0, -1).join('-');
+      const status = statuses.get(toolkit);
+      rows.push({
+        name,
+        toolkit,
+        description: schema.description || '',
+        schema_available: Boolean(schemas[name]),
+        connection_status: status
+          ? (status.has_active_connection ? 'connected' : 'needs auth')
+          : 'unknown',
+      });
+    }
+  }
+  return rows;
+}
+
 async function toolsSearchHandler(ctx) {
-  const toolkits = await resolveSearchToolkits(ctx.runtime, ctx.options.toolkits);
-  const result = await runToolCommand({
-    runtime: ctx.runtime,
-    toolName: 'notis_find_tools',
-    arguments_: {
-      query: ctx.args.query || undefined,
-      toolkits,
-    },
-  });
-  const tools = result.payload.tools || [];
+  const payload = await fetchToolDiscovery(ctx.runtime, ctx.args.query || 'Find tools', ctx.options.knownFields || '');
+  const tools = discoveryToolRows(payload);
   const firstTool = tools[0];
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
-    data: { toolkits, tools },
+    data: payload,
     humanSummary: `Found ${tools.length} tools`,
     hints: firstTool
       ? [
@@ -87,52 +203,41 @@ async function toolsSearchHandler(ctx) {
       : [],
     renderHuman: () =>
       tools
-        .map((tool) => `${tool.name}\n  ${tool.toolkit_id || 'unknown toolkit'}\n  ${tool.description || 'No description'}\n`)
+        .map((tool) => `${tool.name}\n  toolkit: ${tool.toolkit || 'unknown'} (${tool.connection_status})\n  schema: ${tool.schema_available ? 'available' : 'missing'}\n  ${tool.description || 'No description'}\n`)
         .join('\n')
         .trim(),
   });
 }
 
 async function toolsDescribeHandler(ctx) {
-  const toolkits = await resolveSearchToolkits(ctx.runtime, ctx.options.toolkits);
-  const result = await runToolCommand({
-    runtime: ctx.runtime,
-    toolName: 'notis_find_tools',
-    arguments_: {
-      query: ctx.args.toolName,
-      toolkits,
-    },
-  });
-  const tools = result.payload.tools || [];
-  const match = tools.find((tool) => tool.name === ctx.args.toolName);
-  if (!match) {
-    throw usageError(`Tool ${ctx.args.toolName} was not found in the selected toolkits.`);
-  }
+  const requestedToolName = localNotisToolSlug(ctx.args.toolName);
+  const match = await fetchToolSchema(ctx.runtime, requestedToolName);
 
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
-    data: { tool: match, toolkits },
-    humanSummary: `Described tool ${ctx.args.toolName}`,
+    data: { tool: match },
+    humanSummary: `Described tool ${requestedToolName}`,
     hints: [
-      { command: `notis tools exec ${ctx.args.toolName} --dry-run --arguments '{}'`, reason: 'Validate arguments first' },
-      { command: `notis tools exec ${ctx.args.toolName} --arguments '{}'`, reason: 'Execute this tool' },
+      { command: `notis tools exec ${requestedToolName} --dry-run --arguments '{}'`, reason: 'Validate arguments first' },
+      { command: `notis tools exec ${requestedToolName} --arguments '{}'`, reason: 'Execute this tool' },
     ],
     renderHuman: () => JSON.stringify(match, null, 2),
   });
 }
 
 async function toolsExecHandler(ctx) {
-  ensureLongRunningToolTimeout(ctx, ctx.args.toolName);
-  const toolkits = normalizeToolkits(ctx.options.toolkits);
+  const requestedToolName = localNotisToolSlug(ctx.args.toolName);
+  ensureLongRunningToolTimeout(ctx, requestedToolName);
+  const fileBindings = await parseFileBindings(ctx.options.file);
 
   if (ctx.options.getSchema) {
-    const tool = await fetchToolSchema(ctx.runtime, ctx.args.toolName, ctx.options.toolkits);
+    const tool = await fetchToolSchema(ctx.runtime, requestedToolName);
     return ctx.output.emitSuccess({
       command: ctx.spec.command_path.join(' '),
-      data: { tool, toolkits },
-      humanSummary: `Schema for ${ctx.args.toolName}`,
+      data: { tool },
+      humanSummary: `Schema for ${requestedToolName}`,
       hints: [
-        { command: `notis tools exec ${ctx.args.toolName} --dry-run --arguments '{}'`, reason: 'Validate arguments before executing' },
+        { command: `notis tools exec ${requestedToolName} --dry-run --arguments '{}'`, reason: 'Validate arguments before executing' },
       ],
       renderHuman: () => JSON.stringify(tool, null, 2),
     });
@@ -144,16 +249,19 @@ async function toolsExecHandler(ctx) {
     : parseMaybeJson(rawArguments, 'arguments') || {};
 
   if (ctx.options.dryRun) {
-    const tool = await fetchToolSchema(ctx.runtime, ctx.args.toolName, ctx.options.toolkits);
+    if (fileBindings.length) {
+      throw usageError('--file is only supported when executing a tool, not with --dry-run');
+    }
+    const tool = await fetchToolSchema(ctx.runtime, requestedToolName);
     const errors = validateArguments(tool.parameters, args);
 
     if (errors.length) {
       return ctx.output.emitSuccess({
         command: ctx.spec.command_path.join(' '),
-        data: { valid: false, errors, tool: ctx.args.toolName, toolkits },
+        data: { valid: false, errors, tool: requestedToolName },
         humanSummary: `Dry run failed: ${errors.length} validation error(s)`,
         hints: [
-          { command: `notis tools exec ${ctx.args.toolName} --get-schema`, reason: 'Review the full parameter schema' },
+          { command: `notis tools exec ${requestedToolName} --get-schema`, reason: 'Review the full parameter schema' },
         ],
         renderHuman: () => errors.map((e) => `  - ${e}`).join('\n'),
       });
@@ -161,10 +269,10 @@ async function toolsExecHandler(ctx) {
 
     return ctx.output.emitSuccess({
       command: ctx.spec.command_path.join(' '),
-      data: { valid: true, tool: ctx.args.toolName, arguments: args, toolkits },
-      humanSummary: `Dry run passed for ${ctx.args.toolName}`,
+      data: { valid: true, tool: requestedToolName, arguments: args },
+      humanSummary: `Dry run passed for ${requestedToolName}`,
       hints: [
-        { command: `notis tools exec ${ctx.args.toolName} --arguments '${JSON.stringify(args)}'`, reason: 'Execute with these arguments' },
+        { command: `notis tools exec ${requestedToolName} --arguments '${JSON.stringify(args)}'`, reason: 'Execute with these arguments' },
       ],
     });
   }
@@ -173,26 +281,29 @@ async function toolsExecHandler(ctx) {
 
   const result = await runToolCommand({
     runtime: ctx.runtime,
-    toolName: 'notis_execute_tool',
+    toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
     arguments_: {
-      tool_name: ctx.args.toolName,
-      arguments: args,
-      ...(toolkits.length ? { toolkits } : {}),
+      tools: [{ tool_slug: requestedToolName, arguments: args }],
     },
     mutating: true,
     idempotencyKey,
+    fileBindings,
   });
 
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
     data: result.payload,
-    humanSummary: `Executed tool ${ctx.args.toolName}`,
+    humanSummary: `Executed tool ${requestedToolName}`,
     meta: { mutating: true, idempotency_key: idempotencyKey },
     renderHuman: () => JSON.stringify(result.payload, null, 2),
   });
 }
 
 async function toolsExecParallelHandler(ctx) {
+  const parallelFileBindings = await parseFileBindings(ctx.options.file);
+  if (parallelFileBindings.length) {
+    throw usageError('--file is supported by `notis tools exec` only; exec-parallel accepts JSON calls without file uploads.');
+  }
   const calls = parseMaybeJson(ctx.args.calls, 'calls');
   if (!Array.isArray(calls) || !calls.length) {
     throw usageError('calls must be a non-empty JSON array of {tool_name, arguments} objects');
@@ -203,16 +314,15 @@ async function toolsExecParallelHandler(ctx) {
       throw usageError(`calls[${i}] missing required "tool_name" string`);
     }
   }
-  ensureLongRunningToolTimeout(ctx, calls.map((call) => call.tool_name));
+  ensureLongRunningToolTimeout(ctx, calls.map((call) => localNotisToolSlug(call.tool_name)));
 
   const data = await Promise.all(
     calls.map((call) =>
       runToolCommand({
         runtime: ctx.runtime,
-        toolName: 'notis_execute_tool',
+        toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
         arguments_: {
-          tool_name: call.tool_name,
-          arguments: call.arguments || {},
+          tools: [{ tool_slug: localNotisToolSlug(call.tool_name), arguments: call.arguments || {} }],
         },
         mutating: true,
         idempotencyKey: nextIdempotencyKey(ctx.globalOptions),
@@ -275,15 +385,15 @@ async function toolsLinkHandler(ctx) {
 export const toolsCommandSpecs = [
   {
     command_path: ['tools', 'toolkits'],
-    summary: 'List toolkit namespaces available to the active user.',
-    when_to_use: 'Use this before searching or executing generic tools.',
+    summary: 'List toolkit namespaces and connection statuses available to the active user.',
+    when_to_use: 'Use this to inspect connection state before searching or executing generic tools.',
     args_schema: { arguments: [], options: [] },
     examples: ['notis tools toolkits', 'notis tools toolkits --json'],
-    output_schema: 'Returns available toolkit namespaces.',
+    output_schema: 'Returns toolkit_connection_statuses from COMPOSIO_SEARCH_TOOLS, rendered as toolkit rows.',
     mutates: false,
     idempotent: true,
     related_commands: ['notis tools search <query>', 'notis tools describe <tool-name>'],
-    backend_call: { type: 'tool', name: 'notis_find_toolkits' },
+    backend_call: { type: 'tool', name: COMPOSIO_SEARCH_TOOLS },
     handler: toolsToolkitsHandler,
   },
   {
@@ -292,14 +402,14 @@ export const toolsCommandSpecs = [
     when_to_use: 'Use this when you need a generic capability that does not have a first-class CLI command.',
     args_schema: {
       arguments: [{ token: '<query>', description: 'Natural language description of the tool you need.' }],
-      options: [{ flags: '--toolkits <csv-or-json>', description: 'Optional subset of toolkit ids to search.' }],
+      options: [{ flags: '--known-fields <text>', key: 'knownFields', description: 'Optional known field hints, such as channel_name:general or user_email:a@example.com.' }],
     },
-    examples: ['notis tools search "send an email"', 'notis tools search "update framer page" --toolkits mcp-framer'],
-    output_schema: 'Returns tool matches with descriptions and parameter schemas.',
+    examples: ['notis tools search "send an email"', 'notis tools search "post on LinkedIn" --known-fields "platform:linkedin"'],
+    output_schema: 'Returns the full COMPOSIO_SEARCH_TOOLS response. Human output renders canonical names, connection status, and schema availability.',
     mutates: false,
     idempotent: true,
     related_commands: ['notis tools toolkits', 'notis tools exec <tool-name>'],
-    backend_call: { type: 'tool', name: 'notis_find_tools' },
+    backend_call: { type: 'tool', name: COMPOSIO_SEARCH_TOOLS },
     handler: toolsSearchHandler,
   },
   {
@@ -308,14 +418,14 @@ export const toolsCommandSpecs = [
     when_to_use: 'Use this when you know the tool name and want its parameter schema before execution.',
     args_schema: {
       arguments: [{ token: '<tool-name>', description: 'Exact tool name to locate and describe.' }],
-      options: [{ flags: '--toolkits <csv-or-json>', description: 'Optional subset of toolkit ids to search.' }],
+      options: [],
     },
-    examples: ['notis tools describe composio-gmail-default-send_email', 'notis tools describe notis-default-query --toolkits notis-default'],
+    examples: ['notis tools describe composio-gmail-send_email', 'notis tools describe LOCAL_NOTIS_DATABASE_QUERY'],
     output_schema: 'Returns one tool descriptor with name, description, and parameters.',
     mutates: false,
     idempotent: true,
     related_commands: ['notis tools search <query>', 'notis tools exec <tool-name>'],
-    backend_call: { type: 'tool', name: 'notis_find_tools' },
+    backend_call: { type: 'tool', name: COMPOSIO_GET_TOOL_SCHEMAS },
     handler: toolsDescribeHandler,
   },
   {
@@ -326,24 +436,25 @@ export const toolsCommandSpecs = [
       arguments: [{ token: '<tool-name>', description: 'Tool name returned by `notis tools search`.' }],
       options: [
         { flags: '--arguments <json>', description: 'JSON object, @file path, or - for stdin.' },
+        { flags: '--file <argument-path=local-path>', description: 'Upload a local file into a file-uploadable tool argument. Repeatable.', collect: true },
         { flags: '--get-schema', description: 'Display the tool parameter schema without executing.' },
         { flags: '--dry-run', description: 'Validate arguments against the tool schema without executing.' },
-        { flags: '--toolkits <csv-or-json>', description: 'Optional toolkit namespace(s) to use when resolving the tool.' },
       ],
     },
     examples: [
-      'notis tools exec notis-default-query --arguments \'{"database_slug":"tasks","query":{}}\'',
-      'notis tools exec notis-default-get_database --arguments \'{"database_slug":"tasks"}\'',
-      'notis tools exec notis-default-query --get-schema',
-      'notis tools exec notis-default-query --dry-run --arguments \'{"database_slug":"tasks","query":{}}\'',
-      'notis tools exec notis-default-query --arguments @query.json',
-      'notis tools exec notis-default-query --arguments - < query.json',
+      'notis tools exec LOCAL_NOTIS_DATABASE_QUERY --arguments \'{"database_slug":"tasks","query":{}}\'',
+      'notis tools exec LOCAL_NOTIS_DATABASE_GET_DATABASE --arguments \'{"database_slug":"tasks"}\'',
+      'notis tools exec LOCAL_NOTIS_DATABASE_QUERY --get-schema',
+      'notis tools exec LOCAL_NOTIS_DATABASE_QUERY --dry-run --arguments \'{"database_slug":"tasks","query":{}}\'',
+      'notis tools exec LOCAL_NOTIS_DATABASE_QUERY --arguments @query.json',
+      'notis tools exec LOCAL_NOTIS_DATABASE_QUERY --arguments - < query.json',
+      'notis tools exec composio-dropbox-upload_file --arguments \'{"path":"/target/in/dropbox.pdf"}\' --file content=./Invoice.pdf',
     ],
     output_schema: 'Returns the raw tool execution payload.',
     mutates: true,
     idempotent: true,
     related_commands: ['notis tools search <query>', 'notis tools describe <tool-name>', 'notis tools exec-parallel <calls>'],
-    backend_call: { type: 'tool', name: 'notis_execute_tool' },
+    backend_call: { type: 'tool', name: COMPOSIO_MULTI_EXECUTE_TOOL },
     handler: toolsExecHandler,
   },
   {
@@ -354,16 +465,18 @@ export const toolsCommandSpecs = [
       arguments: [
         { token: '<calls>', description: 'JSON array of {tool_name, arguments} objects.' },
       ],
-      options: [],
+      options: [
+        { flags: '--file <argument-path=local-path>', description: 'Unsupported for exec-parallel; use tools exec for file uploads.', collect: true },
+      ],
     },
     examples: [
-      'notis tools exec-parallel \'[{"tool_name":"notis-default-query","arguments":{"database_slug":"tasks","query":{}}},{"tool_name":"notis-default-list_databases","arguments":{}}]\'',
+      'notis tools exec-parallel \'[{"tool_name":"LOCAL_NOTIS_DATABASE_QUERY","arguments":{"database_slug":"tasks","query":{}}},{"tool_name":"LOCAL_NOTIS_DATABASE_LIST_DATABASES","arguments":{}}]\'',
     ],
     output_schema: 'Returns an array of results, one per tool call.',
     mutates: true,
     idempotent: true,
     related_commands: ['notis tools exec <tool-name>', 'notis tools search <query>'],
-    backend_call: { type: 'tool', name: 'notis_execute_tool' },
+    backend_call: { type: 'tool', name: COMPOSIO_MULTI_EXECUTE_TOOL },
     handler: toolsExecParallelHandler,
   },
   {

package/src/runtime/app-boundary-validator.js

@@ -4,10 +4,30 @@ import { fileURLToPath } from 'node:url';
 
 import { usageError } from './errors.js';
 
-const RULES_PATH = resolve(
-  dirname(fileURLToPath(import.meta.url)),
-  '../../../../server/config/notis_app_boundary_rules.json',
-);
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+
+// Candidate locations for the app boundary rules, in priority order:
+//  1. The monorepo server source (always fresh during local development).
+//  2. The copy bundled into the published package at build time (see
+//     scripts/copy-boundary-rules.js + package.json "files": config/). When the
+//     CLI is installed via npm, candidate 1 escapes the package and is absent,
+//     so the bundled copy is used. This is what was missing before: the package
+//     shipped only the escaping path and crashed with ENOENT on any command.
+export const RULES_PATH_CANDIDATES = [
+  resolve(moduleDir, '../../../../server/config/notis_app_boundary_rules.json'),
+  resolve(moduleDir, '../../config/notis_app_boundary_rules.json'),
+];
+
+export function resolveRulesPath() {
+  for (const candidate of RULES_PATH_CANDIDATES) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  // Fall back to the bundled-copy path so any error message points inside the
+  // package rather than at an escaping monorepo path.
+  return RULES_PATH_CANDIDATES[RULES_PATH_CANDIDATES.length - 1];
+}
 
 const SOURCE_FILE_EXTENSIONS = new Set(['.js', '.jsx', '.ts', '.tsx', '.css', '.scss', '.sass', '.pcss']);
 const IGNORED_SOURCE_DIRS = new Set([
@@ -20,20 +40,50 @@ const IGNORED_SOURCE_DIRS = new Set([
   'coverage',
 ]);
 
-function loadBoundaryRules() {
-  return JSON.parse(readFileSync(RULES_PATH, 'utf-8'));
-}
-
 function compileRules(entries) {
-  return (entries || []).map((entry) => ({
+  // Tolerate a rules object whose javascript/css field is a non-array (a corrupt
+  // file can parse to {"javascript":"x"}); coerce anything non-array to [] so
+  // getCompiledRules degrades to an empty rule set instead of throwing on .map.
+  return (Array.isArray(entries) ? entries : []).map((entry) => ({
     regex: new RegExp(entry.pattern, 'm'),
     message: entry.message,
   }));
 }
 
-const boundaryRules = loadBoundaryRules();
-const javascriptRules = compileRules(boundaryRules.javascript);
-const cssRules = compileRules(boundaryRules.css);
+// Loaded lazily on first validation rather than at module import time: a
+// missing rules file must not prevent the whole CLI from booting (every
+// command imports this module transitively). The server re-validates on
+// save/deploy, so an empty client-side rule set degrades gracefully.
+let compiledRules = null;
+
+function getCompiledRules() {
+  if (compiledRules) {
+    return compiledRules;
+  }
+  let boundaryRules = { javascript: [], css: [] };
+  try {
+    const parsed = JSON.parse(readFileSync(resolveRulesPath(), 'utf-8'));
+    // Keep the safe default unless the file is a real rules object: a valid but
+    // non-object payload (null, a number, an array) would otherwise throw on the
+    // `.javascript`/`.css` deref below, reintroducing the boot crash this guards.
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      boundaryRules = parsed;
+    } else {
+      process.stderr.write(
+        'Warning: Notis app boundary rules are not a rules object; skipping local boundary checks.\n',
+      );
+    }
+  } catch (error) {
+    process.stderr.write(
+      `Warning: could not load Notis app boundary rules (${error.message}); skipping local boundary checks.\n`,
+    );
+  }
+  compiledRules = {
+    javascript: compileRules(boundaryRules.javascript),
+    css: compileRules(boundaryRules.css),
+  };
+  return compiledRules;
+}
 
 function collectProjectFiles(projectDir, dir, results) {
   if (!existsSync(dir)) {
@@ -81,11 +131,12 @@ function applyRules(content, rules, relPath) {
 
 function validateTextFile(relPath, content) {
   const extension = extname(relPath);
+  const rules = getCompiledRules();
   if (extension === '.css' || extension === '.scss' || extension === '.sass' || extension === '.pcss') {
-    return applyRules(content, cssRules, relPath);
+    return applyRules(content, rules.css, relPath);
   }
   if (extension === '.js' || extension === '.jsx' || extension === '.ts' || extension === '.tsx') {
-    return applyRules(content, javascriptRules, relPath);
+    return applyRules(content, rules.javascript, relPath);
   }
   return [];
 }

package/src/runtime/profiles.js

@@ -212,15 +212,21 @@ export function resolveRuntimeProfile(globalOptions = {}, { requireAuth = true }
     });
   }
 
+  // An explicit NOTIS_JWT is a complete credential override: use it verbatim and do
+  // NOT attempt a stored-profile dev_portal token refresh (whose refresh_token may be
+  // stale or belong to a different session). Without this, a long-lived shell with an
+  // expired profile refresh_token fails every command with invalid_grant even though
+  // the supplied NOTIS_JWT is valid.
+  const usingEnvJwt = Boolean(process.env.NOTIS_JWT);
   return {
     config,
     profileName,
     apiBase,
     jwt,
-    authMode: profile.auth_mode,
-    refreshToken: profile.refresh_token,
-    accessExpiresAt: profile.access_expires_at,
-    refreshExpiresAt: profile.refresh_expires_at,
+    authMode: usingEnvJwt ? 'jwt' : profile.auth_mode,
+    refreshToken: usingEnvJwt ? undefined : profile.refresh_token,
+    accessExpiresAt: usingEnvJwt ? undefined : profile.access_expires_at,
+    refreshExpiresAt: usingEnvJwt ? undefined : profile.refresh_expires_at,
     agentMode,
     nonInteractive,
     outputMode,