@notis_ai/cli 0.2.22 → 0.2.24

package/README.md

@@ -85,7 +85,7 @@ Options:
 Examples:
 - `npx --package @notis_ai/cli@latest -- notis login`
 - `npx --package @notis_ai/cli@latest -- notis login --profile work`
-- `npx --package @notis_ai/cli@latest -- notis login --profile beta --api-base https://api-beta.notis.ai`
+- `npx --package @notis_ai/cli@latest -- notis login --profile nightly --api-base https://api-nightly.notis.ai`
 - `npx --package @notis_ai/cli@latest -- notis login --no-browser --print-url`
 - `npx --package @notis_ai/cli@latest -- notis login --mode browser`
 - `npx --package @notis_ai/cli@latest -- notis login --mode code`

package/dist/agent-hooks/notis-agent-hook.mjs

@@ -7434,6 +7434,18 @@ var init_config_lock = __esm({
 function isReleaseChannel(value) {
   return RELEASE_CHANNELS.includes(value);
 }
+function normalizeReleaseChannel(value) {
+  if (value === "beta") return "nightly";
+  return isReleaseChannel(value) ? value : null;
+}
+function channelFromApiBase(apiBase) {
+  if (typeof apiBase !== "string" || !apiBase) return null;
+  try {
+    return API_HOST_CHANNELS[new URL(apiBase).hostname] || null;
+  } catch {
+    return null;
+  }
+}
 function packageTagForChannel(channel) {
   return CHANNEL_TAGS[channel] || CHANNEL_TAGS.stable;
 }
@@ -7441,22 +7453,19 @@ function cliCommandForChannel(channel) {
   return `npx --package ${CLI_PACKAGE_NAME}@${packageTagForChannel(channel)} -- notis`;
 }
 function channelFromVersion(version) {
-  return String(version || "").includes("-") ? "beta" : "stable";
+  return String(version || "").includes("-") ? "nightly" : "stable";
 }
-function channelFromProfile(profile = {}) {
-  if (isReleaseChannel(profile.channel)) {
-    return profile.channel;
-  }
-  if (profile.beta === true) return "beta";
+function pinnedReleaseChannel(profile = {}) {
+  if (profile.beta === true) return "nightly";
   if (profile.beta === false) return "stable";
+  return normalizeReleaseChannel(profile.channel) || normalizeReleaseChannel(profile.release_channel);
+}
+function channelFromProfile(profile = {}) {
+  const pinned = pinnedReleaseChannel(profile);
+  if (pinned) return pinned;
   for (const candidate of [profile.oauth_api_base, profile.api_base]) {
-    if (typeof candidate !== "string" || !candidate) continue;
-    try {
-      const { hostname } = new URL(candidate);
-      if (hostname === "api-beta.notis.ai") return "beta";
-      if (hostname === "api.notis.ai") return "stable";
-    } catch {
-    }
+    const channel = channelFromApiBase(candidate);
+    if (channel) return channel;
   }
   return null;
 }
@@ -7487,7 +7496,9 @@ function resolveChannelSwitch({
   const runningChannel = channelFromVersion(runningVersion);
   const targetChannel = channelFromProfile(profile);
   const stay = (reason) => ({ switch: false, reason, runningChannel, targetChannel });
-  if (env[CHANNEL_SWITCH_ENV] === "1") return stay("already_switched");
+  if (env[CHANNEL_SWITCH_ENV] && env[CHANNEL_SWITCH_ENV] !== LEGACY_CHANNEL_SWITCHED) {
+    return stay("already_switched");
+  }
   if (env[CHANNEL_DISABLE_ENV] === "0") return stay("disabled");
   if (!targetChannel) return stay("profile_channel_unknown");
   if (targetChannel === runningChannel) return stay("channel_matches");
@@ -7502,13 +7513,19 @@ function resolveChannelSwitch({
     args: ["--yes", "--package", `${CLI_PACKAGE_NAME}@${packageTagForChannel(targetChannel)}`, "--", "notis"]
   };
 }
-var RELEASE_CHANNELS, CHANNEL_TAGS, CLI_PACKAGE_NAME, CHANNEL_SWITCH_ENV, CHANNEL_DISABLE_ENV;
+var RELEASE_CHANNELS, CHANNEL_TAGS, API_HOST_CHANNELS, CLI_PACKAGE_NAME, CHANNEL_SWITCH_ENV, LEGACY_CHANNEL_SWITCHED, CHANNEL_DISABLE_ENV;
 var init_channel = __esm({
   "src/runtime/channel.js"() {
-    RELEASE_CHANNELS = ["stable", "beta"];
-    CHANNEL_TAGS = { stable: "latest", beta: "beta" };
+    RELEASE_CHANNELS = ["stable", "nightly"];
+    CHANNEL_TAGS = { stable: "latest", nightly: "nightly" };
+    API_HOST_CHANNELS = {
+      "api.notis.ai": "stable",
+      "api-beta.notis.ai": "nightly",
+      "api-nightly.notis.ai": "nightly"
+    };
     CLI_PACKAGE_NAME = "@notis_ai/cli";
     CHANNEL_SWITCH_ENV = "NOTIS_CLI_CHANNEL_SWITCHED";
+    LEGACY_CHANNEL_SWITCHED = "1";
     CHANNEL_DISABLE_ENV = "NOTIS_CLI_AUTO_CHANNEL";
   }
 });
@@ -7763,11 +7780,10 @@ function normalizeProfile(rawProfile = {}) {
   const raw = rawProfile && typeof rawProfile === "object" ? rawProfile : {};
   return {
     api_base: typeof raw.api_base === "string" ? raw.api_base : void 0,
-    beta: typeof raw.beta === "boolean" ? raw.beta : void 0,
-    // Which published CLI build this profile runs, as the deployment reported
-    // it at login. Unknown values are dropped rather than trusted: this key
-    // decides which code executes on the next run.
-    channel: isReleaseChannel(raw.channel) ? raw.channel : void 0,
+    // Which published CLI build this profile runs (`stable` | `nightly`), as
+    // the account reported it at login. Unknown values are dropped rather
+    // than trusted: this key decides which code executes on the next run.
+    release_channel: pinnedReleaseChannel(raw) || void 0,
     label: typeof raw.label === "string" ? raw.label : void 0,
     dev_access_token: typeof raw.dev_access_token === "string" ? raw.dev_access_token : void 0,
     dev_access_expires_at: typeof raw.dev_access_expires_at === "number" ? raw.dev_access_expires_at : void 0,
@@ -8048,21 +8064,8 @@ function isLiveApiBase(value) {
   }
 }
 function resolveDefaultLiveApiBase(profile = {}) {
-  if (profile.beta === true) {
-    return BETA_API_BASE;
-  }
-  if (profile.beta === false) {
-    return DEFAULT_API_BASE;
-  }
-  if (isLiveApiBase(profile.api_base)) {
-    try {
-      if (new URL(profile.api_base).hostname === "api-beta.notis.ai") {
-        return BETA_API_BASE;
-      }
-    } catch {
-    }
-  }
-  return DEFAULT_API_BASE;
+  const channel = pinnedReleaseChannel(profile) || (isLiveApiBase(profile.api_base) ? channelFromProfile({ api_base: profile.api_base }) : null);
+  return channel === "nightly" ? NIGHTLY_API_BASE : DEFAULT_API_BASE;
 }
 function getApiBase(config, profileName, override) {
   if (override) {
@@ -8366,7 +8369,7 @@ function credentialIsExpired(runtime, profile = {}, nowSeconds = Math.floor(Date
 function workspacePath(appId) {
   return join2(WORKSPACE_DIR, appId);
 }
-var CONFIG_DIR, CONFIG_FILE, WORKSPACE_DIR, DEFAULT_API_BASE, BETA_API_BASE, DEFAULT_PROFILE, PROFILE_NAME_PATTERN, LEGACY_DESKTOP_PROFILE_KEYS, WORKTREE_RUNTIME_FILENAME, WORKTREE_ROUTING_FILENAME, LOCAL_API_HOSTS, LIVE_API_HOSTS;
+var CONFIG_DIR, CONFIG_FILE, WORKSPACE_DIR, DEFAULT_API_BASE, NIGHTLY_API_BASE, DEFAULT_PROFILE, PROFILE_NAME_PATTERN, LEGACY_DESKTOP_PROFILE_KEYS, WORKTREE_RUNTIME_FILENAME, WORKTREE_ROUTING_FILENAME, LOCAL_API_HOSTS, LIVE_API_HOSTS;
 var init_profiles = __esm({
   "src/runtime/profiles.js"() {
     init_errors();
@@ -8378,7 +8381,7 @@ var init_profiles = __esm({
     CONFIG_FILE = join2(CONFIG_DIR, "config.json");
     WORKSPACE_DIR = join2(CONFIG_DIR, "workspace");
     DEFAULT_API_BASE = "https://api.notis.ai";
-    BETA_API_BASE = "https://api-beta.notis.ai";
+    NIGHTLY_API_BASE = "https://api-nightly.notis.ai";
     DEFAULT_PROFILE = "default";
     PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
     LEGACY_DESKTOP_PROFILE_KEYS = [
@@ -8393,7 +8396,7 @@ var init_profiles = __esm({
     WORKTREE_RUNTIME_FILENAME = join2(".context", "notis-runtime.json");
     WORKTREE_ROUTING_FILENAME = join2(".context", "notis-routing.json");
     LOCAL_API_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
-    LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-beta.notis.ai"]);
+    LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-nightly.notis.ai", "api-beta.notis.ai"]);
   }
 });
 
@@ -8807,8 +8810,9 @@ async function discoverCliOAuth(apiBase, fetchImpl = fetch) {
     copyPasteRedirectUri: protectedResource.notis_cli_copy_paste_redirect_uri,
     // A deployment that predates channel advertising, or a local one with no
     // published build, leaves this null and the profile keeps resolving its
-    // channel from the endpoint it authorized against.
-    channel: isReleaseChannel(protectedResource.notis_cli_channel) ? protectedResource.notis_cli_channel : null,
+    // channel from the endpoint it authorized against. Deployments from before
+    // the rename still answer `beta`, which is the nightly channel.
+    channel: normalizeReleaseChannel(protectedResource.notis_cli_channel),
     authorizationEndpoint: authorizationServer.authorization_endpoint,
     tokenEndpoint: authorizationServer.token_endpoint,
     revocationEndpoint: authorizationServer.revocation_endpoint
@@ -9327,14 +9331,6 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
   const now = Math.floor(Date.now() / 1e3);
   const payload = decodeJwtPayload(tokenResponse.access_token);
   const oauthApiBase = (metadata.apiBase || runtime.apiBase || "").replace(/\/+$/, "");
-  let beta;
-  try {
-    const hostname = new URL(oauthApiBase).hostname;
-    if (hostname === "api-beta.notis.ai") beta = true;
-    else if (hostname === "api.notis.ai") beta = false;
-  } catch {
-    beta = void 0;
-  }
   const config = updateConfig((latest) => {
     const next = ensureProfile(latest, runtime.profileName);
     const profile = next.profiles[runtime.profileName];
@@ -9344,11 +9340,12 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
       // one API, and the environment the user just authorized against is the
       // only endpoint the resulting token is accepted by.
       api_base: oauthApiBase || profile.api_base,
-      beta: beta ?? profile.beta,
       // The deployment that just authorized this profile also names the
       // published build that belongs to it. Pinning it here is what lets the
       // next run correct itself without the user knowing a channel exists.
-      channel: isReleaseChannel(metadata.channel) ? metadata.channel : channelFromProfile({ ...profile, beta: beta ?? profile.beta, api_base: oauthApiBase }) ?? profile.channel,
+      // followAccountReleaseChannel then replaces it with the account's own
+      // answer once the new grant can ask for it.
+      release_channel: metadata.channel || channelFromApiBase(oauthApiBase) || profile.release_channel,
       oauth_api_base: oauthApiBase || profile.oauth_api_base,
       oauth_resource: metadata.resource,
       oauth_access_token: tokenResponse.access_token,
@@ -10009,12 +10006,14 @@ function confirmCommand(profileName, channel, apiBase) {
   return [
     cliCommandForChannel(channel),
     `--profile ${quoteShellArgument(profileName || "default")}`,
-    `--api-base ${quoteShellArgument(apiBase)}`,
+    // Only an explicit route is repeated: without one, confirming must stay
+    // free to follow the account to its release channel.
+    ...apiBase ? [`--api-base ${quoteShellArgument(apiBase)}`] : [],
     "start"
   ].join(" ");
 }
 function authorizationChannel(metadata, runtime, pending = null) {
-  return metadata.channel || pending?.channel || channelFromProfile({ api_base: pending?.api_base || runtime.apiBase });
+  return metadata.channel || normalizeReleaseChannel(pending?.channel) || channelFromProfile({ api_base: pending?.api_base || runtime.apiBase });
 }
 function updateRuntimeFromOAuthProfile(runtime, profile) {
   const oauthApiBase = getOAuthApiBase(profile);
@@ -10092,6 +10091,9 @@ async function redeemAuthorizationCode(runtime, code, fetchImpl) {
     }
     if (pending.api_base) {
       runtime.apiBase = pending.api_base;
+      if (pending.api_base_explicit && !runtime.requestedApiBase) {
+        runtime.requestedApiBase = pending.api_base;
+      }
     }
     metadata = {
       apiBase: pending.api_base,
@@ -10100,7 +10102,7 @@ async function redeemAuthorizationCode(runtime, code, fetchImpl) {
       clientId: pending.client_id,
       tokenEndpoint: pending.token_endpoint,
       revocationEndpoint: pending.revocation_endpoint || `${String(pending.issuer || "").replace(/\/+$/, "")}/oauth/revoke`,
-      channel: pending.channel
+      channel: normalizeReleaseChannel(pending.channel)
     };
     if (!metadata.issuer || !metadata.resource || !metadata.clientId || !metadata.tokenEndpoint) {
       throw oauthError(
@@ -10269,7 +10271,7 @@ async function loginWithOAuth(runtime, options = {}, output, fetchImpl = fetch,
             confirm_command: confirmCommand(
               runtime.profileName,
               authorizationChannel(metadata, runtime),
-              live.api_base
+              runtime.requestedApiBase ? live.api_base : null
             )
           }
         };
@@ -10362,6 +10364,7 @@ async function loginWithOAuth(runtime, options = {}, output, fetchImpl = fetch,
       savePendingAuthorization(runtime, {
         profile: runtime.profileName,
         api_base: runtime.apiBase,
+        api_base_explicit: Boolean(runtime.requestedApiBase),
         verifier,
         state,
         redirect_uri: redirectUri,
@@ -10431,7 +10434,7 @@ async function loginWithOAuth(runtime, options = {}, output, fetchImpl = fetch,
             confirm_command: confirmCommand(
               runtime.profileName,
               authorizationChannel(metadata, runtime),
-              runtime.apiBase
+              runtime.requestedApiBase ? runtime.apiBase : null
             )
           }
         };
@@ -31992,7 +31995,8 @@ var UPSELL_CODES = /* @__PURE__ */ new Set([
 var NESTED_KEYS = ["error", "details", "data", "result", "response", "entitlement_access"];
 var PORTAL_ORIGINS = {
   "api.notis.ai": "https://app.notis.ai",
-  "api-beta.notis.ai": "https://beta.notis.ai"
+  "api-nightly.notis.ai": "https://app-nightly.notis.ai",
+  "api-beta.notis.ai": "https://app-nightly.notis.ai"
 };
 function isUpsellBody(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -32180,6 +32184,137 @@ init_oauth();
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { dirname as dirname5 } from "node:path";
+
+// src/runtime/release-channel.js
+init_errors();
+init_auth_recovery();
+init_channel();
+init_profiles();
+var CHANNEL_LABELS = { stable: "Stable", nightly: "Nightly" };
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+var RELEASE_CHANNEL_TIMEOUT_MS = 1e4;
+function releaseChannelLabel(channel) {
+  return CHANNEL_LABELS[channel] || channel;
+}
+function isLoopbackApiBase(apiBase) {
+  try {
+    return LOOPBACK_HOSTS.has(new URL(apiBase).hostname);
+  } catch {
+    return false;
+  }
+}
+function trustedApiOrigin(value) {
+  if (typeof value !== "string" || !value) return null;
+  try {
+    const url = new URL(value);
+    const notisHost = url.hostname === "notis.ai" || url.hostname.endsWith(".notis.ai");
+    return url.protocol === "https:" && notisHost && !url.username && !url.password ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
+function followsAccountReleaseChannel(runtime = {}, env = process.env) {
+  if (runtime.requestedApiBase || env.NOTIS_API_BASE) return false;
+  if (runtime.worktreeRuntime || runtime.credentialKind !== "oauth" || !runtime.jwt) return false;
+  return Boolean(runtime.apiBase) && !isLoopbackApiBase(runtime.apiBase);
+}
+function parseReleaseChannelAnswer(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const releaseChannel = normalizeReleaseChannel(payload.release_channel);
+  if (!releaseChannel) return null;
+  const deploymentChannel = normalizeReleaseChannel(payload.deployment_channel);
+  const origins = payload.origins && typeof payload.origins === "object" ? payload.origins : {};
+  return {
+    releaseChannel,
+    deploymentChannel,
+    match: !deploymentChannel || payload.match === true || deploymentChannel === releaseChannel,
+    apiOrigin: trustedApiOrigin(origins.api)
+  };
+}
+async function fetchAccountReleaseChannel(runtime, fetchImpl = fetch) {
+  try {
+    const response = await fetchImpl(`${String(runtime.apiBase).replace(/\/+$/, "")}/release_channel`, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${runtime.jwt}`,
+        ...runtime.cliVersion ? { "X-Notis-CLI-Version": runtime.cliVersion } : {}
+      },
+      signal: AbortSignal.timeout(RELEASE_CHANNEL_TIMEOUT_MS)
+    });
+    if (!response.ok) return null;
+    return parseReleaseChannelAnswer(await response.json());
+  } catch {
+    return null;
+  }
+}
+function persistReleaseChannel(runtime, releaseChannel) {
+  const config = updateConfig((latest) => {
+    const profile = latest.profiles[runtime.profileName];
+    if (profile) profile.release_channel = releaseChannel;
+    return latest;
+  });
+  runtime.channel = releaseChannel;
+  return config.profiles[runtime.profileName];
+}
+async function followAccountReleaseChannel(runtime, result, {
+  login,
+  options = {},
+  output,
+  fetchImpl = fetch,
+  env = process.env,
+  followed = false
+} = {}) {
+  if (!result?.profile || !followsAccountReleaseChannel(runtime, env)) return result;
+  const answer = await fetchAccountReleaseChannel(runtime, fetchImpl);
+  if (!answer?.deploymentChannel) return result;
+  if (answer.match) {
+    return { ...result, profile: persistReleaseChannel(runtime, answer.releaseChannel) || result.profile };
+  }
+  const label = releaseChannelLabel(answer.releaseChannel);
+  if (followed || !answer.apiOrigin || answer.apiOrigin === runtime.apiBase) {
+    output?.notice?.(
+      `Your account uses the ${label} channel, but this sign-in could not move there. Run: ${releaseChannelLoginCommand(runtime, answer)}`
+    );
+    return result;
+  }
+  output?.notice?.(`Your account uses the ${label} channel, signing you in there.`);
+  runtime.apiBase = answer.apiOrigin;
+  const { code: _code, reusePersistedCredential: _reuse, ...nextOptions } = options;
+  const next = await login(runtime, nextOptions, output);
+  if (!next?.profile) return next;
+  return followAccountReleaseChannel(runtime, next, {
+    login,
+    options: nextOptions,
+    output,
+    fetchImpl,
+    env,
+    followed: true
+  });
+}
+function releaseChannelLoginCommand(runtime = {}, answer = {}) {
+  return [
+    cliCommandForChannel(answer.releaseChannel),
+    ...runtime.profileName && runtime.profileName !== "default" ? [`--profile ${quoteShellArgument(runtime.profileName)}`] : [],
+    ...answer.apiOrigin ? [`--api-base ${quoteShellArgument(answer.apiOrigin)}`] : [],
+    "login"
+  ].join(" ");
+}
+function releaseChannelMismatchError(payload, runtime = {}) {
+  const answer = parseReleaseChannelAnswer(payload) || {};
+  const label = releaseChannelLabel(answer.releaseChannel);
+  const message = typeof payload?.message === "string" && payload.message || (answer.releaseChannel ? `Your account uses the ${label} channel, which this Notis API does not serve.` : "Your account uses another Notis release channel than this API serves.");
+  const command = releaseChannelLoginCommand(runtime, answer);
+  return new CliError({
+    code: "release_channel_mismatch",
+    message: `${message} Sign in again with: ${command}`,
+    exitCode: EXIT_CODES.auth,
+    details: payload || {},
+    hints: [{ command, reason: `Sign this profile in on the ${label || "right"} channel` }]
+  });
+}
+
+// src/runtime/transport.js
 init_retry();
 function escapeMultipartHeaderValue(value) {
   return String(value ?? "").replace(/"/g, "%22").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
@@ -32276,6 +32411,9 @@ function normalizeBackendError(status, payload, runtime) {
       details: payload || {}
     });
   }
+  if (status === 403 && backendError === "release_channel_mismatch") {
+    return releaseChannelMismatchError(payload, runtime);
+  }
   if (status === 403) {
     const upsellBody = findUpsell(payload);
     if (upsellBody) {
@@ -32776,6 +32914,18 @@ function validateArguments(schema, args) {
 }
 
 // src/command-specs/tools.js
+var ROUTER_HELPERS = /* @__PURE__ */ new Set([
+  COMPOSIO_SEARCH_TOOLS,
+  COMPOSIO_GET_TOOL_SCHEMAS,
+  COMPOSIO_MULTI_EXECUTE_TOOL,
+  "COMPOSIO_MANAGE_CONNECTIONS",
+  "COMPOSIO_WAIT_FOR_CONNECTIONS",
+  "COMPOSIO_REMOTE_WORKBENCH",
+  "COMPOSIO_REMOTE_BASH_TOOL"
+]);
+function executionRequest(toolName, arguments_) {
+  return ROUTER_HELPERS.has(toolName) ? { toolName, arguments_ } : { toolName: COMPOSIO_MULTI_EXECUTE_TOOL, arguments_: { tools: [{ tool_slug: toolName, arguments: arguments_ }] } };
+}
 async function resolveJsonInput(value, label) {
   if (!value) return void 0;
   if (value === "-") {
@@ -33159,10 +33309,7 @@ async function toolsExecHandler(ctx) {
   });
   const result = await runToolCommand({
     runtime: ctx.runtime,
-    toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
-    arguments_: {
-      tools: [{ tool_slug: requestedToolName, arguments: args }]
-    },
+    ...executionRequest(requestedToolName, args),
     // The server is authoritative about provider/MCP effects. A tool name that
     // looks like a read is not proof of read-only behavior, so generic
     // executions always carry a key and use mutation-safe transport retries.
@@ -33245,8 +33392,7 @@ ${reason}`
   ctx.output.emitProgress({ phase: "execute", message: `Applying ${requestedToolName}` });
   const applied = await runToolCommand({
     runtime: ctx.runtime,
-    toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
-    arguments_: { tools: [{ tool_slug: requestedToolName, arguments: decision.arguments }] },
+    ...executionRequest(requestedToolName, decision.arguments),
     mutating: true,
     idempotencyKey: confirmKey,
     fileBindings
@@ -33278,10 +33424,7 @@ async function toolsExecParallelHandler(ctx) {
     calls.map(
       (call) => runToolCommand({
         runtime: ctx.runtime,
-        toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
-        arguments_: {
-          tools: [{ tool_slug: localNotisToolSlug(call.tool_name), arguments: call.arguments || {} }]
-        },
+        ...executionRequest(localNotisToolSlug(call.tool_name), call.arguments || {}),
         mutating: true,
         idempotencyKey: nextIdempotencyKey(ctx.globalOptions)
       }).then((r) => ({
@@ -33545,7 +33688,7 @@ function doctorChannelSummary(runtime, moduleDirectory = dirname6(fileURLToPath2
   const decision = resolveChannelSwitch({
     runningVersion: runtime.cliVersion,
     profile: {
-      channel: runtime.channel,
+      release_channel: runtime.channel,
       api_base: runtime.apiBase
     },
     moduleDirectory
@@ -34935,7 +35078,11 @@ var agentsCommandSpecs = [
 
 // src/command-specs/auth.js
 async function loginHandler(ctx) {
-  const result = await loginWithOAuth(ctx.runtime, ctx.options, ctx.output);
+  const result = await followAccountReleaseChannel(
+    ctx.runtime,
+    await loginWithOAuth(ctx.runtime, ctx.options, ctx.output),
+    { login: loginWithOAuth, options: ctx.options, output: ctx.output }
+  );
   if (result.agentAuthorization) {
     const presentation = loginAgentAuthorizationPresentation(result.agentAuthorization);
     return ctx.output.emitSuccess({
@@ -35029,7 +35176,7 @@ var authCommandSpecs = [
     examples: [
       "notis login",
       "notis login --profile work",
-      "notis login --profile beta --api-base https://api-beta.notis.ai",
+      "notis login --profile nightly --api-base https://api-nightly.notis.ai",
       "notis login --no-browser --print-url",
       "notis login --mode browser",
       "notis login --mode code",
@@ -35207,7 +35354,26 @@ async function startHandler(ctx) {
     } catch {
     }
   }
+  const followChannel = (result) => followAccountReleaseChannel(runtime, result, {
+    login: loginWithOAuth,
+    options: { browser: true, mode: options.mode },
+    output
+  });
+  const authorizationResult = (authorization2) => {
+    const presentation = loginAgentAuthorizationPresentation(authorization2.agentAuthorization);
+    return output.emitSuccess({
+      command: "start",
+      data: {
+        authenticated: false,
+        profile: runtime.profileName,
+        ...authorization2.agentAuthorization
+      },
+      ...presentation
+    });
+  };
   if (isAuthenticated(runtime)) {
+    const followed = await followChannel({ profile: getProfile(loadConfig(), runtime.profileName) });
+    if (followed?.agentAuthorization) return authorizationResult(followed);
     return authenticatedResult(ctx);
   }
   if (options.briefOnly) {
@@ -35218,22 +35384,13 @@ async function startHandler(ctx) {
       hints: getAuthRecovery(runtime, { mode: "missing" }).hints
     });
   }
-  const authorization = await loginWithOAuth(
+  const authorization = await followChannel(await loginWithOAuth(
     runtime,
     { browser: true, mode: options.mode, reusePersistedCredential: true },
     output
-  );
+  ));
   if (authorization?.agentAuthorization) {
-    const presentation = loginAgentAuthorizationPresentation(authorization.agentAuthorization);
-    return output.emitSuccess({
-      command: "start",
-      data: {
-        authenticated: false,
-        profile: runtime.profileName,
-        ...authorization.agentAuthorization
-      },
-      ...presentation
-    });
+    return authorizationResult(authorization);
   }
   if (!isAuthenticated(runtime)) {
     throw new CliError({
@@ -37466,6 +37623,7 @@ import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as rea
 import { homedir as homedir8 } from "node:os";
 import { dirname as dirname13, join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
+var LIVE_API_BASES = ["https://api.notis.ai", "https://api-nightly.notis.ai", "https://api-beta.notis.ai"];
 var SKILL_SYNC_SERVICE_LABEL = "ai.notis.skills-sync";
 var bundlePath = fileURLToPath6(new URL("../../dist/skill-sync-worker.mjs", import.meta.url));
 function atomicWrite2(target, value, mode = 384) {
@@ -37483,7 +37641,7 @@ async function maybeInstallSkillSyncService(runtime, {
   fetchSettings,
   refresh
 } = {}) {
-  if (process.platform !== "darwin" || runtime.credentialKind !== "oauth" || config.current_profile !== runtime.profileName || !["https://api.notis.ai", "https://api-beta.notis.ai"].includes(runtime.apiBase)) return;
+  if (process.platform !== "darwin" || runtime.credentialKind !== "oauth" || config.current_profile !== runtime.profileName || !LIVE_API_BASES.includes(runtime.apiBase)) return;
   const plist = join12(homedir8(), "Library", "LaunchAgents", `${SKILL_SYNC_SERVICE_LABEL}.plist`);
   if (existsSync9(plist)) {
     const saved = readFileSync13(plist, "utf8");
@@ -37498,7 +37656,7 @@ async function maybeInstallSkillSyncService(runtime, {
 }
 async function installSkillSyncService(runtime, options = {}) {
   if ((options.platform || process.platform) !== "darwin") return { status: "unsupported_platform" };
-  if (runtime.credentialKind !== "oauth" || !runtime.oauthUserId || !["https://api.notis.ai", "https://api-beta.notis.ai"].includes(runtime.apiBase)) {
+  if (runtime.credentialKind !== "oauth" || !runtime.oauthUserId || !LIVE_API_BASES.includes(runtime.apiBase)) {
     return { status: "skipped_non_personal_profile" };
   }
   return withSkillSyncLock(
@@ -37515,7 +37673,7 @@ async function installSkillSyncServiceLocked(runtime, {
   uid = process.getuid?.()
 } = {}) {
   if (platform !== "darwin") return { status: "unsupported_platform" };
-  if (runtime.credentialKind !== "oauth" || runtime.envCredentialOverride || !isValidProfileName(runtime.profileName) || !["https://api.notis.ai", "https://api-beta.notis.ai"].includes(runtime.apiBase)) {
+  if (runtime.credentialKind !== "oauth" || runtime.envCredentialOverride || !isValidProfileName(runtime.profileName) || !LIVE_API_BASES.includes(runtime.apiBase)) {
     return { status: "skipped_non_personal_profile" };
   }
   const root = join12(home, ".notis", "skills", "service");

package/dist/base-skills/notis-cli/.notis-base-skill.json

@@ -1 +1 @@
-{"schema":1,"stamp":1792843001,"commit":"974cae565cf52fde4d5a93fb0502c52b83e2abf9"}
+{"schema":1,"stamp":1793114190,"commit":"a7010008e66c7091ebc496a82627bd42a1c5ead6"}

package/dist/base-skills/notis-cli/SKILL.md

@@ -30,7 +30,7 @@ Use the registry-resolved published npm package everywhere:
 
 Always use this NPX command form so the agent runs the current published CLI, with one exception: on the Notis Cloud Computer (home folder `/vercel/sandbox`) the CLI is preinstalled and kept current, so run `notis ...` there with the same arguments, and use the NPX form only if `notis` is not found. Parallel NPX runs reinstall the package and can break each other. In hosted shells, the CLI is pre-authenticated through `NOTIS_JWT`. On a local machine the CLI holds its own OAuth grant: `notis login` authorizes one in the browser, and signing in to the Notis desktop app authorizes one automatically for that account. Either way the grant belongs to the CLI, which refreshes it without the desktop app running.
 
-`@latest` is correct for every account, including beta ones. Each deployment reports which published build belongs to it, `notis login` pins that on the profile, and a later run that finds itself on the wrong build hands the invocation to the right one before doing anything. Never substitute a channel by hand: pinning `@beta` on a production profile is how a machine ends up running a build its API does not expect. `notis doctor` reports the active channel, and `NOTIS_CLI_AUTO_CHANNEL=0` turns the hand-off off for a run.
+`@latest` is correct for every account, including nightly ones. Each account reports the release channel it belongs to, `notis login` pins that on the profile, and a later run that finds itself on the wrong build hands the invocation to the right one before doing anything. Never substitute a channel by hand: pinning `@nightly` on a stable profile is how a machine ends up running a build its API does not expect. `notis doctor` reports the active channel, and `NOTIS_CLI_AUTO_CHANNEL=0` turns the hand-off off for a run.
 
 The CLI bundles this `notis-cli` base skill and refreshes its canonical copy under `~/.notis/skills/base/` on every launch. It is independent of account-skill sync, feature flags, target selection, and cloud deletion.
 
@@ -38,7 +38,7 @@ The CLI bundles this `notis-cli` base skill and refreshes its canonical copy und
 
 A profile is one account paired with one API endpoint. Profiles live side by side; switching between them never signs any of them out.
 
-Notis Desktop signs the CLI in for every account saved in the app, one profile each. `default` keeps its name; each added account gets a profile named after its email with `@` turned into `-` (for example `flo-mindtheflo.com`), and Beta Desktop adds `-beta`. Switching accounts in Desktop never changes the active profile. Only the active profile's skills are linked into Claude Code, Codex and Cursor; every other account's skills sync into their own folder. Signing an account out of Desktop signs it out of the CLI on this computer and removes the profile and skills Desktop made for it. If that was the active profile, the CLI switches to the account Desktop opens next; with no other signed-in Desktop account it stays signed out. Profiles made with `notis login` are never removed or picked automatically.
+Notis Desktop signs the CLI in for every account saved in the app, one profile each. `default` keeps its name; each added account gets a profile named after its email with `@` turned into `-` (for example `flo-mindtheflo.com`), and a nightly account adds `-nightly`. Switching accounts in Desktop never changes the active profile. Only the active profile's skills are linked into Claude Code, Codex and Cursor; every other account's skills sync into their own folder. Signing an account out of Desktop signs it out of the CLI on this computer and removes the profile and skills Desktop made for it. If that was the active profile, the CLI switches to the account Desktop opens next; with no other signed-in Desktop account it stays signed out. Profiles made with `notis login` are never removed or picked automatically.
 
 - `npx --package @notis_ai/cli@latest -- notis profile list`: every profile on this machine, with its endpoint, user, and whether it is signed in. The active one is marked.
 - `npx --package @notis_ai/cli@latest -- notis profile use <name>`: change which account subsequent commands run as, and link that account's skills into the agent folders straight away.