@notis_ai/cli 0.2.8 → 0.2.10

package/src/command-specs/meta.js

@@ -1,19 +1,52 @@
 import { COMPOSIO_SEARCH_TOOLS, healthCheck, probeAuth } from './helpers.js';
 import { findCommandSpec, formatDescribe } from '../runtime/help.js';
-import { createExpiredAuthError } from '../runtime/desktop-auth.js';
-import { isJwtExpired } from '../runtime/profiles.js';
+import { createExpiredAuthError, getDesktopAuthRecovery } from '../runtime/desktop-auth.js';
+import {
+  credentialIsExpired,
+  getJwtCanonicalUserId,
+  getProfile,
+  loadConfig,
+} from '../runtime/profiles.js';
+import { ensureFreshOAuthCredential } from '../runtime/oauth.js';
+
+export const DOCTOR_TOOL_ROUNDTRIP_TIMEOUT_MS = 90_000;
+
+export function doctorToolRoundtripRuntime(runtime) {
+  return {
+    ...runtime,
+    timeoutMs: Math.max(runtime.timeoutMs || 0, DOCTOR_TOOL_ROUNDTRIP_TIMEOUT_MS),
+  };
+}
 
 async function doctorHandler(ctx) {
   const checks = {
     config: 'ok',
     auth: 'missing',
+    identity: 'ok',
     health: 'unknown',
     tool_roundtrip: 'unknown',
   };
 
+  if (ctx.runtime.credentialKind === 'oauth') {
+    try {
+      await ensureFreshOAuthCredential(ctx.runtime);
+    } catch {
+      // Doctor still reports the remaining health and recovery checks when a
+      // refresh endpoint is unavailable or rejects the stored credential.
+    }
+  }
+  let profile = getProfile(loadConfig(ctx.runtime.worktreeRuntime), ctx.runtime.profileName);
   checks.auth = ctx.runtime.jwt
-    ? (isJwtExpired(ctx.runtime.jwt) ? 'expired' : 'configured')
+    ? (credentialIsExpired(ctx.runtime, profile) ? 'expired' : 'configured')
     : 'missing';
+  const desktopUserId = getJwtCanonicalUserId(profile.jwt);
+  if (
+    desktopUserId
+    && profile.oauth_user_id
+    && desktopUserId !== profile.oauth_user_id
+  ) {
+    checks.identity = 'error';
+  }
 
   try {
     await healthCheck(ctx.runtime);
@@ -24,8 +57,15 @@ async function doctorHandler(ctx) {
 
   if (ctx.runtime.jwt) {
     try {
-      const payload = await probeAuth(ctx.runtime);
+      // Tool discovery may have to query several connected MCP servers on a
+      // cold local backend. A diagnostic must not report a false failure just
+      // because that legitimate roundtrip exceeds the general 30s default.
+      const payload = await probeAuth(doctorToolRoundtripRuntime(ctx.runtime));
       checks.tool_roundtrip = Array.isArray(payload.toolkit_connection_statuses) ? 'ok' : 'error';
+      profile = getProfile(loadConfig(ctx.runtime.worktreeRuntime), ctx.runtime.profileName);
+      checks.auth = ctx.runtime.jwt
+        ? (credentialIsExpired(ctx.runtime, profile) ? 'expired' : 'configured')
+        : 'missing';
     } catch {
       checks.tool_roundtrip = 'error';
     }
@@ -33,7 +73,7 @@ async function doctorHandler(ctx) {
 
   const hints = [];
   if (checks.auth === 'missing') {
-    hints.push({ command: 'Open the Notis desktop app and sign in', reason: 'Configure CLI credentials' });
+    hints.push(...getDesktopAuthRecovery(ctx.runtime, { mode: 'missing' }).hints);
   } else if (checks.auth === 'expired') {
     hints.push(...createExpiredAuthError(ctx.runtime).hints);
   }
@@ -43,12 +83,27 @@ async function doctorHandler(ctx) {
   if (checks.tool_roundtrip === 'error') {
     hints.push({ command: 'notis whoami', reason: 'Verify your account and permissions' });
   }
+  if (checks.identity === 'error') {
+    hints.push({
+      command: 'notis logout',
+      reason: 'Desktop and OAuth credentials identify different accounts; remove the independent OAuth grant or sign Desktop back into the same account',
+    });
+  }
 
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
     data: {
       profile: ctx.runtime.profileName,
       api_base: ctx.runtime.apiBase,
+      credential_source: ctx.runtime.credentialKind || null,
+      ...(ctx.runtime.credentialKind === 'oauth'
+        ? {
+            oauth_client_id: profile.oauth_client_id || null,
+            oauth_scopes: profile.oauth_scopes || [],
+            oauth_access_expires_at: profile.oauth_access_expires_at || null,
+            oauth_refresh_expires_at: profile.oauth_refresh_expires_at || null,
+          }
+        : {}),
       checks,
     },
     humanSummary: `Doctor checks completed for profile ${ctx.runtime.profileName}`,
@@ -72,16 +127,23 @@ function decodeJwtUserId(jwt) {
   }
 }
 
+export function activeRuntimeUserId(runtime) {
+  return runtime.credentialKind === 'oauth'
+    ? runtime.oauthUserId
+    : decodeJwtUserId(runtime.jwt);
+}
+
 async function whoamiHandler(ctx) {
   const payload = await probeAuth(ctx.runtime);
   const toolkits = payload.toolkit_connection_statuses || [];
-  const userId = decodeJwtUserId(ctx.runtime.jwt);
+  const userId = activeRuntimeUserId(ctx.runtime);
 
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(' '),
     data: {
       profile: ctx.runtime.profileName,
       api_base: ctx.runtime.apiBase,
+      credential_source: ctx.runtime.credentialKind || null,
       user_id: userId,
       toolkit_count: toolkits.length,
       toolkits: toolkits.map((t) => t.toolkit),

package/src/command-specs/onboarding.js

@@ -4,7 +4,12 @@ import { fileURLToPath } from 'node:url';
 
 import { CliError, EXIT_CODES } from '../runtime/errors.js';
 import { getDesktopAuthRecovery, waitForDesktopAuth } from '../runtime/desktop-auth.js';
-import { getJwt, isJwtExpired, loadConfig } from '../runtime/profiles.js';
+import {
+  credentialIsExpired,
+  getProfile,
+  loadConfig,
+} from '../runtime/profiles.js';
+import { ensureFreshOAuthCredential, loginWithOAuth } from '../runtime/oauth.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const BUNDLED_BRIEF_PATH = join(HERE, '..', '..', 'skills', 'notis-onboarding', 'BRIEF.md');
@@ -85,7 +90,20 @@ async function requestSignupLink(apiBase, { email, useCases }) {
 async function startHandler(ctx) {
   const { runtime, options, output } = ctx;
   const apiBase = runtime.apiBase;
-  const authenticated = Boolean(runtime.jwt) && !isJwtExpired(runtime.jwt);
+  if (runtime.credentialKind === 'oauth') {
+    try {
+      await ensureFreshOAuthCredential(runtime);
+    } catch {
+      // A failed refresh is equivalent to no usable session here. Interactive
+      // starts may still authorize again; brief-only and agent runs surface
+      // the normal authentication recovery below.
+    }
+  }
+  let authenticated = Boolean(runtime.jwt)
+    && !credentialIsExpired(
+      runtime,
+      getProfile(loadConfig(runtime.worktreeRuntime), runtime.profileName),
+    );
 
   // Safe to re-run: an already-authenticated machine skips straight to the brief.
   // Agents retry commands, and a second signup would invalidate the first email.
@@ -108,6 +126,54 @@ async function startHandler(ctx) {
     });
   }
 
+  if (
+    !options.email
+    && !runtime.agentMode
+    && !runtime.nonInteractive
+    && options.wait !== false
+  ) {
+    let authorization;
+    let authorizationError;
+    try {
+      authorization = await loginWithOAuth(runtime, { browser: true }, output);
+    } catch (error) {
+      // Keep the original OAuth failure while checking whether another process
+      // completed authentication before this attempt failed.
+      authorizationError = error;
+      authorization = null;
+    }
+    if (authorization?.agentAuthorization) {
+      return output.emitSuccess({
+        command: 'start',
+        data: { authenticated: false, ...authorization.agentAuthorization },
+        humanSummary: 'Open the authorization URL to finish signing in.',
+        renderHuman: () => `Authorize Notis CLI: ${authorization.agentAuthorization.authorize_url}`,
+      });
+    }
+    // A failed authorization leaves the stale credential that got us here in
+    // place, so re-apply the same expiry test used above rather than reporting
+    // a machine as signed in on the strength of a dead token.
+    authenticated = Boolean(runtime.jwt)
+      && !credentialIsExpired(runtime, getProfile(loadConfig(runtime.worktreeRuntime), runtime.profileName));
+    if (authenticated) {
+      const brief = await fetchBrief(apiBase, runtime.timeoutMs);
+      return output.emitSuccess({
+        command: 'start',
+        data: {
+          authenticated: true,
+          credential_source: runtime.credentialKind,
+          brief: brief.markdown,
+          brief_source: brief.source,
+        },
+        humanSummary: 'Notis CLI is authenticated. Follow the onboarding brief below.',
+        renderHuman: () => brief.markdown || 'Notis CLI is authenticated.',
+      });
+    }
+    if (authorizationError) {
+      throw authorizationError;
+    }
+  }
+
   if (!options.email) {
     // The one point in the flow that has to stop and talk to the human.
     throw new CliError({
@@ -143,8 +209,29 @@ async function startHandler(ctx) {
   const timeoutMs = Number(options.waitTimeoutMs) > 0 ? Number(options.waitTimeoutMs) : 300_000;
   const jwt = await waitForDesktopAuth({
     loadConfig,
-    getJwt,
-    isJwtExpired,
+    getJwt: (config, profileName) => {
+      const profile = getProfile(config, profileName);
+      if (
+        profile.jwt
+        && !credentialIsExpired(
+          { credentialKind: 'desktop', jwt: profile.jwt },
+          profile,
+        )
+      ) {
+        return profile.jwt;
+      }
+      if (
+        profile.oauth_access_token
+        && !credentialIsExpired(
+          { credentialKind: 'oauth', jwt: profile.oauth_access_token },
+          profile,
+        )
+      ) {
+        return profile.oauth_access_token;
+      }
+      return undefined;
+    },
+    isJwtExpired: () => false,
     profileName: runtime.profileName,
     timeoutMs,
     onTick: (remaining) => {
@@ -165,7 +252,8 @@ async function startHandler(ctx) {
           command: `Install Notis Desktop: ${signup.desktop_download_url || 'https://notis.ai/channels/desktop-app'}`,
           reason: 'The desktop app is what writes the CLI credential',
         },
-        { command: 'notis start --brief-only', reason: 'Resume once the desktop app is signed in' },
+        { command: 'notis login', reason: 'Authorize this machine directly in a browser' },
+        { command: 'notis start --brief-only', reason: 'Resume once authentication is complete' },
         { command: 'notis doctor', reason: 'Re-check config, auth, and API reachability' },
       ],
     });
@@ -183,7 +271,7 @@ async function startHandler(ctx) {
 export const onboardingCommandSpecs = [
   {
     command_path: ['start'],
-    summary: 'Create or access a Notis account and wait for the desktop app to sign the CLI in.',
+    summary: 'Create or access a Notis account and authorize the CLI.',
     when_to_use:
       'Run this first on a new machine, before anything that needs auth. Safe to re-run: an already-signed-in machine just reprints the onboarding brief.',
     args_schema: {

package/src/runtime/app-dev-server.js

@@ -288,12 +288,13 @@ function renderHarnessHtml({ state, manifest, appConfig, route, harnessOptions,
 /**
  * Start the dev server for one or more apps.
  *
- * @param {{apps: Array<{slug: string, projectDir: string, appId?: string, targetAppId?: string, userId?: string}>, port: number, watch?: boolean, harness?: { mode?: string, apiBase?: string, jwt?: string }, log?: (m: string) => void, logError?: (m: string) => void}} options
+ * @param {{apps: Array<{slug: string, projectDir: string, appId?: string, targetAppId?: string, userId?: string}>, port: number, watch?: boolean, sessionsFilePath?: string, harness?: { mode?: string, apiBase?: string, jwt?: string }, log?: (m: string) => void, logError?: (m: string) => void}} options
  */
 export async function startAppDevServer({
   apps,
   port,
   watch = true,
+  sessionsFilePath,
   harness = {},
   log = (msg) => process.stdout.write(`${msg}\n`),
   logError = (msg) => process.stderr.write(`${msg}\n`),
@@ -466,7 +467,7 @@ export async function startAppDevServer({
                 devSlug: state.slug,
                 targetAppId: appId,
                 lastHeartbeatAt: now,
-              });
+              }, sessionsFilePath);
               const response = {
                 ok: true,
                 app_id: appId,

package/src/runtime/app-dev-sessions.js

@@ -1,6 +1,5 @@
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { dirname, join, parse as parsePath } from 'node:path';
 import { CONFIG_DIR } from './profiles.js';
 
@@ -9,37 +8,6 @@ export const APP_DEV_SESSIONS_FILE = DEFAULT_APP_DEV_SESSIONS_FILE;
 export const APP_DEV_SESSIONS_VERSION = 1;
 export const APP_DEV_SESSION_MOUNT_ACKS_VERSION = 1;
 
-/**
- * Walk up from `startDir` looking for a workspace-scoped dev-sessions registry.
- *
- * The Notis desktop (and Conductor) reads a PER-WORKSPACE registry at
- * `<workspace>/.context/app-dev-sessions.json` (it points its own `apps dev`
- * at it via `NOTIS_APP_DEV_SESSIONS_FILE`). When a coding agent runs
- * `apps dev` manually it does not inherit that env var, so its session would
- * otherwise land in the global `~/.notis` registry and never appear in the
- * desktop's Local development sidebar. Resolving the nearest `.context`
- * registry keeps agent-run and desktop-run sessions in the same file.
- *
- * Returns the registry path if a `.context/` directory is found in `startDir`
- * or an ancestor (stopping at the home directory / filesystem root), else null.
- */
-export function findWorkspaceAppDevSessionsFile(startDir = process.cwd()) {
-  let dir = startDir;
-  const home = homedir();
-  const { root } = parsePath(dir);
-  // Bounded walk; `.context` lives at the workspace root, never above $HOME.
-  for (let depth = 0; depth < 64; depth += 1) {
-    if (existsSync(join(dir, '.context'))) {
-      return join(dir, '.context', 'app-dev-sessions.json');
-    }
-    if (dir === home || dir === root) break;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
 export function getAppDevSessionsFile(filePath) {
   if (filePath) {
     return filePath;
@@ -48,10 +16,6 @@ export function getAppDevSessionsFile(filePath) {
   if (typeof envPath === 'string' && envPath.trim()) {
     return envPath.trim();
   }
-  const workspaceFile = findWorkspaceAppDevSessionsFile();
-  if (workspaceFile) {
-    return workspaceFile;
-  }
   return DEFAULT_APP_DEV_SESSIONS_FILE;
 }
 
@@ -173,7 +137,7 @@ function normalizeMountAcknowledgements(raw) {
     typeof acknowledgement.devSlug === 'string' &&
     typeof acknowledgement.mountNonce === 'string' &&
     typeof acknowledgement.acknowledgedAt === 'string' &&
-    acknowledgement.stage === 'listed',
+    ['listed', 'rendered'].includes(acknowledgement.stage),
   );
 }
 
@@ -218,12 +182,13 @@ export function removeAppDevSessionMountAcknowledgements(sessionId, sessionsFile
   return writeAppDevSessionMountAcknowledgements(registry, sessionsFilePath);
 }
 
-function mountAcknowledgementKey(value) {
-  return `${value.sessionId}:${value.appId}:${value.devSlug}:${value.mountNonce}`;
+function mountAcknowledgementKey(value, fallbackStage = 'listed') {
+  return `${value.sessionId}:${value.appId}:${value.devSlug}:${value.mountNonce}:${value.stage || fallbackStage}`;
 }
 
 export async function waitForAppDevSessionMountAcknowledgements(expectedSessions, options = {}) {
   const expected = Array.isArray(expectedSessions) ? expectedSessions : [expectedSessions];
+  const stage = options.stage === 'rendered' ? 'rendered' : 'listed';
   const timeoutMs = Number.isFinite(options.timeoutMs) ? Math.max(0, options.timeoutMs) : 15_000;
   const pollIntervalMs = Number.isFinite(options.pollIntervalMs)
     ? Math.max(1, options.pollIntervalMs)
@@ -237,7 +202,9 @@ export async function waitForAppDevSessionMountAcknowledgements(expectedSessions
   while (true) {
     const registry = readAppDevSessionMountAcknowledgements(options.sessionsFilePath);
     const acknowledgedKeys = new Set(registry.acknowledgements.map(mountAcknowledgementKey));
-    const missing = expected.filter((session) => !acknowledgedKeys.has(mountAcknowledgementKey(session)));
+    const missing = expected.filter(
+      (session) => !acknowledgedKeys.has(mountAcknowledgementKey(session, stage)),
+    );
     if (missing.length === 0) {
       return { mounted: true, missing: [], acknowledgements: registry.acknowledgements };
     }
@@ -249,3 +216,10 @@ export async function waitForAppDevSessionMountAcknowledgements(expectedSessions
     await sleep(Math.min(pollIntervalMs, timeoutMs - elapsedMs));
   }
 }
+
+export function waitForAppDevSessionRenderAcknowledgements(expectedSessions, options = {}) {
+  return waitForAppDevSessionMountAcknowledgements(expectedSessions, {
+    ...options,
+    stage: 'rendered',
+  });
+}

package/src/runtime/cli-mode.generated.js

@@ -1,4 +1,5 @@
 // Auto-generated on npm publish.
-// Committed value is 'local' so in-repo runs target localhost.
-// scripts/set-cli-mode.js rewrites this to 'published' before the npm publish step.
-export const MODE = 'local';
+// Committed value is 'published' so the CLI defaults to the live Notis API.
+// Localhost overrides come only from the worktree test lease (`./dev.sh`).
+// scripts/set-cli-mode.js can rewrite this for publish/labeling experiments.
+export const MODE = 'published';

package/src/runtime/cli-mode.js

@@ -1,13 +1,14 @@
 /**
  * CLI mode detection for `notis apps dev`.
  *
- * The repo-local CLI package targets localhost; the published npm CLI package
- * targets app.notis.ai. Mode is baked into `cli-mode.generated.js` at publish
- * time — no runtime flag is needed (and none is exposed to end users, so a
- * crafted env var can't trick a published CLI into opening a localhost portal
- * that isn't running).
+ * The published npm CLI and the repo-local checkout both default to the live
+ * Notis API (`api.notis.ai` / `api-beta.notis.ai`). Localhost is not a CLI
+ * default — the `/notis-tests` worktree lease (`./dev.sh`) is the only
+ * supported loopback override for Notis developers.
  *
- * The `NOTIS_CLI_MODE` env var is honored for internal testing only.
+ * Mode is baked into `cli-mode.generated.js` at publish time. The
+ * `NOTIS_CLI_MODE` env var is honored for internal labeling only (e.g. the
+ * `apps` auto-dev loop inside `./dev.sh`).
  */
 
 import { MODE as BAKED_MODE } from './cli-mode.generated.js';
@@ -20,8 +21,12 @@ export function getCliMode() {
   return BAKED_MODE === 'published' ? 'published' : 'local';
 }
 
-export function getDefaultApiBase(mode = getCliMode()) {
-  return mode === 'local' ? 'http://localhost:3001' : 'https://api.notis.ai';
+export function getDefaultApiBase(mode = getCliMode(), { beta = false } = {}) {
+  // Mode no longer switches the default API to localhost. Local loopback is
+  // reserved for the worktree test lease; `mode` only affects portal origin
+  // labeling for the in-repo apps-dev helper.
+  void mode;
+  return beta ? 'https://api-beta.notis.ai' : 'https://api.notis.ai';
 }
 
 export function getDefaultPortalOrigin(mode = getCliMode()) {

package/src/runtime/desktop-auth.js

@@ -56,8 +56,8 @@ export function getDesktopAuthRecovery(runtime, { mode = 'expired' } = {}) {
     // Leads the list: a machine that was never signed in may not even have an
     // account yet, and `notis start` covers both cases.
     hints.unshift({
-      command: 'notis start --email <address>',
-      reason: 'Create or access a Notis account and sign this machine in',
+      command: 'notis login',
+      reason: 'Sign in or create an account in the browser and authorize this machine',
     });
   }
   hints.push({
@@ -100,6 +100,18 @@ export async function waitForDesktopAuth({
 }
 
 export function createExpiredAuthError(runtime) {
+  if (runtime.credentialKind === 'oauth') {
+    return new CliError({
+      code: 'auth_expired',
+      message: 'Notis CLI OAuth authentication has expired',
+      exitCode: EXIT_CODES.auth,
+      details: { credential_source: 'oauth' },
+      hints: [
+        { command: 'notis login', reason: 'Authorize a new scoped CLI credential' },
+        { command: 'notis doctor', reason: 'Inspect the active credential state' },
+      ],
+    });
+  }
   if (runtime.credentialSource === 'env') {
     return new CliError({
       code: 'auth_expired',
@@ -130,6 +142,14 @@ export function createExpiredAuthError(runtime) {
 }
 
 export function createInvalidAuthHints(runtime) {
+  if (runtime?.credentialKind === 'oauth') {
+    return [
+      {
+        command: 'notis login',
+        reason: 'Authorize a new scoped CLI credential',
+      },
+    ];
+  }
   if (runtime?.credentialSource === 'env') {
     return [
       {