@notis_ai/cli 0.2.9 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Agent-first Notis CLI for apps and generic tool execution",
   "type": "module",
   "bin": {

package/skills/notis-apps/SKILL.md

@@ -470,13 +470,13 @@ Runs the real desktop-local development workflow. The CLI should discover all ap
 
 ## Deploy Without Backend Server
 
-If the backend server at `localhost:3001` is not running, use `--direct`:
+If the live API is unreachable, use `--direct`:
 
 ```bash
 npx --package @notis_ai/cli@latest -- notis apps deploy --direct
 ```
 
-This uploads the bundle and editable source snapshot directly to Supabase storage and updates the app manifest in the database, bypassing the backend server entirely. The CLI auto-falls back to direct mode on network errors.
+This uploads the bundle and editable source snapshot directly to Supabase storage and updates the app manifest in the database, bypassing the API server. The CLI auto-falls back to direct mode on network errors. Localhost backends are reserved for `/notis-tests` via `./dev.sh`; do not retarget the personal CLI lane at loopback from this skill.
 
 ## Testing
 

package/skills/notis-cli/SKILL.md

@@ -266,15 +266,18 @@ desktop session yourself.
 
 ### Deploy fails with "network_error" or "fetch failed"
 
-The backend server at `http://localhost:3001` is not running. Solutions:
+The CLI defaults to the live Notis API (`https://api.notis.ai`, or
+`https://api-beta.notis.ai` when the signed-in user is on beta). Solutions:
 
-1. Use `--direct` flag: `npx --package @notis_ai/cli@latest -- notis apps deploy --direct` uploads to Supabase storage directly
-2. Start the backend server: `cd server && python3 main.py`
-3. Check the API base: `npx --package @notis_ai/cli@latest -- notis doctor` shows the configured `api_base`
+1. Run `npx --package @notis_ai/cli@latest -- notis doctor` and confirm `api_base` is a live Notis host
+2. Use `--direct` for app deploys when you only need Supabase storage upload: `npx --package @notis_ai/cli@latest -- notis apps deploy --direct`
+3. If auth looks stale, open Notis Desktop (or `Notis Beta`), wait for it to restore the session, then retry
+
+Localhost backends are a Notis-developer test lane only. Do not retarget the CLI at loopback from this skill — that path is owned by `/notis-tests` via `./dev.sh` and the worktree runtime lease.
 
 ### `npx --package @notis_ai/cli@latest -- notis doctor` shows health/tool_roundtrip errors
 
-The CLI health check pings the backend server. If it's not running, these checks fail. App development commands that are `backend_call: local` (`init`, `build`, `verify`, `link`, `doctor`) work without the server. `dev`, `pull`, `create`, `list`, and normal `deploy` need the backend; `deploy --direct` can bypass it when Supabase credentials are available.
+The CLI health check pings the configured live API. App development commands that are `backend_call: local` (`init`, `build`, `verify`, `link`, `doctor`) work offline. `dev`, `pull`, `create`, `list`, and normal `deploy` need the live API; `deploy --direct` can bypass it when Supabase credentials are available.
 
 ### Stale bundle in the portal after deploy
 

package/src/command-specs/apps.js

@@ -561,6 +561,20 @@ export async function ensureDevInstall({
   const skills = resolveConfiguredAppSkills(appConfig, projectDir);
   let linkedState = readLinkedState(projectDir);
   let linkedApp = null;
+  if (linkedState?.dev_app_id) {
+    // Stale cross-runtime / deleted dev apps often surface as PostgREST PGRST116
+    // zero-row errors from LOCAL_NOTIS_GET_APP (.single()), not exact "App not found".
+    // Treat those as absence so ensure can clear and reprovision. Installed app_id
+    // verification below stays fail-closed on unstructured DB errors.
+    const devApp = await getAccessibleApp(ctx.runtime, linkedState.dev_app_id, runTool, {
+      treatPostgrestAbsenceAsMissing: true,
+    });
+    if (!devApp || devApp.manifest?.is_dev !== true) {
+      const { dev_app_id: _devAppId, dev_linked_at: _devLinkedAt, ...rest } = linkedState;
+      linkedState = rest;
+      writeLinkedState(projectDir, linkedState);
+    }
+  }
   if (linkedState?.app_id) {
     linkedApp = await getAccessibleApp(ctx.runtime, linkedState.app_id, runTool);
     if (linkedApp?.manifest?.is_dev === true) {
@@ -627,11 +641,19 @@ function databaseMaterializationWarnings(apps) {
   return warnings;
 }
 
-async function getAccessibleApp(runtime, appId, runTool = runToolCommand) {
+function isPostgrestNoRowsMessage(message) {
+  const text = String(message || '');
+  return /\bPGRST116\b/.test(text)
+    || /\b0 rows\b/i.test(text)
+    || /no rows returned/i.test(text);
+}
+
+async function getAccessibleApp(runtime, appId, runTool = runToolCommand, options = {}) {
+  const { treatPostgrestAbsenceAsMissing = false } = options;
   const result = await runTool({
     runtime,
     toolName: GET_APP_TOOL,
-    arguments_: { app_id: appId },
+    arguments_: { app_id: appId, include_documents: false },
   });
   if (result.payload?.app) {
     return {
@@ -640,7 +662,15 @@ async function getAccessibleApp(runtime, appId, runTool = runToolCommand) {
     };
   }
   const message = typeof result.payload?.message === 'string' ? result.payload.message : '';
-  if (result.payload?.status === 'error' && /PGRST116|0 rows|no rows|not found/i.test(message)) {
+  const errorCode = result.payload?.code || result.payload?.error?.code;
+  if (
+    result.payload?.status === 'error'
+    && (
+      errorCode === 'app_not_found'
+      || /^App not found\.?$/i.test(message.trim())
+      || (treatPostgrestAbsenceAsMissing && isPostgrestNoRowsMessage(message))
+    )
+  ) {
     return null;
   }
   throw usageError(`Could not verify access to app ${appId}${message ? `: ${message}` : '.'}`);

package/src/command-specs/diagnostics.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { usageError } from '../runtime/errors.js';
 import {
@@ -178,6 +178,11 @@ async function executeReadOnlySql(ctx, query, phase) {
       tools: [{ tool_slug: toolName, arguments: { query } }],
     },
     mutating: false,
+    // Always a fresh key, never the operator's --idempotency-key: a diagnostic
+    // must observe current state rather than replay a cached response, and two
+    // different queries under one reused key would collide on the request hash.
+    idempotencyKey: randomUUID(),
+    sendIdempotencyKeyWhenReading: true,
   });
   if (result.payload?.successful === false || result.payload?.error) {
     throw usageError(

package/src/command-specs/helpers.js

@@ -56,12 +56,18 @@ export async function runToolCommand({
   mutating = false,
   idempotencyKey,
   fileBindings = [],
+  sendIdempotencyKeyWhenReading = false,
 }) {
+  // The server owns effect classification and requires a key whenever *its*
+  // metadata says write or unknown — a client-side `mutating: false` hint does
+  // not exempt the call. Callers that knowingly dispatch through an
+  // unknown-classified wrapper (e.g. COMPOSIO_MULTI_EXECUTE_TOOL) opt in so the
+  // request carries a key instead of being rejected as idempotency_key_required.
   const result = await callTool({
     runtime: { ...runtime, mutating },
     toolName,
     arguments_,
-    idempotencyKey: mutating ? idempotencyKey : null,
+    idempotencyKey: mutating || sendIdempotencyKeyWhenReading ? idempotencyKey : null,
     fileBindings,
   });
   return result;

package/src/runtime/cli-mode.generated.js

@@ -1,4 +1,5 @@
 // Auto-generated on npm publish.
-// Committed value is 'local' so in-repo runs target localhost.
-// scripts/set-cli-mode.js rewrites this to 'published' before the npm publish step.
-export const MODE = 'local';
+// Committed value is 'published' so the CLI defaults to the live Notis API.
+// Localhost overrides come only from the worktree test lease (`./dev.sh`).
+// scripts/set-cli-mode.js can rewrite this for publish/labeling experiments.
+export const MODE = 'published';

package/src/runtime/cli-mode.js

@@ -1,13 +1,14 @@
 /**
  * CLI mode detection for `notis apps dev`.
  *
- * The repo-local CLI package targets localhost; the published npm CLI package
- * targets app.notis.ai. Mode is baked into `cli-mode.generated.js` at publish
- * time — no runtime flag is needed (and none is exposed to end users, so a
- * crafted env var can't trick a published CLI into opening a localhost portal
- * that isn't running).
+ * The published npm CLI and the repo-local checkout both default to the live
+ * Notis API (`api.notis.ai` / `api-beta.notis.ai`). Localhost is not a CLI
+ * default — the `/notis-tests` worktree lease (`./dev.sh`) is the only
+ * supported loopback override for Notis developers.
  *
- * The `NOTIS_CLI_MODE` env var is honored for internal testing only.
+ * Mode is baked into `cli-mode.generated.js` at publish time. The
+ * `NOTIS_CLI_MODE` env var is honored for internal labeling only (e.g. the
+ * `apps` auto-dev loop inside `./dev.sh`).
  */
 
 import { MODE as BAKED_MODE } from './cli-mode.generated.js';
@@ -20,8 +21,12 @@ export function getCliMode() {
   return BAKED_MODE === 'published' ? 'published' : 'local';
 }
 
-export function getDefaultApiBase(mode = getCliMode()) {
-  return mode === 'local' ? 'http://localhost:3001' : 'https://api.notis.ai';
+export function getDefaultApiBase(mode = getCliMode(), { beta = false } = {}) {
+  // Mode no longer switches the default API to localhost. Local loopback is
+  // reserved for the worktree test lease; `mode` only affects portal origin
+  // labeling for the in-repo apps-dev helper.
+  void mode;
+  return beta ? 'https://api-beta.notis.ai' : 'https://api.notis.ai';
 }
 
 export function getDefaultPortalOrigin(mode = getCliMode()) {

package/src/runtime/oauth.js

@@ -668,12 +668,28 @@ async function exchangeCode(metadata, {
 function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
   const now = Math.floor(Date.now() / 1000);
   const payload = decodeJwtPayload(tokenResponse.access_token);
+  const oauthApiBase = (metadata.apiBase || runtime.apiBase || '').replace(/\/+$/, '');
+  let beta;
+  try {
+    const hostname = new URL(oauthApiBase).hostname;
+    if (hostname === 'api-beta.notis.ai') beta = true;
+    else if (hostname === 'api.notis.ai') beta = false;
+  } catch {
+    beta = undefined;
+  }
   const config = updateConfig((latest) => {
     const next = ensureProfile(latest, runtime.profileName);
     const profile = next.profiles[runtime.profileName];
     next.profiles[runtime.profileName] = {
       ...profile,
-      oauth_api_base: metadata.apiBase || runtime.apiBase,
+      // Keep Desktop's api_base intact when an independent OAuth grant refreshes.
+      // Only seed api_base from OAuth when the profile has no live API yet.
+      api_base:
+        profile.api_base && !/^https?:\/\/(localhost|127\.0\.0\.1|::1)(:|\/|$)/i.test(profile.api_base)
+          ? profile.api_base
+          : (oauthApiBase || profile.api_base),
+      beta: typeof profile.beta === 'boolean' ? profile.beta : beta,
+      oauth_api_base: oauthApiBase || profile.oauth_api_base,
       oauth_resource: metadata.resource,
       oauth_access_token: tokenResponse.access_token,
       oauth_refresh_token: tokenResponse.refresh_token || profile.oauth_refresh_token,

package/src/runtime/profiles.js

@@ -17,14 +17,12 @@ export const CONFIG_DIR = join(homedir(), '.notis');
 export const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
 export const WORKSPACE_DIR = join(CONFIG_DIR, 'workspace');
 export const DEFAULT_API_BASE = 'https://api.notis.ai';
+export const BETA_API_BASE = 'https://api-beta.notis.ai';
 export const DEFAULT_PROFILE = 'default';
 const WORKTREE_RUNTIME_FILENAME = join('.context', 'notis-runtime.json');
 const WORKTREE_ROUTING_FILENAME = join('.context', 'notis-routing.json');
-const LOCAL_DEFAULT_API_BASES = new Set([
-  'http://localhost:3001',
-  'http://127.0.0.1:3001',
-]);
 const LOCAL_API_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+const LIVE_API_HOSTS = new Set(['api.notis.ai', 'api-beta.notis.ai']);
 // Cross-process write lock over ~/.notis/config.json. Notis Desktop implements
 // the same protocol independently in electron/src/cli-auth.ts (updateConfig);
 // the `${configFile}.write-lock` directory name and these three timings must
@@ -51,6 +49,7 @@ export function normalizeConfig(rawConfig = {}) {
       profiles[name] = {
         jwt: typeof profile.jwt === 'string' ? profile.jwt : undefined,
         api_base: typeof profile.api_base === 'string' ? profile.api_base : undefined,
+        beta: typeof profile.beta === 'boolean' ? profile.beta : undefined,
         auth_mode: profile.auth_mode === 'dev_portal' ? profile.auth_mode : undefined,
         refresh_token:
           typeof profile.refresh_token === 'string' ? profile.refresh_token : undefined,
@@ -105,6 +104,7 @@ export function normalizeConfig(rawConfig = {}) {
       [DEFAULT_PROFILE]: {
         jwt: typeof raw.jwt === 'string' ? raw.jwt : undefined,
         api_base: typeof raw.api_base === 'string' ? raw.api_base : undefined,
+        beta: typeof raw.beta === 'boolean' ? raw.beta : undefined,
         auth_mode: raw.auth_mode === 'dev_portal' ? raw.auth_mode : undefined,
         refresh_token: typeof raw.refresh_token === 'string' ? raw.refresh_token : undefined,
         access_expires_at:
@@ -425,6 +425,48 @@ function isLocalApiBase(value) {
   }
 }
 
+function isLiveApiBase(value) {
+  if (typeof value !== 'string' || !value) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === 'https:' && LIVE_API_HOSTS.has(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Pick the live Notis API for this profile.
+ *
+ * Beta users (`users.beta = true`, mirrored onto the CLI profile by Desktop
+ * sync / OAuth against api-beta) hit api-beta.notis.ai; everyone else hits
+ * api.notis.ai. Localhost is never a default — only the worktree test lease
+ * (`./dev.sh` / `/notis-tests`) may retarget the CLI at loopback.
+ */
+export function resolveDefaultLiveApiBase(profile = {}) {
+  if (profile.beta === true) {
+    return BETA_API_BASE;
+  }
+  if (profile.beta === false) {
+    return DEFAULT_API_BASE;
+  }
+  if (profile.desktop_app_name === 'Notis Beta') {
+    return BETA_API_BASE;
+  }
+  if (isLiveApiBase(profile.api_base)) {
+    try {
+      if (new URL(profile.api_base).hostname === 'api-beta.notis.ai') {
+        return BETA_API_BASE;
+      }
+    } catch {
+      // fall through
+    }
+  }
+  return DEFAULT_API_BASE;
+}
+
 export function getApiBase(config, profileName, override) {
   if (override) {
     return override;
@@ -435,20 +477,16 @@ export function getApiBase(config, profileName, override) {
   }
   const profile = getProfile(config, profileName);
   const profileApiBase = profile.api_base;
-  const conductorPort = Number.parseInt(process.env.CONDUCTOR_PORT || '', 10);
 
-  // Conductor assigns dynamic local ports. When a workspace is running under
-  // Conductor, treat saved localhost profile values as stale and transparently
-  // retarget the CLI at the active backend port.
-  if (
-    Number.isInteger(conductorPort) &&
-    conductorPort > 0 &&
-    (!profileApiBase || LOCAL_DEFAULT_API_BASES.has(profileApiBase) || isLocalApiBase(profileApiBase))
-  ) {
-    return `http://localhost:${conductorPort + 1}`;
+  // Prefer an explicit non-loopback API stored on the profile (Desktop sync /
+  // OAuth / custom overrides). Ignore stale localhost values — loopback
+  // routing is owned exclusively by the worktree runtime lease under
+  // `/notis-tests`, not by CONDUCTOR_PORT or leftover local profile state.
+  if (typeof profileApiBase === 'string' && profileApiBase && !isLocalApiBase(profileApiBase)) {
+    return profileApiBase.replace(/\/+$/, '');
   }
 
-  return profileApiBase || DEFAULT_API_BASE;
+  return resolveDefaultLiveApiBase(profile);
 }
 
 export function getJwt(config, profileName) {