nolo-cli 0.1.23 → 0.1.26

package/machineCommands.ts

@@ -1,9 +1,10 @@
 import type { MachineHeartbeat } from "./connector-experimental/protocol";
 import { detectMachineInfo } from "./connector-experimental/machineInfo";
+import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
-import { mkdirSync, openSync } from "node:fs";
+import { existsSync, mkdirSync, openSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { runLocalAgentTurn, type LocalAgentToolEvent } from "./agent-runtime/localLoop";
 import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import {
@@ -55,6 +56,13 @@ type ConnectorRunProgress = {
   toolCallCount?: number;
   toolResultCount?: number;
   lastToolNames?: string[];
+  provider?: string;
+  promptBytes?: number;
+  promptHash?: string;
+  promptRef?: string;
+  promptPageKey?: string;
+  promptPageHash?: string;
+  requestId?: string;
   workspaceRoot?: string;
   workspaceKind?: string;
   message?: string;
@@ -82,15 +90,26 @@ type MachineCommandDeps = {
   fetchImpl?: typeof fetch;
   machineInfo?: () => MachineHeartbeat;
   runHeartbeatLoop?: (options: HeartbeatLoopOptions) => Promise<void>;
-  connectWebSocket?: (url: string, options: ConnectorWebSocketOptions) => Promise<void>;
-  executeCli?: LocalCliExecutor;
-  spawnDaemon?: (args: {
+  connectWebSocket?: (url: string, options: ConnectorWebSocketOptions) => Promise<void>;
+  executeCli?: LocalCliExecutor;
+  validateWorkspaceLinks?: (cwd: string) => string[] | Promise<string[]>;
+  spawnDaemon?: (args: {
     cmd: string[];
     cwd: string;
     env: EnvLike;
     logPath: string;
   }) => { pid?: number };
-};
+};
+
+type PackageJson = {
+  name?: string;
+  workspaces?: string[] | { packages?: string[] };
+};
+
+const CONNECTOR_RUNTIME_WORKSPACE_PACKAGES = new Set([
+  "connector-experimental",
+  "ai",
+]);
 
 function resolveServerUrl(env: EnvLike) {
   return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
@@ -106,9 +125,113 @@ function writeAuthMissing(output: OutputLike) {
   );
 }
 
-function hasFlag(args: string[], flag: string) {
-  return args.includes(flag);
-}
+function hasFlag(args: string[], flag: string) {
+  return args.includes(flag);
+}
+
+function normalizePath(path: string) {
+  const resolved = resolve(path);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+
+function isInsideOrSame(path: string, parent: string) {
+  const relativePath = relative(parent, path);
+  return relativePath === "" || (!relativePath.startsWith("..") && !isAbsolute(relativePath));
+}
+
+function readJsonFile<T>(path: string): T | null {
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as T;
+  } catch {
+    return null;
+  }
+}
+
+function getWorkspacePatterns(packageJson: PackageJson) {
+  if (Array.isArray(packageJson.workspaces)) return packageJson.workspaces;
+  return packageJson.workspaces?.packages ?? [];
+}
+
+function findWorkspaceRoot(startPath: string) {
+  let current = resolve(startPath);
+  while (true) {
+    const packageJsonPath = join(current, "package.json");
+    if (existsSync(packageJsonPath)) {
+      const packageJson = readJsonFile<PackageJson>(packageJsonPath);
+      if (packageJson && getWorkspacePatterns(packageJson).length > 0) {
+        return current;
+      }
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function validateConnectorWorkspaceLinks(cwd: string) {
+  const repoRoot = findWorkspaceRoot(cwd);
+  if (!repoRoot) return [];
+
+  const rootPackageJson = readJsonFile<PackageJson>(join(repoRoot, "package.json"));
+  if (!rootPackageJson) return [];
+
+  const normalizedRepoRoot = normalizePath(realpathSync(repoRoot));
+  const errors: string[] = [];
+
+  for (const pattern of getWorkspacePatterns(rootPackageJson)) {
+    if (!pattern.endsWith("/*")) continue;
+    const workspaceParent = join(repoRoot, pattern.slice(0, -2));
+    if (!existsSync(workspaceParent)) continue;
+
+    for (const entry of Array.from(new Bun.Glob("*/package.json").scanSync({ cwd: workspaceParent }))) {
+      const packageDir = join(workspaceParent, dirname(entry));
+      const packageJson = readJsonFile<PackageJson>(join(workspaceParent, entry));
+      if (!packageJson?.name || !CONNECTOR_RUNTIME_WORKSPACE_PACKAGES.has(packageJson.name)) {
+        continue;
+      }
+
+      const linkPath = join(repoRoot, "node_modules", ...packageJson.name.split("/"));
+      if (!existsSync(linkPath)) {
+        errors.push(`${linkPath} is missing. Run bun install in ${repoRoot}.`);
+        continue;
+      }
+
+      const actualPath = normalizePath(realpathSync(linkPath));
+      const expectedPath = normalizePath(realpathSync(packageDir));
+      if (!isInsideOrSame(actualPath, normalizedRepoRoot)) {
+        errors.push(
+          `${linkPath} points outside this checkout: ${actualPath}. Run bun install in ${repoRoot}.`,
+        );
+        continue;
+      }
+      if (actualPath !== expectedPath) {
+        errors.push(
+          `${linkPath} points at ${actualPath}, expected ${expectedPath}. Run bun install in ${repoRoot}.`,
+        );
+      }
+    }
+  }
+
+  return errors;
+}
+
+async function checkConnectorWorkspaceLinks(
+  cwd: string,
+  output: OutputLike,
+  validateWorkspaceLinks: (cwd: string) => string[] | Promise<string[]>,
+) {
+  const errors = await validateWorkspaceLinks(cwd);
+  if (errors.length === 0) return true;
+  output.write(
+    [
+      "[nolo] Connector workspace package links are unsafe.",
+      "The connector would import workspace packages from a different checkout, so machine capabilities and runtime behavior may be stale.",
+      ...errors,
+      "",
+    ].join("\n"),
+  );
+  return false;
+}
 
 function readOption(args: string[], flag: string) {
   for (let i = 0; i < args.length; i++) {
@@ -139,6 +262,90 @@ function resolveDaemonLogPath(env: EnvLike) {
   return env.NOLO_CONNECT_LOG || join(homedir(), ".nolo", "logs", "connector.log");
 }
 
+function byteLength(value: string) {
+  return Buffer.byteLength(value, "utf8");
+}
+
+function shortHash(value: string) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+
+function resolvePromptInlineMaxBytes(env: EnvLike) {
+  const raw = Number(env.NOLO_CONNECTOR_PROMPT_INLINE_MAX_BYTES);
+  return Number.isFinite(raw) && raw >= 1024 ? raw : 32_000;
+}
+
+function materializeLargeConnectorPrompt(args: {
+  prompt: string;
+  cwd: string;
+  env: EnvLike;
+  requestId: string;
+  runtimePromptPage?: {
+    dbKey?: string;
+    promptHash?: string;
+    contentBytes?: number;
+  } | null;
+}) {
+  const promptBytes = byteLength(args.prompt);
+  const promptHash = shortHash(args.prompt);
+  const maxInlineBytes = resolvePromptInlineMaxBytes(args.env);
+  if (promptBytes <= maxInlineBytes) {
+    return {
+      prompt: args.prompt,
+      promptBytes,
+      promptHash,
+      promptRef: null as string | null,
+    };
+  }
+
+  const promptDir = join(args.cwd, ".nolo", "agent-prompts");
+  mkdirSync(promptDir, { recursive: true });
+  const promptRef = join(promptDir, `${args.requestId}-${promptHash}.md`);
+  writeFileSync(promptRef, args.prompt, "utf8");
+
+  return {
+    prompt: [
+      "A large Nolo runtime prompt has been materialized outside this command argument.",
+      ...(args.runtimePromptPage?.dbKey
+        ? [
+            "Cloud prompt page is the shared audit/context source.",
+            `Cloud prompt page: ${args.runtimePromptPage.dbKey}`,
+            `Read cloud page: bun packages/cli/index.ts doc read ${JSON.stringify(args.runtimePromptPage.dbKey)}`,
+            ...(args.runtimePromptPage.promptHash
+              ? [`Cloud prompt sha256 prefix: ${args.runtimePromptPage.promptHash}`]
+              : []),
+            "",
+          ]
+        : []),
+      "Local prompt file is the execution-machine fallback and should match the cloud page content at run start.",
+      `Prompt file: ${promptRef}`,
+      `Prompt bytes: ${promptBytes}`,
+      `Prompt sha256 prefix: ${promptHash}`,
+      "",
+      "Prefer the cloud prompt page for shared context when readable; use the local prompt file as fallback.",
+      "Local repository edits, diffs, test output, and commits are still authoritative for local execution facts.",
+      "If neither source is readable, stop and report PROMPT_REF_UNREADABLE with both references.",
+    ].join("\n"),
+    promptBytes,
+    promptHash,
+    promptRef,
+  };
+}
+
+function readRuntimePromptPageMeta(parsed: any) {
+  const page = parsed?.payload?.meta?.runtimePromptPage;
+  if (!page || typeof page !== "object") return null;
+  return {
+    dbKey: typeof page.dbKey === "string" ? page.dbKey : undefined,
+    promptHash: typeof page.promptHash === "string" ? page.promptHash : undefined,
+    contentBytes: typeof page.contentBytes === "number" ? page.contentBytes : undefined,
+  };
+}
+
+function logConnectorRun(message: string, fields: Record<string, unknown> = {}) {
+  console.error(`[nolo-connector] ${message} ${JSON.stringify(fields)}`);
+}
+
 function buildDaemonCommand(cliEntrypointPath: string | undefined) {
   return [process.execPath, cliEntrypointPath || import.meta.path, "connect", "--ws"];
 }
@@ -272,6 +479,7 @@ function buildTaskRunBridgePrompt(args: {
     "Run commands from the repository root. The runner already provides server URL and auth in the environment.",
     "Release boundary: after review passes, AI/reviewer/Codex may advance alpha for verification. Do not merge, push, or release main/release unless the human owner explicitly authorizes it in the current task context.",
     "Cost boundary: read taskRun.control from context. Prefer low-cost/free-window models for routine work, and reserve Codex for supervision, quality gates, complex unblocking, and main/release decisions.",
+    "Handoff context: start from read-context, then inspect existing refs such as workItems.dialogIds, workItems.outcome, review.dialogId, activityRefs, agentRuns.dialogId/resultSummary, and artifactRefs. Use dialog read/search for exact evidence; do not infer completion from handoff text alone.",
     `Read context: bun packages/cli/index.ts task-run read-context --row-dbkey ${JSON.stringify(rowDbKey)}`,
     ...(workItemId
       ? [
@@ -416,11 +624,9 @@ function buildArtifactProgress(args: {
   const runtimeTools = Array.isArray(args.runtimePolicy?.runtimeTools)
     ? args.runtimePolicy.runtimeTools
     : [];
-  const shellTool = runtimeTools.includes("execBash")
-    ? "execBash"
-    : runtimeTools.includes("execShell")
-      ? "execShell"
-      : "workspaceArtifact";
+  const shellTool = runtimeTools.includes("execShell")
+    ? "execShell"
+    : "workspaceArtifact";
   return {
     eventType: "tool-result",
     toolCallCount: 1,
@@ -611,12 +817,57 @@ export async function handleConnectorRunMessage(
       assertMachineRunAllowed(userInput, effectivePermissionPolicy);
       baseSha = await readConnectorGitHead(artifactCwd);
       const provider = String(agentConfig.cliProvider || "copilot");
+      const builtPrompt = buildConnectorCliPrompt(agentConfig, userInput, {
+        agentKey: String(parsed.payload?.agentKey ?? ""),
+        runtimeContext: parsed.payload?.runtimeContext,
+      }, effectivePermissionPolicy);
+      const materializedPrompt = materializeLargeConnectorPrompt({
+        prompt: builtPrompt,
+        cwd,
+        env: runtimeEnv,
+        requestId: parsed.requestId,
+        runtimePromptPage: readRuntimePromptPageMeta(parsed),
+      });
+      const runtimePromptPage = readRuntimePromptPageMeta(parsed);
+      const startAt = Date.now();
+      const progressBase = {
+        provider,
+        requestId: parsed.requestId,
+        promptBytes: materializedPrompt.promptBytes,
+        promptHash: materializedPrompt.promptHash,
+        ...(materializedPrompt.promptRef ? { promptRef: materializedPrompt.promptRef } : {}),
+        ...(runtimePromptPage?.dbKey ? { promptPageKey: runtimePromptPage.dbKey } : {}),
+        ...(runtimePromptPage?.promptHash ? { promptPageHash: runtimePromptPage.promptHash } : {}),
+        workspaceRoot: artifactCwd,
+        workspaceKind: requestsTaskWorktree(runtimePolicy) ? "task-worktree" : "current",
+      };
+      logConnectorRun("agent.run.cli.start", {
+        requestId: parsed.requestId,
+        agentKey: parsed.payload?.agentKey,
+        provider,
+        cwd,
+        artifactCwd,
+        timeout,
+        promptBytes: materializedPrompt.promptBytes,
+        promptHash: materializedPrompt.promptHash,
+        promptRef: materializedPrompt.promptRef,
+        promptPageKey: runtimePromptPage?.dbKey,
+      });
+      sendProgress({
+        ...progressBase,
+        message: "cli-started",
+        updatedAt: startAt,
+      });
+      const heartbeat = setInterval(() => {
+        sendProgress({
+          ...progressBase,
+          message: "cli-running",
+          updatedAt: Date.now(),
+        });
+      }, 15_000);
       const result = await executeCli(
         provider,
-        buildConnectorCliPrompt(agentConfig, userInput, {
-          agentKey: String(parsed.payload?.agentKey ?? ""),
-          runtimeContext: parsed.payload?.runtimeContext,
-        }, effectivePermissionPolicy),
+        materializedPrompt.prompt,
         {
           model: agentConfig.model || undefined,
           timeout,
@@ -630,9 +881,15 @@ export async function handleConnectorRunMessage(
             NOLO_MACHINE_API_KEY: runtimeEnv.NOLO_MACHINE_API_KEY || runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH,
           },
         }
-      );
+      ).finally(() => clearInterval(heartbeat));
+      logConnectorRun("agent.run.cli.result", {
+        requestId: parsed.requestId,
+        provider,
+        elapsed: result.elapsed,
+        outputBytes: byteLength(result.raw ?? result.text ?? ""),
+      });
       runContent = result.text;
-      runModel = agentConfig.model ?? provider;
+      runModel = String(agentConfig.model || "").trim() || provider;
       runTrace = [{ role: "assistant", content: result.text }];
       const artifacts = await collectConnectorRunArtifact({
         cwd: artifactCwd,
@@ -696,11 +953,16 @@ export async function handleConnectorRunMessage(
         artifacts,
       },
     }));
-  } catch (error) {
-    send(JSON.stringify({
-      type: "agent.run.result",
-      requestId: parsed.requestId,
-      error: error instanceof Error ? error.message : String(error),
+  } catch (error) {
+    logConnectorRun("agent.run.error", {
+      requestId: parsed.requestId,
+      agentKey: parsed.payload?.agentKey,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    send(JSON.stringify({
+      type: "agent.run.result",
+      requestId: parsed.requestId,
+      error: error instanceof Error ? error.message : String(error),
     }));
   }
 }
@@ -804,10 +1066,11 @@ export async function runMachineConnectCommand(
     return 1;
   }
 
-  const serverUrl = resolveConnectServerUrl(args, env);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
-  const sendHeartbeat = async () => {
+  const serverUrl = resolveConnectServerUrl(args, env);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
+  const validateWorkspaceLinks = deps.validateWorkspaceLinks ?? validateConnectorWorkspaceLinks;
+  const sendHeartbeat = async () => {
     const res = await fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
     method: "POST",
     headers: {
@@ -822,8 +1085,11 @@ export async function runMachineConnectCommand(
       throw new Error(`HTTP ${res.status}\n${text}`);
     }
   };
-
+
   if (hasFlag(args, "--daemon") || hasFlag(args, "--background")) {
+    if (!(await checkConnectorWorkspaceLinks(process.cwd(), output, validateWorkspaceLinks))) {
+      return 1;
+    }
     const logPath = resolveDaemonLogPath(env);
     const result = (deps.spawnDaemon ?? defaultSpawnDaemon)({
       cmd: buildDaemonCommand(deps.cliEntrypointPath),
@@ -833,9 +1099,12 @@ export async function runMachineConnectCommand(
     });
     output.write(`Connector daemon started${result.pid ? ` pid=${result.pid}` : ""}. Log: ${logPath}\n`);
     return 0;
-  }
-
+  }
+
   if (hasFlag(args, "--ws")) {
+    if (!(await checkConnectorWorkspaceLinks(process.cwd(), output, validateWorkspaceLinks))) {
+      return 1;
+    }
     const maxAttempts = deps.maxConnectorAttempts ?? Infinity;
     const sleep = deps.sleep ?? defaultSleep;
     const reconnectDelayMs = resolveConnectorReconnectDelayMs(env);