nolo-cli 0.1.23 → 0.1.26

package/agent-runtime/runtimeToolPolicy.ts

@@ -1,5 +1,5 @@
 import type { AgentRuntimeAgentConfig } from "./hostAdapter";
-import type { AgentRuntimeToolPolicy } from "./types";
+import type { AgentRuntimeHost, AgentRuntimeToolPolicy } from "./types";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -39,6 +39,7 @@ export function normalizeAgentRuntimeToolPolicy(
       : {}),
     ...(isRecord(value.workspace) ? { workspace: { ...value.workspace } } : {}),
     ...(isRecord(value.shell) ? { shell: { ...value.shell } } : {}),
+    ...(isRecord(value.isolation) ? { isolation: { ...value.isolation } } : {}),
     ...(isRecord(value.git) ? { git: { ...value.git } } : {}),
     ...(isRecord(value.budget) ? { budget: { ...value.budget } } : {}),
     ...(isRecord(value.audit) ? { audit: { ...value.audit } } : {}),
@@ -69,15 +70,52 @@ export function mergeAgentRuntimeToolPolicies(
       ]),
     },
     shell: mergeRecords(base?.shell, override?.shell),
+    isolation: mergeRecords(base?.isolation, override?.isolation),
     git: mergeRecords(base?.git, override?.git),
     budget: mergeRecords(base?.budget, override?.budget),
     audit: mergeRecords(base?.audit, override?.audit),
   };
 }
 
+function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
+  if (!policy) return false;
+  const workspaceMode = policy.workspace?.mode;
+  return (
+    policy.shell?.enabled === true ||
+    policy.runtimeTools?.some((tool) => tool === "execShell") ||
+    workspaceMode === "lease" ||
+    workspaceMode === "task-worktree"
+  );
+}
+
+function applyWebRuntimeSafetyBaseline(
+  policy: AgentRuntimeToolPolicy | undefined,
+): AgentRuntimeToolPolicy | undefined {
+  if (!policyRequestsHostedWorkspace(policy)) return policy;
+  return mergeAgentRuntimeToolPolicies(
+    policy,
+    {
+      version: 1,
+      shell: {
+        commandPolicy: "approval",
+        networkPolicy: "default-deny",
+      },
+      isolation: {
+        mode: "os-sandbox",
+      },
+      audit: {
+        logToolCalls: true,
+        logShellCommands: true,
+        writeToDialog: true,
+      },
+    },
+  );
+}
+
 export function resolveEffectiveRuntimeToolPolicy(args: {
   agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding">;
   taskRunControl?: { runtimeToolPolicy?: unknown } | null;
+  host?: AgentRuntimeHost;
 }): AgentRuntimeToolPolicy | undefined {
   const agentPolicy = normalizeAgentRuntimeToolPolicy(
     args.agentConfig.runtimeToolPolicy ??
@@ -88,5 +126,8 @@ export function resolveEffectiveRuntimeToolPolicy(args: {
   const taskPolicy = normalizeAgentRuntimeToolPolicy(
     args.taskRunControl?.runtimeToolPolicy,
   );
-  return mergeAgentRuntimeToolPolicies(agentPolicy, taskPolicy);
+  const effectivePolicy = mergeAgentRuntimeToolPolicies(agentPolicy, taskPolicy);
+  return args.host === "web"
+    ? applyWebRuntimeSafetyBaseline(effectivePolicy)
+    : effectivePolicy;
 }

package/agent-runtime/types.ts

@@ -105,6 +105,10 @@ export type AgentRuntimeAuditPolicy = {
   writeToTask?: boolean;
 };
 
+export type AgentRuntimeIsolationPolicy = {
+  mode?: "none" | "os-sandbox" | "container" | "gvisor" | "microvm" | "dedicated-vm";
+};
+
 export type AgentRuntimeToolPolicy = {
   version?: 1;
   agentTools?: string[];
@@ -115,6 +119,7 @@ export type AgentRuntimeToolPolicy = {
     cwd?: string;
   };
   shell?: AgentRuntimeShellPolicy;
+  isolation?: AgentRuntimeIsolationPolicy;
   git?: AgentRuntimeGitPolicy;
   budget?: {
     dailyUsdLimit?: number;

package/agentAliases.ts

@@ -13,7 +13,7 @@ export const NOLO_FULLSTACK_AGENT_KEY =
 export const NOLO_SENIOR_FULLSTACK_AGENT_ID = "01NOLOFULLSTK00000000T3XR4";
 export const NOLO_SENIOR_FULLSTACK_AGENT_KEY =
   `agent-${PLATFORM_DEMO_USER_ID}-${NOLO_SENIOR_FULLSTACK_AGENT_ID}`;
-export const NOLO_REVIEW_AGENT_ID = "01NOLOREVIEW0000000000R8V1";
+export const NOLO_REVIEW_AGENT_ID = "01CODEXCLIMAIN00000001OK";
 export const NOLO_REVIEW_AGENT_KEY =
   `agent-${PLATFORM_DEMO_USER_ID}-${NOLO_REVIEW_AGENT_ID}`;
 

package/agentCommandSupport.ts

@@ -0,0 +1,77 @@
+import type { MachineHeartbeat } from "./connector-experimental/protocol";
+import type { CliKvDb } from "./client/hybridRecordStore";
+import type { EnvLike } from "./cliEnvHelpers";
+
+export type OutputLike = { write(chunk: string): unknown };
+
+export type SmokeWebSocketOptions = {
+  headers: Record<string, string>;
+  onMessage: (message: string) => void | Promise<void>;
+  onOpen: () => void | Promise<void>;
+  sentMessages: string[];
+};
+
+export type LocalCliExecutor = (
+  provider: string,
+  prompt: string,
+  options: { model?: string; timeout?: number; cwd?: string; yolo?: boolean }
+) => Promise<{ text: string; raw?: string; elapsed?: number }>;
+
+export type LocalRuntimeProbeResult = {
+  ok: boolean;
+  dbPath: string;
+  agentFound: boolean;
+  agentKey?: string;
+  error?: string;
+};
+
+export type AgentCommandDeps = {
+  env?: EnvLike;
+  output?: OutputLike;
+  db?: CliKvDb;
+  fetchImpl?: typeof fetch;
+  fallbackFetchImpl?: typeof fetch;
+  machineInfo?: () => MachineHeartbeat;
+  connectWebSocket?: (url: string, options: SmokeWebSocketOptions) => Promise<void>;
+  executeCli?: LocalCliExecutor;
+  connectorRunMessageHandler?: (
+    machine: MachineHeartbeat,
+    message: string,
+    pushMessage: (response: string) => void,
+    executeCli: LocalCliExecutor,
+    env: EnvLike,
+    fetchImpl: typeof fetch
+  ) => Promise<void>;
+  localRuntimeProbe?: (env: EnvLike) => Promise<LocalRuntimeProbeResult>;
+};
+
+async function getDefaultCliDb() {
+  const { getDefaultCliLocalRuntimeDb } = await import("./localRuntimeDb");
+  return getDefaultCliLocalRuntimeDb();
+}
+
+function createNullCliDb(): CliKvDb {
+  return {
+    get: async () => {
+      throw new Error("local cache unavailable");
+    },
+    put: async () => undefined,
+    batch: async () => undefined,
+    iterator: () => {
+      throw new Error("local cache unavailable");
+    },
+  };
+}
+
+export async function getReadableCliDb(output: OutputLike) {
+  try {
+    return await getDefaultCliDb();
+  } catch (error) {
+    output.write(
+      `[nolo] local agent cache unavailable; falling back to remote reads only: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`
+    );
+    return createNullCliDb();
+  }
+}

package/agentInternalCommandEntries.ts

@@ -0,0 +1,34 @@
+import { runAgentListCommand } from "./agentListCommands";
+import {
+  runAgentBindCurrentCommand,
+  runAgentRuntimeDoctorCommand,
+  runAgentSmokeCurrentCommand,
+} from "./agentMachineCommands";
+import { runAgentPullCommand } from "./agentPullCommand";
+import {
+  runAgentReadCommand,
+  runAgentUpdateCommand,
+} from "./agentRecordCommands";
+import { runAgentRunCommand } from "./agentRunCommand";
+import {
+  createEnvCommand,
+  createEnvScriptDirCommand,
+} from "./cliCommandFactories";
+import type { CommandEntry } from "./cliCommandTypes";
+import { runSetupOfflineMarxistsAgentCommand } from "./offlineMarxistsAgentCommand";
+
+export function getAgentInternalCommandEntries(): CommandEntry[] {
+  return [
+    createEnvScriptDirCommand(["chat"], "Chat with an agent", runAgentRunCommand),
+    createEnvCommand(["agent", "list"], "List owned agents", runAgentListCommand),
+    createEnvCommand(["agent", "pull"], "Cache an agent for local runs", runAgentPullCommand),
+    createEnvCommand(["agent", "read"], "Read a single agent", runAgentReadCommand),
+    createEnvScriptDirCommand(["agent", "run"], "Run an agent", runAgentRunCommand),
+    createEnvCommand(["agent", "setup-offline-marxists"], "Create or update the Marxists.org offline book agent", runSetupOfflineMarxistsAgentCommand),
+    createEnvCommand(["agent", "update"], "Update agent fields", runAgentUpdateCommand),
+    createEnvCommand(["agent", "bind-current"], "Bind an agent to this machine", runAgentBindCurrentCommand),
+    createEnvCommand(["agent", "smoke-current"], "Smoke test a bound agent through this machine", runAgentSmokeCurrentCommand),
+    createEnvCommand(["agent", "runtime-doctor"], "Diagnose current machine runtime compatibility", runAgentRuntimeDoctorCommand),
+    createEnvScriptDirCommand(["agent", "chat"], "Chat with an agent", runAgentRunCommand),
+  ];
+}

package/agentListCommands.ts

@@ -0,0 +1,123 @@
+import { getReadableCliDb, type AgentCommandDeps } from "./agentCommandSupport";
+import {
+  listLocalCachedAgents,
+  listRemoteAgents,
+  parseAgentListArgs,
+  type ListedAgent,
+} from "./agentListHelpers";
+import {
+  queryUserRecords,
+  readDbRecord,
+} from "./agentRecordHelpers";
+import {
+  parseUserIdFromAuthToken,
+  resolveAuthToken,
+  resolveServerUrl,
+} from "./cliEnvHelpers";
+
+export async function runAgentListCommand(
+  args: string[],
+  deps: AgentCommandDeps = {}
+) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const { wantJson, publicOnly, idsOnly, includeLegacy } = parseAgentListArgs(args);
+
+  const authToken = resolveAuthToken(env);
+  if (!authToken) {
+    output.write("[nolo] agent list requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+
+  const userId = parseUserIdFromAuthToken(authToken);
+  if (!userId) {
+    output.write("[nolo] agent list could not read userId from AUTH_TOKEN.\n");
+    return 1;
+  }
+
+  const db = deps.db ?? await getReadableCliDb(output);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+
+  try {
+    let agents: ListedAgent[];
+    let source: "local-cache" | "remote-cache";
+    try {
+      agents = await listLocalCachedAgents({ db, userId });
+      source = "local-cache";
+    } catch {
+      const serverUrl = resolveServerUrl(env);
+      agents = await listRemoteAgents({
+        authToken,
+        fallbackFetchImpl,
+        fetchImpl,
+        includeLegacy,
+        serverUrl,
+        userId,
+        queryUserRecords,
+        readDbRecord,
+      });
+      source = "remote-cache";
+    }
+
+    if (!includeLegacy) {
+      agents = agents.filter((agent) => !agent.privateKey.startsWith("cybot-"));
+    }
+    if (publicOnly) {
+      agents = agents.filter((agent) => agent.publicRecordExists);
+    }
+
+    if (idsOnly) {
+      output.write(`${agents.map((agent) => agent.id).join("\n")}\n`);
+      return 0;
+    }
+
+    if (wantJson) {
+      output.write(JSON.stringify({
+        userId,
+        total: agents.length,
+        publicCount: agents.filter((agent) => agent.publicRecordExists).length,
+        source,
+        agents,
+      }, null, 2));
+      output.write("\n");
+      return 0;
+    }
+
+    output.write(`userId: ${userId}\n`);
+    output.write(`total agents: ${agents.length}\n`);
+    output.write(`public agents: ${agents.filter((agent) => agent.publicRecordExists).length}\n`);
+    output.write(`source: ${source}\n`);
+    if (agents.length === 0) {
+      output.write("\n(no agents found)\n");
+      return 0;
+    }
+    for (const agent of agents) {
+      const status = agent.publicRecordExists ? "public" : "private";
+      const flagMismatch = agent.isPublicFlag !== agent.publicRecordExists
+        ? ` flag=${agent.isPublicFlag}`
+        : "";
+      output.write(
+        [
+          `\n[${status}] ${agent.name}`,
+          `id=${agent.id}`,
+          `type=${agent.type ?? "-"}`,
+          `model=${agent.model}`,
+          `updatedAt=${agent.updatedAt ?? "-"}`,
+          `privateKey=${agent.privateKey}`,
+          `publicKey=${agent.publicKey}${flagMismatch}`,
+          `tools=${agent.tools.join(", ") || "-"}`,
+        ].join("\n")
+      );
+      output.write("\n");
+    }
+    return 0;
+  } catch (error) {
+    output.write(
+      `[nolo] agent list failed: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`
+    );
+    return 1;
+  }
+}

package/agentListHelpers.ts

@@ -0,0 +1,187 @@
+import type { CliKvDb } from "./client/hybridRecordStore";
+
+export type ListedAgent = {
+  id: string;
+  privateKey: string;
+  publicKey: string;
+  name: string;
+  model: string;
+  updatedAt: string | number | null;
+  isPublicFlag: boolean;
+  publicRecordExists: boolean;
+  type: string | null;
+  tools: string[];
+};
+
+function parseAgentRecordId(privateKey: string, explicitId?: string) {
+  if (explicitId) return explicitId;
+  const agentMatch = privateKey.match(/^agent-[^-]+-(.+)$/i);
+  if (agentMatch?.[1]) return agentMatch[1];
+  const cybotMatch = privateKey.match(/^cybot-[^-]+-([0-9A-HJKMNP-TV-Z]{26})$/i);
+  return cybotMatch?.[1] ?? "";
+}
+
+function buildCompanionKeys(privateKey: string, rawId: string, userId: string) {
+  if (privateKey.startsWith("cybot-")) {
+    return {
+      privateKey: `cybot-${userId}-${rawId}`,
+      publicKey: `cybot-pub-${rawId}`,
+    };
+  }
+  return {
+    privateKey: `agent-${userId}-${rawId}`,
+    publicKey: `agent-pub-${rawId}`,
+  };
+}
+
+export function normalizeListedAgent(record: any): ListedAgent | null {
+  const privateKey = typeof record?.dbKey === "string" ? record.dbKey : "";
+  const explicitId = typeof record?.id === "string" && record.id ? record.id : undefined;
+  const ownerUserId = typeof record?.userId === "string" ? record.userId : "";
+  const rawId = explicitId
+    || (ownerUserId && privateKey.startsWith(`agent-${ownerUserId}-`)
+      ? privateKey.slice(`agent-${ownerUserId}-`.length)
+      : ownerUserId && privateKey.startsWith(`cybot-${ownerUserId}-`)
+        ? privateKey.slice(`cybot-${ownerUserId}-`.length)
+        : parseAgentRecordId(privateKey, explicitId));
+  if (!privateKey || !rawId || !ownerUserId) return null;
+  const keys = buildCompanionKeys(privateKey, rawId, ownerUserId);
+  return {
+    id: rawId,
+    privateKey,
+    publicKey: keys.publicKey,
+    name: typeof record?.name === "string" && record.name ? record.name : "(unnamed)",
+    model: typeof record?.model === "string" && record.model ? record.model : "-",
+    updatedAt:
+      typeof record?.updatedAt === "string" || typeof record?.updatedAt === "number"
+        ? record.updatedAt
+        : typeof record?.createdAt === "string" || typeof record?.createdAt === "number"
+          ? record.createdAt
+          : typeof record?.created === "string" || typeof record?.created === "number"
+            ? record.created
+            : null,
+    isPublicFlag: !!record?.isPublic,
+    publicRecordExists: false,
+    type: typeof record?.type === "string" ? record.type : null,
+    tools: Array.isArray(record?.tools)
+      ? record.tools.filter((tool: unknown): tool is string => typeof tool === "string")
+      : [],
+  };
+}
+
+export function sortListedAgents(agents: ListedAgent[]) {
+  agents.sort((a, b) => {
+    const ta = a.updatedAt == null ? 0 : new Date(a.updatedAt).getTime();
+    const tb = b.updatedAt == null ? 0 : new Date(b.updatedAt).getTime();
+    return tb - ta;
+  });
+  return agents;
+}
+
+export function parseAgentListArgs(args: string[]) {
+  return {
+    wantJson: args.includes("--json"),
+    publicOnly: args.includes("--public-only"),
+    idsOnly: args.includes("--ids-only"),
+    includeLegacy: args.includes("--include-legacy"),
+  };
+}
+
+export async function listLocalCachedAgents(args: {
+  db: CliKvDb;
+  userId: string;
+}) {
+  const privateRecords = new Map<string, any>();
+  const publicKeys = new Set<string>();
+  for await (const [key, value] of args.db.iterator()) {
+    if (typeof key !== "string" || !value || typeof value !== "object") continue;
+    if (key.startsWith(`agent-${args.userId}-`) || key.startsWith(`cybot-${args.userId}-`)) {
+      privateRecords.set(key, { ...(value as Record<string, unknown>), dbKey: key });
+      continue;
+    }
+    if (key.startsWith("agent-pub-") || key.startsWith("cybot-pub-")) {
+      publicKeys.add(key);
+    }
+  }
+
+  const agents = sortListedAgents(
+    [...privateRecords.values()]
+      .map((record) => normalizeListedAgent(record))
+      .filter((agent): agent is ListedAgent => agent != null)
+  );
+
+  for (const agent of agents) {
+    agent.publicRecordExists = publicKeys.has(agent.publicKey);
+  }
+  return agents;
+}
+
+async function hasReadableRecord(args: {
+  authToken: string;
+  dbKey: string;
+  fallbackFetchImpl?: typeof fetch;
+  fetchImpl: typeof fetch;
+  serverUrl: string;
+  readDbRecord: (args: {
+    authToken: string;
+    dbKey: string;
+    fallbackFetchImpl?: typeof fetch;
+    fetchImpl: typeof fetch;
+    serverUrl: string;
+  }) => Promise<any>;
+}) {
+  try {
+    await args.readDbRecord(args);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function listRemoteAgents(args: {
+  authToken: string;
+  fallbackFetchImpl?: typeof fetch;
+  fetchImpl: typeof fetch;
+  includeLegacy: boolean;
+  serverUrl: string;
+  userId: string;
+  queryUserRecords: (args: {
+    authToken: string;
+    fallbackFetchImpl?: typeof fetch;
+    fetchImpl: typeof fetch;
+    serverUrl: string;
+    userId: string;
+    type: "agent" | "cybot";
+  }) => Promise<any[]>;
+  readDbRecord: (args: {
+    authToken: string;
+    dbKey: string;
+    fallbackFetchImpl?: typeof fetch;
+    fetchImpl: typeof fetch;
+    serverUrl: string;
+  }) => Promise<any>;
+}) {
+  const recordGroups = [await args.queryUserRecords({ ...args, type: "agent" as const })];
+  if (args.includeLegacy) {
+    recordGroups.push(await args.queryUserRecords({ ...args, type: "cybot" as const }));
+  }
+  const agents = sortListedAgents(
+    recordGroups
+      .flat()
+      .map((record) => normalizeListedAgent(record))
+      .filter((agent): agent is ListedAgent => agent != null)
+  );
+  await Promise.all(
+    agents.map(async (agent) => {
+      agent.publicRecordExists = await hasReadableRecord({
+        authToken: args.authToken,
+        dbKey: agent.publicKey,
+        fallbackFetchImpl: args.fallbackFetchImpl,
+        fetchImpl: args.fetchImpl,
+        serverUrl: args.serverUrl,
+        readDbRecord: args.readDbRecord,
+      });
+    })
+  );
+  return agents;
+}