nolo-cli 0.1.23 → 0.1.29

package/machineCommands.ts

@@ -1,78 +1,44 @@
 import type { MachineHeartbeat } from "./connector-experimental/protocol";
 import { detectMachineInfo } from "./connector-experimental/machineInfo";
-import { spawn } from "node:child_process";
-import { mkdirSync, openSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { runLocalAgentTurn, type LocalAgentToolEvent } from "./agent-runtime/localLoop";
-import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import {
-  collectConnectorRunArtifact,
-  readConnectorGitHead,
-  resolveConnectorRunCwd,
-} from "./connectorRunArtifact";
-import {
-  type HeartbeatLoopOptions,
-  runHeartbeatLoop as defaultRunHeartbeatLoop,
-} from "./connector-experimental/heartbeatLoop";
-import {
-  assertMachineRunAllowed,
-  buildMachinePermissionPromptBlock,
-  resolveMachineRunPermissionPolicy,
-} from "./ai/agent/machineRunPermissions";
+  type HeartbeatLoopOptions,
+  runHeartbeatLoop as defaultRunHeartbeatLoop,
+} from "./connector-experimental/heartbeatLoop";
 import { resolveConnectorWebSocketTarget } from "./connectorWebSocketTarget";
-import { createCliLocalRuntimeAdapter } from "./client/localRuntimeAdapter";
-import { prepareTaskWorktree } from "./client/taskWorktree";
-
-type EnvLike = Record<string, string | undefined>;
-type OutputLike = { write(chunk: string): unknown };
-type ConnectorWebSocketOptions = {
-  headers: Record<string, string>;
-  onMessage: (message: string) => void | Promise<void>;
-  sentMessages: string[];
-};
-export type LocalCliExecutor = (
-  provider: string,
-  prompt: string,
-  options: { model?: string; timeout?: number; cwd?: string; yolo?: boolean; env?: EnvLike }
-) => Promise<{ text: string; raw?: string; elapsed?: number }>;
-
-type ConnectorRuntimePolicy = {
-  runtimeTools?: string[];
-  agentTools?: string[];
-  workspace?: {
-    mode?: string;
-    cwd?: string;
-  };
-  shell?: {
-    enabled?: boolean;
-    mode?: string;
-  };
-};
+import {
+  checkConnectorWorkspaceLinks,
+  runMachineDaemonCommand,
+} from "./machineDaemonCommands";
+import { runMachineHeartbeatConnectCommand } from "./machineHeartbeatCommands";
+import { runMachineWatchCommand } from "./machineWatchCommands";
+import {
+  handleConnectorRunMessage,
+  type LocalCliExecutor,
+} from "./machineWsRunDispatch";
+import {
+  defaultConnectWebSocket,
+  runMachineWsSession,
+  type ConnectorWebSocketOptions,
+} from "./machineWsSession";
+import {
+  buildConnectorCliPrompt,
+} from "./machineCommandPrompts";
+import {
+  hasFlag,
+  readOption,
+  resolveConnectAuthToken,
+  resolveConnectServerUrl,
+  resolveConnectorReconnectDelayMs,
+  writeAuthMissing,
+  type EnvLike,
+  type OutputLike,
+} from "./machineCommandResolution";
+export {
+  formatMachineStatus,
+  runMachineStatusCommand,
+  type MachineSummary,
+} from "./machineStatusCommands";
 
-type ConnectorRunProgress = {
-  eventType?: LocalAgentToolEvent["type"];
-  toolCallCount?: number;
-  toolResultCount?: number;
-  lastToolNames?: string[];
-  workspaceRoot?: string;
-  workspaceKind?: string;
-  message?: string;
-  updatedAt?: number;
-};
-
-export type MachineSummary = {
-  machineId: string;
-  name: string;
-  platform: string;
-  arch: string;
-  connectorVersion: string | null;
-  capabilities: string[];
-  connectorStatus?: "connected" | "disconnected";
-  status: "online" | "offline";
-  lastSeenAt: number;
-};
-
 type MachineCommandDeps = {
   env?: EnvLike;
   output?: OutputLike;
@@ -82,153 +48,19 @@ type MachineCommandDeps = {
   fetchImpl?: typeof fetch;
   machineInfo?: () => MachineHeartbeat;
   runHeartbeatLoop?: (options: HeartbeatLoopOptions) => Promise<void>;
-  connectWebSocket?: (url: string, options: ConnectorWebSocketOptions) => Promise<void>;
-  executeCli?: LocalCliExecutor;
-  spawnDaemon?: (args: {
+  connectWebSocket?: (url: string, options: ConnectorWebSocketOptions) => Promise<void>;
+  executeCli?: LocalCliExecutor;
+  validateWorkspaceLinks?: (cwd: string) => string[] | Promise<string[]>;
+  spawnDaemon?: (args: {
     cmd: string[];
     cwd: string;
     env: EnvLike;
     logPath: string;
   }) => { pid?: number };
-};
-
-function resolveServerUrl(env: EnvLike) {
-  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
-}
-
-function resolveAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || "";
-}
-
-function writeAuthMissing(output: OutputLike) {
-  output.write(
-    "[nolo] Machine commands require an auth token. Run `nolo login` or set AUTH_TOKEN.\n"
-  );
-}
-
-function hasFlag(args: string[], flag: string) {
-  return args.includes(flag);
-}
-
-function readOption(args: string[], flag: string) {
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === flag) {
-      const next = args[i + 1];
-      if (typeof next === "string" && !next.startsWith("-")) return next;
-      return "";
-    }
-    if (arg.startsWith(flag + "=")) {
-      return arg.slice(flag.length + 1);
-    }
-  }
-  return "";
-}
-
-function resolveConnectServerUrl(args: string[], env: EnvLike) {
-  const fromFlag = readOption(args, "--server-url") || readOption(args, "--server");
-  const raw = fromFlag || env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL;
-  return String(raw).replace(/\/+$|\s+$/g, "").replace(/\/+$/g, "").replace(/\s+$/g, "");
-}
-
-function resolveConnectAuthToken(args: string[], env: EnvLike) {
-  return readOption(args, "--api-key") || readOption(args, "--token") || resolveAuthToken(env);
-}
-
-function resolveDaemonLogPath(env: EnvLike) {
-  return env.NOLO_CONNECT_LOG || join(homedir(), ".nolo", "logs", "connector.log");
-}
-
-function buildDaemonCommand(cliEntrypointPath: string | undefined) {
-  return [process.execPath, cliEntrypointPath || import.meta.path, "connect", "--ws"];
-}
-
-function defaultSpawnDaemon(args: {
-  cmd: string[];
-  cwd: string;
-  env: EnvLike;
-  logPath: string;
-}) {
-  mkdirSync(dirname(args.logPath), { recursive: true });
-  const out = openSync(args.logPath, "a");
-  const env = Object.fromEntries(
-    Object.entries(args.env).filter((entry): entry is [string, string] => typeof entry[1] === "string")
-  );
-  const proc = spawn(args.cmd[0], args.cmd.slice(1), {
-    cwd: args.cwd,
-    env,
-    detached: true,
-    stdio: ["ignore", out, out],
-  });
-  proc.unref();
-  return { pid: proc.pid };
-}
-
-function resolveHeartbeatIntervalMs(env: EnvLike) {
-  const raw = Number(env.NOLO_CONNECT_HEARTBEAT_MS ?? "");
-  return Number.isFinite(raw) && raw > 0 ? raw : 30_000;
-}
-
-const CONNECTOR_WS_KEEPALIVE_MS = 25_000;
-
-function buildConnectorKeepaliveMessage() {
-  return JSON.stringify({ type: "connector.keepalive", sentAt: Date.now() });
-}
+};
 
 const defaultSleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
 
-function resolveConnectorReconnectDelayMs(env: EnvLike) {
-  const raw = Number(env.NOLO_CONNECT_RECONNECT_MS ?? "");
-  return Number.isFinite(raw) && raw >= 0 ? raw : 5_000;
-}
-
-async function defaultConnectWebSocket(url: string, options: ConnectorWebSocketOptions) {
-  const WebSocketCtor = globalThis.WebSocket;
-  if (!WebSocketCtor) {
-    throw new Error("WebSocket is not available in this runtime");
-  }
-  await new Promise<void>((resolve, reject) => {
-    const ws = new WebSocketCtor(url, {
-      headers: options.headers,
-    } as any);
-    let opened = false;
-    let keepalive: ReturnType<typeof setInterval> | null = null;
-    const clearKeepalive = () => {
-      if (keepalive) {
-        clearInterval(keepalive);
-        keepalive = null;
-      }
-    };
-    ws.addEventListener("open", () => {
-      opened = true;
-      keepalive = setInterval(() => {
-        try {
-          ws.send(buildConnectorKeepaliveMessage());
-        } catch {
-          clearKeepalive();
-        }
-      }, CONNECTOR_WS_KEEPALIVE_MS);
-    }, { once: true });
-    ws.addEventListener("error", () => {
-      clearKeepalive();
-      reject(new Error("connector websocket failed"));
-    });
-    ws.addEventListener("close", () => {
-      clearKeepalive();
-      if (opened) resolve();
-      else reject(new Error("connector websocket closed before opening"));
-    }, { once: true });
-    ws.addEventListener("message", (event) => {
-      const startIndex = options.sentMessages.length;
-      Promise.resolve(options.onMessage(String(event.data))).then(() => {
-        for (const message of options.sentMessages.slice(startIndex)) {
-          ws.send(message);
-        }
-      }).catch(() => undefined);
-    });
-  });
-}
-
 async function defaultExecuteCli(
   provider: string,
   prompt: string,
@@ -237,562 +69,12 @@ async function defaultExecuteCli(
   const { executeCli } = await import("./ai/agent/cliExecutor");
   return executeCli(provider as any, prompt, options);
 }
-
-function detectLaunchableMachineInfo() {
-  return detectMachineInfo({ probeLaunchable: true });
-}
-
-function inferTaskRunRole(agentKey: string, agentConfig: any) {
-  const haystack = [
-    agentKey,
-    agentConfig?.name,
-    agentConfig?.prompt,
-  ].filter(Boolean).join("\n").toLowerCase();
-  if (haystack.includes("frontend") || haystack.includes("前端")) return "frontend";
-  if (haystack.includes("fullstack") || haystack.includes("全栈")) return "fullstack";
-  if (haystack.includes("review") || haystack.includes("审查")) return "reviewer";
-  if (haystack.includes("project-manager") || haystack.includes("项目经理")) return "pm";
-  return "codex";
-}
-
-function buildTaskRunBridgePrompt(args: {
-  agentKey: string;
-  agentConfig: any;
-  runtimeContext: any;
-}) {
-  const taskRun = args.runtimeContext?.taskRun;
-  const rowDbKey = typeof taskRun?.rowDbKey === "string" ? taskRun.rowDbKey.trim() : "";
-  if (!rowDbKey) return "";
-  const workItemId = typeof taskRun?.workItemId === "string" ? taskRun.workItemId.trim() : "";
-  const role = inferTaskRunRole(args.agentKey, args.agentConfig);
-  return [
-    "--- Nolo task-run tool bridge ---",
-    "This CLI runtime does not receive server-side function tools directly.",
-    "Use the local task-run bridge command for durable task state writes. Do not edit meta.taskRun with table or database commands.",
-    "Run commands from the repository root. The runner already provides server URL and auth in the environment.",
-    "Release boundary: after review passes, AI/reviewer/Codex may advance alpha for verification. Do not merge, push, or release main/release unless the human owner explicitly authorizes it in the current task context.",
-    "Cost boundary: read taskRun.control from context. Prefer low-cost/free-window models for routine work, and reserve Codex for supervision, quality gates, complex unblocking, and main/release decisions.",
-    `Read context: bun packages/cli/index.ts task-run read-context --row-dbkey ${JSON.stringify(rowDbKey)}`,
-    ...(workItemId
-      ? [
-          `Claim work item: bun packages/cli/index.ts task-run claim-work-item --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --agent-key ${JSON.stringify(args.agentKey)} --role ${role}`,
-          `Set blocker: bun packages/cli/index.ts task-run set-blocker --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --layer tool --code <CODE> --message <MESSAGE>`,
-          `Clear resolved blocker: bun packages/cli/index.ts task-run clear-blocker --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --blocker-id <BLOCKER_ID>`,
-          `Submit outcome: bun packages/cli/index.ts task-run submit-outcome --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --summary <SUMMARY>`,
-          `Request review: bun packages/cli/index.ts task-run request-review --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --reviewer-agent-key <AGENT_KEY> --message <MESSAGE>`,
-          `Record review: bun packages/cli/index.ts task-run record-review --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --review-status <passed|needs_changes|blocked> --reviewer-agent-key ${JSON.stringify(args.agentKey)} --findings <FINDINGS>`,
-          `Close work item: bun packages/cli/index.ts task-run close-work-item --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --summary <SUMMARY>`,
-        ]
-      : []),
-    "If a bridge command fails, report the exact command and error.",
-  ].join("\n");
-}
-
-function buildConnectorCliPrompt(agentConfig: any, userInput: string, bridgeArgs?: {
-  agentKey: string;
-  runtimeContext: any;
-}, permissionPolicy?: ReturnType<typeof resolveMachineRunPermissionPolicy>) {
-  const policy = permissionPolicy ?? resolveMachineRunPermissionPolicy(agentConfig);
-  return [
-    typeof agentConfig?.prompt === "string" ? agentConfig.prompt.trim() : "",
-    bridgeArgs ? buildTaskRunBridgePrompt({
-      agentKey: bridgeArgs.agentKey,
-      agentConfig,
-      runtimeContext: bridgeArgs.runtimeContext,
-    }) : "",
-    buildMachinePermissionPromptBlock(policy),
-    `--- User task ---\n${userInput}`,
-  ].filter(Boolean).join("\n\n");
-}
-
-function isRecord(value: unknown): value is Record<string, any> {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
 
-function runtimePolicyFromConnectorPayload(parsed: any): ConnectorRuntimePolicy | undefined {
-  const fromMeta = parsed?.payload?.meta?.runtimeToolPolicySnapshot;
-  const fromAgent = parsed?.payload?.agentConfig?.runtimeToolPolicy;
-  const policy = isRecord(fromMeta) ? fromMeta : isRecord(fromAgent) ? fromAgent : null;
-  return policy ? policy as ConnectorRuntimePolicy : undefined;
-}
-
-function requestsTaskWorktree(policy?: ConnectorRuntimePolicy) {
-  return policy?.workspace?.mode === "task-worktree" || policy?.workspace?.mode === "lease";
-}
-
-function hasExplicitMachinePermissions(agentConfig: any) {
-  const runtimeBinding = isRecord(agentConfig?.runtimeBinding) ? agentConfig.runtimeBinding : {};
-  return Boolean(
-    isRecord(agentConfig?.machinePermissions) ||
-      isRecord(runtimeBinding.permissions) ||
-      isRecord(runtimeBinding.machinePermissions) ||
-      isRecord(agentConfig?.boundRuntimeMachine?.permissions)
-  );
-}
-
-function runtimeWorkspacePermissionPolicy(
-  runtimePolicy: ConnectorRuntimePolicy | undefined,
-  cwd: string
-): ReturnType<typeof resolveMachineRunPermissionPolicy> | null {
-  if (!requestsTaskWorktree(runtimePolicy)) return null;
-  return {
-    mode: "full_access",
-    allowFilesystemRead: true,
-    allowFilesystemWrite: true,
-    allowShell: runtimePolicy?.shell?.enabled !== false,
-    writableRoots: [cwd],
-  };
-}
-
-function scopePermissionPolicyToRuntimeWorkspace(
-  policy: ReturnType<typeof resolveMachineRunPermissionPolicy>,
-  runtimePolicy: ConnectorRuntimePolicy | undefined,
-  cwd: string
-): ReturnType<typeof resolveMachineRunPermissionPolicy> {
-  if (!requestsTaskWorktree(runtimePolicy)) return policy;
-  return {
-    ...policy,
-    writableRoots: policy.allowFilesystemWrite ? [cwd] : [],
-  };
-}
-
-function mergeToolNames(...values: unknown[]) {
-  const names: string[] = [];
-  for (const value of values) {
-    if (!Array.isArray(value)) continue;
-    for (const item of value) {
-      const name = typeof item === "string"
-        ? item
-        : isRecord(item) && typeof item.name === "string"
-          ? item.name
-          : isRecord(item) && typeof item.function?.name === "string"
-            ? item.function.name
-            : "";
-      if (name && !names.includes(name)) names.push(name);
-    }
-  }
-  return names;
-}
-
-function localRuntimeEnvFromPolicy(runtimeEnv: EnvLike, policy?: ConnectorRuntimePolicy): EnvLike {
-  return {
-    ...runtimeEnv,
-    ...(policy?.shell?.enabled && policy.shell.mode === "worktree"
-      ? { NOLO_LOCAL_SHELL_MODE: "worktree" }
-      : {}),
-    ...(policy?.workspace?.cwd ? { NOLO_LOCAL_WORKTREE: policy.workspace.cwd } : {}),
-  };
-}
-
-function runtimeWorkspaceRootFromTrace(trace: unknown): string | undefined {
-  if (!Array.isArray(trace)) return undefined;
-  for (const message of trace) {
-    if (!isRecord(message)) continue;
-    const metadata = isRecord(message.tool_result_metadata)
-      ? message.tool_result_metadata
-      : null;
-    const workspaceRoot = metadata && typeof metadata.workspaceRoot === "string"
-      ? metadata.workspaceRoot.trim()
-      : "";
-    if (workspaceRoot) return workspaceRoot;
-  }
-  return undefined;
+function detectLaunchableMachineInfo() {
+  return detectMachineInfo({ probeLaunchable: true });
 }
 
-function buildArtifactProgress(args: {
-  artifacts: unknown;
-  runtimePolicy?: ConnectorRuntimePolicy;
-  workspaceRoot: string;
-  workspaceKind?: string;
-}): ConnectorRunProgress | null {
-  if (!isRecord(args.artifacts)) return null;
-  const changedFiles = Array.isArray(args.artifacts.changedFiles)
-    ? args.artifacts.changedFiles
-    : [];
-  const statusShort = typeof args.artifacts.statusShort === "string"
-    ? args.artifacts.statusShort.trim()
-    : "";
-  if (changedFiles.length === 0 && !statusShort) return null;
-  const runtimeTools = Array.isArray(args.runtimePolicy?.runtimeTools)
-    ? args.runtimePolicy.runtimeTools
-    : [];
-  const shellTool = runtimeTools.includes("execBash")
-    ? "execBash"
-    : runtimeTools.includes("execShell")
-      ? "execShell"
-      : "workspaceArtifact";
-  return {
-    eventType: "tool-result",
-    toolCallCount: 1,
-    toolResultCount: 1,
-    lastToolNames: [shellTool],
-    workspaceRoot: args.workspaceRoot,
-    ...(args.workspaceKind ? { workspaceKind: args.workspaceKind } : {}),
-    message: statusShort || `${changedFiles.length} changed file(s)`,
-    updatedAt: Date.now(),
-  };
-}
-
-async function runConnectorLocalRuntimeAgent(args: {
-  parsed: any;
-  runtimeEnv: EnvLike;
-  cwd: string;
-  fetchImpl?: typeof fetch;
-  onProgress?: (progress: ConnectorRunProgress) => void;
-}): Promise<Awaited<ReturnType<typeof runLocalAgentTurn>> & { runtimeWorkspaceRoot?: string }> {
-  const agentKey = String(args.parsed.payload?.agentKey ?? "");
-  const payloadAgentConfig = isRecord(args.parsed.payload?.agentConfig)
-    ? args.parsed.payload.agentConfig
-    : {};
-  const policy = runtimePolicyFromConnectorPayload(args.parsed);
-  const agentRecord = {
-    ...payloadAgentConfig,
-    dbKey: agentKey,
-    id: agentKey,
-    key: agentKey,
-    apiSource: payloadAgentConfig.apiSource ?? "platform",
-    provider: payloadAgentConfig.provider ?? payloadAgentConfig.apiSource ?? "openai",
-    toolNames: mergeToolNames(
-      payloadAgentConfig.toolNames,
-      payloadAgentConfig.tools,
-      policy?.agentTools,
-      policy?.runtimeTools,
-    ),
-    ...(policy ? { runtimeToolPolicy: policy } : {}),
-    ...(policy?.workspace?.mode === "task-worktree" || policy?.workspace?.mode === "lease"
-      ? { localWorkspaceMode: "task-worktree" }
-      : {}),
-  };
-  const store = new Map<string, any>([
-    [agentKey, agentRecord],
-    [`agent-${args.runtimeEnv.NOLO_USER_ID || "local"}-${agentKey}`, agentRecord],
-    [`agent-${args.runtimeEnv.NOLO_LOCAL_USER_ID || args.runtimeEnv.NOLO_USER_ID || "local"}-${agentKey}`, agentRecord],
-  ]);
-  const env = localRuntimeEnvFromPolicy(args.runtimeEnv, policy);
-  const wantsTaskWorktree = requestsTaskWorktree(policy);
-  const adapter = createCliLocalRuntimeAdapter({
-    env,
-    cwd: args.cwd,
-    useCwdAsTaskWorkspaceBase: wantsTaskWorktree,
-    ...(wantsTaskWorktree
-      ? {
-          prepareTaskWorktree: (input) => prepareTaskWorktree({
-            ...input,
-            cwd: args.cwd,
-          }),
-        }
-      : {}),
-    fetchImpl: args.fetchImpl ?? fetch,
-    store: {
-      read: async (key) => store.get(key) ?? null,
-      batch: async (ops) => {
-        for (const op of ops) {
-          if (op.type === "put") store.set(op.key, op.value);
-        }
-      },
-      iterator: async function* (options) {
-        const keys = [...store.keys()].sort();
-        for (const key of keys) {
-          if (key < options.gte) continue;
-          if (options.lte && key > options.lte) continue;
-          if (options.lt && key >= options.lt) continue;
-          yield [key, store.get(key)];
-        }
-      },
-    },
-  });
-  let toolCallCount = 0;
-  let toolResultCount = 0;
-  const lastToolNames: string[] = [];
-  let runtimeWorkspaceRoot: string | undefined;
-  let runtimeWorkspaceKind: string | undefined;
-  const noteToolName = (toolName: string) => {
-    if (!toolName) return;
-    const existingIndex = lastToolNames.indexOf(toolName);
-    if (existingIndex >= 0) lastToolNames.splice(existingIndex, 1);
-    lastToolNames.push(toolName);
-    while (lastToolNames.length > 8) lastToolNames.shift();
-  };
-  const result = await runLocalAgentTurn({
-    adapter,
-    agentRef: agentKey,
-    input: String(args.parsed.payload?.userInput ?? ""),
-    continueDialogId: typeof args.parsed.payload?.continueDialogId === "string"
-      ? args.parsed.payload.continueDialogId
-      : undefined,
-    onToolEvent: (event) => {
-      if (event.type === "tool-call") toolCallCount += 1;
-      if (event.type === "tool-result") toolResultCount += 1;
-      noteToolName(event.toolName);
-      const metadata = isRecord(event.metadata) ? event.metadata : {};
-      if (typeof metadata.workspaceRoot === "string" && metadata.workspaceRoot.trim()) {
-        runtimeWorkspaceRoot = metadata.workspaceRoot.trim();
-      }
-      if (typeof metadata.workspaceKind === "string" && metadata.workspaceKind.trim()) {
-        runtimeWorkspaceKind = metadata.workspaceKind.trim();
-      }
-      args.onProgress?.({
-        eventType: event.type,
-        toolCallCount,
-        toolResultCount,
-        lastToolNames: [...lastToolNames],
-        ...(runtimeWorkspaceRoot ? { workspaceRoot: runtimeWorkspaceRoot } : {}),
-        ...(runtimeWorkspaceKind ? { workspaceKind: runtimeWorkspaceKind } : {}),
-        ...(event.message ? { message: event.message } : {}),
-        updatedAt: Date.now(),
-      });
-    },
-  });
-  return {
-    ...result,
-    runtimeWorkspaceRoot: runtimeWorkspaceRootFromTrace(result.trace) ?? runtimeWorkspaceRoot,
-  };
-}
-
-function normalizeConnectorRunTimeoutMs(value: unknown): number | undefined {
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
-    return undefined;
-  }
-  return Math.floor(value);
-}
-
-export async function handleConnectorRunMessage(
-  machine: MachineHeartbeat,
-  message: string,
-  send: (message: string) => void,
-  executeCli: LocalCliExecutor,
-  runtimeEnv: EnvLike,
-  fetchImpl?: typeof fetch
-) {
-  let parsed: any;
-  try {
-    parsed = JSON.parse(message);
-  } catch {
-    return;
-  }
-  if (parsed?.type !== "agent.run" || typeof parsed.requestId !== "string") return;
-  const agentConfig = parsed.payload?.agentConfig ?? {};
-  const sendProgress = (progress: ConnectorRunProgress) => {
-    send(JSON.stringify({
-      type: "agent.run.progress",
-      requestId: parsed.requestId,
-      progress,
-    }));
-  };
-  try {
-    const machinePermissionPolicy = resolveMachineRunPermissionPolicy(agentConfig);
-    const runtimePolicy = runtimePolicyFromConnectorPayload(parsed);
-    const userInput = String(parsed.payload?.userInput ?? "");
-    const timeout = normalizeConnectorRunTimeoutMs(parsed.payload?.timeoutMs);
-    let cwd = resolveConnectorRunCwd({ env: runtimeEnv, policy: machinePermissionPolicy });
-    let runContent = "";
-    let runModel = agentConfig.model;
-    let runTrace: unknown[] = [];
-    let artifactCwd = cwd;
-    let baseSha: string | null = null;
-    if (agentConfig.apiSource === "cli") {
-      if (requestsTaskWorktree(runtimePolicy)) {
-        const prepared = await prepareTaskWorktree({
-          agentKey: String(parsed.payload?.agentKey ?? "agent"),
-          cwd,
-          env: runtimeEnv,
-        });
-        cwd = prepared.path;
-        artifactCwd = prepared.path;
-      }
-      const runtimePermissionPolicy = !hasExplicitMachinePermissions(agentConfig)
-        ? runtimeWorkspacePermissionPolicy(runtimePolicy, cwd)
-        : null;
-      const effectivePermissionPolicy = scopePermissionPolicyToRuntimeWorkspace(
-        runtimePermissionPolicy ?? machinePermissionPolicy,
-        runtimePolicy,
-        cwd,
-      );
-      assertMachineRunAllowed(userInput, effectivePermissionPolicy);
-      baseSha = await readConnectorGitHead(artifactCwd);
-      const provider = String(agentConfig.cliProvider || "copilot");
-      const result = await executeCli(
-        provider,
-        buildConnectorCliPrompt(agentConfig, userInput, {
-          agentKey: String(parsed.payload?.agentKey ?? ""),
-          runtimeContext: parsed.payload?.runtimeContext,
-        }, effectivePermissionPolicy),
-        {
-          model: agentConfig.model || undefined,
-          timeout,
-          cwd,
-          yolo: true,
-          env: {
-            NOLO_SERVER: runtimeEnv.NOLO_SERVER || runtimeEnv.NOLO_SERVER_URL || runtimeEnv.BASE_URL,
-            NOLO_SERVER_URL: runtimeEnv.NOLO_SERVER_URL || runtimeEnv.NOLO_SERVER || runtimeEnv.BASE_URL,
-            BASE_URL: runtimeEnv.BASE_URL || runtimeEnv.NOLO_SERVER || runtimeEnv.NOLO_SERVER_URL,
-            AUTH_TOKEN: runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH || runtimeEnv.NOLO_MACHINE_API_KEY,
-            NOLO_MACHINE_API_KEY: runtimeEnv.NOLO_MACHINE_API_KEY || runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH,
-          },
-        }
-      );
-      runContent = result.text;
-      runModel = agentConfig.model ?? provider;
-      runTrace = [{ role: "assistant", content: result.text }];
-      const artifacts = await collectConnectorRunArtifact({
-        cwd: artifactCwd,
-        baseSha,
-        exitStatus: "completed",
-      });
-      const artifactProgress = buildArtifactProgress({
-        artifacts,
-        runtimePolicy,
-        workspaceRoot: artifactCwd,
-        workspaceKind: requestsTaskWorktree(runtimePolicy) ? "task-worktree" : "current",
-      });
-      if (artifactProgress && requestsTaskWorktree(runtimePolicy)) sendProgress(artifactProgress);
-      send(JSON.stringify({
-        type: "agent.run.result",
-        requestId: parsed.requestId,
-        result: {
-          content: runContent,
-          model: runModel,
-          trace: runTrace,
-          artifacts,
-        },
-      }));
-      return;
-    } else {
-      if (!runtimePolicy) {
-        throw new Error("Connector can only execute non-CLI agents when runtimeToolPolicySnapshot requests a local workspace runtime.");
-      }
-      baseSha = await readConnectorGitHead(cwd);
-      const result = await runConnectorLocalRuntimeAgent({
-        parsed,
-        runtimeEnv,
-        cwd,
-        fetchImpl,
-        onProgress: sendProgress,
-      });
-      runContent = result.content;
-      runModel = result.model;
-      runTrace = result.trace ?? [];
-      artifactCwd = result.runtimeWorkspaceRoot ?? cwd;
-    }
-    const artifacts = await collectConnectorRunArtifact({
-      cwd: artifactCwd,
-      baseSha,
-      exitStatus: "completed",
-    });
-    const artifactProgress = buildArtifactProgress({
-      artifacts,
-      runtimePolicy,
-      workspaceRoot: artifactCwd,
-      workspaceKind: requestsTaskWorktree(runtimePolicy) ? "task-worktree" : "current",
-    });
-    if (artifactProgress && requestsTaskWorktree(runtimePolicy)) sendProgress(artifactProgress);
-    send(JSON.stringify({
-      type: "agent.run.result",
-      requestId: parsed.requestId,
-      result: {
-        content: runContent,
-        model: runModel,
-        trace: runTrace,
-        artifacts,
-      },
-    }));
-  } catch (error) {
-    send(JSON.stringify({
-      type: "agent.run.result",
-      requestId: parsed.requestId,
-      error: error instanceof Error ? error.message : String(error),
-    }));
-  }
-}
-
-async function runConnectorWebSocketSession(options: {
-  env: EnvLike;
-  output: OutputLike;
-  machine: MachineHeartbeat;
-  sendHeartbeat: () => Promise<void>;
-  runHeartbeatLoop: (options: HeartbeatLoopOptions) => Promise<void>;
-  connectWebSocket: (url: string, options: ConnectorWebSocketOptions) => Promise<void>;
-  executeCli: LocalCliExecutor;
-  fetchImpl: typeof fetch;
-  serverUrl: string;
-  authToken: string;
-}) {
-  const sentMessages: string[] = [];
-  const heartbeatAbort = new AbortController();
-  try {
-    await options.sendHeartbeat();
-    options.output.write(
-      `Connector websocket connected: ${options.machine.name} (${options.machine.machineId})\n`
-    );
-    const heartbeatLoopPromise = options.runHeartbeatLoop({
-      intervalMs: resolveHeartbeatIntervalMs(options.env),
-      sendHeartbeat: options.sendHeartbeat,
-      signal: heartbeatAbort.signal,
-    });
-    const wsTarget = await resolveConnectorWebSocketTarget({
-      serverUrl: options.serverUrl,
-      machineId: options.machine.machineId,
-      headers: { Authorization: `Bearer ${options.authToken}` },
-      fetchImpl: options.fetchImpl,
-    });
-    const runtimeServerUrl =
-      options.env.NOLO_CONNECT_RUNTIME_SERVER_URL ||
-      options.env.NOLO_RUNTIME_SERVER_URL ||
-      options.serverUrl;
-    const websocketPromise = options.connectWebSocket(
-      wsTarget,
-      {
-        headers: { Authorization: `Bearer ${options.authToken}` },
-        sentMessages,
-        onMessage: (message) => handleConnectorRunMessage(
-          options.machine,
-          message,
-          (response) => sentMessages.push(response),
-          options.executeCli,
-          {
-            ...options.env,
-            NOLO_SERVER: runtimeServerUrl,
-            NOLO_SERVER_URL: runtimeServerUrl,
-            BASE_URL: runtimeServerUrl,
-            AUTH_TOKEN: options.authToken,
-            NOLO_MACHINE_API_KEY: options.authToken,
-          },
-          options.fetchImpl
-        ),
-      }
-    );
-    await Promise.race([websocketPromise, heartbeatLoopPromise]);
-    heartbeatAbort.abort();
-    await Promise.allSettled([websocketPromise, heartbeatLoopPromise]);
-    return 0;
-  } catch (error) {
-    heartbeatAbort.abort();
-    options.output.write(
-      `[nolo] Connector websocket failed: ${
-        error instanceof Error ? error.message : String(error)
-      }\n`
-    );
-    return 1;
-  }
-}
-
-export function formatMachineStatus(machines: MachineSummary[]) {
-  if (machines.length === 0) {
-    return "No connected machines.\nRun `nolo connect` on this computer to register it once.\n";
-  }
-
-  return [
-    "Connected machines:",
-    ...machines.map((machine) => {
-      const caps = machine.capabilities.length ? machine.capabilities.join(", ") : "no capabilities";
-      const connector = machine.connectorStatus ? `  ws:${machine.connectorStatus}` : "";
-      return `- ${machine.name}  ${machine.status}${connector}  ${machine.platform}/${machine.arch}  ${caps}`;
-    }),
-    "",
-  ].join("\n");
-}
-
-export async function runMachineConnectCommand(
+export async function runMachineConnectCommand(
   args: string[],
   deps: MachineCommandDeps = {}
 ) {
@@ -804,10 +86,10 @@ export async function runMachineConnectCommand(
     return 1;
   }
 
-  const serverUrl = resolveConnectServerUrl(args, env);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
-  const sendHeartbeat = async () => {
+  const serverUrl = resolveConnectServerUrl(args, env);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
+  const sendHeartbeat = async () => {
     const res = await fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
     method: "POST",
     headers: {
@@ -822,35 +104,62 @@ export async function runMachineConnectCommand(
       throw new Error(`HTTP ${res.status}\n${text}`);
     }
   };
-
+
   if (hasFlag(args, "--daemon") || hasFlag(args, "--background")) {
-    const logPath = resolveDaemonLogPath(env);
-    const result = (deps.spawnDaemon ?? defaultSpawnDaemon)({
-      cmd: buildDaemonCommand(deps.cliEntrypointPath),
-      cwd: process.cwd(),
+    return runMachineDaemonCommand({
       env,
-      logPath,
-    });
-    output.write(`Connector daemon started${result.pid ? ` pid=${result.pid}` : ""}. Log: ${logPath}\n`);
-    return 0;
-  }
-
+      output,
+      cliEntrypointPath: deps.cliEntrypointPath,
+      validateWorkspaceLinks: deps.validateWorkspaceLinks,
+      spawnDaemon: deps.spawnDaemon,
+    });
+  }
+
   if (hasFlag(args, "--ws")) {
+    const validateWorkspaceLinks = deps.validateWorkspaceLinks ?? (() => []);
+    if (!(await checkConnectorWorkspaceLinks(process.cwd(), output, validateWorkspaceLinks))) {
+      return 1;
+    }
     const maxAttempts = deps.maxConnectorAttempts ?? Infinity;
     const sleep = deps.sleep ?? defaultSleep;
     const reconnectDelayMs = resolveConnectorReconnectDelayMs(env);
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-      const exitCode = await runConnectorWebSocketSession({
+      const runtimeServerUrl =
+        env.NOLO_CONNECT_RUNTIME_SERVER_URL ||
+        env.NOLO_RUNTIME_SERVER_URL ||
+        serverUrl;
+      const exitCode = await runMachineWsSession({
         env,
         output,
         machine,
         sendHeartbeat,
         runHeartbeatLoop: deps.runHeartbeatLoop ?? defaultRunHeartbeatLoop,
         connectWebSocket: deps.connectWebSocket ?? defaultConnectWebSocket,
-        executeCli: deps.executeCli ?? defaultExecuteCli,
-        fetchImpl,
         serverUrl,
         authToken,
+        resolveConnectorWebSocketTarget: (options) =>
+          resolveConnectorWebSocketTarget({
+            ...options,
+            fetchImpl,
+          }),
+        onMessage: (message, send) =>
+          handleConnectorRunMessage(
+            message,
+            send,
+            deps.executeCli ?? defaultExecuteCli,
+            {
+              ...env,
+              NOLO_SERVER: runtimeServerUrl,
+              NOLO_SERVER_URL: runtimeServerUrl,
+              BASE_URL: runtimeServerUrl,
+              AUTH_TOKEN: authToken,
+              NOLO_MACHINE_API_KEY: authToken,
+            },
+            fetchImpl,
+            {
+              buildConnectorCliPrompt,
+            }
+          ),
       });
       if (attempt >= maxAttempts) return exitCode;
       output.write(`[nolo] Connector websocket disconnected. Reconnecting in ${reconnectDelayMs}ms.\n`);
@@ -859,78 +168,20 @@ export async function runMachineConnectCommand(
     return 0;
   }
 
-  if (hasFlag(args, "--watch")) {
-    output.write(`Connecting machine heartbeat loop: ${machine.name} (${machine.platform}/${machine.arch})\n`);
-    try {
-      await (deps.runHeartbeatLoop ?? defaultRunHeartbeatLoop)({
-        intervalMs: resolveHeartbeatIntervalMs(env),
-        sendHeartbeat,
-      });
-      return 0;
-    } catch (error) {
-      output.write(
-        `[nolo] Machine heartbeat loop failed: ${
-          error instanceof Error ? error.message : String(error)
-        }\n`
-      );
-      return 1;
-    }
-  }
-
-  try {
-    await sendHeartbeat();
-  } catch (error) {
-    output.write(
-      `[nolo] Machine connect failed: ${
-        error instanceof Error ? error.message : String(error)
-      }\n`
-    );
-    return 1;
-  }
-
-  output.write(`Connected machine: ${machine.name} (${machine.platform}/${machine.arch})\n`);
-  return 0;
-}
-
-export async function runMachineStatusCommand(
-  _args: string[],
-  deps: MachineCommandDeps = {}
-) {
-  const env = deps.env ?? process.env;
-  const output = deps.output ?? process.stdout;
-  const authToken = resolveAuthToken(env);
-  if (!authToken) {
-    writeAuthMissing(output);
-    return 1;
-  }
-
-  const serverUrl = resolveServerUrl(env);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  let res: Response;
-  try {
-    res = await fetchImpl(`${serverUrl}/api/machines`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${authToken}`,
-      },
-    });
-  } catch (error) {
-    output.write(
-      `[nolo] Machine status failed: ${
-        error instanceof Error ? error.message : String(error)
-      }\n`
-    );
-    return 1;
-  }
+  if (hasFlag(args, "--watch")) {
+    return runMachineWatchCommand({
+      env,
+      output,
+      machine,
+      sendHeartbeat,
+      runHeartbeatLoop: deps.runHeartbeatLoop ?? defaultRunHeartbeatLoop,
+    });
+  }
 
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    output.write(`[nolo] Machine status failed: HTTP ${res.status}\n${text}\n`);
-    return 1;
-  }
+  return runMachineHeartbeatConnectCommand({
+    output,
+    machine,
+    sendHeartbeat,
+  });
+}
 
-  const data = await res.json().catch(() => ({ machines: [] }));
-  const machines = Array.isArray(data?.machines) ? data.machines : [];
-  output.write(formatMachineStatus(machines));
-  return 0;
-}