nolo-cli 0.1.23 → 0.1.29

package/agentListHelpers.ts

@@ -0,0 +1,187 @@
+import type { CliKvDb } from "./client/hybridRecordStore";
+
+export type ListedAgent = {
+  id: string;
+  privateKey: string;
+  publicKey: string;
+  name: string;
+  model: string;
+  updatedAt: string | number | null;
+  isPublicFlag: boolean;
+  publicRecordExists: boolean;
+  type: string | null;
+  tools: string[];
+};
+
+function parseAgentRecordId(privateKey: string, explicitId?: string) {
+  if (explicitId) return explicitId;
+  const agentMatch = privateKey.match(/^agent-[^-]+-(.+)$/i);
+  if (agentMatch?.[1]) return agentMatch[1];
+  const cybotMatch = privateKey.match(/^cybot-[^-]+-([0-9A-HJKMNP-TV-Z]{26})$/i);
+  return cybotMatch?.[1] ?? "";
+}
+
+function buildCompanionKeys(privateKey: string, rawId: string, userId: string) {
+  if (privateKey.startsWith("cybot-")) {
+    return {
+      privateKey: `cybot-${userId}-${rawId}`,
+      publicKey: `cybot-pub-${rawId}`,
+    };
+  }
+  return {
+    privateKey: `agent-${userId}-${rawId}`,
+    publicKey: `agent-pub-${rawId}`,
+  };
+}
+
+export function normalizeListedAgent(record: any): ListedAgent | null {
+  const privateKey = typeof record?.dbKey === "string" ? record.dbKey : "";
+  const explicitId = typeof record?.id === "string" && record.id ? record.id : undefined;
+  const ownerUserId = typeof record?.userId === "string" ? record.userId : "";
+  const rawId = explicitId
+    || (ownerUserId && privateKey.startsWith(`agent-${ownerUserId}-`)
+      ? privateKey.slice(`agent-${ownerUserId}-`.length)
+      : ownerUserId && privateKey.startsWith(`cybot-${ownerUserId}-`)
+        ? privateKey.slice(`cybot-${ownerUserId}-`.length)
+        : parseAgentRecordId(privateKey, explicitId));
+  if (!privateKey || !rawId || !ownerUserId) return null;
+  const keys = buildCompanionKeys(privateKey, rawId, ownerUserId);
+  return {
+    id: rawId,
+    privateKey,
+    publicKey: keys.publicKey,
+    name: typeof record?.name === "string" && record.name ? record.name : "(unnamed)",
+    model: typeof record?.model === "string" && record.model ? record.model : "-",
+    updatedAt:
+      typeof record?.updatedAt === "string" || typeof record?.updatedAt === "number"
+        ? record.updatedAt
+        : typeof record?.createdAt === "string" || typeof record?.createdAt === "number"
+          ? record.createdAt
+          : typeof record?.created === "string" || typeof record?.created === "number"
+            ? record.created
+            : null,
+    isPublicFlag: !!record?.isPublic,
+    publicRecordExists: false,
+    type: typeof record?.type === "string" ? record.type : null,
+    tools: Array.isArray(record?.tools)
+      ? record.tools.filter((tool: unknown): tool is string => typeof tool === "string")
+      : [],
+  };
+}
+
+export function sortListedAgents(agents: ListedAgent[]) {
+  agents.sort((a, b) => {
+    const ta = a.updatedAt == null ? 0 : new Date(a.updatedAt).getTime();
+    const tb = b.updatedAt == null ? 0 : new Date(b.updatedAt).getTime();
+    return tb - ta;
+  });
+  return agents;
+}
+
+export function parseAgentListArgs(args: string[]) {
+  return {
+    wantJson: args.includes("--json"),
+    publicOnly: args.includes("--public-only"),
+    idsOnly: args.includes("--ids-only"),
+    includeLegacy: args.includes("--include-legacy"),
+  };
+}
+
+export async function listLocalCachedAgents(args: {
+  db: CliKvDb;
+  userId: string;
+}) {
+  const privateRecords = new Map<string, any>();
+  const publicKeys = new Set<string>();
+  for await (const [key, value] of args.db.iterator()) {
+    if (typeof key !== "string" || !value || typeof value !== "object") continue;
+    if (key.startsWith(`agent-${args.userId}-`) || key.startsWith(`cybot-${args.userId}-`)) {
+      privateRecords.set(key, { ...(value as Record<string, unknown>), dbKey: key });
+      continue;
+    }
+    if (key.startsWith("agent-pub-") || key.startsWith("cybot-pub-")) {
+      publicKeys.add(key);
+    }
+  }
+
+  const agents = sortListedAgents(
+    [...privateRecords.values()]
+      .map((record) => normalizeListedAgent(record))
+      .filter((agent): agent is ListedAgent => agent != null)
+  );
+
+  for (const agent of agents) {
+    agent.publicRecordExists = publicKeys.has(agent.publicKey);
+  }
+  return agents;
+}
+
+async function hasReadableRecord(args: {
+  authToken: string;
+  dbKey: string;
+  fallbackFetchImpl?: typeof fetch;
+  fetchImpl: typeof fetch;
+  serverUrl: string;
+  readDbRecord: (args: {
+    authToken: string;
+    dbKey: string;
+    fallbackFetchImpl?: typeof fetch;
+    fetchImpl: typeof fetch;
+    serverUrl: string;
+  }) => Promise<any>;
+}) {
+  try {
+    await args.readDbRecord(args);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function listRemoteAgents(args: {
+  authToken: string;
+  fallbackFetchImpl?: typeof fetch;
+  fetchImpl: typeof fetch;
+  includeLegacy: boolean;
+  serverUrl: string;
+  userId: string;
+  queryUserRecords: (args: {
+    authToken: string;
+    fallbackFetchImpl?: typeof fetch;
+    fetchImpl: typeof fetch;
+    serverUrl: string;
+    userId: string;
+    type: "agent" | "cybot";
+  }) => Promise<any[]>;
+  readDbRecord: (args: {
+    authToken: string;
+    dbKey: string;
+    fallbackFetchImpl?: typeof fetch;
+    fetchImpl: typeof fetch;
+    serverUrl: string;
+  }) => Promise<any>;
+}) {
+  const recordGroups = [await args.queryUserRecords({ ...args, type: "agent" as const })];
+  if (args.includeLegacy) {
+    recordGroups.push(await args.queryUserRecords({ ...args, type: "cybot" as const }));
+  }
+  const agents = sortListedAgents(
+    recordGroups
+      .flat()
+      .map((record) => normalizeListedAgent(record))
+      .filter((agent): agent is ListedAgent => agent != null)
+  );
+  await Promise.all(
+    agents.map(async (agent) => {
+      agent.publicRecordExists = await hasReadableRecord({
+        authToken: args.authToken,
+        dbKey: agent.publicKey,
+        fallbackFetchImpl: args.fallbackFetchImpl,
+        fetchImpl: args.fetchImpl,
+        serverUrl: args.serverUrl,
+        readDbRecord: args.readDbRecord,
+      });
+    })
+  );
+  return agents;
+}

package/agentMachineCommands.ts

@@ -0,0 +1,476 @@
+import type { MachineHeartbeat } from "./connector-experimental/protocol";
+import { resolveConnectorWebSocketTarget } from "./connectorWebSocketTarget";
+import { resolveCliAgentKeyInput } from "./agentAliases";
+import {
+  type AgentCommandDeps,
+  type LocalCliExecutor,
+  type SmokeWebSocketOptions,
+} from "./agentCommandSupport";
+import {
+  readAgentRecord,
+  writeAgentRecord,
+} from "./agentRecordHelpers";
+import {
+  parseUserIdFromAuthToken,
+  readOption,
+  resolveAuthToken,
+  resolveServerUrl,
+  type EnvLike,
+} from "./cliEnvHelpers";
+
+async function defaultExecuteCli(
+  provider: string,
+  prompt: string,
+  options: { model?: string; timeout?: number; cwd?: string; yolo?: boolean }
+) {
+  const { executeCli } = await import("./ai/agent/cliExecutor");
+  return executeCli(provider as any, prompt, options);
+}
+
+async function forwardConnectorRunMessage(
+  machine: MachineHeartbeat,
+  message: string,
+  pushMessage: (response: string) => void,
+  executeCli: LocalCliExecutor,
+  env: EnvLike,
+  fetchImpl: typeof fetch
+) {
+  const { handleConnectorRunMessage } = await import("./machineCommands");
+  return handleConnectorRunMessage(machine, message, pushMessage, executeCli, env, fetchImpl);
+}
+
+async function detectLaunchableMachineInfo() {
+  const { detectMachineInfo } = await import("./connector-experimental/machineInfo");
+  return detectMachineInfo({ probeLaunchable: true });
+}
+
+function requiredCapabilityForAgent(agent: any) {
+  if (agent?.apiSource !== "cli") return "";
+  const cliProvider = String(agent?.cliProvider || "").trim();
+  const capabilityByProvider: Record<string, string> = {
+    codex: "codex-cli",
+    claude: "claude-code",
+    copilot: "copilot-cli",
+    gemini: "gemini-cli",
+    kimi: "kimi-cli",
+    agy: "agy-cli",
+  };
+  return capabilityByProvider[cliProvider] ?? "";
+}
+
+function classifyAgentRuntime(agent: any) {
+  if (agent?.apiSource === "cli") return "cli-machine";
+  if (agent?.apiSource === "platform" || agent?.useServerProxy) return "platform-local-loop";
+  if (agent?.apiSource === "local") return "local-provider-loop";
+  return "unknown";
+}
+
+function shouldRuntimeDoctorPass(args: {
+  runtimeClass: string;
+  requiredCapability: string;
+  hasCapability: boolean;
+  bindingRequired: boolean;
+  isBoundToCurrent: boolean;
+  isBindingOwnerCompatible: boolean;
+}) {
+  if (args.runtimeClass !== "cli-machine") return args.runtimeClass !== "unknown";
+  return Boolean(
+    args.requiredCapability &&
+      args.hasCapability &&
+      (!args.bindingRequired || (args.isBoundToCurrent && args.isBindingOwnerCompatible))
+  );
+}
+
+function assertSmokeCompatible(agent: any, machine: MachineHeartbeat) {
+  if (agent?.apiSource !== "cli") {
+    throw new Error(`Agent ${agent?.name ?? agent?.dbKey ?? "unknown"} is not a CLI agent.`);
+  }
+  const requiredCapability = requiredCapabilityForAgent(agent);
+  if (!requiredCapability) {
+    throw new Error(`Agent ${agent?.name ?? agent?.dbKey ?? "unknown"} has unsupported cliProvider: ${agent?.cliProvider ?? "missing"}.`);
+  }
+  if (!machine.capabilities.includes(requiredCapability)) {
+    const currentCapabilities = machine.capabilities.length
+      ? machine.capabilities.join(", ")
+      : "none";
+    throw new Error(
+      `Agent ${agent?.name ?? agent?.dbKey ?? "unknown"} requires ${requiredCapability}; current machine capabilities: ${currentCapabilities}.`
+    );
+  }
+}
+
+function runtimeBindingFacts(agent: any, machine: MachineHeartbeat, currentUserId?: string) {
+  const runtimeBinding = agent?.runtimeBinding && typeof agent.runtimeBinding === "object"
+    ? agent.runtimeBinding
+    : {};
+  const boundMachineId = typeof runtimeBinding.machineId === "string"
+    ? runtimeBinding.machineId.trim()
+    : "";
+  const boundOwnerUserId = typeof runtimeBinding.ownerUserId === "string"
+    ? runtimeBinding.ownerUserId.trim()
+    : "";
+  const bindingRequired = agent?.apiSource === "cli";
+  return {
+    bindingRequired,
+    boundMachineId,
+    boundOwnerUserId,
+    isBoundToCurrent: Boolean(boundMachineId) && boundMachineId === machine.machineId,
+    isBindingOwnerCompatible: !boundOwnerUserId || !currentUserId || boundOwnerUserId === currentUserId,
+  };
+}
+
+function assertSmokeBindingState(args: {
+  agent: any;
+  machine: MachineHeartbeat;
+  currentUserId: string;
+  allowRebind: boolean;
+}) {
+  const facts = runtimeBindingFacts(args.agent, args.machine, args.currentUserId);
+  if (args.allowRebind || !facts.bindingRequired) return;
+  if (facts.boundMachineId && !facts.isBoundToCurrent) {
+    throw new Error(
+      `Agent ${args.agent?.name ?? args.agent?.dbKey ?? "unknown"} is bound to ${facts.boundMachineId}, not current machine ${args.machine.machineId}. Run \`nolo agent bind-current ${args.agent?.dbKey ?? "AGENT_KEY"}\` first or pass --bind to rebind explicitly.`
+    );
+  }
+  if (facts.boundOwnerUserId && !facts.isBindingOwnerCompatible) {
+    throw new Error(
+      `Agent ${args.agent?.name ?? args.agent?.dbKey ?? "unknown"} is bound for owner ${facts.boundOwnerUserId}, not current user ${args.currentUserId}. Run \`nolo agent bind-current ${args.agent?.dbKey ?? "AGENT_KEY"}\` first or pass --bind to rebind explicitly.`
+    );
+  }
+}
+
+const CONNECTOR_WS_KEEPALIVE_MS = 25_000;
+
+function buildConnectorKeepaliveMessage() {
+  return JSON.stringify({ type: "connector.keepalive", sentAt: Date.now() });
+}
+
+async function defaultConnectWebSocket(url: string, options: SmokeWebSocketOptions) {
+  const WebSocketCtor = globalThis.WebSocket;
+  if (!WebSocketCtor) {
+    throw new Error("WebSocket is not available in this runtime");
+  }
+  await new Promise<void>((resolve, reject) => {
+    const ws = new WebSocketCtor(url, { headers: options.headers } as any);
+    let keepalive: ReturnType<typeof setInterval> | null = null;
+    const clearKeepalive = () => {
+      if (keepalive) {
+        clearInterval(keepalive);
+        keepalive = null;
+      }
+    };
+    ws.addEventListener("open", () => {
+      keepalive = setInterval(() => {
+        try {
+          ws.send(buildConnectorKeepaliveMessage());
+        } catch {
+          clearKeepalive();
+        }
+      }, CONNECTOR_WS_KEEPALIVE_MS);
+      Promise.resolve(options.onOpen())
+        .then(() => ws.close())
+        .catch((error) => {
+          ws.close();
+          reject(error);
+        });
+    }, { once: true });
+    ws.addEventListener("error", () => {
+      clearKeepalive();
+      reject(new Error("connector websocket failed"));
+    });
+    ws.addEventListener("close", () => {
+      clearKeepalive();
+      resolve();
+    }, { once: true });
+    ws.addEventListener("message", (event) => {
+      const startIndex = options.sentMessages.length;
+      Promise.resolve(options.onMessage(String(event.data))).then(() => {
+        for (const message of options.sentMessages.slice(startIndex)) {
+          ws.send(message);
+        }
+      }).catch(reject);
+    });
+  });
+}
+
+async function heartbeatCurrentMachine(args: {
+  authToken: string;
+  fetchImpl: typeof fetch;
+  machine: MachineHeartbeat;
+  serverUrl: string;
+}) {
+  const res = await args.fetchImpl(`${args.serverUrl}/api/machines/heartbeat`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${args.authToken}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(args.machine),
+  });
+  const text = await res.text().catch(() => "");
+  if (!res.ok) {
+    throw new Error(`heartbeat failed: HTTP ${res.status} ${text}`);
+  }
+}
+
+export async function runAgentBindCurrentCommand(
+  args: string[],
+  deps: AgentCommandDeps = {}
+) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const agentKey = args[0]?.trim();
+  if (!agentKey || agentKey === "--help" || agentKey === "-h") {
+    output.write("Usage: nolo agent bind-current <agentKey>\n");
+    return agentKey ? 0 : 1;
+  }
+
+  const authToken = resolveAuthToken(env);
+  if (!authToken) {
+    output.write("[nolo] agent bind-current requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+
+  const userId = parseUserIdFromAuthToken(authToken);
+  if (!userId) {
+    output.write("[nolo] agent bind-current could not read userId from AUTH_TOKEN.\n");
+    return 1;
+  }
+
+  const serverUrl = resolveServerUrl(env);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+  const machine = await (deps.machineInfo ?? detectLaunchableMachineInfo)();
+
+  try {
+    await heartbeatCurrentMachine({ authToken, fetchImpl, machine, serverUrl });
+    const existing = await readAgentRecord({ agentKey, authToken, fallbackFetchImpl, fetchImpl, serverUrl });
+    const updated = {
+      ...existing,
+      runtimeBinding: {
+        ...(existing?.runtimeBinding && typeof existing.runtimeBinding === "object"
+          ? existing.runtimeBinding
+          : {}),
+        machineId: machine.machineId,
+        ownerUserId: userId,
+      },
+      updatedAt: Date.now(),
+    };
+    await writeAgentRecord({
+      agentKey,
+      authToken,
+      fallbackFetchImpl,
+      fetchImpl,
+      serverUrl,
+      userId,
+      record: updated,
+    });
+  } catch (error) {
+    output.write(
+      `[nolo] agent bind-current failed: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`
+    );
+    return 1;
+  }
+
+  output.write(`Bound agent ${agentKey} to this machine: ${machine.name} (${machine.machineId})\n`);
+  return 0;
+}
+
+export async function runAgentSmokeCurrentCommand(
+  args: string[],
+  deps: AgentCommandDeps = {}
+) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const agentInput = args[0]?.trim();
+  const allowRebind = args.includes("--bind");
+  if (!agentInput || agentInput === "--help" || agentInput === "-h") {
+    output.write("Usage: nolo agent smoke-current <agent> [--msg \"hello\"] [--bind]\n");
+    return agentInput ? 0 : 1;
+  }
+  const agentKey = resolveCliAgentKeyInput(agentInput);
+
+  const authToken = resolveAuthToken(env);
+  if (!authToken) {
+    output.write("[nolo] agent smoke-current requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+  const userId = parseUserIdFromAuthToken(authToken);
+  if (!userId) {
+    output.write("[nolo] agent smoke-current could not read userId from AUTH_TOKEN.\n");
+    return 1;
+  }
+
+  const userInput = readOption(args, "--msg") ?? "Smoke test from nolo connector.";
+  const serverUrl = resolveServerUrl(env);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+  const machine = await (deps.machineInfo ?? detectLaunchableMachineInfo)();
+  const sentMessages: string[] = [];
+
+  try {
+    await heartbeatCurrentMachine({ authToken, fetchImpl, machine, serverUrl });
+    const existing = await readAgentRecord({ agentKey, authToken, fallbackFetchImpl, fetchImpl, serverUrl });
+    assertSmokeCompatible(existing, machine);
+    assertSmokeBindingState({
+      agent: existing,
+      machine,
+      currentUserId: userId,
+      allowRebind,
+    });
+    if (allowRebind) {
+      await writeAgentRecord({
+        agentKey,
+        authToken,
+        fallbackFetchImpl,
+        fetchImpl,
+        serverUrl,
+        userId,
+        record: {
+          ...existing,
+          runtimeBinding: {
+            ...(existing?.runtimeBinding && typeof existing.runtimeBinding === "object"
+              ? existing.runtimeBinding
+              : {}),
+            machineId: machine.machineId,
+            ownerUserId: userId,
+          },
+          updatedAt: Date.now(),
+        },
+      });
+    }
+
+    let runResponse: any = null;
+    const wsTarget = await resolveConnectorWebSocketTarget({
+      serverUrl,
+      machineId: machine.machineId,
+      headers: { Authorization: `Bearer ${authToken}` },
+      fetchImpl,
+    });
+    await (deps.connectWebSocket ?? defaultConnectWebSocket)(
+      wsTarget,
+      {
+        headers: { Authorization: `Bearer ${authToken}` },
+        sentMessages,
+        onMessage: (message) => (deps.connectorRunMessageHandler ?? forwardConnectorRunMessage)(
+          machine,
+          message,
+          (response) => sentMessages.push(response),
+          deps.executeCli ?? defaultExecuteCli,
+          {
+            ...env,
+            NOLO_SERVER: serverUrl,
+            NOLO_SERVER_URL: serverUrl,
+            BASE_URL: serverUrl,
+            AUTH_TOKEN: authToken,
+            NOLO_MACHINE_API_KEY: authToken,
+          },
+          fetchImpl
+        ),
+        onOpen: async () => {
+          const res = await fetchImpl(`${serverUrl}/api/agent/run`, {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${authToken}`,
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              agentKey,
+              userInput,
+              stream: false,
+            }),
+          });
+          runResponse = await res.json().catch(() => ({}));
+          if (!res.ok) {
+            throw new Error(`agent run failed: HTTP ${res.status} ${JSON.stringify(runResponse)}`);
+          }
+        },
+      }
+    );
+    output.write(`Smoke OK: ${runResponse?.dialogId ?? "no-dialog"}\n`);
+    if (runResponse?.content) output.write(`${runResponse.content}\n`);
+    return 0;
+  } catch (error) {
+    output.write(
+      `[nolo] agent smoke-current failed: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`
+    );
+    return 1;
+  }
+}
+
+export async function runAgentRuntimeDoctorCommand(
+  args: string[],
+  deps: AgentCommandDeps = {}
+) {
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const agentInput = args[0]?.trim();
+  if (!agentInput || agentInput === "--help" || agentInput === "-h") {
+    output.write("Usage: nolo agent runtime-doctor <agentKey>\n");
+    return agentInput ? 0 : 1;
+  }
+  const agentKey = resolveCliAgentKeyInput(agentInput);
+
+  const authToken = resolveAuthToken(env);
+  if (!authToken) {
+    output.write("[nolo] agent runtime-doctor requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
+    return 1;
+  }
+
+  const serverUrl = resolveServerUrl(env);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fallbackFetchImpl = deps.fallbackFetchImpl;
+  const machine = await (deps.machineInfo ?? detectLaunchableMachineInfo)();
+
+  try {
+    const agent = await readAgentRecord({ agentKey, authToken, fallbackFetchImpl, fetchImpl, serverUrl });
+    const requiredCapability = requiredCapabilityForAgent(agent);
+    const runtimeClass = classifyAgentRuntime(agent);
+    const hasCapability = requiredCapability
+      ? machine.capabilities.includes(requiredCapability)
+      : false;
+    const bindingFacts = runtimeBindingFacts(agent, machine, parseUserIdFromAuthToken(authToken));
+    output.write(`Agent runtime doctor: ${agent?.name ?? agentKey}\n`);
+    if (agentInput !== agentKey) output.write(`Agent input: ${agentInput}\n`);
+    output.write(`Agent key: ${agentKey}\n`);
+    output.write(`Runtime class: ${runtimeClass}\n`);
+    output.write(`API source: ${agent?.apiSource ?? "unknown"}\n`);
+    output.write(`CLI provider: ${agent?.cliProvider ?? "none"}\n`);
+    output.write(`Required capability: ${requiredCapability || "none"}\n`);
+    output.write(`Current machine: ${machine.name} (${machine.machineId})\n`);
+    output.write(`Current machine capabilities: ${machine.capabilities.length ? machine.capabilities.join(", ") : "none"}\n`);
+    output.write(`Recorded bound machine: ${bindingFacts.boundMachineId || "none"}\n`);
+    output.write(`Recorded binding owner: ${bindingFacts.boundOwnerUserId || "unknown"}\n`);
+    output.write(`Current machine binding: ${runtimeClass === "cli-machine" ? (bindingFacts.isBoundToCurrent ? "yes" : "no") : "not required"}\n`);
+    output.write(
+      `Binding owner matches current user: ${
+        runtimeClass === "cli-machine"
+          ? (bindingFacts.boundOwnerUserId
+            ? (bindingFacts.isBindingOwnerCompatible ? "yes" : "no")
+            : "unknown")
+          : "not required"
+      }\n`
+    );
+    output.write(`Current machine has required capability: ${requiredCapability ? (hasCapability ? "yes" : "no") : "not required"}\n`);
+
+    return shouldRuntimeDoctorPass({
+      runtimeClass,
+      requiredCapability,
+      hasCapability,
+      bindingRequired: bindingFacts.bindingRequired,
+      isBoundToCurrent: bindingFacts.isBoundToCurrent,
+      isBindingOwnerCompatible: bindingFacts.isBindingOwnerCompatible,
+    }) ? 0 : 1;
+  } catch (error) {
+    output.write(
+      `[nolo] agent runtime-doctor failed: ${
+        error instanceof Error ? error.message : String(error)
+      }\n`
+    );
+    return 1;
+  }
+}

package/agentPullCommand.ts

@@ -1,14 +1,15 @@
-import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import { getDefaultCliLocalRuntimeDb } from "./localRuntimeDb";
 import type { CliLocalRuntimeDb } from "./client/localRuntimeAdapter";
+import type { OutputLike } from "./cliIoTypes";
 import { resolveCliAgentKeyInput } from "./agentAliases";
+import {
+  readCliOptionValue,
+  resolveAuthTokenFromEnv,
+  resolveServerUrlFromEnv,
+} from "./cliEnvHelpers";
 
 type EnvLike = Record<string, string | undefined>;
 
-type OutputLike = {
-  write(chunk: string): unknown;
-};
-
 type AgentPullCommandDeps = {
   env?: EnvLike;
   output?: OutputLike;
@@ -21,8 +22,7 @@ export type ParsedAgentPullArgs = {
 };
 
 function readFlagValue(args: string[], flag: string) {
-  const index = args.indexOf(flag);
-  return index >= 0 ? args[index + 1] : undefined;
+  return readCliOptionValue(args, flag) || undefined;
 }
 
 function positionalArgs(args: string[]) {
@@ -45,11 +45,11 @@ export function parseAgentPullArgs(args: string[]): ParsedAgentPullArgs | null {
 }
 
 function resolveServerUrl(env: EnvLike) {
-  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
+  return resolveServerUrlFromEnv(env);
 }
 
 function resolveAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || env.BENCHMARK_AUTH_TOKEN || "";
+  return resolveAuthTokenFromEnv(env);
 }
 
 function extractToolNames(record: any) {