nolo-cli 0.1.29 → 0.1.30

package/agentCreateCustomCommands.ts

@@ -3,6 +3,7 @@ import { createSpaceKey } from "./create/space/spaceKeys";
 import { readDbRecord, writeDbRecord } from "./agentRecordHelpers";
 import {
   parseUserIdFromAuthToken,
+  readCliOptionValue,
   resolveAuthToken,
   resolveServerUrl,
   type EnvLike,
@@ -68,11 +69,13 @@ function buildAgentKeys(agentId: string, userId: string) {
 
 async function createCustomAgentWithCliAuth(
   options: CreateCustomCodingAgentOptions,
-  deps: Pick<AgentCreateCustomDeps, "env" | "fallbackFetchImpl" | "fetchImpl">
+  deps: Pick<AgentCreateCustomDeps, "env" | "fallbackFetchImpl" | "fetchImpl"> & {
+    cliArgs?: string[];
+  }
 ) {
   const env = deps.env ?? process.env;
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const authToken = resolveAuthToken(env);
+  const authToken = readCliOptionValue(deps.cliArgs ?? [], "--token") || resolveAuthToken(env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     throw new Error("agent create-custom requires an auth token with userId. Run `nolo login`.");
@@ -232,9 +235,11 @@ export async function runAgentCreateCustomCommand(
   }
 
   try {
-    const createCustomAgent = deps.createCustomAgent ?? ((options) => createCustomAgentWithCliAuth(options, deps));
+    const createCustomAgent =
+      deps.createCustomAgent ??
+      ((options) => createCustomAgentWithCliAuth(options, { ...deps, cliArgs: args }));
     const result = await createCustomAgent({
-      baseUrl: resolveServerUrl(env),
+      baseUrl: resolveServerUrl(args, env),
       spaceId: readOption(args, "--space-id"),
       agentId: env.CUSTOM_AGENT_ID,
       apiKey,

package/agentDialogsCommands.ts

@@ -93,7 +93,7 @@ export async function runAgentDialogsCommand(
     return agentInput ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent dialogs requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -112,12 +112,13 @@ export async function runAgentDialogsCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const serverUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, serverUrl);
+  const serverUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, serverUrl);
 
   try {
     const resolvedAgent = await resolveAgentRecordFromHybridStore({
       agentInput,
+      cliArgs: args,
       env,
       db,
       fetchImpl,

package/agentDoctorCommands.ts

@@ -45,7 +45,7 @@ export async function runAgentDoctorCommand(
     return 0;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent doctor requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -60,8 +60,8 @@ export async function runAgentDoctorCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const [profile, settings, agents] = await Promise.all([

package/agentListCommands.ts

@@ -25,7 +25,7 @@ export async function runAgentListCommand(
   const output = deps.output ?? process.stdout;
   const { wantJson, publicOnly, idsOnly, includeLegacy } = parseAgentListArgs(args);
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent list requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -40,8 +40,8 @@ export async function runAgentListCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const serverUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, serverUrl);
+  const serverUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, serverUrl);
 
   try {
     const loadRemoteAgents = async () => {

package/agentMachineCommands.ts

@@ -225,7 +225,7 @@ export async function runAgentBindCurrentCommand(
     return agentKey ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent bind-current requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -237,7 +237,7 @@ export async function runAgentBindCurrentCommand(
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
   const machine = await (deps.machineInfo ?? detectLaunchableMachineInfo)();
@@ -292,7 +292,7 @@ export async function runAgentSmokeCurrentCommand(
   }
   const agentKey = resolveCliAgentKeyInput(agentInput);
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent smoke-current requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -304,7 +304,7 @@ export async function runAgentSmokeCurrentCommand(
   }
 
   const userInput = readOption(args, "--msg") ?? "Smoke test from nolo connector.";
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
   const machine = await (deps.machineInfo ?? detectLaunchableMachineInfo)();
@@ -415,13 +415,13 @@ export async function runAgentRuntimeDoctorCommand(
   }
   const agentKey = resolveCliAgentKeyInput(agentInput);
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent runtime-doctor requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
   const machine = await (deps.machineInfo ?? detectLaunchableMachineInfo)();

package/agentPullCommand.ts

@@ -4,8 +4,8 @@ import type { OutputLike } from "./cliIoTypes";
 import { resolveCliAgentKeyInput } from "./agentAliases";
 import {
   readCliOptionValue,
-  resolveAuthTokenFromEnv,
-  resolveServerUrlFromEnv,
+  resolveAuthToken,
+  resolveServerUrl,
 } from "./cliEnvHelpers";
 
 type EnvLike = Record<string, string | undefined>;
@@ -44,14 +44,6 @@ export function parseAgentPullArgs(args: string[]): ParsedAgentPullArgs | null {
   return { agentKey: resolveCliAgentKeyInput(agentKey) };
 }
 
-function resolveServerUrl(env: EnvLike) {
-  return resolveServerUrlFromEnv(env);
-}
-
-function resolveAuthToken(env: EnvLike) {
-  return resolveAuthTokenFromEnv(env);
-}
-
 function extractToolNames(record: any) {
   if (Array.isArray(record?.toolNames)) return record.toolNames.filter((tool: unknown) => typeof tool === "string");
   if (!Array.isArray(record?.tools)) return [];
@@ -113,8 +105,8 @@ export async function runAgentPullCommand(args: string[], deps: AgentPullCommand
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
-  const authToken = resolveAuthToken(env);
+  const serverUrl = resolveServerUrl(args, env);
+  const authToken = resolveAuthToken(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const db = deps.db ?? await getDefaultCliLocalRuntimeDb();
 

package/agentRecordCommands.ts

@@ -21,7 +21,7 @@ export async function runAgentReadCommand(
     return agentInput ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent read requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -35,6 +35,7 @@ export async function runAgentReadCommand(
   try {
     const result = await resolveAgentRecordFromHybridStore({
       agentInput,
+      cliArgs: args,
       env,
       db,
       fetchImpl,
@@ -79,7 +80,7 @@ export async function runAgentUpdateCommand(
     return args[0] ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent update requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -97,6 +98,7 @@ export async function runAgentUpdateCommand(
 
   try {
     const built = await buildUpdatedAgentRecord({
+      cliArgs: args,
       parsed,
       env,
       db,

package/agentRecordHelpers.ts

@@ -262,14 +262,15 @@ export async function deleteDbRecord(args: {
 
 export async function resolveAgentRecordFromHybridStore(args: {
   agentInput: string;
+  cliArgs?: string[];
   env: EnvLike;
   db: CliKvDb;
   fetchImpl: typeof fetch;
   fallbackFetchImpl?: typeof fetch;
 }) {
   const agentKey = resolveCliAgentKeyInput(args.agentInput);
-  const authToken = resolveAuthToken(args.env);
-  const defaultServerUrl = resolveServerUrl(args.env);
+  const authToken = resolveAuthToken(args.cliArgs ?? [], args.env);
+  const defaultServerUrl = resolveServerUrl(args.cliArgs ?? [], args.env);
 
   for (const key of buildLocalAgentLookupKeys({
     agentRef: agentKey,
@@ -289,7 +290,7 @@ export async function resolveAgentRecordFromHybridStore(args: {
     }
 
     if (!shouldReadAgentKeyRemotely(key)) continue;
-    for (const serverUrl of resolveServerCandidates(args.env, defaultServerUrl)) {
+    for (const serverUrl of resolveServerCandidates(args.cliArgs ?? [], args.env, defaultServerUrl)) {
       try {
         const remoteRecord = await readAgentRecord({
           agentKey: key,
@@ -380,6 +381,7 @@ export function parseAgentUpdateArgs(args: string[]) {
 }
 
 export async function buildUpdatedAgentRecord(args: {
+  cliArgs?: string[];
   parsed: NonNullable<ReturnType<typeof parseAgentUpdateArgs>>;
   env: EnvLike;
   db: CliKvDb;
@@ -389,13 +391,14 @@ export async function buildUpdatedAgentRecord(args: {
 }) {
   const cached = await resolveAgentRecordFromHybridStore({
     agentInput: args.parsed.agentInput,
+    cliArgs: args.cliArgs,
     env: args.env,
     db: args.db,
     fetchImpl: args.fetchImpl,
     fallbackFetchImpl: args.fallbackFetchImpl,
   });
   const agentKey = cached?.agentKey ?? resolveCliAgentKeyInput(args.parsed.agentInput);
-  const serverUrl = cached?.record?.serverOrigin ?? resolveServerUrl(args.env);
+  const serverUrl = cached?.record?.serverOrigin ?? resolveServerUrl(args.cliArgs ?? [], args.env);
   const currentRecord = await readAgentRecord({
     agentKey,
     authToken: args.authToken,
@@ -407,6 +410,7 @@ export async function buildUpdatedAgentRecord(args: {
   if (args.parsed.copyProviderFrom) {
     const providerSource = await resolveAgentRecordFromHybridStore({
       agentInput: args.parsed.copyProviderFrom,
+      cliArgs: args.cliArgs,
       env: args.env,
       db: args.db,
       fetchImpl: args.fetchImpl,

package/agentRunCommand.ts

@@ -1,4 +1,3 @@
-import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import { runAgentTurn, type RunAgentTurnResult } from "./client/agentRun";
 import type { AgentRuntimeHostAdapter } from "./agentRuntimeLocal";
 import {
@@ -20,6 +19,7 @@ import {
   type ParsedAgentRunArgs,
   type ResolvedWorkflowReference,
 } from "./agentRunParsing";
+import { resolveServerUrl } from "./cliEnvHelpers";
 
 type AgentRunCommandDeps = {
   env?: EnvLike;
@@ -49,10 +49,6 @@ function shouldPrintLocalRunSummary(args: {
   return Boolean(args.localRuntimeCwd && args.parsed.runtimeMode === "local");
 }
 
-function resolveServerUrl(env: EnvLike) {
-  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
-}
-
 function writeUsage(output: OutputLike) {
   output.write(
     "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--continue <dialogId>] [--cwd <path>] [--max-tool-rounds <n>]\n" +
@@ -95,7 +91,7 @@ export async function runAgentRunCommand(args: string[], deps: AgentRunCommandDe
   const result: RunAgentTurnResult = await runner({
     agentName: parsed.agentKey,
     agentKey: parsed.agentKey,
-    serverUrl: resolveServerUrl(env),
+    serverUrl: resolveServerUrl(args, env),
     message: prependWorkflowReferencePrompt(parsed.message, workflowReference),
     imageUrls: parsed.imageUrls.map(normalizeCliImageInput),
     scriptDir: deps.scriptDir,

package/agentUnpublishCommands.ts

@@ -36,7 +36,7 @@ export async function runAgentUnpublishCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent unpublish requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -51,13 +51,14 @@ export async function runAgentUnpublishCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const privateKey = `agent-${userId}-${agentId}`;
   const publicKey = `agent-pub-${agentId}`;
 
   try {
     const resolved = await resolveAgentRecordFromHybridStore({
       agentInput: privateKey,
+      cliArgs: args,
       env,
       db,
       fetchImpl,

package/cliEnvHelpers.ts

@@ -49,19 +49,13 @@ export function resolveServerUrlFromArgs(args: string[], env: EnvLike) {
   );
 }
 
-export function resolveServerUrl(env: EnvLike) {
-  return resolveServerUrlFromEnv(env);
+type ServerResolverInput = string[] | EnvLike;
+
+function isCliArgs(value: ServerResolverInput): value is string[] {
+  return Array.isArray(value);
 }
 
-export function resolveServerCandidates(env: EnvLike, preferred?: string | null) {
-  const values = [
-    preferred?.trim(),
-    env.NOLO_SERVER,
-    env.BASE_URL,
-    env.NOLO_SERVER_URL,
-    DEFAULT_NOLO_SERVER_URL,
-    ...NOLO_CLUSTER_SERVERS,
-  ];
+function buildServerCandidates(values: Array<string | null | undefined>) {
   return [...new Set(
     values
       .filter((value): value is string => typeof value === "string" && value.trim().length > 0)
@@ -69,8 +63,61 @@ export function resolveServerCandidates(env: EnvLike, preferred?: string | null)
   )];
 }
 
-export function resolveAuthToken(env: EnvLike) {
-  return resolveAuthTokenFromEnv(env);
+export function resolveServerUrl(env: EnvLike): string;
+export function resolveServerUrl(args: string[], env: EnvLike): string;
+export function resolveServerUrl(input: ServerResolverInput, env?: EnvLike) {
+  if (isCliArgs(input)) {
+    return resolveServerUrlFromArgs(input, env ?? {});
+  }
+  return resolveServerUrlFromEnv(input);
+}
+
+export function resolveServerCandidates(env: EnvLike, preferred?: string | null): string[];
+export function resolveServerCandidates(
+  args: string[],
+  env: EnvLike,
+  preferred?: string | null,
+): string[];
+export function resolveServerCandidates(
+  input: ServerResolverInput,
+  envOrPreferred?: EnvLike | string | null,
+  preferred?: string | null,
+) {
+  if (isCliArgs(input)) {
+    const env = (envOrPreferred ?? {}) as EnvLike;
+    const explicitServer = resolveServerUrlFromArgs(input, env);
+    return buildServerCandidates([
+      explicitServer,
+      preferred?.trim(),
+      env.NOLO_SERVER,
+      env.BASE_URL,
+      env.NOLO_SERVER_URL,
+      DEFAULT_NOLO_SERVER_URL,
+      ...NOLO_CLUSTER_SERVERS,
+    ]);
+  }
+  const env = input;
+  return buildServerCandidates([
+    typeof envOrPreferred === "string" ? envOrPreferred.trim() : undefined,
+    env.NOLO_SERVER,
+    env.BASE_URL,
+    env.NOLO_SERVER_URL,
+    DEFAULT_NOLO_SERVER_URL,
+    ...NOLO_CLUSTER_SERVERS,
+  ]);
+}
+
+export function resolveAuthToken(env: EnvLike, extraEnvKeys?: string[]): string;
+export function resolveAuthToken(args: string[], env: EnvLike, extraEnvKeys?: string[]): string;
+export function resolveAuthToken(
+  input: ServerResolverInput,
+  envOrExtraEnvKeys?: EnvLike | string[],
+  extraEnvKeys: string[] = [],
+) {
+  if (isCliArgs(input)) {
+    return resolveAuthTokenFromArgs(input, (envOrExtraEnvKeys ?? {}) as EnvLike, extraEnvKeys);
+  }
+  return resolveAuthTokenFromEnv(input, (envOrExtraEnvKeys as string[] | undefined) ?? []);
 }
 
 export function resolveAuthTokenFromEnv(env: EnvLike, extraEnvKeys: string[] = []) {

package/connectorWebSocketTarget.ts

@@ -1,6 +1,20 @@
-export async function resolveConnectorWebSocketTarget(input: {
-  serverUrl: string;
-  machineId: string;
+export class ConnectorWebSocketAuthError extends Error {
+  code: string;
+
+  constructor(message: string, code = "CONNECTOR_AUTH_FAILED") {
+    super(message);
+    this.name = "ConnectorWebSocketAuthError";
+    this.code = code;
+  }
+}
+
+export function isConnectorWebSocketAuthError(error: unknown): error is ConnectorWebSocketAuthError {
+  return error instanceof ConnectorWebSocketAuthError;
+}
+
+export async function resolveConnectorWebSocketTarget(input: {
+  serverUrl: string;
+  machineId: string;
   headers: Record<string, string>;
   fetchImpl?: typeof fetch;
 }) {
@@ -14,13 +28,20 @@ export async function resolveConnectorWebSocketTarget(input: {
   probeUrl.pathname = "/api/connector/ws";
   probeUrl.search = directWsUrl.search;
 
-  const response = await (input.fetchImpl ?? fetch)(probeUrl, {
-    headers: input.headers,
-  }).catch(() => null);
-
-  if (!response || !response.ok) {
-    return directWsUrl.toString();
-  }
+  const response = await (input.fetchImpl ?? fetch)(probeUrl, {
+    headers: input.headers,
+  }).catch(() => null);
+
+  if (response && (response.status === 401 || response.status === 403)) {
+    const json = await response.json().catch(() => null);
+    const code = typeof json?.code === "string" ? json.code : "CONNECTOR_AUTH_FAILED";
+    const message = typeof json?.error === "string" ? json.error : `Connector auth failed with HTTP ${response.status}`;
+    throw new ConnectorWebSocketAuthError(`${code}: ${message}`, code);
+  }
+
+  if (!response || !response.ok) {
+    return directWsUrl.toString();
+  }
 
   const json = await response.json().catch(() => null);
   return typeof json?.wsUrl === "string" && json.wsUrl

package/dialogReadCommands.ts

@@ -60,7 +60,7 @@ export async function runDialogReadCommand(
     return args[0] ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
 
@@ -68,6 +68,7 @@ export async function runDialogReadCommand(
     const { base, dialogId, userId, spaceId } = parseDialogInputForCli(parsedArgs.rawInput, env);
     const dialogKey = `dialog-${userId}-${dialogId}`;
     const candidateBases = resolveServerCandidates(
+      args,
       {
         ...env,
         BASE_URL: env.READ_DIALOG_BASE?.trim() || base || env.BASE_URL,

package/dialogStatusCommands.ts

@@ -31,7 +31,7 @@ export async function runDialogStatusCommand(
     return rawInput ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
 
@@ -39,6 +39,7 @@ export async function runDialogStatusCommand(
     const { base, dialogId, userId } = parseDialogInputForCli(rawInput, env);
     const dialogKey = `dialog-${userId}-${dialogId}`;
     const candidateBases = resolveServerCandidates(
+      args,
       {
         ...env,
         BASE_URL: env.READ_DIALOG_BASE?.trim() || base || env.BASE_URL,

package/machineCommands.ts

@@ -161,6 +161,7 @@ export async function runMachineConnectCommand(
             }
           ),
       });
+      if (exitCode === 2) return 1;
       if (attempt >= maxAttempts) return exitCode;
       output.write(`[nolo] Connector websocket disconnected. Reconnecting in ${reconnectDelayMs}ms.\n`);
       await sleep(reconnectDelayMs);

package/machineStatusCommands.ts

@@ -1,5 +1,5 @@
-import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import type { OutputLike } from "./cliIoTypes";
+import { resolveAuthToken, resolveServerUrl } from "./cliEnvHelpers";
 
 type EnvLike = Record<string, string | undefined>;
 
@@ -21,14 +21,6 @@ export type MachineStatusCommandDeps = {
   fetchImpl?: typeof fetch;
 };
 
-function resolveServerUrl(env: EnvLike) {
-  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
-}
-
-function resolveAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || "";
-}
-
 function writeAuthMissing(output: OutputLike) {
   output.write(
     "[nolo] Machine commands require an auth token. Run `nolo login` or set AUTH_TOKEN.\n"
@@ -52,18 +44,18 @@ export function formatMachineStatus(machines: MachineSummary[]) {
 }
 
 export async function runMachineStatusCommand(
-  _args: string[],
+  args: string[],
   deps: MachineStatusCommandDeps = {}
 ) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     writeAuthMissing(output);
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   let res: Response;
   try {

package/machineWsSession.ts

@@ -1,5 +1,6 @@
 import type { HeartbeatLoopOptions } from "./connector-experimental/heartbeatLoop";
 import type { MachineHeartbeat } from "./connector-experimental/protocol";
+import { isConnectorWebSocketAuthError } from "./connectorWebSocketTarget";
 
 type EnvLike = Record<string, string | undefined>;
 type OutputLike = { write(chunk: string): unknown };
@@ -138,6 +139,12 @@ export async function runMachineWsSession(options: {
     await Promise.allSettled(
       [websocketPromise, heartbeatLoopPromise].filter(Boolean) as Promise<void>[],
     );
+    if (isConnectorWebSocketAuthError(error)) {
+      options.output.write(
+        `[nolo] Connector websocket auth failed: ${error.message}. Re-register this machine or update NOLO_MACHINE_API_KEY.\n`
+      );
+      return 2;
+    }
     options.output.write(
       `[nolo] Connector websocket failed: ${
         error instanceof Error ? error.message : String(error)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nolo-cli",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "type": "module",
   "description": "Agent-first terminal workspace for Nolo",
   "bin": {
@@ -110,10 +110,10 @@
     "ai/**/*.ts",
     "chat/**/*.ts",
     "render/**/*.ts",
-    "core/**/*.ts",
     "auth/**/*.ts",
-    "life/**/*.ts",
     "share/**/*.ts",
+    "life/**/*.ts",
+    "core/**/*.ts",
     "server/**/*.ts",
     "integrations/**/*.ts"
   ],
@@ -136,24 +136,23 @@
     "tweetnacl": "^1.0.3",
     "@reduxjs/toolkit": "^2.5.0",
     "react-redux": "^9.2.0",
-    "react-hot-toast": "^2.4.1",
     "react": "^19.2.1",
-    "browser-image-compression": "^2.0.2",
+    "react-hot-toast": "^2.4.1",
     "react-i18next": "^14.1.2",
     "i18next": "^23.11.5",
-    "ulid": "^2.3.0",
+    "browser-image-compression": "^2.0.2",
     "pino": "^9.9.0",
+    "ulid": "^2.3.0",
     "slate": "^0.112.0",
+    "slate-react": "^0.112.1",
+    "pdfjs-dist": "^5.2.133",
+    "slate-history": "^0.113.1",
     "mdast-util-from-markdown": "^2.0.2",
     "mdast-util-gfm": "^3.0.0",
     "micromark-extension-gfm": "^3.0.0",
-    "slate-history": "^0.113.1",
-    "slate-react": "^0.112.1",
-    "pdfjs-dist": "^5.2.133",
-    "rambda": "^8.6.0",
-    "react-native-blob-util": "^0.24.7",
     "@react-native-community/netinfo": "^11.5.0",
-    "react-native-sse": "^1.2.1",
+    "react-native-blob-util": "^0.24.7",
+    "rambda": "^8.6.0",
     "@lobehub/icons": "^5.0.1",
     "pizzip": "^3.2.0",
     "docxtemplater": "^3.67.5",
@@ -161,16 +160,17 @@
     "zod": "^3.25.20",
     "react-hook-form": "^7.51.5",
     "@hookform/resolvers": "^3.3.2",
+    "react-native-sse": "^1.2.1",
+    "xlsx": "^0.18.5",
     "react-router-dom": "^6.23.1",
     "croner": "^8.0.1",
-    "xlsx": "^0.18.5",
     "mermaid": "^11.6.0",
-    "js-base64": "^3.7.7",
     "react-native-keychain": "^9.2.2",
     "async-mutex": "^0.5.0",
-    "diff": "^8.0.2",
+    "js-base64": "^3.7.7",
     "react-dom": "^19.2.1",
-    "@waffo/pancake-ts": "^0.5.2",
-    "playwright": "^1.59.1"
+    "diff": "^8.0.2",
+    "playwright": "^1.59.1",
+    "@waffo/pancake-ts": "^0.5.2"
   }
 }

package/pageCreateCommands.ts

@@ -66,7 +66,7 @@ async function runBasePageCreateCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write(`[nolo] ${mode} create requires an auth token with userId. Run \`nolo login\`.\n`);
@@ -82,7 +82,7 @@ async function runBasePageCreateCommand(
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;

package/pageDeleteCommands.ts

@@ -54,7 +54,7 @@ export async function runBasePageDeleteCommand(
     return dbKey ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write(`[nolo] ${mode} delete requires an auth token with userId. Run \`nolo login\`.\n`);
@@ -64,8 +64,8 @@ export async function runBasePageDeleteCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const existing = await readRecord({

package/pageReadCommands.ts

@@ -76,7 +76,7 @@ async function runBasePageReadCommand(
     return raw ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write(`[nolo] ${mode} read requires an auth token. Run \`nolo login\` or set AUTH_TOKEN.\n`);
     return 1;
@@ -85,8 +85,8 @@ async function runBasePageReadCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const record = await readPageRecord({

package/pageUpdateCommands.ts

@@ -63,7 +63,7 @@ async function runBasePageUpdateCommand(
     return dbKey ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write(`[nolo] ${mode} update requires an auth token with userId. Run \`nolo login\`.\n`);
@@ -73,8 +73,8 @@ async function runBasePageUpdateCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
   const writeTargets = [defaultServerUrl];
 
   try {

package/runtimeDoctorCommands.ts

@@ -64,13 +64,13 @@ async function defaultLocalRuntimeProbe(env: EnvLike): Promise<LocalRuntimeProbe
 }
 
 export async function runDoctorRuntimeCommand(
-  _args: string[],
+  args: string[],
   deps: AgentCommandDeps = {}
 ) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
-  const authToken = resolveAuthToken(env);
-  const serverUrl = resolveServerUrl(env);
+  const authToken = resolveAuthToken(args, env);
+  const serverUrl = resolveServerUrl(args, env);
   const localProbe = await (deps.localRuntimeProbe ?? defaultLocalRuntimeProbe)(env);
   const hasLocalAgentConfig = detectLocalAgentConfig(env) && localProbe.ok && localProbe.agentFound;
   const hasLocalProvider = detectLocalProvider(env);

package/spaceCategoryCommands.ts

@@ -49,7 +49,7 @@ export async function runSpaceCategoryCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write("[nolo] space category requires an auth token with userId. Run `nolo login`.\n");
@@ -66,8 +66,8 @@ export async function runSpaceCategoryCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const spaceId = parseSpaceIdFromInput(rawSpace);
@@ -163,7 +163,7 @@ export async function runSpaceContentCategoryCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write("[nolo] space content-category requires an auth token with userId. Run `nolo login`.\n");
@@ -189,8 +189,8 @@ export async function runSpaceContentCategoryCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const spaceId = parseSpaceIdFromInput(rawSpace);

package/spaceCommands.ts

@@ -181,7 +181,7 @@ export async function runSpaceListCommand(
   const output = deps.output ?? process.stdout;
   const filters = parseSpaceListArgs(args);
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] space list requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -196,8 +196,8 @@ export async function runSpaceListCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     let spaces: ListedSpace[];

package/spaceDeleteCommands.ts

@@ -195,7 +195,7 @@ export async function runSpaceDeleteCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write("[nolo] space delete requires an auth token with userId. Run `nolo login`.\n");
@@ -207,7 +207,7 @@ export async function runSpaceDeleteCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
 
   try {
     const memberships = await fetchMemberships({

package/spaceReadCommands.ts

@@ -79,7 +79,7 @@ export async function runSpaceReadCommand(
   const output = deps.output ?? process.stdout;
   const { raw, brief, contentKeyFilter, includeRecord } = parseSpaceReadArgs(args);
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] space read requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -94,8 +94,8 @@ export async function runSpaceReadCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const spaceId = parseSpaceIdFromInput(raw);

package/tableMetaCommands.ts

@@ -158,7 +158,7 @@ export async function runTableMetaCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write("[nolo] table meta requires an auth token with userId. Run `nolo login`.\n");
@@ -168,7 +168,7 @@ export async function runTableMetaCommand(
   const name = rawName.trim();
   const description = readOption(args, "--description")?.trim() || undefined;
   const tags = parseTags(readOption(args, "--tags"));
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;

package/taskRunCommand.ts

@@ -13,6 +13,15 @@ type TaskRunCommandDeps = {
   fetchImpl?: typeof fetch;
 };
 
+const DEFAULT_TASK_RUN_TIMEOUT_MS = 10 * 60 * 1000;
+
+function resolveTaskRunTimeoutMs(env: EnvLike) {
+  const raw = env.NOLO_TASK_RUN_TIMEOUT_MS;
+  if (!raw) return DEFAULT_TASK_RUN_TIMEOUT_MS;
+  const value = Number(raw);
+  return Number.isFinite(value) && value > 0 ? value : DEFAULT_TASK_RUN_TIMEOUT_MS;
+}
+
 export async function runTaskRunCommand(args: string[], deps: TaskRunCommandDeps = {}) {
   const env = loadTaskRunEnv(deps.env ?? process.env, { includeDefaultEnvFiles: deps.env === undefined });
   const output = deps.output ?? process.stdout;
@@ -38,6 +47,7 @@ export async function runTaskRunCommand(args: string[], deps: TaskRunCommandDeps
   }
 
   const serverUrl = resolveServerUrl(args, env);
+  const timeoutMs = resolveTaskRunTimeoutMs(env);
   let response: Response;
   try {
     response = await fetchImpl(`${serverUrl}/api/task-run`, {
@@ -47,6 +57,7 @@ export async function runTaskRunCommand(args: string[], deps: TaskRunCommandDeps
         "Content-Type": "application/json",
       },
       body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs),
     });
   } catch (error) {
     output.write(`[nolo] task-run failed: ${error instanceof Error ? error.message : String(error)}\n`);