nolo-cli 0.1.29 → 0.1.31

package/machineWsRunDispatch.ts

@@ -1,4 +1,6 @@
 import { runLocalAgentTurn, type LocalAgentToolEvent } from "./agent-runtime/localLoop";
+import { resolveHostRuntimeConfigFromEnv } from "./agent-runtime/hostRuntimeConfig";
+import { normalizeAgentRunDialogLineage } from "./ai/agent/agentRunDialogLineage";
 import {
   assertMachineRunAllowed as defaultAssertMachineRunAllowed,
   resolveMachineRunPermissionPolicy as defaultResolveMachineRunPermissionPolicy,
@@ -118,6 +120,24 @@ function requestsLocalWorkspaceRuntime(policy?: ConnectorRuntimePolicy) {
   );
 }
 
+function isMachineBoundLocalCustomProvider(agentConfig: any) {
+  const machineId =
+    isRecord(agentConfig?.runtimeBinding) && typeof agentConfig.runtimeBinding.machineId === "string"
+      ? agentConfig.runtimeBinding.machineId.trim()
+      : "";
+  const providerUrl =
+    typeof agentConfig?.customProviderUrl === "string"
+      ? agentConfig.customProviderUrl.trim()
+      : "";
+  if (!machineId || !providerUrl) return false;
+  try {
+    const hostname = new URL(providerUrl).hostname.toLowerCase();
+    return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1";
+  } catch {
+    return false;
+  }
+}
+
 function hasExplicitMachinePermissions(agentConfig: any) {
   const runtimeBinding = isRecord(agentConfig?.runtimeBinding) ? agentConfig.runtimeBinding : {};
   return Boolean(
@@ -130,6 +150,7 @@ function hasExplicitMachinePermissions(agentConfig: any) {
 
 function runtimeWorkspacePermissionPolicy(
   runtimePolicy: ConnectorRuntimePolicy | undefined,
+  hostRuntimeConfig: { capabilities: { allowShell: boolean } },
   cwd: string
 ): PermissionPolicy | null {
   if (!requestsTaskWorktree(runtimePolicy)) return null;
@@ -137,7 +158,10 @@ function runtimeWorkspacePermissionPolicy(
     mode: "full_access",
     allowFilesystemRead: true,
     allowFilesystemWrite: true,
-    allowShell: runtimePolicy?.shell?.enabled !== false,
+    allowShell:
+      hostRuntimeConfig.capabilities.allowShell &&
+      Array.isArray(runtimePolicy?.runtimeTools) &&
+      runtimePolicy.runtimeTools.includes("execShell"),
     writableRoots: [cwd],
   };
 }
@@ -175,13 +199,20 @@ function mergeToolNames(...values: unknown[]) {
 function localRuntimeEnvFromPolicy(runtimeEnv: EnvLike, policy?: ConnectorRuntimePolicy): EnvLike {
   return {
     ...runtimeEnv,
-    ...(policy?.shell?.enabled && policy.shell.mode === "worktree"
-      ? { NOLO_LOCAL_SHELL_MODE: "worktree" }
-      : {}),
     ...(policy?.workspace?.cwd ? { NOLO_LOCAL_WORKTREE: policy.workspace.cwd } : {}),
   };
 }
 
+function forwardedUserAuthToken(parsed: any): string {
+  const value = parsed?.payload?.meta?.userAuthToken;
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function withForwardedUserAuthToken(runtimeEnv: EnvLike, parsed: any): EnvLike {
+  const userAuthToken = forwardedUserAuthToken(parsed);
+  return userAuthToken ? { ...runtimeEnv, AUTH_TOKEN: userAuthToken } : runtimeEnv;
+}
+
 function runtimeWorkspaceRootFromTrace(trace: unknown): string | undefined {
   if (!Array.isArray(trace)) return undefined;
   for (const message of trace) {
@@ -241,6 +272,12 @@ async function defaultRunConnectorLocalRuntimeAgent(args: {
     ? args.parsed.payload.agentConfig
     : {};
   const policy = runtimePolicyFromConnectorPayload(args.parsed);
+  const wantsTaskWorktree = requestsTaskWorktree(policy);
+  const hostRuntimeConfig = resolveHostRuntimeConfigFromEnv({
+    env: args.runtimeEnv,
+    surface: "connector-local",
+    workspaceBinding: wantsTaskWorktree ? "default-cwd" : "explicit-cwd",
+  });
   const agentRecord = {
     ...payloadAgentConfig,
     dbKey: agentKey,
@@ -262,12 +299,14 @@ async function defaultRunConnectorLocalRuntimeAgent(args: {
     [`agent-${args.runtimeEnv.NOLO_USER_ID || "local"}-${agentKey}`, agentRecord],
     [`agent-${args.runtimeEnv.NOLO_LOCAL_USER_ID || args.runtimeEnv.NOLO_USER_ID || "local"}-${agentKey}`, agentRecord],
   ]);
-  const env = localRuntimeEnvFromPolicy(args.runtimeEnv, policy);
-  const wantsTaskWorktree = requestsTaskWorktree(policy);
+  const env = localRuntimeEnvFromPolicy(
+    withForwardedUserAuthToken(args.runtimeEnv, args.parsed),
+    policy
+  );
   const adapter = createCliLocalRuntimeAdapter({
     env,
+    hostRuntimeConfig,
     cwd: args.cwd,
-    useCwdAsTaskWorkspaceBase: wantsTaskWorktree,
     ...(wantsTaskWorktree
       ? {
           prepareTaskWorktree: (input) => prepareTaskWorktree({
@@ -350,6 +389,20 @@ function normalizeConnectorRunTimeoutMs(value: unknown): number | undefined {
   return Math.floor(value);
 }
 
+function normalizeConnectorRunPayloadContinueDialogId(payload: unknown) {
+  if (!isRecord(payload)) return payload;
+  const dialogLineage = normalizeAgentRunDialogLineage({
+    continueDialogId: payload.continueDialogId,
+  });
+  const normalizedPayload = { ...payload };
+  if (dialogLineage.continueDialogId) {
+    normalizedPayload.continueDialogId = dialogLineage.continueDialogId;
+  } else {
+    delete normalizedPayload.continueDialogId;
+  }
+  return normalizedPayload;
+}
+
 export async function handleConnectorRunMessage(
   message: string,
   send: (message: string) => void,
@@ -365,6 +418,12 @@ export async function handleConnectorRunMessage(
     return;
   }
   if (parsed?.type !== "agent.run" || typeof parsed.requestId !== "string") return;
+  if (isRecord(parsed)) {
+    parsed = {
+      ...parsed,
+      payload: normalizeConnectorRunPayloadContinueDialogId(parsed.payload),
+    };
+  }
   const agentConfig = parsed.payload?.agentConfig ?? {};
   const sendProgress = (progress: ConnectorRunProgress) => {
     send(JSON.stringify({
@@ -392,6 +451,11 @@ export async function handleConnectorRunMessage(
   try {
     const machinePermissionPolicy = resolveMachineRunPermissionPolicy(agentConfig);
     const runtimePolicy = runtimePolicyFromConnectorPayload(parsed);
+    const hostRuntimeConfig = resolveHostRuntimeConfigFromEnv({
+      env: runtimeEnv,
+      surface: agentConfig.apiSource === "cli" ? "connector-cli" : "connector-local",
+      workspaceBinding: requestsTaskWorktree(runtimePolicy) ? "default-cwd" : "explicit-cwd",
+    });
     const userInput = String(parsed.payload?.userInput ?? "");
     const timeout = normalizeConnectorRunTimeoutMs(parsed.payload?.timeoutMs);
     let cwd = resolveConnectorRunCwd({ env: runtimeEnv, policy: machinePermissionPolicy });
@@ -414,7 +478,7 @@ export async function handleConnectorRunMessage(
         artifactCwd = prepared.path;
       }
       const runtimePermissionPolicy = !hasExplicitMachinePermissions(agentConfig)
-        ? runtimeWorkspacePermissionPolicy(runtimePolicy, cwd)
+        ? runtimeWorkspacePermissionPolicy(runtimePolicy, hostRuntimeConfig, cwd)
         : null;
       const effectivePermissionPolicy = scopePermissionPolicyToRuntimeWorkspace(
         runtimePermissionPolicy ?? machinePermissionPolicy,
@@ -472,17 +536,18 @@ export async function handleConnectorRunMessage(
           updatedAt: Date.now(),
         });
       }, 15_000);
+      const effectiveRuntimeEnv = withForwardedUserAuthToken(runtimeEnv, parsed);
       const result = await executeCli(provider, materializedPrompt.prompt, {
         model: agentConfig.model || undefined,
         timeout,
         cwd,
         yolo: true,
         env: {
-          NOLO_SERVER: runtimeEnv.NOLO_SERVER || runtimeEnv.NOLO_SERVER_URL || runtimeEnv.BASE_URL,
-          NOLO_SERVER_URL: runtimeEnv.NOLO_SERVER_URL || runtimeEnv.NOLO_SERVER || runtimeEnv.BASE_URL,
-          BASE_URL: runtimeEnv.BASE_URL || runtimeEnv.NOLO_SERVER || runtimeEnv.NOLO_SERVER_URL,
-          AUTH_TOKEN: runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH || runtimeEnv.NOLO_MACHINE_API_KEY,
-          NOLO_MACHINE_API_KEY: runtimeEnv.NOLO_MACHINE_API_KEY || runtimeEnv.AUTH_TOKEN || runtimeEnv.AUTH,
+          NOLO_SERVER: effectiveRuntimeEnv.NOLO_SERVER || effectiveRuntimeEnv.NOLO_SERVER_URL || effectiveRuntimeEnv.BASE_URL,
+          NOLO_SERVER_URL: effectiveRuntimeEnv.NOLO_SERVER_URL || effectiveRuntimeEnv.NOLO_SERVER || effectiveRuntimeEnv.BASE_URL,
+          BASE_URL: effectiveRuntimeEnv.BASE_URL || effectiveRuntimeEnv.NOLO_SERVER || effectiveRuntimeEnv.NOLO_SERVER_URL,
+          AUTH_TOKEN: effectiveRuntimeEnv.AUTH_TOKEN || effectiveRuntimeEnv.AUTH || effectiveRuntimeEnv.NOLO_MACHINE_API_KEY,
+          NOLO_MACHINE_API_KEY: effectiveRuntimeEnv.NOLO_MACHINE_API_KEY || effectiveRuntimeEnv.AUTH_TOKEN || effectiveRuntimeEnv.AUTH,
         },
       }).finally(() => clearInterval(heartbeat));
       logConnectorRun("agent.run.cli.result", {
@@ -518,13 +583,13 @@ export async function handleConnectorRunMessage(
       }));
       return;
     }
-    if (!requestsLocalWorkspaceRuntime(runtimePolicy)) {
+    if (!requestsLocalWorkspaceRuntime(runtimePolicy) && !isMachineBoundLocalCustomProvider(agentConfig)) {
       throw new Error("Connector can only execute non-CLI agents when runtimeToolPolicySnapshot requests a local workspace runtime.");
     }
     baseSha = await readConnectorGitHead(cwd);
     const result = await runConnectorLocalRuntimeAgent({
       parsed,
-      runtimeEnv,
+      runtimeEnv: withForwardedUserAuthToken(runtimeEnv, parsed),
       cwd,
       fetchImpl,
       onProgress: sendProgress,

package/machineWsSession.ts

@@ -1,5 +1,6 @@
 import type { HeartbeatLoopOptions } from "./connector-experimental/heartbeatLoop";
 import type { MachineHeartbeat } from "./connector-experimental/protocol";
+import { isConnectorWebSocketAuthError } from "./connectorWebSocketTarget";
 
 type EnvLike = Record<string, string | undefined>;
 type OutputLike = { write(chunk: string): unknown };
@@ -8,6 +9,7 @@ export type ConnectorWebSocketOptions = {
   headers: Record<string, string>;
   onMessage: (message: string) => void | Promise<void>;
   sentMessages: string[];
+  signal?: AbortSignal;
 };
 
 const CONNECTOR_WS_KEEPALIVE_MS = 25_000;
@@ -34,6 +36,7 @@ export async function defaultConnectWebSocket(
       headers: options.headers,
     } as any);
     let opened = false;
+    let aborted = options.signal?.aborted ?? false;
     let keepalive: ReturnType<typeof setInterval> | null = null;
     const clearKeepalive = () => {
       if (keepalive) {
@@ -41,6 +44,16 @@ export async function defaultConnectWebSocket(
         keepalive = null;
       }
     };
+    const handleAbort = () => {
+      aborted = true;
+      clearKeepalive();
+      try {
+        ws.close();
+      } catch {
+        resolve();
+      }
+    };
+    options.signal?.addEventListener("abort", handleAbort, { once: true });
     ws.addEventListener(
       "open",
       () => {
@@ -57,13 +70,17 @@ export async function defaultConnectWebSocket(
     );
     ws.addEventListener("error", () => {
       clearKeepalive();
+      if (aborted) {
+        resolve();
+        return;
+      }
       reject(new Error("connector websocket failed"));
     });
     ws.addEventListener(
       "close",
       () => {
         clearKeepalive();
-        if (opened) resolve();
+        if (opened || aborted) resolve();
         else reject(new Error("connector websocket closed before opening"));
       },
       { once: true },
@@ -87,11 +104,13 @@ export async function runMachineWsSession(options: {
   machine: MachineHeartbeat;
   serverUrl: string;
   authToken: string;
+  signal?: AbortSignal;
   sendHeartbeat: () => Promise<void>;
   runHeartbeatLoop: (options: HeartbeatLoopOptions) => Promise<void>;
   resolveConnectorWebSocketTarget: (args: {
     serverUrl: string;
     machineId: string;
+    connectorSurface?: string;
     headers: Record<string, string>;
   }) => Promise<string>;
   connectWebSocket: (url: string, options: ConnectorWebSocketOptions) => Promise<void>;
@@ -102,6 +121,9 @@ export async function runMachineWsSession(options: {
   let heartbeatLoopPromise: Promise<void> | null = null;
   let websocketPromise: Promise<void> | null = null;
   try {
+    if (options.signal?.aborted) {
+      return 0;
+    }
     await options.sendHeartbeat();
     options.output.write(
       `Connector websocket connected: ${options.machine.name} (${options.machine.machineId})\n`
@@ -119,25 +141,47 @@ export async function runMachineWsSession(options: {
     const wsTarget = await options.resolveConnectorWebSocketTarget({
       serverUrl: options.serverUrl,
       machineId: options.machine.machineId,
+      connectorSurface: "cli",
       headers: { Authorization: `Bearer ${options.authToken}` },
     });
     websocketPromise = options.connectWebSocket(wsTarget, {
       headers: { Authorization: `Bearer ${options.authToken}` },
+      signal: options.signal,
       sentMessages,
       onMessage: (message) =>
         options.onMessage(message, (response) => {
           sentMessages.push(response);
         }),
     });
-    await Promise.race([websocketPromise, heartbeatMonitorPromise]);
+    const abortPromise = options.signal
+      ? new Promise<"aborted">((resolve) => {
+          if (options.signal?.aborted) {
+            resolve("aborted");
+            return;
+          }
+          options.signal?.addEventListener("abort", () => resolve("aborted"), { once: true });
+        })
+      : null;
+    const raceResult = await Promise.race(
+      [websocketPromise, heartbeatMonitorPromise, abortPromise].filter(Boolean) as Promise<void | "aborted">[]
+    );
     heartbeatAbort.abort();
     await Promise.allSettled([websocketPromise, heartbeatLoopPromise]);
+    if (raceResult === "aborted") {
+      return 0;
+    }
     return 0;
   } catch (error) {
     heartbeatAbort.abort();
     await Promise.allSettled(
       [websocketPromise, heartbeatLoopPromise].filter(Boolean) as Promise<void>[],
     );
+    if (isConnectorWebSocketAuthError(error)) {
+      options.output.write(
+        `[nolo] Connector websocket auth failed: ${error.message}. Re-register this machine or update NOLO_MACHINE_API_KEY.\n`
+      );
+      return 2;
+    }
     options.output.write(
       `[nolo] Connector websocket failed: ${
         error instanceof Error ? error.message : String(error)

package/noloReadBridgePrompt.ts

@@ -0,0 +1,16 @@
+const REPO_CLI_PREFIX = "bun packages/cli/index.ts";
+
+export function buildNoloReadOnlyBridgePrompt() {
+  return [
+    "--- Nolo read-only CLI bridge ---",
+    "This CLI runtime does not receive server-side function tools directly.",
+    "Use these repo-local read commands to fetch authoritative Nolo docs and records on demand instead of trusting prompt snapshots or summaries alone.",
+    "Run commands from the repository root. The runner already provides server URL and auth in the environment.",
+    `Read doc/page truth: ${REPO_CLI_PREFIX} doc read "<pageKey>"`,
+    `Read skill doc truth: ${REPO_CLI_PREFIX} skill-doc read "<pageKey>"`,
+    `Read dialog truth: ${REPO_CLI_PREFIX} dialog read "<dialogId|dialogUrl>"`,
+    `Read shared space truth: ${REPO_CLI_PREFIX} space read "<spaceId|spaceKey|spaceUrl>"`,
+    `Read agent truth: ${REPO_CLI_PREFIX} agent read "<agentKey|agentAlias|agentUrl>"`,
+    "If a read command fails, report the exact command and error.",
+  ].join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nolo-cli",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "type": "module",
   "description": "Agent-first terminal workspace for Nolo",
   "bin": {
@@ -97,11 +97,104 @@
     "runtimeModeArgs.ts",
     "tableCommands.ts",
     "updateCommands.ts",
-    "client/**/*.ts",
-    "tui/**/*.ts",
+    "client/compactDialog.test.ts",
+    "client/localAgentRecords.test.ts",
+    "client/localRuntimeDryRun.test.ts",
+    "client/agentRunTaskRunRecorder.ts",
+    "client/workspaceSession.test.ts",
+    "client/localProviderResolver.test.ts",
+    "client/localDialogRecords.ts",
+    "client/agentRunLocalExecutor.ts",
+    "client/localDialogRecords.test.ts",
+    "client/profileConfig.test.ts",
+    "client/profileConfig.ts",
+    "client/agentRunRuntimeSelection.ts",
+    "client/localAgentRecords.ts",
+    "client/taskWorktree.ts",
+    "client/localToolPolicy.test.ts",
+    "client/streamingOutput.test.ts",
+    "client/streamingOutput.ts",
+    "client/localToolPolicy.ts",
+    "client/compactDialog.ts",
+    "client/hybridRecordStore.test.ts",
+    "client/agentRun.ts",
+    "client/localRuntimeAdapter.test.ts",
+    "client/agentRunRuntimeSelection.test.ts",
+    "client/agentRunLocalExecution.test.ts",
+    "client/agentRunInput.ts",
+    "client/localProviderResolver.ts",
+    "client/taskRunPrompt.ts",
+    "client/hybridRecordStore.ts",
+    "client/agentConfigResolver.test.ts",
+    "client/agentRunServerTransport.ts",
+    "client/workspaceSession.ts",
+    "client/agentRun.test.ts",
+    "client/agentConfigResolver.ts",
+    "client/agentRunLocalExecution.ts",
+    "client/localRuntimeAdapter.ts",
+    "tui/tuiPresentation.ts",
+    "tui/readlineWorkspace.ts",
+    "tui/session.ts",
+    "tui/tuiPresentation.test.ts",
+    "tui/tuiCommandInterpreter.test.ts",
+    "tui/tuiCommandInterpreter.ts",
+    "tui/tuiCatalog.ts",
     "README.md",
-    "ai/**/*.ts",
-    "connector-experimental/**/*.ts",
+    "ai/agent.ts",
+    "ai/tools/agent/taskRunTool.ts",
+    "ai/agent/cliExecutor.ts",
+    "ai/agent/agentSlice.ts",
+    "ai/agent/machineRunPermissions.ts",
+    "ai/agent/agentRunDialogLineage.ts",
+    "ai/agent/cliPrompt.ts",
+    "ai/index.ts",
+    "connector-experimental/protocol.ts",
+    "connector-experimental/machineInfo.ts",
+    "../agent-runtime/index.ts",
+    "../ai/tools/agent/taskRunTool.ts",
+    "../ai/agent/cliExecutor.ts",
+    "../ai/agent/cliPrompt.ts",
+    "../agent-runtime/hostAdapter.ts",
+    "../agent-runtime/localLoop.ts",
+    "../agent-runtime/agentConfigOptions.ts",
+    "../agent-runtime/openAiCompatibleProvider.ts",
+    "../agent-runtime/openAiCompatibleProviderConfig.ts",
+    "../agent-runtime/platformChatProvider.ts",
+    "../agent-runtime/runtimeDecision.ts",
+    "../agent-runtime/runtimeFacts.ts",
+    "../agent-runtime/agentRecordKeys.ts",
+    "../agent-runtime/agentRecordConfig.ts",
+    "../agent-runtime/dialogMessageRecord.ts",
+    "../agent-runtime/dialogStatus.ts",
+    "../agent-runtime/dialogWritePlan.ts",
+    "../agent-runtime/hybridRecordStore.ts",
+    "../agent-runtime/workspaceSession.ts",
+    "../agent-runtime/taskWorkspace.ts",
+    "../agent-runtime/hostRuntimeConfig.ts",
+    "../agent-runtime/localToolPolicy.ts",
+    "../agent-runtime/runtimeToolPolicy.ts",
+    "../agent-runtime/localWorkspaceTools.ts",
+    "../agent-runtime/types.ts",
+    "../database/config.ts",
+    "../app/types.ts",
+    "../create/space/spaceKeys.ts",
+    "spaceAttachCommands.ts",
+    "cliRuntimeDoctorReport.ts",
+    "../ai/agent/agentRunDialogLineage.ts",
+    "../ai/agent/machineRunPermissions.ts",
+    "noloReadBridgePrompt.ts",
+    "../chat/messages/fetchMessages.ts",
+    "../chat/messages/types.ts",
+    "../database/server/dbPath.ts",
+    "../database/server/db.ts",
+    "../database/server/ensureDbOpen.ts",
+    "../database/server/legacyServerDb.ts",
+    "../database/server/authorityStoreTypes.ts",
+    "../database/server/serverStoreFactory.ts",
+    "../database/server/levelAuthorityStore.ts",
+    "../database/server/memoryAuthorityStore.ts",
+    "../database/keys.ts",
+    "../database/utils/ulid.ts",
     "agent-runtime/**/*.ts",
     "connector-experimental/**/*.ts",
     "app/**/*.ts",
@@ -110,10 +203,10 @@
     "ai/**/*.ts",
     "chat/**/*.ts",
     "render/**/*.ts",
-    "core/**/*.ts",
+    "share/**/*.ts",
     "auth/**/*.ts",
     "life/**/*.ts",
-    "share/**/*.ts",
+    "core/**/*.ts",
     "server/**/*.ts",
     "integrations/**/*.ts"
   ],
@@ -136,24 +229,23 @@
     "tweetnacl": "^1.0.3",
     "@reduxjs/toolkit": "^2.5.0",
     "react-redux": "^9.2.0",
-    "react-hot-toast": "^2.4.1",
     "react": "^19.2.1",
-    "browser-image-compression": "^2.0.2",
+    "react-hot-toast": "^2.4.1",
     "react-i18next": "^14.1.2",
     "i18next": "^23.11.5",
-    "ulid": "^2.3.0",
+    "browser-image-compression": "^2.0.2",
     "pino": "^9.9.0",
+    "ulid": "^2.3.0",
     "slate": "^0.112.0",
+    "slate-react": "^0.112.1",
+    "pdfjs-dist": "^5.2.133",
+    "slate-history": "^0.113.1",
     "mdast-util-from-markdown": "^2.0.2",
     "mdast-util-gfm": "^3.0.0",
     "micromark-extension-gfm": "^3.0.0",
-    "slate-history": "^0.113.1",
-    "slate-react": "^0.112.1",
-    "pdfjs-dist": "^5.2.133",
-    "rambda": "^8.6.0",
-    "react-native-blob-util": "^0.24.7",
     "@react-native-community/netinfo": "^11.5.0",
-    "react-native-sse": "^1.2.1",
+    "react-native-blob-util": "^0.24.7",
+    "rambda": "^8.6.0",
     "@lobehub/icons": "^5.0.1",
     "pizzip": "^3.2.0",
     "docxtemplater": "^3.67.5",
@@ -161,16 +253,17 @@
     "zod": "^3.25.20",
     "react-hook-form": "^7.51.5",
     "@hookform/resolvers": "^3.3.2",
+    "react-native-sse": "^1.2.1",
+    "xlsx": "^0.18.5",
     "react-router-dom": "^6.23.1",
     "croner": "^8.0.1",
-    "xlsx": "^0.18.5",
     "mermaid": "^11.6.0",
-    "js-base64": "^3.7.7",
     "react-native-keychain": "^9.2.2",
     "async-mutex": "^0.5.0",
-    "diff": "^8.0.2",
+    "js-base64": "^3.7.7",
     "react-dom": "^19.2.1",
-    "@waffo/pancake-ts": "^0.5.2",
-    "playwright": "^1.59.1"
+    "diff": "^8.0.2",
+    "playwright": "^1.59.1",
+    "@waffo/pancake-ts": "^0.5.2"
   }
 }

package/pageCreateCommands.ts

@@ -66,7 +66,7 @@ async function runBasePageCreateCommand(
     return 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write(`[nolo] ${mode} create requires an auth token with userId. Run \`nolo login\`.\n`);
@@ -82,7 +82,7 @@ async function runBasePageCreateCommand(
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
+  const serverUrl = resolveServerUrl(args, env);
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;

package/pageDeleteCommands.ts

@@ -54,7 +54,7 @@ export async function runBasePageDeleteCommand(
     return dbKey ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write(`[nolo] ${mode} delete requires an auth token with userId. Run \`nolo login\`.\n`);
@@ -64,8 +64,8 @@ export async function runBasePageDeleteCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const existing = await readRecord({

package/pageReadCommands.ts

@@ -76,7 +76,7 @@ async function runBasePageReadCommand(
     return raw ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write(`[nolo] ${mode} read requires an auth token. Run \`nolo login\` or set AUTH_TOKEN.\n`);
     return 1;
@@ -85,8 +85,8 @@ async function runBasePageReadCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
 
   try {
     const record = await readPageRecord({

package/pageUpdateCommands.ts

@@ -63,7 +63,7 @@ async function runBasePageUpdateCommand(
     return dbKey ? 0 : 1;
   }
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   const userId = parseUserIdFromAuthToken(authToken);
   if (!authToken || !userId) {
     output.write(`[nolo] ${mode} update requires an auth token with userId. Run \`nolo login\`.\n`);
@@ -73,8 +73,8 @@ async function runBasePageUpdateCommand(
   const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
-  const defaultServerUrl = resolveServerUrl(env);
-  const serverCandidates = resolveServerCandidates(env, defaultServerUrl);
+  const defaultServerUrl = resolveServerUrl(args, env);
+  const serverCandidates = resolveServerCandidates(args, env, defaultServerUrl);
   const writeTargets = [defaultServerUrl];
 
   try {

package/render/layout/mainLayoutViewMode.ts

@@ -12,6 +12,15 @@ export interface SpaceRouteContext {
   isSpaceRoute: boolean;
   isSpaceRootRoute: boolean;
   spaceId: string | null;
+  routeSection:
+    | "none"
+    | "root"
+    | "files"
+    | "ai"
+    | "scheduled"
+    | "members"
+    | "settings"
+    | "content";
 }
 
 export function isAllViewRoutePath(pathname: string): boolean {
@@ -25,6 +34,7 @@ export function getSpaceRouteContext(pathname: string): SpaceRouteContext {
       isSpaceRoute: false,
       isSpaceRootRoute: false,
       spaceId: null,
+      routeSection: "none",
     };
   }
 
@@ -37,10 +47,25 @@ export function getSpaceRouteContext(pathname: string): SpaceRouteContext {
     // Keep the encoded segment so route classification never fails on bad input.
   }
 
+  const routeSection = !descendantPath
+    ? "root"
+    : descendantPath === "files" || descendantPath.startsWith("files/")
+      ? "files"
+      : descendantPath === "ai" || descendantPath.startsWith("ai/")
+        ? "ai"
+        : descendantPath === "scheduled" || descendantPath.startsWith("scheduled/")
+          ? "scheduled"
+          : descendantPath === "members" || descendantPath.startsWith("members/")
+            ? "members"
+            : descendantPath === "settings" || descendantPath.startsWith("settings/")
+              ? "settings"
+              : "content";
+
   return {
     isSpaceRoute: true,
     isSpaceRootRoute: !descendantPath,
     spaceId,
+    routeSection,
   };
 }