nolo-cli 0.1.32 → 0.1.33

package/cli/machineCommands.ts

@@ -1,10 +1,14 @@
 import type { MachineHeartbeat } from "../connector-experimental/protocol";
-import { NOLO_CLUSTER_SERVERS, normalizeKnownServerOrigin } from "../database/config";
 import { detectMachineInfo } from "../connector-experimental/machineInfo";
+import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import {
   type HeartbeatLoopOptions,
   runHeartbeatLoop as defaultRunHeartbeatLoop,
 } from "../connector-experimental/heartbeatLoop";
+import {
+  buildMachinePermissionPromptBlock,
+  resolveMachineRunPermissionPolicy,
+} from "../ai/agent/machineRunPermissions";
 import { resolveConnectorWebSocketTarget } from "./connectorWebSocketTarget";
 import {
   checkConnectorWorkspaceLinks,
@@ -21,24 +25,14 @@ import {
   runMachineWsSession,
   type ConnectorWebSocketOptions,
 } from "./machineWsSession";
-import {
-  buildConnectorCliPrompt,
-} from "./machineCommandPrompts";
-import {
-  hasFlag,
-  readOption,
-  resolveConnectAuthToken,
-  resolveConnectServerUrl,
-  resolveConnectorReconnectDelayMs,
-  writeAuthMissing,
-  type EnvLike,
-  type OutputLike,
-} from "./machineCommandResolution";
 export {
   formatMachineStatus,
   runMachineStatusCommand,
   type MachineSummary,
 } from "./machineStatusCommands";
+
+type EnvLike = Record<string, string | undefined>;
+type OutputLike = { write(chunk: string): unknown };
 
 type MachineCommandDeps = {
   env?: EnvLike;
@@ -61,8 +55,50 @@ type MachineCommandDeps = {
   }) => { pid?: number };
 };
 
+function resolveServerUrl(env: EnvLike) {
+  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
+}
+
+function resolveAuthToken(env: EnvLike) {
+  return env.AUTH_TOKEN || env.AUTH || "";
+}
+
+function writeAuthMissing(output: OutputLike) {
+  output.write(
+    "[nolo] Machine commands require an auth token. Run `nolo login` or set AUTH_TOKEN.\n"
+  );
+}
+
+function hasFlag(args: string[], flag: string) {
+  return args.includes(flag);
+}
+
+function readOption(args: string[], flag: string) {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === flag) {
+      const next = args[i + 1];
+      if (typeof next === "string" && !next.startsWith("-")) return next;
+      return "";
+    }
+    if (arg.startsWith(flag + "=")) {
+      return arg.slice(flag.length + 1);
+    }
+  }
+  return "";
+}
+
+function resolveConnectServerUrl(args: string[], env: EnvLike) {
+  const fromFlag = readOption(args, "--server-url") || readOption(args, "--server");
+  const raw = fromFlag || env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL;
+  return String(raw).replace(/\/+$|\s+$/g, "").replace(/\/+$/g, "").replace(/\s+$/g, "");
+}
+
+function resolveConnectAuthToken(args: string[], env: EnvLike) {
+  return readOption(args, "--api-key") || readOption(args, "--token") || resolveAuthToken(env);
+}
+
 const defaultSleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
-const MACHINE_TOKEN_PREFIX = "sk_machine_";
 
 async function sleepWithAbort(ms: number, sleep: (ms: number) => Promise<void>, signal?: AbortSignal) {
   if (!signal) {
@@ -83,80 +119,6 @@ function resolveConnectorReconnectDelayMs(env: EnvLike) {
   return Number.isFinite(raw) && raw >= 0 ? raw : 5_000;
 }
 
-function isMachineToken(token: string) {
-  return token.trim().startsWith(MACHINE_TOKEN_PREFIX);
-}
-
-function resolveClusterConnectServerUrls(serverUrl: string, authToken: string) {
-  const normalizedPrimary = normalizeKnownServerOrigin(serverUrl) ?? serverUrl.trim().replace(/\/+$/, "");
-  if (isMachineToken(authToken)) return [normalizedPrimary];
-  const normalizedCluster = NOLO_CLUSTER_SERVERS
-    .map((baseUrl) => normalizeKnownServerOrigin(baseUrl) ?? baseUrl)
-    .filter((value, index, list) => value && list.indexOf(value) === index);
-  if (!normalizedCluster.includes(normalizedPrimary)) return [normalizedPrimary];
-  return [normalizedPrimary, ...normalizedCluster.filter((baseUrl) => baseUrl !== normalizedPrimary)];
-}
-
-function linkAbortSignal(signal: AbortSignal | undefined, controller: AbortController) {
-  if (!signal) return;
-  if (signal.aborted) {
-    controller.abort();
-    return;
-  }
-  signal.addEventListener("abort", () => controller.abort(), { once: true });
-}
-
-async function sendMachineHeartbeat(args: {
-  serverUrl: string;
-  authToken: string;
-  fetchImpl: typeof fetch;
-  machine: MachineHeartbeat;
-}) {
-  const res = await args.fetchImpl(`${args.serverUrl}/api/machines/heartbeat`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${args.authToken}`,
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify(args.machine),
-  });
-
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`HTTP ${res.status}\n${text}`);
-  }
-}
-
-async function sendHeartbeatAcrossServers(args: {
-  serverUrls: string[];
-  authToken: string;
-  fetchImpl: typeof fetch;
-  machine: MachineHeartbeat;
-  output: OutputLike;
-}) {
-  let primaryError: Error | null = null;
-  for (const [index, serverUrl] of args.serverUrls.entries()) {
-    try {
-      await sendMachineHeartbeat({
-        serverUrl,
-        authToken: args.authToken,
-        fetchImpl: args.fetchImpl,
-        machine: args.machine,
-      });
-    } catch (error) {
-      const resolvedError = error instanceof Error ? error : new Error(String(error));
-      if (index === 0) {
-        primaryError = resolvedError;
-      } else {
-        args.output.write(
-          `[nolo] secondary connector registration failed for ${serverUrl}: ${resolvedError.message}\n`
-        );
-      }
-    }
-  }
-  if (primaryError) throw primaryError;
-}
-
 async function defaultExecuteCli(
   provider: string,
   prompt: string,
@@ -169,11 +131,75 @@ async function defaultExecuteCli(
 function detectLaunchableMachineInfo() {
   return detectMachineInfo({ probeLaunchable: true });
 }
+
+function inferTaskRunRole(agentKey: string, agentConfig: any) {
+  const haystack = [
+    agentKey,
+    agentConfig?.name,
+    agentConfig?.prompt,
+  ].filter(Boolean).join("\n").toLowerCase();
+  if (haystack.includes("frontend") || haystack.includes("前端")) return "frontend";
+  if (haystack.includes("fullstack") || haystack.includes("全栈")) return "fullstack";
+  if (haystack.includes("review") || haystack.includes("审查")) return "reviewer";
+  if (haystack.includes("project-manager") || haystack.includes("项目经理")) return "pm";
+  return "codex";
+}
+
+function buildTaskRunBridgePrompt(args: {
+  agentKey: string;
+  agentConfig: any;
+  runtimeContext: any;
+}) {
+  const taskRun = args.runtimeContext?.taskRun;
+  const rowDbKey = typeof taskRun?.rowDbKey === "string" ? taskRun.rowDbKey.trim() : "";
+  if (!rowDbKey) return "";
+  const workItemId = typeof taskRun?.workItemId === "string" ? taskRun.workItemId.trim() : "";
+  const role = inferTaskRunRole(args.agentKey, args.agentConfig);
+  return [
+    "--- Nolo task-run tool bridge ---",
+    "This CLI runtime does not receive server-side function tools directly.",
+    "Use the local task-run bridge command for durable task state writes. Do not edit meta.taskRun with table or database commands.",
+    "Run commands from the repository root. The runner already provides server URL and auth in the environment.",
+    "Release boundary: after review passes, AI/reviewer/Codex may advance alpha for verification. Do not merge, push, or release main/release unless the human owner explicitly authorizes it in the current task context.",
+    "Cost boundary: read taskRun.control from context. Prefer low-cost/free-window models for routine work, and reserve Codex for supervision, quality gates, complex unblocking, and main/release decisions.",
+    "Handoff context: start from read-context, then inspect existing refs such as workItems.dialogIds, workItems.outcome, review.dialogId, activityRefs, agentRuns.dialogId/resultSummary, and artifactRefs. Use dialog read/search for exact evidence; do not infer completion from handoff text alone.",
+    `Read context: bun packages/cli/index.ts task-run read-context --row-dbkey ${JSON.stringify(rowDbKey)}`,
+    ...(workItemId
+      ? [
+          `Claim work item: bun packages/cli/index.ts task-run claim-work-item --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --agent-key ${JSON.stringify(args.agentKey)} --role ${role}`,
+          `Set blocker: bun packages/cli/index.ts task-run set-blocker --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --layer tool --code <CODE> --message <MESSAGE>`,
+          `Clear resolved blocker: bun packages/cli/index.ts task-run clear-blocker --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --blocker-id <BLOCKER_ID>`,
+          `Submit outcome: bun packages/cli/index.ts task-run submit-outcome --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --summary <SUMMARY>`,
+          `Request review: bun packages/cli/index.ts task-run request-review --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --reviewer-agent-key <AGENT_KEY> --message <MESSAGE>`,
+          `Record review: bun packages/cli/index.ts task-run record-review --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --review-status <passed|needs_changes|blocked> --reviewer-agent-key ${JSON.stringify(args.agentKey)} --findings <FINDINGS>`,
+          `Close work item: bun packages/cli/index.ts task-run close-work-item --row-dbkey ${JSON.stringify(rowDbKey)} --work-item-id ${JSON.stringify(workItemId)} --summary <SUMMARY>`,
+        ]
+      : []),
+    "If a bridge command fails, report the exact command and error.",
+  ].join("\n");
+}
+
+function buildConnectorCliPrompt(agentConfig: any, userInput: string, bridgeArgs?: {
+  agentKey: string;
+  runtimeContext: any;
+}, permissionPolicy?: ReturnType<typeof resolveMachineRunPermissionPolicy>) {
+  const policy = permissionPolicy ?? resolveMachineRunPermissionPolicy(agentConfig);
+  return [
+    typeof agentConfig?.prompt === "string" ? agentConfig.prompt.trim() : "",
+    bridgeArgs ? buildTaskRunBridgePrompt({
+      agentKey: bridgeArgs.agentKey,
+      agentConfig,
+      runtimeContext: bridgeArgs.runtimeContext,
+    }) : "",
+    buildMachinePermissionPromptBlock(policy),
+    `--- User task ---\n${userInput}`,
+  ].filter(Boolean).join("\n\n");
+}
 
 export async function runMachineConnectCommand(
-  args: string[],
-  deps: MachineCommandDeps = {}
-) {
+  args: string[],
+  deps: MachineCommandDeps = {}
+) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
   const authToken = resolveConnectAuthToken(args, env);
@@ -181,31 +207,29 @@ export async function runMachineConnectCommand(
     writeAuthMissing(output);
     return 1;
   }
-
+
   const serverUrl = resolveConnectServerUrl(args, env);
-  const serverUrls = resolveClusterConnectServerUrls(serverUrl, authToken);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
   const sendHeartbeat = async () => {
-    await sendHeartbeatAcrossServers({
-      serverUrls,
-      authToken,
-      fetchImpl,
-      machine,
-      output,
-    });
-  };
+    const res = await fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(machine),
+    });
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`HTTP ${res.status}\n${text}`);
+    }
+  };
 
   if (hasFlag(args, "--daemon") || hasFlag(args, "--background")) {
     return runMachineDaemonCommand({
-      env: {
-        ...env,
-        NOLO_SERVER: serverUrl,
-        NOLO_SERVER_URL: serverUrl,
-        BASE_URL: serverUrl,
-        AUTH_TOKEN: authToken,
-        NOLO_MACHINE_API_KEY: authToken,
-      },
+      env,
       output,
       cliEntrypointPath: deps.cliEntrypointPath,
       validateWorkspaceLinks: deps.validateWorkspaceLinks,
@@ -221,88 +245,63 @@ export async function runMachineConnectCommand(
     const maxAttempts = deps.maxConnectorAttempts ?? Infinity;
     const sleep = deps.sleep ?? defaultSleep;
     const reconnectDelayMs = resolveConnectorReconnectDelayMs(env);
-    const runServerSession = async (targetServerUrl: string, signal?: AbortSignal) => {
-      for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-        if (signal?.aborted) {
-          return { serverUrl: targetServerUrl, exitCode: 0 };
-        }
-        const runtimeServerUrl =
-          env.NOLO_CONNECT_RUNTIME_SERVER_URL ||
-          env.NOLO_RUNTIME_SERVER_URL ||
-          targetServerUrl;
-        const sessionResult = await runMachineWsSession({
-          env,
-          output,
-          signal,
-          machine,
-          sendHeartbeat: () =>
-            sendMachineHeartbeat({
-              serverUrl: targetServerUrl,
-              authToken,
-              fetchImpl,
-              machine,
-            }),
-          runHeartbeatLoop: deps.runHeartbeatLoop ?? defaultRunHeartbeatLoop,
-          connectWebSocket: deps.connectWebSocket ?? defaultConnectWebSocket,
-          serverUrl: targetServerUrl,
-          authToken,
-          resolveConnectorWebSocketTarget: (options) =>
-            resolveConnectorWebSocketTarget({
-              ...options,
-              fetchImpl,
-            }),
-          onMessage: (message, send) =>
-            handleConnectorRunMessage(
-              message,
-              send,
-              deps.executeCli ?? defaultExecuteCli,
-              {
-                ...env,
-                NOLO_SERVER: runtimeServerUrl,
-                NOLO_SERVER_URL: runtimeServerUrl,
-                BASE_URL: runtimeServerUrl,
-                AUTH_TOKEN: authToken,
-                NOLO_MACHINE_API_KEY: authToken,
-              },
-              fetchImpl,
-              {
-                buildConnectorCliPrompt,
-              }
-            ),
-        });
-        const exitCode = sessionResult.exitCode;
-        if (exitCode === 2) return { serverUrl: targetServerUrl, exitCode: 2 };
-        if (signal?.aborted) {
-          return { serverUrl: targetServerUrl, exitCode: 0 };
-        }
-        if (attempt >= maxAttempts) return { serverUrl: targetServerUrl, exitCode };
-        const retryDelayMs = sessionResult.retryAfterMs ?? reconnectDelayMs;
-        const reconnectContext =
-          sessionResult.reconnectReason === "core_draining" ? " during core draining" : "";
-        output.write(
-          `[nolo] Connector websocket disconnected${reconnectContext}. Reconnecting in ${retryDelayMs}ms.\n`
-        );
-        await sleepWithAbort(retryDelayMs, sleep, signal);
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+      if (deps.signal?.aborted) {
+        return 0;
       }
-      return { serverUrl: targetServerUrl, exitCode: 0 };
-    };
-
-    const sessionAbort = new AbortController();
-    linkAbortSignal(deps.signal, sessionAbort);
-
-    const sessionPromises = serverUrls.map(async (targetServerUrl, index) => {
-      const result = await runServerSession(targetServerUrl, sessionAbort.signal);
-      if (index > 0 && result.exitCode !== 0 && !sessionAbort.signal.aborted) {
-        output.write(
-          `[nolo] secondary connector registration failed for ${targetServerUrl}: exit ${result.exitCode}\n`
-        );
+      const runtimeServerUrl =
+        env.NOLO_CONNECT_RUNTIME_SERVER_URL ||
+        env.NOLO_RUNTIME_SERVER_URL ||
+        serverUrl;
+      const sessionResult = await runMachineWsSession({
+        env,
+        output,
+        signal: deps.signal,
+        machine,
+        sendHeartbeat,
+        runHeartbeatLoop: deps.runHeartbeatLoop ?? defaultRunHeartbeatLoop,
+        connectWebSocket: deps.connectWebSocket ?? defaultConnectWebSocket,
+        serverUrl,
+        authToken,
+        resolveConnectorWebSocketTarget: (options) =>
+          resolveConnectorWebSocketTarget({
+            ...options,
+            fetchImpl,
+          }),
+        onMessage: (message, send) =>
+          handleConnectorRunMessage(
+            message,
+            send,
+            deps.executeCli ?? defaultExecuteCli,
+            {
+              ...env,
+              NOLO_SERVER: runtimeServerUrl,
+              NOLO_SERVER_URL: runtimeServerUrl,
+              BASE_URL: runtimeServerUrl,
+              AUTH_TOKEN: authToken,
+              NOLO_MACHINE_API_KEY: authToken,
+            },
+            fetchImpl,
+            {
+              buildConnectorCliPrompt,
+            }
+          ),
+      });
+      const exitCode = sessionResult.exitCode;
+      if (exitCode === 2) return 1;
+      if (deps.signal?.aborted) {
+        return 0;
       }
-      return result;
-    });
-    const results = await Promise.all(sessionPromises);
-    if (results.some((result) => result.exitCode === 0)) return 0;
-    if (results.some((result) => result.exitCode === 2)) return 1;
-    return results[0]?.exitCode ?? 1;
+      if (attempt >= maxAttempts) return exitCode;
+      const retryDelayMs = sessionResult.retryAfterMs ?? reconnectDelayMs;
+      const reconnectContext =
+        sessionResult.reconnectReason === "core_draining" ? " during core draining" : "";
+      output.write(
+        `[nolo] Connector websocket disconnected${reconnectContext}. Reconnecting in ${retryDelayMs}ms.\n`
+      );
+      await sleepWithAbort(retryDelayMs, sleep, deps.signal);
+    }
+    return 0;
   }
 
   if (hasFlag(args, "--watch")) {

package/cli/machineDaemonCommands.ts

@@ -1,11 +1,153 @@
-import {
-  checkConnectorWorkspaceLinks,
-  runConnectorDaemon,
-  type ConnectorDaemonDeps,
-} from "../connector-experimental/daemonLauncher";
-import type { OutputLike } from "./cliIoTypes";
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, openSync, readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 
 type EnvLike = Record<string, string | undefined>;
+type OutputLike = { write(chunk: string): unknown };
+
+type PackageJson = {
+  name?: string;
+  workspaces?: string[] | { packages?: string[] };
+};
+
+const CONNECTOR_RUNTIME_WORKSPACE_PACKAGES = new Set([
+  "connector-experimental",
+  "ai",
+]);
+
+function readJsonFile<T>(path: string): T | null {
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as T;
+  } catch {
+    return null;
+  }
+}
+
+function getWorkspacePatterns(packageJson: PackageJson) {
+  if (Array.isArray(packageJson.workspaces)) return packageJson.workspaces;
+  return packageJson.workspaces?.packages ?? [];
+}
+
+function normalizePath(path: string) {
+  const resolved = resolve(path);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+
+function isInsideOrSame(path: string, parent: string) {
+  const relativePath = relative(parent, path);
+  return relativePath === "" || (!relativePath.startsWith("..") && !isAbsolute(relativePath));
+}
+
+function findWorkspaceRoot(startPath: string) {
+  let current = resolve(startPath);
+  while (true) {
+    const packageJsonPath = join(current, "package.json");
+    if (existsSync(packageJsonPath)) {
+      const packageJson = readJsonFile<PackageJson>(packageJsonPath);
+      if (packageJson && getWorkspacePatterns(packageJson).length > 0) {
+        return current;
+      }
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function validateConnectorWorkspaceLinks(cwd: string) {
+  const repoRoot = findWorkspaceRoot(cwd);
+  if (!repoRoot) return [];
+
+  const rootPackageJson = readJsonFile<PackageJson>(join(repoRoot, "package.json"));
+  if (!rootPackageJson) return [];
+
+  const normalizedRepoRoot = normalizePath(realpathSync(repoRoot));
+  const errors: string[] = [];
+
+  for (const pattern of getWorkspacePatterns(rootPackageJson)) {
+    if (!pattern.endsWith("/*")) continue;
+    const workspaceParent = join(repoRoot, pattern.slice(0, -2));
+    if (!existsSync(workspaceParent)) continue;
+
+    for (const entry of Array.from(new Bun.Glob("*/package.json").scanSync({ cwd: workspaceParent }))) {
+      const packageDir = join(workspaceParent, dirname(entry));
+      const packageJson = readJsonFile<PackageJson>(join(workspaceParent, entry));
+      if (!packageJson?.name || !CONNECTOR_RUNTIME_WORKSPACE_PACKAGES.has(packageJson.name)) {
+        continue;
+      }
+
+      const linkPath = join(repoRoot, "node_modules", ...packageJson.name.split("/"));
+      if (!existsSync(linkPath)) {
+        errors.push(`${linkPath} is missing. Run bun install in ${repoRoot}.`);
+        continue;
+      }
+
+      const actualPath = normalizePath(realpathSync(linkPath));
+      const expectedPath = normalizePath(realpathSync(packageDir));
+      if (!isInsideOrSame(actualPath, normalizedRepoRoot)) {
+        errors.push(
+          `${linkPath} points outside this checkout: ${actualPath}. Run bun install in ${repoRoot}.`,
+        );
+        continue;
+      }
+      if (actualPath !== expectedPath) {
+        errors.push(
+          `${linkPath} points at ${actualPath}, expected ${expectedPath}. Run bun install in ${repoRoot}.`,
+        );
+      }
+    }
+  }
+
+  return errors;
+}
+
+export async function checkConnectorWorkspaceLinks(
+  cwd: string,
+  output: OutputLike,
+  validateWorkspaceLinks: (cwd: string) => string[] | Promise<string[]>,
+) {
+  const errors = await validateWorkspaceLinks(cwd);
+  if (errors.length === 0) return true;
+  output.write(
+    [
+      "[nolo] Connector workspace package links are unsafe.",
+      "The connector would import workspace packages from a different checkout, so machine capabilities and runtime behavior may be stale.",
+      ...errors,
+      "",
+    ].join("\n"),
+  );
+  return false;
+}
+
+function resolveDaemonLogPath(env: EnvLike) {
+  return env.NOLO_CONNECT_LOG || join(homedir(), ".nolo", "logs", "connector.log");
+}
+
+function buildDaemonCommand(cliEntrypointPath: string | undefined) {
+  return [process.execPath, cliEntrypointPath || import.meta.path, "connect", "--ws"];
+}
+
+function defaultSpawnDaemon(args: {
+  cmd: string[];
+  cwd: string;
+  env: EnvLike;
+  logPath: string;
+}) {
+  mkdirSync(dirname(args.logPath), { recursive: true });
+  const out = openSync(args.logPath, "a");
+  const env = Object.fromEntries(
+    Object.entries(args.env).filter((entry): entry is [string, string] => typeof entry[1] === "string")
+  );
+  const proc = spawn(args.cmd[0], args.cmd.slice(1), {
+    cwd: args.cwd,
+    env,
+    detached: true,
+    stdio: ["ignore", out, out],
+  });
+  proc.unref();
+  return { pid: proc.pid };
+}
 
 export type MachineDaemonCommandDeps = {
   env?: EnvLike;
@@ -23,7 +165,21 @@ export type MachineDaemonCommandDeps = {
 export async function runMachineDaemonCommand(
   deps: MachineDaemonCommandDeps = {}
 ) {
-  return runConnectorDaemon(deps as ConnectorDaemonDeps);
-}
+  const env = deps.env ?? process.env;
+  const output = deps.output ?? process.stdout;
+  const validateWorkspaceLinks = deps.validateWorkspaceLinks ?? validateConnectorWorkspaceLinks;
 
-export { checkConnectorWorkspaceLinks };
+  if (!(await checkConnectorWorkspaceLinks(process.cwd(), output, validateWorkspaceLinks))) {
+    return 1;
+  }
+
+  const logPath = resolveDaemonLogPath(env);
+  const result = (deps.spawnDaemon ?? defaultSpawnDaemon)({
+    cmd: buildDaemonCommand(deps.cliEntrypointPath),
+    cwd: process.cwd(),
+    env,
+    logPath,
+  });
+  output.write(`Connector daemon started${result.pid ? ` pid=${result.pid}` : ""}. Log: ${logPath}\n`);
+  return 0;
+}

package/cli/machineHeartbeatCommands.ts

@@ -1,5 +1,6 @@
 import type { MachineHeartbeat } from "../connector-experimental/protocol";
-import type { OutputLike } from "./cliIoTypes";
+
+type OutputLike = { write(chunk: string): unknown };
 
 export type MachineHeartbeatConnectDeps = {
   output?: OutputLike;

package/cli/machineStatusCommands.ts

@@ -1,7 +1,7 @@
-import type { OutputLike } from "./cliIoTypes";
-import { resolveAuthToken, resolveServerUrl } from "./cliEnvHelpers";
+import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 
 type EnvLike = Record<string, string | undefined>;
+type OutputLike = { write(chunk: string): unknown };
 
 export type MachineSummary = {
   machineId: string;
@@ -21,6 +21,14 @@ export type MachineStatusCommandDeps = {
   fetchImpl?: typeof fetch;
 };
 
+function resolveServerUrl(env: EnvLike) {
+  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
+}
+
+function resolveAuthToken(env: EnvLike) {
+  return env.AUTH_TOKEN || env.AUTH || "";
+}
+
 function writeAuthMissing(output: OutputLike) {
   output.write(
     "[nolo] Machine commands require an auth token. Run `nolo login` or set AUTH_TOKEN.\n"
@@ -44,18 +52,18 @@ export function formatMachineStatus(machines: MachineSummary[]) {
 }
 
 export async function runMachineStatusCommand(
-  args: string[],
+  _args: string[],
   deps: MachineStatusCommandDeps = {}
 ) {
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
-  const authToken = resolveAuthToken(args, env);
+  const authToken = resolveAuthToken(env);
   if (!authToken) {
     writeAuthMissing(output);
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(args, env);
+  const serverUrl = resolveServerUrl(env);
   const fetchImpl = deps.fetchImpl ?? fetch;
   let res: Response;
   try {