nolo-cli 0.1.33 → 0.1.35

package/agent-runtime/providerResolution.ts

@@ -0,0 +1,242 @@
+import type { AgentRuntimeAgentConfig } from "./hostAdapter";
+import { pickAgentRuntimeInferenceOptions } from "./agentConfigOptions";
+
+type EnvLike = Record<string, string | undefined>;
+
+const PROVIDER_ENDPOINTS: Record<string, string> = {
+  deepinfra: "https://api.deepinfra.com/v1/openai/chat/completions",
+  deepseek: "https://api.deepseek.com/chat/completions",
+  fireworks: "https://api.fireworks.ai/inference/v1/chat/completions",
+  google: "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions",
+  mistral: "https://api.mistral.ai/v1/chat/completions",
+  mimo: "https://token-plan-cn.xiaomimimo.com/v1/chat/completions",
+  openai: "https://api.openai.com/v1/chat/completions",
+  openrouter: "https://openrouter.ai/api/v1/chat/completions",
+};
+
+export type AgentProviderMode = "cli" | "platform" | "custom";
+export type ProviderExecutionTransport = "direct" | "proxy";
+
+type ProviderExecutionPlanBase = {
+  mode: AgentProviderMode;
+  transport: ProviderExecutionTransport;
+  model: string;
+  provider: string;
+  requestOptions: Record<string, number | string>;
+};
+
+export type CliProviderExecutionPlan = ProviderExecutionPlanBase & {
+  mode: "cli";
+  transport: "direct";
+  cliProvider: string;
+};
+
+export type DirectProviderExecutionPlan = ProviderExecutionPlanBase & {
+  mode: "platform" | "custom";
+  transport: "direct";
+  endpoint: string;
+  apiKey: string;
+  apiKeyHeader?: string;
+};
+
+export type ProxyProviderExecutionPlan = ProviderExecutionPlanBase & {
+  mode: "platform" | "custom";
+  transport: "proxy";
+  endpoint: string;
+  serverUrl: string;
+  authToken: string;
+  agentKey: string;
+  apiSource?: string;
+  apiKey?: string;
+  apiKeyHeader?: string;
+};
+
+export type ProviderExecutionPlan =
+  | CliProviderExecutionPlan
+  | DirectProviderExecutionPlan
+  | ProxyProviderExecutionPlan;
+
+export function trimTrailingSlash(value: string) {
+  return value.trim().replace(/\/+$/, "");
+}
+
+export function resolveChatCompletionsEndpoint(value: string) {
+  const trimmed = trimTrailingSlash(value);
+  return trimmed.endsWith("/chat/completions")
+    ? trimmed
+    : `${trimmed}/chat/completions`;
+}
+
+export function resolveOpenAiCompatibleBaseUrl(env: EnvLike) {
+  return env.NOLO_LOCAL_OPENAI_BASE_URL || env.OPENAI_BASE_URL || "https://api.openai.com/v1";
+}
+
+export function resolveOpenAiCompatibleApiKey(env: EnvLike) {
+  return env.OPENAI_API_KEY || env.NOLO_LOCAL_OPENAI_API_KEY || "";
+}
+
+export function resolvePlatformServerUrl(env: EnvLike) {
+  return trimTrailingSlash(env.NOLO_SERVER || env.BASE_URL || "https://nolo.chat");
+}
+
+export function resolvePlatformAuthToken(env: EnvLike) {
+  return env.AUTH_TOKEN || env.AUTH || env.BENCHMARK_AUTH_TOKEN || "";
+}
+
+export function canUsePlatformChatProvider(env: EnvLike) {
+  return Boolean(resolvePlatformAuthToken(env));
+}
+
+export function hasDirectOpenAiCompatibleProvider(env: EnvLike) {
+  return Boolean(
+    env.NOLO_LOCAL_OPENAI_API_KEY ||
+      env.OPENAI_API_KEY ||
+      env.NOLO_LOCAL_OPENAI_BASE_URL ||
+      env.OPENAI_BASE_URL ||
+      env.OLLAMA_BASE_URL
+  );
+}
+
+function resolvePlatformProviderEndpoint(agentConfig: AgentRuntimeAgentConfig) {
+  const customProviderUrl = agentConfig.customProviderUrl?.trim();
+  if (customProviderUrl) return resolveChatCompletionsEndpoint(customProviderUrl);
+
+  const provider = agentConfig.provider?.trim().toLowerCase();
+  if (!provider) {
+    throw new Error("Platform chat provider requires agentConfig.provider.");
+  }
+  const endpoint = PROVIDER_ENDPOINTS[provider];
+  if (!endpoint) {
+    throw new Error(`Platform chat provider does not support provider "${provider}".`);
+  }
+  return endpoint;
+}
+
+export function resolveAgentProviderMode(agentConfig: AgentRuntimeAgentConfig): AgentProviderMode {
+  if (agentConfig.apiSource === "cli" || agentConfig.provider === "cli" || agentConfig.cliProvider) {
+    return "cli";
+  }
+  if (agentConfig.apiSource === "custom" || agentConfig.customProviderUrl) {
+    return "custom";
+  }
+  return "platform";
+}
+
+export function shouldUsePlatformProxyTransport(
+  env: EnvLike,
+  agentConfig?: AgentRuntimeAgentConfig
+) {
+  if (agentConfig?.apiSource === "platform" || agentConfig?.useServerProxy === true) return true;
+  if (env.NOLO_LOCAL_LLM === "platform") return true;
+  if (env.NOLO_LOCAL_LLM === "direct") return false;
+  return !hasDirectOpenAiCompatibleProvider(env) && canUsePlatformChatProvider(env);
+}
+
+export function resolveProviderAuthHeaderName(args: {
+  endpoint: string;
+  apiKeyHeader?: string;
+}) {
+  const explicitHeader = args.apiKeyHeader?.trim();
+  if (explicitHeader) return explicitHeader;
+  if (/xiaomimimo\.com/i.test(args.endpoint)) return "api-key";
+  return "Authorization";
+}
+
+export function buildProviderAuthHeaders(args: {
+  endpoint: string;
+  apiKey: string;
+  apiKeyHeader?: string;
+}) {
+  if (!args.apiKey) return {};
+  const headerName = resolveProviderAuthHeaderName(args);
+  return headerName.toLowerCase() === "authorization"
+    ? { Authorization: `Bearer ${args.apiKey}` }
+    : { [headerName]: args.apiKey };
+}
+
+export function buildProviderExecutionPlan(args: {
+  agentConfig: AgentRuntimeAgentConfig;
+  env: EnvLike;
+  runtimeKind: "local" | "desktop" | "server";
+}): ProviderExecutionPlan {
+  const { agentConfig, env } = args;
+  const mode = resolveAgentProviderMode(agentConfig);
+  const model = agentConfig.model || "gpt-4.1-mini";
+  const requestOptions = pickAgentRuntimeInferenceOptions(agentConfig);
+
+  if (mode === "cli") {
+    return {
+      mode,
+      transport: "direct",
+      cliProvider: agentConfig.cliProvider || agentConfig.provider || "codex",
+      model,
+      provider: agentConfig.provider || "cli",
+      requestOptions,
+    };
+  }
+
+  if (mode === "custom") {
+    const endpoint = resolveChatCompletionsEndpoint(agentConfig.customProviderUrl || resolveOpenAiCompatibleBaseUrl(env));
+    const apiKey = agentConfig.apiKey?.trim() || agentConfig.apiKeyFromAgentKey?.trim() || "";
+    const apiKeyHeader = resolveProviderAuthHeaderName({
+      endpoint,
+      apiKeyHeader: agentConfig.apiKeyHeader,
+    });
+    if (agentConfig.useServerProxy) {
+      return {
+        mode,
+        transport: "proxy",
+        model,
+        provider: agentConfig.provider || "custom",
+        endpoint,
+        requestOptions,
+        serverUrl: resolvePlatformServerUrl(env),
+        authToken: resolvePlatformAuthToken(env),
+        agentKey: agentConfig.key,
+        ...(agentConfig.apiSource ? { apiSource: agentConfig.apiSource } : {}),
+        ...(apiKey ? { apiKey } : {}),
+        ...(apiKeyHeader ? { apiKeyHeader } : {}),
+      };
+    }
+    return {
+      mode,
+      transport: "direct",
+      model,
+      provider: agentConfig.provider || "custom",
+      endpoint,
+      requestOptions,
+      apiKey,
+      ...(apiKeyHeader ? { apiKeyHeader } : {}),
+    };
+  }
+
+  const provider = agentConfig.provider || agentConfig.apiSource || "openai";
+  const endpoint = shouldUsePlatformProxyTransport(env, agentConfig)
+    ? resolvePlatformProviderEndpoint(agentConfig)
+    : resolveChatCompletionsEndpoint(resolveOpenAiCompatibleBaseUrl(env));
+  if (shouldUsePlatformProxyTransport(env, agentConfig)) {
+    return {
+      mode,
+      transport: "proxy",
+      model,
+      provider,
+      endpoint,
+      requestOptions,
+      serverUrl: resolvePlatformServerUrl(env),
+      authToken: resolvePlatformAuthToken(env),
+      agentKey: agentConfig.key,
+      ...(agentConfig.apiSource ? { apiSource: agentConfig.apiSource } : {}),
+      ...(agentConfig.apiKey?.trim() ? { apiKey: agentConfig.apiKey.trim() } : {}),
+      ...(agentConfig.apiKeyHeader?.trim() ? { apiKeyHeader: agentConfig.apiKeyHeader.trim() } : {}),
+    };
+  }
+  return {
+    mode,
+    transport: "direct",
+    model,
+    provider: agentConfig.provider || "openai-compatible",
+    endpoint,
+    requestOptions,
+    apiKey: resolveOpenAiCompatibleApiKey(env),
+  };
+}

package/agent-runtime/runtimeToolPolicy.ts

@@ -46,6 +46,16 @@ export function normalizeAgentRuntimeToolPolicy(
   };
 }
 
+function runtimeBindingRecord(
+  runtimeBinding: unknown,
+): Record<string, unknown> | undefined {
+  return isRecord(runtimeBinding) ? runtimeBinding : undefined;
+}
+
+function runtimeToolNamesFromPolicy(policy: AgentRuntimeToolPolicy | undefined) {
+  return stringArray(policy?.runtimeTools);
+}
+
 export function mergeAgentRuntimeToolPolicies(
   base?: AgentRuntimeToolPolicy,
   override?: AgentRuntimeToolPolicy,
@@ -77,6 +87,29 @@ export function mergeAgentRuntimeToolPolicies(
   };
 }
 
+export function resolveRequestedRuntimeToolNames(args: {
+  agentConfig: Pick<
+    AgentRuntimeAgentConfig,
+    "toolNames" | "runtimeToolPolicy" | "runtimeBinding"
+  >;
+}) {
+  const runtimeBinding = runtimeBindingRecord(args.agentConfig.runtimeBinding);
+  const bindingPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicy,
+  );
+  const bindingSnapshotPolicy = normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot,
+  );
+  return unique([
+    ...stringArray(args.agentConfig.toolNames),
+    ...runtimeToolNamesFromPolicy(
+      normalizeAgentRuntimeToolPolicy(args.agentConfig.runtimeToolPolicy),
+    ),
+    ...runtimeToolNamesFromPolicy(bindingPolicy),
+    ...runtimeToolNamesFromPolicy(bindingSnapshotPolicy),
+  ]);
+}
+
 function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
   if (!policy) return false;
   const workspaceMode = policy.workspace?.mode;

package/agent-runtime/shellCommandPolicy.ts

@@ -0,0 +1,120 @@
+export type ShellCommandPolicyVerdict = "allowed" | "forbidden";
+
+export type ShellCommandPolicyResult =
+  | {
+      verdict: "allowed";
+    }
+  | {
+      verdict: "forbidden";
+      code: "destructive_action_requires_confirmation";
+      reason: string;
+      policy: {
+        capability: "destructive_action";
+        target: "shell_command";
+        detail: string;
+      };
+    };
+
+const DESTRUCTIVE_NEGATION_PATTERNS = [
+  "别删",
+  "别删除",
+  "不要删",
+  "不要删除",
+  "别乱删",
+  "别动",
+  "不要动",
+  "不要清理",
+  "不要清空",
+  "不要重置",
+  "don't delete",
+  "do not delete",
+  "don't remove",
+  "do not remove",
+  "without deleting",
+] as const;
+
+const EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS = [
+  "删除",
+  "删掉",
+  "移除",
+  "清理",
+  "清空",
+  "重置",
+  "drop",
+  "delete",
+  "remove",
+  "erase",
+  "clean up",
+  "reset",
+] as const;
+
+const SHELL_DESTRUCTIVE_PATTERNS = [
+  /\brm\s+(-[^\n\r]*\s+)?/i,
+  /\bremove-item\b/i,
+  /\bdel\s+\/?[a-z]*\s+/i,
+  /\berase\s+/i,
+  /\brmdir\s+/i,
+  /\brd\s+\/s\b/i,
+  /\bgit\s+reset\s+(--hard\b|--merge\b|--keep\b)/i,
+  /\bgit\s+clean\s+-[^\n\r]*f/i,
+  /\bgit\s+checkout\s+--\b/i,
+  /\bgit\s+restore\s+--source=/i,
+] as const;
+
+const normalizeUserInput = (value: unknown): string =>
+  typeof value === "string" ? value.trim().toLowerCase() : "";
+
+const containsAny = (text: string, patterns: readonly string[]): boolean =>
+  patterns.some((pattern) => text.includes(pattern));
+
+const hasExplicitDestructivePermission = (userInput: unknown): boolean => {
+  const normalized = normalizeUserInput(userInput);
+  if (!normalized) return false;
+  if (containsAny(normalized, DESTRUCTIVE_NEGATION_PATTERNS)) return false;
+  return containsAny(normalized, EXPLICIT_DESTRUCTIVE_REQUEST_PATTERNS);
+};
+
+const buildCombinedShellInput = (args: {
+  command?: unknown;
+  input?: unknown;
+}): string =>
+  [
+    typeof args.command === "string" ? args.command : "",
+    typeof args.input === "string" ? args.input : "",
+  ]
+    .filter(Boolean)
+    .join("\n");
+
+export function isDestructiveShellCommand(args: {
+  command?: unknown;
+  input?: unknown;
+}): boolean {
+  const combined = buildCombinedShellInput(args);
+  if (!combined.trim()) return false;
+  return SHELL_DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(combined));
+}
+
+export function evaluateShellCommandPolicy(args: {
+  command?: unknown;
+  input?: unknown;
+  userInput?: unknown;
+}): ShellCommandPolicyResult {
+  if (
+    isDestructiveShellCommand(args) &&
+    !hasExplicitDestructivePermission(args.userInput)
+  ) {
+    return {
+      verdict: "forbidden",
+      code: "destructive_action_requires_confirmation",
+      reason:
+        "当前运行默认禁止自动执行可能删除用户内容的 shell 命令。只有当用户在当前请求里明确要求删除/清理时，才能继续；否则请停止并先说明限制。",
+      policy: {
+        capability: "destructive_action",
+        target: "shell_command",
+        detail: "execShell destructive command",
+      },
+    };
+  }
+
+  return { verdict: "allowed" };
+}

package/agentCommandSupport.ts

@@ -20,6 +20,10 @@ export type LocalCliExecutor = (
 export type LocalRuntimeProbeResult = {
   ok: boolean;
   dbPath: string;
+  authorityDriver?: string;
+  authorityEndpoint?: string;
+  authorityMetadataPath?: string;
+  authorityHealthPath?: string;
   agentFound: boolean;
   agentKey?: string;
   error?: string;

package/agentInternalCommandEntries.ts

@@ -8,6 +8,7 @@ import { runAgentPullCommand } from "./agentPullCommand";
 import {
   runAgentReadCommand,
   runAgentUpdateCommand,
+  runAgentCreateCommand,
 } from "./agentRecordCommands";
 import { runAgentRunCommand } from "./agentRunCommand";
 import {
@@ -21,6 +22,7 @@ export function getAgentInternalCommandEntries(): CommandEntry[] {
   return [
     createEnvScriptDirCommand(["chat"], "Chat with an agent", runAgentRunCommand),
     createEnvCommand(["agent", "list"], "List owned agents", runAgentListCommand),
+    createEnvCommand(["agent", "create"], "Create a new agent", runAgentCreateCommand),
     createEnvCommand(["agent", "pull"], "Cache an agent for local runs", runAgentPullCommand),
     createEnvCommand(["agent", "read"], "Read a single agent", runAgentReadCommand),
     createEnvScriptDirCommand(["agent", "run"], "Run an agent", runAgentRunCommand),

package/agentListCommands.ts

@@ -1,6 +1,8 @@
 import { getReadableCliDb, type AgentCommandDeps } from "./agentCommandSupport";
 import {
+  decorateAgentsWithPublicStatusAcrossServers,
   listLocalCachedAgents,
+  listRemoteAgentsAcrossServers,
   listRemoteAgents,
   parseAgentListArgs,
   type ListedAgent,
@@ -9,11 +11,15 @@ import {
   queryUserRecords,
   readDbRecord,
 } from "./agentRecordHelpers";
+import { buildSpaceLookup, getSpaceContentKeys } from "./cliSpaceHelpers";
 import {
   parseUserIdFromAuthToken,
+  readOption,
   resolveAuthToken,
+  resolveServerCandidates,
   resolveServerUrl,
 } from "./cliEnvHelpers";
+import { readLiveDbRecordAfterTombstoneMerge } from "./globalRecordOperations";
 
 export async function runAgentListCommand(
   args: string[],
@@ -22,8 +28,9 @@ export async function runAgentListCommand(
   const env = deps.env ?? process.env;
   const output = deps.output ?? process.stdout;
   const { wantJson, publicOnly, idsOnly, includeLegacy } = parseAgentListArgs(args);
+  const spaceInput = readOption(args, "--space") ?? readOption(args, "--space-id");
 
-  const authToken = resolveAuthToken(env);
+  const authToken = resolveAuthToken(args, env);
   if (!authToken) {
     output.write("[nolo] agent list requires an auth token. Run `nolo login` or set AUTH_TOKEN.\n");
     return 1;
@@ -35,34 +42,79 @@ export async function runAgentListCommand(
     return 1;
   }
 
-  const db = deps.db ?? await getReadableCliDb(output);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const fallbackFetchImpl = deps.fallbackFetchImpl;
+  const serverUrl = resolveServerUrl(args, env);
+  const serverUrls = resolveServerCandidates(args, env, serverUrl);
 
   try {
     let agents: ListedAgent[];
-    let source: "local-cache" | "remote-cache";
+    let source: "local-cache" | "remote-cache" | "global-cache";
+    let serverFailures: Array<{ serverUrl: string; error: string }> = [];
     try {
-      agents = await listLocalCachedAgents({ db, userId });
-      source = "local-cache";
-    } catch {
-      const serverUrl = resolveServerUrl(env);
-      agents = await listRemoteAgents({
+      const remoteResult = await listRemoteAgentsAcrossServers({
         authToken,
         fallbackFetchImpl,
         fetchImpl,
         includeLegacy,
-        serverUrl,
+        serverUrls,
         userId,
-        queryUserRecords,
-        readDbRecord,
       });
-      source = "remote-cache";
+      agents = remoteResult.agents;
+      serverFailures = remoteResult.failures;
+      source = "global-cache";
+    } catch {
+      try {
+        const db = deps.db ?? await getReadableCliDb(output);
+        agents = await listLocalCachedAgents({ db, userId });
+        source = "local-cache";
+      } catch {
+        agents = await listRemoteAgents({
+          authToken,
+          fallbackFetchImpl,
+          fetchImpl,
+          includeLegacy,
+          serverUrl,
+          userId,
+          queryUserRecords,
+          readDbRecord,
+        });
+        source = "remote-cache";
+      }
     }
 
     if (!includeLegacy) {
       agents = agents.filter((agent) => !agent.privateKey.startsWith("cybot-"));
     }
+    let resolvedSpaceId: string | null = null;
+    if (spaceInput) {
+      const { spaceId, spaceKey } = buildSpaceLookup(spaceInput);
+      resolvedSpaceId = spaceId;
+      const spaceRead = await readLiveDbRecordAfterTombstoneMerge({
+        authToken,
+        dbKey: spaceKey,
+        fallbackFetchImpl,
+        fetchImpl,
+        serverUrls,
+      });
+      serverFailures = [...serverFailures, ...spaceRead.failures];
+      const spaceRecord = spaceRead.record;
+      const spaceContentKeys = getSpaceContentKeys(spaceRecord);
+      agents = agents.filter((agent) =>
+        spaceContentKeys.has(agent.privateKey) ||
+        spaceContentKeys.has(agent.publicKey) ||
+        spaceContentKeys.has(agent.id)
+      );
+    }
+    if (source === "global-cache") {
+      await decorateAgentsWithPublicStatusAcrossServers({
+        agents,
+        authToken,
+        fallbackFetchImpl,
+        fetchImpl,
+        serverUrls,
+      });
+    }
     if (publicOnly) {
       agents = agents.filter((agent) => agent.publicRecordExists);
     }
@@ -75,6 +127,9 @@ export async function runAgentListCommand(
     if (wantJson) {
       output.write(JSON.stringify({
         userId,
+        ...(resolvedSpaceId ? { spaceId: resolvedSpaceId } : {}),
+        targetServers: serverUrls,
+        ...(serverFailures.length ? { serverFailures } : {}),
         total: agents.length,
         publicCount: agents.filter((agent) => agent.publicRecordExists).length,
         source,
@@ -85,6 +140,13 @@ export async function runAgentListCommand(
     }
 
     output.write(`userId: ${userId}\n`);
+    if (resolvedSpaceId) {
+      output.write(`spaceId: ${resolvedSpaceId}\n`);
+    }
+    output.write(`targetServers: ${serverUrls.join(", ")}\n`);
+    if (serverFailures.length) {
+      output.write(`serverFailures: ${serverFailures.length}\n`);
+    }
     output.write(`total agents: ${agents.length}\n`);
     output.write(`public agents: ${agents.filter((agent) => agent.publicRecordExists).length}\n`);
     output.write(`source: ${source}\n`);

package/agentListHelpers.ts

@@ -1,4 +1,8 @@
 import type { CliKvDb } from "./client/hybridRecordStore";
+import {
+  listUserRecordsFromServers,
+  readLiveDbRecordAfterTombstoneMerge,
+} from "./globalRecordOperations";
 
 export type ListedAgent = {
   id: string;
@@ -93,7 +97,7 @@ export async function listLocalCachedAgents(args: {
 }) {
   const privateRecords = new Map<string, any>();
   const publicKeys = new Set<string>();
-  for await (const [key, value] of args.db.iterator()) {
+  for await (const [key, value] of args.db.iterator({ gte: "", lte: "\uffff" })) {
     if (typeof key !== "string" || !value || typeof value !== "object") continue;
     if (key.startsWith(`agent-${args.userId}-`) || key.startsWith(`cybot-${args.userId}-`)) {
       privateRecords.set(key, { ...(value as Record<string, unknown>), dbKey: key });
@@ -185,3 +189,54 @@ export async function listRemoteAgents(args: {
   );
   return agents;
 }
+
+export async function listRemoteAgentsAcrossServers(args: {
+  authToken: string;
+  fallbackFetchImpl?: typeof fetch;
+  fetchImpl: typeof fetch;
+  includeLegacy: boolean;
+  serverUrls: string[];
+  userId: string;
+}) {
+  const remoteResult = await listUserRecordsFromServers({
+    authToken: args.authToken,
+    fallbackFetchImpl: args.fallbackFetchImpl,
+    fetchImpl: args.fetchImpl,
+    label: "agent query",
+    serverUrls: args.serverUrls,
+    type: args.includeLegacy ? ["agent", "cybot"] : "agent",
+    userId: args.userId,
+  });
+  const agents = sortListedAgents(
+    remoteResult.records
+      .map((record) => normalizeListedAgent(record))
+      .filter((agent): agent is ListedAgent => agent != null)
+  );
+  return { agents, failures: remoteResult.failures };
+}
+
+export async function decorateAgentsWithPublicStatusAcrossServers(args: {
+  agents: ListedAgent[];
+  authToken: string;
+  fallbackFetchImpl?: typeof fetch;
+  fetchImpl: typeof fetch;
+  serverUrls: string[];
+}) {
+  await Promise.all(
+    args.agents.map(async (agent) => {
+      try {
+        const result = await readLiveDbRecordAfterTombstoneMerge({
+          authToken: args.authToken,
+          dbKey: agent.publicKey,
+          fallbackFetchImpl: args.fallbackFetchImpl,
+          fetchImpl: args.fetchImpl,
+          serverUrls: args.serverUrls,
+        });
+        agent.publicRecordExists = result.record?.isPublic === true;
+      } catch {
+        agent.publicRecordExists = false;
+      }
+    })
+  );
+  return args.agents;
+}

package/agentPullCommand.ts

@@ -1,7 +1,7 @@
-import { DEFAULT_NOLO_SERVER_URL } from "./defaultServer";
 import { getDefaultCliLocalRuntimeDb } from "./localRuntimeDb";
 import type { CliLocalRuntimeDb } from "./client/localRuntimeAdapter";
 import { resolveCliAgentKeyInput } from "./agentAliases";
+import { resolveAuthToken, resolveServerUrl } from "./cliEnvHelpers";
 
 type EnvLike = Record<string, string | undefined>;
 
@@ -44,14 +44,6 @@ export function parseAgentPullArgs(args: string[]): ParsedAgentPullArgs | null {
   return { agentKey: resolveCliAgentKeyInput(agentKey) };
 }
 
-function resolveServerUrl(env: EnvLike) {
-  return (env.NOLO_SERVER || env.BASE_URL || DEFAULT_NOLO_SERVER_URL).replace(/\/+$/, "");
-}
-
-function resolveAuthToken(env: EnvLike) {
-  return env.AUTH_TOKEN || env.AUTH || env.BENCHMARK_AUTH_TOKEN || "";
-}
-
 function extractToolNames(record: any) {
   if (Array.isArray(record?.toolNames)) return record.toolNames.filter((tool: unknown) => typeof tool === "string");
   if (!Array.isArray(record?.tools)) return [];
@@ -113,8 +105,11 @@ export async function runAgentPullCommand(args: string[], deps: AgentPullCommand
     return 1;
   }
 
-  const serverUrl = resolveServerUrl(env);
-  const authToken = resolveAuthToken(env);
+  const serverUrl = resolveServerUrl(args, env);
+  const authToken =
+    readFlagValue(args, "--token") ||
+    readFlagValue(args, "--machine-key") ||
+    resolveAuthToken(env, ["BENCHMARK_AUTH_TOKEN"]);
   const fetchImpl = deps.fetchImpl ?? fetch;
   const db = deps.db ?? await getDefaultCliLocalRuntimeDb();