nolo-cli 0.1.36 → 0.1.38

package/README.md

@@ -76,7 +76,8 @@ token directly:
 nolo login --server https://nolo.chat --token <token>
 ```
 
-Local repo development can still use the script bridge without `AUTH_TOKEN`.
+Local repo development should use `nolo login` or an explicit `AUTH_TOKEN` for
+agent runs.
 
 Inside the TUI, `/update` is the shortcut for the same global `nolo update`
 command.
@@ -207,6 +208,15 @@ commands instead of ad hoc scripts:
   updates such as `--model`, `--cli-provider`, `--api-source`, and repeated
   `--field key=value`.
 
+Account ownership matters for private agent maintenance. The legacy
+`b2e06f801f` / platform-demo account still owns older agents, task-board data,
+and workspace records, while newer personal or machine-bound work may belong to
+the current operator account. Use `nolo agent read`, `nolo agent update`, and
+repo-native helpers as the normal entrypoints; only owner-only operations such
+as private record updates/deletes should use the maintained platform-demo token
+from `scripts/testUtils.ts` or a regenerated token from `scripts/generateToken.ts`.
+Do not copy token strings into docs, logs, or prompts.
+
 Inside the current TUI, examples of supported slash commands include:
 `/agent`, `/agents`, `/switch`, `/context` (alias `/ctx`), `/dialog`, `/doc`,
 `/help`, `/new`, `/customize`, `/login`, `/profile`, `/version`, `/quit`

package/agent-runtime/agentRecordConfig.ts

@@ -33,6 +33,7 @@ function localWorkspaceModeField(record: AgentRecord): "current" | "task-worktre
 
 function appendUniqueStrings(values: string[], next: unknown) {
   if (!Array.isArray(next)) return values;
+  const seen = new Set(values);
   for (const value of next) {
     const toolName = typeof value === "string"
       ? value
@@ -41,7 +42,10 @@ function appendUniqueStrings(values: string[], next: unknown) {
         : value && typeof value === "object" && typeof (value as any).function?.name === "string"
           ? (value as any).function.name
           : "";
-    if (toolName && !values.includes(toolName)) values.push(toolName);
+    if (toolName && !seen.has(toolName)) {
+      seen.add(toolName);
+      values.push(toolName);
+    }
   }
   return values;
 }

package/agent-runtime/index.ts

@@ -59,8 +59,11 @@ export {
 export {
   mergeAgentRuntimeToolPolicies,
   normalizeAgentRuntimeToolPolicy,
+  resolveCurrentRunRuntimeToolPolicy,
   resolveRequestedRuntimeToolNames,
   resolveEffectiveRuntimeToolPolicy,
+  resolveLocalRuntimeEnvFromPolicy,
+  resolveLocalWorkspaceExecutorOptionsFromPolicy,
 } from "./runtimeToolPolicy";
 export {
   buildLocalWorkspaceOpenAiTools,

package/agent-runtime/localLoop.ts

@@ -94,8 +94,7 @@ function extractUserInputText(content: AgentRuntimeMessageContent): string {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
   return content
-    .map((part) => (part?.type === "text" ? part.text : ""))
-    .filter(Boolean)
+    .flatMap((part) => (part?.type === "text" && part.text ? [part.text] : []))
     .join("\n")
     .trim();
 }

package/agent-runtime/localToolPolicy.ts

@@ -38,16 +38,16 @@ const DEFAULT_LOCAL_TOOLS = new Set([
   "editFile",
   "searchFiles",
   "searchWorkspace",
-  "applyPatch",
-  "runPackageScript",
   "execShell",
 ]);
 
 function parseToolAllowlist(value: string | undefined) {
   return (value ?? "")
     .split(",")
-    .map((item) => item.trim())
-    .filter(Boolean);
+    .flatMap((item) => {
+      const trimmed = item.trim();
+      return trimmed ? [trimmed] : [];
+    });
 }
 
 function normalizeLocalToolName(toolName: string) {
@@ -129,7 +129,10 @@ export function resolveLocalToolPolicy(args: {
 
   const allowedByEnv = new Set(parseToolAllowlist(args.env.NOLO_LOCAL_ALLOWED_TOOLS));
   const agentTools = new Set(
-    (args.agentToolNames ?? []).map(normalizeLocalToolName).filter(Boolean),
+    (args.agentToolNames ?? []).flatMap((item) => {
+      const normalized = normalizeLocalToolName(item);
+      return normalized ? [normalized] : [];
+    }),
   );
   if (!restrictedMode && agentTools.has(toolName)) {
     return { allowed: true, toolName };

package/agent-runtime/localWorkspaceTools.ts

@@ -9,6 +9,7 @@ import type {
 type LocalWorkspaceToolArgs = {
   workspaceRoot: string;
   commandTimeoutMs?: number;
+  commandOutputLimit?: number;
   commandPrefix?: string[];
 };
 
@@ -21,9 +22,6 @@ type WorkspaceFileArgs = {
   query?: unknown;
   command?: unknown;
   cmd?: unknown;
-  patch?: unknown;
-  script?: unknown;
-  args?: unknown;
   branch?: unknown;
   paths?: unknown;
   message?: unknown;
@@ -56,8 +54,6 @@ const WORKSPACE_TOOL_NAMES = [
   "searchWorkspace",
   "applyEdit",
   "applyLineEdits",
-  "applyPatch",
-  "runPackageScript",
   "startPreview",
   "getPreviewStatus",
   "stopPreview",
@@ -84,7 +80,6 @@ const REMOVED_WORKSPACE_TOOL_NAMES = new Set([
   "gitCommit",
   "commitWorkspace",
 ]);
-const DEFAULT_WORKSPACE_COMMAND_TIMEOUT_MS = 120_000;
 
 function buildWorkspacePathProperty() {
   return {
@@ -200,51 +195,6 @@ function buildSearchWorkspaceTool(): OpenAiCompatibleTool {
   };
 }
 
-function buildApplyPatchTool(): OpenAiCompatibleTool {
-  return {
-    type: "function",
-    function: {
-      name: "applyPatch",
-      description: "Apply a unified diff patch to files inside the workspace.",
-      parameters: {
-        type: "object",
-        properties: {
-          patch: {
-            type: "string",
-            description: "Unified diff text accepted by git apply.",
-          },
-        },
-        required: ["patch"],
-      },
-    },
-  };
-}
-
-function buildRunPackageScriptTool(): OpenAiCompatibleTool {
-  return {
-    type: "function",
-    function: {
-      name: "runPackageScript",
-      description: "Run a package script in the workspace, for example a test or lint script.",
-      parameters: {
-        type: "object",
-        properties: {
-          script: {
-            type: "string",
-            description: "Package script name to run.",
-          },
-          args: {
-            type: "array",
-            items: { type: "string" },
-            description: "Optional extra arguments passed after --.",
-          },
-        },
-        required: ["script"],
-      },
-    },
-  };
-}
-
 function buildPreviewLifecycleTool(toolName: string): OpenAiCompatibleTool {
   const descriptions: Record<string, string> = {
     startPreview: "Start the local preview stack for the current workspace.",
@@ -421,8 +371,6 @@ function buildWorkspaceToolDefinition(toolName: string) {
   if (toolName === "searchWorkspace" || toolName === "searchFiles") {
     return renameWorkspaceToolDefinition(buildSearchWorkspaceTool(), toolName);
   }
-  if (toolName === "applyPatch") return buildApplyPatchTool();
-  if (toolName === "runPackageScript") return buildRunPackageScriptTool();
   if (toolName === "startPreview" || toolName === "getPreviewStatus" || toolName === "stopPreview" || toolName === "releasePreview") {
     return buildPreviewLifecycleTool(toolName);
   }
@@ -585,12 +533,6 @@ function requireWorkspaceSearchQuery(args: WorkspaceFileArgs) {
   return query;
 }
 
-function requireWorkspacePatch(args: WorkspaceFileArgs) {
-  const patch = typeof args.patch === "string" ? args.patch : "";
-  if (!patch.trim()) throw new Error("applyPatch requires a non-empty patch.");
-  return patch;
-}
-
 function requireShellCommand(args: WorkspaceFileArgs, toolName: string) {
   const command = typeof args.cmd === "string"
     ? args.cmd.trim()
@@ -601,24 +543,12 @@ function requireShellCommand(args: WorkspaceFileArgs, toolName: string) {
   return command;
 }
 
-function requirePackageScript(args: WorkspaceFileArgs) {
-  const script = typeof args.script === "string" ? args.script.trim() : "";
-  if (!script) throw new Error("runPackageScript requires a non-empty script.");
-  return script;
-}
-
 function requireVisualWaitSelector(args: WorkspaceFileArgs) {
   const selector = typeof args.waitSelector === "string" ? args.waitSelector.trim() : "";
   if (!selector) throw new Error("captureVisualState requires a non-empty waitSelector.");
   return selector;
 }
 
-function readPackageScriptArgs(args: WorkspaceFileArgs) {
-  return Array.isArray(args.args)
-    ? args.args.map((value) => String(value)).filter(Boolean)
-    : [];
-}
-
 function readOptionalStringArg(value: unknown) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
@@ -669,6 +599,51 @@ function formatAvailableScripts(scripts: string[]) {
   return scripts.length ? scripts.join(", ") : "(none)";
 }
 
+async function runWorkspacePackageScript(args: {
+  workspaceRoot: string;
+  script: string;
+  extraArgs?: string[];
+  commandTimeoutMs?: number;
+}): Promise<AgentRuntimeToolResult> {
+  const script = args.script.trim();
+  if (!script) throw new Error("package script name is required.");
+  const extraArgs = args.extraArgs ?? [];
+  const packageScripts = await readWorkspacePackageScripts(args.workspaceRoot);
+  if (!packageScripts.scripts.includes(script)) {
+    return {
+      content: [
+        `script not found: ${script}`,
+        `available scripts: ${formatAvailableScripts(packageScripts.scripts)}`,
+        ...(packageScripts.error ? [`package.json read error: ${packageScripts.error}`] : []),
+      ].join("\n"),
+      metadata: {
+        script,
+        exitCode: 1,
+        reason: "script-not-found",
+        availableScripts: packageScripts.scripts,
+        ...(packageScripts.error ? { packageJsonError: packageScripts.error } : {}),
+      },
+    };
+  }
+  const result = await runWorkspaceCommand({
+    workspaceRoot: args.workspaceRoot,
+    command: ["bun", "run", script, ...(extraArgs.length ? ["--", ...extraArgs] : [])],
+    timeoutMs: args.commandTimeoutMs,
+  });
+  return {
+    content: result.content,
+    metadata: {
+      script,
+      args: extraArgs,
+      exitCode: result.exitCode,
+      reason: result.exitCode === 0 ? "ok" : "script-failed",
+      timedOut: result.timedOut,
+      stdoutTail: result.stdout.trim().slice(-4000),
+      stderrTail: result.stderr.trim().slice(-4000),
+    },
+  };
+}
+
 function truncateToolOutput(value: string, limit = 20_000) {
   if (value.length <= limit) return value;
   return `${value.slice(0, limit)}\n\n[truncated ${value.length - limit} chars]`;
@@ -712,9 +687,13 @@ async function runWorkspaceCommand(args: {
   command: string[];
   stdin?: string;
   timeoutMs?: number;
+  outputLimit?: number;
   commandPrefix?: string[];
 }) {
-  const timeoutMs = args.timeoutMs ?? DEFAULT_WORKSPACE_COMMAND_TIMEOUT_MS;
+  const timeoutMs =
+    typeof args.timeoutMs === "number" && Number.isFinite(args.timeoutMs) && args.timeoutMs > 0
+      ? args.timeoutMs
+      : undefined;
   const detached = process.platform !== "win32";
   const command = [
     ...(args.commandPrefix ?? []),
@@ -732,12 +711,14 @@ async function runWorkspaceCommand(args: {
   const stderrPromise = new Response(proc.stderr).text();
   let timeout: ReturnType<typeof setTimeout> | undefined;
   const timeoutResult = Symbol("timeout");
-  const exitOrTimeout = await Promise.race([
-    proc.exited,
-    new Promise<typeof timeoutResult>((resolveTimeout) => {
-      timeout = setTimeout(() => resolveTimeout(timeoutResult), timeoutMs);
-    }),
-  ]);
+  const exitOrTimeout = timeoutMs
+    ? await Promise.race([
+        proc.exited,
+        new Promise<typeof timeoutResult>((resolveTimeout) => {
+          timeout = setTimeout(() => resolveTimeout(timeoutResult), timeoutMs);
+        }),
+      ])
+    : await proc.exited;
   if (timeout) clearTimeout(timeout);
   const timedOut = exitOrTimeout === timeoutResult;
   if (timedOut) {
@@ -769,7 +750,7 @@ async function runWorkspaceCommand(args: {
   ]);
   const exitCode = timedOut ? 124 : Number(exitOrTimeout);
   const stderr = timedOut
-    ? `${rawStderr.trim() ? `${rawStderr.trim()}\n` : ""}command timed out after ${timeoutMs}ms\n`
+    ? `${rawStderr.trim() ? `${rawStderr.trim()}\n` : ""}command timed out after ${timeoutMs ?? "unknown"}ms\n`
     : rawStderr;
   return {
     stdout,
@@ -780,7 +761,7 @@ async function runWorkspaceCommand(args: {
       stdout.trim() ? `stdout:\n${stdout.trim()}` : "",
       stderr.trim() ? `stderr:\n${stderr.trim()}` : "",
       `exitCode: ${exitCode}`,
-    ].filter(Boolean).join("\n\n")),
+    ].filter(Boolean).join("\n\n"), args.outputLimit),
   };
 }
 
@@ -983,82 +964,6 @@ async function searchWorkspaceTool(args: {
   };
 }
 
-async function applyPatchTool(args: {
-  call: AgentRuntimeToolCallInput;
-  workspaceRoot: string;
-}): Promise<AgentRuntimeToolResult> {
-  const parsed = parseWorkspaceToolArguments(args.call.arguments);
-  const patch = requireWorkspacePatch(parsed);
-  const checkResult = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: ["git", "apply", "--check", "--whitespace=nowarn", "-"],
-    stdin: patch,
-  });
-  if (checkResult.exitCode !== 0) {
-    throw new Error(
-      [
-        "applyPatch failed during git apply --check.",
-        "Use editFile/applyEdit for exact single-file edits when possible.",
-        checkResult.content,
-      ].join("\n\n")
-    );
-  }
-  const result = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: ["git", "apply", "--whitespace=nowarn", "-"],
-    stdin: patch,
-  });
-  if (result.exitCode !== 0) throw new Error(result.content);
-  return {
-    content: "patch applied",
-    metadata: { bytes: Buffer.byteLength(patch) },
-  };
-}
-
-async function runPackageScriptTool(args: {
-  call: AgentRuntimeToolCallInput;
-  workspaceRoot: string;
-  commandTimeoutMs?: number;
-}): Promise<AgentRuntimeToolResult> {
-  const parsed = parseWorkspaceToolArguments(args.call.arguments);
-  const script = requirePackageScript(parsed);
-  const extraArgs = readPackageScriptArgs(parsed);
-  const packageScripts = await readWorkspacePackageScripts(args.workspaceRoot);
-  if (!packageScripts.scripts.includes(script)) {
-    return {
-      content: [
-        `script not found: ${script}`,
-        `available scripts: ${formatAvailableScripts(packageScripts.scripts)}`,
-        ...(packageScripts.error ? [`package.json read error: ${packageScripts.error}`] : []),
-      ].join("\n"),
-      metadata: {
-        script,
-        exitCode: 1,
-        reason: "script-not-found",
-        availableScripts: packageScripts.scripts,
-        ...(packageScripts.error ? { packageJsonError: packageScripts.error } : {}),
-      },
-    };
-  }
-  const result = await runWorkspaceCommand({
-    workspaceRoot: args.workspaceRoot,
-    command: ["bun", "run", script, ...(extraArgs.length ? ["--", ...extraArgs] : [])],
-    timeoutMs: args.commandTimeoutMs,
-  });
-  return {
-    content: result.content,
-    metadata: {
-      script,
-      args: extraArgs,
-      exitCode: result.exitCode,
-      reason: result.exitCode === 0 ? "ok" : "script-failed",
-      timedOut: result.timedOut,
-      stdoutTail: result.stdout.trim().slice(-4000),
-      stderrTail: result.stderr.trim().slice(-4000),
-    },
-  };
-}
-
 async function resolveVisualStateBaseUrl(args: {
   workspaceRoot: string;
   explicitBaseUrl?: string;
@@ -1106,16 +1011,10 @@ async function captureVisualStateTool(args: {
     "--metrics",
     captureArgs.metricsPath,
   ];
-  const result = await runPackageScriptTool({
-    call: {
-      id: args.call.id,
-      name: "runPackageScript",
-      arguments: JSON.stringify({
-        script: "probe:visual-review",
-        args: extraArgs,
-      }),
-    },
+  const result = await runWorkspacePackageScript({
     workspaceRoot: args.workspaceRoot,
+    script: "probe:visual-review",
+    extraArgs,
     commandTimeoutMs: args.commandTimeoutMs,
   });
   const metrics = parseLastJsonObject(String(result.metadata?.stdoutTail ?? result.content));
@@ -1153,13 +1052,9 @@ async function previewLifecycleTool(args: {
   commandTimeoutMs?: number;
   script: "preview:start" | "preview:status" | "preview:stop" | "preview:release";
 }): Promise<AgentRuntimeToolResult> {
-  const result = await runPackageScriptTool({
-    call: {
-      id: args.call.id,
-      name: "runPackageScript",
-      arguments: JSON.stringify({ script: args.script }),
-    },
+  const result = await runWorkspacePackageScript({
     workspaceRoot: args.workspaceRoot,
+    script: args.script,
     commandTimeoutMs: args.commandTimeoutMs,
   });
   const summary = parseLastJsonObject(String(result.metadata?.stdoutTail ?? result.content)) ?? {};
@@ -1195,6 +1090,7 @@ async function execShellTool(args: {
       shell: parsed.shell,
     }),
     timeoutMs: args.commandTimeoutMs,
+    outputLimit: args.commandOutputLimit,
     commandPrefix: args.commandPrefix,
   });
   return {
@@ -1253,15 +1149,6 @@ export function createLocalWorkspaceToolExecutors(args: LocalWorkspaceToolArgs)
       call,
       workspaceRoot: args.workspaceRoot,
     }),
-    applyPatch: (call: AgentRuntimeToolCallInput) => applyPatchTool({
-      call,
-      workspaceRoot: args.workspaceRoot,
-    }),
-    runPackageScript: (call: AgentRuntimeToolCallInput) => runPackageScriptTool({
-      call,
-      workspaceRoot: args.workspaceRoot,
-      commandTimeoutMs: args.commandTimeoutMs,
-    }),
     startPreview: (call: AgentRuntimeToolCallInput) => previewLifecycleTool({
       call,
       workspaceRoot: args.workspaceRoot,
@@ -1295,6 +1182,7 @@ export function createLocalWorkspaceToolExecutors(args: LocalWorkspaceToolArgs)
       call,
       workspaceRoot: args.workspaceRoot,
       commandTimeoutMs: args.commandTimeoutMs,
+      commandOutputLimit: args.commandOutputLimit,
       commandPrefix: args.commandPrefix,
     }),
   };

package/agent-runtime/runtimeToolPolicy.ts

@@ -1,6 +1,8 @@
 import type { AgentRuntimeAgentConfig } from "./hostAdapter";
 import type { AgentRuntimeHost, AgentRuntimeToolPolicy } from "./types";
 
+type EnvLike = Record<string, string | undefined>;
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -56,6 +58,11 @@ function runtimeToolNamesFromPolicy(policy: AgentRuntimeToolPolicy | undefined)
   return stringArray(policy?.runtimeTools);
 }
 
+function readPositiveNumber(value: unknown) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+
 export function mergeAgentRuntimeToolPolicies(
   base?: AgentRuntimeToolPolicy,
   override?: AgentRuntimeToolPolicy,
@@ -110,6 +117,44 @@ export function resolveRequestedRuntimeToolNames(args: {
   ]);
 }
 
+export function resolveCurrentRunRuntimeToolPolicy(
+  agentConfig: Pick<AgentRuntimeAgentConfig, "runtimeToolPolicy" | "runtimeBinding"> | null | undefined,
+): AgentRuntimeToolPolicy | undefined {
+  const runtimeBinding = runtimeBindingRecord(agentConfig?.runtimeBinding);
+  return normalizeAgentRuntimeToolPolicy(
+    runtimeBinding?.runtimeToolPolicySnapshot ??
+      agentConfig?.runtimeToolPolicy ??
+      runtimeBinding?.runtimeToolPolicy,
+  );
+}
+
+export function resolveLocalRuntimeEnvFromPolicy(
+  runtimeEnv: EnvLike,
+  policy?: AgentRuntimeToolPolicy,
+): EnvLike {
+  const enablesWorktreeShell =
+    Array.isArray(policy?.runtimeTools) &&
+    policy.runtimeTools.includes("execShell") &&
+    policy.shell?.enabled === true &&
+    policy.shell?.mode === "worktree";
+  return {
+    ...runtimeEnv,
+    ...(policy?.workspace?.cwd ? { NOLO_LOCAL_WORKTREE: policy.workspace.cwd } : {}),
+    ...(enablesWorktreeShell && !runtimeEnv.NOLO_LOCAL_SHELL_MODE
+      ? { NOLO_LOCAL_SHELL_MODE: "worktree" }
+      : {}),
+  };
+}
+
+export function resolveLocalWorkspaceExecutorOptionsFromPolicy(
+  policy?: AgentRuntimeToolPolicy,
+) {
+  const maxOutputBytes = readPositiveNumber(policy?.shell?.maxOutputBytes);
+  return {
+    ...(maxOutputBytes ? { commandOutputLimit: Math.floor(maxOutputBytes) } : {}),
+  };
+}
+
 function policyRequestsHostedWorkspace(policy: AgentRuntimeToolPolicy | undefined) {
   if (!policy) return false;
   const workspaceMode = policy.workspace?.mode;
@@ -150,12 +195,7 @@ export function resolveEffectiveRuntimeToolPolicy(args: {
   taskRunControl?: { runtimeToolPolicy?: unknown } | null;
   host?: AgentRuntimeHost;
 }): AgentRuntimeToolPolicy | undefined {
-  const agentPolicy = normalizeAgentRuntimeToolPolicy(
-    args.agentConfig.runtimeToolPolicy ??
-      (isRecord(args.agentConfig.runtimeBinding)
-        ? args.agentConfig.runtimeBinding.runtimeToolPolicy
-        : undefined),
-  );
+  const agentPolicy = resolveCurrentRunRuntimeToolPolicy(args.agentConfig);
   const taskPolicy = normalizeAgentRuntimeToolPolicy(
     args.taskRunControl?.runtimeToolPolicy,
   );

package/agent-runtime/taskWorkspace.ts

@@ -6,6 +6,7 @@ import {
   readlink,
   rm,
   symlink,
+  unlink,
 } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 
@@ -73,22 +74,23 @@ export async function collectWorkspacePackageLinks(workspacePath: string) {
     () => []
   );
   const nodeModulesPath = join(workspacePath, "node_modules");
-  const links: WorkspacePackageLink[] = [];
-
-  for (const entry of packageDirs) {
-    if (!entry.isDirectory()) continue;
-    const target = join(packagesRoot, entry.name);
-    const name = await readPackageName(join(target, "package.json")).catch(
-      () => null
-    );
-    if (!name) continue;
-    links.push({
-      name,
-      target,
-      linkPath: packageLinkPath(nodeModulesPath, name),
+
+  const linksPromises = packageDirs
+    .filter((entry) => entry.isDirectory())
+    .map(async (entry) => {
+      const target = join(packagesRoot, entry.name);
+      const name = await readPackageName(join(target, "package.json")).catch(
+        () => null
+      );
+      if (!name) return null;
+      return {
+        name,
+        target,
+        linkPath: packageLinkPath(nodeModulesPath, name),
+      };
     });
-  }
 
+  const links = (await Promise.all(linksPromises)).filter(Boolean) as WorkspacePackageLink[];
   return links;
 }
 
@@ -106,7 +108,7 @@ async function ensureWorkspacePackageLink(link: WorkspacePackageLink) {
     if (!existingTarget) {
       throw new Error(`Cannot replace non-symlink workspace package path: ${link.linkPath}`);
     }
-    await rm(link.linkPath, { force: true });
+    await unlink(link.linkPath);
   }
   await symlink(link.target, link.linkPath, "dir");
   return true;
@@ -134,7 +136,7 @@ async function ensureWorkspaceNodeModulesDirectory(workspacePath: string) {
   if (symlinkTarget) {
     const resolvedTarget = resolve(dirname(nodeModulesPath), symlinkTarget);
     if (!isInsideWorkspace(workspacePath, resolvedTarget)) {
-      await rm(nodeModulesPath, { force: true });
+      await unlink(nodeModulesPath);
     }
   }
   await mkdir(nodeModulesPath, { recursive: true });
@@ -150,12 +152,10 @@ export async function ensureWorkspacePackageLinks(workspacePath: string) {
     };
   }
   await ensureWorkspaceNodeModulesDirectory(workspacePath);
-  let createdOrUpdated = 0;
-  for (const link of links) {
-    if (await ensureWorkspacePackageLink(link)) {
-      createdOrUpdated += 1;
-    }
-  }
+  const results = await Promise.all(
+    links.map((link) => ensureWorkspacePackageLink(link))
+  );
+  const createdOrUpdated = results.filter(Boolean).length;
   return {
     workspacePath,
     links,
@@ -173,7 +173,7 @@ export async function prepareGitTaskWorkspace(args: {
     return { path: args.env.NOLO_LOCAL_WORKTREE };
   }
   const cwd = args.cwd ?? process.cwd();
-  const root = await runGitForTaskWorkspace(["rev-parse", "--show-toplevel"], cwd);
+  const root = resolve(await runGitForTaskWorkspace(["rev-parse", "--show-toplevel"], cwd));
   if (isFormalTaskWorkspacePath(root)) {
     await ensureWorkspacePackageLinks(root);
     return { path: root };

package/agent-runtime/types.ts

@@ -88,7 +88,6 @@ export type AgentRuntimeShellPolicy = {
   mode?: "off" | "worktree";
   commandPolicy?: "denylist" | "allowlist" | "approval";
   networkPolicy?: "default-deny" | "allowed" | "approval";
-  maxSeconds?: number;
   maxOutputBytes?: number;
 };