nolo-cli 0.1.36 → 0.1.38

package/client/agentRun.test.ts

@@ -5,7 +5,6 @@ import {
   classifyTaskRunReviewStatus,
   findServerPlatformTools,
   runAgentTurn,
-  shouldUseScriptBridge,
 } from "./agentRun";
 import { NOLO_PROJECT_MANAGER_AGENT_KEY } from "../agentAliases";
 
@@ -34,12 +33,6 @@ describe("cli agent run client", () => {
     expect(classifyTaskRunReviewStatus("I looked at the diff and have notes")).toBeUndefined();
   });
 
-  test("uses the repo script bridge only when no auth token is available", () => {
-    expect(shouldUseScriptBridge({ hasAuthToken: false, scriptPathExists: true })).toBe(true);
-    expect(shouldUseScriptBridge({ hasAuthToken: true, scriptPathExists: true })).toBe(false);
-    expect(shouldUseScriptBridge({ hasAuthToken: false, scriptPathExists: false })).toBe(false);
-  });
-
   test("identifies server platform tools that local runtime cannot provide", () => {
     expect(findServerPlatformTools(["readWorkspaceFile", "queryTableRows", "updateTableRow"])).toEqual([
       "queryTableRows",
@@ -61,7 +54,6 @@ describe("cli agent run client", () => {
       scriptDir: "C:/missing/scripts",
       env: { AUTH_TOKEN: "token-123" },
       output,
-      scriptPathExists: () => false,
       fetchImpl: async (url, init) => {
         requests.push({
           url: String(url),
@@ -120,7 +112,6 @@ describe("cli agent run client", () => {
         workItemId: "frontend-filter",
         artifactIds: ["artifact-1"],
       },
-      scriptPathExists: () => false,
       fetchImpl: async (_url, init) => {
         requests.push({ body: JSON.parse(String(init?.body)) });
         return Response.json({ content: "ok", dialogId: "dialog-1" });
@@ -160,7 +151,6 @@ describe("cli agent run client", () => {
       taskRunRecorder: async (args) => {
         writebacks.push(args);
       },
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         return Response.json({ content: "patched", dialogId: "dialog-1" });
       },
@@ -193,7 +183,6 @@ describe("cli agent run client", () => {
       env: { AUTH_TOKEN: "token-123" },
       output,
       runtimeMode: "server",
-      scriptPathExists: () => false,
       fetchImpl: async (_url, init) => {
         requests.push({ body: JSON.parse(String(init?.body)) });
         return Response.json({ content: "ok" });
@@ -206,7 +195,7 @@ describe("cli agent run client", () => {
     ]);
   });
 
-  test("sends script-compatible dialog metadata over HTTP", async () => {
+  test("sends CLI dialog metadata over HTTP", async () => {
     const output = new CaptureOutput();
     const requests: Array<{ body: any }> = [];
 
@@ -227,7 +216,6 @@ describe("cli agent run client", () => {
       env: { AUTH_TOKEN: "token-123" },
       output,
       runtimeMode: "server",
-      scriptPathExists: () => false,
       fetchImpl: async (_url, init) => {
         requests.push({ body: JSON.parse(String(init?.body)) });
         return Response.json({ dialogId: "dialog-1", status: "queued" });
@@ -271,7 +259,6 @@ describe("cli agent run client", () => {
         writebacks.push(args);
       },
       output,
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         return Response.json({ dialogId: "dialog-bg", status: "pending" }, { status: 202 });
       },
@@ -319,7 +306,6 @@ describe("cli agent run client", () => {
           throw new Error("no tools expected");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         throw new Error("HTTP should not be called for forced local runs");
       },
@@ -371,7 +357,6 @@ describe("cli agent run client", () => {
         }),
         executeTool: async () => ({ content: "ok" }),
       },
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         throw new Error("HTTP should not be called for forced local runs");
       },
@@ -432,7 +417,6 @@ describe("cli agent run client", () => {
           return { content: "ok" };
         },
       },
-      scriptPathExists: () => false,
     });
 
     expect(result).toEqual({ exitCode: 0, dialogId: "dialog-local-retry" });
@@ -487,7 +471,6 @@ describe("cli agent run client", () => {
         }),
         executeTool: async () => ({ content: "clean" }),
       },
-      scriptPathExists: () => false,
     });
 
     expect(result).toMatchObject({ exitCode: 0, dialogId: "dialog-local" });
@@ -548,7 +531,6 @@ describe("cli agent run client", () => {
         }),
         executeTool: async () => ({ content: "clean" }),
       },
-      scriptPathExists: () => false,
     });
 
     expect(result).toMatchObject({ exitCode: 0, dialogId: "dialog-local" });
@@ -604,7 +586,6 @@ describe("cli agent run client", () => {
           throw new Error("no tools expected");
         },
       },
-      scriptPathExists: () => false,
     });
 
     expect(result).toEqual({ exitCode: 0, dialogId: "dialog-local-bg" });
@@ -648,7 +629,6 @@ describe("cli agent run client", () => {
           throw new Error("no tools expected");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async (url) => {
         httpCalls.push(String(url));
         return Response.json({ content: "server" });
@@ -701,7 +681,6 @@ describe("cli agent run client", () => {
           throw new Error("no tools expected");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async (url) => {
         httpCalls.push(String(url));
         return Response.json({ content: "server" });
@@ -748,7 +727,6 @@ describe("cli agent run client", () => {
           throw new Error("no tools expected");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async (url, init) => {
         httpCalls.push({ url: String(url), body: JSON.parse(String(init?.body)) });
         return Response.json({ content: "server fallback", dialogId: "dialog-server-fallback" });
@@ -798,7 +776,6 @@ describe("cli agent run client", () => {
           throw new Error("local tools should be skipped");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async (url, init) => {
         httpCalls.push({ url: String(url), body: JSON.parse(String(init?.body)) });
         return Response.json({ content: "server ok", dialogId: "dialog-server" });
@@ -852,7 +829,6 @@ describe("cli agent run client", () => {
           throw new Error("local tools should be skipped");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async (url, init) => {
         httpCalls.push({ url: String(url), body: JSON.parse(String(init?.body)) });
         return Response.json({ content: "server ok", dialogId: "dialog-server-policy" });
@@ -898,7 +874,6 @@ describe("cli agent run client", () => {
           throw new Error("local tools should be skipped");
         },
       },
-      scriptPathExists: () => false,
       fetchImpl: async (url, init) => {
         httpCalls.push({ url: String(url), body: JSON.parse(String(init?.body)) });
         return Response.json({ content: "server ok", dialogId: "dialog-server" });
@@ -942,7 +917,6 @@ describe("cli agent run client", () => {
           },
         };
       },
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         throw new Error("HTTP should not be called for env local runs");
       },
@@ -964,7 +938,6 @@ describe("cli agent run client", () => {
       scriptDir: "C:/missing/scripts",
       env: { AUTH_TOKEN: "token-123" },
       output,
-      scriptPathExists: () => false,
       fetchImpl: async () =>
         new Response(
           [
@@ -998,7 +971,6 @@ describe("cli agent run client", () => {
       scriptDir: "C:/missing/scripts",
       env: { AUTH_TOKEN: "token-123" },
       output,
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         let sent = false;
         return new Response(
@@ -1054,14 +1026,13 @@ describe("cli agent run client", () => {
       scriptDir: "C:/missing/scripts",
       env: {},
       output,
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         throw new Error("fetch should not be called");
       },
     });
 
     expect(result.exitCode).toBe(1);
-    expect(output.text()).toContain("Set AUTH_TOKEN");
+    expect(output.text()).toContain("Run `nolo login`");
   });
 
   test("prints a friendly connection hint instead of crashing on transport errors", async () => {
@@ -1075,7 +1046,6 @@ describe("cli agent run client", () => {
       scriptDir: "C:/missing/scripts",
       env: { AUTH_TOKEN: "token-123" },
       output,
-      scriptPathExists: () => false,
       fetchImpl: async () => {
         throw new Error("ConnectionRefused");
       },

package/client/agentRun.ts

@@ -1,22 +1,20 @@
-import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { runLocalAgentTurn } from "../agentRuntimeLocal";
 import { LOCAL_AGENT_CONFIG_MISSING_CODE } from "../agent-runtime/localLoop";
 import {
-  FRONTEND_IMPLEMENTER_AGENT_KEY,
-  NOLO_FULLSTACK_AGENT_KEY,
+  MIMO_MONTH_AGENT_KEY,
   NOLO_PROJECT_MANAGER_AGENT_KEY,
-  NOLO_REVIEW_AGENT_KEY,
   NOLO_SENIOR_FULLSTACK_AGENT_KEY,
+  WIN_CODEX_AGENT_KEY,
 } from "../agentAliases";
 import type { LocalAgentToolEvent } from "../agent-runtime/localLoop";
 import type { AgentRuntimeHostAdapter, AgentRuntimeRequestedMode } from "../agentRuntimeLocal";
 import { createCliLocalRuntimeAdapter } from "./localRuntimeAdapter";
 import { createStreamingTextWriter } from "./streamingOutput";
 import { prependTaskRunPrompt, type TaskRunPromptContext } from "./taskRunPrompt";
-
-type EnvLike = Record<string, string | undefined>;
-
+
+type EnvLike = Record<string, string | undefined>;
+
 type OutputLike = {
   write(chunk: string): unknown;
 };
@@ -48,7 +46,7 @@ type RunAgentTurnOptions = {
   noStream?: boolean;
   noDefaultTestRoot?: boolean;
   scriptDir: string;
-  env: EnvLike;
+  env: EnvLike;
   output: OutputLike;
   runtimeMode?: AgentRuntimeRequestedMode;
   localRuntimeAdapter?: AgentRuntimeHostAdapter;
@@ -66,20 +64,55 @@ type RunAgentTurnOptions = {
     errorCode?: string;
     toolEvidence?: TaskRunToolEvidence;
   }) => Promise<void>;
-  scriptPathExists?: (path: string) => boolean;
   fetchImpl?: typeof fetch;
 };
-
+
 export type RunAgentTurnResult = {
   exitCode: number;
   dialogId?: string;
   streamInterrupted?: boolean;
 };
-
-type ScriptBridgeDecision = {
-  hasAuthToken: boolean;
-  scriptPathExists: boolean;
-};
+
+class Spinner {
+  private timer: any = null;
+  private frameIndex = 0;
+  private frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+  private isTTY: boolean;
+
+  constructor(
+    private output: OutputLike,
+    private text: string
+  ) {
+    this.isTTY = Boolean((output as any).isTTY ?? process.stdout.isTTY);
+  }
+
+  start() {
+    if (!this.isTTY) {
+      this.output.write(`\n${this.text}...\n`);
+      return;
+    }
+
+    this.frameIndex = 0;
+    this.output.write(`\x1b[36m${this.frames[0]}\x1b[39m ${this.text}...`);
+
+    this.timer = setInterval(() => {
+      this.frameIndex = (this.frameIndex + 1) % this.frames.length;
+      this.output.write(`\r\x1b[36m${this.frames[this.frameIndex]}\x1b[39m ${this.text}...`);
+    }, 80);
+  }
+
+  stop() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+
+    if (this.isTTY) {
+      this.output.write("\r\x1b[K");
+    }
+  }
+}
+
 
 const SERVER_PLATFORM_TOOL_NAMES = new Set([
   "addTableRow",
@@ -94,10 +127,9 @@ const SERVER_PLATFORM_TOOL_NAMES = new Set([
 ]);
 
 const KNOWN_SERVER_PLATFORM_AGENT_KEYS = new Set([
-  FRONTEND_IMPLEMENTER_AGENT_KEY,
-  NOLO_FULLSTACK_AGENT_KEY,
+  MIMO_MONTH_AGENT_KEY,
   NOLO_PROJECT_MANAGER_AGENT_KEY,
-  NOLO_REVIEW_AGENT_KEY,
+  WIN_CODEX_AGENT_KEY,
   NOLO_SENIOR_FULLSTACK_AGENT_KEY,
 ]);
 
@@ -125,10 +157,6 @@ const KNOWN_SERVER_PLATFORM_AGENT_ALIASES = new Set([
   "reviewer",
 ]);
 
-export function shouldUseScriptBridge(decision: ScriptBridgeDecision) {
-  return !decision.hasAuthToken && decision.scriptPathExists;
-}
-
 export function findServerPlatformTools(toolNames?: string[]) {
   if (!Array.isArray(toolNames)) return [];
   return toolNames.filter((toolName) => SERVER_PLATFORM_TOOL_NAMES.has(toolName));
@@ -514,62 +542,9 @@ function buildTransportErrorHint(serverUrl: string, error: unknown) {
   return detail;
 }
 
-async function runScriptBridge(options: RunAgentTurnOptions, scriptPath: string) {
-  options.output.write(`\n${options.agentName} -> working via local script...\n\n`);
-  const proc = Bun.spawn({
-    cmd: [
-      process.execPath,
-      scriptPath,
-      "--agent",
-      options.agentKey,
-      "--server",
-      options.serverUrl,
-      "--msg",
-      options.message,
-      ...(options.taskRunContext?.rowDbKey
-        ? ["--task-row-dbkey", options.taskRunContext.rowDbKey]
-        : []),
-      ...(options.taskRunContext?.taskRunId
-        ? ["--task-run-id", options.taskRunContext.taskRunId]
-        : []),
-      ...(options.taskRunContext?.workItemId
-        ? ["--work-item-id", options.taskRunContext.workItemId]
-        : []),
-      ...(options.taskRunContext?.artifactIds?.length
-        ? ["--artifact-ids", options.taskRunContext.artifactIds.join(",")]
-        : []),
-      ...(options.noDefaultTestRoot ? ["--no-default-test-root"] : []),
-      ...(options.continueDialogId
-        ? ["--continue", options.continueDialogId]
-        : []),
-      ...(options.spaceId ? ["--space", options.spaceId] : []),
-      ...(options.category ? ["--category", options.category] : []),
-      ...(options.inheritedFromDialogKey
-        ? ["--inherit-from-dialog", options.inheritedFromDialogKey]
-        : []),
-      ...(options.background ? ["--bg"] : []),
-      ...(typeof options.timeoutMs === "number" ? ["--timeout-ms", String(options.timeoutMs)] : []),
-      ...(options.noStream ? ["--no-stream"] : []),
-    ],
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env: {
-      ...process.env,
-      ...options.env,
-      ASSISTANT_LABEL: options.agentName,
-    },
-  });
-
-  const exitCode = await proc.exited;
-  if (exitCode !== 0) {
-    options.output.write(`\n[nolo] Agent run exited with code ${exitCode}.\n`);
-  }
-  return { exitCode };
-}
-
 async function runHttpAgentTurn(options: RunAgentTurnOptions, authToken: string) {
-  options.output.write(`\n${options.agentName} -> working...\n`);
+  const spinner = new Spinner(options.output, `${options.agentName} -> working`);
+  spinner.start();
 
   const fetchImpl = options.fetchImpl ?? fetch;
   let res: Response;
@@ -623,14 +598,16 @@ async function runHttpAgentTurn(options: RunAgentTurnOptions, authToken: string)
         ...(typeof options.timeoutMs === "number" ? { timeoutMs: options.timeoutMs } : {}),
         stream: !options.noStream && !options.background,
       }),
-    });
-  } catch (error) {
-    options.output.write(buildTransportErrorHint(options.serverUrl, error));
-    return { exitCode: 1 };
-  }
-
+    });
+  } catch (error) {
+    spinner.stop();
+    options.output.write(buildTransportErrorHint(options.serverUrl, error));
+    return { exitCode: 1 };
+  }
+
   const contentType = res.headers.get("content-type") || "";
   if (contentType.includes("text/event-stream") && res.body) {
+    spinner.stop();
     const result = await readStreamingAgentRun(options, res);
     await recordTaskRunOutcome({
       options,
@@ -644,14 +621,15 @@ async function runHttpAgentTurn(options: RunAgentTurnOptions, authToken: string)
     });
     return result;
   }
-
-  let data: any = {};
-  try {
-    data = await res.json();
-  } catch {
-    data = {};
-  }
-
+
+  spinner.stop();
+  let data: any = {};
+  try {
+    data = await res.json();
+  } catch {
+    data = {};
+  }
+
   if (!res.ok) {
     options.output.write(`[nolo] Agent request failed: HTTP ${res.status}\n`);
     if (data?.error || data?.message) {
@@ -758,7 +736,8 @@ async function runLocalAgentTurnForCli(
     return { exitCode: 1 };
   }
 
-  options.output.write(`\n${options.agentName} -> working locally...\n`);
+  const spinner = new Spinner(options.output, `${options.agentName} -> working locally`);
+  spinner.start();
   const toolEvents: LocalAgentToolEvent[] = [];
   try {
     const traceLocalTools = shouldTraceLocalTools(options);
@@ -783,11 +762,15 @@ async function runLocalAgentTurnForCli(
         ? {
             onToolEvent: (event) => {
               if (collectToolEvidence) toolEvents.push(event);
-              if (traceLocalTools) options.output.write(formatToolTraceEvent(event));
+              if (traceLocalTools) {
+                spinner.stop();
+                options.output.write(formatToolTraceEvent(event));
+              }
             },
           }
         : {}),
     });
+    spinner.stop();
     const content = result.content.trim();
     if (content) {
       options.output.write(`\n${options.agentName} > ${content}\n`);
@@ -803,6 +786,7 @@ async function runLocalAgentTurnForCli(
     });
     return { exitCode: 0, dialogId: result.dialogId };
   } catch (error) {
+    spinner.stop();
     if (settings.reportFailure) {
       options.output.write(
         `[nolo] Local agent run failed: ${
@@ -927,8 +911,6 @@ async function readStreamingAgentRun(
 
 export async function runAgentTurn(options: RunAgentTurnOptions) {
   const authToken = resolveAuthToken(options.env);
-  const scriptPath = join(options.scriptDir, "chatWithAgent.ts");
-  const scriptPathExists = (options.scriptPathExists ?? existsSync)(scriptPath);
   const runtimeMode = resolveRequestedRuntimeMode(options);
 
   if (runtimeMode === "local") {
@@ -969,17 +951,13 @@ export async function runAgentTurn(options: RunAgentTurnOptions) {
     }
   }
 
-  if (shouldUseScriptBridge({ hasAuthToken: Boolean(authToken), scriptPathExists })) {
-    return runScriptBridge(options, scriptPath);
+  if (!authToken) {
+    options.output.write(
+      "[nolo] This install needs an auth token before it can talk to agents.\n" +
+        "Run `nolo login`, or set AUTH_TOKEN / NOLO_SERVER for non-interactive runs.\n"
+    );
+    return { exitCode: 1 };
   }
 
-  if (!authToken) {
-    options.output.write(
-      "[nolo] This install needs an auth token before it can talk to agents.\n" +
-        "Set AUTH_TOKEN, or use the repo-local CLI where the dev script bridge is available.\n"
-    );
-    return { exitCode: 1 };
-  }
-
   return runHttpAgentTurn(options, authToken);
 }

package/client/localRuntimeAdapter.test.ts

@@ -1324,6 +1324,70 @@ describe("CLI local runtime adapter", () => {
     expect(result.metadata).toMatchObject({ exitCode: 0 });
   });
 
+  test("applies runtime policy shell output limit to local executors without adding a timeout", async () => {
+    const requests: Array<{ body: any }> = [];
+    const adapter = createCliLocalRuntimeAdapter({
+      env: {
+        NOLO_LOCAL_OPENAI_BASE_URL: "http://127.0.0.1:11434/v1",
+        NOLO_LOCAL_SHELL_MODE: "worktree",
+      },
+      db: {
+        get: async () => ({
+          dbKey: "agent-local-shell-limits",
+          prompt: "Use shell when needed.",
+          model: "qwen-coder",
+          runtimeToolPolicy: {
+            version: 1,
+            runtimeTools: ["execShell"],
+            shell: { enabled: true, mode: "worktree", maxOutputBytes: 120 },
+          },
+        }),
+        put: async () => {},
+        batch: async () => {},
+        iterator: () => (async function* () {})(),
+      },
+      cwd: import.meta.dir,
+      fetchImpl: async (_url, init) => {
+        requests.push({ body: JSON.parse(String(init?.body)) });
+        if (requests.length === 1) {
+          return Response.json({
+            choices: [{
+              message: {
+                content: "",
+                tool_calls: [{
+                  id: "call-1",
+                  type: "function",
+                  function: {
+                    name: "execShell",
+                    arguments: JSON.stringify({
+                      cmd: process.platform === "win32"
+                        ? "'abcdefghijklmnopqrstuvwxyz0123456789'.PadRight(500, 'x')"
+                        : "bun -e 'console.log(\"x\".repeat(500))'",
+                    }),
+                  },
+                }],
+              },
+            }],
+          });
+        }
+        return Response.json({
+          choices: [{ message: { content: "limits applied" } }],
+        });
+      },
+    });
+
+    const result = await runLocalAgentTurn({
+      adapter,
+      agentRef: "shell-limits",
+      input: "run output limit check",
+    });
+
+    expect(result.content).toBe("limits applied");
+    const toolResult = requests[1]?.body.messages.at(-1)?.content ?? "";
+    expect(toolResult).toContain("[truncated ");
+    expect(toolResult).not.toContain("command timed out");
+  });
+
   test("accepts execShell aliases from the local model", async () => {
     const requests: Array<{ body: any }> = [];
     const adapter = createCliLocalRuntimeAdapter({

package/client/localRuntimeAdapter.ts

@@ -16,6 +16,8 @@ import {
   parsePlatformChatCompletionData,
   parsePlatformChatCompletionResponse,
   resolvePlatformChatProviderConfig,
+  resolveCurrentRunRuntimeToolPolicy,
+  resolveLocalWorkspaceExecutorOptionsFromPolicy,
   resolveRequestedRuntimeToolNames,
   shouldUsePlatformChatProvider,
 } from "../agentRuntimeLocal";
@@ -337,9 +339,15 @@ function buildLocalToolExecutors(args: {
   env: EnvLike;
   fetchImpl: typeof fetch;
   localToolExecutors?: CliLocalRuntimeAdapterDeps["localToolExecutors"];
+  commandTimeoutMs?: number;
+  commandOutputLimit?: number;
 }) {
   return {
-    ...createLocalWorkspaceToolExecutors({ workspaceRoot: args.workspaceRoot }),
+    ...createLocalWorkspaceToolExecutors({
+      workspaceRoot: args.workspaceRoot,
+      commandTimeoutMs: args.commandTimeoutMs,
+      commandOutputLimit: args.commandOutputLimit,
+    }),
     ...buildServerPlatformToolExecutors({
       env: args.env,
       fetchImpl: args.fetchImpl,
@@ -434,11 +442,13 @@ export function createCliLocalRuntimeAdapter(
       ? { defaultCwd: deps.cwd }
       : { cwd: deps.cwd }
   );
+  let runtimeToolExecutionLimits: ReturnType<typeof resolveLocalWorkspaceExecutorOptionsFromPolicy> = {};
   let localToolExecutors = buildLocalToolExecutors({
     workspaceRoot: workspaceSession.workspaceRoot,
     env: deps.env,
     fetchImpl,
     localToolExecutors: deps.localToolExecutors,
+    ...runtimeToolExecutionLimits,
   });
 
   async function activateAgentWorkspaceSession(args: {
@@ -458,6 +468,7 @@ export function createCliLocalRuntimeAdapter(
       env: deps.env,
       fetchImpl,
       localToolExecutors: deps.localToolExecutors,
+      ...runtimeToolExecutionLimits,
     });
     deps.output?.write(formatWorkspaceSessionActivation(workspaceSession));
   }
@@ -478,7 +489,17 @@ export function createCliLocalRuntimeAdapter(
         toolNames: requestedToolNames,
         env: deps.env,
       });
+      runtimeToolExecutionLimits = resolveLocalWorkspaceExecutorOptionsFromPolicy(
+        resolveCurrentRunRuntimeToolPolicy(agentConfig),
+      );
       await activateAgentWorkspaceSession({ agentRef, agentConfig });
+      localToolExecutors = buildLocalToolExecutors({
+        workspaceRoot: workspaceSession.workspaceRoot,
+        env: deps.env,
+        fetchImpl,
+        localToolExecutors: deps.localToolExecutors,
+        ...runtimeToolExecutionLimits,
+      });
       return agentConfig;
     },
     loadDialogHistory: async (dialogId) => readDialogMessages({

package/machineWsRunDispatch.ts

@@ -1,4 +1,5 @@
 import { runLocalAgentTurn, type LocalAgentToolEvent } from "./agent-runtime/localLoop";
+import { resolveLocalRuntimeEnvFromPolicy } from "./agent-runtime/runtimeToolPolicy";
 import {
   assertMachineRunAllowed as defaultAssertMachineRunAllowed,
   resolveMachineRunPermissionPolicy as defaultResolveMachineRunPermissionPolicy,
@@ -225,11 +226,8 @@ function mergeToolNames(...values: unknown[]) {
   return names;
 }
 
-function localRuntimeEnvFromPolicy(runtimeEnv: EnvLike, policy?: ConnectorRuntimePolicy): EnvLike {
-  return {
-    ...runtimeEnv,
-    ...(policy?.workspace?.cwd ? { NOLO_LOCAL_WORKTREE: policy.workspace.cwd } : {}),
-  };
+export function localRuntimeEnvFromPolicy(runtimeEnv: EnvLike, policy?: ConnectorRuntimePolicy): EnvLike {
+  return resolveLocalRuntimeEnvFromPolicy(runtimeEnv, policy);
 }
 
 function forwardedUserAuthToken(parsed: any): string {