nolo-cli 0.1.39 → 0.1.40

package/agent-runtime/runtimeToolPolicy.ts

@@ -132,17 +132,8 @@ export function resolveLocalRuntimeEnvFromPolicy(
   runtimeEnv: EnvLike,
   policy?: AgentRuntimeToolPolicy,
 ): EnvLike {
-  const enablesWorktreeShell =
-    Array.isArray(policy?.runtimeTools) &&
-    policy.runtimeTools.includes("execShell") &&
-    policy.shell?.enabled === true &&
-    policy.shell?.mode === "worktree";
-  return {
-    ...runtimeEnv,
-    ...(enablesWorktreeShell && !runtimeEnv.NOLO_LOCAL_SHELL_MODE
-      ? { NOLO_LOCAL_SHELL_MODE: "worktree" }
-      : {}),
-  };
+  void policy;
+  return { ...runtimeEnv };
 }
 
 export function resolveLocalWorkspaceExecutorOptionsFromPolicy(

package/agent-runtime/runtimeToolSurface.ts

@@ -0,0 +1,198 @@
+export const DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
+  "listDialogs",
+  "readDialog",
+  "listAgents",
+  "readAgent",
+  "listSpaces",
+  "readSpace",
+  "readDoc",
+  "readSkillDoc",
+  "queryTableRows",
+  "cliWhoami",
+  "cliDoctor",
+] as const;
+
+export type RuntimeToolSurfaceHost =
+  | "web"
+  | "cli"
+  | "desktop"
+  | "connector"
+  | "server";
+
+export type RuntimeToolSurfaceVisibility =
+  | "private"
+  | "public"
+  | "anonymous"
+  | "shared";
+
+export type RuntimeToolSurfaceInput = {
+  explicitToolNames?: string[] | null;
+  currentUserId?: string | null;
+  agentOwnerId?: string | null;
+  invocationVisibility?: RuntimeToolSurfaceVisibility;
+  runtimeHost: RuntimeToolSurfaceHost;
+  trustedPrivateInvocation?: boolean;
+};
+
+export type RuntimeToolSurfaceResult = {
+  explicitToolNames: string[];
+  injectedToolNames: string[];
+  finalToolNames: string[];
+  auditReason:
+    | "private-authenticated-defaults"
+    | "explicit-only-public"
+    | "explicit-only-anonymous"
+    | "explicit-only-shared"
+    | "explicit-only-missing-identity"
+    | "explicit-only-owner-mismatch";
+};
+
+export type RuntimeToolSurfaceForAgentInput = {
+  explicitToolNames?: string[] | null;
+  currentUserId?: string | null;
+  agentOwnerId?: string | null;
+  agentKey?: string | null;
+  isPublic?: boolean | null;
+  sharingLevel?: string | null;
+  runtimeHost: RuntimeToolSurfaceHost;
+  trustedPrivateInvocation?: boolean;
+};
+
+function uniqueToolNames(values: readonly string[]) {
+  return [
+    ...new Set(
+      values
+        .filter((value) => typeof value === "string")
+        .map((value) => value.trim())
+        .filter(Boolean)
+    ),
+  ];
+}
+
+function canInjectPrivateDefaults(args: RuntimeToolSurfaceInput) {
+  if (!args.currentUserId) return false;
+  if (args.invocationVisibility !== "private") return false;
+  if (args.agentOwnerId && args.agentOwnerId === args.currentUserId) return true;
+  if (args.trustedPrivateInvocation === true) return true;
+  return false;
+}
+
+function explicitOnlyReason(
+  args: RuntimeToolSurfaceInput
+): RuntimeToolSurfaceResult["auditReason"] {
+  if (!args.currentUserId || !args.agentOwnerId) {
+    return "explicit-only-missing-identity";
+  }
+  if (args.invocationVisibility === "public") return "explicit-only-public";
+  if (args.invocationVisibility === "shared") return "explicit-only-shared";
+  if (args.agentOwnerId !== args.currentUserId) {
+    return "explicit-only-owner-mismatch";
+  }
+  return "explicit-only-anonymous";
+}
+
+export function resolveRuntimeToolSurface(
+  args: RuntimeToolSurfaceInput
+): RuntimeToolSurfaceResult {
+  const explicitToolNames = uniqueToolNames(args.explicitToolNames ?? []);
+
+  if (canInjectPrivateDefaults(args)) {
+    const injectedToolNames = [...DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS];
+    return {
+      explicitToolNames,
+      injectedToolNames,
+      finalToolNames: uniqueToolNames([
+        ...explicitToolNames,
+        ...injectedToolNames,
+      ]),
+      auditReason: "private-authenticated-defaults",
+    };
+  }
+
+  return {
+    explicitToolNames,
+    injectedToolNames: [],
+    finalToolNames: explicitToolNames,
+    auditReason: explicitOnlyReason(args),
+  };
+}
+
+export function isPublicRuntimeAgentRef(value: unknown) {
+  return (
+    typeof value === "string" &&
+    (value.startsWith("agent-pub-") || value.startsWith("cybot-pub-"))
+  );
+}
+
+export function inferOwnerIdFromRuntimeAgentKey(value: unknown) {
+  if (typeof value !== "string") return null;
+  const privateAgentMatch = value.match(/^agent-([^-]+)-(.+)$/);
+  if (privateAgentMatch && privateAgentMatch[1] !== "pub") {
+    return privateAgentMatch[1];
+  }
+  const privateCybotMatch = value.match(/^cybot-([^-]+)-(.+)$/);
+  if (privateCybotMatch && privateCybotMatch[1] !== "pub") {
+    return privateCybotMatch[1];
+  }
+  return null;
+}
+
+export function resolveRuntimeToolSurfaceForAgent(
+  args: RuntimeToolSurfaceForAgentInput
+) {
+  const agentKey = typeof args.agentKey === "string" ? args.agentKey : "";
+  const currentUserId = typeof args.currentUserId === "string" ? args.currentUserId : "";
+  const inferredOwnerId =
+    args.agentOwnerId ??
+    (currentUserId &&
+    (agentKey.startsWith(`agent-${currentUserId}-`) ||
+      agentKey.startsWith(`cybot-${currentUserId}-`))
+      ? currentUserId
+      : inferOwnerIdFromRuntimeAgentKey(agentKey));
+  const publicRef = isPublicRuntimeAgentRef(agentKey);
+  const visibility =
+    args.trustedPrivateInvocation === true
+      ? "private"
+      : publicRef || args.isPublic === true || args.sharingLevel === "public"
+      ? "public"
+      : "private";
+  return resolveRuntimeToolSurface({
+    explicitToolNames: args.explicitToolNames,
+    currentUserId: args.currentUserId,
+    agentOwnerId: inferredOwnerId,
+    invocationVisibility: visibility,
+    runtimeHost: args.runtimeHost,
+    trustedPrivateInvocation: args.trustedPrivateInvocation,
+  });
+}
+
+const SECRET_FIELD_NAMES = [
+  "apikey",
+  "api_key",
+  "secret",
+  "token",
+  "authorization",
+  "credential",
+  "password",
+];
+
+function isSecretFieldName(key: string) {
+  const normalized = key.toLowerCase();
+  return SECRET_FIELD_NAMES.some((name) => normalized.includes(name));
+}
+
+export function redactAgentRecordForWorkspaceTool(record: unknown): unknown {
+  if (!record || typeof record !== "object") return record;
+  if (Array.isArray(record)) return record.map(redactAgentRecordForWorkspaceTool);
+  const redacted: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(record as Record<string, unknown>)) {
+    if (isSecretFieldName(key)) {
+      redacted[key] = "[redacted]";
+      continue;
+    }
+    redacted[key] = value && typeof value === "object"
+      ? redactAgentRecordForWorkspaceTool(value)
+      : value;
+  }
+  return redacted;
+}

package/agent-runtime/types.ts

@@ -55,6 +55,7 @@ export interface AgentRuntimeResult {
   tool_calls?: AgentRuntimeToolCall[];
   reasoning_content?: string;
   runtimeToolNames?: string[];
+  runtimeToolSurface?: unknown;
   toolCallCount?: number;
   policyState?: unknown;
   latencyProfile?: {

package/agentAliases.ts

@@ -1,4 +1,5 @@
 export const PLATFORM_DEMO_USER_ID = "b2e06f801f";
+export const CURRENT_OPERATOR_USER_ID = "0e95801d90";
 export const NOLO_DEFAULT_AGENT_ID = "01NOLOAPPBLD000000019KCKT0";
 export const NOLO_DEFAULT_AGENT_KEY = `agent-pub-${NOLO_DEFAULT_AGENT_ID}`;
 export const NOLO_PROJECT_MANAGER_AGENT_ID = "01NOLOPROJMGR00000000MSVGG";
@@ -9,7 +10,7 @@ export const NOLO_SENIOR_FULLSTACK_AGENT_KEY =
   `agent-${PLATFORM_DEMO_USER_ID}-${NOLO_SENIOR_FULLSTACK_AGENT_ID}`;
 export const NOLO_FRONTEND_AGENT_ID = "01FRONTENDAG0000000115N4E1";
 export const NOLO_FRONTEND_AGENT_KEY =
-  `agent-${PLATFORM_DEMO_USER_ID}-${NOLO_FRONTEND_AGENT_ID}`;
+  `agent-${CURRENT_OPERATOR_USER_ID}-${NOLO_FRONTEND_AGENT_ID}`;
 export const WIN_CODEX_AGENT_ID = "WINCODEX00000000FQ0LK0";
 export const WIN_CODEX_AGENT_KEY =
   `agent-0e95801d90-${WIN_CODEX_AGENT_ID}`;

package/agentRunCommand.ts

@@ -50,11 +50,10 @@ type ParsedAgentRunArgs = {
   parentDialogId?: string;
   background: boolean;
   noStream: boolean;
-  noDefaultTestRoot: boolean;
   cwd?: string;
-  maxToolRounds?: number;
   timeoutMs?: number;
   traceTools: boolean;
+  eventsMode?: "jsonl";
   injectFeatureWorktreeInstruction: boolean;
   taskRunContext?: TaskRunPromptContext;
   workflowRef?: string;
@@ -66,10 +65,6 @@ type ResolvedWorkflowReference = {
   config?: Partial<WorkflowReferenceConfig>;
 };
 
-const DEFAULT_TEST_ROOT_DIALOG_ID = "01KN6V3MVEQA4Q1PNKVM2W7YY8";
-const DEFAULT_TEST_ROOT_DIALOG_KEY = `dialog-b2e06f801f-${DEFAULT_TEST_ROOT_DIALOG_ID}`;
-const DEFAULT_TEST_DIALOG_CATEGORY_ID = "test-dialogs";
-
 function readFlagValue(args: string[], flag: string) {
   const index = args.indexOf(flag);
   if (index < 0) return undefined;
@@ -109,13 +104,6 @@ function isMonthlyMimoAgentRef(raw: string | undefined, resolved: string) {
   );
 }
 
-function parseNonNegativeInteger(value: string | undefined) {
-  if (!value) return undefined;
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed) || parsed < 0) return undefined;
-  return Math.floor(parsed);
-}
-
 function parsePositiveInteger(value: string | undefined) {
   if (!value) return undefined;
   const parsed = Number(value);
@@ -134,7 +122,6 @@ function positionalArgs(args: string[]) {
     "--bg",
     "--no-stream",
     "--debug",
-    "--no-default-test-root",
   ]);
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -167,20 +154,13 @@ export function parseAgentRunArgs(
   const spaceId = readFlagValue(args, "--space");
   const category = readFlagValue(args, "--category");
   const inheritedFromDialog = readFlagValue(args, "--inherit-from-dialog");
-  const noDefaultTestRoot = args.includes("--no-default-test-root");
   const cwd = readFlagValue(args, "--cwd");
-  const maxToolRounds = parseNonNegativeInteger(
-    readFlagValue(args, "--max-tool-rounds") ?? readFlagValue(args, "--rounds")
-  );
   const timeoutMs = parsePositiveInteger(readFlagValue(args, "--timeout-ms"));
+  const rawEventsMode = readFlagValue(args, "--events");
+  const eventsMode = rawEventsMode === "jsonl" ? "jsonl" : undefined;
   const inheritedRef = inheritedFromDialog
     ? parseDialogReference(inheritedFromDialog)
-    : !continueDialogId && !noDefaultTestRoot
-      ? {
-          dialogKey: DEFAULT_TEST_ROOT_DIALOG_KEY,
-          dialogId: DEFAULT_TEST_ROOT_DIALOG_ID,
-        }
-      : undefined;
+    : undefined;
   const imageUrls = [
     ...readRepeatedFlagValues(args, "--image"),
     ...readRepeatedFlagValues(args, "--image-url"),
@@ -199,6 +179,7 @@ export function parseAgentRunArgs(
     imageUrls,
     allowShell: args.includes("--dangerously-allow-shell") || mimoLocalWorkspaceDefault,
     traceTools: args.includes("--trace-tools"),
+    ...(eventsMode ? { eventsMode } : {}),
     injectFeatureWorktreeInstruction: mimoLocalWorkspaceDefault,
     ...(workflowRef ? { workflowRef } : {}),
     ...(taskRowDbKey
@@ -218,14 +199,12 @@ export function parseAgentRunArgs(
         : {}),
     background: args.includes("--bg"),
     noStream: args.includes("--no-stream"),
-    noDefaultTestRoot,
     ...(continueDialogId ? { continueDialogId } : {}),
     ...(!continueDialogId && spaceId ? { spaceId } : {}),
-    ...(category ? { category } : !continueDialogId && !noDefaultTestRoot ? { category: DEFAULT_TEST_DIALOG_CATEGORY_ID } : {}),
+    ...(category ? { category } : {}),
     ...(inheritedRef?.dialogKey ? { inheritedFromDialogKey: inheritedRef.dialogKey } : {}),
     ...(inheritedRef?.dialogId ? { parentDialogId: inheritedRef.dialogId } : {}),
     ...(cwd ? { cwd } : {}),
-    ...(typeof maxToolRounds === "number" ? { maxToolRounds } : {}),
     ...(typeof timeoutMs === "number" ? { timeoutMs } : {}),
   };
 }
@@ -411,16 +390,16 @@ function buildLocalRunEnv(args: {
   env: EnvLike;
   allowShell: boolean;
 }) {
+  void args.allowShell;
   return {
     ...args.env,
-    ...(args.allowShell ? { NOLO_LOCAL_SHELL_MODE: "worktree" } : {}),
   };
 }
 
 function writeUsage(output: OutputLike) {
   output.write(
-    "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--continue <dialogId>] [--cwd <path>] [--max-tool-rounds <n>]\n" +
-      "       nolo agent run --agent <agent> (--msg <message>|--msg-file <path>) [--image <url-or-path>] [--space <spaceId>] [--category <name>] [--inherit-from-dialog <dialog>] [--task-row-dbkey <key>] [--bg] [--timeout-ms <n>] [--no-stream]\n"
+    "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--continue <dialogId>] [--cwd <path>]\n" +
+      "       nolo agent run --agent <agent> (--msg <message>|--msg-file <path>) [--image <url-or-path>] [--space <spaceId>] [--category <name>] [--inherit-from-dialog <dialog>] [--task-row-dbkey <key>] [--bg] [--timeout-ms <n>] [--events jsonl] [--no-stream]\n"
   );
 }
 
@@ -480,10 +459,9 @@ export async function runAgentRunCommand(args: string[], deps: AgentRunCommandDe
     ...(parsed.parentDialogId ? { parentDialogId: parsed.parentDialogId } : {}),
     background: parsed.background,
     noStream: parsed.noStream,
-    noDefaultTestRoot: parsed.noDefaultTestRoot,
-    ...(typeof parsed.maxToolRounds === "number" ? { maxToolRounds: parsed.maxToolRounds } : {}),
     ...(typeof parsed.timeoutMs === "number" ? { timeoutMs: parsed.timeoutMs } : {}),
     traceTools: parsed.traceTools,
+    ...(parsed.eventsMode ? { eventsMode: parsed.eventsMode } : {}),
     ...(parsed.taskRunContext ? { taskRunContext: parsed.taskRunContext } : {}),
   });
 

package/agentRuntimeLocal.ts

@@ -20,6 +20,7 @@ export {
   resolveLocalToolPolicy,
   resolveOpenAiCompatibleProviderConfig,
   resolveRequestedRuntimeToolNames,
+  resolveRuntimeToolSurfaceForAgent,
   evaluateShellCommandPolicy,
   isDestructiveShellCommand,
   shouldUsePlatformChatProvider,