nolo-cli 0.1.39 → 0.1.40

package/client/localRuntimeAdapter.ts

@@ -21,6 +21,7 @@ import {
   resolveCurrentRunRuntimeToolPolicy,
   resolveLocalWorkspaceExecutorOptionsFromPolicy,
   resolveRequestedRuntimeToolNames,
+  resolveRuntimeToolSurfaceForAgent,
   shouldUsePlatformChatProvider,
 } from "../agentRuntimeLocal";
 import type { AgentRuntimeChatMessage } from "../agent-runtime";
@@ -43,6 +44,7 @@ import {
 import { executeLocalToolWithPolicy } from "./localToolPolicy";
 import { taskRunFunctionSchema } from "../ai/tools/agent/taskRunTool";
 import {
+  MIMO_MONTH_AGENT_KEY,
   NOLO_DEFAULT_AGENT_ID,
   NOLO_DEFAULT_AGENT_KEY,
 } from "../agentAliases";
@@ -50,14 +52,26 @@ import {
   buildNoloWorkspaceCliToolExecutors,
   buildNoloWorkspaceOpenAiTools,
   filterNoloWorkspaceToolNames,
-  NOLO_WORKSPACE_TOOL_NAMES,
-  NOLO_WORKSPACE_TOOL_PROMPT,
   parseNoloWorkspaceToolArguments,
 } from "../agent-runtime/noloWorkspaceTools";
+import { executeCli as defaultExecuteCli, type CliExecuteResult, type CliImageInput } from "../ai/agent/cliExecutor";
+import { buildCliPrompt } from "../ai/agent/cliPrompt";
 
 type EnvLike = Record<string, string | undefined>;
 type FetchInput = Parameters<typeof fetch>[0];
 type FetchInit = Parameters<typeof fetch>[1];
+type LocalCliExecutor = (
+  provider: string,
+  prompt: string,
+  options: {
+    model?: string;
+    timeout?: number;
+    cwd?: string;
+    yolo?: boolean;
+    env?: Record<string, string | undefined>;
+    imageInputs?: CliImageInput[];
+  }
+) => Promise<CliExecuteResult>;
 const TRANSIENT_FETCH_MAX_ATTEMPTS = 8;
 const TRANSIENT_FETCH_RETRY_BASE_DELAY_MS = 250;
 export const BUILTIN_NOLO_AGENT_ID = NOLO_DEFAULT_AGENT_ID;
@@ -77,6 +91,7 @@ export type CliLocalRuntimeAdapterDeps = {
   cwd?: string;
   output?: { write(chunk: string): unknown };
   localToolExecutors?: Record<string, (call: any) => Promise<{ content: string; metadata?: Record<string, unknown> }>>;
+  executeCli?: LocalCliExecutor;
   sleep?: (ms: number) => Promise<void>;
   loopbackRequest?: (input: FetchInput, init?: FetchInit) => Promise<Response>;
 };
@@ -93,10 +108,6 @@ function resolveLocalUserId(env: EnvLike) {
   return env.NOLO_LOCAL_USER_ID || env.NOLO_USER_ID || "local";
 }
 
-function shellModeEnabled(env: EnvLike) {
-  return env.NOLO_LOCAL_SHELL_MODE === "worktree";
-}
-
 function parseLocalToolBudgets(env: EnvLike) {
   const raw = env.NOLO_LOCAL_TOOL_BUDGETS?.trim();
   if (!raw) return {};
@@ -251,7 +262,79 @@ function parseJsonObject(raw: string) {
   }
 }
 
+function isCliProviderAgent(agentConfig: AgentRuntimeAgentConfig) {
+  return Boolean(
+    agentConfig.apiSource === "cli" ||
+      agentConfig.provider === "cli" ||
+      agentConfig.cliProvider
+  );
+}
+
+function resolveCliProviderName(agentConfig: AgentRuntimeAgentConfig) {
+  return (agentConfig.cliProvider || agentConfig.provider || "codex").trim() || "codex";
+}
+
+function stringifyRuntimeMessageContent(content: AgentRuntimeChatMessage["content"]) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((part) => {
+        if (typeof part === "string") return part;
+        if (part && typeof part === "object" && "text" in part) {
+          return String((part as any).text ?? "");
+        }
+        return JSON.stringify(part);
+      })
+      .filter((part) => part.trim())
+      .join("\n");
+  }
+  return content == null ? "" : String(content);
+}
+
+function buildPromptForCliProvider(messages: AgentRuntimeChatMessage[]) {
+  const systemPrompt = messages
+    .filter((message) => message.role === "system")
+    .map((message) => stringifyRuntimeMessageContent(message.content).trim())
+    .filter(Boolean)
+    .join("\n\n");
+  const taskPrompt = messages
+    .filter((message) => message.role !== "system")
+    .map((message) => {
+      const content = stringifyRuntimeMessageContent(message.content).trim();
+      if (!content) return "";
+      return `[${message.role}]\n${content}`;
+    })
+    .filter(Boolean)
+    .join("\n\n");
+  return buildCliPrompt(systemPrompt, taskPrompt);
+}
+
+function collectCliProviderImageInputs(messages: AgentRuntimeChatMessage[]) {
+  const urls: string[] = [];
+  for (const message of messages) {
+    if (!Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (
+        part &&
+        typeof part === "object" &&
+        (part as any).type === "image_url" &&
+        typeof (part as any).image_url?.url === "string" &&
+        (part as any).image_url.url.trim()
+      ) {
+        urls.push((part as any).image_url.url.trim());
+      }
+    }
+  }
+  return urls;
+}
+
 function logLocalRuntimeDiagnostic(event: string, fields: Record<string, unknown>) {
+  if (
+    process.env.NOLO_LOCAL_RUNTIME_DEBUG !== "1" &&
+    process.env.NOLO_DEBUG !== "1"
+  ) {
+    return;
+  }
   console.error(`[nolo-local-runtime] ${event} ${JSON.stringify(fields)}`);
 }
 
@@ -266,31 +349,38 @@ function summarizeOpenAiToolNames(tools: Array<Record<string, unknown>>) {
     .filter((name): name is string => Boolean(name));
 }
 
-function buildOpenAiTools(args: { toolNames?: string[]; env: EnvLike }) {
+function shouldExposeLocalPlatformTools(agentKey?: string) {
+  return agentKey !== MIMO_MONTH_AGENT_KEY;
+}
+
+function buildOpenAiTools(args: { agentKey?: string; toolNames?: string[]; env: EnvLike }) {
   const toolset = buildLocalWorkspaceToolsetForEnv(args);
+  const exposePlatformTools = shouldExposeLocalPlatformTools(args.agentKey);
   return [
     ...buildLocalWorkspaceOpenAiTools({
       toolNames: toolset.toolNames,
       exposeShellTools: toolset.exposeShellTools,
     }),
-    ...buildServerPlatformOpenAiTools({ toolNames: args.toolNames }),
-    ...buildNoloWorkspaceOpenAiTools({ toolNames: args.toolNames }),
+    ...(exposePlatformTools ? buildServerPlatformOpenAiTools({ toolNames: args.toolNames }) : []),
+    ...(exposePlatformTools ? buildNoloWorkspaceOpenAiTools({ toolNames: args.toolNames }) : []),
   ];
 }
 
 function buildLocalWorkspaceToolsetForEnv(args: { toolNames?: string[]; env: EnvLike }) {
+  void args.env;
   const toolset = buildLocalWorkspaceToolset({
     declaredToolNames: args.toolNames,
-    exposeShellTools: shellModeEnabled(args.env),
+    exposeShellTools: true,
   });
   return toolset;
 }
 
 function buildLocalPolicyToolNames(args: { toolNames?: string[]; env: EnvLike }) {
+  void args.env;
   return [
     ...buildLocalWorkspacePolicyToolNames({
       declaredToolNames: args.toolNames,
-      exposeShellTools: shellModeEnabled(args.env),
+      exposeShellTools: true,
     }),
     ...((args.toolNames ?? []).includes("taskRun") ? ["taskRun"] : []),
     ...filterNoloWorkspaceToolNames(args.toolNames),
@@ -336,16 +426,32 @@ function isBuiltinNoloAgentConfig(agentConfig: AgentRuntimeAgentConfig | null |
   return isBuiltinNoloAgentRef(key) || isBuiltinNoloAgentRef(id);
 }
 
-function withBuiltinNoloCliTools(agentConfig: AgentRuntimeAgentConfig | null) {
-  if (!agentConfig || !isBuiltinNoloAgentConfig(agentConfig)) return agentConfig;
-  const toolNames = [...new Set([...(agentConfig.toolNames ?? []), ...NOLO_WORKSPACE_TOOL_NAMES])];
+function withResolvedRuntimeToolSurface(
+  agentConfig: AgentRuntimeAgentConfig | null,
+  env: EnvLike
+) {
+  if (!agentConfig) return agentConfig;
+  const currentUserId = resolveLocalUserId(env);
+  const rawRecord = (agentConfig as any).rawRecord ?? {};
+  const ownerId =
+    typeof rawRecord.userId === "string" && rawRecord.userId.trim()
+      ? rawRecord.userId.trim()
+      : null;
+  const toolSurface = resolveRuntimeToolSurfaceForAgent({
+    explicitToolNames: agentConfig.toolNames,
+    currentUserId,
+    agentOwnerId: ownerId,
+    agentKey: rawRecord.dbKey ?? agentConfig.key,
+    isPublic: !isBuiltinNoloAgentConfig(agentConfig) && rawRecord.isPublic === true,
+    sharingLevel: typeof rawRecord.sharingLevel === "string" ? rawRecord.sharingLevel : null,
+    trustedPrivateInvocation: isBuiltinNoloAgentConfig(agentConfig),
+    runtimeHost: "cli",
+  });
   return {
     ...agentConfig,
-    toolNames,
-    prompt: [
-      agentConfig.prompt?.trim() ?? "",
-      NOLO_WORKSPACE_TOOL_PROMPT,
-    ].filter(Boolean).join("\n\n"),
+    toolNames: toolSurface.finalToolNames,
+    toolSurface,
+    prompt: agentConfig.prompt,
   };
 }
 
@@ -500,11 +606,14 @@ export function createCliLocalRuntimeAdapter(
     host: "cli",
     capabilities: ["leveldb-agent-config", "local-provider", "leveldb-persistence", "local-tools"],
     loadAgentConfig: async (agentRef) => {
-      const agentConfig = withBuiltinNoloCliTools(await readAgentFromStore({
-        agentRef,
-        store: await resolveStore(deps),
-        userId,
-      }));
+      const agentConfig = withResolvedRuntimeToolSurface(
+        await readAgentFromStore({
+          agentRef,
+          store: await resolveStore(deps),
+          userId,
+        }),
+        deps.env
+      );
       const requestedToolNames = agentConfig
         ? resolveRequestedRuntimeToolNames({ agentConfig })
         : [];
@@ -537,6 +646,50 @@ export function createCliLocalRuntimeAdapter(
       cwd: workspaceRoot,
     }),
     resolveProvider: async (agentConfig) => {
+      if (isCliProviderAgent(agentConfig)) {
+        const provider = resolveCliProviderName(agentConfig);
+        logLocalRuntimeDiagnostic("provider.selected", {
+          agentKey: agentConfig.key,
+          transport: "local-cli",
+          apiSource: agentConfig.apiSource ?? null,
+          provider,
+          model: agentConfig.model ?? null,
+          cwd: workspaceRoot,
+        });
+        return {
+          model: agentConfig.model || provider,
+          complete: async (messages, options) => {
+            const executeCli = deps.executeCli ?? (defaultExecuteCli as LocalCliExecutor);
+            const imageUrls = collectCliProviderImageInputs(messages);
+            const imageInputs: CliImageInput[] | undefined =
+              imageUrls.length > 0
+                ? imageUrls.map((url) => ({ source: url }))
+                : undefined;
+            const prompt = buildPromptForCliProvider(messages);
+            try {
+              const result = await executeCli(provider, prompt, {
+                ...(agentConfig.model ? { model: agentConfig.model } : {}),
+                ...(options?.timeoutMs ? { timeout: options.timeoutMs } : {}),
+                cwd: workspaceRoot,
+                yolo: true,
+                env: deps.env,
+                ...(imageInputs ? { imageInputs } : {}),
+              });
+              return {
+                content: result.text,
+                model: agentConfig.model || provider,
+                raw: result.raw,
+              };
+            } catch (error) {
+              const message = error instanceof Error ? error.message : String(error);
+              throw new Error(
+                `Local CLI provider "${provider}" is unavailable or failed: ${message}`
+              );
+            }
+          },
+        };
+      }
+
       if (shouldUsePlatformChatProvider(deps.env, agentConfig)) {
         const providerConfig = resolvePlatformChatProviderConfig({
           agentConfig,
@@ -563,6 +716,7 @@ export function createCliLocalRuntimeAdapter(
               agentConfig,
             });
             const tools = buildOpenAiTools({
+              agentKey: agentConfig.key,
               toolNames: requestedToolNames,
               env: deps.env,
             });
@@ -582,7 +736,6 @@ export function createCliLocalRuntimeAdapter(
               toolCount: tools.length,
               requestedToolNames,
               openAiToolNames: summarizeOpenAiToolNames(tools),
-              shellMode: deps.env.NOLO_LOCAL_SHELL_MODE ?? null,
               timeoutMs: options?.timeoutMs ?? null,
             });
             const res = await fetchWithTransientRetry(fetchImpl, request.url, {
@@ -636,6 +789,7 @@ export function createCliLocalRuntimeAdapter(
             agentConfig,
           });
           const tools = buildOpenAiTools({
+            agentKey: agentConfig.key,
             toolNames: requestedToolNames,
             env: deps.env,
           });
@@ -654,7 +808,6 @@ export function createCliLocalRuntimeAdapter(
             toolCount: tools.length,
             requestedToolNames,
             openAiToolNames: summarizeOpenAiToolNames(tools),
-            shellMode: deps.env.NOLO_LOCAL_SHELL_MODE ?? null,
             timeoutMs: options?.timeoutMs ?? null,
           });
           const res = await fetchWithTransientRetry(fetchImpl, request.url, {

package/client/localRuntimeDryRun.test.ts

@@ -7,6 +7,26 @@ import { runLocalAgentTurn } from "../agent-runtime/localLoop";
 import { createCliLocalRuntimeAdapter } from "./localRuntimeAdapter";
 
 describe("CLI local runtime dry run", () => {
+  const DEFAULT_PRIVATE_LOCAL_TOOL_NAMES = [
+    "listFiles",
+    "readFile",
+    "writeFile",
+    "editFile",
+    "searchFiles",
+    "execShell",
+    "listDialogs",
+    "readDialog",
+    "listAgents",
+    "readAgent",
+    "listSpaces",
+    "readSpace",
+    "readDoc",
+    "readSkillDoc",
+    "queryTableRows",
+    "cliWhoami",
+    "cliDoctor",
+  ];
+
   test("lets a declared workspace file tool write a file and save the tool trace", async () => {
     const workspaceRoot = mkdtempSync(join(tmpdir(), "nolo-local-runtime-dry-run-"));
     try {
@@ -18,7 +38,7 @@ describe("CLI local runtime dry run", () => {
           prompt: "Use workspace file tools to edit files.",
           model: "qwen-coder",
           tools: [
-            { type: "function", function: { name: "writeWorkspaceFile" } },
+            { type: "function", function: { name: "writeFile" } },
           ],
         }],
       ]);
@@ -52,13 +72,7 @@ describe("CLI local runtime dry run", () => {
           const body = JSON.parse(String(init?.body));
           completeCount += 1;
           if (completeCount === 1) {
-            expect(body.tools.map((tool: any) => tool.function.name)).toEqual([
-              "writeWorkspaceFile",
-              "listFiles",
-              "readFile",
-              "editFile",
-              "searchFiles",
-            ]);
+            expect(body.tools.map((tool: any) => tool.function.name)).toEqual(DEFAULT_PRIVATE_LOCAL_TOOL_NAMES);
             return Response.json({
               model: "qwen-coder",
               choices: [{
@@ -68,7 +82,7 @@ describe("CLI local runtime dry run", () => {
                     id: "call-1",
                     type: "function",
                     function: {
-                      name: "writeWorkspaceFile",
+                      name: "writeFile",
                       arguments: JSON.stringify({
                         path: "src/notification.css",
                         content: ".notification { border-radius: 8px; }\n",

package/client/localToolPolicy.test.ts

@@ -3,20 +3,20 @@ import { describe, expect, test } from "bun:test";
 import { executeLocalToolWithPolicy, resolveLocalToolPolicy } from "./localToolPolicy";
 
 describe("CLI local tool policy", () => {
-  test("allows execShell in explicit worktree shell mode", () => {
+  test("allows execShell by default", () => {
     expect(resolveLocalToolPolicy({
-      env: { NOLO_LOCAL_SHELL_MODE: "worktree" },
+      env: {},
       agentToolNames: [],
       toolName: "execShell",
     })).toEqual({ allowed: true, toolName: "execShell" });
   });
 
-  test("blocks execShell unless explicit shell mode is enabled", () => {
+  test("allows execShell even without env allowlist", () => {
     expect(resolveLocalToolPolicy({
       env: { NOLO_LOCAL_ALLOWED_TOOLS: "execShell" },
       agentToolNames: ["execShell"],
       toolName: "execShell",
-    })).toMatchObject({ allowed: false });
+    })).toEqual({ allowed: true, toolName: "execShell" });
   });
 
   test("requires both env allowlist and agent declaration", () => {

package/commandRegistry.ts

@@ -69,8 +69,8 @@ export function renderHelpText() {
     "  nolo space read 01KKY77TT0DA9NY7TNW3R7255N --content-key page-user-id --brief",
     "  nolo space delete --name-prefix rn_owner_verify_0504 --yes",
     "  nolo table query --table 01ABCXYZ",
-    '  nolo table query --table meta-b2e06f801f-NOLOTASKBOARD --columns \'["title","status","owner","priority","codeStatus"]\' --no-base-fields --output items',
-    '  nolo table update-row --table meta-b2e06f801f-NOLOTASKBOARD --row 01ROWID --changes \'{"status":"已完成"}\'',
+    '  nolo table query --table meta-0e95801d90-NOLOTASKBOARD --columns \'["title","status","owner","priority","codeStatus"]\' --no-base-fields --output items',
+    '  nolo table update-row --table meta-0e95801d90-NOLOTASKBOARD --row 01ROWID --changes \'{"status":"已完成"}\'',
     "  nolo task-run read-context --row-dbkey row-user-table-row",
     "  nolo llama status",
   ];

package/database/server/levelAuthorityStore.ts

@@ -48,6 +48,25 @@ export function createLevelAuthorityStore(
   const levelDb: LevelLike = typeof source === "string"
     ? new Level<string, any>(source, { valueEncoding: safeJsonEncoding })
     : source;
+  const writeBatchOps = async (ops: AuthorityBatchOperation[]) => {
+    const result = levelDb.batch(ops);
+    if (result && typeof (result as any).then === "function") {
+      await result;
+      return;
+    }
+    if (result && typeof (result as any).write === "function") {
+      for (const op of ops) {
+        if (op.type === "put") {
+          (result as LevelBatchWriterLike).put(op.key, op.value);
+        } else {
+          (result as LevelBatchWriterLike).del(op.key);
+        }
+      }
+      await (result as LevelBatchWriterLike).write();
+      return;
+    }
+    throw new Error("Level backing does not support batch writes");
+  };
 
   return {
     get location() {
@@ -72,7 +91,7 @@ export function createLevelAuthorityStore(
       await levelDb.del(key);
     },
     async batchWrite(ops: AuthorityBatchOperation[]) {
-      await levelDb.batch(ops);
+      await writeBatchOps(ops);
     },
     createBatch(): AuthorityBatchWriter {
       const batch = levelDb.batch();

package/machineWsRunDispatch.ts

@@ -20,9 +20,52 @@ type EnvLike = Record<string, string | undefined>;
 export type LocalCliExecutor = (
   provider: string,
   prompt: string,
-  options: { model?: string; timeout?: number; cwd?: string; yolo?: boolean; env?: EnvLike }
+  options: {
+    model?: string;
+    timeout?: number;
+    cwd?: string;
+    yolo?: boolean;
+    env?: EnvLike;
+    imageInputs?: Array<{ source: string; materializedPath?: string }>;
+  }
 ) => Promise<{ text: string; raw?: string; elapsed?: number }>;
 
+/**
+ * 从 connector payload 的 userInput 中提取 multimodal 内容。
+ * 如果 userInput 是字符串，直接返回 { text, imageUrls: [] }。
+ * 如果 userInput 是 multimodal content array（`[{ type: "text" }, { type: "image_url" }]`），
+ * 提取 text 和 image_url parts。
+ */
+function extractMultimodalUserInput(userInput: unknown): {
+  text: string;
+  imageUrls: string[];
+} {
+  if (typeof userInput === "string") {
+    return { text: userInput, imageUrls: [] };
+  }
+  if (!Array.isArray(userInput)) {
+    return { text: String(userInput ?? ""), imageUrls: [] };
+  }
+
+  const textParts: string[] = [];
+  const imageUrls: string[] = [];
+
+  for (const part of userInput) {
+    if (!part || typeof part !== "object") continue;
+    if ((part as any).type === "text" && typeof (part as any).text === "string") {
+      textParts.push((part as any).text);
+    } else if (
+      (part as any).type === "image_url" &&
+      typeof (part as any).image_url?.url === "string" &&
+      (part as any).image_url.url.trim()
+    ) {
+      imageUrls.push((part as any).image_url.url.trim());
+    }
+  }
+
+  return { text: textParts.join("\n"), imageUrls };
+}
+
 type ConnectorRuntimePolicy = {
   runtimeTools?: string[];
   agentTools?: string[];
@@ -103,7 +146,6 @@ function summarizeRuntimePolicyForLogs(policy?: ConnectorRuntimePolicy) {
     workspaceMode: policy?.workspace?.mode ?? null,
     workspaceCwd: policy?.workspace?.cwd ?? null,
     shellEnabled: policy?.shell?.enabled ?? null,
-    shellMode: policy?.shell?.mode ?? null,
   };
 }
 
@@ -188,13 +230,13 @@ function runtimeWorkspacePermissionPolicy(
   runtimeEnv: EnvLike,
   cwd: string
 ): PermissionPolicy | null {
+  void runtimeEnv;
   if (!requestsLocalWorkspaceRuntime(runtimePolicy)) return null;
   return {
     mode: "full_access",
     allowFilesystemRead: true,
     allowFilesystemWrite: true,
     allowShell:
-      runtimeEnv.NOLO_LOCAL_SHELL_MODE === "worktree" &&
       Array.isArray(runtimePolicy?.runtimeTools) &&
       runtimePolicy.runtimeTools.includes("execShell"),
     writableRoots: [cwd],
@@ -332,8 +374,6 @@ async function defaultRunConnectorLocalRuntimeAgent(args: {
     requestId: args.parsed.requestId,
     agentKey,
     cwd: args.cwd,
-    runtimeEnvShellModeBeforePolicy: args.runtimeEnv.NOLO_LOCAL_SHELL_MODE ?? null,
-    runtimeEnvShellModeAfterPolicy: env.NOLO_LOCAL_SHELL_MODE ?? null,
     ...summarizeRuntimePolicyForLogs(policy),
   });
   const adapter = createCliLocalRuntimeAdapter({
@@ -454,7 +494,9 @@ export async function handleConnectorRunMessage(
   try {
     const machinePermissionPolicy = resolveMachineRunPermissionPolicy(agentConfig);
     const runtimePolicy = runtimePolicyFromConnectorPayload(parsed);
-    const userInput = String(parsed.payload?.userInput ?? "");
+    const extractedInput = extractMultimodalUserInput(parsed.payload?.userInput);
+    const userInput = extractedInput.text;
+    const connectorImageUrls = extractedInput.imageUrls;
     const timeout = normalizeConnectorRunTimeoutMs(parsed.payload?.timeoutMs);
     let cwd = resolveConnectorRunCwd({ env: runtimeEnv, policy: machinePermissionPolicy });
     let runContent = "";
@@ -553,6 +595,9 @@ export async function handleConnectorRunMessage(
             effectiveRuntimeEnv.AUTH_TOKEN ||
             effectiveRuntimeEnv.AUTH,
         },
+        ...(connectorImageUrls.length > 0
+          ? { imageInputs: connectorImageUrls.map((url) => ({ source: url })) }
+          : {}),
       }).finally(() => clearInterval(heartbeat));
       logConnectorRun("agent.run.cli.result", {
         requestId: parsed.requestId,

package/offlineMarxistsAgentCommand.ts

@@ -40,15 +40,17 @@ function readFlagValue(args: string[], flag: string) {
 }
 
 function parseUserIdFromToken(token: string) {
-  const payload = token.split(".")[0];
-  if (!payload) return "";
+  const payload = token.split(".")[1];
+  if (!payload) return undefined;
   try {
     const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
     const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
     const parsed = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
-    return typeof parsed?.userId === "string" ? parsed.userId : "";
+    return typeof parsed?.userId === "string" && parsed.userId.trim()
+      ? parsed.userId.trim()
+      : undefined;
   } catch {
-    return "";
+    return undefined;
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nolo-cli",
-  "version": "0.1.39",
+  "version": "0.1.40",
   "type": "module",
   "description": "Agent-first terminal workspace for Nolo",
   "bin": {
@@ -169,6 +169,7 @@
     "agent-runtime/hybridRecordStore.ts",
     "agent-runtime/localToolPolicy.ts",
     "agent-runtime/shellCommandPolicy.ts",
+    "agent-runtime/runtimeToolSurface.ts",
     "connector-experimental/heartbeatLoop.ts",
     "connector-experimental/capabilities.ts",
     "connector-experimental/codexBinary.ts",