nolo-cli 0.1.39 → 0.1.41

package/agent-runtime/runtimeToolPolicy.ts

@@ -132,17 +132,8 @@ export function resolveLocalRuntimeEnvFromPolicy(
   runtimeEnv: EnvLike,
   policy?: AgentRuntimeToolPolicy,
 ): EnvLike {
-  const enablesWorktreeShell =
-    Array.isArray(policy?.runtimeTools) &&
-    policy.runtimeTools.includes("execShell") &&
-    policy.shell?.enabled === true &&
-    policy.shell?.mode === "worktree";
-  return {
-    ...runtimeEnv,
-    ...(enablesWorktreeShell && !runtimeEnv.NOLO_LOCAL_SHELL_MODE
-      ? { NOLO_LOCAL_SHELL_MODE: "worktree" }
-      : {}),
-  };
+  void policy;
+  return { ...runtimeEnv };
 }
 
 export function resolveLocalWorkspaceExecutorOptionsFromPolicy(

package/agent-runtime/runtimeToolSurface.ts

@@ -0,0 +1,198 @@
+export const DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS = [
+  "listDialogs",
+  "readDialog",
+  "listAgents",
+  "readAgent",
+  "listSpaces",
+  "readSpace",
+  "readDoc",
+  "readSkillDoc",
+  "queryTableRows",
+  "cliWhoami",
+  "cliDoctor",
+] as const;
+
+export type RuntimeToolSurfaceHost =
+  | "web"
+  | "cli"
+  | "desktop"
+  | "connector"
+  | "server";
+
+export type RuntimeToolSurfaceVisibility =
+  | "private"
+  | "public"
+  | "anonymous"
+  | "shared";
+
+export type RuntimeToolSurfaceInput = {
+  explicitToolNames?: string[] | null;
+  currentUserId?: string | null;
+  agentOwnerId?: string | null;
+  invocationVisibility?: RuntimeToolSurfaceVisibility;
+  runtimeHost: RuntimeToolSurfaceHost;
+  trustedPrivateInvocation?: boolean;
+};
+
+export type RuntimeToolSurfaceResult = {
+  explicitToolNames: string[];
+  injectedToolNames: string[];
+  finalToolNames: string[];
+  auditReason:
+    | "private-authenticated-defaults"
+    | "explicit-only-public"
+    | "explicit-only-anonymous"
+    | "explicit-only-shared"
+    | "explicit-only-missing-identity"
+    | "explicit-only-owner-mismatch";
+};
+
+export type RuntimeToolSurfaceForAgentInput = {
+  explicitToolNames?: string[] | null;
+  currentUserId?: string | null;
+  agentOwnerId?: string | null;
+  agentKey?: string | null;
+  isPublic?: boolean | null;
+  sharingLevel?: string | null;
+  runtimeHost: RuntimeToolSurfaceHost;
+  trustedPrivateInvocation?: boolean;
+};
+
+function uniqueToolNames(values: readonly string[]) {
+  return [
+    ...new Set(
+      values
+        .filter((value) => typeof value === "string")
+        .map((value) => value.trim())
+        .filter(Boolean)
+    ),
+  ];
+}
+
+function canInjectPrivateDefaults(args: RuntimeToolSurfaceInput) {
+  if (!args.currentUserId) return false;
+  if (args.invocationVisibility !== "private") return false;
+  if (args.agentOwnerId && args.agentOwnerId === args.currentUserId) return true;
+  if (args.trustedPrivateInvocation === true) return true;
+  return false;
+}
+
+function explicitOnlyReason(
+  args: RuntimeToolSurfaceInput
+): RuntimeToolSurfaceResult["auditReason"] {
+  if (!args.currentUserId || !args.agentOwnerId) {
+    return "explicit-only-missing-identity";
+  }
+  if (args.invocationVisibility === "public") return "explicit-only-public";
+  if (args.invocationVisibility === "shared") return "explicit-only-shared";
+  if (args.agentOwnerId !== args.currentUserId) {
+    return "explicit-only-owner-mismatch";
+  }
+  return "explicit-only-anonymous";
+}
+
+export function resolveRuntimeToolSurface(
+  args: RuntimeToolSurfaceInput
+): RuntimeToolSurfaceResult {
+  const explicitToolNames = uniqueToolNames(args.explicitToolNames ?? []);
+
+  if (canInjectPrivateDefaults(args)) {
+    const injectedToolNames = [...DEFAULT_PRIVATE_NOLO_WORKSPACE_TOOLS];
+    return {
+      explicitToolNames,
+      injectedToolNames,
+      finalToolNames: uniqueToolNames([
+        ...explicitToolNames,
+        ...injectedToolNames,
+      ]),
+      auditReason: "private-authenticated-defaults",
+    };
+  }
+
+  return {
+    explicitToolNames,
+    injectedToolNames: [],
+    finalToolNames: explicitToolNames,
+    auditReason: explicitOnlyReason(args),
+  };
+}
+
+export function isPublicRuntimeAgentRef(value: unknown) {
+  return (
+    typeof value === "string" &&
+    (value.startsWith("agent-pub-") || value.startsWith("cybot-pub-"))
+  );
+}
+
+export function inferOwnerIdFromRuntimeAgentKey(value: unknown) {
+  if (typeof value !== "string") return null;
+  const privateAgentMatch = value.match(/^agent-([^-]+)-(.+)$/);
+  if (privateAgentMatch && privateAgentMatch[1] !== "pub") {
+    return privateAgentMatch[1];
+  }
+  const privateCybotMatch = value.match(/^cybot-([^-]+)-(.+)$/);
+  if (privateCybotMatch && privateCybotMatch[1] !== "pub") {
+    return privateCybotMatch[1];
+  }
+  return null;
+}
+
+export function resolveRuntimeToolSurfaceForAgent(
+  args: RuntimeToolSurfaceForAgentInput
+) {
+  const agentKey = typeof args.agentKey === "string" ? args.agentKey : "";
+  const currentUserId = typeof args.currentUserId === "string" ? args.currentUserId : "";
+  const inferredOwnerId =
+    args.agentOwnerId ??
+    (currentUserId &&
+    (agentKey.startsWith(`agent-${currentUserId}-`) ||
+      agentKey.startsWith(`cybot-${currentUserId}-`))
+      ? currentUserId
+      : inferOwnerIdFromRuntimeAgentKey(agentKey));
+  const publicRef = isPublicRuntimeAgentRef(agentKey);
+  const visibility =
+    args.trustedPrivateInvocation === true
+      ? "private"
+      : publicRef || args.isPublic === true || args.sharingLevel === "public"
+      ? "public"
+      : "private";
+  return resolveRuntimeToolSurface({
+    explicitToolNames: args.explicitToolNames,
+    currentUserId: args.currentUserId,
+    agentOwnerId: inferredOwnerId,
+    invocationVisibility: visibility,
+    runtimeHost: args.runtimeHost,
+    trustedPrivateInvocation: args.trustedPrivateInvocation,
+  });
+}
+
+const SECRET_FIELD_NAMES = [
+  "apikey",
+  "api_key",
+  "secret",
+  "token",
+  "authorization",
+  "credential",
+  "password",
+];
+
+function isSecretFieldName(key: string) {
+  const normalized = key.toLowerCase();
+  return SECRET_FIELD_NAMES.some((name) => normalized.includes(name));
+}
+
+export function redactAgentRecordForWorkspaceTool(record: unknown): unknown {
+  if (!record || typeof record !== "object") return record;
+  if (Array.isArray(record)) return record.map(redactAgentRecordForWorkspaceTool);
+  const redacted: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(record as Record<string, unknown>)) {
+    if (isSecretFieldName(key)) {
+      redacted[key] = "[redacted]";
+      continue;
+    }
+    redacted[key] = value && typeof value === "object"
+      ? redactAgentRecordForWorkspaceTool(value)
+      : value;
+  }
+  return redacted;
+}

package/agent-runtime/types.ts

@@ -55,6 +55,7 @@ export interface AgentRuntimeResult {
   tool_calls?: AgentRuntimeToolCall[];
   reasoning_content?: string;
   runtimeToolNames?: string[];
+  runtimeToolSurface?: unknown;
   toolCallCount?: number;
   policyState?: unknown;
   latencyProfile?: {

package/agentAliases.ts

@@ -1,4 +1,5 @@
 export const PLATFORM_DEMO_USER_ID = "b2e06f801f";
+export const CURRENT_OPERATOR_USER_ID = "0e95801d90";
 export const NOLO_DEFAULT_AGENT_ID = "01NOLOAPPBLD000000019KCKT0";
 export const NOLO_DEFAULT_AGENT_KEY = `agent-pub-${NOLO_DEFAULT_AGENT_ID}`;
 export const NOLO_PROJECT_MANAGER_AGENT_ID = "01NOLOPROJMGR00000000MSVGG";
@@ -9,7 +10,7 @@ export const NOLO_SENIOR_FULLSTACK_AGENT_KEY =
   `agent-${PLATFORM_DEMO_USER_ID}-${NOLO_SENIOR_FULLSTACK_AGENT_ID}`;
 export const NOLO_FRONTEND_AGENT_ID = "01FRONTENDAG0000000115N4E1";
 export const NOLO_FRONTEND_AGENT_KEY =
-  `agent-${PLATFORM_DEMO_USER_ID}-${NOLO_FRONTEND_AGENT_ID}`;
+  `agent-${CURRENT_OPERATOR_USER_ID}-${NOLO_FRONTEND_AGENT_ID}`;
 export const WIN_CODEX_AGENT_ID = "WINCODEX00000000FQ0LK0";
 export const WIN_CODEX_AGENT_KEY =
   `agent-0e95801d90-${WIN_CODEX_AGENT_ID}`;

package/agentRunCommand.ts

@@ -50,11 +50,10 @@ type ParsedAgentRunArgs = {
   parentDialogId?: string;
   background: boolean;
   noStream: boolean;
-  noDefaultTestRoot: boolean;
   cwd?: string;
-  maxToolRounds?: number;
   timeoutMs?: number;
   traceTools: boolean;
+  eventsMode?: "jsonl";
   injectFeatureWorktreeInstruction: boolean;
   taskRunContext?: TaskRunPromptContext;
   workflowRef?: string;
@@ -66,10 +65,6 @@ type ResolvedWorkflowReference = {
   config?: Partial<WorkflowReferenceConfig>;
 };
 
-const DEFAULT_TEST_ROOT_DIALOG_ID = "01KN6V3MVEQA4Q1PNKVM2W7YY8";
-const DEFAULT_TEST_ROOT_DIALOG_KEY = `dialog-b2e06f801f-${DEFAULT_TEST_ROOT_DIALOG_ID}`;
-const DEFAULT_TEST_DIALOG_CATEGORY_ID = "test-dialogs";
-
 function readFlagValue(args: string[], flag: string) {
   const index = args.indexOf(flag);
   if (index < 0) return undefined;
@@ -109,13 +104,6 @@ function isMonthlyMimoAgentRef(raw: string | undefined, resolved: string) {
   );
 }
 
-function parseNonNegativeInteger(value: string | undefined) {
-  if (!value) return undefined;
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed) || parsed < 0) return undefined;
-  return Math.floor(parsed);
-}
-
 function parsePositiveInteger(value: string | undefined) {
   if (!value) return undefined;
   const parsed = Number(value);
@@ -134,7 +122,6 @@ function positionalArgs(args: string[]) {
     "--bg",
     "--no-stream",
     "--debug",
-    "--no-default-test-root",
   ]);
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -167,20 +154,13 @@ export function parseAgentRunArgs(
   const spaceId = readFlagValue(args, "--space");
   const category = readFlagValue(args, "--category");
   const inheritedFromDialog = readFlagValue(args, "--inherit-from-dialog");
-  const noDefaultTestRoot = args.includes("--no-default-test-root");
   const cwd = readFlagValue(args, "--cwd");
-  const maxToolRounds = parseNonNegativeInteger(
-    readFlagValue(args, "--max-tool-rounds") ?? readFlagValue(args, "--rounds")
-  );
   const timeoutMs = parsePositiveInteger(readFlagValue(args, "--timeout-ms"));
+  const rawEventsMode = readFlagValue(args, "--events");
+  const eventsMode = rawEventsMode === "jsonl" ? "jsonl" : undefined;
   const inheritedRef = inheritedFromDialog
     ? parseDialogReference(inheritedFromDialog)
-    : !continueDialogId && !noDefaultTestRoot
-      ? {
-          dialogKey: DEFAULT_TEST_ROOT_DIALOG_KEY,
-          dialogId: DEFAULT_TEST_ROOT_DIALOG_ID,
-        }
-      : undefined;
+    : undefined;
   const imageUrls = [
     ...readRepeatedFlagValues(args, "--image"),
     ...readRepeatedFlagValues(args, "--image-url"),
@@ -199,6 +179,7 @@ export function parseAgentRunArgs(
     imageUrls,
     allowShell: args.includes("--dangerously-allow-shell") || mimoLocalWorkspaceDefault,
     traceTools: args.includes("--trace-tools"),
+    ...(eventsMode ? { eventsMode } : {}),
     injectFeatureWorktreeInstruction: mimoLocalWorkspaceDefault,
     ...(workflowRef ? { workflowRef } : {}),
     ...(taskRowDbKey
@@ -218,14 +199,12 @@ export function parseAgentRunArgs(
         : {}),
     background: args.includes("--bg"),
     noStream: args.includes("--no-stream"),
-    noDefaultTestRoot,
     ...(continueDialogId ? { continueDialogId } : {}),
     ...(!continueDialogId && spaceId ? { spaceId } : {}),
-    ...(category ? { category } : !continueDialogId && !noDefaultTestRoot ? { category: DEFAULT_TEST_DIALOG_CATEGORY_ID } : {}),
+    ...(category ? { category } : {}),
     ...(inheritedRef?.dialogKey ? { inheritedFromDialogKey: inheritedRef.dialogKey } : {}),
     ...(inheritedRef?.dialogId ? { parentDialogId: inheritedRef.dialogId } : {}),
     ...(cwd ? { cwd } : {}),
-    ...(typeof maxToolRounds === "number" ? { maxToolRounds } : {}),
     ...(typeof timeoutMs === "number" ? { timeoutMs } : {}),
   };
 }
@@ -411,16 +390,16 @@ function buildLocalRunEnv(args: {
   env: EnvLike;
   allowShell: boolean;
 }) {
+  void args.allowShell;
   return {
     ...args.env,
-    ...(args.allowShell ? { NOLO_LOCAL_SHELL_MODE: "worktree" } : {}),
   };
 }
 
 function writeUsage(output: OutputLike) {
   output.write(
-    "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--continue <dialogId>] [--cwd <path>] [--max-tool-rounds <n>]\n" +
-      "       nolo agent run --agent <agent> (--msg <message>|--msg-file <path>) [--image <url-or-path>] [--space <spaceId>] [--category <name>] [--inherit-from-dialog <dialog>] [--task-row-dbkey <key>] [--bg] [--timeout-ms <n>] [--no-stream]\n"
+    "Usage: nolo agent run <agent> <message> [--local|--server|--auto] [--continue <dialogId>] [--cwd <path>]\n" +
+      "       nolo agent run --agent <agent> (--msg <message>|--msg-file <path>) [--image <url-or-path>] [--space <spaceId>] [--category <name>] [--inherit-from-dialog <dialog>] [--task-row-dbkey <key>] [--bg] [--timeout-ms <n>] [--events jsonl] [--no-stream]\n"
   );
 }
 
@@ -480,10 +459,9 @@ export async function runAgentRunCommand(args: string[], deps: AgentRunCommandDe
     ...(parsed.parentDialogId ? { parentDialogId: parsed.parentDialogId } : {}),
     background: parsed.background,
     noStream: parsed.noStream,
-    noDefaultTestRoot: parsed.noDefaultTestRoot,
-    ...(typeof parsed.maxToolRounds === "number" ? { maxToolRounds: parsed.maxToolRounds } : {}),
     ...(typeof parsed.timeoutMs === "number" ? { timeoutMs: parsed.timeoutMs } : {}),
     traceTools: parsed.traceTools,
+    ...(parsed.eventsMode ? { eventsMode: parsed.eventsMode } : {}),
     ...(parsed.taskRunContext ? { taskRunContext: parsed.taskRunContext } : {}),
   });
 

package/agentRuntimeLocal.ts

@@ -20,6 +20,7 @@ export {
   resolveLocalToolPolicy,
   resolveOpenAiCompatibleProviderConfig,
   resolveRequestedRuntimeToolNames,
+  resolveRuntimeToolSurfaceForAgent,
   evaluateShellCommandPolicy,
   isDestructiveShellCommand,
   shouldUsePlatformChatProvider,

package/ai/agent/_executeModel.ts

@@ -0,0 +1,146 @@
+import { RootState } from "../../app/store";
+import { Agent, Message } from "../../app/types";
+import { selectCurrentDialogConfig } from "../../chat/dialog/dialogSlice";
+import { read } from "../../database/dbSlice";
+import { fetchAgentContexts } from "../agent/fetchAgentContexts";
+import { filterAndCleanMessages } from "../../integrations/openai/filterAndCleanMessages";
+import { selectAllMsgs } from "../../chat/messages/messageSlice";
+import { generateRequestBody } from "../llm/generateRequestBody";
+import { getApiEndpoint } from "../llm/providers";
+import { selectCurrentServer } from "../../app/settings/settingSlice";
+import { selectCurrentToken } from "../../auth/authSlice";
+import { applyChatCompletionsStreamMode } from "../../integrations/openai/chatCompletionStreamMode";
+
+import { sendOpenAICompletionsRequest } from "../chat/sendOpenAICompletionsRequest";
+import { performFetchRequest } from "../chat/fetchUtils";
+import { updateTokensAction } from "../../chat/dialog/actions/updateTokensAction";
+import { extractCustomId } from "../../core/prefix";
+
+export const _executeModel = async (
+  options: {
+    isStreaming: boolean;
+    withAgentContext: boolean;
+    withChatHistory: boolean;
+    agentConfigOverrides?: Record<string, any>;
+  },
+  args: {
+    llmConfig?: Partial<Agent> & Pick<Agent, "provider" | "model">;
+    agentKey?: string;
+    agentConfig?: Partial<Agent> & Pick<Agent, "provider" | "model">;
+    content: any;
+    parentMessageId?: string;
+    billingDialogKey?: string;
+  },
+  thunkApi: any
+) => {
+  const { isStreaming, withAgentContext, withChatHistory, agentConfigOverrides } = options;
+  const { getState, dispatch, rejectWithValue } = thunkApi;
+  const { content } = args;
+  const state = getState() as RootState;
+
+  let agentConfig: Partial<Agent> & Pick<Agent, "provider" | "model">;
+  if (args.llmConfig) {
+    agentConfig = args.llmConfig;
+  } else if (args.agentConfig) {
+    agentConfig = args.agentConfig;
+  } else {
+    const agentKey = args.agentKey || selectCurrentDialogConfig(state)?.cybots?.[0];
+    if (!agentKey) {
+      const msg = "Model execution failed: No llmConfig, agentConfig, or agentKey provided.";
+      console.error(msg);
+      return rejectWithValue(msg);
+    }
+    try {
+      agentConfig = await dispatch(read({ dbKey: agentKey })).unwrap();
+    } catch (error: any) {
+      console.error(`_executeModel failed to load agent [${agentKey}]`, error);
+      return rejectWithValue(error.message);
+    }
+  }
+
+  try {
+    const resolvedConfig = agentConfigOverrides
+      ? { ...agentConfig, ...agentConfigOverrides }
+      : agentConfig;
+    const resolvedAgentConfig = resolvedConfig as Agent;
+    const agentContexts = withAgentContext
+      ? await fetchAgentContexts(resolvedAgentConfig.references, dispatch)
+      : {};
+
+    let messages: Message[];
+    if (withChatHistory) {
+      messages = filterAndCleanMessages(selectAllMsgs(state)) as unknown as Message[];
+      messages.push({ role: "user", content: args.content });
+    } else {
+      messages = [{ role: "user", content: args.content }];
+    }
+
+    const requestBody = generateRequestBody({
+      agentConfig: resolvedAgentConfig,
+      messages,
+      userInput: content,
+      contexts: agentContexts,
+    });
+    const bodyData = applyChatCompletionsStreamMode(requestBody, isStreaming) as any;
+    const currentDialogKey = selectCurrentDialogConfig(state)?.dbKey ?? "";
+
+    if (isStreaming) {
+      await sendOpenAICompletionsRequest({
+        bodyData,
+        agentConfig: resolvedAgentConfig,
+        thunkApi,
+        dialogKey: currentDialogKey,
+        parentMessageId: args.parentMessageId,
+      });
+    } else {
+      const response = await performFetchRequest({
+        agentConfig: resolvedAgentConfig,
+        api: getApiEndpoint(resolvedAgentConfig),
+        bodyData,
+        currentServer: selectCurrentServer(state),
+        token: selectCurrentToken(state),
+      });
+      if (!response.ok) {
+        let message = `Model request failed with HTTP ${response.status}`;
+        try {
+          const errorBody = await response.json();
+          const upstreamMessage =
+            typeof errorBody?.error?.message === "string"
+              ? errorBody.error.message
+              : typeof errorBody?.message === "string"
+                ? errorBody.message
+                : "";
+          if (upstreamMessage.trim()) message = upstreamMessage.trim();
+        } catch {
+          // Keep the status-based message when the response body is not JSON.
+        }
+        throw new Error(message);
+      }
+      const result = await response.json();
+      const content = result?.choices?.[0]?.message?.content;
+      if (typeof content !== "string") {
+        const upstreamMessage =
+          typeof result?.error?.message === "string" ? result.error.message : "";
+        throw new Error(
+          upstreamMessage.trim() ||
+          "Model response missing choices[0].message.content"
+        );
+      }
+      if (args.billingDialogKey && result?.usage) {
+        await updateTokensAction(
+          {
+            dialogId: extractCustomId(args.billingDialogKey),
+            dialogKey: args.billingDialogKey,
+            usage: result.usage,
+            agentConfig: resolvedAgentConfig,
+          },
+          thunkApi
+        );
+      }
+      return content;
+    }
+  } catch (error: any) {
+    console.error(`_executeModel failed`, error);
+    return rejectWithValue(error.message);
+  }
+};