nolo-cli 0.108.0-alpha.1 → 0.108.0

package/{machineCommands-KSN4COGR.js → machineCommands-IQRRLSYP.js}

@@ -2,149 +2,173 @@ import {
   buildMachinePermissionPromptBlock,
   handleConnectorRunMessage,
   resolveMachineRunPermissionPolicy
-} from "./chunk-RRM7AJ3M.js";
+} from "./chunk-PS6XSDHW.js";
 import {
+  MAX_CONNECTOR_TIMER_DELAY_MS,
+  clampConnectorTimerDelayMs,
   isConnectorWebSocketAuthError,
   isConnectorWebSocketRetryableError,
+  resolveConnectorProbeTimeoutMs,
   resolveConnectorWebSocketTarget
-} from "./chunk-ALXHV7NK.js";
+} from "./chunk-2GGXHQIW.js";
 import {
   detectMachineInfo
 } from "./chunk-ESHYE7WU.js";
-import "./chunk-BVGTK7MR.js";
-import "./chunk-53HEEOTT.js";
-import "./chunk-EADNWBAZ.js";
-import "./chunk-SH43IESU.js";
-import "./chunk-I3TQJXQ7.js";
-import "./chunk-42V6BK2E.js";
-import "./chunk-Z77CRGTW.js";
-import "./chunk-SV5IJK6K.js";
-import "./chunk-MP64VFGD.js";
+import "./chunk-QH2QSBGP.js";
+import "./chunk-OYBAT7RT.js";
+import "./chunk-KQ7DAEZ7.js";
+import "./chunk-6MXDOUMH.js";
+import "./chunk-6CCAXGFK.js";
+import "./chunk-VP3BINY7.js";
+import "./chunk-PHHFVGOJ.js";
+import "./chunk-NBTY7YJF.js";
+import "./chunk-4XEYAFLY.js";
 import "./chunk-JBTJAPUF.js";
-import "./chunk-XD2MJFUG.js";
+import "./chunk-VIWDGTDA.js";
 import "./chunk-ATNTHIZI.js";
-import "./chunk-L7OXGGBN.js";
+import "./chunk-PBGO5AFD.js";
+import "./chunk-WVES4PHL.js";
 import "./chunk-HS7MLR74.js";
-import "./chunk-AG2AZ6GX.js";
-import "./chunk-5UTFL4QJ.js";
+import "./chunk-YZZLKXCQ.js";
+import "./chunk-V5DCOM6G.js";
+import "./chunk-APO5TOXO.js";
+import "./chunk-OXME3PEE.js";
+import "./chunk-WCQNEMXG.js";
+import "./chunk-DGDGNYI5.js";
 import "./chunk-NF64D32W.js";
 import {
-  CORE_DRAIN_REASON
-} from "./chunk-3L2WKC3W.js";
-import "./chunk-3VNWWVKB.js";
-import "./chunk-PQFHGD77.js";
-import "./chunk-KQHGZWSV.js";
-import "./chunk-J4MOO56S.js";
-import "./chunk-6Z7MY3V7.js";
-import "./chunk-EYAQT56M.js";
+  CORE_DRAIN_REASON,
+  parsePositiveFiniteNumberOrFallback
+} from "./chunk-XPWGOTBQ.js";
+import "./chunk-5XN3OSCT.js";
+import "./chunk-2ECUZDEL.js";
+import "./chunk-BIAETTOB.js";
+import "./chunk-6VRWNU5J.js";
+import "./chunk-PFEK4SA2.js";
 import "./chunk-VIDPVFP3.js";
-import "./chunk-VLTIYV3X.js";
-import "./chunk-QTGQ2LTL.js";
-import "./chunk-N4G4PKQ6.js";
-import "./chunk-FZGV4FGK.js";
-import "./chunk-MEYIRKDN.js";
+import "./chunk-NUHHBEJC.js";
+import "./chunk-AGIM7IMJ.js";
 import "./chunk-63W5N6P3.js";
 import "./chunk-VF4K2QE6.js";
-import "./chunk-QWL5QZGU.js";
-import "./chunk-RRPWH4LX.js";
-import "./chunk-7U6P3PHS.js";
+import "./chunk-X2VPXJZC.js";
+import "./chunk-26UZ2Y4Z.js";
+import "./chunk-BFYDNHYW.js";
+import "./chunk-P6KLYCL3.js";
 import "./chunk-ZJ7UHBJS.js";
-import "./chunk-TWQWYIMJ.js";
-import "./chunk-MC4XLIJ7.js";
-import "./chunk-3BMYXEUW.js";
-import "./chunk-YYLHWIW6.js";
+import "./chunk-ROXFUKKL.js";
+import "./chunk-523DITKR.js";
+import "./chunk-UKZX3NHN.js";
+import "./chunk-F2UJW3EK.js";
+import "./chunk-BYXBJQAS.js";
+import "./chunk-QYPE3TS3.js";
+import "./chunk-EXR4XCFE.js";
 import "./chunk-AGGIDPCZ.js";
-import "./chunk-PVZT43MU.js";
-import "./chunk-BFDFRLLQ.js";
+import "./chunk-WW2USJ3C.js";
 import "./chunk-5RGU3J7P.js";
-import "./chunk-6YTOJY35.js";
-import "./chunk-M76ECQRD.js";
+import "./chunk-VBG7GWWR.js";
+import "./chunk-ZRAU6T47.js";
+import "./chunk-4LCOCOR5.js";
 import "./chunk-YDH3FDFQ.js";
-import "./chunk-2F7RJC6L.js";
-import "./chunk-GLKOYSRU.js";
-import "./chunk-JRQFUXY7.js";
-import "./chunk-DHDMC6FO.js";
-import "./chunk-Q554LLSI.js";
-import "./chunk-KHCLMKZZ.js";
+import "./chunk-QFEW2ULV.js";
+import "./chunk-V2UPLOXT.js";
+import "./chunk-2OMUAIKR.js";
+import "./chunk-UAD2WT54.js";
+import "./chunk-RNNWTMKT.js";
+import "./chunk-3PVYUPXK.js";
+import "./chunk-GHZ2H2HJ.js";
+import "./chunk-AIZE5TDM.js";
+import "./chunk-4YRTZIVN.js";
+import "./chunk-UEILX4EV.js";
+import "./chunk-IJERIUXS.js";
+import "./chunk-6Q7UTJKR.js";
+import "./chunk-QQ56R7KS.js";
+import "./chunk-OW765XBU.js";
+import "./chunk-SEJ5OS6F.js";
+import "./chunk-D2MDMY2M.js";
+import "./chunk-RRQQAG7W.js";
+import "./chunk-3CZM6HGQ.js";
+import "./chunk-IXH3HKY2.js";
+import "./chunk-XETG4RIX.js";
+import "./chunk-OKARGYFT.js";
 import {
+  NEW_TEXT_FIELD_ALIASES,
   PATH_FIELD_ALIASES,
-  createLocalWorkspaceToolExecutors
-} from "./chunk-62CATUYY.js";
-import "./chunk-GO3Z72MT.js";
-import "./chunk-Q5FJJ6XI.js";
+  createLocalWorkspaceToolExecutors,
+  resolveRequestedWorkspacePath
+} from "./chunk-NLEJWKF5.js";
+import "./chunk-3SK3J3IF.js";
 import "./chunk-ZNFJWEN4.js";
-import "./chunk-4MK3I7Y4.js";
-import "./chunk-CQ3WA2NE.js";
+import "./chunk-IFALJPEX.js";
+import "./chunk-GMZLP5DV.js";
+import "./chunk-CHOZJMJS.js";
+import "./chunk-G23MQWLJ.js";
 import "./chunk-5ZUL4CUO.js";
-import "./chunk-N7J63Q6C.js";
-import "./chunk-MRIHM22T.js";
-import "./chunk-PUOC4YRO.js";
-import "./chunk-IIVGDG4I.js";
-import "./chunk-FDTR4QJ6.js";
-import "./chunk-UZGQNTVW.js";
-import "./chunk-6OZ36FXI.js";
+import "./chunk-JJM3WS6W.js";
+import "./chunk-G6OOUQWJ.js";
+import "./chunk-56GBUMO5.js";
+import "./chunk-WJZOQR2J.js";
+import "./chunk-LAVSW2C2.js";
+import "./chunk-SJ3QFSQS.js";
+import "./chunk-QLQ573SU.js";
+import "./chunk-3MZAGMYY.js";
 import "./chunk-2MBTWINN.js";
-import "./chunk-HKNXJGEC.js";
-import "./chunk-P5EVSOPA.js";
-import "./chunk-PSCNXBYA.js";
-import "./chunk-GQBOR3G6.js";
-import "./chunk-BYXBJQAS.js";
-import "./chunk-OIVSQH2O.js";
+import "./chunk-VSPO4S33.js";
+import "./chunk-FWY6BHIJ.js";
+import "./chunk-5MMAK75Q.js";
 import "./chunk-DWLEOOGR.js";
-import "./chunk-HVURBGF3.js";
-import "./chunk-ONXOABJR.js";
+import "./chunk-PWRS2SU2.js";
+import "./chunk-KX6YBIHG.js";
+import "./chunk-7DPNBQSV.js";
+import "./chunk-IHPDK6UD.js";
+import "./chunk-LWLNLZC5.js";
+import "./chunk-3LI5UCTU.js";
+import "./chunk-M2EJHDJP.js";
+import "./chunk-RLRYVSCD.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-MW533QT3.js";
+import "./chunk-TSBCYK5F.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-MHD5JBSS.js";
+import "./chunk-PJNFNEJE.js";
+import "./chunk-PSCNXBYA.js";
+import "./chunk-KY6GPQ7O.js";
+import "./chunk-NN4UUYGB.js";
+import "./chunk-CGEK73JN.js";
 import "./chunk-W7XHHYWM.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import "./chunk-DVINR3PL.js";
-import "./chunk-2GRGFCF6.js";
-import "./chunk-O6OSWFZQ.js";
-import "./chunk-7S4YWN7P.js";
-import "./chunk-X7HHHIOZ.js";
+import "./chunk-2C47W7IJ.js";
+import "./chunk-GLKOYSRU.js";
+import "./chunk-EYLGAEB4.js";
 import {
   isCompiledBinary
 } from "./chunk-A7GB5UGH.js";
 import {
   DEFAULT_NOLO_SERVER_URL
 } from "./chunk-OLZBQWZU.js";
-import "./chunk-ACTMNVHM.js";
-import "./chunk-Q67DOFOO.js";
-import "./chunk-PBA4UJBK.js";
-import "./chunk-GP5LKBUZ.js";
-import {
-  parsePositiveFiniteNumberOrFallback
-} from "./chunk-Y5GCAMGP.js";
-import "./chunk-QDSINZM3.js";
-import "./chunk-KX6YBIHG.js";
-import "./chunk-AHAHBQMU.js";
-import "./chunk-UAD2WT54.js";
-import "./chunk-VRTTFDBM.js";
-import "./chunk-VMFTFOWF.js";
-import "./chunk-WWC7I6TA.js";
-import "./chunk-ABQYVJBJ.js";
-import "./chunk-QSJ3HFEF.js";
-import "./chunk-WV42OMV7.js";
-import "./chunk-BNGW5ASC.js";
-import "./chunk-M2EJHDJP.js";
-import "./chunk-UKWGR5SS.js";
-import "./chunk-QOKAKDPE.js";
-import "./chunk-OW765XBU.js";
-import "./chunk-SEJ5OS6F.js";
-import "./chunk-GBRG75BQ.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
-import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import "./chunk-TNIX77YM.js";
+import "./chunk-Y6ROFCZO.js";
+import "./chunk-P3SFAHIL.js";
+import "./chunk-SZC4REES.js";
+import "./chunk-QSJ3HFEF.js";
+import "./chunk-ZWQUWF6W.js";
+import "./chunk-KHCLMKZZ.js";
+import "./chunk-VEA7H5FG.js";
+import "./chunk-4VJAC32I.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/connector-experimental/heartbeatLoop.ts
@@ -366,16 +390,104 @@ async function runMachineWatchCommand(deps) {
 }
 
 // packages/cli/machineToolInvokeDispatch.ts
-import { lstat, realpath } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "node:path";
-var MACHINE_TOOL_INVOKE_V1_TOOL_NAMES = ["readFile", "globFiles"];
+import { appendFile, lstat, mkdir, realpath, stat } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
+
+// packages/agent-runtime/machineToolGrants.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeMachineToolGrants(raw) {
+  if (!isRecord2(raw)) return void 0;
+  const grants = {};
+  for (const [rawKey, rawEntry] of Object.entries(raw)) {
+    const agentKey = rawKey.trim();
+    if (!agentKey) continue;
+    if (!isRecord2(rawEntry)) continue;
+    if (typeof rawEntry.write !== "boolean") continue;
+    grants[agentKey] = { write: rawEntry.write };
+  }
+  return Object.keys(grants).length > 0 ? grants : void 0;
+}
+
+// packages/cli/machineToolInvokeDispatch.ts
+var MACHINE_TOOL_INVOKE_V1_READ_ONLY_TOOL_NAMES = ["readFile", "globFiles"];
+var READ_ONLY_TOOL_NAME_SET = new Set(MACHINE_TOOL_INVOKE_V1_READ_ONLY_TOOL_NAMES);
+var MACHINE_TOOL_INVOKE_V1_TOOL_NAMES = [
+  "readFile",
+  "globFiles",
+  "writeFile",
+  "editFile"
+];
 var V1_ALLOWED_TOOL_NAMES = new Set(MACHINE_TOOL_INVOKE_V1_TOOL_NAMES);
 var DEFAULT_TOOL_INVOKE_TIMEOUT_MS = 3e4;
 var TOOL_RESULT_MESSAGE_MAX_CHARS = 1e6;
-var TOOL_NOT_ALLOWED_MESSAGE = "tool not allowed in v1 (read-only)";
+var TOOL_NOT_ALLOWED_MESSAGE = "tool not allowed in v1 (allowlisted read/write file tools only)";
 var TOOL_PAYLOAD_MALFORMED_MESSAGE = "malformed tool.invoke payload (payload object required)";
 var TOOL_ARGS_MALFORMED_MESSAGE = "malformed tool.invoke args (args object required)";
+var GRANT_DIMENSION_BY_TOOL = {
+  writeFile: "write",
+  editFile: "write"
+};
+var MACHINE_TOOL_INVOKE_V1_WRITE_TOOL_NAMES = Object.keys(GRANT_DIMENSION_BY_TOOL);
+function grantDimensionForTool(toolName) {
+  return Object.hasOwn(GRANT_DIMENSION_BY_TOOL, toolName) ? GRANT_DIMENSION_BY_TOOL[toolName] : void 0;
+}
+var AUDIT_TARGET_MAX_CHARS = 200;
+function machineToolNotGrantedMessage(toolName, agentKey) {
+  const dimension = grantDimensionForTool(toolName);
+  if (!dimension) {
+    return `tool not granted on this machine: ${toolName} is not a registered machine tool (no grant dimension) (NOLO_MACHINE_TOOL_GRANTS)`;
+  }
+  return agentKey ? `tool not granted on this machine: ${toolName} requires ${dimension} grant for agent ${agentKey} (NOLO_MACHINE_TOOL_GRANTS)` : `tool not granted on this machine: ${toolName} requires an agentKey with ${dimension} grant (NOLO_MACHINE_TOOL_GRANTS)`;
+}
+function isMachineToolGranted(grants, toolName, agentKey) {
+  if (READ_ONLY_TOOL_NAME_SET.has(toolName)) return true;
+  const dimension = grantDimensionForTool(toolName);
+  if (!dimension) return false;
+  const normalizedAgentKey = typeof agentKey === "string" ? agentKey.trim() : "";
+  if (!normalizedAgentKey || !grants) return false;
+  if (!Object.prototype.hasOwnProperty.call(grants, normalizedAgentKey)) return false;
+  const entry = grants[normalizedAgentKey];
+  if (!isRecord3(entry)) return false;
+  return Object.hasOwn(entry, dimension) && entry[dimension] === true;
+}
+function resolveMachineToolAuditLogPath() {
+  const noloHome = process.env.NOLO_HOME?.trim();
+  const base = noloHome ? noloHome : join2(homedir2(), ".nolo");
+  return join2(base, "logs", "machine-tool-audit.jsonl");
+}
+function auditTargetFor(executorArgs) {
+  const target = extractMachineToolRequestPath(executorArgs) ?? "";
+  return target.length > AUDIT_TARGET_MAX_CHARS ? target.slice(0, AUDIT_TARGET_MAX_CHARS) : target;
+}
+function machineToolOutcomeFailed(outcome) {
+  const metadata = outcome.metadata;
+  if (!isRecord3(metadata)) return false;
+  if (metadata.timedOut === true) return true;
+  if (metadata.aborted === true) return true;
+  const exitCode = metadata.exitCode;
+  return typeof exitCode === "number" && exitCode !== 0;
+}
+async function appendMachineToolAudit(entry) {
+  try {
+    const logPath = resolveMachineToolAuditLogPath();
+    await mkdir(dirname2(logPath), { recursive: true });
+    await appendFile(
+      logPath,
+      `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), agentKey: entry.agentKey ?? null, tool: entry.tool, target: entry.target, ok: entry.ok })}
+`,
+      "utf8"
+    );
+  } catch (error) {
+    console.warn(`[nolo] machine tool audit write failed: ${toMessage(error)}`);
+  }
+}
 function createMachineToolInvokeHandlers(args) {
+  const grants = normalizeMachineToolGrants(
+    args.grants ?? readMachineToolGrants(args.env ?? process.env)
+  );
   const executors = (args.createToolExecutors ?? createLocalWorkspaceToolExecutors)({
     workspaceRoot: args.workspaceRoot,
     // v1 硬 containment：localWorkspaceTools 在无确认回调时对工作区外路径
@@ -391,7 +503,7 @@ function createMachineToolInvokeHandlers(args) {
     readFileNoLedger: true
   });
   const executorMap = executors;
-  const invokeWithTimeout = async (toolName, executorArgs, timeoutMs, workspaceRoot) => {
+  const invokeWithTimeout = async (toolName, executorArgs, timeoutMs, workspaceRoot, agentKey) => {
     const call = {
       id: "machine-tool-invoke",
       name: toolName,
@@ -405,7 +517,11 @@ function createMachineToolInvokeHandlers(args) {
       });
       if (preflightError) return { error: preflightError };
     }
+    const deleteGuardError = await machinePureDeleteGuard(toolName, executorArgs, workspaceRoot);
+    if (deleteGuardError) return { error: deleteGuardError };
     let timer = null;
+    const audited = grantDimensionForTool(toolName) !== void 0;
+    let auditOk = false;
     try {
       const outcome = await Promise.race([
         executorMap[toolName](call),
@@ -414,6 +530,7 @@ function createMachineToolInvokeHandlers(args) {
         })
       ]);
       const content = typeof outcome?.content === "string" ? outcome.content : "";
+      auditOk = !machineToolOutcomeFailed(outcome);
       if (content.length > TOOL_RESULT_MESSAGE_MAX_CHARS) {
         return {
           result: content.slice(0, TOOL_RESULT_MESSAGE_MAX_CHARS) + `
@@ -426,14 +543,25 @@ function createMachineToolInvokeHandlers(args) {
       return { error: toMessage(error) };
     } finally {
       if (timer) clearTimeout(timer);
+      if (audited) {
+        await appendMachineToolAudit({
+          agentKey,
+          tool: toolName,
+          target: auditTargetFor(executorArgs),
+          ok: auditOk
+        });
+      }
     }
   };
-  const invokeMachineTool = async (requestId, toolName, toolArgs, timeoutMs) => {
+  const invokeMachineTool = async (requestId, toolName, toolArgs, timeoutMs, agentKey) => {
     if (!V1_ALLOWED_TOOL_NAMES.has(toolName)) {
       return { error: TOOL_NOT_ALLOWED_MESSAGE };
     }
+    if (!isMachineToolGranted(grants, toolName, agentKey)) {
+      return { error: machineToolNotGrantedMessage(toolName, agentKey) };
+    }
     const resolvedTimeout = resolveTimeoutMs(timeoutMs);
-    return invokeWithTimeout(toolName, toolArgs, resolvedTimeout, args.workspaceRoot);
+    return invokeWithTimeout(toolName, toolArgs, resolvedTimeout, args.workspaceRoot, agentKey);
   };
   return {
     handleToolInvokeMessage: async (message, send) => {
@@ -446,7 +574,7 @@ function createMachineToolInvokeHandlers(args) {
         );
         return JSON.stringify({ type: "tool.result", requestId, error: TOOL_PAYLOAD_MALFORMED_MESSAGE });
       }
-      if (!isRecord2(payload.args)) {
+      if (!isRecord3(payload.args)) {
         send(
           JSON.stringify({ type: "tool.result", requestId, error: TOOL_ARGS_MALFORMED_MESSAGE })
         );
@@ -456,7 +584,8 @@ function createMachineToolInvokeHandlers(args) {
         requestId,
         payload.tool,
         payload.args,
-        payload.timeoutMs
+        payload.timeoutMs,
+        payload.agentKey
       );
       send(
         JSON.stringify(
@@ -485,7 +614,7 @@ function isLexicallyInsideRoot(root, targetPath) {
 }
 async function machinePathPreflight(args) {
   const workspaceRoot = resolve2(args.workspaceRoot);
-  const lexicalPath = resolve2(workspaceRoot, args.request);
+  const lexicalPath = resolveRequestedWorkspacePath(workspaceRoot, args.request);
   if (!isLexicallyInsideRoot(workspaceRoot, lexicalPath)) {
     return `path outside workspace root: ${args.request}`;
   }
@@ -494,11 +623,19 @@ async function machinePathPreflight(args) {
   while (true) {
     const stats = await lstat(current).catch(() => void 0);
     if (!stats) {
-      return null;
+      const parent = resolve2(current, "..");
+      if (parent === current) return null;
+      return await ancestorContainmentPreflight({
+        workspaceRoot,
+        ancestor: parent,
+        request: args.request
+      });
     }
     if (!stats.isSymbolicLink()) break;
     const target = await realpath(current).catch(() => void 0);
-    if (!target) return null;
+    if (!target) {
+      return `path outside workspace root after symlink resolution: ${args.request}`;
+    }
     symlinks.push({ link: current, target });
     current = resolve2(current, "..");
     if (current === dirname2(current)) break;
@@ -514,6 +651,76 @@ async function machinePathPreflight(args) {
   }
   return null;
 }
+async function ancestorContainmentPreflight(args) {
+  const workspaceRoot = resolve2(args.workspaceRoot);
+  let existing = args.ancestor;
+  while (true) {
+    const stats = await lstat(existing).catch(() => void 0);
+    if (stats) break;
+    const parent = resolve2(existing, "..");
+    if (parent === existing) return null;
+    existing = parent;
+  }
+  try {
+    const [realExisting, realRoot] = await Promise.all([realpath(existing), realpath(workspaceRoot)]);
+    if (!isLexicallyInsideRoot(realRoot, realExisting)) {
+      return `path outside workspace root after symlink resolution: ${args.request}`;
+    }
+  } catch {
+    return `path outside workspace root after symlink resolution: ${args.request}`;
+  }
+  return null;
+}
+var WRITEFILE_DELETE_GUARD_MESSAGE = "writeFile blocked: refusing to overwrite an existing non-empty file with empty content (data-deletion guard). Use editFile with the exact oldText to remove specific text, or write the intended content explicitly.";
+var WRITEFILE_DIRECTORY_TARGET_MESSAGE = "writeFile blocked: target path is an existing directory, not a file (refusing to write; nothing was modified).";
+var EDITFILE_DELETE_GUARD_MESSAGE = "editFile blocked: refusing to replace matched text with an empty newText (data-deletion guard). Provide the intended replacement text.";
+function extractMachineToolStringField(executorArgs, aliases) {
+  const rawArgs = typeof executorArgs === "string" ? executorArgs : executorArgs !== void 0 && executorArgs !== null ? JSON.stringify(executorArgs) : null;
+  if (rawArgs === null) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(rawArgs);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+  for (const key of aliases) {
+    const value = parsed[key];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function writeFileUninspectableTargetMessage(code) {
+  return `writeFile blocked: target cannot be inspected (${code}); refusing to write (fail closed \u2014 only a missing target counts as a new file).`;
+}
+function fsErrorCode(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const code = error.code;
+  return typeof code === "string" ? code : void 0;
+}
+async function machinePureDeleteGuard(toolName, executorArgs, workspaceRoot) {
+  if (toolName === "writeFile") {
+    const content = extractMachineToolStringField(executorArgs, ["content"]);
+    if (content === void 0 || content.trim() !== "") return null;
+    const requestPath = extractMachineToolRequestPath(executorArgs);
+    if (requestPath === null) return null;
+    let stats;
+    try {
+      stats = await stat(resolveRequestedWorkspacePath(workspaceRoot, requestPath));
+    } catch (error) {
+      if (fsErrorCode(error) === "ENOENT") return null;
+      return writeFileUninspectableTargetMessage(fsErrorCode(error) ?? "unknown");
+    }
+    if (stats.isDirectory()) return WRITEFILE_DIRECTORY_TARGET_MESSAGE;
+    return stats.size > 0 ? WRITEFILE_DELETE_GUARD_MESSAGE : null;
+  }
+  if (toolName === "editFile") {
+    const newText = extractMachineToolStringField(executorArgs, NEW_TEXT_FIELD_ALIASES);
+    if (newText !== void 0 && newText.trim() === "") return EDITFILE_DELETE_GUARD_MESSAGE;
+    return null;
+  }
+  return null;
+}
 function extractMachineToolRequestPath(executorArgs) {
   const rawArgs = typeof executorArgs === "string" ? executorArgs : executorArgs !== void 0 && executorArgs !== null ? JSON.stringify(executorArgs) : null;
   if (rawArgs === null) return null;
@@ -537,9 +744,9 @@ function parseToolInvokeFrame(message) {
   } catch {
     return null;
   }
-  if (!isRecord2(parsed) || parsed.type !== "tool.invoke") return null;
+  if (!isRecord3(parsed) || parsed.type !== "tool.invoke") return null;
   if (typeof parsed.requestId !== "string" || parsed.requestId.length === 0) return null;
-  if (!isRecord2(parsed.payload)) {
+  if (!isRecord3(parsed.payload)) {
     return {
       requestId: parsed.requestId,
       payload: { tool: "", args: {}, timeoutMs: void 0 },
@@ -552,23 +759,46 @@ function parseToolInvokeFrame(message) {
     payload: {
       tool: typeof payload.tool === "string" ? payload.tool : "",
       args: payload.args,
-      timeoutMs: payload.timeoutMs
+      timeoutMs: payload.timeoutMs,
+      agentKey: typeof payload.agentKey === "string" && payload.agentKey.length > 0 ? payload.agentKey : void 0
     }
   };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // packages/cli/machineWsSession.ts
 var CONNECTOR_WS_KEEPALIVE_MS = 25e3;
+var DEFAULT_CONNECTOR_TEARDOWN_TIMEOUT_MS = 2e3;
+function resolveTeardownTimeoutMs(env) {
+  return clampConnectorTimerDelayMs(
+    parsePositiveFiniteNumberOrFallback(
+      env.NOLO_CONNECT_TEARDOWN_TIMEOUT_MS,
+      DEFAULT_CONNECTOR_TEARDOWN_TIMEOUT_MS
+    )
+  );
+}
+async function settleWithinTimeout(promises, timeoutMs) {
+  let timer = null;
+  try {
+    const outcome = await Promise.race([
+      Promise.allSettled(promises).then(() => "settled"),
+      new Promise((resolve3) => {
+        timer = setTimeout(() => resolve3("timeout"), timeoutMs);
+      })
+    ]);
+    return { timedOut: outcome === "timeout" };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 function buildConnectorKeepaliveMessage() {
   return JSON.stringify({ type: "connector.keepalive", sentAt: Date.now() });
 }
 function resolveHeartbeatIntervalMs2(env) {
-  return parsePositiveFiniteNumberOrFallback(
-    env.NOLO_CONNECT_HEARTBEAT_MS,
-    3e4
+  return clampConnectorTimerDelayMs(
+    parsePositiveFiniteNumberOrFallback(env.NOLO_CONNECT_HEARTBEAT_MS, 3e4)
   );
 }
 async function defaultConnectWebSocket(url, options) {
@@ -599,6 +829,7 @@ async function defaultConnectWebSocket(url, options) {
       }
     };
     options.signal?.addEventListener("abort", handleAbort, { once: true });
+    options.teardownSignal?.addEventListener("abort", handleAbort, { once: true });
     ws.addEventListener(
       "open",
       () => {
@@ -608,8 +839,13 @@ async function defaultConnectWebSocket(url, options) {
             ws.send(buildConnectorKeepaliveMessage());
           } catch {
             clearKeepalive();
+            try {
+              ws.close();
+            } catch {
+              resolve3();
+            }
           }
-        }, CONNECTOR_WS_KEEPALIVE_MS);
+        }, options.keepaliveMs ?? CONNECTOR_WS_KEEPALIVE_MS);
       },
       { once: true }
     );
@@ -643,8 +879,19 @@ async function defaultConnectWebSocket(url, options) {
 async function runMachineWsSession(options) {
   const sentMessages = [];
   const heartbeatAbort = new AbortController();
+  const teardownAbort = new AbortController();
+  const teardownTimeoutMs = resolveTeardownTimeoutMs(options.env);
   let heartbeatLoopPromise = null;
   let websocketPromise = null;
+  const settleTeardown = async () => {
+    const { timedOut } = await settleWithinTimeout(
+      [websocketPromise, heartbeatLoopPromise].filter(Boolean),
+      teardownTimeoutMs
+    );
+    if (timedOut) {
+      teardownAbort.abort();
+    }
+  };
   try {
     if (options.signal?.aborted) {
       return { exitCode: 0 };
@@ -668,11 +915,13 @@ async function runMachineWsSession(options) {
       serverUrl: options.serverUrl,
       machineId: options.machine.machineId,
       connectorSurface: "cli",
-      headers: { Authorization: `Bearer ${options.authToken}` }
+      headers: { Authorization: `Bearer ${options.authToken}` },
+      probeTimeoutMs: resolveConnectorProbeTimeoutMs(options.env)
     });
     websocketPromise = options.connectWebSocket(wsTarget, {
       headers: { Authorization: `Bearer ${options.authToken}` },
       signal: options.signal,
+      teardownSignal: teardownAbort.signal,
       sentMessages,
       onMessage: (message) => options.onMessage(message, (response) => {
         sentMessages.push(response);
@@ -689,16 +938,14 @@ async function runMachineWsSession(options) {
       [websocketPromise, heartbeatMonitorPromise, abortPromise].filter(Boolean)
     );
     heartbeatAbort.abort();
-    await Promise.allSettled([websocketPromise, heartbeatLoopPromise]);
+    await settleTeardown();
     if (raceResult === "aborted") {
       return { exitCode: 0 };
     }
     return { exitCode: 0 };
   } catch (error) {
     heartbeatAbort.abort();
-    await Promise.allSettled(
-      [websocketPromise, heartbeatLoopPromise].filter(Boolean)
-    );
+    await settleTeardown();
     if (isConnectorWebSocketAuthError(error)) {
       options.output.write(
         `[nolo] Connector websocket auth failed: ${error.message}. Re-register this machine or update NOLO_MACHINE_API_KEY.
@@ -801,6 +1048,43 @@ async function handleMachineWsMessageDemux(message, send, handlers, runConnector
   }
   await runConnectorMessage();
 }
+function readMachineToolGrants(env) {
+  const raw = env.NOLO_MACHINE_TOOL_GRANTS?.trim();
+  if (!raw) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    warnMalformedMachineToolGrantsOnce(
+      `json:${raw}`,
+      `[nolo] NOLO_MACHINE_TOOL_GRANTS is not valid JSON, ignoring it: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return void 0;
+  }
+  if (!isRecord(parsed)) {
+    warnMalformedMachineToolGrantsOnce(
+      `shape:${raw}`,
+      "[nolo] NOLO_MACHINE_TOOL_GRANTS must be a JSON object, ignoring it"
+    );
+    return void 0;
+  }
+  return parsed;
+}
+var warnedMalformedMachineToolGrants = /* @__PURE__ */ new Set();
+function warnMalformedMachineToolGrantsOnce(dedupeKey, message) {
+  if (warnedMalformedMachineToolGrants.has(dedupeKey)) return;
+  warnedMalformedMachineToolGrants.add(dedupeKey);
+  console.warn(message);
+}
+function __resetMalformedMachineToolGrantsWarningsForTests() {
+  warnedMalformedMachineToolGrants.clear();
+}
+function appendToolGrantsToWsUrl(wsUrl, grants) {
+  if (!grants) return wsUrl;
+  const target = new URL(wsUrl);
+  target.searchParams.set("toolGrants", JSON.stringify(grants));
+  return target.toString();
+}
 function resolveAuthToken2(env) {
   return env.AUTH_TOKEN || env.AUTH || "";
 }
@@ -849,11 +1133,60 @@ async function sleepWithAbort(ms, sleep, signal) {
   ]);
 }
 function resolveConnectorReconnectDelayMs(env) {
-  const raw = Number(env.NOLO_CONNECT_RECONNECT_MS ?? "");
-  return Number.isFinite(raw) && raw >= 0 ? raw : 5e3;
+  const rawValue = env.NOLO_CONNECT_RECONNECT_MS;
+  if (rawValue === void 0 || rawValue.trim() === "") return 5e3;
+  const raw = Number(rawValue);
+  if (!Number.isFinite(raw) || raw < 0) return 5e3;
+  return Math.min(raw, MAX_CONNECTOR_TIMER_DELAY_MS);
+}
+var DEFAULT_CONNECTOR_HEARTBEAT_TIMEOUT_MS = 1e4;
+function resolveConnectorHeartbeatTimeoutMs(env) {
+  return clampConnectorTimerDelayMs(
+    parsePositiveFiniteNumberOrFallback(
+      env.NOLO_CONNECT_HEARTBEAT_TIMEOUT_MS,
+      DEFAULT_CONNECTOR_HEARTBEAT_TIMEOUT_MS
+    )
+  );
+}
+async function postMachineHeartbeat(args) {
+  const { fetchImpl, serverUrl, authToken, machine, timeoutMs } = args;
+  const controller = new AbortController();
+  const startedAt = Date.now();
+  let timer = null;
+  const timeoutPromise = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(
+        new Error(
+          `heartbeat timed out after ${Date.now() - startedAt}ms (NOLO_CONNECT_HEARTBEAT_TIMEOUT_MS=${timeoutMs})`
+        )
+      );
+    }, timeoutMs);
+  });
+  try {
+    const res = await Promise.race([
+      fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${authToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(machine),
+        signal: controller.signal
+      }),
+      timeoutPromise
+    ]);
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`HTTP ${res.status}
+${text}`);
+    }
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 async function defaultExecuteCli(provider, prompt, options) {
-  const { executeCli } = await import("./cliExecutor-HG3S345O.js");
+  const { executeCli } = await import("./cliExecutor-AWYR3T33.js");
   return executeCli(provider, prompt, options);
 }
 function detectLaunchableMachineInfo() {
@@ -923,21 +1256,13 @@ async function runMachineConnectCommand(args, deps = {}) {
     });
   }
   const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
-  const sendHeartbeat = async () => {
-    const res = await fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${authToken}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(machine)
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      throw new Error(`HTTP ${res.status}
-${text}`);
-    }
-  };
+  const sendHeartbeat = () => postMachineHeartbeat({
+    fetchImpl,
+    serverUrl,
+    authToken,
+    machine,
+    timeoutMs: resolveConnectorHeartbeatTimeoutMs(env)
+  });
   if (hasFlag(args, "--ws")) {
     const validateWorkspaceLinks = deps.validateWorkspaceLinks ?? (() => []);
     if (!await checkConnectorWorkspaceLinks(process.cwd(), output, validateWorkspaceLinks)) {
@@ -946,8 +1271,15 @@ ${text}`);
     const maxAttempts = deps.maxConnectorAttempts ?? Infinity;
     const sleep = deps.sleep ?? defaultSleep2;
     const reconnectDelayMs = resolveConnectorReconnectDelayMs(env);
+    const toolGrants = readMachineToolGrants(env);
     const toolInvokeHandlers = createMachineToolInvokeHandlers({
-      workspaceRoot: process.cwd()
+      workspaceRoot: process.cwd(),
+      // M2 修复：机器侧授权复核与握手上报共用同一来源——本次 `deps.env ??
+      // process.env`。grants 快照与 WS URL 上报的那份逐字节相同；未配置时也
+      // 显式传 env，工厂不再回落到 process.env（调用方经 deps.env 注入环境时
+      // 两端曾不一致）。
+      env,
+      ...toolGrants ? { grants: toolGrants } : {}
     });
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
       if (deps.signal?.aborted) {
@@ -964,10 +1296,13 @@ ${text}`);
         connectWebSocket: deps.connectWebSocket ?? defaultConnectWebSocket,
         serverUrl,
         authToken,
-        resolveConnectorWebSocketTarget: (options) => resolveConnectorWebSocketTarget({
-          ...options,
-          fetchImpl
-        }),
+        resolveConnectorWebSocketTarget: async (options) => appendToolGrantsToWsUrl(
+          await resolveConnectorWebSocketTarget({
+            ...options,
+            fetchImpl
+          }),
+          toolGrants
+        ),
         onMessage: (message, send) => handleMachineWsMessageDemux(
           message,
           send,
@@ -997,7 +1332,10 @@ ${text}`);
         return 0;
       }
       if (attempt >= maxAttempts) return exitCode;
-      const retryDelayMs = sessionResult.retryAfterMs ?? reconnectDelayMs;
+      const retryDelayMs = Math.min(
+        sessionResult.retryAfterMs ?? reconnectDelayMs,
+        MAX_CONNECTOR_TIMER_DELAY_MS
+      );
       const reconnectContext = sessionResult.reconnectReason === CORE_DRAIN_REASON ? " during core draining" : "";
       output.write(
         `[nolo] Connector websocket disconnected${reconnectContext}. Reconnecting in ${retryDelayMs}ms.
@@ -1023,7 +1361,11 @@ ${text}`);
   });
 }
 export {
+  __resetMalformedMachineToolGrantsWarningsForTests,
   formatMachineStatus,
+  postMachineHeartbeat,
+  readMachineToolGrants,
+  resolveConnectorHeartbeatTimeoutMs,
   runMachineConnectCommand,
   runMachineStatusCommand
 };