nolo-cli 0.149.0-alpha.1 → 0.151.0-alpha.3

package/{machineCommands-HAP75VSG.js → machineCommands-6OBFD3XF.js}

@@ -2,154 +2,178 @@ import {
   buildMachinePermissionPromptBlock,
   handleConnectorRunMessage,
   resolveMachineRunPermissionPolicy
-} from "./chunk-UASIEDKM.js";
+} from "./chunk-I2XLRXVX.js";
 import {
+  MAX_CONNECTOR_TIMER_DELAY_MS,
+  clampConnectorTimerDelayMs,
   isConnectorWebSocketAuthError,
   isConnectorWebSocketRetryableError,
+  resolveConnectorProbeTimeoutMs,
   resolveConnectorWebSocketTarget
-} from "./chunk-ALXHV7NK.js";
-import "./chunk-XYJSY4KG.js";
-import "./chunk-I4OPU5TK.js";
-import "./chunk-YUNJN43V.js";
-import "./chunk-62IL3KQV.js";
+} from "./chunk-2GGXHQIW.js";
+import "./chunk-PKZKOVA5.js";
+import "./chunk-XS47QOFV.js";
+import "./chunk-6MXDOUMH.js";
+import "./chunk-SW4S4XYB.js";
+import "./chunk-VP3BINY7.js";
+import "./chunk-UUPR3TD7.js";
+import "./chunk-NBTY7YJF.js";
+import "./chunk-VL5KOY2C.js";
 import {
   detectMachineInfo
-} from "./chunk-ESHYE7WU.js";
-import "./chunk-EADNWBAZ.js";
-import "./chunk-OTGFTBLI.js";
-import "./chunk-SV5IJK6K.js";
-import "./chunk-CFT5HBGW.js";
-import "./chunk-ZOVKKMF6.js";
-import "./chunk-GLKOYSRU.js";
-import "./chunk-4XEYAFLY.js";
-import "./chunk-JBTJAPUF.js";
-import "./chunk-O2OWEFII.js";
+} from "./chunk-S73EPYNC.js";
+import "./chunk-ZEZC7IIM.js";
+import "./chunk-VIWDGTDA.js";
+import "./chunk-6MJNEXUU.js";
+import "./chunk-BU2YQBV4.js";
+import "./chunk-XRUSXPCQ.js";
 import "./chunk-ATNTHIZI.js";
-import "./chunk-3DAVPNFT.js";
+import "./chunk-KFHQQ3NO.js";
+import "./chunk-V4EE3D54.js";
 import "./chunk-HS7MLR74.js";
-import "./chunk-ID7LNBWR.js";
-import "./chunk-DY7ANLKG.js";
-import "./chunk-5UTFL4QJ.js";
-import "./chunk-KQHGZWSV.js";
-import "./chunk-ATLTFRYJ.js";
+import "./chunk-3T4ZG6AC.js";
+import "./chunk-JKMLSTZK.js";
+import "./chunk-I2ZMGXXF.js";
+import "./chunk-OXME3PEE.js";
+import "./chunk-ROCUB2H2.js";
 import "./chunk-NF64D32W.js";
 import {
-  CORE_DRAIN_REASON
-} from "./chunk-3L2WKC3W.js";
-import "./chunk-4JMDLJAD.js";
-import "./chunk-OMRJYNCI.js";
-import "./chunk-CPUFH46E.js";
-import "./chunk-YRRASA5Q.js";
+  CORE_DRAIN_REASON,
+  parsePositiveFiniteNumberOrFallback
+} from "./chunk-XPWGOTBQ.js";
+import "./chunk-ZIWPQEFU.js";
+import "./chunk-CBHGZRCE.js";
+import "./chunk-SCMHQUMK.js";
+import "./chunk-RSHPU4PD.js";
+import "./chunk-VIDPVFP3.js";
+import "./chunk-5MM7NNO6.js";
+import "./chunk-IA7TRNNR.js";
+import "./chunk-AGIM7IMJ.js";
 import "./chunk-63W5N6P3.js";
 import "./chunk-VF4K2QE6.js";
-import "./chunk-TXH4IWJL.js";
-import "./chunk-6FGTMQCL.js";
-import "./chunk-XPRWFQQK.js";
-import "./chunk-UQNS32WZ.js";
-import "./chunk-MEYIRKDN.js";
-import "./chunk-36KZDDO5.js";
-import "./chunk-ZJ7UHBJS.js";
-import "./chunk-ACQD6YI2.js";
+import "./chunk-626KHJNX.js";
+import "./chunk-ILU2NPWY.js";
+import "./chunk-AG7MCDLR.js";
+import "./chunk-F32Z66T4.js";
+import "./chunk-EYWJT7A2.js";
+import "./chunk-AJ3G7X2K.js";
+import "./chunk-U5ICMAFV.js";
 import "./chunk-523DITKR.js";
-import "./chunk-YYLHWIW6.js";
-import "./chunk-6O4IK4V2.js";
-import "./chunk-TZZ2WRBL.js";
-import "./chunk-Z4CSIXYP.js";
+import "./chunk-UKZX3NHN.js";
+import "./chunk-OFFL4DCR.js";
+import "./chunk-QYPE3TS3.js";
+import "./chunk-DFDXM2Y4.js";
+import "./chunk-4JH2UMJR.js";
+import "./chunk-ZJ7UHBJS.js";
+import "./chunk-BYXBJQAS.js";
+import "./chunk-PLSVXHSA.js";
 import "./chunk-5RGU3J7P.js";
-import "./chunk-M76ECQRD.js";
-import "./chunk-B6SAMB33.js";
+import "./chunk-OWYYDMGJ.js";
+import "./chunk-ZRAU6T47.js";
+import "./chunk-4LCOCOR5.js";
 import "./chunk-YDH3FDFQ.js";
-import "./chunk-MX574M24.js";
-import "./chunk-4DPP773Q.js";
-import "./chunk-VIDPVFP3.js";
-import "./chunk-AGGIDPCZ.js";
-import "./chunk-CU3QB4HW.js";
-import "./chunk-B2XUQXQX.js";
-import "./chunk-6TPOEJMQ.js";
-import "./chunk-AUDNYVRC.js";
-import "./chunk-KHCLMKZZ.js";
+import "./chunk-QFEW2ULV.js";
+import "./chunk-XI7DGLUK.js";
+import "./chunk-EDX5XSJM.js";
+import "./chunk-UAD2WT54.js";
+import "./chunk-74RAWNQN.js";
+import "./chunk-3PVYUPXK.js";
+import "./chunk-A4MW3YZL.js";
+import "./chunk-AIZE5TDM.js";
+import "./chunk-4YRTZIVN.js";
+import "./chunk-UEILX4EV.js";
+import "./chunk-IJERIUXS.js";
+import "./chunk-6Q7UTJKR.js";
+import "./chunk-QQ56R7KS.js";
+import "./chunk-OW765XBU.js";
+import "./chunk-SEJ5OS6F.js";
+import "./chunk-D2MDMY2M.js";
+import "./chunk-HIQ4GF53.js";
+import "./chunk-JZX2XLKC.js";
+import "./chunk-EUGTFFO6.js";
+import "./chunk-XETG4RIX.js";
+import "./chunk-GKXCHNTE.js";
 import {
+  NEW_TEXT_FIELD_ALIASES,
   PATH_FIELD_ALIASES,
-  createLocalWorkspaceToolExecutors
-} from "./chunk-4H22P2JV.js";
-import "./chunk-P6GMCCAT.js";
+  createLocalWorkspaceToolExecutors,
+  resolveRequestedWorkspacePath
+} from "./chunk-AUIJZACN.js";
+import "./chunk-GQV5KHJU.js";
 import "./chunk-ZNFJWEN4.js";
-import "./chunk-QXGPFY6J.js";
-import "./chunk-GMZLP5DV.js";
-import "./chunk-OHOVNO7I.js";
+import "./chunk-LGN377P3.js";
+import "./chunk-HNUWUO75.js";
+import "./chunk-CHOZJMJS.js";
+import "./chunk-PWTNI4N7.js";
+import "./chunk-UOKFKFPO.js";
 import "./chunk-5ZUL4CUO.js";
-import "./chunk-CQ3WA2NE.js";
-import "./chunk-PQWU42UQ.js";
+import "./chunk-GCKHQECX.js";
+import "./chunk-G6OOUQWJ.js";
+import "./chunk-56GBUMO5.js";
+import "./chunk-WJZOQR2J.js";
+import "./chunk-WD4XYDYC.js";
+import "./chunk-3SZA4U64.js";
+import "./chunk-QLQ573SU.js";
+import "./chunk-3MZAGMYY.js";
 import "./chunk-2MBTWINN.js";
-import "./chunk-N7J63Q6C.js";
-import "./chunk-K2CSUCHJ.js";
-import "./chunk-PUOC4YRO.js";
-import "./chunk-RGNEEJ3Y.js";
-import "./chunk-H6A6X4EK.js";
-import "./chunk-S5XGT6GB.js";
-import "./chunk-27ONFIEY.js";
-import "./chunk-AKG5W4LG.js";
-import "./chunk-RYZINGPM.js";
-import "./chunk-PSCNXBYA.js";
-import "./chunk-L36OWPP3.js";
-import "./chunk-BYXBJQAS.js";
+import "./chunk-6CCFTVBP.js";
+import "./chunk-BPMPOFWP.js";
+import "./chunk-5MMAK75Q.js";
 import "./chunk-DWLEOOGR.js";
-import "./chunk-7KVZ5LDQ.js";
+import "./chunk-LIQJTQRN.js";
+import "./chunk-UHTDNB5Y.js";
+import "./chunk-KX6YBIHG.js";
+import "./chunk-7DPNBQSV.js";
+import "./chunk-5EBLANFT.js";
+import "./chunk-NYYFIKHI.js";
+import "./chunk-EZVK3N5L.js";
+import "./chunk-M2EJHDJP.js";
+import "./chunk-5EMSBTQ6.js";
+import "./chunk-I42VC5KR.js";
+import "./chunk-U6VC4MU4.js";
+import "./chunk-TYYRSFBG.js";
+import "./chunk-XZNCX52W.js";
+import "./chunk-WWC7I6TA.js";
+import "./chunk-YVLQXTUB.js";
+import "./chunk-PJNFNEJE.js";
+import "./chunk-PSCNXBYA.js";
+import "./chunk-K2AER7RX.js";
+import "./chunk-UBUH2TCC.js";
+import "./chunk-I4SN4NUQ.js";
+import "./chunk-5BHQICF2.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import {
   toErrorMessage
 } from "./chunk-HNMXYYJR.js";
-import "./chunk-3BXNTXYI.js";
-import "./chunk-W7XHHYWM.js";
-import "./chunk-RSEEDUMS.js";
-import "./chunk-UAD2WT54.js";
-import "./chunk-ZWQUWF6W.js";
-import "./chunk-HDLLCBRF.js";
-import "./chunk-4VJAC32I.js";
-import "./chunk-XUWRURDF.js";
-import "./chunk-5J3PYNUP.js";
-import "./chunk-UNYJU5L6.js";
+import "./chunk-FY4SDK2E.js";
+import "./chunk-GLKOYSRU.js";
+import "./chunk-EYLGAEB4.js";
 import {
   isCompiledBinary
 } from "./chunk-A7GB5UGH.js";
 import {
   DEFAULT_NOLO_SERVER_URL
 } from "./chunk-OLZBQWZU.js";
-import "./chunk-TNIX77YM.js";
-import "./chunk-Y6ROFCZO.js";
-import "./chunk-CYSYR67N.js";
-import "./chunk-Y3PMXGLH.js";
-import "./chunk-SONWNI3L.js";
-import {
-  parsePositiveFiniteNumberOrFallback
-} from "./chunk-Y5GCAMGP.js";
-import "./chunk-QDSINZM3.js";
-import "./chunk-KX6YBIHG.js";
-import "./chunk-HYZIYH2H.js";
-import "./chunk-7CHC4W22.js";
-import "./chunk-3AH7LNUB.js";
-import "./chunk-WWC7I6TA.js";
-import "./chunk-QSJ3HFEF.js";
-import "./chunk-IAESIMK7.js";
-import "./chunk-WIWM4FE3.js";
-import "./chunk-QOKAKDPE.js";
-import "./chunk-SEJ5OS6F.js";
-import "./chunk-OW765XBU.js";
-import "./chunk-GBRG75BQ.js";
-import {
-  isRecord
-} from "./chunk-KUG52IAP.js";
-import "./chunk-BNGW5ASC.js";
-import "./chunk-M2EJHDJP.js";
-import {
-  asTrimmedString
-} from "./chunk-3EUW3WEO.js";
-import "./chunk-U6VC4MU4.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import {
   normalizeServerOrigin
 } from "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
+import "./chunk-TNIX77YM.js";
+import "./chunk-Y6ROFCZO.js";
+import "./chunk-RVWMAFIT.js";
+import "./chunk-CHCS6XPJ.js";
+import "./chunk-QSJ3HFEF.js";
+import "./chunk-ZWQUWF6W.js";
+import "./chunk-KHCLMKZZ.js";
+import "./chunk-VEA7H5FG.js";
+import "./chunk-4VJAC32I.js";
 import "./chunk-4VNS5WPM.js";
 
 // packages/connector-experimental/heartbeatLoop.ts
@@ -371,16 +395,104 @@ async function runMachineWatchCommand(deps) {
 }
 
 // packages/cli/machineToolInvokeDispatch.ts
-import { lstat, realpath } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "node:path";
-var MACHINE_TOOL_INVOKE_V1_TOOL_NAMES = ["readFile", "globFiles"];
+import { appendFile, lstat, mkdir, realpath, stat } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
+
+// packages/agent-runtime/machineToolGrants.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeMachineToolGrants(raw) {
+  if (!isRecord2(raw)) return void 0;
+  const grants = {};
+  for (const [rawKey, rawEntry] of Object.entries(raw)) {
+    const agentKey = rawKey.trim();
+    if (!agentKey) continue;
+    if (!isRecord2(rawEntry)) continue;
+    if (typeof rawEntry.write !== "boolean") continue;
+    grants[agentKey] = { write: rawEntry.write };
+  }
+  return Object.keys(grants).length > 0 ? grants : void 0;
+}
+
+// packages/cli/machineToolInvokeDispatch.ts
+var MACHINE_TOOL_INVOKE_V1_READ_ONLY_TOOL_NAMES = ["readFile", "globFiles"];
+var READ_ONLY_TOOL_NAME_SET = new Set(MACHINE_TOOL_INVOKE_V1_READ_ONLY_TOOL_NAMES);
+var MACHINE_TOOL_INVOKE_V1_TOOL_NAMES = [
+  "readFile",
+  "globFiles",
+  "writeFile",
+  "editFile"
+];
 var V1_ALLOWED_TOOL_NAMES = new Set(MACHINE_TOOL_INVOKE_V1_TOOL_NAMES);
 var DEFAULT_TOOL_INVOKE_TIMEOUT_MS = 3e4;
 var TOOL_RESULT_MESSAGE_MAX_CHARS = 1e6;
-var TOOL_NOT_ALLOWED_MESSAGE = "tool not allowed in v1 (read-only)";
+var TOOL_NOT_ALLOWED_MESSAGE = "tool not allowed in v1 (allowlisted read/write file tools only)";
 var TOOL_PAYLOAD_MALFORMED_MESSAGE = "malformed tool.invoke payload (payload object required)";
 var TOOL_ARGS_MALFORMED_MESSAGE = "malformed tool.invoke args (args object required)";
+var GRANT_DIMENSION_BY_TOOL = {
+  writeFile: "write",
+  editFile: "write"
+};
+var MACHINE_TOOL_INVOKE_V1_WRITE_TOOL_NAMES = Object.keys(GRANT_DIMENSION_BY_TOOL);
+function grantDimensionForTool(toolName) {
+  return Object.hasOwn(GRANT_DIMENSION_BY_TOOL, toolName) ? GRANT_DIMENSION_BY_TOOL[toolName] : void 0;
+}
+var AUDIT_TARGET_MAX_CHARS = 200;
+function machineToolNotGrantedMessage(toolName, agentKey) {
+  const dimension = grantDimensionForTool(toolName);
+  if (!dimension) {
+    return `tool not granted on this machine: ${toolName} is not a registered machine tool (no grant dimension) (NOLO_MACHINE_TOOL_GRANTS)`;
+  }
+  return agentKey ? `tool not granted on this machine: ${toolName} requires ${dimension} grant for agent ${agentKey} (NOLO_MACHINE_TOOL_GRANTS)` : `tool not granted on this machine: ${toolName} requires an agentKey with ${dimension} grant (NOLO_MACHINE_TOOL_GRANTS)`;
+}
+function isMachineToolGranted(grants, toolName, agentKey) {
+  if (READ_ONLY_TOOL_NAME_SET.has(toolName)) return true;
+  const dimension = grantDimensionForTool(toolName);
+  if (!dimension) return false;
+  const normalizedAgentKey = typeof agentKey === "string" ? agentKey.trim() : "";
+  if (!normalizedAgentKey || !grants) return false;
+  if (!Object.prototype.hasOwnProperty.call(grants, normalizedAgentKey)) return false;
+  const entry = grants[normalizedAgentKey];
+  if (!isRecord3(entry)) return false;
+  return Object.hasOwn(entry, dimension) && entry[dimension] === true;
+}
+function resolveMachineToolAuditLogPath() {
+  const noloHome = process.env.NOLO_HOME?.trim();
+  const base = noloHome ? noloHome : join2(homedir2(), ".nolo");
+  return join2(base, "logs", "machine-tool-audit.jsonl");
+}
+function auditTargetFor(executorArgs) {
+  const target = extractMachineToolRequestPath(executorArgs) ?? "";
+  return target.length > AUDIT_TARGET_MAX_CHARS ? target.slice(0, AUDIT_TARGET_MAX_CHARS) : target;
+}
+function machineToolOutcomeFailed(outcome) {
+  const metadata = outcome.metadata;
+  if (!isRecord3(metadata)) return false;
+  if (metadata.timedOut === true) return true;
+  if (metadata.aborted === true) return true;
+  const exitCode = metadata.exitCode;
+  return typeof exitCode === "number" && exitCode !== 0;
+}
+async function appendMachineToolAudit(entry) {
+  try {
+    const logPath = resolveMachineToolAuditLogPath();
+    await mkdir(dirname2(logPath), { recursive: true });
+    await appendFile(
+      logPath,
+      `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), agentKey: entry.agentKey ?? null, tool: entry.tool, target: entry.target, ok: entry.ok })}
+`,
+      "utf8"
+    );
+  } catch (error) {
+    console.warn(`[nolo] machine tool audit write failed: ${toMessage(error)}`);
+  }
+}
 function createMachineToolInvokeHandlers(args) {
+  const grants = normalizeMachineToolGrants(
+    args.grants ?? readMachineToolGrants(args.env ?? process.env)
+  );
   const executors = (args.createToolExecutors ?? createLocalWorkspaceToolExecutors)({
     workspaceRoot: args.workspaceRoot,
     // v1 硬 containment：localWorkspaceTools 在无确认回调时对工作区外路径
@@ -396,7 +508,7 @@ function createMachineToolInvokeHandlers(args) {
     readFileNoLedger: true
   });
   const executorMap = executors;
-  const invokeWithTimeout = async (toolName, executorArgs, timeoutMs, workspaceRoot) => {
+  const invokeWithTimeout = async (toolName, executorArgs, timeoutMs, workspaceRoot, agentKey) => {
     const call = {
       id: "machine-tool-invoke",
       name: toolName,
@@ -410,7 +522,11 @@ function createMachineToolInvokeHandlers(args) {
       });
       if (preflightError) return { error: preflightError };
     }
+    const deleteGuardError = await machinePureDeleteGuard(toolName, executorArgs, workspaceRoot);
+    if (deleteGuardError) return { error: deleteGuardError };
     let timer = null;
+    const audited = grantDimensionForTool(toolName) !== void 0;
+    let auditOk = false;
     try {
       const outcome = await Promise.race([
         executorMap[toolName](call),
@@ -419,6 +535,7 @@ function createMachineToolInvokeHandlers(args) {
         })
       ]);
       const content = typeof outcome?.content === "string" ? outcome.content : "";
+      auditOk = !machineToolOutcomeFailed(outcome);
       if (content.length > TOOL_RESULT_MESSAGE_MAX_CHARS) {
         return {
           result: content.slice(0, TOOL_RESULT_MESSAGE_MAX_CHARS) + `
@@ -431,14 +548,25 @@ function createMachineToolInvokeHandlers(args) {
       return { error: toMessage(error) };
     } finally {
       if (timer) clearTimeout(timer);
+      if (audited) {
+        await appendMachineToolAudit({
+          agentKey,
+          tool: toolName,
+          target: auditTargetFor(executorArgs),
+          ok: auditOk
+        });
+      }
     }
   };
-  const invokeMachineTool = async (requestId, toolName, toolArgs, timeoutMs) => {
+  const invokeMachineTool = async (requestId, toolName, toolArgs, timeoutMs, agentKey) => {
     if (!V1_ALLOWED_TOOL_NAMES.has(toolName)) {
       return { error: TOOL_NOT_ALLOWED_MESSAGE };
     }
+    if (!isMachineToolGranted(grants, toolName, agentKey)) {
+      return { error: machineToolNotGrantedMessage(toolName, agentKey) };
+    }
     const resolvedTimeout = resolveTimeoutMs(timeoutMs);
-    return invokeWithTimeout(toolName, toolArgs, resolvedTimeout, args.workspaceRoot);
+    return invokeWithTimeout(toolName, toolArgs, resolvedTimeout, args.workspaceRoot, agentKey);
   };
   return {
     handleToolInvokeMessage: async (message, send) => {
@@ -451,7 +579,7 @@ function createMachineToolInvokeHandlers(args) {
         );
         return JSON.stringify({ type: "tool.result", requestId, error: TOOL_PAYLOAD_MALFORMED_MESSAGE });
       }
-      if (!isRecord2(payload.args)) {
+      if (!isRecord3(payload.args)) {
         send(
           JSON.stringify({ type: "tool.result", requestId, error: TOOL_ARGS_MALFORMED_MESSAGE })
         );
@@ -461,7 +589,8 @@ function createMachineToolInvokeHandlers(args) {
         requestId,
         payload.tool,
         payload.args,
-        payload.timeoutMs
+        payload.timeoutMs,
+        payload.agentKey
       );
       send(
         JSON.stringify(
@@ -490,7 +619,7 @@ function isLexicallyInsideRoot(root, targetPath) {
 }
 async function machinePathPreflight(args) {
   const workspaceRoot = resolve2(args.workspaceRoot);
-  const lexicalPath = resolve2(workspaceRoot, args.request);
+  const lexicalPath = resolveRequestedWorkspacePath(workspaceRoot, args.request);
   if (!isLexicallyInsideRoot(workspaceRoot, lexicalPath)) {
     return `path outside workspace root: ${args.request}`;
   }
@@ -499,11 +628,19 @@ async function machinePathPreflight(args) {
   while (true) {
     const stats = await lstat(current).catch(() => void 0);
     if (!stats) {
-      return null;
+      const parent = resolve2(current, "..");
+      if (parent === current) return null;
+      return await ancestorContainmentPreflight({
+        workspaceRoot,
+        ancestor: parent,
+        request: args.request
+      });
     }
     if (!stats.isSymbolicLink()) break;
     const target = await realpath(current).catch(() => void 0);
-    if (!target) return null;
+    if (!target) {
+      return `path outside workspace root after symlink resolution: ${args.request}`;
+    }
     symlinks.push({ link: current, target });
     current = resolve2(current, "..");
     if (current === dirname2(current)) break;
@@ -519,6 +656,76 @@ async function machinePathPreflight(args) {
   }
   return null;
 }
+async function ancestorContainmentPreflight(args) {
+  const workspaceRoot = resolve2(args.workspaceRoot);
+  let existing = args.ancestor;
+  while (true) {
+    const stats = await lstat(existing).catch(() => void 0);
+    if (stats) break;
+    const parent = resolve2(existing, "..");
+    if (parent === existing) return null;
+    existing = parent;
+  }
+  try {
+    const [realExisting, realRoot] = await Promise.all([realpath(existing), realpath(workspaceRoot)]);
+    if (!isLexicallyInsideRoot(realRoot, realExisting)) {
+      return `path outside workspace root after symlink resolution: ${args.request}`;
+    }
+  } catch {
+    return `path outside workspace root after symlink resolution: ${args.request}`;
+  }
+  return null;
+}
+var WRITEFILE_DELETE_GUARD_MESSAGE = "writeFile blocked: refusing to overwrite an existing non-empty file with empty content (data-deletion guard). Use editFile with the exact oldText to remove specific text, or write the intended content explicitly.";
+var WRITEFILE_DIRECTORY_TARGET_MESSAGE = "writeFile blocked: target path is an existing directory, not a file (refusing to write; nothing was modified).";
+var EDITFILE_DELETE_GUARD_MESSAGE = "editFile blocked: refusing to replace matched text with an empty newText (data-deletion guard). Provide the intended replacement text.";
+function extractMachineToolStringField(executorArgs, aliases) {
+  const rawArgs = typeof executorArgs === "string" ? executorArgs : executorArgs !== void 0 && executorArgs !== null ? JSON.stringify(executorArgs) : null;
+  if (rawArgs === null) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(rawArgs);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+  for (const key of aliases) {
+    const value = parsed[key];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function writeFileUninspectableTargetMessage(code) {
+  return `writeFile blocked: target cannot be inspected (${code}); refusing to write (fail closed \u2014 only a missing target counts as a new file).`;
+}
+function fsErrorCode(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const code = error.code;
+  return typeof code === "string" ? code : void 0;
+}
+async function machinePureDeleteGuard(toolName, executorArgs, workspaceRoot) {
+  if (toolName === "writeFile") {
+    const content = extractMachineToolStringField(executorArgs, ["content"]);
+    if (content === void 0 || content.trim() !== "") return null;
+    const requestPath = extractMachineToolRequestPath(executorArgs);
+    if (requestPath === null) return null;
+    let stats;
+    try {
+      stats = await stat(resolveRequestedWorkspacePath(workspaceRoot, requestPath));
+    } catch (error) {
+      if (fsErrorCode(error) === "ENOENT") return null;
+      return writeFileUninspectableTargetMessage(fsErrorCode(error) ?? "unknown");
+    }
+    if (stats.isDirectory()) return WRITEFILE_DIRECTORY_TARGET_MESSAGE;
+    return stats.size > 0 ? WRITEFILE_DELETE_GUARD_MESSAGE : null;
+  }
+  if (toolName === "editFile") {
+    const newText = extractMachineToolStringField(executorArgs, NEW_TEXT_FIELD_ALIASES);
+    if (newText !== void 0 && newText.trim() === "") return EDITFILE_DELETE_GUARD_MESSAGE;
+    return null;
+  }
+  return null;
+}
 function extractMachineToolRequestPath(executorArgs) {
   const rawArgs = typeof executorArgs === "string" ? executorArgs : executorArgs !== void 0 && executorArgs !== null ? JSON.stringify(executorArgs) : null;
   if (rawArgs === null) return null;
@@ -542,9 +749,9 @@ function parseToolInvokeFrame(message) {
   } catch {
     return null;
   }
-  if (!isRecord2(parsed) || parsed.type !== "tool.invoke") return null;
+  if (!isRecord3(parsed) || parsed.type !== "tool.invoke") return null;
   if (typeof parsed.requestId !== "string" || parsed.requestId.length === 0) return null;
-  if (!isRecord2(parsed.payload)) {
+  if (!isRecord3(parsed.payload)) {
     return {
       requestId: parsed.requestId,
       payload: { tool: "", args: {}, timeoutMs: void 0 },
@@ -557,23 +764,46 @@ function parseToolInvokeFrame(message) {
     payload: {
       tool: typeof payload.tool === "string" ? payload.tool : "",
       args: payload.args,
-      timeoutMs: payload.timeoutMs
+      timeoutMs: payload.timeoutMs,
+      agentKey: typeof payload.agentKey === "string" && payload.agentKey.length > 0 ? payload.agentKey : void 0
     }
   };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // packages/cli/machineWsSession.ts
 var CONNECTOR_WS_KEEPALIVE_MS = 25e3;
+var DEFAULT_CONNECTOR_TEARDOWN_TIMEOUT_MS = 2e3;
+function resolveTeardownTimeoutMs(env) {
+  return clampConnectorTimerDelayMs(
+    parsePositiveFiniteNumberOrFallback(
+      env.NOLO_CONNECT_TEARDOWN_TIMEOUT_MS,
+      DEFAULT_CONNECTOR_TEARDOWN_TIMEOUT_MS
+    )
+  );
+}
+async function settleWithinTimeout(promises, timeoutMs) {
+  let timer = null;
+  try {
+    const outcome = await Promise.race([
+      Promise.allSettled(promises).then(() => "settled"),
+      new Promise((resolve3) => {
+        timer = setTimeout(() => resolve3("timeout"), timeoutMs);
+      })
+    ]);
+    return { timedOut: outcome === "timeout" };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 function buildConnectorKeepaliveMessage() {
   return JSON.stringify({ type: "connector.keepalive", sentAt: Date.now() });
 }
 function resolveHeartbeatIntervalMs2(env) {
-  return parsePositiveFiniteNumberOrFallback(
-    env.NOLO_CONNECT_HEARTBEAT_MS,
-    3e4
+  return clampConnectorTimerDelayMs(
+    parsePositiveFiniteNumberOrFallback(env.NOLO_CONNECT_HEARTBEAT_MS, 3e4)
   );
 }
 async function defaultConnectWebSocket(url, options) {
@@ -604,6 +834,7 @@ async function defaultConnectWebSocket(url, options) {
       }
     };
     options.signal?.addEventListener("abort", handleAbort, { once: true });
+    options.teardownSignal?.addEventListener("abort", handleAbort, { once: true });
     ws.addEventListener(
       "open",
       () => {
@@ -613,8 +844,13 @@ async function defaultConnectWebSocket(url, options) {
             ws.send(buildConnectorKeepaliveMessage());
           } catch {
             clearKeepalive();
+            try {
+              ws.close();
+            } catch {
+              resolve3();
+            }
           }
-        }, CONNECTOR_WS_KEEPALIVE_MS);
+        }, options.keepaliveMs ?? CONNECTOR_WS_KEEPALIVE_MS);
       },
       { once: true }
     );
@@ -648,8 +884,19 @@ async function defaultConnectWebSocket(url, options) {
 async function runMachineWsSession(options) {
   const sentMessages = [];
   const heartbeatAbort = new AbortController();
+  const teardownAbort = new AbortController();
+  const teardownTimeoutMs = resolveTeardownTimeoutMs(options.env);
   let heartbeatLoopPromise = null;
   let websocketPromise = null;
+  const settleTeardown = async () => {
+    const { timedOut } = await settleWithinTimeout(
+      [websocketPromise, heartbeatLoopPromise].filter(Boolean),
+      teardownTimeoutMs
+    );
+    if (timedOut) {
+      teardownAbort.abort();
+    }
+  };
   try {
     if (options.signal?.aborted) {
       return { exitCode: 0 };
@@ -673,11 +920,13 @@ async function runMachineWsSession(options) {
       serverUrl: options.serverUrl,
       machineId: options.machine.machineId,
       connectorSurface: "cli",
-      headers: { Authorization: `Bearer ${options.authToken}` }
+      headers: { Authorization: `Bearer ${options.authToken}` },
+      probeTimeoutMs: resolveConnectorProbeTimeoutMs(options.env)
     });
     websocketPromise = options.connectWebSocket(wsTarget, {
       headers: { Authorization: `Bearer ${options.authToken}` },
       signal: options.signal,
+      teardownSignal: teardownAbort.signal,
       sentMessages,
       onMessage: (message) => options.onMessage(message, (response) => {
         sentMessages.push(response);
@@ -694,16 +943,14 @@ async function runMachineWsSession(options) {
       [websocketPromise, heartbeatMonitorPromise, abortPromise].filter(Boolean)
     );
     heartbeatAbort.abort();
-    await Promise.allSettled([websocketPromise, heartbeatLoopPromise]);
+    await settleTeardown();
     if (raceResult === "aborted") {
       return { exitCode: 0 };
     }
     return { exitCode: 0 };
   } catch (error) {
     heartbeatAbort.abort();
-    await Promise.allSettled(
-      [websocketPromise, heartbeatLoopPromise].filter(Boolean)
-    );
+    await settleTeardown();
     if (isConnectorWebSocketAuthError(error)) {
       options.output.write(
         `[nolo] Connector websocket auth failed: ${error.message}. Re-register this machine or update NOLO_MACHINE_API_KEY.
@@ -806,6 +1053,43 @@ async function handleMachineWsMessageDemux(message, send, handlers, runConnector
   }
   await runConnectorMessage();
 }
+function readMachineToolGrants(env) {
+  const raw = env.NOLO_MACHINE_TOOL_GRANTS?.trim();
+  if (!raw) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    warnMalformedMachineToolGrantsOnce(
+      `json:${raw}`,
+      `[nolo] NOLO_MACHINE_TOOL_GRANTS is not valid JSON, ignoring it: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return void 0;
+  }
+  if (!isRecord(parsed)) {
+    warnMalformedMachineToolGrantsOnce(
+      `shape:${raw}`,
+      "[nolo] NOLO_MACHINE_TOOL_GRANTS must be a JSON object, ignoring it"
+    );
+    return void 0;
+  }
+  return parsed;
+}
+var warnedMalformedMachineToolGrants = /* @__PURE__ */ new Set();
+function warnMalformedMachineToolGrantsOnce(dedupeKey, message) {
+  if (warnedMalformedMachineToolGrants.has(dedupeKey)) return;
+  warnedMalformedMachineToolGrants.add(dedupeKey);
+  console.warn(message);
+}
+function __resetMalformedMachineToolGrantsWarningsForTests() {
+  warnedMalformedMachineToolGrants.clear();
+}
+function appendToolGrantsToWsUrl(wsUrl, grants) {
+  if (!grants) return wsUrl;
+  const target = new URL(wsUrl);
+  target.searchParams.set("toolGrants", JSON.stringify(grants));
+  return target.toString();
+}
 function resolveAuthToken2(env) {
   return env.AUTH_TOKEN || env.AUTH || "";
 }
@@ -854,11 +1138,60 @@ async function sleepWithAbort(ms, sleep, signal) {
   ]);
 }
 function resolveConnectorReconnectDelayMs(env) {
-  const raw = Number(env.NOLO_CONNECT_RECONNECT_MS ?? "");
-  return Number.isFinite(raw) && raw >= 0 ? raw : 5e3;
+  const rawValue = env.NOLO_CONNECT_RECONNECT_MS;
+  if (rawValue === void 0 || rawValue.trim() === "") return 5e3;
+  const raw = Number(rawValue);
+  if (!Number.isFinite(raw) || raw < 0) return 5e3;
+  return Math.min(raw, MAX_CONNECTOR_TIMER_DELAY_MS);
+}
+var DEFAULT_CONNECTOR_HEARTBEAT_TIMEOUT_MS = 1e4;
+function resolveConnectorHeartbeatTimeoutMs(env) {
+  return clampConnectorTimerDelayMs(
+    parsePositiveFiniteNumberOrFallback(
+      env.NOLO_CONNECT_HEARTBEAT_TIMEOUT_MS,
+      DEFAULT_CONNECTOR_HEARTBEAT_TIMEOUT_MS
+    )
+  );
+}
+async function postMachineHeartbeat(args) {
+  const { fetchImpl, serverUrl, authToken, machine, timeoutMs } = args;
+  const controller = new AbortController();
+  const startedAt = Date.now();
+  let timer = null;
+  const timeoutPromise = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(
+        new Error(
+          `heartbeat timed out after ${Date.now() - startedAt}ms (NOLO_CONNECT_HEARTBEAT_TIMEOUT_MS=${timeoutMs})`
+        )
+      );
+    }, timeoutMs);
+  });
+  try {
+    const res = await Promise.race([
+      fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${authToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(machine),
+        signal: controller.signal
+      }),
+      timeoutPromise
+    ]);
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`HTTP ${res.status}
+${text}`);
+    }
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 async function defaultExecuteCli(provider, prompt, options) {
-  const { executeCli } = await import("./cliExecutor-AWYR3T33.js");
+  const { executeCli } = await import("./cliExecutor-BWBF2MTI.js");
   return executeCli(provider, prompt, options);
 }
 function detectLaunchableMachineInfo() {
@@ -928,21 +1261,13 @@ async function runMachineConnectCommand(args, deps = {}) {
     });
   }
   const machine = (deps.machineInfo ?? detectLaunchableMachineInfo)();
-  const sendHeartbeat = async () => {
-    const res = await fetchImpl(`${serverUrl}/api/machines/heartbeat`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${authToken}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(machine)
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      throw new Error(`HTTP ${res.status}
-${text}`);
-    }
-  };
+  const sendHeartbeat = () => postMachineHeartbeat({
+    fetchImpl,
+    serverUrl,
+    authToken,
+    machine,
+    timeoutMs: resolveConnectorHeartbeatTimeoutMs(env)
+  });
   if (hasFlag(args, "--ws")) {
     const validateWorkspaceLinks = deps.validateWorkspaceLinks ?? (() => []);
     if (!await checkConnectorWorkspaceLinks(process.cwd(), output, validateWorkspaceLinks)) {
@@ -951,8 +1276,15 @@ ${text}`);
     const maxAttempts = deps.maxConnectorAttempts ?? Infinity;
     const sleep = deps.sleep ?? defaultSleep2;
     const reconnectDelayMs = resolveConnectorReconnectDelayMs(env);
+    const toolGrants = readMachineToolGrants(env);
     const toolInvokeHandlers = createMachineToolInvokeHandlers({
-      workspaceRoot: process.cwd()
+      workspaceRoot: process.cwd(),
+      // M2 修复：机器侧授权复核与握手上报共用同一来源——本次 `deps.env ??
+      // process.env`。grants 快照与 WS URL 上报的那份逐字节相同；未配置时也
+      // 显式传 env，工厂不再回落到 process.env（调用方经 deps.env 注入环境时
+      // 两端曾不一致）。
+      env,
+      ...toolGrants ? { grants: toolGrants } : {}
     });
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
       if (deps.signal?.aborted) {
@@ -969,10 +1301,13 @@ ${text}`);
         connectWebSocket: deps.connectWebSocket ?? defaultConnectWebSocket,
         serverUrl,
         authToken,
-        resolveConnectorWebSocketTarget: (options) => resolveConnectorWebSocketTarget({
-          ...options,
-          fetchImpl
-        }),
+        resolveConnectorWebSocketTarget: async (options) => appendToolGrantsToWsUrl(
+          await resolveConnectorWebSocketTarget({
+            ...options,
+            fetchImpl
+          }),
+          toolGrants
+        ),
         onMessage: (message, send) => handleMachineWsMessageDemux(
           message,
           send,
@@ -1002,7 +1337,10 @@ ${text}`);
         return 0;
       }
       if (attempt >= maxAttempts) return exitCode;
-      const retryDelayMs = sessionResult.retryAfterMs ?? reconnectDelayMs;
+      const retryDelayMs = Math.min(
+        sessionResult.retryAfterMs ?? reconnectDelayMs,
+        MAX_CONNECTOR_TIMER_DELAY_MS
+      );
       const reconnectContext = sessionResult.reconnectReason === CORE_DRAIN_REASON ? " during core draining" : "";
       output.write(
         `[nolo] Connector websocket disconnected${reconnectContext}. Reconnecting in ${retryDelayMs}ms.
@@ -1028,7 +1366,11 @@ ${text}`);
   });
 }
 export {
+  __resetMalformedMachineToolGrantsWarningsForTests,
   formatMachineStatus,
+  postMachineHeartbeat,
+  readMachineToolGrants,
+  resolveConnectorHeartbeatTimeoutMs,
   runMachineConnectCommand,
   runMachineStatusCommand
 };