@realqiyan/agent-task 0.0.0-stage → 0.0.1-rc.2

package/dist/web/app.js

@@ -0,0 +1,72 @@
+import { connect, disconnect, request } from "./api.js";
+import { element, notice, report, submit } from "./dom.js";
+import { renderTasks } from "./tasks-view.js";
+import { renderSettings } from "./settings-view.js";
+
+const login = document.querySelector("#login"), navigation = document.querySelector("#navigation");
+const main = document.querySelector("#view"), status = document.querySelector("#status"), token = document.querySelector("#token");
+let connected = false, view = { kind: "tasks", after: 0 }, sequence = 0, loading = false, dirty = false;
+
+function health(value) {
+  status.textContent = (value.running && value.storageHealthy ? "服务运行中" : "服务不可用") +
+    " · 活动协调运行：" + value.activeTaskRunIds.length + " · ACP 会话：" + value.activeNodeRunIds.length +
+    (value.settings.pendingRestart ? " · 已保存变更，待手动重启（当前权限和凭据未变）" : " · 无待重启变更") +
+    (value.settings.writeBlocked ? " · 配置保存已冻结，请停服核查" : "");
+}
+async function render() {
+  const current = ++sequence, target = { ...view }, root = element("section");
+  const open = new Set([...main.querySelectorAll("details[open]")].map(node => node.dataset.key));
+  loading = true;
+  const navigate = (next, force = false) => { if (root.isConnected) void go(next, force); };
+  try {
+    if (target.kind === "settings") await renderSettings(root, navigate);
+    else await renderTasks(root, target, navigate);
+    if (current !== sequence || !connected) return;
+    for (const node of root.querySelectorAll("details")) node.open = open.has(node.dataset.key);
+    root.addEventListener("input", () => { dirty = true; });
+    main.replaceChildren(root); dirty = false;
+  } catch (error) { if (current === sequence && connected) report(error); }
+  finally { if (current === sequence) loading = false; }
+}
+async function go(next, force = false) {
+  if (!force && dirty && !confirm("离开或刷新将丢弃尚未保存的表单编辑，继续？")) return;
+  view = next; dirty = false; await render();
+}
+function logout() {
+  connected = false; sequence++; loading = false; dirty = false; disconnect();
+  main.replaceChildren(); status.textContent = ""; token.value = "";
+  navigation.hidden = true; login.hidden = false;
+}
+login.append(submit(login, "连接控制台", async () => {
+  const value = token.value; token.value = "";
+  const result = await connect(value);
+  connected = true; login.hidden = true; navigation.hidden = false; notice(); health(result);
+  await go({ kind: "tasks", after: 0 }, true);
+}));
+document.querySelector("#tasks").addEventListener("click", () => { void go({ kind: "tasks", after: 0 }); });
+document.querySelector("#settings").addEventListener("click", () => { void go({ kind: "settings" }); });
+document.querySelector("#refresh").addEventListener("click", async () => {
+  await go(view);
+  if (connected) { try { health(await request("/status")); } catch (error) { report(error); } }
+});
+document.querySelector("#logout").addEventListener("click", () => { logout(); notice("已退出；刷新后也须重新输入管理员令牌。"); });
+document.addEventListener("unauthorized", logout);
+document.addEventListener("service-restarted", event => {
+  logout();
+  notice("新实例已通过认证健康检查。请在新地址重新连接；令牌没有放入链接。");
+  const url = new URL(event.detail.consoleUrl);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1") return;
+  const link = element("a", url.href); link.href = url.href; main.append(link);
+});
+window.addEventListener("pagehide", logout);
+setInterval(async () => {
+  if (!connected || document.hidden || loading) return;
+  const current = sequence;
+  try {
+    const value = await request("/status");
+    if (connected && current === sequence) {
+      health(value);
+      if (view.kind !== "settings" && !main.contains(document.activeElement)) await render();
+    }
+  } catch (error) { if (connected && current === sequence) report(error); }
+}, 10_000);

package/dist/web/dom.js

@@ -0,0 +1,65 @@
+export function element(tag, text) {
+  const node = document.createElement(tag);
+  if (text !== undefined) node.textContent = String(text);
+  return node;
+}
+export function notice(text = "") { document.querySelector("#notice").textContent = text; }
+export function report(error) {
+  notice(error.message ?? "操作失败");
+  if (error.status === 401) document.dispatchEvent(new Event("unauthorized"));
+}
+async function act(node, action) {
+  node.disabled = true;
+  try { await action(); } catch (error) { if (node.isConnected) report(error); }
+  finally { node.disabled = false; }
+}
+export function button(text, action, disabled = false) {
+  const node = element("button", text); node.type = "button"; node.disabled = disabled;
+  node.addEventListener("click", () => { void act(node, action); });
+  return node;
+}
+export function submit(form, text, action) {
+  const node = form.querySelector("button[type=submit]") ?? element("button", text); node.type = "submit";
+  form.addEventListener("submit", event => { event.preventDefault(); void act(node, action); });
+  return node;
+}
+export function block(title, value, key = title) {
+  const details = element("details"); details.dataset.key = key;
+  details.append(element("summary", title), element("pre", typeof value === "string" ? value : JSON.stringify(value, null, 2)));
+  return details;
+}
+export function table(headers, rows) {
+  const wrapper = element("div"); wrapper.className = "table-wrap";
+  const node = element("table"), head = element("tr");
+  for (const label of headers) head.append(element("th", label));
+  const thead = element("thead"); thead.append(head); node.append(thead);
+  const body = element("tbody");
+  for (const row of rows) {
+    const tr = element("tr");
+    for (const value of row) {
+      const td = element("td");
+      td.append(value instanceof Node ? value : document.createTextNode(value == null ? "—" : String(value)));
+      tr.append(td);
+    }
+    body.append(tr);
+  }
+  node.append(body); wrapper.append(node);
+  return wrapper;
+}
+export function field(label, value = "", type = "text") {
+  const row = element("label", label), input = element(type === "textarea" ? "textarea" : "input");
+  if (type !== "textarea") input.type = type;
+  if (type === "checkbox") input.checked = Boolean(value); else input.value = value ?? "";
+  if (type === "password") { input.autocomplete = "off"; input.spellcheck = false; }
+  row.append(input);
+  return { row, input };
+}
+export function select(label, choices, value = "") {
+  const row = element("label", label), input = element("select");
+  for (const [key, text] of choices) {
+    const option = element("option", text); option.value = key; input.append(option);
+  }
+  input.value = value; row.append(input);
+  return { row, input };
+}
+export function time(value) { return value == null ? "—" : new Date(value).toLocaleString(); }

package/dist/web/index.html

@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Agent Task 控制台</title>
+  <link rel="stylesheet" href="/admin/style.css">
+  <script type="module" src="/admin/app.js"></script>
+</head>
+<body>
+  <header>
+    <h1>Agent Task</h1>
+    <p>本机管理控制台 · 配置保存后须手动重启</p>
+    <form id="login" autocomplete="off">
+      <label>管理员令牌
+        <input id="token" type="password" required maxlength="256" autocomplete="off" spellcheck="false">
+      </label>
+      <button type="submit">连接</button>
+      <p class="hint">使用独立的 AGENT_TASK_ADMIN_TOKEN，不是 MCP token。令牌只保存在当前页面内存中。</p>
+    </form>
+    <nav id="navigation" hidden>
+      <button id="tasks" type="button">任务</button>
+      <button id="settings" type="button">配置</button>
+      <button id="refresh" type="button">刷新</button>
+      <button id="logout" type="button">退出</button>
+    </nav>
+    <p id="status" role="status"></p>
+  </header>
+  <p id="notice" role="alert"></p>
+  <main id="view"></main>
+  <noscript>控制台需要 JavaScript；没有加载任何第三方脚本。</noscript>
+</body>
+</html>

package/dist/web/settings-view.js

@@ -0,0 +1,126 @@
+import { request } from "./api.js";
+import { element, field, select, button, submit, block, table, notice } from "./dom.js";
+
+function executorEditor(host, executor) {
+  const card = element("fieldset"), fields = {};
+  card.append(element("legend", "ACP 执行端"));
+  const type = select("类型", ["pi", "codex", "claude", "opencode"].map(value => [value, value]), executor.type ?? "pi");
+  fields.type = type.input; card.append(type.row);
+  for (const [key, label, kind, value] of [
+    ["id", "注册 ID", "text", executor.id],
+    ["note", "备注", "textarea", executor.note],
+    ["cwd", "默认工作空间（绝对路径）", "text", executor.cwd],
+  ]) {
+    const item = field(label, value, kind); fields[key] = item.input; card.append(item.row);
+  }
+  const approved = field("已由管理员审核原生授权，允许无人值守执行", executor.unattendedApproved, "checkbox");
+  for (const [key, input] of Object.entries(fields)) if (key !== "note") input.addEventListener("input", () => { approved.input.checked = false; });
+  card.append(approved.row, element("p", "按类型从用户原生 PATH 查找 ACP 适配器。继承用户原生环境，但过滤服务私密变量；额外 ACP 审批一律拒绝。结果固定保存在 dataDir/results，只向节点提供指定上游文件，不提供整个数据目录读取。"),
+    button("从待保存配置中移除", () => { card.remove(); host.dispatchEvent(new Event("input", { bubbles: true })); }));
+  host.append(card);
+  return () => card.parentNode === host ? [{
+    id: fields.id.value, type: fields.type.value, note: fields.note.value,
+    cwd: fields.cwd.value, unattendedApproved: approved.input.checked,
+  }] : [];
+}
+function coordinatorEditor(host, config) {
+  const provider = select("协调模型提供方", [["", "未配置"], ["openai", "OpenAI"], ["anthropic", "Anthropic"],
+    ["deepseek", "DeepSeek"], ["openai-compatible", "OpenAI-compatible"]], config?.provider ?? "");
+  const model = field("模型 ID", config?.model), compatible = element("fieldset");
+  compatible.append(element("legend", "兼容端点元数据（由管理员确认，不自动查询）"));
+  const custom = {
+    baseUrl: field("端点 URL（不得包含凭据、查询参数或片段）", config?.baseUrl),
+    apiKeyEnv: field("密钥变量名（先在下方保存新密钥）", config?.apiKeyEnv ?? "COORDINATOR_API_KEY"),
+    api: select("API", [["openai-completions", "openai-completions"], ["openai-responses", "openai-responses"]], config?.api ?? "openai-completions"),
+    contextWindow: field("上下文窗口", config?.contextWindow, "number"),
+    maxTokens: field("最大输出 token", config?.maxTokens, "number"),
+    reasoning: field("支持 reasoning", config?.reasoning, "checkbox"),
+  };
+  for (const item of Object.values(custom)) compatible.append(item.row);
+  const visibility = () => { compatible.hidden = provider.input.value !== "openai-compatible"; model.row.hidden = !provider.input.value; };
+  provider.input.addEventListener("change", visibility); visibility();
+  host.append(provider.row, model.row, compatible);
+  return () => {
+    if (!provider.input.value) return undefined;
+    const result = { provider: provider.input.value, model: model.input.value };
+    if (result.provider === "openai-compatible") Object.assign(result, {
+      baseUrl: custom.baseUrl.input.value, apiKeyEnv: custom.apiKeyEnv.input.value, api: custom.api.input.value,
+      contextWindow: custom.contextWindow.input.valueAsNumber, maxTokens: custom.maxTokens.input.valueAsNumber,
+      reasoning: custom.reasoning.input.checked,
+    });
+    return result;
+  };
+}
+export async function renderSettings(root, navigate) {
+  let state = await request("/settings");
+  root.append(element("h2", "配置与凭据"), element("p", "配置和密钥分别保存。保存不修改当前进程；每次重新启动（包括故障后拉起）读取已保存值。"),
+    element("p", "先保存新密钥，再保存引用它的配置。执行端原生登录和原生权限仍通过官方工具管理；这里不编辑其认证文件。"),
+    block("当前运行配置（只读，无密钥值）", state.running));
+  if (state.writeBlocked) root.append(element("p", "上次文件提交结果不确定。请停服核查；当前禁止继续保存。"));
+  const form = element("form"), modelHost = element("fieldset"), executors = element("div"), readers = [];
+  modelHost.append(element("legend", "协调模型"));
+  const readModel = coordinatorEditor(modelHost, state.saved.coordinator);
+  const startup = {
+    dataDir: field("下次启动的数据目录（规范绝对路径；不搬迁或删除旧历史）", state.saved.dataDir),
+    port: field("下次启动的监听端口（0 为自动分配）", state.saved.port, "number"),
+    tokenEnv: field("MCP 令牌环境变量名（改名保留令牌值）", state.saved.tokenEnv),
+  };
+  form.append(element("h3", "启动配置"), ...Object.values(startup).map(item => item.row),
+    modelHost, element("h3", "执行端注册与权限"), executors);
+  for (const executor of state.saved.executors) readers.push(executorEditor(executors, executor));
+  form.append(button("添加执行端", () => {
+    readers.push(executorEditor(executors, { id: "", type: "pi", note: "", cwd: "", unattendedApproved: false }));
+  }, state.writeBlocked));
+  const preview = element("div");
+  const save = submit(form, "校验并预览配置变更", async () => {
+    const input = { editToken: state.editToken, config: { dataDir: startup.dataDir.input.value, port: startup.port.input.valueAsNumber, tokenEnv: startup.tokenEnv.input.value,
+      coordinator: readModel(), executors: readers.flatMap(read => read()) } };
+    const checked = await request("/settings/validate", input);
+    preview.replaceChildren(block("校验后的待保存配置", checked.config),
+      block("重启后受执行端变更影响的任务", checked.affectedTasks));
+    const affected = checked.affectedTasks.map(task => task.name + " (" + task.id + ")").join("\n") || "无";
+    if (!confirm("本地校验通过，不代表模型认证或 ACP 执行已验证。\n受影响任务：\n" + affected +
+      "\n\n旧任务快照不会被重写，派发可能被拒绝。确认保存配置？保存后仍须手动重启。")) return;
+    await request("/settings/config", input);
+    notice("配置已保存，未热更新。检查活动运行后可在本页或 CLI 重启。");
+    navigate({ kind: "settings" }, true);
+  });
+  save.disabled = state.writeBlocked; form.append(save, preview); root.append(form);
+
+  root.append(element("h3", "密钥（仅显示是否设置）"),
+    element("p", "不提交即保留原值。新变量名使用 _KEY、_TOKEN、_SECRET 或 _PASSWORD 结尾；不能在这里修改服务/管理员令牌或运行环境。"));
+  const statuses = element("div"), credentialForm = element("form");
+  const key = field("凭据变量名"), value = field("新值（替换后不回显）", "", "password");
+  key.input.required = true; value.input.required = true;
+  value.input.maxLength = 16384;
+  const drawCredentials = () => {
+    statuses.replaceChildren(table(["变量名", "已保存", "当前进程已设置", "待重启", "操作"], state.credentials.map(credential => [
+      credential.key, credential.saved ? "是" : "否", credential.running ? "是" : "否", credential.pendingRestart ? "是" : "否",
+      button("删除已保存值", async () => {
+        if (!confirm("删除 " + credential.key + " 的已保存值？当前进程仍保留旧值，直到重启。")) return;
+        state = await request("/settings/credential", { editToken: state.editToken, key: credential.key, action: "delete" });
+        drawCredentials(); notice("密钥删除已保存，待重启。配置表单中的未保存编辑仍保留。");
+      }, !credential.saved || credential.referenced || state.writeBlocked),
+    ])));
+  };
+  drawCredentials();
+  credentialForm.append(key.row, value.row);
+  const replace = submit(credentialForm, "单独保存此密钥", async () => {
+    const input = { editToken: state.editToken, key: key.input.value, action: "replace", value: value.input.value };
+    value.input.value = "";
+    state = await request("/settings/credential", input);
+    drawCredentials(); notice("密钥已保存，未热更新。配置表单中的未保存编辑仍保留，请继续校验并保存配置。");
+  });
+  replace.disabled = state.writeBlocked;
+  credentialForm.append(replace);
+  root.append(statuses, credentialForm, element("h3", "重启服务"),
+    element("p", "重启只应用已保存配置，未保存草稿会丢失。活动执行及待回答运行可能持有 ACP 会话；重启会关闭会话，不自动重试或重放不确定执行。"),
+    button("重启并检查可用性", async () => {
+      if (!confirm("确认使用已保存配置重启？活动工作可能中断，旧数据不会迁移。")) return;
+      notice("正在关闭旧运行并启动新实例，请勿重复操作……");
+      const ready = await request("/restart", {});
+      document.dispatchEvent(new CustomEvent("service-restarted", { detail: ready }));
+    }, state.writeBlocked),
+    block("前台或 systemd / launchd 托管实例", "agent-task restart [--home /absolute/installation]"),
+    element("p", "只有新实例通过认证健康检查才显示成功。若请求结果不确定，请先运行 agent-task status；启动失败时检查当前 dataDir/service.log，不删除历史或重放任务来修复。"));
+}

package/dist/web/style.css

@@ -0,0 +1,24 @@
+:root { color-scheme: light dark; font: 15px/1.55 system-ui, sans-serif; }
+body { max-width: 1150px; margin: 0 auto; padding: 1.2rem; }
+h1, h2, h3 { line-height: 1.25; }
+header { border-bottom: 1px solid #8886; margin-bottom: 1rem; }
+nav, .actions { display: flex; flex-wrap: wrap; gap: .5rem; margin: .8rem 0; }
+button, input, select, textarea { font: inherit; }
+button { padding: .35rem .8rem; cursor: pointer; }
+button:disabled { cursor: default; opacity: .55; }
+label { display: block; margin: .7rem 0; overflow-wrap: anywhere; }
+input:not([type="checkbox"]), select, textarea { display: block; box-sizing: border-box; width: 100%; max-width: 48rem; padding: .35rem; }
+input[type="checkbox"] { margin-left: .7rem; }
+textarea { min-height: 5rem; resize: vertical; }
+fieldset, article { border: 1px solid #8886; border-radius: .3rem; padding: .8rem; margin: 1rem 0; min-width: 0; }
+.table-wrap { overflow-x: auto; }
+table { border-collapse: collapse; width: 100%; margin: .8rem 0; }
+th, td { text-align: left; vertical-align: top; border-bottom: 1px solid #8886; padding: .45rem; overflow-wrap: anywhere; }
+pre { white-space: pre-wrap; overflow-wrap: anywhere; padding: .8rem; background: #8881; max-height: 32rem; overflow-y: auto; }
+details { margin: .8rem 0; }
+summary { cursor: pointer; font-weight: 600; }
+.hint { opacity: .8; font-size: .92rem; }
+#notice:not(:empty) { border-left: 4px solid #c88712; padding: .7rem; background: #c8871215; }
+#status { font-weight: 600; }
+[hidden] { display: none !important; }
+@media (max-width: 600px) { body { padding: .7rem; } th, td { padding: .3rem; } }

package/dist/web/tasks-view.js

@@ -0,0 +1,83 @@
+import { request } from "./api.js";
+import { element, table, button, block, notice, time } from "./dom.js";
+
+function paging(root, page, state, navigate) {
+  const actions = element("div"); actions.className = "actions";
+  actions.append(button("上一页", () => navigate({ ...state, after: Math.max(0, state.after - 20) }), state.after === 0),
+    button("下一页", () => navigate({ ...state, after: page.next }), page.next === null));
+  root.append(actions);
+}
+export async function renderTasks(root, state, navigate) {
+  if (state.kind === "tasks") {
+    const page = await request("/tasks?after=" + state.after);
+    root.append(element("h2", "任务"), element("p", "触发计划状态不等于运行结果；空闲页面每 10 秒刷新，交互时可手动刷新。"),
+      table(["任务", "触发计划状态", "计划", "下次触发"], page.items.map(task => [
+        button(task.name, () => navigate({ kind: "task", id: task.id, after: 0 })),
+        task.status, JSON.stringify(task.schedule), time(task.nextAt),
+      ])));
+    paging(root, page, state, navigate);
+  } else if (state.kind === "task") await task(root, state, navigate);
+  else await run(root, state, navigate);
+}
+async function task(root, state, navigate) {
+  const [task, page] = await Promise.all([
+    request("/tasks/" + encodeURIComponent(state.id)),
+    request("/runs?taskId=" + encodeURIComponent(state.id) + "&after=" + state.after),
+  ]);
+  root.append(button("返回任务列表", () => navigate({ kind: "tasks", after: 0 })), element("h2", task.input.name),
+    element("p", task.id + " · 触发计划：" + task.status + " · 下次触发：" + time(task.nextAt)),
+    element("p", "以下操作只影响未来触发，不停止当前运行，也不回滚外部操作。恢复不会补跑；取消后不可恢复未来触发。"));
+  const actions = element("div"); actions.className = "actions";
+  for (const [action, label, enabled] of [
+    ["pause", "暂停未来触发", task.status === "active"],
+    ["resume", "恢复未来触发", task.status === "paused"],
+    ["cancel", "取消未来触发", !["cancelled", "expired"].includes(task.status)],
+  ]) {
+    actions.append(button(label, async () => {
+      if (!confirm(label + "？\n不影响当前运行。恢复不会补跑；取消不可恢复。")) return;
+      await request("/task-update", { id: task.id, action });
+      notice("未来触发已更新；当前运行未被取消。");
+      navigate(state);
+    }, !enabled || task.nextAt === null));
+  }
+  root.append(actions, block("整体目标", task.input.prompt),
+    block("计划、预算与工作空间", { ...task.input, prompt: undefined, nodes: undefined, workspace: task.workspace }),
+    table(["节点", "执行端", "依赖节点"], task.input.nodes.map(node => [node.id, node.executorId, node.dependsOn.join(", ") || "无"])),
+    block("固定 DAG 与执行端快照（只读）", { nodes: task.input.nodes, executors: task.executors }), element("h3", "运行历史"),
+    table(["运行", "状态", "已接受节点", "开始 / 结束", "错误"], page.items.map(run => [
+      button(run.id, () => navigate({ kind: "run", id: run.id })), run.status,
+      run.accepted + " / " + run.total, time(run.createdAt) + " / " + time(run.finishedAt), run.error,
+    ])));
+  paging(root, page, state, navigate);
+}
+async function run(root, state, navigate) {
+  const run = await request("/runs/" + encodeURIComponent(state.id));
+  root.append(button("返回任务", () => navigate({ kind: "task", id: run.taskId, after: 0 })),
+    element("h2", "运行 " + run.id), element("p", run.status + " · " + time(run.createdAt) + " → " + time(run.finishedAt)),
+    element("p", "协议回合结束不等于任务完成；只有明确接受的交付才能解锁依赖。"));
+  if (run.error) root.append(block("运行错误 / 阻塞原因", run.error));
+  if (run.summary) root.append(block("运行摘要", run.summary));
+  root.append(table(["节点", "执行端", "状态", "开始", "错误"], run.nodes.map(node =>
+    [node.definition.id, node.definition.executorId, node.status, time(node.startedAt), node.error])));
+  for (const node of run.nodes) {
+    const details = element("details"); details.dataset.key = node.id;
+    details.append(element("summary", node.definition.id + " · " + node.status),
+      block("节点与会话记录", { definition: node.definition, workspace: node.workspace, inputFiles: node.inputFiles,
+        resultFile: node.resultFile, sessionId: node.sessionId, error: node.error }, node.id + "-metadata"));
+    if (node.result !== null) details.append(block("已接受交付", node.result, node.id + "-result"),
+      block("接受理由", node.acceptance, node.id + "-acceptance"));
+    node.turns.forEach((turn, index) => details.append(block("回合 " + (index + 1) + "（原始材料，不等于交付）", turn, node.id + "-turn-" + index)));
+    root.append(details);
+  }
+  root.append(element("h3", "问题与已有回复（只读）"), element("p", "本页面不回答问题。请通过 MCP 的现有人工回复流程处理。"));
+  if (!run.questions.length) root.append(element("p", "无问题记录。"));
+  for (const question of run.questions) {
+    const card = element("article");
+    card.append(element("h3", question.reply ? "已回复" : "待回答"),
+      element("p", question.question), block("已完成工作", question.completedWork, question.id + "-work"),
+      element("p", "问题 ID：" + question.id + " · 节点：" + (question.nodeId ?? "整体任务")),
+      element("p", "问题期限：" + time(question.expiresAt) + " · 会话期限：" + time(question.sessionExpiresAt)));
+    if (question.reply) card.append(block("已有回复", question.reply.answer, question.id + "-answer"));
+    root.append(card);
+  }
+}

package/dist/web.js

@@ -0,0 +1,117 @@
+import express from "express";
+import { fileURLToPath } from "node:url";
+import { bearerVerifier } from "./http-auth.js";
+import { SettingsError } from "./settings.js";
+import { StorageError } from "./task-storage.js";
+import { taskIdSchema, taskListSchema, taskRunListSchema, taskUpdateSchema } from "./task-contract.js";
+function query(schema, request) {
+    const value = { ...request.query };
+    for (const key of ["after", "limit"]) {
+        if (value[key] === undefined)
+            continue;
+        if (typeof value[key] !== "string" || !/^\d+$/.test(value[key]))
+            throw new Error("Invalid pagination");
+        // Protocol adaptation only; the shared contract owns range checks.
+        value[key] = Number(value[key]);
+    }
+    return schema.parse(value);
+}
+export function createWebRouter(tasks, settings, token, fatal, restart, instanceId) {
+    const router = express.Router(), authorized = bearerVerifier(token);
+    router.use((req, res, next) => {
+        res.set({
+            "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer",
+            "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'",
+            "X-Frame-Options": "DENY",
+        });
+        const origin = new URL("http://127.0.0.1:" + req.socket.localPort).origin;
+        if (req.headers.host !== new URL(origin).host || (req.headers.origin !== undefined && req.headers.origin !== origin)) {
+            res.status(403).end();
+            return;
+        }
+        next();
+    });
+    // Mount authentication with the same router matching rules as the API, including case variants.
+    router.use("/api", (req, res, next) => {
+        const origin = new URL("http://127.0.0.1:" + req.socket.localPort).origin;
+        if (req.headers["sec-fetch-site"] !== undefined && req.headers["sec-fetch-site"] !== "same-origin") {
+            res.status(403).end();
+            return;
+        }
+        if (!authorized(req.headers.authorization)) {
+            res.status(401).set("WWW-Authenticate", "Bearer").end();
+            return;
+        }
+        if (req.method !== "GET" && (req.method !== "POST" || req.headers.origin !== origin)) {
+            res.status(403).end();
+            return;
+        }
+        if (req.method === "POST" && !req.is("application/json")) {
+            res.status(415).end();
+            return;
+        }
+        next();
+    });
+    const assets = new Map(["index.html", "app.js", "api.js", "dom.js", "tasks-view.js", "settings-view.js", "style.css"]
+        .map(name => [name === "index.html" ? "/" : "/" + name, fileURLToPath(new URL("./web/" + name, import.meta.url))]));
+    router.get(["/", ...[...assets.keys()].filter(path => path !== "/")], (req, res) => {
+        res.sendFile(assets.get(req.path), { lastModified: false, cacheControl: false, acceptRanges: false }, error => { if (error && !res.headersSent)
+            res.status(404).end(); });
+    });
+    router.use("/api", express.json({ limit: "512kb" }));
+    const respond = (execute) => (req, res) => {
+        try {
+            res.json({ data: execute(req) });
+        }
+        catch (error) {
+            if (error instanceof StorageError) {
+                fatal(error);
+                res.status(503).json({ error: "Task storage unavailable" });
+            }
+            else if (error instanceof SettingsError) {
+                res.status({ invalid: 400, conflict: 409, unavailable: 503 }[error.code]).json({ error: error.message });
+            }
+            else
+                res.status(400).json({ error: "Request rejected; check inputs and refresh the current state" });
+        }
+    };
+    router.get("/api/status", respond(() => ({ ...tasks.status(), settings: settings.status(), instanceId })));
+    router.get("/api/tasks", respond(req => {
+        const input = query(taskListSchema, req), page = tasks.list(input.after, input.limit);
+        return { ...page, items: page.items.map(task => ({ id: task.id, name: task.input.name, status: task.status, nextAt: task.nextAt, schedule: task.input.schedule })) };
+    }));
+    router.get("/api/tasks/:id", respond(req => tasks.get(taskIdSchema.parse(req.params).id)));
+    router.get("/api/runs", respond(req => {
+        const input = query(taskRunListSchema, req), page = tasks.runs(input.taskId, input.after, input.limit);
+        return { ...page, items: page.items.map(run => ({ id: run.id, taskId: run.taskId, status: run.status,
+                createdAt: run.createdAt, finishedAt: run.finishedAt, error: run.error,
+                accepted: run.nodes.filter(node => node.status === "succeeded").length, total: run.nodes.length })) };
+    }));
+    router.get("/api/runs/:id", respond(req => tasks.run(taskIdSchema.parse(req.params).id)));
+    router.post("/api/task-update", respond(req => tasks.update(taskUpdateSchema.parse(req.body))));
+    router.get("/api/settings", respond(() => settings.get()));
+    router.post("/api/settings/validate", respond(req => {
+        const config = settings.validate(req.body);
+        return { config, affectedTasks: tasks.executorImpact(config.executors) };
+    }));
+    router.post("/api/settings/config", respond(req => settings.saveConfig(req.body)));
+    router.post("/api/settings/credential", respond(req => settings.saveCredential(req.body)));
+    router.post("/api/restart", async (req, res) => {
+        if (!req.body || Array.isArray(req.body) || typeof req.body !== "object" || Object.keys(req.body).length) {
+            res.status(400).json({ error: "Expected an empty request" });
+            return;
+        }
+        try {
+            res.json({ data: await restart() });
+        }
+        catch {
+            res.status(503).json({ error: "Restart could not be confirmed; inspect private logs and use CLI status before retrying" });
+        }
+    });
+    router.use((_req, res) => { res.status(404).end(); });
+    router.use(((error, _req, res, _next) => {
+        res.status(error.status === 413 ? 413 : error.status === 415 ? 415 : 400).json({ error: "Invalid request body" });
+    }));
+    return router;
+}
+//# sourceMappingURL=web.js.map

package/dist/worker.js

@@ -0,0 +1,89 @@
+import { openAcp } from "./acp.js";
+import { z } from "zod";
+import { errorText, executorSchema } from "./model.js";
+const inputSchema = z.object({ executor: executorSchema, inputFiles: z.array(z.string()).max(20), resultsRoot: z.string().min(1) }).strict();
+const controller = new AbortController();
+const pending = new Map();
+let sequence = 0, started = false, busy = false;
+let session;
+let opening, closing;
+function send(value) {
+    return new Promise((resolve, reject) => {
+        if (!process.connected || !process.send) {
+            reject(new Error("Supervisor disconnected"));
+            return;
+        }
+        process.send(value, error => error ? reject(error) : resolve());
+    });
+}
+async function emit(kind, data, text = "") {
+    const seq = ++sequence;
+    const acknowledged = new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { pending.delete(seq); reject(new Error("Progress acknowledgement timed out")); }, 5000);
+        pending.set(seq, { resolve, reject, timer });
+    });
+    void acknowledged.catch(() => { });
+    try {
+        await send({ type: "event", seq, kind, data, text });
+        await acknowledged;
+    }
+    finally {
+        const item = pending.get(seq);
+        if (item)
+            clearTimeout(item.timer);
+        pending.delete(seq);
+    }
+}
+function close() {
+    return closing ??= (async () => {
+        controller.abort(new Error("Execution stopped"));
+        for (const item of pending.values()) {
+            clearTimeout(item.timer);
+            item.reject(new Error("Execution stopped"));
+        }
+        pending.clear();
+        await opening?.catch(() => { });
+        await session?.close();
+        if (process.connected)
+            process.disconnect();
+    })();
+}
+async function fail(error) {
+    await send({ type: "failed", error: errorText(error) }).catch(() => { });
+    await close();
+}
+process.on("disconnect", () => { void close(); });
+process.on("SIGTERM", () => { void close(); });
+process.on("SIGINT", () => { void close(); });
+process.on("message", (message) => {
+    if (message.type === "ack" && message.seq !== undefined)
+        pending.get(message.seq)?.resolve();
+    else if (message.type === "close")
+        void close();
+    else if (message.type === "open" && !started && !closing) {
+        started = true;
+        opening = (async () => {
+            const input = inputSchema.parse(message.input);
+            session = await openAcp(input.executor, controller.signal, emit, input.resultsRoot, input.inputFiles);
+            void session.closed.then(() => { if (!closing)
+                void fail(new Error("ACP process exited")); });
+            if (!controller.signal.aborted)
+                await send({ type: "opened" });
+        })();
+        void opening.catch(error => { void fail(error); });
+    }
+    else if (message.type === "prompt" && session && !closing) {
+        if (busy || typeof message.text !== "string") {
+            void fail(new Error("Invalid or concurrent turn"));
+            return;
+        }
+        busy = true;
+        void session.prompt(message.text).then(async (stopReason) => {
+            // Release admission before the parent can observe completion and send the next turn.
+            busy = false;
+            await send({ type: "turn", stopReason });
+        }).catch(error => { busy = false; return fail(error); });
+    }
+});
+void send({ type: "ready" }).catch(() => { void close(); });
+//# sourceMappingURL=worker.js.map

package/dist/workspace.js

@@ -0,0 +1,16 @@
+import { realpathSync, statSync } from "node:fs";
+import { isAbsolute } from "node:path";
+/** Path validity only; native executor policy owns directory and tool access. */
+export function resolveWorkspace(path) {
+    if (!path || path.includes("\0") || !isAbsolute(path))
+        throw new Error("Workspace must be an absolute directory path");
+    const canonical = realpathSync(path);
+    if (!statSync(canonical).isDirectory())
+        throw new Error("Workspace must be an existing directory");
+    return canonical;
+}
+export function checkWorkspace(path) {
+    if (resolveWorkspace(path) !== path)
+        throw new Error("Workspace path changed since admission");
+}
+//# sourceMappingURL=workspace.js.map