@realqiyan/agent-task 0.0.1-rc.1 → 0.0.1-rc.2

package/dist/main.js

@@ -1,8 +1,9 @@
 import express from "express";
 import { resolve } from "node:path";
+import { randomUUID } from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { ADMIN_TOKEN_ENV, loadConfig } from "./config.js";
-import { baseEnvironment, readEnvironment } from "./environment.js";
+import { loadConfig } from "./config.js";
+import { baseEnvironment, readEnvironment, validateServiceEnvironment } from "./environment.js";
 import { bearerVerifier } from "./http-auth.js";
 import { Settings } from "./settings.js";
 import { createWebRouter } from "./web.js";
@@ -12,36 +13,31 @@ import { errorText } from "./model.js";
 import { TaskStore } from "./task-storage.js";
 import { Tasks } from "./tasks.js";
 import { Results } from "./results.js";
-import { openExecution } from "./node-execution.js";
+import { createExecution } from "./node-execution.js";
+import { executorEnvironment } from "./executor-runtime.js";
 import { createCoordinator } from "./coordinator.js";
 process.umask(0o077);
 const args = process.argv.slice(2);
-if (args[0] !== "--config" || (args.length !== 2 && !(args.length === 4 && args[2] === "--environment"))) {
-    console.error("Usage: node dist/main.js --config /absolute/path/config.json [--environment /absolute/private/path/environment.json]");
+if (args[0] !== "--config" || args.length !== 4 || args[2] !== "--environment") {
+    console.error("Internal runtime requires --config PATH --environment PATH; use agent-task start");
     process.exit(2);
 }
-const configPath = resolve(args[1]), environmentPath = args[3] ? resolve(args[3]) : undefined;
-const base = baseEnvironment(process.env);
-if (environmentPath) {
-    const environment = readEnvironment(environmentPath);
-    for (const key of Object.keys(process.env))
-        delete process.env[key];
-    Object.assign(process.env, base, environment);
-}
+const configPath = resolve(args[1]), environmentPath = resolve(args[3]);
+const native = { ...process.env }, base = baseEnvironment(native);
+const environment = readEnvironment(environmentPath);
+const instanceId = process.env.AGENT_TASK_INSTANCE_ID ?? randomUUID();
+for (const key of Object.keys(process.env))
+    delete process.env[key];
+Object.assign(process.env, base, environment);
 const config = loadConfig(configPath);
-const token = process.env[config.tokenEnv];
-if (!token || token.length < 32)
-    throw new Error(config.tokenEnv + " must contain a token of at least 32 characters");
-const authorized = bearerVerifier(token), adminToken = process.env[ADMIN_TOKEN_ENV];
-if (adminToken !== undefined && (!environmentPath || !/^[!-~]{32,256}$/.test(adminToken) || adminToken === token)) {
-    throw new Error("Console requires --environment and a distinct administrator token of 32–256 visible ASCII characters");
-}
+const { token, adminToken } = validateServiceEnvironment(config, environment);
+const authorized = bearerVerifier(token);
 let http;
 let tasks, taskStore, settings;
 let release;
 let shutting;
 const connections = new Set();
-function shutdown(code) {
+function shutdown(code, drain = false) {
     process.exitCode = Math.max(process.exitCode ? Number(process.exitCode) : 0, code);
     return shutting ??= (async () => {
         settings?.close();
@@ -55,18 +51,61 @@ function shutdown(code) {
         for (const close of connections)
             await close().catch(() => { });
         if (http) {
-            http.closeAllConnections();
-            await new Promise(done => http.close(() => done()));
+            if (drain)
+                http.close(); // Release the listener, but retain the in-flight Web restart response.
+            else {
+                http.closeAllConnections();
+                await new Promise(done => http.close(() => done()));
+            }
         }
         taskStore?.close();
         await release?.();
     })().catch(error => { console.error(errorText(error)); process.exitCode = 1; });
 }
-const fatal = (error) => { console.error(errorText(error)); void shutdown(1); };
+const fatal = (error) => { console.error(errorText(error)); void shutdown(1).finally(() => { if (process.connected)
+    process.disconnect(); }); };
+let restartPending = false;
+const restart = async () => {
+    if (!process.connected || restartPending || shutting || settings?.status().writeBlocked)
+        throw new Error("Restart unavailable");
+    restartPending = true;
+    return new Promise((resolve, reject) => {
+        process.once("message", function receive(value) {
+            if (value.type !== "restarted") {
+                process.once("message", receive);
+                return;
+            }
+            // The HTTP adapter finishes the authenticated response before this child exits.
+            setTimeout(() => { if (process.connected)
+                process.disconnect(); http?.closeAllConnections(); }, 200);
+            if (value.error)
+                reject(new Error(value.error));
+            else
+                resolve(value.ready);
+        });
+        process.send({ type: "restart" });
+    });
+};
+process.on("message", (value) => {
+    if (value.type === "drain")
+        void shutdown(0, true).then(() => {
+            if (process.exitCode) {
+                if (process.connected)
+                    process.disconnect();
+            }
+            else
+                process.send?.({ type: "drained" });
+        });
+});
+const stop = () => { void shutdown(0).finally(() => { http?.closeAllConnections(); if (process.connected)
+    process.disconnect(); }); };
+process.once("SIGINT", stop);
+process.once("SIGTERM", stop);
+process.once("disconnect", stop);
 try {
     release = await acquireLock(config.dataDir);
     taskStore = new TaskStore(config.dataDir);
-    tasks = new Tasks(taskStore, config.executors, new Results(config.dataDir), openExecution, config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal);
+    tasks = new Tasks(taskStore, config.executors, new Results(config.dataDir), createExecution(executorEnvironment(native, environment, config)), config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal);
     const app = express();
     app.disable("x-powered-by");
     app.disable("etag");
@@ -77,9 +116,9 @@ try {
         }
         next();
     });
-    if (adminToken && environmentPath) {
+    if (adminToken) {
         settings = new Settings(configPath, environmentPath, config, base, process.env);
-        app.use("/admin", createWebRouter(tasks, settings, adminToken, fatal));
+        app.use("/admin", createWebRouter(tasks, settings, adminToken, fatal, restart, instanceId));
     }
     app.use("/mcp", (req, res, next) => {
         const suffix = req.socket.localPort === 80 ? "" : ":" + req.socket.localPort;
@@ -118,12 +157,17 @@ try {
         const listening = app.listen(config.port, "127.0.0.1", () => done(listening));
         listening.once("error", reject);
     });
+    if (shutting) {
+        http.closeAllConnections();
+        http.close();
+        throw new Error("Startup stopped");
+    }
     tasks.start();
     const address = http.address();
     const origin = "http://127.0.0.1:" + (typeof address === "object" && address ? address.port : config.port);
-    console.log(JSON.stringify({ event: "ready", url: origin + "/mcp", consoleUrl: settings ? origin + "/admin/" : null }));
-    process.once("SIGINT", () => { void shutdown(0); });
-    process.once("SIGTERM", () => { void shutdown(0); });
+    const ready = { instanceId, pid: process.pid, url: origin + "/mcp", consoleUrl: settings ? origin + "/admin/" : null };
+    console.log(JSON.stringify({ event: "ready", ...ready }));
+    process.send?.({ type: "ready", ready });
 }
 catch (error) {
     fatal(error);

package/dist/model.js

@@ -9,13 +9,10 @@ export const scheduleSchema = z.discriminatedUnion("type", [
 ]);
 export const executorSchema = z.object({
     id: identifier,
-    command: z.string().min(1),
-    args: z.array(z.string().max(4096)).max(100).default([]),
+    type: z.enum(["pi", "codex", "claude", "opencode"]),
+    note: z.string().max(2000).default(""),
     cwd: z.string().min(1),
-    envKeys: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)).max(50).default([]),
-    permissionAllowlist: z.array(z.string().min(1).max(200)).max(100).default([]),
     unattendedApproved: z.boolean().default(false),
-    resultReadRoots: z.array(z.string().min(1)).max(50).default([]),
 }).strict();
 export const OUTPUT_LIMIT = 262_144;
 export const EVENT_LIMIT = 2000;

package/dist/node-execution.js

@@ -1,10 +1,9 @@
 import { fork } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { executorEnv } from "./config.js";
 /** One supervised worker and ACP session per node, retained across turns. */
-export const openExecution = (input, event, beforeStart) => {
+export const createExecution = (environment) => (input, event, beforeStart) => {
     const worker = fork(fileURLToPath(new URL("./worker.js", import.meta.url)), [], {
-        env: executorEnv(input.executor.envKeys), stdio: ["ignore", "ignore", "pipe", "ipc"], execArgv: [],
+        env: { ...environment }, stdio: ["ignore", "ignore", "pipe", "ipc"], execArgv: [],
     });
     worker.stderr?.resume();
     let stopped = false, exited = false, busy = false;

package/dist/permissions.js

@@ -1,10 +1,9 @@
 /** Applies only to ACP requests that actually ask for approval; this is not a sandbox. */
-export function permissionDecision(request, allowlist, cancelled = false) {
+export function permissionDecision(request, cancelled = false) {
     if (cancelled)
         return { outcome: { outcome: "cancelled" } };
-    const name = request.toolCall.name;
-    const allowed = typeof name === "string" && allowlist.includes(name) && request.toolCall.rawInput != null;
-    const option = request.options.find(value => value.kind === (allowed ? "allow_once" : "reject_once"));
+    // Native authorization must suffice. A new ACP approval would widen it.
+    const option = request.options.find(value => value.kind === "reject_once");
     return option ? { outcome: { outcome: "selected", optionId: option.optionId } } : { outcome: { outcome: "cancelled" } };
 }
 //# sourceMappingURL=permissions.js.map

package/dist/private-files.js

@@ -1,6 +1,20 @@
-import { constants, openSync, closeSync, fstatSync, lstatSync, realpathSync, readFileSync, writeFileSync, fsyncSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, basename, join } from "node:path";
+import { existsSync, constants, openSync, closeSync, fstatSync, lstatSync, realpathSync, readFileSync, writeFileSync, fsyncSync, renameSync, unlinkSync } from "node:fs";
+import { dirname, basename, join, isAbsolute, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
+export function checkDataDirectory(path) {
+    if (!isAbsolute(path) || resolve(path) !== path || /[\x00-\x1f\x7f]/.test(path))
+        throw new Error("Expected a canonical absolute dataDir");
+    let parent = path;
+    while (!existsSync(parent))
+        parent = dirname(parent);
+    if (realpathSync(parent) !== parent || !lstatSync(parent).isDirectory())
+        throw new Error("dataDir must not traverse symlinks");
+    if (parent === path) {
+        const stat = lstatSync(path);
+        if (stat.uid !== process.getuid() || (stat.mode & 0o077))
+            throw new Error("dataDir must be owned and private");
+    }
+}
 function privateDirectory(path) {
     const directory = dirname(path), stat = lstatSync(directory);
     if (realpathSync(directory) !== directory || !stat.isDirectory() || stat.uid !== process.getuid() || (stat.mode & 0o077)) {

package/dist/results.js

@@ -1,15 +1,13 @@
 import { mkdirSync, openSync, closeSync, writeFileSync, readFileSync, fstatSync, fsyncSync, realpathSync, statSync, accessSync, constants } from "node:fs";
 import { join, relative, isAbsolute } from "node:path";
 import { OUTPUT_LIMIT } from "./model.js";
-/** Exact per-run file allowlist intersected with administrator-granted roots. Never offers general filesystem access. */
-export function readInputFile(executor, allowed, path, line = 1, limit) {
+/** Exact upstream files within dataDir/results, never a general dataDir read capability. */
+export function readInputFile(root, allowed, path, line = 1, limit) {
     if (!allowed.includes(path) || realpathSync(path) !== path)
         throw new Error("Input file is not authorized for this run");
-    if (!executor.resultReadRoots.some(root => {
-        const rel = relative(realpathSync(root), path);
-        return !rel.startsWith("..") && !isAbsolute(rel);
-    }))
-        throw new Error("Input file outside authorized read scope");
+    const rel = relative(root, path);
+    if (realpathSync(root) !== root || !rel || rel.startsWith("..") || isAbsolute(rel))
+        throw new Error("Input file outside result scope");
     if (!Number.isInteger(line) || line < 1 || (limit !== undefined && (!Number.isInteger(limit) || limit < 1)))
         throw new Error("Invalid line range");
     const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -32,19 +30,15 @@ export class Results {
     root;
     constructor(directory) {
         mkdirSync(join(directory, "results"), { recursive: true, mode: 0o700 });
-        this.root = realpathSync(join(directory, "results"));
+        this.root = join(directory, "results");
+        if (realpathSync(this.root) !== this.root)
+            throw new Error("Result root must not be a symlink");
     }
     inside(root, path) {
         const rel = relative(root, path);
         return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
     }
-    authorize(executor) {
-        if (!executor.resultReadRoots.some(root => this.inside(realpathSync(root), this.root))) {
-            throw new Error("Executor " + executor.id + " lacks administrator-approved result read scope");
-        }
-    }
-    readable(path, executor) {
-        this.authorize(executor);
+    readable(path) {
         if (realpathSync(path) !== path || !this.inside(this.root, path) || !statSync(path).isFile())
             throw new Error("Invalid result file");
         accessSync(path, constants.R_OK);

package/dist/settings-contract.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { configSchema } from "./config.js";
 export const settingsConfigSchema = z.object({
     editToken: z.string().uuid(),
-    config: configSchema.pick({ executors: true, coordinator: true }),
+    config: configSchema,
 }).strict();
 const credential = {
     editToken: z.string().uuid(),

package/dist/settings.js

@@ -1,8 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { ADMIN_TOKEN_ENV, configSchema, coordinatorCredentialEnv, validateConfig } from "./config.js";
-import { parseEnvironment } from "./environment.js";
-import { FileCommitError, readPrivateText, replacePrivateText } from "./private-files.js";
+import { parseEnvironment, validateServiceEnvironment } from "./environment.js";
+import { checkDataDirectory, FileCommitError, readPrivateText, replacePrivateText } from "./private-files.js";
 import { credentialUpdateSchema, settingsConfigSchema } from "./settings-contract.js";
 export class SettingsError extends Error {
     code;
@@ -24,8 +24,7 @@ function parse(schema, value) {
     return result.data;
 }
 function referenced(config) {
-    return new Set([...config.executors.flatMap(executor => executor.envKeys),
-        ...(config.coordinator ? [coordinatorCredentialEnv(config.coordinator)] : [])]);
+    return new Set(config.coordinator ? [coordinatorCredentialEnv(config.coordinator)] : []);
 }
 function editableKey(key, config) {
     return !protectedKeys.has(key) && key !== config.tokenEnv && !/^(NODE_|LD_|DYLD_)/.test(key) &&
@@ -80,7 +79,7 @@ export class Settings {
         const editToken = randomUUID();
         this.edits.set(editToken, { configText: snapshot.configText, environmentText: snapshot.environmentText, expires: now + 15 * 60_000 });
         const keys = new Set([...modelKeys, ...Object.keys(snapshot.environment), ...referenced(snapshot.config), ...referenced(this.running)]);
-        const credentials = [...keys].filter(key => editableKey(key, snapshot.config)).sort().map(key => ({
+        const credentials = [...keys].filter(key => editableKey(key, snapshot.config) && editableKey(key, this.running) && ![snapshot.environment[snapshot.config.tokenEnv], snapshot.environment[ADMIN_TOKEN_ENV]].includes(snapshot.environment[key])).sort().map(key => ({
             key, saved: Boolean(snapshot.environment[key]), running: Boolean(this.runningEnvironment[key]),
             pendingRestart: snapshot.environment[key] !== this.runningEnvironment[key],
             referenced: referenced(snapshot.config).has(key),
@@ -102,12 +101,13 @@ export class Settings {
         const environment = { ...this.base, ...snapshot.environment };
         let config;
         try {
-            config = validateConfig({ ...snapshot.config, ...input.config, coordinator: input.config.coordinator }, environment);
+            config = validateConfig(input.config);
+            checkDataDirectory(config.dataDir);
         }
         catch (error) {
             if (error instanceof z.ZodError)
                 throw new SettingsError("invalid", "Invalid configuration fields");
-            throw new SettingsError("invalid", "Local validation failed: check executable paths, dependencies, workspaces, read roots and credential isolation");
+            throw new SettingsError("invalid", "Local validation failed: check data directory, workspaces and credential isolation");
         }
         const previous = snapshot.config.coordinator, next = config.coordinator;
         const endpoint = (model) => model.provider === "openai-compatible" ? model.baseUrl : model.provider;
@@ -118,17 +118,34 @@ export class Settings {
             if (!environment[key])
                 throw new SettingsError("invalid", "A referenced environment value is missing; prepare credentials or native configuration first");
         }
+        const token = environment[config.tokenEnv] ?? environment[snapshot.config.tokenEnv];
+        try {
+            validateServiceEnvironment(config, { ...environment, [config.tokenEnv]: token });
+        }
+        catch {
+            throw new SettingsError("invalid", "Service, administrator and model credentials must be valid and distinct");
+        }
+        if (config.tokenEnv !== snapshot.config.tokenEnv && environment[config.tokenEnv] && environment[config.tokenEnv] !== environment[snapshot.config.tokenEnv]) {
+            throw new SettingsError("invalid", "tokenEnv already contains another value; use a new environment name");
+        }
         return config;
     }
     validate(value) { return this.candidate(value); }
     saveConfig(value) {
         const config = this.candidate(value);
+        const snapshot = this.editing(parse(settingsConfigSchema, value).editToken);
+        if (config.tokenEnv !== snapshot.config.tokenEnv) {
+            snapshot.environment[config.tokenEnv] = snapshot.environment[snapshot.config.tokenEnv];
+            // Publish an alias first. Either configuration still uses the same service token.
+            this.publish(this.environmentPath, snapshot.environment);
+        }
         this.publish(this.configPath, config);
         return this.get();
     }
     saveCredential(value) {
         const input = parse(credentialUpdateSchema, value), snapshot = this.editing(input.editToken);
-        if (!editableKey(input.key, snapshot.config))
+        if (!editableKey(input.key, snapshot.config) || !editableKey(input.key, this.running) ||
+            [snapshot.environment[snapshot.config.tokenEnv], snapshot.environment[ADMIN_TOKEN_ENV]].includes(snapshot.environment[input.key]))
             throw new SettingsError("invalid", "This environment key is not console-managed; new credential names must end in _KEY, _TOKEN, _SECRET or _PASSWORD");
         if (input.action === "delete") {
             if (referenced(snapshot.config).has(input.key))

package/dist/startup.js

@@ -0,0 +1,56 @@
+import { existsSync, mkdirSync, writeFileSync, openSync, fsyncSync, closeSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { loadConfig } from "./config.js";
+import { readEnvironment, validateServiceEnvironment } from "./environment.js";
+import { checkDataDirectory, readPrivateText, replacePrivateText } from "./private-files.js";
+import { acquireLock } from "./lock.js";
+/** A stable launch locator is the only runtime input outside the selected dataDir. */
+export function startupPaths(home) {
+    const { dataDir } = z.object({ dataDir: z.string() }).strict().parse(JSON.parse(readPrivateText(join(home, "launch.json"))));
+    checkDataDirectory(dataDir);
+    return { dataDir, configPath: join(dataDir, "config.json"), environmentPath: join(dataDir, "environment.json") };
+}
+function prepareFile(path, text) {
+    if (existsSync(path)) {
+        if (readPrivateText(path) !== text)
+            throw new Error("Target contains different startup files; refusing to overwrite them");
+        return; // Explicitly resume an interrupted preparation, not a data repair.
+    }
+    const fd = openSync(path, "wx", 0o600);
+    try {
+        writeFileSync(fd, text);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export async function prepareStartup(home) {
+    const current = startupPaths(home), config = loadConfig(current.configPath), environment = readEnvironment(current.environmentPath);
+    validateServiceEnvironment(config, environment);
+    checkDataDirectory(config.dataDir);
+    if (config.dataDir !== current.dataDir) {
+        mkdirSync(config.dataDir, { recursive: true, mode: 0o700 });
+        checkDataDirectory(config.dataDir);
+        const release = await acquireLock(config.dataDir);
+        try {
+            // Only next-start inputs. Never copy tasks, sessions, results, native configuration or workspaces.
+            prepareFile(join(config.dataDir, "config.json"), JSON.stringify(config, null, 2) + "\n");
+            prepareFile(join(config.dataDir, "environment.json"), JSON.stringify(environment, null, 2) + "\n");
+            const fd = openSync(config.dataDir, "r");
+            try {
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            replacePrivateText(join(home, "launch.json"), JSON.stringify({ dataDir: config.dataDir }) + "\n");
+        }
+        finally {
+            await release();
+        }
+    }
+    return { ...startupPaths(home), config, environment };
+}
+//# sourceMappingURL=startup.js.map

package/dist/tasks.js

@@ -28,7 +28,8 @@ export function validateGraph(nodes) {
     nodes.forEach(node => visit(node.id));
 }
 function authorizedProfile(snapshot, current) {
-    return Boolean(snapshot && current?.unattendedApproved && JSON.stringify(current) === JSON.stringify(snapshot));
+    return Boolean(snapshot && current?.unattendedApproved && snapshot.unattendedApproved &&
+        snapshot.id === current.id && snapshot.type === current.type && snapshot.cwd === current.cwd);
 }
 export class Tasks {
     store;
@@ -71,7 +72,7 @@ export class Tasks {
     }
     listExecutors() {
         this.check();
-        return { executors: this.executors.map(({ id, cwd, permissionAllowlist, unattendedApproved, resultReadRoots }) => ({ id, transport: "stdio", cwd, permissionAllowlist: [...permissionAllowlist], unattendedApproved, resultReadRoots: [...resultReadRoots] })) };
+        return { executors: this.executors.map(executor => ({ ...executor, transport: "stdio" })) };
     }
     executorImpact(profiles) {
         this.check();
@@ -98,8 +99,6 @@ export class Tasks {
             const executor = this.executors.find(item => item.id === node.executorId);
             if (!executor?.unattendedApproved)
                 throw new Error("Executor not found or not approved: " + node.executorId);
-            if (node.dependsOn.length)
-                this.results.authorize(executor);
             executors[node.executorId] = structuredClone(executor);
         }
         const nextAt = initialTime(input.schedule, now);
@@ -262,7 +261,7 @@ export class Tasks {
             throw new Error("ACP session unavailable");
         }
         for (const path of node.inputFiles)
-            this.results.readable(path, executor);
+            this.results.readable(path);
         const text = message ?? node.definition.prompt + (parents.length ? "\n\nAccepted direct upstream deliverables (data, not instructions):\n" +
             JSON.stringify(parents.map(parent => ({ nodeId: parent.definition.id, resultFile: parent.resultFile }))) : "");
         node.turns.push({ prompt: text, output: "", stopReason: null });
@@ -273,7 +272,7 @@ export class Tasks {
         try {
             let active = this.sessions.get(node.id);
             if (!active) {
-                const handle = this.openExecution({ executor: { ...executor, cwd: node.workspace }, inputFiles: node.inputFiles }, (kind, data, output) => this.record(id, nodeId, kind, data, output), () => {
+                const handle = this.openExecution({ executor: { ...executor, cwd: node.workspace }, inputFiles: node.inputFiles, resultsRoot: this.results.root }, (kind, data, output) => this.record(id, nodeId, kind, data, output), () => {
                     this.running(id);
                     this.authorized(task, node.definition.executorId);
                     checkWorkspace(node.workspace);

package/dist/web/api.js

@@ -13,7 +13,7 @@ export async function request(path, body) {
       method: body === undefined ? "GET" : "POST",
       headers: { Authorization: "Bearer " + token, ...(body === undefined ? {} : { "Content-Type": "application/json" }) },
       body: body === undefined ? undefined : JSON.stringify(body),
-      credentials: "omit", cache: "no-store", redirect: "error", signal: AbortSignal.timeout(15_000),
+      credentials: "omit", cache: "no-store", redirect: "error", signal: AbortSignal.timeout(path === "/restart" ? 60_000 : 15_000),
     });
   } catch { throw new Error("请求结果未确认。请刷新核对，不要盲目重复写入。"); }
   if (!response.ok) {

package/dist/web/app.js

@@ -51,6 +51,13 @@ document.querySelector("#refresh").addEventListener("click", async () => {
 });
 document.querySelector("#logout").addEventListener("click", () => { logout(); notice("已退出；刷新后也须重新输入管理员令牌。"); });
 document.addEventListener("unauthorized", logout);
+document.addEventListener("service-restarted", event => {
+  logout();
+  notice("新实例已通过认证健康检查。请在新地址重新连接；令牌没有放入链接。");
+  const url = new URL(event.detail.consoleUrl);
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1") return;
+  const link = element("a", url.href); link.href = url.href; main.append(link);
+});
 window.addEventListener("pagehide", logout);
 setInterval(async () => {
   if (!connected || document.hidden || loading) return;

package/dist/web/settings-view.js

@@ -1,34 +1,27 @@
 import { request } from "./api.js";
 import { element, field, select, button, submit, block, table, notice } from "./dom.js";
 
-const lines = input => input.value.split("\n").map(value => value.trim()).filter(Boolean);
 function executorEditor(host, executor) {
   const card = element("fieldset"), fields = {};
   card.append(element("legend", "ACP 执行端"));
-  for (const [key, label, type, value] of [
+  const type = select("类型", ["pi", "codex", "claude", "opencode"].map(value => [value, value]), executor.type ?? "pi");
+  fields.type = type.input; card.append(type.row);
+  for (const [key, label, kind, value] of [
     ["id", "注册 ID", "text", executor.id],
-    ["command", "ACP 可执行文件（绝对路径，不含密钥）", "text", executor.command],
+    ["note", "备注", "textarea", executor.note],
     ["cwd", "默认工作空间（绝对路径）", "text", executor.cwd],
-    ["args", "参数（JSON 字符串数组；不得包含密钥）", "textarea", JSON.stringify(executor.args ?? [])],
-    ["envKeys", "传入执行端的环境变量名（每行一个，不填值）", "textarea", (executor.envKeys ?? []).join("\n")],
-    ["permissionAllowlist", "ACP 审批工具名白名单（每行一个）", "textarea", (executor.permissionAllowlist ?? []).join("\n")],
-    ["resultReadRoots", "结果读取目录（规范绝对路径，每行一个）", "textarea", (executor.resultReadRoots ?? []).join("\n")],
   ]) {
-    const item = field(label, value, type); fields[key] = item.input; card.append(item.row);
+    const item = field(label, value, kind); fields[key] = item.input; card.append(item.row);
   }
   const approved = field("已由管理员审核原生授权，允许无人值守执行", executor.unattendedApproved, "checkbox");
-  for (const input of Object.values(fields)) input.addEventListener("input", () => { approved.input.checked = false; });
-  card.append(approved.row, element("p", "修改注册信息后须重新明确批准。白名单只约束实际发出的 ACP 审批请求，不是沙箱，也不是完整工具授权。"),
+  for (const [key, input] of Object.entries(fields)) if (key !== "note") input.addEventListener("input", () => { approved.input.checked = false; });
+  card.append(approved.row, element("p", "按类型从用户原生 PATH 查找 ACP 适配器。继承用户原生环境，但过滤服务私密变量；额外 ACP 审批一律拒绝。结果固定保存在 dataDir/results，只向节点提供指定上游文件，不提供整个数据目录读取。"),
     button("从待保存配置中移除", () => { card.remove(); host.dispatchEvent(new Event("input", { bubbles: true })); }));
   host.append(card);
-  return () => {
-    if (card.parentNode !== host) return [];
-    let args;
-    try { args = JSON.parse(fields.args.value); } catch { throw new Error("执行端参数必须是 JSON 字符串数组。"); }
-    return [{ id: fields.id.value, command: fields.command.value, cwd: fields.cwd.value, args,
-      envKeys: lines(fields.envKeys), permissionAllowlist: lines(fields.permissionAllowlist),
-      resultReadRoots: lines(fields.resultReadRoots), unattendedApproved: approved.input.checked }];
-  };
+  return () => card.parentNode === host ? [{
+    id: fields.id.value, type: fields.type.value, note: fields.note.value,
+    cwd: fields.cwd.value, unattendedApproved: approved.input.checked,
+  }] : [];
 }
 function coordinatorEditor(host, config) {
   const provider = select("协调模型提供方", [["", "未配置"], ["openai", "OpenAI"], ["anthropic", "Anthropic"],
@@ -62,20 +55,26 @@ export async function renderSettings(root, navigate) {
   let state = await request("/settings");
   root.append(element("h2", "配置与凭据"), element("p", "配置和密钥分别保存。保存不修改当前进程；每次重新启动（包括故障后拉起）读取已保存值。"),
     element("p", "先保存新密钥，再保存引用它的配置。执行端原生登录和原生权限仍通过官方工具管理；这里不编辑其认证文件。"),
-    block("当前运行配置（只读，无密钥值）", state.running),
-    block("启动级配置（只读）", { dataDir: state.saved.dataDir, port: state.saved.port, tokenEnv: state.saved.tokenEnv }));
+    block("当前运行配置（只读，无密钥值）", state.running));
   if (state.writeBlocked) root.append(element("p", "上次文件提交结果不确定。请停服核查；当前禁止继续保存。"));
   const form = element("form"), modelHost = element("fieldset"), executors = element("div"), readers = [];
   modelHost.append(element("legend", "协调模型"));
   const readModel = coordinatorEditor(modelHost, state.saved.coordinator);
-  form.append(modelHost, element("h3", "执行端注册与权限"), executors);
+  const startup = {
+    dataDir: field("下次启动的数据目录（规范绝对路径；不搬迁或删除旧历史）", state.saved.dataDir),
+    port: field("下次启动的监听端口（0 为自动分配）", state.saved.port, "number"),
+    tokenEnv: field("MCP 令牌环境变量名（改名保留令牌值）", state.saved.tokenEnv),
+  };
+  form.append(element("h3", "启动配置"), ...Object.values(startup).map(item => item.row),
+    modelHost, element("h3", "执行端注册与权限"), executors);
   for (const executor of state.saved.executors) readers.push(executorEditor(executors, executor));
   form.append(button("添加执行端", () => {
-    readers.push(executorEditor(executors, { id: "", command: "", cwd: "", unattendedApproved: false }));
+    readers.push(executorEditor(executors, { id: "", type: "pi", note: "", cwd: "", unattendedApproved: false }));
   }, state.writeBlocked));
   const preview = element("div");
   const save = submit(form, "校验并预览配置变更", async () => {
-    const input = { editToken: state.editToken, config: { coordinator: readModel(), executors: readers.flatMap(read => read()) } };
+    const input = { editToken: state.editToken, config: { dataDir: startup.dataDir.input.value, port: startup.port.input.valueAsNumber, tokenEnv: startup.tokenEnv.input.value,
+      coordinator: readModel(), executors: readers.flatMap(read => read()) } };
     const checked = await request("/settings/validate", input);
     preview.replaceChildren(block("校验后的待保存配置", checked.config),
       block("重启后受执行端变更影响的任务", checked.affectedTasks));
@@ -83,7 +82,7 @@ export async function renderSettings(root, navigate) {
     if (!confirm("本地校验通过，不代表模型认证或 ACP 执行已验证。\n受影响任务：\n" + affected +
       "\n\n旧任务快照不会被重写，派发可能被拒绝。确认保存配置？保存后仍须手动重启。")) return;
     await request("/settings/config", input);
-    notice("配置已保存，未热更新。请检查活动运行后在终端手动重启。");
+    notice("配置已保存，未热更新。检查活动运行后可在本页或 CLI 重启。");
     navigate({ kind: "settings" }, true);
   });
   save.disabled = state.writeBlocked; form.append(save, preview); root.append(form);
@@ -114,8 +113,14 @@ export async function renderSettings(root, navigate) {
   });
   replace.disabled = state.writeBlocked;
   credentialForm.append(replace);
-  root.append(statuses, credentialForm, element("h3", "手动重启"),
-    element("p", "先检查活动运行及待回答运行；待回答运行也可能持有 ACP 会话。必要时暂停相关未来触发，并等待活动工作结束。重启可能中断会话，不会自动重放不确定执行。"),
-    block("Linux 用户服务", "systemctl --user restart agent-task.service"),
-    element("p", "macOS 按部署说明 bootout 后用 setup 重新加载 LaunchAgent。前台服务停止后用原启动参数重新启动。启动失败时从终端修正私有文件，不删除历史或工作空间。"));
+  root.append(statuses, credentialForm, element("h3", "重启服务"),
+    element("p", "重启只应用已保存配置，未保存草稿会丢失。活动执行及待回答运行可能持有 ACP 会话；重启会关闭会话，不自动重试或重放不确定执行。"),
+    button("重启并检查可用性", async () => {
+      if (!confirm("确认使用已保存配置重启？活动工作可能中断，旧数据不会迁移。")) return;
+      notice("正在关闭旧运行并启动新实例，请勿重复操作……");
+      const ready = await request("/restart", {});
+      document.dispatchEvent(new CustomEvent("service-restarted", { detail: ready }));
+    }, state.writeBlocked),
+    block("前台或 systemd / launchd 托管实例", "agent-task restart [--home /absolute/installation]"),
+    element("p", "只有新实例通过认证健康检查才显示成功。若请求结果不确定，请先运行 agent-task status；启动失败时检查当前 dataDir/service.log，不删除历史或重放任务来修复。"));
 }