@realqiyan/agent-task 0.0.1-rc.1 → 0.0.1-rc.3

package/dist/configuration/files.js

@@ -0,0 +1,43 @@
+import { join } from "node:path";
+import { z } from "zod";
+import { checkDataDirectory, readPrivateText, replacePrivateText } from "../infrastructure/private-files.js";
+import { resolveWorkspace } from "../infrastructure/workspace.js";
+import { configSchema } from "./contract.js";
+import { parseEnvironment } from "./environment.js";
+import { validateConfig } from "./policy.js";
+export const configurationPaths = { resolveWorkspace, checkDataDirectory };
+export function loadConfig(path) {
+    let value;
+    try {
+        value = JSON.parse(readPrivateText(path));
+    }
+    catch {
+        throw new Error("Cannot read configuration JSON");
+    }
+    return validateConfig(configSchema.parse(value), resolveWorkspace);
+}
+export function readEnvironment(path) { return parseEnvironment(readPrivateText(path)); }
+export class LocalSettingsFiles {
+    configPath;
+    environmentPath;
+    constructor(configPath, environmentPath) {
+        this.configPath = configPath;
+        this.environmentPath = environmentPath;
+        if (configPath === environmentPath)
+            throw new Error("Configuration and environment must be separate files");
+    }
+    read() {
+        const configText = readPrivateText(this.configPath), environmentText = readPrivateText(this.environmentPath);
+        return { configText, environmentText, config: configSchema.parse(JSON.parse(configText)), environment: parseEnvironment(environmentText) };
+    }
+    publish(target, value) {
+        replacePrivateText(target === "config" ? this.configPath : this.environmentPath, JSON.stringify(value, null, 2) + "\n");
+    }
+}
+/** A stable launch locator is the only runtime input outside the selected dataDir. */
+export function startupPaths(home) {
+    const { dataDir } = z.object({ dataDir: z.string() }).strict().parse(JSON.parse(readPrivateText(join(home, "launch.json"))));
+    checkDataDirectory(dataDir);
+    return { dataDir, configPath: join(dataDir, "config.json"), environmentPath: join(dataDir, "environment.json") };
+}
+//# sourceMappingURL=files.js.map

package/dist/configuration/management.js

@@ -0,0 +1,6 @@
+/** Configuration preview and task impact are one management operation for all clients. */
+export function previewSettings(settings, tasks, input) {
+    const preview = settings.preview(input);
+    return { ...preview, affectedTasks: tasks.executorImpact(preview.config.executors) };
+}
+//# sourceMappingURL=management.js.map

package/dist/configuration/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/configuration/policy.js

@@ -0,0 +1,29 @@
+export const ADMIN_TOKEN_ENV = "AGENT_TASK_ADMIN_TOKEN";
+export const baseEnvKeys = ["HOME", "PATH", "LANG", "LC_ALL", "TZ", "TMPDIR", "NODE_OPTIONS", "NODE_PATH", "__proto__", "constructor", "prototype"];
+export function coordinatorCredentialEnv(config) {
+    switch (config.provider) {
+        case "openai": return "OPENAI_API_KEY";
+        case "anthropic": return "ANTHROPIC_API_KEY";
+        case "deepseek": return "DEEPSEEK_API_KEY";
+        case "openai-compatible": return config.apiKeyEnv;
+    }
+}
+export function validateConfig(value, resolveWorkspace) {
+    const config = structuredClone(value);
+    if (!config.dataDir.startsWith("/") || /[\x00-\x1f\x7f]/.test(config.dataDir))
+        throw new Error("dataDir must be absolute without control characters");
+    const coordinatorKey = config.coordinator ? coordinatorCredentialEnv(config.coordinator) : undefined;
+    if (/^(NODE_|LD_|DYLD_)/.test(config.tokenEnv) || [...baseEnvKeys, ADMIN_TOKEN_ENV, "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "DEEPSEEK_API_KEY", coordinatorKey].includes(config.tokenEnv))
+        throw new Error("tokenEnv must be separate from base environment, administrator and model credentials");
+    if (coordinatorKey === ADMIN_TOKEN_ENV)
+        throw new Error("Administrator token must not be used as a model credential");
+    const ids = new Set();
+    for (const executor of config.executors) {
+        if (ids.has(executor.id))
+            throw new Error("Duplicate executor ID");
+        ids.add(executor.id);
+        executor.cwd = resolveWorkspace(executor.cwd);
+    }
+    return config;
+}
+//# sourceMappingURL=policy.js.map

package/dist/configuration/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/{settings.js → configuration/settings.js}

@@ -1,9 +1,9 @@
 import { randomUUID } from "node:crypto";
-import { z } from "zod";
-import { ADMIN_TOKEN_ENV, configSchema, coordinatorCredentialEnv, validateConfig } from "./config.js";
-import { parseEnvironment } from "./environment.js";
-import { FileCommitError, readPrivateText, replacePrivateText } from "./private-files.js";
-import { credentialUpdateSchema, settingsConfigSchema } from "./settings-contract.js";
+import { isDeepStrictEqual } from "node:util";
+import { ADMIN_TOKEN_ENV, coordinatorCredentialEnv, validateConfig } from "./policy.js";
+import { sameExecutor } from "../executors/registry.js";
+import { parseEnvironment, validateServiceEnvironment } from "./environment.js";
+import { FileCommitError } from "../shared/errors.js";
 export class SettingsError extends Error {
     code;
     constructor(code, message) {
@@ -14,27 +14,22 @@ export class SettingsError extends Error {
 const protectedKeys = new Set(["HOME", "PATH", "LANG", "LC_ALL", "TZ", "TMPDIR", "NODE_OPTIONS", "NODE_PATH",
     "PI_ACP_PI_COMMAND", "AGENT_TASK_TOKEN", ADMIN_TOKEN_ENV, "__proto__", "constructor", "prototype"]);
 const modelKeys = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "DEEPSEEK_API_KEY"];
-function parse(schema, value) {
-    const result = schema.safeParse(value);
-    if (!result.success) {
-        // Field paths only: parser diagnostics and rejected values may contain credentials.
-        const fields = result.error.issues.slice(0, 8).map(issue => issue.path.join(".") || "request");
-        throw new SettingsError("invalid", "Invalid fields: " + fields.join(", "));
-    }
-    return result.data;
-}
 function referenced(config) {
-    return new Set([...config.executors.flatMap(executor => executor.envKeys),
-        ...(config.coordinator ? [coordinatorCredentialEnv(config.coordinator)] : [])]);
+    return new Set(config.coordinator ? [coordinatorCredentialEnv(config.coordinator)] : []);
 }
 function editableKey(key, config) {
     return !protectedKeys.has(key) && key !== config.tokenEnv && !/^(NODE_|LD_|DYLD_)/.test(key) &&
         (/(?:_KEY|_TOKEN|_SECRET|_PASSWORD)$/.test(key) || referenced(config).has(key));
 }
+export function configChanges(before, after) {
+    return Object.keys(after).concat(Object.keys(before))
+        .filter((key, index, keys) => keys.indexOf(key) === index && !isDeepStrictEqual(before[key], after[key]))
+        .map(field => ({ field, before: before[field] ?? null, after: after[field] ?? null }));
+}
 /** Disk settings are next-start inputs only. This service never mutates live objects or process.env. */
 export class Settings {
-    configPath;
-    environmentPath;
+    files;
+    paths;
     edits = new Map();
     initial;
     running;
@@ -43,11 +38,9 @@ export class Settings {
     closed = false;
     uncertain = false;
     startedAt = new Date().toISOString();
-    constructor(configPath, environmentPath, running, base, environment) {
-        this.configPath = configPath;
-        this.environmentPath = environmentPath;
-        if (configPath === environmentPath)
-            throw new SettingsError("invalid", "Configuration and environment must be separate files");
+    constructor(files, paths, running, base, environment) {
+        this.files = files;
+        this.paths = paths;
         this.running = structuredClone(running);
         this.base = { ...base };
         this.runningEnvironment = { ...environment };
@@ -57,8 +50,7 @@ export class Settings {
         if (this.closed)
             throw new SettingsError("unavailable", "Configuration management is closed");
         try {
-            const configText = readPrivateText(this.configPath), environmentText = readPrivateText(this.environmentPath);
-            return { configText, environmentText, config: configSchema.parse(JSON.parse(configText)), environment: parseEnvironment(environmentText) };
+            return this.files.read();
         }
         catch {
             throw new SettingsError("unavailable", "Cannot read private configuration files; inspect their format, ownership and permissions offline");
@@ -80,7 +72,7 @@ export class Settings {
         const editToken = randomUUID();
         this.edits.set(editToken, { configText: snapshot.configText, environmentText: snapshot.environmentText, expires: now + 15 * 60_000 });
         const keys = new Set([...modelKeys, ...Object.keys(snapshot.environment), ...referenced(snapshot.config), ...referenced(this.running)]);
-        const credentials = [...keys].filter(key => editableKey(key, snapshot.config)).sort().map(key => ({
+        const credentials = [...keys].filter(key => editableKey(key, snapshot.config) && editableKey(key, this.running) && ![snapshot.environment[snapshot.config.tokenEnv], snapshot.environment[ADMIN_TOKEN_ENV]].includes(snapshot.environment[key])).sort().map(key => ({
             key, saved: Boolean(snapshot.environment[key]), running: Boolean(this.runningEnvironment[key]),
             pendingRestart: snapshot.environment[key] !== this.runningEnvironment[key],
             referenced: referenced(snapshot.config).has(key),
@@ -97,17 +89,23 @@ export class Settings {
         }
         return snapshot;
     }
-    candidate(value) {
-        const input = parse(settingsConfigSchema, value), snapshot = this.editing(input.editToken);
+    candidate(input) {
+        const snapshot = this.editing(input.editToken);
         const environment = { ...this.base, ...snapshot.environment };
         let config;
         try {
-            config = validateConfig({ ...snapshot.config, ...input.config, coordinator: input.config.coordinator }, environment);
+            config = validateConfig(input.config, this.paths.resolveWorkspace);
+            this.paths.checkDataDirectory(config.dataDir);
         }
-        catch (error) {
-            if (error instanceof z.ZodError)
-                throw new SettingsError("invalid", "Invalid configuration fields");
-            throw new SettingsError("invalid", "Local validation failed: check executable paths, dependencies, workspaces, read roots and credential isolation");
+        catch {
+            throw new SettingsError("invalid", "Local validation failed: check data directory, workspaces and credential isolation");
+        }
+        for (const executor of config.executors) {
+            const previous = snapshot.config.executors.find(item => item.id === executor.id);
+            if (executor.unattendedApproved && (!previous?.unattendedApproved || !sameExecutor(previous, executor)) &&
+                !input.approveExecutors.includes(executor.id)) {
+                throw new SettingsError("invalid", "Executor changes require explicit approval of the new configuration: " + executor.id);
+            }
         }
         const previous = snapshot.config.coordinator, next = config.coordinator;
         const endpoint = (model) => model.provider === "openai-compatible" ? model.baseUrl : model.provider;
@@ -118,17 +116,74 @@ export class Settings {
             if (!environment[key])
                 throw new SettingsError("invalid", "A referenced environment value is missing; prepare credentials or native configuration first");
         }
+        const token = environment[config.tokenEnv] ?? environment[snapshot.config.tokenEnv];
+        try {
+            validateServiceEnvironment(config, { ...environment, [config.tokenEnv]: token });
+        }
+        catch {
+            throw new SettingsError("invalid", "Service, administrator and model credentials must be valid and distinct");
+        }
+        if (config.tokenEnv !== snapshot.config.tokenEnv && environment[config.tokenEnv] && environment[config.tokenEnv] !== environment[snapshot.config.tokenEnv]) {
+            throw new SettingsError("invalid", "tokenEnv already contains another value; use a new environment name");
+        }
         return config;
     }
     validate(value) { return this.candidate(value); }
-    saveConfig(value) {
-        const config = this.candidate(value);
-        this.publish(this.configPath, config);
+    preview(input) {
+        const config = this.candidate(input);
+        return { config, changes: configChanges(this.editing(input.editToken).config, config) };
+    }
+    diff() {
+        const saved = this.snapshot().config;
+        return { changes: configChanges(this.running, saved), ...this.status() };
+    }
+    /** Convenience commands create a draft; all publication still uses saveConfig. */
+    prepareChange(value) {
+        const { editToken, change } = value;
+        const config = structuredClone(this.editing(editToken).config), approveExecutors = [];
+        if (change.action === "executor-add") {
+            config.executors.push({ ...change.executor, unattendedApproved: false });
+        }
+        else if (change.action === "coordinator-set")
+            config.coordinator = change.coordinator;
+        else if (change.action === "coordinator-clear")
+            delete config.coordinator;
+        else {
+            const executor = config.executors.find(item => item.id === change.id);
+            if (!executor)
+                throw new SettingsError("invalid", "Executor not found");
+            if (change.action === "executor-remove")
+                config.executors = config.executors.filter(item => item !== executor);
+            else if (change.action === "executor-update") {
+                const updated = { ...executor, ...change.patch };
+                if (!sameExecutor(executor, updated))
+                    updated.unattendedApproved = false;
+                config.executors[config.executors.indexOf(executor)] = updated;
+            }
+            else {
+                executor.unattendedApproved = change.action === "executor-approve";
+                if (executor.unattendedApproved)
+                    approveExecutors.push(executor.id);
+            }
+        }
+        const input = { editToken, config, approveExecutors };
+        return { ...input, config: this.candidate(input) };
+    }
+    saveConfig(input) {
+        const config = this.candidate(input);
+        const snapshot = this.editing(input.editToken);
+        if (config.tokenEnv !== snapshot.config.tokenEnv) {
+            snapshot.environment[config.tokenEnv] = snapshot.environment[snapshot.config.tokenEnv];
+            // Publish an alias first. Either configuration still uses the same service token.
+            this.publish("environment", snapshot.environment);
+        }
+        this.publish("config", config);
         return this.get();
     }
-    saveCredential(value) {
-        const input = parse(credentialUpdateSchema, value), snapshot = this.editing(input.editToken);
-        if (!editableKey(input.key, snapshot.config))
+    saveCredential(input) {
+        const snapshot = this.editing(input.editToken);
+        if (!editableKey(input.key, snapshot.config) || !editableKey(input.key, this.running) ||
+            [snapshot.environment[snapshot.config.tokenEnv], snapshot.environment[ADMIN_TOKEN_ENV]].includes(snapshot.environment[input.key]))
             throw new SettingsError("invalid", "This environment key is not console-managed; new credential names must end in _KEY, _TOKEN, _SECRET or _PASSWORD");
         if (input.action === "delete") {
             if (referenced(snapshot.config).has(input.key))
@@ -144,12 +199,12 @@ export class Settings {
         }
         // Recheck the complete environment format, not only the edited value.
         parseEnvironment(JSON.stringify(snapshot.environment));
-        this.publish(this.environmentPath, snapshot.environment);
+        this.publish("environment", snapshot.environment);
         return this.get();
     }
-    publish(path, value) {
+    publish(target, value) {
         try {
-            replacePrivateText(path, JSON.stringify(value, null, 2) + "\n");
+            this.files.publish(target, value);
         }
         catch (error) {
             if (error instanceof FileCommitError && error.uncertain)

package/dist/executors/environment.js

@@ -0,0 +1,10 @@
+import { ADMIN_TOKEN_ENV, coordinatorCredentialEnv } from "../configuration/policy.js";
+/** Private service inputs never enter workers, even through an alias with the same value. */
+export function executorEnvironment(native, privateValues, config) {
+    const blocked = new Set([...Object.keys(privateValues), config.tokenEnv, ADMIN_TOKEN_ENV,
+        ...(config.coordinator ? [coordinatorCredentialEnv(config.coordinator)] : [])]);
+    const secrets = new Set([...Object.values(privateValues), ...[...blocked].map(key => native[key])].filter(Boolean));
+    return Object.fromEntries(Object.entries(native).filter(([key, value]) => value !== undefined && !blocked.has(key) && !secrets.has(value) &&
+        !/^(AGENT_TASK_|NODE_|LD_|DYLD_)/.test(key) && key !== "PI_ACP_PI_COMMAND"));
+}
+//# sourceMappingURL=environment.js.map

package/dist/executors/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/{permissions.js → executors/permissions.js}

@@ -1,10 +1,9 @@
 /** Applies only to ACP requests that actually ask for approval; this is not a sandbox. */
-export function permissionDecision(request, allowlist, cancelled = false) {
+export function permissionDecision(request, cancelled = false) {
     if (cancelled)
         return { outcome: { outcome: "cancelled" } };
-    const name = request.toolCall.name;
-    const allowed = typeof name === "string" && allowlist.includes(name) && request.toolCall.rawInput != null;
-    const option = request.options.find(value => value.kind === (allowed ? "allow_once" : "reject_once"));
+    // Native authorization must suffice. A new ACP approval would widen it.
+    const option = request.options.find(value => value.kind === "reject_once");
     return option ? { outcome: { outcome: "selected", optionId: option.optionId } } : { outcome: { outcome: "cancelled" } };
 }
 //# sourceMappingURL=permissions.js.map

package/dist/executors/registry.js

@@ -0,0 +1,29 @@
+export function sameExecutor(a, b) {
+    return a.id === b.id && a.type === b.type && a.cwd === b.cwd;
+}
+export function authorizedProfile(snapshot, current) {
+    return Boolean(snapshot?.unattendedApproved && current?.unattendedApproved && sameExecutor(snapshot, current));
+}
+/** Immutable registrations for one service lifetime. Settings apply to the next instance. */
+export class ExecutorRegistry {
+    profiles;
+    constructor(profiles) { this.profiles = structuredClone(profiles); }
+    list() { return { executors: this.profiles.map(profile => ({ ...profile, transport: "stdio" })) }; }
+    snapshot(ids) {
+        const result = Object.create(null);
+        for (const id of ids) {
+            const profile = this.profiles.find(item => item.id === id);
+            if (!profile?.unattendedApproved)
+                throw new Error("Executor not found or not approved: " + id);
+            result[id] = structuredClone(profile);
+        }
+        return result;
+    }
+    authorize(snapshot) {
+        if (!snapshot || !authorizedProfile(snapshot, this.profiles.find(profile => profile.id === snapshot.id))) {
+            throw new Error("Executor authorization revoked or changed");
+        }
+        return structuredClone(snapshot);
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/executors/validation.js

@@ -0,0 +1,10 @@
+import { z } from "zod";
+import { absolutePath, identifier } from "../shared/validation.js";
+export const executorRecord = z.object({
+    id: identifier, type: z.enum(["pi", "codex", "claude", "opencode"]),
+    note: z.string().max(2000), cwd: absolutePath, unattendedApproved: z.boolean(),
+}).strict();
+export const executorSchema = executorRecord.extend({
+    note: executorRecord.shape.note.default(""), unattendedApproved: z.boolean().default(false),
+});
+//# sourceMappingURL=validation.js.map

package/dist/{lock.js → infrastructure/lock.js}

@@ -1,6 +1,22 @@
-import { DatabaseSync } from "node:sqlite";
+import { DatabaseSync } from "./sqlite.js";
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
+/** The stable installation lock prevents two launchers during a directory switch. */
+export function acquireLauncherLock(home) {
+    const db = new DatabaseSync(join(home, "launcher-lock.sqlite"));
+    try {
+        db.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE");
+    }
+    catch {
+        db.close();
+        throw new Error("Another launcher owns this installation");
+    }
+    let released = false;
+    return () => { if (!released) {
+        db.close();
+        released = true;
+    } };
+}
 /** A dedicated SQLite transaction owns an OS lock until close or process death.
  * Local filesystems only. Never unlink this file: that would create a second lock identity.
  */

package/dist/{private-files.js → infrastructure/private-files.js}

@@ -1,6 +1,21 @@
-import { constants, openSync, closeSync, fstatSync, lstatSync, realpathSync, readFileSync, writeFileSync, fsyncSync, renameSync, unlinkSync } from "node:fs";
-import { dirname, basename, join } from "node:path";
+import { FileCommitError } from "../shared/errors.js";
+import { existsSync, constants, openSync, closeSync, fstatSync, lstatSync, realpathSync, readFileSync, writeFileSync, fsyncSync, renameSync, unlinkSync } from "node:fs";
+import { dirname, basename, join, isAbsolute, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
+export function checkDataDirectory(path) {
+    if (!isAbsolute(path) || resolve(path) !== path || /[\x00-\x1f\x7f]/.test(path))
+        throw new Error("Expected a canonical absolute dataDir");
+    let parent = path;
+    while (!existsSync(parent))
+        parent = dirname(parent);
+    if (realpathSync(parent) !== parent || !lstatSync(parent).isDirectory())
+        throw new Error("dataDir must not traverse symlinks");
+    if (parent === path) {
+        const stat = lstatSync(path);
+        if (stat.uid !== process.getuid() || (stat.mode & 0o077))
+            throw new Error("dataDir must be owned and private");
+    }
+}
 function privateDirectory(path) {
     const directory = dirname(path), stat = lstatSync(directory);
     if (realpathSync(directory) !== directory || !stat.isDirectory() || stat.uid !== process.getuid() || (stat.mode & 0o077)) {
@@ -30,13 +45,6 @@ export function readPrivateText(path) {
         closeSync(fd);
     }
 }
-export class FileCommitError extends Error {
-    uncertain;
-    constructor(uncertain) {
-        super(uncertain ? "Configuration publication could not be confirmed; stop and inspect the files" : "Configuration was not published");
-        this.uncertain = uncertain;
-    }
-}
 /** Caller owns the configuration. No await between comparison, validation and publication. */
 export function replacePrivateText(path, text) {
     const temporary = join(dirname(path), "." + basename(path) + "." + randomUUID() + ".tmp");

package/dist/infrastructure/sqlite.js

@@ -0,0 +1,19 @@
+import { createRequire } from "node:module";
+// Node 22 warns on loading SQLite. Suppress only that known notice during the
+// synchronous import, then restore normal warning handling for all other code.
+const emitWarning = process.emitWarning;
+let sqlite;
+try {
+    process.emitWarning = (warning, ...args) => {
+        if (warning === "SQLite is an experimental feature and might change at any time"
+            && args[0] === "ExperimentalWarning")
+            return;
+        Reflect.apply(emitWarning, process, [warning, ...args]);
+    };
+    sqlite = createRequire(import.meta.url)("node:sqlite");
+}
+finally {
+    process.emitWarning = emitWarning;
+}
+export const DatabaseSync = sqlite.DatabaseSync;
+//# sourceMappingURL=sqlite.js.map

package/dist/infrastructure/version.js

@@ -0,0 +1,3 @@
+import { readFileSync } from "node:fs";
+export const version = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+//# sourceMappingURL=version.js.map

package/dist/{acp.js → integrations/acp/connection.js}

@@ -2,10 +2,11 @@ import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
 import { setTimeout as delay } from "node:timers/promises";
 import * as acp from "@agentclientprotocol/sdk";
-import { executorEnv } from "./config.js";
-import { readInputFile } from "./results.js";
-import { permissionDecision } from "./permissions.js";
-import { version } from "./version.js";
+import { executorCommand } from "./runtime.js";
+import { Results } from "../../results/service.js";
+import { LocalResultFiles } from "../../results/files.js";
+import { permissionDecision } from "../../executors/permissions.js";
+import { version } from "../../infrastructure/version.js";
 /** Project only public progress. Queue every piece before yielding so concurrent notifications cannot reorder output. */
 export function progressEvents(update) {
     if (update.sessionUpdate === "agent_message_chunk" && update.content.type === "text") {
@@ -38,7 +39,7 @@ function signalGroup(child, signal) {
         }
     }
 }
-/** Kill the whole group even if its leader already exited; Linux systemd additionally owns a cgroup; macOS does not. */
+/** Kill the whole group even if its leader already exited. */
 export async function terminateGroup(child) {
     signalGroup(child, "SIGTERM");
     await delay(300);
@@ -47,10 +48,12 @@ export async function terminateGroup(child) {
     child.stdout?.destroy();
     child.stderr?.destroy();
 }
-export async function openAcp(executor, signal, emit, inputFiles = []) {
+export async function openAcp(executor, signal, emit, resultsRoot, inputFiles = []) {
     signal.throwIfAborted();
-    const child = spawn(executor.command, executor.args, {
-        cwd: executor.cwd, env: executorEnv(executor.envKeys), detached: true, stdio: ["pipe", "pipe", "pipe"],
+    const results = new Results(new LocalResultFiles(resultsRoot));
+    const launch = executorCommand(executor.type, process.env);
+    const child = spawn(launch.command, launch.args, {
+        cwd: executor.cwd, env: process.env, detached: true, stdio: ["pipe", "pipe", "pipe"],
     });
     const controller = new AbortController();
     const cancel = AbortSignal.any([signal, controller.signal]);
@@ -102,7 +105,7 @@ export async function openAcp(executor, signal, emit, inputFiles = []) {
             cancel.throwIfAborted();
             if (ctx.params.sessionId !== sessionId)
                 throw new Error("Wrong input-file session");
-            return { content: readInputFile(executor, inputFiles, ctx.params.path, ctx.params.line ?? 1, ctx.params.limit ?? undefined) };
+            return { content: results.readInputFile(inputFiles, ctx.params.path, ctx.params.line ?? 1, ctx.params.limit ?? undefined) };
         }
         catch (error) {
             controller.abort(error);
@@ -111,7 +114,7 @@ export async function openAcp(executor, signal, emit, inputFiles = []) {
     })
         .onRequest(acp.methods.client.session.requestPermission, async (ctx) => {
         const request = ctx.params;
-        const response = permissionDecision(request, executor.permissionAllowlist, cancel.aborted || request.sessionId !== sessionId);
+        const response = permissionDecision(request, cancel.aborted || request.sessionId !== sessionId);
         await report("permission", { tool: request.toolCall.name ?? null, outcome: response.outcome });
         return response;
     })
@@ -165,4 +168,4 @@ export async function openAcp(executor, signal, emit, inputFiles = []) {
         throw error;
     }
 }
-//# sourceMappingURL=acp.js.map
+//# sourceMappingURL=connection.js.map

package/dist/{node-execution.js → integrations/acp/execution.js}

@@ -1,10 +1,9 @@
 import { fork } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { executorEnv } from "./config.js";
 /** One supervised worker and ACP session per node, retained across turns. */
-export const openExecution = (input, event, beforeStart) => {
+export const createExecution = (environment) => (input, event, beforeStart) => {
     const worker = fork(fileURLToPath(new URL("./worker.js", import.meta.url)), [], {
-        env: executorEnv(input.executor.envKeys), stdio: ["ignore", "ignore", "pipe", "ipc"], execArgv: [],
+        env: { ...environment }, stdio: ["ignore", "ignore", "pipe", "ipc"], execArgv: [],
     });
     worker.stderr?.resume();
     let stopped = false, exited = false, busy = false;
@@ -100,4 +99,4 @@ export const openExecution = (input, event, beforeStart) => {
         },
     };
 };
-//# sourceMappingURL=node-execution.js.map
+//# sourceMappingURL=execution.js.map

package/dist/integrations/acp/runtime.js

@@ -0,0 +1,28 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+const commands = {
+    pi: { command: "pi-acp", args: [] },
+    codex: { command: "codex-acp", args: [] },
+    claude: { command: "claude-agent-acp", args: [] },
+    opencode: { command: "opencode", args: ["acp"] },
+};
+/** Fixed ACP adapters, resolved in the OS user's native PATH. Never a shell command. */
+export function executorCommand(type, environment) {
+    const find = (name) => {
+        for (const directory of (environment.PATH ?? "").split(delimiter).filter(isAbsolute)) {
+            try {
+                const path = realpathSync(join(directory, name));
+                accessSync(path, constants.X_OK);
+                if (statSync(path).isFile())
+                    return path;
+            }
+            catch { /* Try the next native PATH entry. */ }
+        }
+        throw new Error("Missing ACP dependency on native PATH: " + name);
+    };
+    const entry = commands[type];
+    if (type === "pi")
+        find("pi");
+    return { command: find(entry.command), args: [...entry.args] };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/{worker.js → integrations/acp/worker.js}

@@ -1,7 +1,8 @@
-import { openAcp } from "./acp.js";
+import { openAcp } from "./connection.js";
 import { z } from "zod";
-import { errorText, executorSchema } from "./model.js";
-const inputSchema = z.object({ executor: executorSchema, inputFiles: z.array(z.string()).max(20) }).strict();
+import { errorText } from "../../shared/errors.js";
+import { executorSchema } from "../../executors/validation.js";
+const inputSchema = z.object({ executor: executorSchema, inputFiles: z.array(z.string()).max(20), resultsRoot: z.string().min(1) }).strict();
 const controller = new AbortController();
 const pending = new Map();
 let sequence = 0, started = false, busy = false;
@@ -64,7 +65,7 @@ process.on("message", (message) => {
         started = true;
         opening = (async () => {
             const input = inputSchema.parse(message.input);
-            session = await openAcp(input.executor, controller.signal, emit, input.inputFiles);
+            session = await openAcp(input.executor, controller.signal, emit, input.resultsRoot, input.inputFiles);
             void session.closed.then(() => { if (!closing)
                 void fail(new Error("ACP process exited")); });
             if (!controller.signal.aborted)