@realqiyan/agent-task 0.0.1-rc.1 → 0.0.1-rc.3

package/dist/main.js

@@ -1,131 +0,0 @@
-import express from "express";
-import { resolve } from "node:path";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { ADMIN_TOKEN_ENV, loadConfig } from "./config.js";
-import { baseEnvironment, readEnvironment } from "./environment.js";
-import { bearerVerifier } from "./http-auth.js";
-import { Settings } from "./settings.js";
-import { createWebRouter } from "./web.js";
-import { acquireLock } from "./lock.js";
-import { createMcpServer } from "./mcp.js";
-import { errorText } from "./model.js";
-import { TaskStore } from "./task-storage.js";
-import { Tasks } from "./tasks.js";
-import { Results } from "./results.js";
-import { openExecution } from "./node-execution.js";
-import { createCoordinator } from "./coordinator.js";
-process.umask(0o077);
-const args = process.argv.slice(2);
-if (args[0] !== "--config" || (args.length !== 2 && !(args.length === 4 && args[2] === "--environment"))) {
-    console.error("Usage: node dist/main.js --config /absolute/path/config.json [--environment /absolute/private/path/environment.json]");
-    process.exit(2);
-}
-const configPath = resolve(args[1]), environmentPath = args[3] ? resolve(args[3]) : undefined;
-const base = baseEnvironment(process.env);
-if (environmentPath) {
-    const environment = readEnvironment(environmentPath);
-    for (const key of Object.keys(process.env))
-        delete process.env[key];
-    Object.assign(process.env, base, environment);
-}
-const config = loadConfig(configPath);
-const token = process.env[config.tokenEnv];
-if (!token || token.length < 32)
-    throw new Error(config.tokenEnv + " must contain a token of at least 32 characters");
-const authorized = bearerVerifier(token), adminToken = process.env[ADMIN_TOKEN_ENV];
-if (adminToken !== undefined && (!environmentPath || !/^[!-~]{32,256}$/.test(adminToken) || adminToken === token)) {
-    throw new Error("Console requires --environment and a distinct administrator token of 32–256 visible ASCII characters");
-}
-let http;
-let tasks, taskStore, settings;
-let release;
-let shutting;
-const connections = new Set();
-function shutdown(code) {
-    process.exitCode = Math.max(process.exitCode ? Number(process.exitCode) : 0, code);
-    return shutting ??= (async () => {
-        settings?.close();
-        try {
-            await tasks?.close();
-        }
-        catch (error) {
-            console.error(errorText(error));
-            process.exitCode = 1;
-        }
-        for (const close of connections)
-            await close().catch(() => { });
-        if (http) {
-            http.closeAllConnections();
-            await new Promise(done => http.close(() => done()));
-        }
-        taskStore?.close();
-        await release?.();
-    })().catch(error => { console.error(errorText(error)); process.exitCode = 1; });
-}
-const fatal = (error) => { console.error(errorText(error)); void shutdown(1); };
-try {
-    release = await acquireLock(config.dataDir);
-    taskStore = new TaskStore(config.dataDir);
-    tasks = new Tasks(taskStore, config.executors, new Results(config.dataDir), openExecution, config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal);
-    const app = express();
-    app.disable("x-powered-by");
-    app.disable("etag");
-    app.use((_req, res, next) => {
-        if (shutting) {
-            res.status(503).end();
-            return;
-        }
-        next();
-    });
-    if (adminToken && environmentPath) {
-        settings = new Settings(configPath, environmentPath, config, base, process.env);
-        app.use("/admin", createWebRouter(tasks, settings, adminToken, fatal));
-    }
-    app.use("/mcp", (req, res, next) => {
-        const suffix = req.socket.localPort === 80 ? "" : ":" + req.socket.localPort;
-        if (req.headers.origin !== undefined || !["127.0.0.1" + suffix, "localhost" + suffix].includes(req.headers.host ?? "")) {
-            res.status(403).end();
-            return;
-        }
-        if (!authorized(req.headers.authorization)) {
-            res.status(401).set("WWW-Authenticate", "Bearer").end();
-            return;
-        }
-        next();
-    }, express.json({ limit: "512kb" }));
-    app.post("/mcp", async (req, res) => {
-        const server = createMcpServer(tasks, fatal);
-        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
-        const close = async () => { connections.delete(close); await transport.close(); await server.close(); };
-        connections.add(close);
-        res.once("close", () => { void close().catch(() => { }); });
-        try {
-            await server.connect(transport);
-            await transport.handleRequest(req, res, req.body);
-        }
-        catch {
-            if (!res.headersSent)
-                res.status(500).json({ error: "MCP request failed" });
-            await close();
-        }
-    });
-    app.all("/mcp", (_req, res) => { res.status(405).set("Allow", "POST").end(); });
-    app.use((_req, res) => { res.status(404).end(); });
-    app.use(((error, _req, res, _next) => {
-        res.status(error.status === 413 ? 413 : 400).json({ error: "Invalid request body" });
-    }));
-    http = await new Promise((done, reject) => {
-        const listening = app.listen(config.port, "127.0.0.1", () => done(listening));
-        listening.once("error", reject);
-    });
-    tasks.start();
-    const address = http.address();
-    const origin = "http://127.0.0.1:" + (typeof address === "object" && address ? address.port : config.port);
-    console.log(JSON.stringify({ event: "ready", url: origin + "/mcp", consoleUrl: settings ? origin + "/admin/" : null }));
-    process.once("SIGINT", () => { void shutdown(0); });
-    process.once("SIGTERM", () => { void shutdown(0); });
-}
-catch (error) {
-    fatal(error);
-}
-//# sourceMappingURL=main.js.map

package/dist/model.js

@@ -1,28 +0,0 @@
-import { z } from "zod";
-export const timestamp = z.string().datetime({ offset: true }).transform(value => new Date(value).toISOString());
-export const identifier = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/);
-export const scheduleSchema = z.discriminatedUnion("type", [
-    z.object({ type: z.literal("now") }).strict(),
-    z.object({ type: z.literal("once"), at: timestamp }).strict(),
-    z.object({ type: z.literal("interval"), startAt: timestamp,
-        seconds: z.number().int().min(60).max(31_536_000) }).strict(),
-]);
-export const executorSchema = z.object({
-    id: identifier,
-    command: z.string().min(1),
-    args: z.array(z.string().max(4096)).max(100).default([]),
-    cwd: z.string().min(1),
-    envKeys: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)).max(50).default([]),
-    permissionAllowlist: z.array(z.string().min(1).max(200)).max(100).default([]),
-    unattendedApproved: z.boolean().default(false),
-    resultReadRoots: z.array(z.string().min(1)).max(50).default([]),
-}).strict();
-export const OUTPUT_LIMIT = 262_144;
-export const EVENT_LIMIT = 2000;
-export const GRACE_MS = 30_000;
-export function iso(now = Date.now()) { return new Date(now).toISOString(); }
-export function errorText(error) { return (error instanceof Error ? error.message : String(error)).slice(0, 2000); }
-export function initialTime(schedule, now) {
-    return schedule.type === "now" ? now : Date.parse(schedule.type === "once" ? schedule.at : schedule.startAt);
-}
-//# sourceMappingURL=model.js.map

package/dist/results.js

@@ -1,85 +0,0 @@
-import { mkdirSync, openSync, closeSync, writeFileSync, readFileSync, fstatSync, fsyncSync, realpathSync, statSync, accessSync, constants } from "node:fs";
-import { join, relative, isAbsolute } from "node:path";
-import { OUTPUT_LIMIT } from "./model.js";
-/** Exact per-run file allowlist intersected with administrator-granted roots. Never offers general filesystem access. */
-export function readInputFile(executor, allowed, path, line = 1, limit) {
-    if (!allowed.includes(path) || realpathSync(path) !== path)
-        throw new Error("Input file is not authorized for this run");
-    if (!executor.resultReadRoots.some(root => {
-        const rel = relative(realpathSync(root), path);
-        return !rel.startsWith("..") && !isAbsolute(rel);
-    }))
-        throw new Error("Input file outside authorized read scope");
-    if (!Number.isInteger(line) || line < 1 || (limit !== undefined && (!Number.isInteger(limit) || limit < 1)))
-        throw new Error("Invalid line range");
-    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const stat = fstatSync(fd);
-        if (!stat.isFile() || stat.size > OUTPUT_LIMIT)
-            throw new Error("Invalid or oversized input file");
-        const content = readFileSync(fd, "utf8");
-        if (Buffer.byteLength(content) > OUTPUT_LIMIT)
-            throw new Error("Input file grew beyond limit");
-        if (line === 1 && limit === undefined)
-            return content;
-        return content.split("\n").slice(line - 1, limit === undefined ? undefined : line - 1 + limit).join("\n");
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-export class Results {
-    root;
-    constructor(directory) {
-        mkdirSync(join(directory, "results"), { recursive: true, mode: 0o700 });
-        this.root = realpathSync(join(directory, "results"));
-    }
-    inside(root, path) {
-        const rel = relative(root, path);
-        return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-    }
-    authorize(executor) {
-        if (!executor.resultReadRoots.some(root => this.inside(realpathSync(root), this.root))) {
-            throw new Error("Executor " + executor.id + " lacks administrator-approved result read scope");
-        }
-    }
-    readable(path, executor) {
-        this.authorize(executor);
-        if (realpathSync(path) !== path || !this.inside(this.root, path) || !statSync(path).isFile())
-            throw new Error("Invalid result file");
-        accessSync(path, constants.R_OK);
-        // Actually open it. Native agent sandbox access remains an administrator-reviewed prerequisite.
-        const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-        closeSync(fd);
-    }
-    save(taskRunId, nodeId, runId, text) {
-        for (const id of [taskRunId, nodeId, runId]) {
-            if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/.test(id))
-                throw new Error("Invalid result identity");
-        }
-        const directory = join(this.root, taskRunId);
-        mkdirSync(directory, { recursive: true, mode: 0o700 });
-        if (realpathSync(directory) !== directory)
-            throw new Error("Result directory must not be a symlink");
-        const path = join(directory, nodeId + "." + runId + ".txt");
-        const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-        try {
-            writeFileSync(fd, text, "utf8");
-            fsyncSync(fd);
-        }
-        finally {
-            closeSync(fd);
-        }
-        for (const dir of [directory, this.root]) {
-            const handle = openSync(dir, constants.O_RDONLY);
-            try {
-                fsyncSync(handle);
-            }
-            finally {
-                closeSync(handle);
-            }
-        }
-        return path;
-    }
-}
-//# sourceMappingURL=results.js.map

package/dist/settings-contract.js

@@ -1,16 +0,0 @@
-import { z } from "zod";
-import { configSchema } from "./config.js";
-export const settingsConfigSchema = z.object({
-    editToken: z.string().uuid(),
-    config: configSchema.pick({ executors: true, coordinator: true }),
-}).strict();
-const credential = {
-    editToken: z.string().uuid(),
-    key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(200),
-};
-export const credentialUpdateSchema = z.discriminatedUnion("action", [
-    z.object({ ...credential, action: z.literal("replace"),
-        value: z.string().min(1).max(16_384).refine(value => Boolean(value.trim()) && !value.includes("\0")) }).strict(),
-    z.object({ ...credential, action: z.literal("delete") }).strict(),
-]);
-//# sourceMappingURL=settings-contract.js.map

package/dist/task-contract.js

@@ -1,37 +0,0 @@
-import { z } from "zod";
-import { isAbsolute } from "node:path";
-import { identifier, scheduleSchema, timestamp } from "./model.js";
-export const nodeSchema = z.object({
-    id: identifier, prompt: z.string().trim().min(1).max(64_000),
-    executorId: identifier.describe("Administrator-registered ACP executor assigned to this node; not a command or URL."),
-    dependsOn: z.array(identifier).max(20).default([]),
-    maxRunSeconds: z.number().int().min(1).max(3600).default(600),
-}).strict();
-export const questionSchema = z.object({
-    nodeId: identifier.optional(), question: z.string().trim().min(1).max(4000),
-    completedWork: z.string().trim().min(1).max(4000),
-}).strict();
-export const replySchema = z.object({
-    runId: z.string().uuid(), questionId: z.string().uuid(), requestKey: identifier,
-    answer: z.string().trim().min(1).max(16000),
-}).strict();
-export const taskIdSchema = z.object({ id: z.string().uuid() }).strict();
-export const taskListSchema = z.object({
-    after: z.number().int().nonnegative().default(0), limit: z.number().int().min(1).max(100).default(20),
-}).strict();
-export const taskRunListSchema = taskListSchema.extend({ taskId: z.string().uuid().optional() });
-export const taskUpdateSchema = z.object({
-    id: z.string().uuid(), action: z.enum(["pause", "resume", "cancel"]),
-}).strict();
-export const taskSchema = z.object({
-    requestKey: identifier, name: z.string().trim().min(1).max(200),
-    prompt: z.string().trim().min(1).max(64_000).describe("Overall goal and coordination constraints; does not generate or replace the DAG."),
-    nodes: z.array(nodeSchema).min(1).max(20).describe("Caller-defined fixed DAG. Each node specifies its prompt, executorId and direct dependencies."),
-    workspace: z.string().min(1).max(4096).refine(path => isAbsolute(path) && !path.includes("\0"), "Workspace must be an absolute path without NUL").optional(),
-    schedule: scheduleSchema, expiresAt: timestamp.optional(),
-    maxRunSeconds: z.number().int().min(1).max(86_400).default(1800),
-    maxSteps: z.number().int().min(1).max(200).default(40),
-    maxNodeTurns: z.number().int().min(1).max(10).default(3),
-    inputWaitSeconds: z.number().int().min(1).max(604800).default(86400),
-}).strict();
-//# sourceMappingURL=task-contract.js.map

package/dist/task-model.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=task-model.js.map