@realqiyan/agent-task 0.0.1-rc.2 → 0.0.1-rc.3

package/README.md

@@ -8,8 +8,9 @@
 
 | 目的 | 入口 |
 | --- | --- |
-| 安装、认证、后台运行、卸载 | [部署说明](docs/deployment.md) |
+| 安装、配置、运行 | [部署说明](docs/deployment.md) |
 | 本机控制台、配置保存与 Web/CLI 重启 | [控制台说明](docs/web-console.md) |
+| 命令行配置、凭据和任务管理 | [CLI 说明](docs/cli.md) |
 | 理解产品目标和架构选择 | [总体方案](docs/design-proposal.md) |
 | 查找实现与对应测试 | [代码导航](docs/technical-design.md) |
 | 查询测试命令、真实验收及缺口 | [验证说明](docs/validation.md) |
@@ -32,7 +33,7 @@ agent-task status
 agent-task restart
 ```
 
-npm 包名为 `@realqiyan/agent-task`，安装后的命令仍为 `agent-task`。setup 提供交互配置；启动后可使用本机 Web 控制台。先停止前台实例，再用 `agent-task service install` 安装并启动用户后台服务。安装器不会替用户登录或批准执行端；详细操作见[部署说明](docs/deployment.md)。
+npm 包名为 `@realqiyan/agent-task`，安装后的命令仍为 `agent-task`。setup 提供交互配置；启动后可使用本机 Web 控制台或 [CLI](docs/cli.md)，两端共用管理服务。安装器不会替用户登录或批准执行端；详细操作见[部署说明](docs/deployment.md)。
 
 MCP 客户端使用独立服务 token。源码开发辅助命令（凭据须安全注入环境，不写命令行）：
 
@@ -41,7 +42,7 @@ node scripts/mcp-call.mjs --list
 node scripts/mcp-call.mjs service_status
 ```
 
-任务由 `task_create` 提交固定 DAG，每个节点选择已注册执行端。具体契约见 [task-contract.ts](src/task-contract.ts)，管理工具见 [mcp.ts](src/mcp.ts)。Prompt、人工回复和工作空间选择都不授予工具权限。
+任务由 `task_create` 提交固定 DAG，每个节点选择已注册执行端。具体契约见 [task-contract.ts](src/protocol/task-contract.ts)，管理工具见 [mcp.ts](src/protocol/mcp.ts)。Prompt、人工回复和工作空间选择都不授予工具权限。
 
 ## 许可证
 

package/bin/agent-task.mjs

@@ -4,16 +4,17 @@ import { readFileSync } from "node:fs";
 const help = `Usage: agent-task <command>
   setup [options]           Interactive configuration (setup --help for flags)
   start [--home PATH]        Foreground service using the private installation
-  restart [--home PATH]      Restart foreground or managed runtime; verify readiness
-  status [--home PATH]       Authenticated MCP health check; no token printed
-  service install [--home PATH]
-                            Install/start systemd user service or LaunchAgent
-  service remove [--home PATH]
-                            Stop/remove only the owned service
-  uninstall [--home PATH]    Remove service and owned executor components;
-                            preserve configuration, credentials and task data
+  restart [--home PATH]      Restart runtime; verify readiness
+  status [--home PATH]       Health, active work and pending configuration
+  config                    Show, edit, validate and apply configuration
+  executor                  Manage registrations and unattended authorization
+  coordinator               Configure the coordination model
+  credential                List, replace or delete private credentials
+  task                      Inspect tasks and control future triggers
+  run                       Inspect run history and deliveries
+  <command> --help           Command usage; management supports --json
   --version | --help
-Node.js 22.19+; Linux or macOS. Setup never grants executor permissions.`;
+Node.js 22.19+; Linux or macOS.`;
 try {
   const [major, minor] = process.versions.node.split(".").map(Number);
   if (major < 22 || (major === 22 && minor < 19)) throw new Error("Node.js 22.19+ is required");
@@ -22,40 +23,26 @@ try {
     console.log(help);
   } else if (command === "--version") {
     console.log(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version);
-  } else if (command === "setup" || command === "uninstall") {
+  } else if (command === "setup") {
     process.argv = [process.execPath, command, ...args];
     await import(`../scripts/${command}.mjs`);
   } else {
     const lib = await import("../scripts/install-lib.mjs");
-    const action = command === "service" ? args.shift() : undefined;
-    if (!["start", "status", "restart", "service"].includes(command) || (command === "service" && !["install", "remove"].includes(action))) throw new Error(help);
-    const options = lib.argumentsFor(args);
-    if (Object.keys(options).some(key => key !== "home")) throw new Error("Only --home is accepted here");
-    const root = lib.installRoot(options);
-    if (action === "install") {
-      process.argv = [process.execPath, "setup", "--home", root, "--service"];
-      await import("../scripts/setup.mjs");
-    } else if (action === "remove") {
-      lib.readManifest(root);
-      const unlock = lib.operationLock(root);
-      try {
-        const manifest = lib.readManifest(root);
-        await lib.deactivate(manifest);
-        manifest.serviceInstalled = false;
-        lib.saveManifest(root, manifest);
-        console.log("Owned service removed; configuration, credentials, components and data preserved.");
-      } finally { unlock(); }
-    } else if (command === "start") {
-      if (lib.readManifest(root).serviceInstalled) throw new Error("Remove the managed service before starting a foreground instance");
-      process.argv = [process.execPath, "service-runner", root];
-      await import("../scripts/service-runner.mjs");
+    if (command === "start") {
+      if (args.includes("--help")) { console.log("Usage: agent-task start [--home ABSOLUTE_DIR]"); }
+      else {
+        const options = lib.argumentsFor(args);
+        if (Object.keys(options).some(key => key !== "home")) throw new Error("Only --home is accepted here");
+        const root = lib.installRoot(options);
+        process.argv = [process.execPath, "service-runner", root];
+        await import("../scripts/service-runner.mjs");
+      }
     } else {
-      const { controlService } = await import("../dist/launcher.js");
-      const ready = await controlService(root, command);
-      console.log(JSON.stringify({ event: command === "restart" ? "restarted" : "healthy", ...ready }));
+      const { runCli } = await import("../dist/protocol/cli/commands.js");
+      await runCli(command, args, home => lib.installRoot({ home }));
     }
   }
 } catch (error) {
-  console.error(error.message);
+  console.error(process.argv.includes("--json") ? JSON.stringify({ error: error.message }) : error.message);
   process.exitCode = 1;
 }

package/dist/{launcher.js → application/launcher.js}

@@ -1,13 +1,12 @@
 import { fork } from "node:child_process";
-import { createServer, request } from "node:http";
+import { createServer } from "node:http";
 import { appendFileSync, chmodSync, closeSync, constants, existsSync, fstatSync, lstatSync, openSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
-import { acquireLauncherLock } from "./lock.js";
-import { prepareStartup, startupPaths } from "./startup.js";
-import { readEnvironment } from "./environment.js";
-import { loadConfig } from "./config.js";
+import { acquireLauncherLock } from "../infrastructure/lock.js";
+import { prepareStartup } from "./startup.js";
+import { startupPaths } from "../configuration/files.js";
 function message(child, type, timeout = 30_000) {
     return new Promise((resolve, reject) => {
         const cleanup = () => { clearTimeout(timer); child.off("message", receive); child.off("exit", exit); child.off("error", fail); };
@@ -144,7 +143,7 @@ export async function launch(home, nativeEnvironment) {
             const value = (await message(child, "ready")).ready;
             await health(value, inputs.environment[inputs.config.tokenEnv]);
             current = child;
-            ready = value;
+            ready = { info: value, token: inputs.environment[inputs.config.tokenEnv] };
             return value;
         }
         catch (error) {
@@ -155,28 +154,35 @@ export async function launch(home, nativeEnvironment) {
     const status = async () => {
         if (!ready || restarting || closing)
             throw new Error("Service unavailable");
-        const paths = startupPaths(home), config = loadConfig(paths.configPath), env = readEnvironment(paths.environmentPath);
-        await health(ready, env[config.tokenEnv]);
-        return ready;
+        // Saved inputs may need repair. Health belongs to the running instance,
+        // including the credential with which that instance actually started.
+        const running = ready;
+        await health(running.info, running.token);
+        return running.info;
     };
     const restart = async (requester) => {
         if (restarting || closing)
             throw new Error("Restart already in progress or closed");
         restarting = true;
         const old = current;
-        current = undefined;
-        ready = undefined;
         try {
             if (old) {
                 const drained = message(old, "drained");
                 old.send({ type: "drain" });
+                let result;
                 try {
-                    await drained;
+                    result = await drained;
                 }
                 catch (error) {
+                    current = undefined;
+                    ready = undefined;
                     await stop(old);
                     throw error;
                 }
+                if (result.error)
+                    throw new Error(result.error);
+                current = undefined;
+                ready = undefined;
                 // Keep only the authenticated Web response alive until the new process is verified.
                 if (old !== requester)
                     await stop(old);
@@ -186,7 +192,7 @@ export async function launch(home, nativeEnvironment) {
         }
         finally {
             restarting = false;
-            if (requester) {
+            if (requester && requester !== current) {
                 const timer = setTimeout(() => { void stop(requester); }, 5000);
                 requester.once("close", () => clearTimeout(timer));
             }
@@ -206,33 +212,4 @@ export async function launch(home, nativeEnvironment) {
         process.off("SIGTERM", signal);
     }
 }
-/** Local administrator capability: the socket lives in the private launcher directory. */
-export function controlService(home, action) {
-    startupPaths(home);
-    return new Promise((resolve, reject) => {
-        let timedOut = false;
-        const req = request({ socketPath: join(home, "control.sock"), path: "/" + action, method: "POST" }, res => {
-            let body = "";
-            res.setEncoding("utf8");
-            res.on("data", chunk => { body += chunk; });
-            res.on("end", () => {
-                if (res.statusCode !== 200) {
-                    reject(new Error("Service unavailable; inspect private logs and startup files"));
-                    return;
-                }
-                try {
-                    resolve(JSON.parse(body));
-                }
-                catch {
-                    reject(new Error("Invalid launcher response"));
-                }
-            });
-        });
-        req.setTimeout(60_000, () => { timedOut = true; req.destroy(); });
-        req.once("error", () => reject(new Error(timedOut
-            ? "Service control timed out; outcome is unknown, check status before another restart"
-            : "Cannot contact launcher; start the foreground or managed service first")));
-        req.end();
-    });
-}
 //# sourceMappingURL=launcher.js.map

package/dist/application/main.js

@@ -0,0 +1,122 @@
+import { HttpServer } from "../protocol/http/server.js";
+import { createTaskRuntime } from "./task-runtime.js";
+import { LocalSettingsFiles, configurationPaths } from "../configuration/files.js";
+import { resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { loadConfig } from "../configuration/files.js";
+import { baseEnvironment, validateServiceEnvironment } from "../configuration/environment.js";
+import { readEnvironment } from "../configuration/files.js";
+import { Settings } from "../configuration/settings.js";
+import { acquireLock } from "../infrastructure/lock.js";
+import { errorText } from "../shared/errors.js";
+import { createExecution } from "../integrations/acp/execution.js";
+import { executorEnvironment } from "../executors/environment.js";
+import { createCoordinator } from "../integrations/coordinator/coordinator.js";
+process.umask(0o077);
+const args = process.argv.slice(2);
+if (args[0] !== "--config" || args.length !== 4 || args[2] !== "--environment") {
+    console.error("Internal runtime requires --config PATH --environment PATH; use agent-task start");
+    process.exit(2);
+}
+const configPath = resolve(args[1]), environmentPath = resolve(args[3]);
+const native = { ...process.env }, base = baseEnvironment(native);
+const environment = readEnvironment(environmentPath);
+const instanceId = process.env.AGENT_TASK_INSTANCE_ID ?? randomUUID();
+for (const key of Object.keys(process.env))
+    delete process.env[key];
+Object.assign(process.env, base, environment);
+const config = loadConfig(configPath);
+const { token, adminToken } = validateServiceEnvironment(config, environment);
+let http;
+let tasks, settings;
+let release;
+let shutting;
+function shutdown(code, drain = false) {
+    process.exitCode = Math.max(process.exitCode ? Number(process.exitCode) : 0, code);
+    return shutting ??= (async () => {
+        http?.stopAccepting();
+        settings?.close();
+        try {
+            await tasks?.close();
+        }
+        catch (error) {
+            console.error(errorText(error));
+            process.exitCode = 1;
+        }
+        await http?.close(drain);
+        await release?.();
+    })().catch(error => { console.error(errorText(error)); process.exitCode = 1; });
+}
+const fatal = (error) => { console.error(errorText(error)); void shutdown(1).finally(() => { if (process.connected)
+    process.disconnect(); }); };
+let restartPending = false;
+const restart = async () => {
+    if (!process.connected || restartPending || shutting)
+        throw new Error("Restart unavailable");
+    restartPending = true;
+    return new Promise((resolve, reject) => {
+        process.once("message", function receive(value) {
+            if (value.type !== "restarted") {
+                process.once("message", receive);
+                return;
+            }
+            if (value.error && !shutting) {
+                restartPending = false;
+                reject(new Error(value.error));
+                return;
+            }
+            // The HTTP adapter finishes the authenticated response before this child exits.
+            setTimeout(() => { if (process.connected)
+                process.disconnect(); http?.closeConnections(); }, 200);
+            if (value.error)
+                reject(new Error(value.error));
+            else
+                resolve(value.ready);
+        });
+        process.send({ type: "restart" });
+    });
+};
+process.on("message", (value) => {
+    if (value.type !== "drain")
+        return;
+    // Both Web and CLI restarts pass this boundary before changing runtime ownership.
+    try {
+        if (settings?.status().writeBlocked)
+            throw new Error("Configuration publication is uncertain");
+    }
+    catch {
+        process.send?.({ type: "drained", error: "Restart blocked; stop and inspect private configuration files" });
+        return;
+    }
+    void shutdown(0, true).then(() => {
+        if (process.exitCode) {
+            if (process.connected)
+                process.disconnect();
+        }
+        else
+            process.send?.({ type: "drained" });
+    });
+});
+const stop = () => { void shutdown(0).finally(() => { http?.closeConnections(); if (process.connected)
+    process.disconnect(); }); };
+process.once("SIGINT", stop);
+process.once("SIGTERM", stop);
+process.once("disconnect", stop);
+try {
+    release = await acquireLock(config.dataDir);
+    tasks = createTaskRuntime(config.dataDir, config.executors, createExecution(executorEnvironment(native, environment, config)), config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal);
+    if (adminToken)
+        settings = new Settings(new LocalSettingsFiles(configPath, environmentPath), configurationPaths, config, base, process.env);
+    http = new HttpServer({ tasks, settings, token, adminToken, fatal, restart, instanceId });
+    const origin = await http.listen(config.port);
+    if (shutting)
+        throw new Error("Startup stopped");
+    tasks.supervisor.start();
+    const ready = { instanceId, pid: process.pid, url: origin + "/mcp", consoleUrl: settings ? origin + "/admin/" : null };
+    console.log(JSON.stringify({ event: "ready", ...ready }));
+    process.send?.({ type: "ready", ready });
+}
+catch (error) {
+    fatal(error);
+}
+//# sourceMappingURL=main.js.map

package/dist/{startup.js → application/startup.js}

@@ -1,16 +1,11 @@
+import { startupPaths } from "../configuration/files.js";
 import { existsSync, mkdirSync, writeFileSync, openSync, fsyncSync, closeSync } from "node:fs";
 import { join } from "node:path";
-import { z } from "zod";
-import { loadConfig } from "./config.js";
-import { readEnvironment, validateServiceEnvironment } from "./environment.js";
-import { checkDataDirectory, readPrivateText, replacePrivateText } from "./private-files.js";
-import { acquireLock } from "./lock.js";
-/** A stable launch locator is the only runtime input outside the selected dataDir. */
-export function startupPaths(home) {
-    const { dataDir } = z.object({ dataDir: z.string() }).strict().parse(JSON.parse(readPrivateText(join(home, "launch.json"))));
-    checkDataDirectory(dataDir);
-    return { dataDir, configPath: join(dataDir, "config.json"), environmentPath: join(dataDir, "environment.json") };
-}
+import { loadConfig } from "../configuration/files.js";
+import { readEnvironment } from "../configuration/files.js";
+import { validateServiceEnvironment } from "../configuration/environment.js";
+import { checkDataDirectory, readPrivateText, replacePrivateText } from "../infrastructure/private-files.js";
+import { acquireLock } from "../infrastructure/lock.js";
 function prepareFile(path, text) {
     if (existsSync(path)) {
         if (readPrivateText(path) !== text)

package/dist/application/task-runtime.js

@@ -0,0 +1,42 @@
+import { join } from "node:path";
+import { ExecutorRegistry } from "../executors/registry.js";
+import { checkWorkspace, resolveWorkspace } from "../infrastructure/workspace.js";
+import { LocalResultFiles } from "../results/files.js";
+import { Results } from "../results/service.js";
+import { TaskDefinitions } from "../tasks/definitions.js";
+import { TaskRuns } from "../tasks/runs.js";
+import { RunSupervisor } from "../tasks/supervisor.js";
+import { TaskStore } from "../tasks/storage/store.js";
+/** Creates and owns the business store and services; callers must stop ingress before closing. */
+export function createTaskRuntime(directory, profiles, openExecution, coordinate, fatal) {
+    const store = new TaskStore(directory);
+    try {
+        const executors = new ExecutorRegistry(profiles);
+        const workspaces = { resolve: resolveWorkspace, check: checkWorkspace };
+        const results = new Results(new LocalResultFiles(join(directory, "results"), true));
+        const definitions = new TaskDefinitions(store, executors, workspaces, Boolean(coordinate));
+        const runs = new TaskRuns(store, executors, results, workspaces);
+        const supervisor = new RunSupervisor(runs, openExecution, coordinate, fatal);
+        let closing;
+        return { definitions, runs, supervisor, executors,
+            close() {
+                return closing ??= (async () => {
+                    definitions.close();
+                    const stopped = supervisor.close();
+                    runs.close();
+                    try {
+                        await stopped;
+                    }
+                    finally {
+                        store.close();
+                    }
+                })();
+            },
+        };
+    }
+    catch (error) {
+        store.close();
+        throw error;
+    }
+}
+//# sourceMappingURL=task-runtime.js.map

package/dist/configuration/contract.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import { executorSchema } from "../executors/validation.js";
+import { baseEnvKeys } from "./policy.js";
+const envKey = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+const modelId = z.string().min(1).max(200);
+const coordinatorSchema = z.discriminatedUnion("provider", [
+    z.object({ provider: z.enum(["openai", "anthropic", "deepseek"]), model: modelId }).strict(),
+    z.object({
+        provider: z.literal("openai-compatible"), model: modelId,
+        api: z.enum(["openai-completions", "openai-responses"]).default("openai-completions"),
+        baseUrl: z.string().url().refine(value => {
+            const url = new URL(value);
+            return ["https:", "http:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
+        }, "baseUrl must be HTTP(S) without credentials, query or fragment"),
+        apiKeyEnv: envKey.refine(key => !baseEnvKeys.includes(key), "Credential must not use a base environment key"),
+        contextWindow: z.number().int().positive(),
+        maxTokens: z.number().int().positive(),
+        reasoning: z.boolean().default(false),
+    }).strict(),
+]).refine(value => value.provider !== "openai-compatible" || value.maxTokens <= value.contextWindow, "maxTokens must not exceed contextWindow");
+export const configSchema = z.object({
+    dataDir: z.string().min(1),
+    port: z.number().int().min(0).max(65535).default(8765),
+    tokenEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).default("AGENT_TASK_TOKEN"),
+    coordinator: coordinatorSchema.optional(),
+    executors: z.array(executorSchema).max(100).default([]),
+}).strict();
+//# sourceMappingURL=contract.js.map

package/dist/{environment.js → configuration/environment.js}

@@ -1,5 +1,4 @@
-import { ADMIN_TOKEN_ENV, coordinatorCredentialEnv } from "./config.js";
-import { readPrivateText } from "./private-files.js";
+import { ADMIN_TOKEN_ENV, coordinatorCredentialEnv } from "./policy.js";
 export function parseEnvironment(text) {
     let value;
     try {
@@ -13,9 +12,6 @@ export function parseEnvironment(text) {
         throw new Error("Invalid environment file");
     return value;
 }
-export function readEnvironment(path) {
-    return parseEnvironment(readPrivateText(path));
-}
 /** Credential names and values must stay separate, including historical token aliases. */
 export function validateServiceEnvironment(config, environment) {
     const token = environment[config.tokenEnv], adminToken = environment[ADMIN_TOKEN_ENV];

package/dist/configuration/files.js

@@ -0,0 +1,43 @@
+import { join } from "node:path";
+import { z } from "zod";
+import { checkDataDirectory, readPrivateText, replacePrivateText } from "../infrastructure/private-files.js";
+import { resolveWorkspace } from "../infrastructure/workspace.js";
+import { configSchema } from "./contract.js";
+import { parseEnvironment } from "./environment.js";
+import { validateConfig } from "./policy.js";
+export const configurationPaths = { resolveWorkspace, checkDataDirectory };
+export function loadConfig(path) {
+    let value;
+    try {
+        value = JSON.parse(readPrivateText(path));
+    }
+    catch {
+        throw new Error("Cannot read configuration JSON");
+    }
+    return validateConfig(configSchema.parse(value), resolveWorkspace);
+}
+export function readEnvironment(path) { return parseEnvironment(readPrivateText(path)); }
+export class LocalSettingsFiles {
+    configPath;
+    environmentPath;
+    constructor(configPath, environmentPath) {
+        this.configPath = configPath;
+        this.environmentPath = environmentPath;
+        if (configPath === environmentPath)
+            throw new Error("Configuration and environment must be separate files");
+    }
+    read() {
+        const configText = readPrivateText(this.configPath), environmentText = readPrivateText(this.environmentPath);
+        return { configText, environmentText, config: configSchema.parse(JSON.parse(configText)), environment: parseEnvironment(environmentText) };
+    }
+    publish(target, value) {
+        replacePrivateText(target === "config" ? this.configPath : this.environmentPath, JSON.stringify(value, null, 2) + "\n");
+    }
+}
+/** A stable launch locator is the only runtime input outside the selected dataDir. */
+export function startupPaths(home) {
+    const { dataDir } = z.object({ dataDir: z.string() }).strict().parse(JSON.parse(readPrivateText(join(home, "launch.json"))));
+    checkDataDirectory(dataDir);
+    return { dataDir, configPath: join(dataDir, "config.json"), environmentPath: join(dataDir, "environment.json") };
+}
+//# sourceMappingURL=files.js.map

package/dist/configuration/management.js

@@ -0,0 +1,6 @@
+/** Configuration preview and task impact are one management operation for all clients. */
+export function previewSettings(settings, tasks, input) {
+    const preview = settings.preview(input);
+    return { ...preview, affectedTasks: tasks.executorImpact(preview.config.executors) };
+}
+//# sourceMappingURL=management.js.map

package/dist/configuration/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/configuration/policy.js

@@ -0,0 +1,29 @@
+export const ADMIN_TOKEN_ENV = "AGENT_TASK_ADMIN_TOKEN";
+export const baseEnvKeys = ["HOME", "PATH", "LANG", "LC_ALL", "TZ", "TMPDIR", "NODE_OPTIONS", "NODE_PATH", "__proto__", "constructor", "prototype"];
+export function coordinatorCredentialEnv(config) {
+    switch (config.provider) {
+        case "openai": return "OPENAI_API_KEY";
+        case "anthropic": return "ANTHROPIC_API_KEY";
+        case "deepseek": return "DEEPSEEK_API_KEY";
+        case "openai-compatible": return config.apiKeyEnv;
+    }
+}
+export function validateConfig(value, resolveWorkspace) {
+    const config = structuredClone(value);
+    if (!config.dataDir.startsWith("/") || /[\x00-\x1f\x7f]/.test(config.dataDir))
+        throw new Error("dataDir must be absolute without control characters");
+    const coordinatorKey = config.coordinator ? coordinatorCredentialEnv(config.coordinator) : undefined;
+    if (/^(NODE_|LD_|DYLD_)/.test(config.tokenEnv) || [...baseEnvKeys, ADMIN_TOKEN_ENV, "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "DEEPSEEK_API_KEY", coordinatorKey].includes(config.tokenEnv))
+        throw new Error("tokenEnv must be separate from base environment, administrator and model credentials");
+    if (coordinatorKey === ADMIN_TOKEN_ENV)
+        throw new Error("Administrator token must not be used as a model credential");
+    const ids = new Set();
+    for (const executor of config.executors) {
+        if (ids.has(executor.id))
+            throw new Error("Duplicate executor ID");
+        ids.add(executor.id);
+        executor.cwd = resolveWorkspace(executor.cwd);
+    }
+    return config;
+}
+//# sourceMappingURL=policy.js.map

package/dist/configuration/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map