@realqiyan/agent-task 0.0.1-rc.2 → 0.0.1-rc.3

package/scripts/install-lib.mjs

@@ -1,16 +1,12 @@
 import { spawnSync } from "node:child_process";
-import { DatabaseSync } from "node:sqlite";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, realpathSync, readdirSync, unlinkSync, rmdirSync, openSync, closeSync, fsyncSync, renameSync } from "node:fs";
+import { DatabaseSync } from "../dist/infrastructure/sqlite.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, realpathSync, readdirSync, unlinkSync, openSync, closeSync, fsyncSync, renameSync } from "node:fs";
 import { dirname, join, resolve, isAbsolute, basename } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { setTimeout as delay } from "node:timers/promises";
-import { controlService } from "../dist/launcher.js";
 
 export const packageRoot = realpathSync(fileURLToPath(new URL("..", import.meta.url)));
 
-export const label = "com.agent-task.service";
-export const unit = "agent-task.service";
 export const packages = {
   pi: ["@earendil-works/pi-coding-agent@1.3.0", "pi-acp@0.0.34"],
   codex: ["@agentclientprotocol/codex-acp@2.2.2"],
@@ -18,7 +14,7 @@ export const packages = {
   opencode: ["opencode-ai@1.19.3"],
 };
 export function argumentsFor(argv) {
-  const flags = new Set(["prepare-only", "service", "check", "probe", "resume", "help"]), options = {};
+  const flags = new Set(["check", "probe", "resume", "help"]), options = {};
   for (let i = 0; i < argv.length; i++) {
     const key = argv[i].replace(/^--/, "");
     if (!argv[i].startsWith("--") || key in options) throw new Error("Invalid or repeated option");
@@ -61,7 +57,7 @@ export function run(command, args, options = {}) {
 export function operationLock(root) {
   const db = new DatabaseSync(join(root, "setup-lock.sqlite"));
   try { db.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE"); }
-  catch { db.close(); throw new Error("Another setup/uninstall operation owns this installation"); }
+  catch { db.close(); throw new Error("Another setup operation owns this installation"); }
   return () => db.close();
 }
 export function readManifest(root) {
@@ -90,95 +86,8 @@ export function runtimeBaseEnv(manifest) {
   // Capture the OS user environment; the runtime isolates private service values before worker creation.
   return { ...process.env, HOME: manifest.home, PATH: [join(manifest.root, "components/node_modules/.bin"), dirname(manifest.node), process.env.PATH ?? "", "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(":"), LANG: process.env.LANG ?? "en_US.UTF-8" };
 }
-const xml = value => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-const systemdQuote = value => '"' + value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("$", "$$") + '"';
-export function serviceDefinition(manifest) {
-  const runner = join(manifest.app, "scripts/service-runner.mjs");
-  if (manifest.platform === "linux") return {
-    path: join(manifest.home, ".config/systemd/user", unit),
-    text: `[Unit]\nDescription=Agent Task (managed by setup)\nAfter=network.target\n\n[Service]\nType=simple\nExecStart=${[manifest.node, runner, manifest.root].map(systemdQuote).join(" ")}\nRestart=on-failure\nRestartSec=5\nTimeoutStopSec=45\nKillMode=control-group\nUMask=0077\n\n[Install]\nWantedBy=default.target\n`,
-  };
-  return { path: join(manifest.home, "Library/LaunchAgents", label + ".plist"), text:
-    `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n<key>Label</key><string>${label}</string>\n<key>ProgramArguments</key><array>${[manifest.node, runner, manifest.root].map(value => `<string>${xml(value)}</string>`).join("")}</array>\n<key>RunAtLoad</key><true/>\n<key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n<key>ThrottleInterval</key><integer>5</integer>\n<key>ExitTimeOut</key><integer>45</integer>\n<key>AbandonProcessGroup</key><false/>\n<key>Umask</key><integer>63</integer>\n</dict></plist>\n` };
-}
-export function serviceEnv() {
-  const keys = ["HOME", "PATH", "LANG", "LC_ALL", "DBUS_SESSION_BUS_ADDRESS"];
-  return { ...Object.fromEntries(keys.filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]])),
-    XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR ?? `/run/user/${process.getuid()}` };
-}
-export async function checkHealth(home, waitMs = 5000) {
-  const deadline = Date.now() + waitMs;
-  do {
-    try { return await controlService(home, "status"); }
-    catch { /* The launcher may still be starting; never log credentials. */ }
-    await delay(200);
-  } while (Date.now() < deadline);
-  throw new Error("Authenticated MCP health check failed; inspect private logs and startup files");
-}
-export function verifyServiceFile(manifest) {
-  const definition = serviceDefinition(manifest);
-  if (existsSync(definition.path)) {
-    privateFile(definition.path);
-    if (readFileSync(definition.path, "utf8") !== definition.text) throw new Error("Service file differs; refusing to overwrite or remove it: " + definition.path);
-  }
-  return definition;
-}
-export function activate(manifest) {
-  const definition = verifyServiceFile(manifest);
-  if (!existsSync(definition.path)) createFile(definition.path, definition.text);
-  if (manifest.platform === "linux") {
-    run("systemctl", ["--user", "daemon-reload"], { env: serviceEnv() });
-    run("systemctl", ["--user", "enable", "--now", unit], { env: serviceEnv() });
-    run("systemctl", ["--user", "is-active", unit], { env: serviceEnv() });
-  } else {
-    const domain = `gui/${process.getuid()}`;
-    const active = spawnSync("launchctl", ["print", domain + "/" + label], { stdio: "ignore" });
-    if (active.status !== 0) run("launchctl", ["bootstrap", domain, definition.path]);
-    run("launchctl", ["kickstart", domain + "/" + label]);
-    run("launchctl", ["print", domain + "/" + label]);
-  }
-}
-export async function deactivate(manifest) {
-  const definition = verifyServiceFile(manifest);
-  if (!existsSync(definition.path)) {
-    if (manifest.serviceInstalled) throw new Error("Managed service file is missing; verify it is unloaded before cleanup");
-    return;
-  }
-  if (manifest.platform === "linux") {
-    run("systemctl", ["--user", "disable", "--now", unit], { env: serviceEnv() });
-    // Do not remove code while the service is still active or deactivating.
-    const state = run("systemctl", ["--user", "show", "--property=ActiveState", "--value", unit], { env: serviceEnv() });
-    if (!["inactive", "failed"].includes(state)) throw new Error("Service has not stopped");
-  } else {
-    const target = `gui/${process.getuid()}/${label}`;
-    const active = spawnSync("launchctl", ["print", target], { stdio: "ignore" });
-    if (active.status === 0) run("launchctl", ["bootout", target]);
-    // bootout can return while launchd still reports the job during graceful shutdown.
-    const deadline = Date.now() + 50_000;
-    while (spawnSync("launchctl", ["print", target], { stdio: "ignore" }).status === 0) {
-      if (Date.now() >= deadline) throw new Error("LaunchAgent is still loaded");
-      await delay(100);
-    }
-  }
-  unlinkSync(definition.path);
-  if (manifest.platform === "linux") run("systemctl", ["--user", "daemon-reload"], { env: serviceEnv() });
-}
 export function inventory(root, relative) {
   const path = join(root, relative), stat = lstatSync(path);
   if (!stat.isDirectory() || stat.isSymbolicLink()) return [relative];
   return readdirSync(path).flatMap(name => inventory(root, join(relative, name))).concat(relative);
 }
-export function removeInventory(root, files) {
-  for (const relative of files) {
-    if (!/^components(\/|$)/.test(relative) || relative.split("/").includes("..")) throw new Error("Invalid component inventory");
-    const path = join(root, relative);
-    // Never follow a directory replaced by a symlink outside the installation.
-    try {
-      if (realpathSync(dirname(path)) !== dirname(path)) throw new Error("Component parent path changed; cleanup stopped");
-      const stat = lstatSync(path);
-      if (stat.isDirectory() && !stat.isSymbolicLink()) {
-        try { rmdirSync(path); } catch (error) { if (error.code !== "ENOTEMPTY") throw error; }
-      } else unlinkSync(path);
-    } catch (error) { if (error.code !== "ENOENT") throw error; }
-  }
-}

package/scripts/mcp-call.mjs

@@ -1,6 +1,6 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { version } from "../dist/version.js";
+import { version } from "../dist/infrastructure/version.js";
 const [tool, input = "{}"] = process.argv.slice(2);
 if (!tool || !process.env.AGENT_TASK_TOKEN) {
   console.error("Usage: AGENT_TASK_TOKEN=... node scripts/mcp-call.mjs <tool|--list> '[JSON arguments]'\nAGENT_TASK_URL defaults to http://127.0.0.1:8765/mcp");

package/scripts/probe-agent.mjs

@@ -2,12 +2,13 @@
 import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
-import { loadConfig } from "../dist/config.js";
-import { executorCommand, executorEnvironment } from "../dist/executor-runtime.js";
-import { readEnvironment } from "../dist/environment.js";
+import { loadConfig } from "../dist/configuration/files.js";
+import { executorEnvironment } from "../dist/executors/environment.js";
+import { executorCommand } from "../dist/integrations/acp/runtime.js";
+import { readEnvironment } from "../dist/configuration/files.js";
 import { join } from "node:path";
-import { terminateGroup } from "../dist/acp.js";
-import { version } from "../dist/version.js";
+import { terminateGroup } from "../dist/integrations/acp/connection.js";
+import { version } from "../dist/infrastructure/version.js";
 const [file, id] = process.argv.slice(2);
 if (!file || !id) { console.error("Usage: node scripts/probe-agent.mjs <config.json> <executorId>"); process.exit(2); }
 const config = loadConfig(file);

package/scripts/service-runner.mjs

@@ -1,5 +1,5 @@
 import { readManifest, runtimeBaseEnv } from "./install-lib.mjs";
-import { launch } from "../dist/launcher.js";
+import { launch } from "../dist/application/launcher.js";
 
 process.umask(0o077);
 const root = process.argv[2];

package/scripts/setup-wizard.mjs

@@ -7,7 +7,7 @@ export async function setupWizard(options, root) {
   input.on("SIGINT", () => abort.abort());
   const ask = async (question, fallback) => (await input.question(`${question}${fallback ? " [" + fallback + "]" : ""}: `, { signal: abort.signal })).trim() || fallback;
   try {
-    console.log(`Private installation: ${root}\nNo credentials are requested here. Use the local Web console or a private editor after setup.\nExecutors are optional; installing one does not authorize it.`);
+    console.log(`Private installation: ${root}`);
     options.executors ??= await ask("Executors to install (none or comma-separated pi,codex,claude,opencode)", "none");
     options.cwd ??= await ask("Existing absolute workspace (outside installation and npm package)", process.cwd());
     if (!options.provider) {
@@ -16,11 +16,6 @@ export async function setupWizard(options, root) {
     }
     if (options.provider) options.model ??= await ask("Coordinator model ID", "");
     options.port ??= await ask("Loopback HTTP port", "8765");
-    if (!options["prepare-only"] && !options.service) {
-      const answer = await ask("Install and start the background service now? (yes/no)", "no");
-      if (!["yes", "no"].includes(answer)) throw new Error("Expected yes or no; setup cancelled");
-      if (answer === "yes") options.service = true;
-    }
     if (await ask("Write private configuration and install selected components? (yes/no)", "no") !== "yes") throw new Error("Setup cancelled; no configuration written");
   } catch (error) {
     if (abort.signal.aborted) throw new Error("Setup cancelled; no configuration written");

package/scripts/setup.mjs

@@ -5,22 +5,21 @@ import { pathToFileURL } from "node:url";
 import { homedir } from "node:os";
 import { randomBytes } from "node:crypto";
 import { argumentsFor, installRoot, packages, createFile, json, run, operationLock, readManifest, saveManifest,
-  runtimeBaseEnv, activate, inventory, verifyServiceFile, packageRoot, checkHealth } from "./install-lib.mjs";
+  runtimeBaseEnv, inventory, packageRoot } from "./install-lib.mjs";
 import { setupWizard } from "./setup-wizard.mjs";
-import { startupPaths } from "../dist/startup.js";
-import { readEnvironment } from "../dist/environment.js";
-import { executorCommand, executorEnvironment } from "../dist/executor-runtime.js";
-import { acquireLauncherLock } from "../dist/lock.js";
+import { startupPaths } from "../dist/configuration/files.js";
+import { readEnvironment } from "../dist/configuration/files.js";
+import { executorEnvironment } from "../dist/executors/environment.js";
+import { executorCommand } from "../dist/integrations/acp/runtime.js";
 
 process.umask(0o077);
 let unlock;
 try {
   const options = argumentsFor(process.argv.slice(2));
   if (options.help) {
-    console.log("Usage: agent-task setup [--home ABSOLUTE_PRIVATE_DIR]\nInteractive on a terminal for a new installation. Noninteractive: --executors pi,codex,claude,opencode|none --cwd ABSOLUTE_DIR [--provider openai|anthropic|deepseek --model ID] [--port 8765]\nDefault: --prepare-only (no background service). --service explicitly installs/starts the background service.\nExisting installation: --check [--probe] | --resume. No credentials accepted on the command line. Existing configuration is never replaced.");
+    console.log("Usage: agent-task setup [--home ABSOLUTE_PRIVATE_DIR]\nInteractive on a terminal for a new installation. Noninteractive: --executors pi,codex,claude,opencode|none --cwd ABSOLUTE_DIR [--provider openai|anthropic|deepseek --model ID] [--port 8765]\nExisting installation: --check [--probe] | --resume. No credentials accepted on the command line. Existing configuration is never replaced.");
     process.exit(0);
   }
-  if (options.service && (options["prepare-only"] || options.check)) throw new Error("--service cannot be combined with --prepare-only or --check");
   if (options.probe && !options.check) throw new Error("--probe requires --check");
   const root = installRoot(options), manifestPath = join(root, "installation.json");
   if (!existsSync(manifestPath) && !options.check && !options.resume && (!options.executors || !options.cwd)) await setupWizard(options, root);
@@ -31,7 +30,7 @@ try {
   if (existsSync(manifestPath)) {
     manifest = readManifest(root);
     if (["executors", "cwd", "provider", "model", "port"].some(key => options[key] !== undefined)) throw new Error("Installation already exists; initialization options cannot replace existing configuration");
-    if (manifest.phase !== "ready" && !options.resume) throw new Error("Incomplete or uninstalled components; use --resume explicitly (configuration will be preserved)");
+    if (manifest.phase !== "ready" && !options.resume) throw new Error("Incomplete components; use --resume explicitly (configuration will be preserved)");
   } else {
     if (options.check || options.probe || options.resume) throw new Error("No installation to check/resume");
     if (!options.executors || !options.cwd) throw new Error("Select --executors pi,codex,claude,opencode|none and --cwd ABSOLUTE_DIR");
@@ -49,26 +48,23 @@ try {
     }
     manifest = { project: "agent-task", root, home: homedir(), platform: process.platform, node: process.execPath, app: packageRoot,
       selected, cwd, port, coordinator: options.provider ? { provider: options.provider, model: options.model } : undefined,
-      phase: "installing", serviceInstalled: false, files: [] };
+      phase: "installing", files: [] };
     createFile(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
   }
-  verifyServiceFile(manifest);
   const app = manifest.app, components = join(root, "components");
-  if (!existsSync(join(app, "dist/main.js"))) throw new Error("Prebuilt runtime is missing; reinstall the npm package (source contributors: npm run build)");
+  if (!existsSync(join(app, "dist/application/main.js"))) throw new Error("Prebuilt runtime is missing; reinstall the npm package (source contributors: npm run build)");
   if (manifest.phase !== "ready") {
-    if (manifest.serviceInstalled) throw new Error("Stop/uninstall the existing service before rebuilding components");
     for (const name of ["components"]) {
       if (!existsSync(join(root, name))) continue;
       const known = new Set(manifest.files);
       if (inventory(root, name).some(file => !known.has(file))) throw new Error("Uninventoried component files exist; refusing to overwrite them during resume");
     }
     try {
-      console.log("Using the prebuilt npm runtime. No source checkout or compilation required.");
       mkdirSync(components, { recursive: true, mode: 0o700 });
       if (!existsSync(join(components, "package.json"))) createFile(join(components, "package.json"), JSON.stringify({ private: true }));
       const dependencies = manifest.selected.flatMap(id => packages[id]);
       if (dependencies.length) {
-        console.log("Installing selected ACP executors into private components (not global executables).");
+        console.log("Installing selected ACP executors...");
         const installArgs = existsSync(join(components, "package-lock.json"))
           ? ["ci", "--ignore-scripts", "--no-audit", "--no-fund"]
           : ["install", "--save-exact", "--ignore-scripts", "--no-audit", "--no-fund", ...dependencies];
@@ -94,13 +90,13 @@ try {
   }
   const paths = startupPaths(root), env = runtimeBaseEnv(manifest);
   // Use the same native launch environment; private values are read separately, never passed to probes.
-  run(manifest.node, ["--input-type=module", "-e", `import {loadConfig} from ${JSON.stringify(pathToFileURL(join(app, "dist/config.js")).href)}; loadConfig(process.argv[1]);`, paths.configPath], { env });
+  run(manifest.node, ["--input-type=module", "-e", `import {loadConfig} from ${JSON.stringify(pathToFileURL(join(app, "dist/configuration/files.js")).href)}; loadConfig(process.argv[1]);`, paths.configPath], { env });
   const config = json(paths.configPath);
   for (const id of manifest.selected) {
     const cliEnv = executorEnvironment(env, readEnvironment(paths.environmentPath), config);
     executorCommand(id, cliEnv); // No native process is launched without an explicit --probe.
   }
-  const report = { platform: process.platform, dependencies: "ready", configuration: "valid", background: "not-checked",
+  const report = { platform: process.platform, dependencies: "ready", configuration: "valid",
     coordinator: config.coordinator ? "configured; authentication not verified" : "not configured; task admission disabled",
     executors: config.executors.map(executor => ({ id: executor.id, authorized: executor.unattendedApproved,
       handshake: "not checked", execution: "not verified by setup" })) };
@@ -110,21 +106,12 @@ try {
       catch { entry.handshake = "failed; inspect native dependencies/configuration separately"; process.exitCode = 1; }
     }
   }
-  if (options.service) {
-    if (!manifest.serviceInstalled) acquireLauncherLock(root)(); // Refuse a live foreground owner.
-    // Record intent before activating so a failed service start is still owned by uninstall.
-    manifest.serviceInstalled = true; saveManifest(root, manifest);
-    activate(manifest);
-    report.background = "service manager registered";
-  }
-  if (manifest.serviceInstalled) {
-    try {
-      await checkHealth(root, 15000);
-      report.background = "authenticated MCP health check passed";
-    } catch { report.background = "not ready; run --check after startup and inspect the service manager"; process.exitCode = 1; }
-  }
   console.log(JSON.stringify(report, null, 2));
-  console.log(`Config: ${paths.configPath}\nSecrets (never printed): ${paths.environmentPath}\nInstalled ACP adapters: ${join(components, "node_modules/.bin")}. Prepare authentication with each executor\'s official native tools under the service OS user. No login is performed by setup.\nConsole: http://127.0.0.1:${config.port}/admin/ (use the separate AGENT_TASK_ADMIN_TOKEN from the private environment file; never place it in a URL). Configure coordinator credentials there or in environment.json, and audit native executor permissions before setting unattendedApproved=true. No permissions are granted by setup. Use Web restart or agent-task restart after changes.\nLinux: user service requires lingering for logout survival (administrator decision). macOS: LaunchAgent survives terminal close, not user logout; log in again to restart. Neither platform executes during sleep/shutdown.`);
+  if (!options.check) {
+    console.log(`Config: ${paths.configPath}\nCredentials: ${paths.environmentPath}\nConsole: http://127.0.0.1:${config.port}/admin/\nSign in with AGENT_TASK_ADMIN_TOKEN from the credentials file.`);
+    if (config.executors.length) console.log("Prepare native executor authentication and review permissions before approving unattended execution.");
+    console.log(`Start: agent-task start --home '${root.replaceAll("'", "'\"'\"'")}'`);
+  }
 } catch (error) {
   console.error(error.message); process.exitCode = 1;
 } finally { unlock?.(); }

package/deploy/agent-task.service.example

@@ -1,17 +0,0 @@
-[Unit]
-Description=Agent Task local service
-StartLimitIntervalSec=60
-StartLimitBurst=3
-
-[Service]
-Type=simple
-WorkingDirectory=/absolute/path/to/agent-task
-ExecStart=/absolute/path/to/node /absolute/path/to/agent-task/scripts/service-runner.mjs %h/.local/share/agent-task
-Restart=on-failure
-RestartSec=5
-TimeoutStopSec=45
-KillMode=control-group
-UMask=0077
-
-[Install]
-WantedBy=default.target

package/dist/admin.js

@@ -1,31 +0,0 @@
-import { readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { loadConfig, validateConfig } from "./config.js";
-import { replacePrivateText } from "./private-files.js";
-import { executorSchema } from "./model.js";
-import { acquireLock } from "./lock.js";
-process.umask(0o077);
-const [action, configPath, profilePath] = process.argv.slice(2);
-if (!configPath || !["register", "list"].includes(action ?? "") || (action === "register" && !profilePath)) {
-    throw new Error("Usage: node dist/admin.js list CONFIG | register CONFIG PROFILE.json (service stopped)");
-}
-const path = resolve(configPath), config = loadConfig(path);
-const release = await acquireLock(dirname(path));
-try {
-    if (action === "list") {
-        console.log(JSON.stringify(config.executors.map(executor => ({ ...executor, transport: "stdio" })), null, 2));
-    }
-    else {
-        const profile = executorSchema.parse(JSON.parse(readFileSync(resolve(profilePath), "utf8")));
-        if (config.executors.some(item => item.id === profile.id))
-            throw new Error("Executor ID already registered; edit reviewed config while stopped to replace");
-        config.executors.push(profile);
-        // Validate the complete candidate before publication, using the same rules as startup and the console.
-        replacePrivateText(path, JSON.stringify(validateConfig(config), null, 2) + "\n");
-        console.log(JSON.stringify({ registered: profile.id, transport: "stdio" }));
-    }
-}
-finally {
-    await release();
-}
-//# sourceMappingURL=admin.js.map

package/dist/config.js

@@ -1,72 +0,0 @@
-import { realpathSync, statSync } from "node:fs";
-import { isAbsolute } from "node:path";
-import { z } from "zod";
-import { executorSchema } from "./model.js";
-import { readPrivateText } from "./private-files.js";
-export const ADMIN_TOKEN_ENV = "AGENT_TASK_ADMIN_TOKEN";
-const envKey = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
-const baseEnvKeys = ["HOME", "PATH", "LANG", "LC_ALL", "TZ", "TMPDIR", "NODE_OPTIONS", "NODE_PATH", "__proto__", "constructor", "prototype"];
-const modelId = z.string().min(1).max(200);
-const coordinatorSchema = z.discriminatedUnion("provider", [
-    z.object({ provider: z.enum(["openai", "anthropic", "deepseek"]), model: modelId }).strict(),
-    z.object({
-        provider: z.literal("openai-compatible"), model: modelId,
-        api: z.enum(["openai-completions", "openai-responses"]).default("openai-completions"),
-        baseUrl: z.string().url().refine(value => {
-            const url = new URL(value);
-            return ["https:", "http:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
-        }, "baseUrl must be HTTP(S) without credentials, query or fragment"),
-        apiKeyEnv: envKey.refine(key => !baseEnvKeys.includes(key), "Credential must not use a base environment key"),
-        contextWindow: z.number().int().positive(),
-        maxTokens: z.number().int().positive(),
-        reasoning: z.boolean().default(false),
-    }).strict(),
-]).refine(value => value.provider !== "openai-compatible" || value.maxTokens <= value.contextWindow, "maxTokens must not exceed contextWindow");
-export const configSchema = z.object({
-    dataDir: z.string().min(1),
-    port: z.number().int().min(0).max(65535).default(8765),
-    tokenEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).default("AGENT_TASK_TOKEN"),
-    coordinator: coordinatorSchema.optional(),
-    executors: z.array(executorSchema).max(100).default([]),
-}).strict();
-export function coordinatorCredentialEnv(config) {
-    switch (config.provider) {
-        case "openai": return "OPENAI_API_KEY";
-        case "anthropic": return "ANTHROPIC_API_KEY";
-        case "deepseek": return "DEEPSEEK_API_KEY";
-        case "openai-compatible": return config.apiKeyEnv;
-    }
-}
-export function loadConfig(path) {
-    let value;
-    try {
-        value = JSON.parse(readPrivateText(path));
-    }
-    catch {
-        throw new Error("Cannot read configuration JSON");
-    }
-    return validateConfig(value);
-}
-export function validateConfig(value) {
-    const config = configSchema.parse(value);
-    if (!isAbsolute(config.dataDir) || /[\x00-\x1f\x7f]/.test(config.dataDir))
-        throw new Error("dataDir must be absolute without control characters");
-    const coordinatorKey = config.coordinator ? coordinatorCredentialEnv(config.coordinator) : undefined;
-    if (/^(NODE_|LD_|DYLD_)/.test(config.tokenEnv) || [...baseEnvKeys, ADMIN_TOKEN_ENV, "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "DEEPSEEK_API_KEY", coordinatorKey].includes(config.tokenEnv))
-        throw new Error("tokenEnv must be separate from base environment, administrator and model credentials");
-    if (coordinatorKey === ADMIN_TOKEN_ENV)
-        throw new Error("Administrator token must not be used as a model credential");
-    const ids = new Set();
-    for (const executor of config.executors) {
-        if (ids.has(executor.id))
-            throw new Error("Duplicate executor ID");
-        ids.add(executor.id);
-        if (!isAbsolute(executor.cwd))
-            throw new Error("Executor cwd must be absolute");
-        executor.cwd = realpathSync(executor.cwd);
-        if (!statSync(executor.cwd).isDirectory())
-            throw new Error("Invalid executor cwd");
-    }
-    return config;
-}
-//# sourceMappingURL=config.js.map

package/dist/main.js

@@ -1,175 +0,0 @@
-import express from "express";
-import { resolve } from "node:path";
-import { randomUUID } from "node:crypto";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { loadConfig } from "./config.js";
-import { baseEnvironment, readEnvironment, validateServiceEnvironment } from "./environment.js";
-import { bearerVerifier } from "./http-auth.js";
-import { Settings } from "./settings.js";
-import { createWebRouter } from "./web.js";
-import { acquireLock } from "./lock.js";
-import { createMcpServer } from "./mcp.js";
-import { errorText } from "./model.js";
-import { TaskStore } from "./task-storage.js";
-import { Tasks } from "./tasks.js";
-import { Results } from "./results.js";
-import { createExecution } from "./node-execution.js";
-import { executorEnvironment } from "./executor-runtime.js";
-import { createCoordinator } from "./coordinator.js";
-process.umask(0o077);
-const args = process.argv.slice(2);
-if (args[0] !== "--config" || args.length !== 4 || args[2] !== "--environment") {
-    console.error("Internal runtime requires --config PATH --environment PATH; use agent-task start");
-    process.exit(2);
-}
-const configPath = resolve(args[1]), environmentPath = resolve(args[3]);
-const native = { ...process.env }, base = baseEnvironment(native);
-const environment = readEnvironment(environmentPath);
-const instanceId = process.env.AGENT_TASK_INSTANCE_ID ?? randomUUID();
-for (const key of Object.keys(process.env))
-    delete process.env[key];
-Object.assign(process.env, base, environment);
-const config = loadConfig(configPath);
-const { token, adminToken } = validateServiceEnvironment(config, environment);
-const authorized = bearerVerifier(token);
-let http;
-let tasks, taskStore, settings;
-let release;
-let shutting;
-const connections = new Set();
-function shutdown(code, drain = false) {
-    process.exitCode = Math.max(process.exitCode ? Number(process.exitCode) : 0, code);
-    return shutting ??= (async () => {
-        settings?.close();
-        try {
-            await tasks?.close();
-        }
-        catch (error) {
-            console.error(errorText(error));
-            process.exitCode = 1;
-        }
-        for (const close of connections)
-            await close().catch(() => { });
-        if (http) {
-            if (drain)
-                http.close(); // Release the listener, but retain the in-flight Web restart response.
-            else {
-                http.closeAllConnections();
-                await new Promise(done => http.close(() => done()));
-            }
-        }
-        taskStore?.close();
-        await release?.();
-    })().catch(error => { console.error(errorText(error)); process.exitCode = 1; });
-}
-const fatal = (error) => { console.error(errorText(error)); void shutdown(1).finally(() => { if (process.connected)
-    process.disconnect(); }); };
-let restartPending = false;
-const restart = async () => {
-    if (!process.connected || restartPending || shutting || settings?.status().writeBlocked)
-        throw new Error("Restart unavailable");
-    restartPending = true;
-    return new Promise((resolve, reject) => {
-        process.once("message", function receive(value) {
-            if (value.type !== "restarted") {
-                process.once("message", receive);
-                return;
-            }
-            // The HTTP adapter finishes the authenticated response before this child exits.
-            setTimeout(() => { if (process.connected)
-                process.disconnect(); http?.closeAllConnections(); }, 200);
-            if (value.error)
-                reject(new Error(value.error));
-            else
-                resolve(value.ready);
-        });
-        process.send({ type: "restart" });
-    });
-};
-process.on("message", (value) => {
-    if (value.type === "drain")
-        void shutdown(0, true).then(() => {
-            if (process.exitCode) {
-                if (process.connected)
-                    process.disconnect();
-            }
-            else
-                process.send?.({ type: "drained" });
-        });
-});
-const stop = () => { void shutdown(0).finally(() => { http?.closeAllConnections(); if (process.connected)
-    process.disconnect(); }); };
-process.once("SIGINT", stop);
-process.once("SIGTERM", stop);
-process.once("disconnect", stop);
-try {
-    release = await acquireLock(config.dataDir);
-    taskStore = new TaskStore(config.dataDir);
-    tasks = new Tasks(taskStore, config.executors, new Results(config.dataDir), createExecution(executorEnvironment(native, environment, config)), config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal);
-    const app = express();
-    app.disable("x-powered-by");
-    app.disable("etag");
-    app.use((_req, res, next) => {
-        if (shutting) {
-            res.status(503).end();
-            return;
-        }
-        next();
-    });
-    if (adminToken) {
-        settings = new Settings(configPath, environmentPath, config, base, process.env);
-        app.use("/admin", createWebRouter(tasks, settings, adminToken, fatal, restart, instanceId));
-    }
-    app.use("/mcp", (req, res, next) => {
-        const suffix = req.socket.localPort === 80 ? "" : ":" + req.socket.localPort;
-        if (req.headers.origin !== undefined || !["127.0.0.1" + suffix, "localhost" + suffix].includes(req.headers.host ?? "")) {
-            res.status(403).end();
-            return;
-        }
-        if (!authorized(req.headers.authorization)) {
-            res.status(401).set("WWW-Authenticate", "Bearer").end();
-            return;
-        }
-        next();
-    }, express.json({ limit: "512kb" }));
-    app.post("/mcp", async (req, res) => {
-        const server = createMcpServer(tasks, fatal);
-        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
-        const close = async () => { connections.delete(close); await transport.close(); await server.close(); };
-        connections.add(close);
-        res.once("close", () => { void close().catch(() => { }); });
-        try {
-            await server.connect(transport);
-            await transport.handleRequest(req, res, req.body);
-        }
-        catch {
-            if (!res.headersSent)
-                res.status(500).json({ error: "MCP request failed" });
-            await close();
-        }
-    });
-    app.all("/mcp", (_req, res) => { res.status(405).set("Allow", "POST").end(); });
-    app.use((_req, res) => { res.status(404).end(); });
-    app.use(((error, _req, res, _next) => {
-        res.status(error.status === 413 ? 413 : 400).json({ error: "Invalid request body" });
-    }));
-    http = await new Promise((done, reject) => {
-        const listening = app.listen(config.port, "127.0.0.1", () => done(listening));
-        listening.once("error", reject);
-    });
-    if (shutting) {
-        http.closeAllConnections();
-        http.close();
-        throw new Error("Startup stopped");
-    }
-    tasks.start();
-    const address = http.address();
-    const origin = "http://127.0.0.1:" + (typeof address === "object" && address ? address.port : config.port);
-    const ready = { instanceId, pid: process.pid, url: origin + "/mcp", consoleUrl: settings ? origin + "/admin/" : null };
-    console.log(JSON.stringify({ event: "ready", ...ready }));
-    process.send?.({ type: "ready", ready });
-}
-catch (error) {
-    fatal(error);
-}
-//# sourceMappingURL=main.js.map

package/dist/model.js

@@ -1,25 +0,0 @@
-import { z } from "zod";
-export const timestamp = z.string().datetime({ offset: true }).transform(value => new Date(value).toISOString());
-export const identifier = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/);
-export const scheduleSchema = z.discriminatedUnion("type", [
-    z.object({ type: z.literal("now") }).strict(),
-    z.object({ type: z.literal("once"), at: timestamp }).strict(),
-    z.object({ type: z.literal("interval"), startAt: timestamp,
-        seconds: z.number().int().min(60).max(31_536_000) }).strict(),
-]);
-export const executorSchema = z.object({
-    id: identifier,
-    type: z.enum(["pi", "codex", "claude", "opencode"]),
-    note: z.string().max(2000).default(""),
-    cwd: z.string().min(1),
-    unattendedApproved: z.boolean().default(false),
-}).strict();
-export const OUTPUT_LIMIT = 262_144;
-export const EVENT_LIMIT = 2000;
-export const GRACE_MS = 30_000;
-export function iso(now = Date.now()) { return new Date(now).toISOString(); }
-export function errorText(error) { return (error instanceof Error ? error.message : String(error)).slice(0, 2000); }
-export function initialTime(schedule, now) {
-    return schedule.type === "now" ? now : Date.parse(schedule.type === "once" ? schedule.at : schedule.startAt);
-}
-//# sourceMappingURL=model.js.map