@realqiyan/agent-task 0.0.1-rc.2 → 0.1.0-rc.1

package/docs/web-console.md

@@ -2,36 +2,41 @@
 
 控制台与 MCP 共用 HTTP 服务，只监听 `127.0.0.1`。访问 `http://127.0.0.1:<port>/admin/`，不要改用 LAN 地址、反向代理或公网转发。
 
+全部管理操作也可通过 [CLI](cli.md) 完成，两端使用同一管理 API 和底层服务。
+
 ## 启用与连接
 
 新安装由 `agent-task setup`（[实现](../scripts/setup.mjs)）在当前 `dataDir/environment.json` 中生成独立的 `AGENT_TASK_ADMIN_TOKEN`。用本地编辑器读取该字段并在连接表单输入；它不是 MCP token，不能放进 URL、命令参数、截图或日志。
 
-已有文件不会由 setup 补写或覆盖。缺少管理员令牌时，管理接口关闭。需要启用时先停服，用本地密码管理器生成独立随机令牌，离线加入该字段；令牌约束见 [environment.ts](../src/environment.ts)。不要复用服务或模型密钥。
+已有文件不会由 setup 补写或覆盖。缺少管理员令牌时，管理接口关闭。需要启用时先停服，用本地密码管理器生成独立随机令牌，离线加入该字段；令牌约束见 [environment.ts](../src/configuration/environment.ts)。不要复用服务或模型密钥。
 
-前台和托管服务使用同一固定启动入口，见[部署说明](deployment.md)。配置和环境文件须属于当前用户、权限为 `0600`，所在目录须为规范绝对路径、权限为 `0700`，不接受符号链接。环境文件仅在运行进程启动时加载。文件格式见 [environment.ts](../src/environment.ts)。
+启动入口，见[部署说明](deployment.md)。配置和环境文件须属于当前用户、权限为 `0600`，所在目录须为规范绝对路径、权限为 `0700`，不接受符号链接。环境文件仅在运行进程启动时加载。文件格式见 [environment.ts](../src/configuration/environment.ts)。
 
 令牌仅保留在页面内存中；退出、离开或刷新后重新连接。不设置 Cookie，不写浏览器持久存储。配置和密钥文件仍是本地明文，须按凭据保护；此方案不隔离同一 OS 用户的其他进程或恶意浏览器扩展。
 
 ## 操作范围
 
 - 任务列表、固定 DAG、运行历史、节点进度、已接受交付、错误和问题只读。触发计划结束不等于运行成功，原始输出不等于交付。
-- 任务写操作仅复用 `task_update`，暂停、恢复或取消未来触发。不停止当前运行，不补跑错过的触发，不回答问题或修改 DAG。
-- 数据目录、监听端口、MCP token 环境变量名、执行端注册和协调模型可编辑，下次启动生效。修改 token 变量名保留令牌值，不在页面回显。
-- 执行端只选择 pi、codex、claude 或 opencode，保留 ID、默认工作空间和无人值守审核，并可填写备注。启动方式由系统决定；原生认证和权限继续用官方工具管理。没有命令、参数、环境变量清单、结果目录或 ACP 工具白名单配置。
+- 任务写操作仅复用 `task_update`，暂停、恢复或取消未来触发。不停止当前运行，不补跑错过的触发，不回答问题或修改 DAG。已有不确定外部结果的任务拒绝恢复未来触发；当前不提供人工核对后强制恢复能力。
+- 协调模型是常规配置入口。数据目录、监听端口、MCP token 环境变量名和执行端启停位于高级设置，下次启动生效。修改 token 变量名保留令牌值，不在页面回显。
+- 执行端自动检测本机 pi、codex、claude 和 opencode。页面显示本机路径、准备结果和错误，提供重新检测与显式适配器升级；准备过程中自动更新状态。就绪不代表原生认证或工具权限已经验收。安装与更新边界见[部署说明](deployment.md)。
+- 无须手工注册执行端、设置默认工作目录或另行批准。原生认证和权限继续用官方工具管理；任务工作目录通过 MCP 上下文或创建参数确定。
 
-页面与接口入口见 [web.ts](../src/web.ts)、[页面模块](../src/web/)，任务契约见 [task-contract.ts](../src/task-contract.ts)。提供受管理员认证保护的重启入口；没有通用 MCP 代理、文件浏览器或下载接口。固定结果目录不授予整个 dataDir 的读取能力。
+页面与接口入口见 [web.ts](../src/protocol/http/web.ts)、[页面模块](../src/web/)，任务契约见 [task-contract.ts](../src/protocol/task-contract.ts)。提供受管理员认证保护的重启入口；没有通用 MCP 代理、文件浏览器或下载接口。固定结果目录不授予整个 dataDir 的读取能力。
 
 ## 保存与重启
 
-1. 密钥只显示是否设置，原值不回显。不提交即保留；替换和删除必须明确操作。先保存新密钥，再保存引用它的配置。新凭据命名和受保护变量见 [settings.ts](../src/settings.ts)。
-2. 配置先校验并预览影响，再确认保存。校验不调用模型或启动 ACP，不能证明认证、原生权限或实际执行成功。修改执行端类型、ID 或工作空间后，页面要求重新明确批准无人值守执行；仅修改备注不改变授权。
+1. 密钥只显示是否设置，原值不回显。不提交即保留；替换和删除必须明确操作。先保存新密钥，再保存引用它的配置。新凭据命名和受保护变量见 [settings.ts](../src/configuration/settings.ts)。
+2. 配置先校验并预览影响，再确认保存。校验不调用模型或启动 ACP，不能证明认证、原生权限或实际执行成功。禁用执行端时显示受影响任务，不自动改派。
 3. 配置与密钥分别原子替换，不是跨文件事务。更换模型端点须使用新的凭据引用，避免中途重启将新密钥交给旧端点。旧凭据不自动清理。
-4. 保存不热更新。检查活动运行及待回答运行后，点击“重启并检查可用性”或执行 `agent-task restart`；两者均支持前台和 systemd／launchd 托管实例。目录切换、原生环境来源及故障处理见[部署说明](deployment.md)。
+4. 保存不热更新。检查活动运行及待回答运行后，点击“重启并检查可用性”或执行 `agent-task restart`。目录切换、原生环境来源及故障处理见[部署说明](deployment.md)。
 5. 只有新进程通过认证健康检查才显示成功。页面清除令牌并给出新地址，重新连接后核对运行配置。请求未确认时先用 CLI status 核查，不删除历史、自动回滚或重放执行来修复。
 
-待回答运行也可能持有 ACP 会话，重启不保证无损续接。执行端类型、工作空间或批准状态与任务快照不一致时，旧任务的派发会被拒绝；页面显示受影响任务，但不改写快照、DAG 或执行端指派。需要新任务时由 MCP 调用方处理。
+待回答运行也可能持有 ACP 会话，重启不保证无损续接。执行端未就绪、被禁用或本机路径与任务快照不一致时，旧任务的派发会被拒绝；页面不改写快照、DAG 或执行端指派。需要新任务时由 MCP 调用方处理。
+
+重新检测和适配器升级直接作用于当前执行端目录，无需重启；它们不保存启动配置。普通刷新复用已经准备的适配器，只有显式升级才请求更新。升级期间暂停向该执行端派发新工作，完成后可在状态表核对结果。OpenCode 使用原生 ACP，通过原生 CLI 的安装渠道更新。
 
-多个页面的旧编辑会被拒绝，不做自动合并。离线编辑配置须先停服。校验与保存职责见 [settings.ts](../src/settings.ts)、[settings-contract.ts](../src/settings-contract.ts)、[private-files.ts](../src/private-files.ts)。
+Web 与 CLI 的旧编辑都会被拒绝，不做自动合并。离线编辑配置须先停服。校验与保存职责见 [settings.ts](../src/configuration/settings.ts)、[配置影响预览](../src/configuration/management.ts)、[settings-contract.ts](../src/protocol/settings-contract.ts)、[配置文件适配](../src/configuration/files.ts)。
 
 ## 安全与验收
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@realqiyan/agent-task",
-  "version": "0.0.1-rc.2",
+  "version": "0.1.0-rc.1",
   "license": "MIT",
   "author": "realqiyan",
   "repository": {
@@ -21,11 +21,11 @@
     "scripts/setup-wizard.mjs",
     "scripts/install-lib.mjs",
     "scripts/service-runner.mjs",
-    "scripts/uninstall.mjs",
     "scripts/probe-agent.mjs",
     "scripts/mcp-call.mjs",
     "docs/*.md",
-    "deploy/*.example",
+    "docs/adr/*.md",
+    "CONTEXT.md",
     "config.example.json",
     "LICENSE"
   ],
@@ -34,14 +34,17 @@
     "registry": "https://registry.npmjs.org/",
     "tag": "latest"
   },
-  "os": ["linux", "darwin"],
+  "os": [
+    "linux",
+    "darwin"
+  ],
   "type": "module",
   "description": "Durable intelligent task coordination over MCP with ACP executors",
   "engines": {
     "node": ">=22.19.0"
   },
   "scripts": {
-    "check": "tsc --noEmit",
+    "check": "tsc --noEmit && node scripts/check-boundaries.mjs",
     "build": "rm -rf dist && tsc && node scripts/copy-web.mjs",
     "test": "npm run build && node --test --test-concurrency=1 tests/*.test.mjs",
     "test:e2e": "npm run build && node --test --test-concurrency=1 tests/e2e/deepseek-acp.test.mjs",
@@ -50,8 +53,7 @@
     "setup": "node bin/agent-task.mjs setup",
     "prepack": "npm run build",
     "pack:release": "node scripts/pack-release.mjs",
-    "test:install": "node scripts/verify-install.mjs",
-    "uninstall:service": "node scripts/uninstall.mjs"
+    "test:install": "node scripts/verify-install.mjs"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "2.0.0",

package/scripts/install-lib.mjs

@@ -1,29 +1,18 @@
-import { spawnSync } from "node:child_process";
-import { DatabaseSync } from "node:sqlite";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, realpathSync, readdirSync, unlinkSync, rmdirSync, openSync, closeSync, fsyncSync, renameSync } from "node:fs";
+import { DatabaseSync } from "../dist/infrastructure/sqlite.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, realpathSync, unlinkSync, openSync, closeSync, fsyncSync, renameSync } from "node:fs";
 import { dirname, join, resolve, isAbsolute, basename } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { setTimeout as delay } from "node:timers/promises";
-import { controlService } from "../dist/launcher.js";
 
 export const packageRoot = realpathSync(fileURLToPath(new URL("..", import.meta.url)));
 
-export const label = "com.agent-task.service";
-export const unit = "agent-task.service";
-export const packages = {
-  pi: ["@earendil-works/pi-coding-agent@1.3.0", "pi-acp@0.0.34"],
-  codex: ["@agentclientprotocol/codex-acp@2.2.2"],
-  claude: ["@zed-industries/claude-agent-acp@0.23.1"],
-  opencode: ["opencode-ai@1.19.3"],
-};
 export function argumentsFor(argv) {
-  const flags = new Set(["prepare-only", "service", "check", "probe", "resume", "help"]), options = {};
+  const flags = new Set(["check", "resume", "help", "yes", "generate-tokens"]), options = {};
   for (let i = 0; i < argv.length; i++) {
     const key = argv[i].replace(/^--/, "");
     if (!argv[i].startsWith("--") || key in options) throw new Error("Invalid or repeated option");
     if (flags.has(key)) options[key] = true;
-    else if (["home", "executors", "cwd", "provider", "model", "port"].includes(key) && argv[i + 1] && !argv[i + 1].startsWith("--")) options[key] = argv[++i];
+    else if (["home", "data-dir", "provider", "model", "port", "token-env", "credentials-file", "base-url", "api", "api-key-env", "context-window", "max-tokens"].includes(key) && argv[i + 1] && !argv[i + 1].startsWith("--")) options[key] = argv[++i];
     else throw new Error("Unknown option or missing value: " + key);
   }
   return options;
@@ -52,16 +41,10 @@ export function createFile(path, text) {
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
   writeFileSync(path, text, { flag: "wx", mode: 0o600 });
 }
-export function run(command, args, options = {}) {
-  const env = Object.fromEntries(["HOME", "PATH", "LANG", "LC_ALL", "TZ", "TMPDIR"].filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]]));
-  const result = spawnSync(command, args, { encoding: "utf8", timeout: 300000, stdio: "pipe", env, ...options });
-  if (result.error || result.status !== 0) throw new Error("Command failed (diagnostics withheld; may contain credentials): " + command + " " + args[0]);
-  return result.stdout?.trim();
-}
 export function operationLock(root) {
   const db = new DatabaseSync(join(root, "setup-lock.sqlite"));
   try { db.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE"); }
-  catch { db.close(); throw new Error("Another setup/uninstall operation owns this installation"); }
+  catch { db.close(); throw new Error("Another setup operation owns this installation"); }
   return () => db.close();
 }
 export function readManifest(root) {
@@ -71,7 +54,7 @@ export function readManifest(root) {
   return value;
 }
 export function saveManifest(root, manifest) {
-  // Preserve the last committed inventory even if a disk-full write fails.
+  // Preserve the last committed initialization record if a write fails.
   const temporary = join(root, `installation-${process.pid}.tmp`);
   let fd;
   try {
@@ -88,97 +71,5 @@ export function saveManifest(root, manifest) {
 }
 export function runtimeBaseEnv(manifest) {
   // Capture the OS user environment; the runtime isolates private service values before worker creation.
-  return { ...process.env, HOME: manifest.home, PATH: [join(manifest.root, "components/node_modules/.bin"), dirname(manifest.node), process.env.PATH ?? "", "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(":"), LANG: process.env.LANG ?? "en_US.UTF-8" };
-}
-const xml = value => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-const systemdQuote = value => '"' + value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("$", "$$") + '"';
-export function serviceDefinition(manifest) {
-  const runner = join(manifest.app, "scripts/service-runner.mjs");
-  if (manifest.platform === "linux") return {
-    path: join(manifest.home, ".config/systemd/user", unit),
-    text: `[Unit]\nDescription=Agent Task (managed by setup)\nAfter=network.target\n\n[Service]\nType=simple\nExecStart=${[manifest.node, runner, manifest.root].map(systemdQuote).join(" ")}\nRestart=on-failure\nRestartSec=5\nTimeoutStopSec=45\nKillMode=control-group\nUMask=0077\n\n[Install]\nWantedBy=default.target\n`,
-  };
-  return { path: join(manifest.home, "Library/LaunchAgents", label + ".plist"), text:
-    `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>\n<key>Label</key><string>${label}</string>\n<key>ProgramArguments</key><array>${[manifest.node, runner, manifest.root].map(value => `<string>${xml(value)}</string>`).join("")}</array>\n<key>RunAtLoad</key><true/>\n<key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n<key>ThrottleInterval</key><integer>5</integer>\n<key>ExitTimeOut</key><integer>45</integer>\n<key>AbandonProcessGroup</key><false/>\n<key>Umask</key><integer>63</integer>\n</dict></plist>\n` };
-}
-export function serviceEnv() {
-  const keys = ["HOME", "PATH", "LANG", "LC_ALL", "DBUS_SESSION_BUS_ADDRESS"];
-  return { ...Object.fromEntries(keys.filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]])),
-    XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR ?? `/run/user/${process.getuid()}` };
-}
-export async function checkHealth(home, waitMs = 5000) {
-  const deadline = Date.now() + waitMs;
-  do {
-    try { return await controlService(home, "status"); }
-    catch { /* The launcher may still be starting; never log credentials. */ }
-    await delay(200);
-  } while (Date.now() < deadline);
-  throw new Error("Authenticated MCP health check failed; inspect private logs and startup files");
-}
-export function verifyServiceFile(manifest) {
-  const definition = serviceDefinition(manifest);
-  if (existsSync(definition.path)) {
-    privateFile(definition.path);
-    if (readFileSync(definition.path, "utf8") !== definition.text) throw new Error("Service file differs; refusing to overwrite or remove it: " + definition.path);
-  }
-  return definition;
-}
-export function activate(manifest) {
-  const definition = verifyServiceFile(manifest);
-  if (!existsSync(definition.path)) createFile(definition.path, definition.text);
-  if (manifest.platform === "linux") {
-    run("systemctl", ["--user", "daemon-reload"], { env: serviceEnv() });
-    run("systemctl", ["--user", "enable", "--now", unit], { env: serviceEnv() });
-    run("systemctl", ["--user", "is-active", unit], { env: serviceEnv() });
-  } else {
-    const domain = `gui/${process.getuid()}`;
-    const active = spawnSync("launchctl", ["print", domain + "/" + label], { stdio: "ignore" });
-    if (active.status !== 0) run("launchctl", ["bootstrap", domain, definition.path]);
-    run("launchctl", ["kickstart", domain + "/" + label]);
-    run("launchctl", ["print", domain + "/" + label]);
-  }
-}
-export async function deactivate(manifest) {
-  const definition = verifyServiceFile(manifest);
-  if (!existsSync(definition.path)) {
-    if (manifest.serviceInstalled) throw new Error("Managed service file is missing; verify it is unloaded before cleanup");
-    return;
-  }
-  if (manifest.platform === "linux") {
-    run("systemctl", ["--user", "disable", "--now", unit], { env: serviceEnv() });
-    // Do not remove code while the service is still active or deactivating.
-    const state = run("systemctl", ["--user", "show", "--property=ActiveState", "--value", unit], { env: serviceEnv() });
-    if (!["inactive", "failed"].includes(state)) throw new Error("Service has not stopped");
-  } else {
-    const target = `gui/${process.getuid()}/${label}`;
-    const active = spawnSync("launchctl", ["print", target], { stdio: "ignore" });
-    if (active.status === 0) run("launchctl", ["bootout", target]);
-    // bootout can return while launchd still reports the job during graceful shutdown.
-    const deadline = Date.now() + 50_000;
-    while (spawnSync("launchctl", ["print", target], { stdio: "ignore" }).status === 0) {
-      if (Date.now() >= deadline) throw new Error("LaunchAgent is still loaded");
-      await delay(100);
-    }
-  }
-  unlinkSync(definition.path);
-  if (manifest.platform === "linux") run("systemctl", ["--user", "daemon-reload"], { env: serviceEnv() });
-}
-export function inventory(root, relative) {
-  const path = join(root, relative), stat = lstatSync(path);
-  if (!stat.isDirectory() || stat.isSymbolicLink()) return [relative];
-  return readdirSync(path).flatMap(name => inventory(root, join(relative, name))).concat(relative);
-}
-export function removeInventory(root, files) {
-  for (const relative of files) {
-    if (!/^components(\/|$)/.test(relative) || relative.split("/").includes("..")) throw new Error("Invalid component inventory");
-    const path = join(root, relative);
-    // Never follow a directory replaced by a symlink outside the installation.
-    try {
-      if (realpathSync(dirname(path)) !== dirname(path)) throw new Error("Component parent path changed; cleanup stopped");
-      const stat = lstatSync(path);
-      if (stat.isDirectory() && !stat.isSymbolicLink()) {
-        try { rmdirSync(path); } catch (error) { if (error.code !== "ENOTEMPTY") throw error; }
-      } else unlinkSync(path);
-    } catch (error) { if (error.code !== "ENOENT") throw error; }
-  }
+  return { ...process.env, HOME: manifest.home, PATH: [process.env.PATH ?? "", dirname(manifest.node), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(":"), LANG: process.env.LANG ?? "en_US.UTF-8" };
 }

package/scripts/mcp-call.mjs

@@ -1,6 +1,6 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { version } from "../dist/version.js";
+import { version } from "../dist/infrastructure/version.js";
 const [tool, input = "{}"] = process.argv.slice(2);
 if (!tool || !process.env.AGENT_TASK_TOKEN) {
   console.error("Usage: AGENT_TASK_TOKEN=... node scripts/mcp-call.mjs <tool|--list> '[JSON arguments]'\nAGENT_TASK_URL defaults to http://127.0.0.1:8765/mcp");

package/scripts/probe-agent.mjs

@@ -2,21 +2,23 @@
 import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
-import { loadConfig } from "../dist/config.js";
-import { executorCommand, executorEnvironment } from "../dist/executor-runtime.js";
-import { readEnvironment } from "../dist/environment.js";
+import { loadConfig, startupPaths } from "../dist/configuration/files.js";
+import { executorEnvironment } from "../dist/executors/environment.js";
+import { executorLaunch } from "../dist/integrations/acp/runtime.js";
+import { LocalExecutors } from "../dist/integrations/acp/discovery.js";
+import { readEnvironment } from "../dist/configuration/files.js";
 import { join } from "node:path";
-import { terminateGroup } from "../dist/acp.js";
-import { version } from "../dist/version.js";
-const [file, id] = process.argv.slice(2);
-if (!file || !id) { console.error("Usage: node scripts/probe-agent.mjs <config.json> <executorId>"); process.exit(2); }
-const config = loadConfig(file);
-const executor = config.executors.find(value => value.id === id);
-if (!executor) throw new Error("Executor not found");
+import { terminateGroup } from "../dist/integrations/acp/connection.js";
+import { version } from "../dist/infrastructure/version.js";
+const [home, id] = process.argv.slice(2);
+if (!home || !id) { console.error("Usage: node scripts/probe-agent.mjs <installation-home> <pi|codex|claude|opencode>"); process.exit(2); }
+const config = loadConfig(startupPaths(home).configPath);
 const env = executorEnvironment(process.env, readEnvironment(join(config.dataDir, "environment.json")), config);
-const launch = executorCommand(executor.type, env);
+const executor = new LocalExecutors(join(home, "adapters"), env).discover().executors.find(value => value.id === id);
+if (!executor || config.disabledExecutors.includes(executor.type)) throw new Error("Executor unavailable; connect MCP to prepare its adapter first");
+const launch = executorLaunch(executor, env);
 const child = spawn(launch.command, launch.args, {
-  cwd: executor.cwd, env, detached: true, stdio: ["pipe", "pipe", "pipe"],
+  cwd: process.cwd(), env: launch.env, detached: true, stdio: ["pipe", "pipe", "pipe"],
 });
 child.stderr.resume();
 let connection;

package/scripts/service-runner.mjs

@@ -1,9 +1,14 @@
 import { readManifest, runtimeBaseEnv } from "./install-lib.mjs";
-import { launch } from "../dist/launcher.js";
+import { launch } from "../dist/application/launcher.js";
 
 process.umask(0o077);
 const root = process.argv[2];
 if (!root || process.argv.length !== 3) throw new Error("Expected installation home");
-const manifest = readManifest(root);
-if (manifest.phase !== "ready") throw new Error("Installation is not ready");
-await launch(root, runtimeBaseEnv(manifest));
+try {
+  const manifest = readManifest(root);
+  if (manifest.phase !== "ready") throw new Error("Installation is not ready; run agent-task setup --resume");
+  await launch(root, runtimeBaseEnv(manifest));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/scripts/setup-wizard.mjs

@@ -1,29 +1,51 @@
 import { createInterface } from "node:readline/promises";
+import { Writable } from "node:stream";
+import { join } from "node:path";
 
+async function secret(question) {
+  let muted = false;
+  const output = new Writable({ write(chunk, _encoding, callback) { if (!muted) process.stderr.write(chunk); callback(); } });
+  const input = createInterface({ input: process.stdin, output, terminal: true });
+  try {
+    process.stderr.write(question + ": "); muted = true;
+    return (await input.question("")).trim();
+  } finally { muted = false; process.stderr.write("\n"); input.close(); output.end(); }
+}
+
+/** Terminal collection only; setup validates and publishes the settings. */
 export async function setupWizard(options, root) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Interactive setup requires a terminal; use --executors none|pi,codex,claude,opencode and --cwd ABSOLUTE_DIR for noninteractive setup");
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Setup requires a terminal or explicit --home --data-dir --port --generate-tokens/--credentials-file and --yes");
   const input = createInterface({ input: process.stdin, output: process.stdout });
   const abort = new AbortController();
   input.on("SIGINT", () => abort.abort());
-  const ask = async (question, fallback) => (await input.question(`${question}${fallback ? " [" + fallback + "]" : ""}: `, { signal: abort.signal })).trim() || fallback;
+  const ask = async (question, fallback = "") => (await input.question(`${question}${fallback ? " [" + fallback + "]" : ""}: `, { signal: abort.signal })).trim() || fallback;
+  let needsKey = false;
   try {
-    console.log(`Private installation: ${root}\nNo credentials are requested here. Use the local Web console or a private editor after setup.\nExecutors are optional; installing one does not authorize it.`);
-    options.executors ??= await ask("Executors to install (none or comma-separated pi,codex,claude,opencode)", "none");
-    options.cwd ??= await ask("Existing absolute workspace (outside installation and npm package)", process.cwd());
-    if (!options.provider) {
-      const provider = await ask("Coordinator provider (none/openai/anthropic/deepseek; configurable later in Web)", "none");
-      if (provider !== "none") options.provider = provider;
-    }
-    if (options.provider) options.model ??= await ask("Coordinator model ID", "");
-    options.port ??= await ask("Loopback HTTP port", "8765");
-    if (!options["prepare-only"] && !options.service) {
-      const answer = await ask("Install and start the background service now? (yes/no)", "no");
-      if (!["yes", "no"].includes(answer)) throw new Error("Expected yes or no; setup cancelled");
-      if (answer === "yes") options.service = true;
+    options.home = await ask("Private installation directory", options.home ?? root);
+    options["data-dir"] = await ask("Private data directory", options["data-dir"] ?? join(options.home, "data"));
+    options.port = await ask("Loopback HTTP port (0 assigns an available port)", options.port ?? "8765");
+    options["token-env"] = await ask("MCP token variable name", options["token-env"] ?? "AGENT_TASK_TOKEN");
+    const tokens = await ask("Service/admin tokens (generate/file)", options["credentials-file"] ? "file" : "generate");
+    if (tokens === "generate") options["generate-tokens"] = true;
+    else if (tokens === "file") options["credentials-file"] = await ask("Private credentials JSON file", options["credentials-file"]);
+    else throw new Error("Choose generate or file for tokens");
+    options.provider = await ask("Coordinator provider (none/openai/anthropic/deepseek/openai-compatible)", options.provider ?? "none");
+    if (options.provider !== "none") {
+      options.model = await ask("Coordinator model ID", options.model);
+      if (options.provider === "openai-compatible") {
+        options["base-url"] = await ask("Model endpoint URL", options["base-url"]);
+        options.api = await ask("API (openai-completions/openai-responses)", options.api ?? "openai-completions");
+        options["api-key-env"] = await ask("Coordinator credential name", options["api-key-env"] ?? "COORDINATOR_API_KEY");
+        options["context-window"] = await ask("Model context window", options["context-window"]);
+        options["max-tokens"] = await ask("Maximum output tokens", options["max-tokens"]);
+      }
+      needsKey = !options["credentials-file"];
     }
-    if (await ask("Write private configuration and install selected components? (yes/no)", "no") !== "yes") throw new Error("Setup cancelled; no configuration written");
+    if (await ask("Confirm directories, port, token configuration and coordinator? (yes/no)", "no") !== "yes") throw new Error("Setup cancelled; no configuration written");
+    options.yes = true;
   } catch (error) {
     if (abort.signal.aborted) throw new Error("Setup cancelled; no configuration written");
     throw error;
   } finally { input.close(); }
+  if (needsKey) options.coordinatorKey = await secret("Coordinator API key (hidden)");
 }