@realqiyan/agent-task 0.0.1-rc.3 → 0.1.0-rc.2

package/CONTEXT.md

@@ -0,0 +1,17 @@
+# Agent Task
+
+本词汇表定义任务协调与执行中的项目术语。
+
+## Language
+
+**协调模型服务（Coordinator Provider）**：
+为内置协调员提供模型推理的服务。它的模型选择和凭据独立于各执行端的原生模型配置。
+_Avoid_: 全局模型服务、执行端模型服务
+
+**任务工作目录（Task Workspace）**：
+任务各节点开展工作的项目目录。它在提交任务时确定，后续各次运行使用同一个目录。
+_Avoid_: 执行端默认目录、服务工作目录
+
+**任务请求键（Task Request Key）**：
+由调用方提供、用于识别同一任务工作目录中一次任务创建请求的标识。不同工作目录中的相同请求键表示不同请求。
+_Avoid_: 全局任务 ID

package/README.md

@@ -12,6 +12,7 @@
 | 本机控制台、配置保存与 Web/CLI 重启 | [控制台说明](docs/web-console.md) |
 | 命令行配置、凭据和任务管理 | [CLI 说明](docs/cli.md) |
 | 理解产品目标和架构选择 | [总体方案](docs/design-proposal.md) |
+| 查询项目术语 | [词汇表](CONTEXT.md) |
 | 查找实现与对应测试 | [代码导航](docs/technical-design.md) |
 | 查询测试命令、真实验收及缺口 | [验证说明](docs/validation.md) |
 | npm 候选验收、GitHub Actions 与受控发布 | [发布说明](docs/release.md) |
@@ -21,28 +22,49 @@
 
 ## 使用入口
 
-Linux/macOS，Node.js **22.19+**。安装包自带运行产物，无需克隆或编译。`latest` 指向的已发布版本及平台验收范围见[发布证据](docs/validation.md#npm-发布候选验证)。
+Linux/macOS，Node.js **22.19+**。以下为当前源码的使用入口；安装包自带运行产物。实际发布状态及平台验收范围见[发布证据](docs/validation.md#npm-发布候选验证)。
 
 ```bash
 npm install -g @realqiyan/agent-task
 agent-task setup
-agent-task start
-# 另一个终端进行带认证的健康检查：
+# 在 MCP 宿主中配置 command: agent-task，args: [mcp]
+# 连接后可查询后台状态：
 agent-task status
 # 应用已保存配置并确认新实例可用：
 agent-task restart
 ```
 
-npm 包名为 `@realqiyan/agent-task`，安装后的命令仍为 `agent-task`。setup 提供交互配置；启动后可使用本机 Web 控制台或 [CLI](docs/cli.md)，两端共用管理服务。安装器不会替用户登录或批准执行端；详细操作见[部署说明](docs/deployment.md)。
+npm 包名为 `@realqiyan/agent-task`，安装后的命令仍为 `agent-task`。setup 要求确认目录、端口、令牌与协调模型。MCP 连接自动启动或复用独立后台，检测本机执行 CLI，并在缺少 ACP 适配器时安装当时最新版；已有适配器复用，原生登录仍由其官方工具管理。宿主退出后后台继续运行。接入配置与前台管理方式见[部署说明](docs/deployment.md)。
 
-MCP 客户端使用独立服务 token。源码开发辅助命令（凭据须安全注入环境，不写命令行）：
+stdio 入口从私有文件读取内部服务 token；直接 HTTP 接入需配置独立服务 token。源码开发辅助命令（凭据须安全注入环境，不写命令行）：
 
 ```bash
 node scripts/mcp-call.mjs --list
 node scripts/mcp-call.mjs service_status
 ```
 
-任务由 `task_create` 提交固定 DAG，每个节点选择已注册执行端。具体契约见 [task-contract.ts](src/protocol/task-contract.ts)，管理工具见 [mcp.ts](src/protocol/mcp.ts)。Prompt、人工回复和工作空间选择都不授予工具权限。
+任务由 `task_create` 提交固定 DAG，每个节点选择已就绪执行端。显式工作目录优先，否则 stdio 入口补入自己的启动目录；直接 HTTP 调用必须提供目录。具体契约见 [task-contract.ts](src/protocol/task-contract.ts)，管理工具见 [mcp.ts](src/protocol/mcp.ts)。Prompt、人工回复和工作空间选择都不授予工具权限。
+
+## CLI 命令索引
+
+下表列出全部命令及子命令。参数见 `agent-task <命令> --help`，操作流程见 [CLI 说明](docs/cli.md)和[部署说明](docs/deployment.md)。
+
+| 命令 | 子命令 | 用途 |
+| --- | --- | --- |
+| `agent-task setup` | — | 初始化、检查或接续安装配置 |
+| `agent-task mcp` | — | stdio 接入，自动启动或连接共用后台 |
+| `agent-task start` | — | 前台启动服务并调度任务 |
+| `agent-task stop` | — | 停止共用服务 |
+| `agent-task restart` | — | 应用已保存配置并重启、检查可用性 |
+| `agent-task status` | — | 查看服务健康、活动任务及待生效配置 |
+| `agent-task config` | `show`、`diff`、`edit`、`export`、`validate`、`apply` | 查看、编辑、导出、校验及保存配置 |
+| `agent-task executor` | `list`、`show`、`refresh`、`upgrade`、`enable`、`disable` | 查看与刷新执行端、升级适配器、设置启停 |
+| `agent-task coordinator` | `show`、`set`、`clear` | 查看、设置或清除协调模型配置 |
+| `agent-task credential` | `list`、`set`、`delete` | 查看凭据状态、设置或删除凭据 |
+| `agent-task task` | `list`、`show`、`pause`、`resume`、`cancel` | 查看任务，控制未来触发 |
+| `agent-task run` | `list`、`show` | 查看运行历史与交付详情 |
+| `agent-task help` / `agent-task --help` | — | 查看总帮助 |
+| `agent-task --version` | — | 查看版本 |
 
 ## 许可证
 

package/bin/agent-task.mjs

@@ -3,11 +3,13 @@ import { readFileSync } from "node:fs";
 
 const help = `Usage: agent-task <command>
   setup [options]           Interactive configuration (setup --help for flags)
+  mcp [--home PATH]          MCP stdio connection; start or reuse the shared background service
   start [--home PATH]        Foreground service using the private installation
+  stop [--home PATH]         Stop the shared service
   restart [--home PATH]      Restart runtime; verify readiness
   status [--home PATH]       Health, active work and pending configuration
   config                    Show, edit, validate and apply configuration
-  executor                  Manage registrations and unattended authorization
+  executor                  Discover executors, upgrade adapters and configure enable/disable
   coordinator               Configure the coordination model
   credential                List, replace or delete private credentials
   task                      Inspect tasks and control future triggers
@@ -28,14 +30,24 @@ try {
     await import(`../scripts/${command}.mjs`);
   } else {
     const lib = await import("../scripts/install-lib.mjs");
-    if (command === "start") {
-      if (args.includes("--help")) { console.log("Usage: agent-task start [--home ABSOLUTE_DIR]"); }
+    if (["start", "mcp", "stop"].includes(command)) {
+      if (args.includes("--help")) { console.log("Usage: agent-task " + command + " [--home ABSOLUTE_DIR]" + (command === "stop" ? " [--json]" : "")); }
       else {
-        const options = lib.argumentsFor(args);
+        const json = command === "stop" && args.includes("--json");
+        if (args.filter(arg => arg === "--json").length > 1) throw new Error("Repeated option: --json");
+        const options = lib.argumentsFor(json ? args.filter(arg => arg !== "--json") : args);
         if (Object.keys(options).some(key => key !== "home")) throw new Error("Only --home is accepted here");
         const root = lib.installRoot(options);
-        process.argv = [process.execPath, "service-runner", root];
-        await import("../scripts/service-runner.mjs");
+        if (command === "mcp") {
+          const { runMcp } = await import("../dist/application/mcp-entry.js");
+          await runMcp(root);
+        } else if (command === "stop") {
+          const { controlService } = await import("../dist/integrations/local-service/control.js");
+          console.log(JSON.stringify({ event: "stopped", ...await controlService(root, "stop") }, null, json ? undefined : 2));
+        } else {
+          process.argv = [process.execPath, "service-runner", root];
+          await import("../scripts/service-runner.mjs");
+        }
       }
     } else {
       const { runCli } = await import("../dist/protocol/cli/commands.js");

package/config.example.json

@@ -3,5 +3,5 @@
   "port": 8765,
   "tokenEnv": "AGENT_TASK_TOKEN",
   "coordinator": { "provider": "openai", "model": "YOUR_AVAILABLE_MODEL_ID" },
-  "executors": []
+  "disabledExecutors": []
 }

package/dist/application/launcher.js

@@ -66,17 +66,25 @@ function logFile(path) {
 export async function launch(home, nativeEnvironment) {
     process.umask(0o077);
     startupPaths(home); // Also checks private ownership of the locator.
-    const unlock = acquireLauncherLock(home);
+    const unlock = await acquireLauncherLock(home);
     const socket = join(home, "control.sock"), children = new Set();
     let current, ready, restarting = true, closing = false;
+    let shutting;
     let release;
     const finished = new Promise(resolve => { release = resolve; });
     const control = createServer(async (req, res) => {
         try {
-            if (req.method !== "POST" || !["/status", "/restart"].includes(req.url ?? "")) {
+            if (req.method !== "POST" || !["/status", "/restart", "/stop"].includes(req.url ?? "")) {
                 res.writeHead(404).end();
                 return;
             }
+            if (req.url === "/stop") {
+                await shutdown(true);
+                res.setHeader("Content-Type", "application/json");
+                res.setHeader("Connection", "close");
+                res.end(JSON.stringify({ stopped: true }));
+                return;
+            }
             const result = req.url === "/restart" ? await restart() : await status();
             res.setHeader("Content-Type", "application/json");
             res.end(JSON.stringify(result));
@@ -85,31 +93,36 @@ export async function launch(home, nativeEnvironment) {
             res.writeHead(503).end(JSON.stringify({ error: "Service unavailable; inspect private logs and startup files" }));
         }
     });
-    const shutdown = async () => {
-        if (closing)
-            return;
+    const shutdown = (drain = false) => {
+        if (shutting)
+            return shutting;
         closing = true;
-        control.close();
-        control.closeAllConnections();
-        await Promise.all([...children].map(stop));
-        try {
-            removeSocket(socket);
-        }
-        finally {
-            unlock();
-            release();
-        }
+        return shutting = (async () => {
+            control.close();
+            if (!drain)
+                control.closeAllConnections();
+            await Promise.all([...children].map(stop));
+            try {
+                removeSocket(socket);
+            }
+            finally {
+                unlock();
+                release();
+            }
+        })();
     };
     const signal = () => { void shutdown(); };
+    const hangup = () => { }; // A detached launcher survives the originating terminal closing.
     process.on("SIGINT", signal);
     process.on("SIGTERM", signal);
+    process.on("SIGHUP", hangup);
     const start = async () => {
         const inputs = await prepareStartup(home);
         if (closing)
             throw new Error("Launcher is closing");
         const log = logFile(join(inputs.dataDir, "service.log"));
         const child = fork(fileURLToPath(new URL("./main.js", import.meta.url)), ["--config", inputs.configPath, "--environment", inputs.environmentPath], {
-            env: { ...nativeEnvironment, AGENT_TASK_INSTANCE_ID: randomUUID() }, execArgv: [], stdio: ["ignore", "pipe", "pipe", "ipc"],
+            env: { ...nativeEnvironment, AGENT_TASK_INSTANCE_ID: randomUUID(), AGENT_TASK_INSTALL_HOME: home }, execArgv: [], stdio: ["ignore", "pipe", "pipe", "ipc"],
         });
         children.add(child);
         const output = (chunk) => { appendFileSync(log, chunk); process.stdout.write(chunk); };
@@ -210,6 +223,7 @@ export async function launch(home, nativeEnvironment) {
         await shutdown();
         process.off("SIGINT", signal);
         process.off("SIGTERM", signal);
+        process.off("SIGHUP", hangup);
     }
 }
 //# sourceMappingURL=launcher.js.map

package/dist/application/main.js

@@ -1,7 +1,7 @@
 import { HttpServer } from "../protocol/http/server.js";
 import { createTaskRuntime } from "./task-runtime.js";
 import { LocalSettingsFiles, configurationPaths } from "../configuration/files.js";
-import { resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { loadConfig } from "../configuration/files.js";
 import { baseEnvironment, validateServiceEnvironment } from "../configuration/environment.js";
@@ -12,6 +12,7 @@ import { errorText } from "../shared/errors.js";
 import { createExecution } from "../integrations/acp/execution.js";
 import { executorEnvironment } from "../executors/environment.js";
 import { createCoordinator } from "../integrations/coordinator/coordinator.js";
+import { LocalExecutors } from "../integrations/acp/discovery.js";
 process.umask(0o077);
 const args = process.argv.slice(2);
 if (args[0] !== "--config" || args.length !== 4 || args[2] !== "--environment") {
@@ -104,7 +105,9 @@ process.once("SIGTERM", stop);
 process.once("disconnect", stop);
 try {
     release = await acquireLock(config.dataDir);
-    tasks = createTaskRuntime(config.dataDir, config.executors, createExecution(executorEnvironment(native, environment, config)), config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal);
+    const executorEnv = executorEnvironment(native, environment, config);
+    const discovery = new LocalExecutors(join(native.AGENT_TASK_INSTALL_HOME ?? dirname(configPath), "adapters"), executorEnv);
+    tasks = createTaskRuntime(config.dataDir, [], createExecution(executorEnv), config.coordinator ? createCoordinator(config.dataDir, config.coordinator) : undefined, fatal, discovery, config.disabledExecutors);
     if (adminToken)
         settings = new Settings(new LocalSettingsFiles(configPath, environmentPath), configurationPaths, config, base, process.env);
     http = new HttpServer({ tasks, settings, token, adminToken, fatal, restart, instanceId });

package/dist/application/mcp-entry.js

@@ -0,0 +1,71 @@
+import { spawn } from "node:child_process";
+import { closeSync, constants, existsSync, fstatSync, openSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { setTimeout } from "node:timers/promises";
+import { configSchema } from "../configuration/contract.js";
+import { readEnvironment, startupPaths } from "../configuration/files.js";
+import { readPrivateText } from "../infrastructure/private-files.js";
+import { controlService, ControlError } from "../integrations/local-service/control.js";
+import { serveStdio } from "../protocol/stdio.js";
+async function startBackground(home) {
+    const fd = openSync(join(home, "launcher.log"), constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 0o077))
+            throw new Error("Expected a private launcher log");
+        const child = spawn(process.execPath, [fileURLToPath(new URL("../../scripts/service-runner.mjs", import.meta.url)), home], {
+            cwd: home, env: { ...process.env }, detached: true, stdio: ["ignore", fd, fd],
+        });
+        await new Promise((resolve, reject) => {
+            child.once("error", () => reject(new Error("Cannot start background service; inspect the private launcher log")));
+            child.once("spawn", () => { child.unref(); resolve(); });
+        });
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+async function connectBackground(home) {
+    const deadline = Date.now() + 40_000;
+    let mayStart = true;
+    while (Date.now() < deadline) {
+        try {
+            return await controlService(home, "status", 2000);
+        }
+        catch (error) {
+            if (!(error instanceof ControlError) || error.kind === "invalid")
+                throw error;
+            if (error.kind === "unreachable" && mayStart) {
+                mayStart = false;
+                await startBackground(home);
+            }
+            else
+                mayStart = false;
+        }
+        // Concurrent clients may launch together. The existing launcher lock selects one owner.
+        await setTimeout(200);
+    }
+    throw new Error("Background service did not become ready; inspect the private launcher log and use agent-task status. No restart was attempted");
+}
+/** The stdio connection owns neither the shared launcher nor persisted work. */
+export async function runMcp(home) {
+    const workspace = process.cwd();
+    if (!existsSync(join(home, "launch.json")))
+        throw new Error("Agent Task is not initialized; run agent-task setup first");
+    startupPaths(home);
+    const ready = await connectBackground(home);
+    const paths = startupPaths(home);
+    let config;
+    try {
+        config = configSchema.parse(JSON.parse(readPrivateText(paths.configPath)));
+    }
+    catch {
+        throw new Error("Cannot read service configuration; inspect the private startup files");
+    }
+    const token = readEnvironment(paths.environmentPath)[config.tokenEnv];
+    if (!token)
+        throw new Error("Service credential is unavailable; inspect the private startup files");
+    await serveStdio({ url: ready.url, token, workspace });
+}
+//# sourceMappingURL=mcp-entry.js.map

package/dist/application/task-runtime.js

@@ -8,10 +8,10 @@ import { TaskRuns } from "../tasks/runs.js";
 import { RunSupervisor } from "../tasks/supervisor.js";
 import { TaskStore } from "../tasks/storage/store.js";
 /** Creates and owns the business store and services; callers must stop ingress before closing. */
-export function createTaskRuntime(directory, profiles, openExecution, coordinate, fatal) {
+export function createTaskRuntime(directory, profiles, openExecution, coordinate, fatal, discovery, disabled = []) {
     const store = new TaskStore(directory);
     try {
-        const executors = new ExecutorRegistry(profiles);
+        const executors = new ExecutorRegistry(profiles, discovery, disabled);
         const workspaces = { resolve: resolveWorkspace, check: checkWorkspace };
         const results = new Results(new LocalResultFiles(join(directory, "results"), true));
         const definitions = new TaskDefinitions(store, executors, workspaces, Boolean(coordinate));
@@ -25,7 +25,7 @@ export function createTaskRuntime(directory, profiles, openExecution, coordinate
                     const stopped = supervisor.close();
                     runs.close();
                     try {
-                        await stopped;
+                        await Promise.all([stopped, executors.close()]);
                     }
                     finally {
                         store.close();

package/dist/configuration/contract.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { executorSchema } from "../executors/validation.js";
+import { executorTypeSchema } from "../executors/validation.js";
 import { baseEnvKeys } from "./policy.js";
 const envKey = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
 const modelId = z.string().min(1).max(200);
@@ -23,6 +23,6 @@ export const configSchema = z.object({
     port: z.number().int().min(0).max(65535).default(8765),
     tokenEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).default("AGENT_TASK_TOKEN"),
     coordinator: coordinatorSchema.optional(),
-    executors: z.array(executorSchema).max(100).default([]),
+    disabledExecutors: z.array(executorTypeSchema).max(4).refine(types => new Set(types).size === types.length, "Disabled executor types must be unique").default([]),
 }).strict();
 //# sourceMappingURL=contract.js.map

package/dist/configuration/files.js

@@ -1,11 +1,10 @@
 import { join } from "node:path";
 import { z } from "zod";
 import { checkDataDirectory, readPrivateText, replacePrivateText } from "../infrastructure/private-files.js";
-import { resolveWorkspace } from "../infrastructure/workspace.js";
 import { configSchema } from "./contract.js";
 import { parseEnvironment } from "./environment.js";
 import { validateConfig } from "./policy.js";
-export const configurationPaths = { resolveWorkspace, checkDataDirectory };
+export const configurationPaths = { checkDataDirectory };
 export function loadConfig(path) {
     let value;
     try {
@@ -14,7 +13,7 @@ export function loadConfig(path) {
     catch {
         throw new Error("Cannot read configuration JSON");
     }
-    return validateConfig(configSchema.parse(value), resolveWorkspace);
+    return validateConfig(configSchema.parse(value));
 }
 export function readEnvironment(path) { return parseEnvironment(readPrivateText(path)); }
 export class LocalSettingsFiles {

package/dist/configuration/management.js

@@ -1,6 +1,6 @@
 /** Configuration preview and task impact are one management operation for all clients. */
 export function previewSettings(settings, tasks, input) {
     const preview = settings.preview(input);
-    return { ...preview, affectedTasks: tasks.executorImpact(preview.config.executors) };
+    return { ...preview, affectedTasks: tasks.executorImpact(preview.config.disabledExecutors) };
 }
 //# sourceMappingURL=management.js.map

package/dist/configuration/policy.js

@@ -8,7 +8,7 @@ export function coordinatorCredentialEnv(config) {
         case "openai-compatible": return config.apiKeyEnv;
     }
 }
-export function validateConfig(value, resolveWorkspace) {
+export function validateConfig(value) {
     const config = structuredClone(value);
     if (!config.dataDir.startsWith("/") || /[\x00-\x1f\x7f]/.test(config.dataDir))
         throw new Error("dataDir must be absolute without control characters");
@@ -17,13 +17,8 @@ export function validateConfig(value, resolveWorkspace) {
         throw new Error("tokenEnv must be separate from base environment, administrator and model credentials");
     if (coordinatorKey === ADMIN_TOKEN_ENV)
         throw new Error("Administrator token must not be used as a model credential");
-    const ids = new Set();
-    for (const executor of config.executors) {
-        if (ids.has(executor.id))
-            throw new Error("Duplicate executor ID");
-        ids.add(executor.id);
-        executor.cwd = resolveWorkspace(executor.cwd);
-    }
+    if (new Set(config.disabledExecutors).size !== config.disabledExecutors.length)
+        throw new Error("Duplicate disabled executor type");
     return config;
 }
 //# sourceMappingURL=policy.js.map

package/dist/configuration/settings.js

@@ -1,7 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { ADMIN_TOKEN_ENV, coordinatorCredentialEnv, validateConfig } from "./policy.js";
-import { sameExecutor } from "../executors/registry.js";
 import { parseEnvironment, validateServiceEnvironment } from "./environment.js";
 import { FileCommitError } from "../shared/errors.js";
 export class SettingsError extends Error {
@@ -94,18 +93,11 @@ export class Settings {
         const environment = { ...this.base, ...snapshot.environment };
         let config;
         try {
-            config = validateConfig(input.config, this.paths.resolveWorkspace);
+            config = validateConfig(input.config);
             this.paths.checkDataDirectory(config.dataDir);
         }
         catch {
-            throw new SettingsError("invalid", "Local validation failed: check data directory, workspaces and credential isolation");
-        }
-        for (const executor of config.executors) {
-            const previous = snapshot.config.executors.find(item => item.id === executor.id);
-            if (executor.unattendedApproved && (!previous?.unattendedApproved || !sameExecutor(previous, executor)) &&
-                !input.approveExecutors.includes(executor.id)) {
-                throw new SettingsError("invalid", "Executor changes require explicit approval of the new configuration: " + executor.id);
-            }
+            throw new SettingsError("invalid", "Local validation failed: check data directory, executor selection and credential isolation");
         }
         const previous = snapshot.config.coordinator, next = config.coordinator;
         const endpoint = (model) => model.provider === "openai-compatible" ? model.baseUrl : model.provider;
@@ -140,33 +132,18 @@ export class Settings {
     /** Convenience commands create a draft; all publication still uses saveConfig. */
     prepareChange(value) {
         const { editToken, change } = value;
-        const config = structuredClone(this.editing(editToken).config), approveExecutors = [];
-        if (change.action === "executor-add") {
-            config.executors.push({ ...change.executor, unattendedApproved: false });
-        }
-        else if (change.action === "coordinator-set")
+        const config = structuredClone(this.editing(editToken).config);
+        if (change.action === "coordinator-set")
             config.coordinator = change.coordinator;
         else if (change.action === "coordinator-clear")
             delete config.coordinator;
-        else {
-            const executor = config.executors.find(item => item.id === change.id);
-            if (!executor)
-                throw new SettingsError("invalid", "Executor not found");
-            if (change.action === "executor-remove")
-                config.executors = config.executors.filter(item => item !== executor);
-            else if (change.action === "executor-update") {
-                const updated = { ...executor, ...change.patch };
-                if (!sameExecutor(executor, updated))
-                    updated.unattendedApproved = false;
-                config.executors[config.executors.indexOf(executor)] = updated;
-            }
-            else {
-                executor.unattendedApproved = change.action === "executor-approve";
-                if (executor.unattendedApproved)
-                    approveExecutors.push(executor.id);
-            }
+        else if (change.action === "executor-enable") {
+            config.disabledExecutors = config.disabledExecutors.filter(type => type !== change.id);
+        }
+        else if (!config.disabledExecutors.includes(change.id)) {
+            config.disabledExecutors.push(change.id);
         }
-        const input = { editToken, config, approveExecutors };
+        const input = { editToken, config };
         return { ...input, config: this.candidate(input) };
     }
     saveConfig(input) {

package/dist/executors/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/executors/registry.js

@@ -1,29 +1,131 @@
+import { errorText, TaskError } from "../shared/errors.js";
 export function sameExecutor(a, b) {
-    return a.id === b.id && a.type === b.type && a.cwd === b.cwd;
+    return a.id === b.id && a.type === b.type && a.nativePath === b.nativePath;
 }
 export function authorizedProfile(snapshot, current) {
-    return Boolean(snapshot?.unattendedApproved && current?.unattendedApproved && sameExecutor(snapshot, current));
+    return Boolean(snapshot && current && sameExecutor(snapshot, current));
 }
-/** Immutable registrations for one service lifetime. Settings apply to the next instance. */
+function status(executor, state = "ready") {
+    return { id: executor.id, type: executor.type, nativePath: executor.nativePath,
+        state, adapterVersion: executor.adapterVersion, error: null };
+}
+/** Owns the ready executor set and adapter installation lifetime, not native tool permissions. */
 export class ExecutorRegistry {
+    discovery;
     profiles;
-    constructor(profiles) { this.profiles = structuredClone(profiles); }
-    list() { return { executors: this.profiles.map(profile => ({ ...profile, transport: "stdio" })) }; }
+    states;
+    disabled;
+    installing = new Map();
+    closed = false;
+    closing;
+    constructor(profiles, discovery, disabled = []) {
+        this.discovery = discovery;
+        this.disabled = new Set(disabled);
+        const found = discovery?.discover();
+        this.profiles = structuredClone((found?.executors ?? profiles).filter(profile => !this.disabled.has(profile.type)));
+        this.states = found ? found.states.map(entry => this.disabled.has(entry.type)
+            ? { ...entry, state: "disabled", error: null } : { ...entry })
+            : profiles.map(profile => status(profile, this.disabled.has(profile.type) ? "disabled" : "ready"));
+    }
+    checkOpen() { if (this.closed)
+        throw new TaskError("unavailable", "Executor registry closed"); }
+    list() { this.checkOpen(); return { executors: structuredClone(this.states) }; }
+    refresh() {
+        this.checkOpen();
+        if (!this.discovery)
+            return this.list();
+        const found = this.discovery.discover();
+        this.profiles = structuredClone(found.executors.filter(profile => !this.disabled.has(profile.type) && !this.installing.has(profile.type)));
+        this.states = found.states.map(entry => {
+            if (this.disabled.has(entry.type))
+                return { ...entry, state: "disabled", error: null };
+            if (this.installing.has(entry.type))
+                return { ...entry, state: "installing", error: null };
+            return { ...entry };
+        });
+        for (const entry of this.states) {
+            if (entry.state === "missing" && entry.nativePath !== null)
+                this.install(entry, false);
+        }
+        return this.list();
+    }
+    upgrade(id) {
+        this.checkOpen();
+        const entry = this.states.find(item => item.id === id);
+        if (!this.discovery || !entry || !entry.nativePath)
+            throw new TaskError("not_found", "Executor is not installed: " + id);
+        if (this.disabled.has(entry.type))
+            throw new TaskError("precondition", "Executor is disabled: " + id);
+        if (entry.type === "opencode")
+            throw new TaskError("precondition", "OpenCode uses its native ACP command; update the native CLI directly");
+        this.install(entry, true);
+        return this.list();
+    }
+    install(entry, upgrade) {
+        const discovery = this.discovery;
+        if (!discovery || this.installing.has(entry.type))
+            return;
+        const controller = new AbortController(), expectedPath = entry.nativePath;
+        this.profiles = this.profiles.filter(profile => profile.type !== entry.type);
+        Object.assign(entry, { state: "installing", error: null });
+        const done = Promise.resolve().then(async () => {
+            try {
+                if (this.closed || controller.signal.aborted)
+                    return;
+                const executor = await discovery.install(entry.type, upgrade, controller.signal);
+                if (this.closed)
+                    return;
+                if (executor.type !== entry.type || executor.id !== entry.id || executor.nativePath !== expectedPath) {
+                    throw new TaskError("conflict", "Native executor changed during adapter installation; refresh discovery");
+                }
+                discovery.check(executor);
+                this.profiles = [...this.profiles.filter(profile => profile.type !== entry.type), structuredClone(executor)];
+                this.states = this.states.map(item => item.type === entry.type ? status(executor) : item);
+            }
+            catch (error) {
+                if (!this.closed)
+                    this.states = this.states.map(item => item.type === entry.type ?
+                        { ...item, state: "error", error: errorText(error) } : item);
+            }
+            finally {
+                this.installing.delete(entry.type);
+            }
+        });
+        this.installing.set(entry.type, { controller, done });
+    }
+    ready(id) {
+        const profile = this.profiles.find(item => item.id === id);
+        if (!profile) {
+            const entry = this.states.find(item => item.id === id);
+            throw new TaskError("precondition", "Executor is not ready: " + id + (entry ? " (" + entry.state + ")" : ""));
+        }
+        this.discovery?.check(profile);
+        return profile;
+    }
     snapshot(ids) {
+        this.checkOpen();
         const result = Object.create(null);
-        for (const id of ids) {
-            const profile = this.profiles.find(item => item.id === id);
-            if (!profile?.unattendedApproved)
-                throw new Error("Executor not found or not approved: " + id);
-            result[id] = structuredClone(profile);
-        }
+        for (const id of ids)
+            result[id] = structuredClone(this.ready(id));
         return result;
     }
     authorize(snapshot) {
-        if (!snapshot || !authorizedProfile(snapshot, this.profiles.find(profile => profile.id === snapshot.id))) {
-            throw new Error("Executor authorization revoked or changed");
-        }
-        return structuredClone(snapshot);
+        this.checkOpen();
+        if (!snapshot)
+            throw new TaskError("precondition", "Executor snapshot is missing");
+        const current = this.ready(snapshot.id);
+        if (!authorizedProfile(snapshot, current))
+            throw new TaskError("conflict", "Native executor changed; existing task assignment cannot be replaced");
+        return structuredClone(current);
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closed = true;
+        for (const entry of this.installing.values())
+            entry.controller.abort();
+        this.closing = Promise.all([...this.installing.values()].map(entry => entry.done)).then(() => undefined);
+        return this.closing;
     }
 }
 //# sourceMappingURL=registry.js.map