@realqiyan/agent-task 0.0.1-rc.3 → 0.1.0-rc.2

package/docs/web-console.md

@@ -18,20 +18,23 @@
 
 - 任务列表、固定 DAG、运行历史、节点进度、已接受交付、错误和问题只读。触发计划结束不等于运行成功，原始输出不等于交付。
 - 任务写操作仅复用 `task_update`，暂停、恢复或取消未来触发。不停止当前运行，不补跑错过的触发，不回答问题或修改 DAG。已有不确定外部结果的任务拒绝恢复未来触发；当前不提供人工核对后强制恢复能力。
-- 数据目录、监听端口、MCP token 环境变量名、执行端注册和协调模型可编辑，下次启动生效。修改 token 变量名保留令牌值，不在页面回显。
-- 执行端只选择 pi、codex、claude 或 opencode，保留 ID、默认工作空间和无人值守审核，并可填写备注。启动方式由系统决定；原生认证和权限继续用官方工具管理。没有命令、参数、环境变量清单、结果目录或 ACP 工具白名单配置。
+- 协调模型是常规配置入口。数据目录、监听端口、MCP token 环境变量名和执行端启停位于高级设置，下次启动生效。修改 token 变量名保留令牌值，不在页面回显。
+- 执行端自动检测本机 pi、codex、claude 和 opencode。页面显示本机路径、准备结果和错误，提供重新检测与显式适配器升级；准备过程中自动更新状态。就绪不代表原生认证或工具权限已经验收。安装与更新边界见[部署说明](deployment.md)。
+- 无须手工注册执行端、设置默认工作目录或另行批准。原生认证和权限继续用官方工具管理；任务工作目录通过 MCP 上下文或创建参数确定。
 
 页面与接口入口见 [web.ts](../src/protocol/http/web.ts)、[页面模块](../src/web/)，任务契约见 [task-contract.ts](../src/protocol/task-contract.ts)。提供受管理员认证保护的重启入口；没有通用 MCP 代理、文件浏览器或下载接口。固定结果目录不授予整个 dataDir 的读取能力。
 
 ## 保存与重启
 
 1. 密钥只显示是否设置，原值不回显。不提交即保留；替换和删除必须明确操作。先保存新密钥，再保存引用它的配置。新凭据命名和受保护变量见 [settings.ts](../src/configuration/settings.ts)。
-2. 配置先校验并预览影响，再确认保存。校验不调用模型或启动 ACP，不能证明认证、原生权限或实际执行成功。修改执行端类型、ID 或工作空间后，配置服务要求重新明确批准无人值守执行；仅修改备注不改变授权。
+2. 配置先校验并预览影响，再确认保存。校验不调用模型或启动 ACP，不能证明认证、原生权限或实际执行成功。禁用执行端时显示受影响任务，不自动改派。
 3. 配置与密钥分别原子替换，不是跨文件事务。更换模型端点须使用新的凭据引用，避免中途重启将新密钥交给旧端点。旧凭据不自动清理。
 4. 保存不热更新。检查活动运行及待回答运行后，点击“重启并检查可用性”或执行 `agent-task restart`。目录切换、原生环境来源及故障处理见[部署说明](deployment.md)。
 5. 只有新进程通过认证健康检查才显示成功。页面清除令牌并给出新地址，重新连接后核对运行配置。请求未确认时先用 CLI status 核查，不删除历史、自动回滚或重放执行来修复。
 
-待回答运行也可能持有 ACP 会话，重启不保证无损续接。执行端类型、工作空间或批准状态与任务快照不一致时，旧任务的派发会被拒绝；页面显示受影响任务，但不改写快照、DAG 或执行端指派。需要新任务时由 MCP 调用方处理。
+待回答运行也可能持有 ACP 会话，重启不保证无损续接。执行端未就绪、被禁用或本机路径与任务快照不一致时，旧任务的派发会被拒绝；页面不改写快照、DAG 或执行端指派。需要新任务时由 MCP 调用方处理。
+
+重新检测和适配器升级直接作用于当前执行端目录，无需重启；它们不保存启动配置。普通刷新复用已经准备的适配器，只有显式升级才请求更新。升级期间暂停向该执行端派发新工作，完成后可在状态表核对结果。OpenCode 使用原生 ACP，通过原生 CLI 的安装渠道更新。
 
 Web 与 CLI 的旧编辑都会被拒绝，不做自动合并。离线编辑配置须先停服。校验与保存职责见 [settings.ts](../src/configuration/settings.ts)、[配置影响预览](../src/configuration/management.ts)、[settings-contract.ts](../src/protocol/settings-contract.ts)、[配置文件适配](../src/configuration/files.ts)。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@realqiyan/agent-task",
-  "version": "0.0.1-rc.3",
+  "version": "0.1.0-rc.2",
   "license": "MIT",
   "author": "realqiyan",
   "repository": {
@@ -24,6 +24,8 @@
     "scripts/probe-agent.mjs",
     "scripts/mcp-call.mjs",
     "docs/*.md",
+    "docs/adr/*.md",
+    "CONTEXT.md",
     "config.example.json",
     "LICENSE"
   ],

package/scripts/install-lib.mjs

@@ -1,25 +1,18 @@
-import { spawnSync } from "node:child_process";
 import { DatabaseSync } from "../dist/infrastructure/sqlite.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, realpathSync, readdirSync, unlinkSync, openSync, closeSync, fsyncSync, renameSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, realpathSync, unlinkSync, openSync, closeSync, fsyncSync, renameSync } from "node:fs";
 import { dirname, join, resolve, isAbsolute, basename } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 
 export const packageRoot = realpathSync(fileURLToPath(new URL("..", import.meta.url)));
 
-export const packages = {
-  pi: ["@earendil-works/pi-coding-agent@1.3.0", "pi-acp@0.0.34"],
-  codex: ["@agentclientprotocol/codex-acp@2.2.2"],
-  claude: ["@zed-industries/claude-agent-acp@0.23.1"],
-  opencode: ["opencode-ai@1.19.3"],
-};
 export function argumentsFor(argv) {
-  const flags = new Set(["check", "probe", "resume", "help"]), options = {};
+  const flags = new Set(["check", "resume", "help", "yes", "generate-tokens"]), options = {};
   for (let i = 0; i < argv.length; i++) {
     const key = argv[i].replace(/^--/, "");
     if (!argv[i].startsWith("--") || key in options) throw new Error("Invalid or repeated option");
     if (flags.has(key)) options[key] = true;
-    else if (["home", "executors", "cwd", "provider", "model", "port"].includes(key) && argv[i + 1] && !argv[i + 1].startsWith("--")) options[key] = argv[++i];
+    else if (["home", "data-dir", "provider", "model", "port", "token-env", "credentials-file", "base-url", "api", "api-key-env", "context-window", "max-tokens"].includes(key) && argv[i + 1] && !argv[i + 1].startsWith("--")) options[key] = argv[++i];
     else throw new Error("Unknown option or missing value: " + key);
   }
   return options;
@@ -48,12 +41,6 @@ export function createFile(path, text) {
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
   writeFileSync(path, text, { flag: "wx", mode: 0o600 });
 }
-export function run(command, args, options = {}) {
-  const env = Object.fromEntries(["HOME", "PATH", "LANG", "LC_ALL", "TZ", "TMPDIR"].filter(key => process.env[key] !== undefined).map(key => [key, process.env[key]]));
-  const result = spawnSync(command, args, { encoding: "utf8", timeout: 300000, stdio: "pipe", env, ...options });
-  if (result.error || result.status !== 0) throw new Error("Command failed (diagnostics withheld; may contain credentials): " + command + " " + args[0]);
-  return result.stdout?.trim();
-}
 export function operationLock(root) {
   const db = new DatabaseSync(join(root, "setup-lock.sqlite"));
   try { db.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE"); }
@@ -67,7 +54,7 @@ export function readManifest(root) {
   return value;
 }
 export function saveManifest(root, manifest) {
-  // Preserve the last committed inventory even if a disk-full write fails.
+  // Preserve the last committed initialization record if a write fails.
   const temporary = join(root, `installation-${process.pid}.tmp`);
   let fd;
   try {
@@ -84,10 +71,5 @@ export function saveManifest(root, manifest) {
 }
 export function runtimeBaseEnv(manifest) {
   // Capture the OS user environment; the runtime isolates private service values before worker creation.
-  return { ...process.env, HOME: manifest.home, PATH: [join(manifest.root, "components/node_modules/.bin"), dirname(manifest.node), process.env.PATH ?? "", "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(":"), LANG: process.env.LANG ?? "en_US.UTF-8" };
-}
-export function inventory(root, relative) {
-  const path = join(root, relative), stat = lstatSync(path);
-  if (!stat.isDirectory() || stat.isSymbolicLink()) return [relative];
-  return readdirSync(path).flatMap(name => inventory(root, join(relative, name))).concat(relative);
+  return { ...process.env, HOME: manifest.home, PATH: [process.env.PATH ?? "", dirname(manifest.node), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].join(":"), LANG: process.env.LANG ?? "en_US.UTF-8" };
 }

package/scripts/probe-agent.mjs

@@ -2,22 +2,23 @@
 import { spawn } from "node:child_process";
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
-import { loadConfig } from "../dist/configuration/files.js";
+import { loadConfig, startupPaths } from "../dist/configuration/files.js";
 import { executorEnvironment } from "../dist/executors/environment.js";
-import { executorCommand } from "../dist/integrations/acp/runtime.js";
+import { executorLaunch } from "../dist/integrations/acp/runtime.js";
+import { LocalExecutors } from "../dist/integrations/acp/discovery.js";
 import { readEnvironment } from "../dist/configuration/files.js";
 import { join } from "node:path";
 import { terminateGroup } from "../dist/integrations/acp/connection.js";
 import { version } from "../dist/infrastructure/version.js";
-const [file, id] = process.argv.slice(2);
-if (!file || !id) { console.error("Usage: node scripts/probe-agent.mjs <config.json> <executorId>"); process.exit(2); }
-const config = loadConfig(file);
-const executor = config.executors.find(value => value.id === id);
-if (!executor) throw new Error("Executor not found");
+const [home, id] = process.argv.slice(2);
+if (!home || !id) { console.error("Usage: node scripts/probe-agent.mjs <installation-home> <pi|codex|claude|opencode>"); process.exit(2); }
+const config = loadConfig(startupPaths(home).configPath);
 const env = executorEnvironment(process.env, readEnvironment(join(config.dataDir, "environment.json")), config);
-const launch = executorCommand(executor.type, env);
+const executor = new LocalExecutors(join(home, "adapters"), env).discover().executors.find(value => value.id === id);
+if (!executor || config.disabledExecutors.includes(executor.type)) throw new Error("Executor unavailable; connect MCP to prepare its adapter first");
+const launch = executorLaunch(executor, env);
 const child = spawn(launch.command, launch.args, {
-  cwd: executor.cwd, env, detached: true, stdio: ["pipe", "pipe", "pipe"],
+  cwd: process.cwd(), env: launch.env, detached: true, stdio: ["pipe", "pipe", "pipe"],
 });
 child.stderr.resume();
 let connection;

package/scripts/service-runner.mjs

@@ -4,6 +4,11 @@ import { launch } from "../dist/application/launcher.js";
 process.umask(0o077);
 const root = process.argv[2];
 if (!root || process.argv.length !== 3) throw new Error("Expected installation home");
-const manifest = readManifest(root);
-if (manifest.phase !== "ready") throw new Error("Installation is not ready");
-await launch(root, runtimeBaseEnv(manifest));
+try {
+  const manifest = readManifest(root);
+  if (manifest.phase !== "ready") throw new Error("Installation is not ready; run agent-task setup --resume");
+  await launch(root, runtimeBaseEnv(manifest));
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/scripts/setup-wizard.mjs

@@ -1,24 +1,51 @@
 import { createInterface } from "node:readline/promises";
+import { Writable } from "node:stream";
+import { join } from "node:path";
 
+async function secret(question) {
+  let muted = false;
+  const output = new Writable({ write(chunk, _encoding, callback) { if (!muted) process.stderr.write(chunk); callback(); } });
+  const input = createInterface({ input: process.stdin, output, terminal: true });
+  try {
+    process.stderr.write(question + ": "); muted = true;
+    return (await input.question("")).trim();
+  } finally { muted = false; process.stderr.write("\n"); input.close(); output.end(); }
+}
+
+/** Terminal collection only; setup validates and publishes the settings. */
 export async function setupWizard(options, root) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Interactive setup requires a terminal; use --executors none|pi,codex,claude,opencode and --cwd ABSOLUTE_DIR for noninteractive setup");
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("Setup requires a terminal or explicit --home --data-dir --port --generate-tokens/--credentials-file and --yes");
   const input = createInterface({ input: process.stdin, output: process.stdout });
   const abort = new AbortController();
   input.on("SIGINT", () => abort.abort());
-  const ask = async (question, fallback) => (await input.question(`${question}${fallback ? " [" + fallback + "]" : ""}: `, { signal: abort.signal })).trim() || fallback;
+  const ask = async (question, fallback = "") => (await input.question(`${question}${fallback ? " [" + fallback + "]" : ""}: `, { signal: abort.signal })).trim() || fallback;
+  let needsKey = false;
   try {
-    console.log(`Private installation: ${root}`);
-    options.executors ??= await ask("Executors to install (none or comma-separated pi,codex,claude,opencode)", "none");
-    options.cwd ??= await ask("Existing absolute workspace (outside installation and npm package)", process.cwd());
-    if (!options.provider) {
-      const provider = await ask("Coordinator provider (none/openai/anthropic/deepseek; configurable later in Web)", "none");
-      if (provider !== "none") options.provider = provider;
+    options.home = await ask("Private installation directory", options.home ?? root);
+    options["data-dir"] = await ask("Private data directory", options["data-dir"] ?? join(options.home, "data"));
+    options.port = await ask("Loopback HTTP port (0 assigns an available port)", options.port ?? "8765");
+    options["token-env"] = await ask("MCP token variable name", options["token-env"] ?? "AGENT_TASK_TOKEN");
+    const tokens = await ask("Service/admin tokens (generate/file)", options["credentials-file"] ? "file" : "generate");
+    if (tokens === "generate") options["generate-tokens"] = true;
+    else if (tokens === "file") options["credentials-file"] = await ask("Private credentials JSON file", options["credentials-file"]);
+    else throw new Error("Choose generate or file for tokens");
+    options.provider = await ask("Coordinator provider (none/openai/anthropic/deepseek/openai-compatible)", options.provider ?? "none");
+    if (options.provider !== "none") {
+      options.model = await ask("Coordinator model ID", options.model);
+      if (options.provider === "openai-compatible") {
+        options["base-url"] = await ask("Model endpoint URL", options["base-url"]);
+        options.api = await ask("API (openai-completions/openai-responses)", options.api ?? "openai-completions");
+        options["api-key-env"] = await ask("Coordinator credential name", options["api-key-env"] ?? "COORDINATOR_API_KEY");
+        options["context-window"] = await ask("Model context window", options["context-window"]);
+        options["max-tokens"] = await ask("Maximum output tokens", options["max-tokens"]);
+      }
+      needsKey = !options["credentials-file"];
     }
-    if (options.provider) options.model ??= await ask("Coordinator model ID", "");
-    options.port ??= await ask("Loopback HTTP port", "8765");
-    if (await ask("Write private configuration and install selected components? (yes/no)", "no") !== "yes") throw new Error("Setup cancelled; no configuration written");
+    if (await ask("Confirm directories, port, token configuration and coordinator? (yes/no)", "no") !== "yes") throw new Error("Setup cancelled; no configuration written");
+    options.yes = true;
   } catch (error) {
     if (abort.signal.aborted) throw new Error("Setup cancelled; no configuration written");
     throw error;
   } finally { input.close(); }
+  if (needsKey) options.coordinatorKey = await secret("Coordinator API key (hidden)");
 }

package/scripts/setup.mjs

@@ -1,117 +1,91 @@
 #!/usr/bin/env node
 import { existsSync, mkdirSync, realpathSync, lstatSync } from "node:fs";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
+import { join, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { randomBytes } from "node:crypto";
-import { argumentsFor, installRoot, packages, createFile, json, run, operationLock, readManifest, saveManifest,
-  runtimeBaseEnv, inventory, packageRoot } from "./install-lib.mjs";
+import { argumentsFor, installRoot, createFile, json, operationLock, readManifest, saveManifest, packageRoot } from "./install-lib.mjs";
 import { setupWizard } from "./setup-wizard.mjs";
-import { startupPaths } from "../dist/configuration/files.js";
-import { readEnvironment } from "../dist/configuration/files.js";
-import { executorEnvironment } from "../dist/executors/environment.js";
-import { executorCommand } from "../dist/integrations/acp/runtime.js";
+import { startupPaths, loadConfig, readEnvironment } from "../dist/configuration/files.js";
+import { configSchema } from "../dist/configuration/contract.js";
+import { validateConfig, coordinatorCredentialEnv } from "../dist/configuration/policy.js";
+import { validateServiceEnvironment, parseEnvironment } from "../dist/configuration/environment.js";
+import { checkDataDirectory } from "../dist/infrastructure/private-files.js";
 
 process.umask(0o077);
 let unlock;
 try {
   const options = argumentsFor(process.argv.slice(2));
   if (options.help) {
-    console.log("Usage: agent-task setup [--home ABSOLUTE_PRIVATE_DIR]\nInteractive on a terminal for a new installation. Noninteractive: --executors pi,codex,claude,opencode|none --cwd ABSOLUTE_DIR [--provider openai|anthropic|deepseek --model ID] [--port 8765]\nExisting installation: --check [--probe] | --resume. No credentials accepted on the command line. Existing configuration is never replaced.");
+    console.log("Usage: agent-task setup [--home ABSOLUTE_PRIVATE_DIR]\nNew installation: confirm directories, port, tokens and coordinator in the terminal.\nNoninteractive: --home DIR --data-dir DIR --port NUMBER --generate-tokens|--credentials-file PRIVATE_JSON --yes [--provider openai|anthropic|deepseek|openai-compatible --model ID]\nCompatible provider: --base-url URL --api openai-completions|openai-responses --api-key-env NAME --context-window NUMBER --max-tokens NUMBER\nExisting installation: --check | --resume. Secrets are read from a private JSON file or hidden terminal input, never command arguments. No executor installation during setup.");
     process.exit(0);
   }
-  if (options.probe && !options.check) throw new Error("--probe requires --check");
-  const root = installRoot(options), manifestPath = join(root, "installation.json");
-  if (!existsSync(manifestPath) && !options.check && !options.resume && (!options.executors || !options.cwd)) await setupWizard(options, root);
-  if (!existsSync(root)) mkdirSync(root, { recursive: true, mode: 0o700 });
-  if (realpathSync(root) !== root || lstatSync(root).uid !== process.getuid() || (lstatSync(root).mode & 0o077)) throw new Error("Installation home must be canonical, owned and private");
-  unlock = operationLock(root);
-  let manifest;
-  if (existsSync(manifestPath)) {
+  let root = installRoot(options);
+  if (!existsSync(join(root, "installation.json")) && !options.check && !options.resume && !options.yes) {
+    await setupWizard(options, root); root = installRoot(options);
+  }
+  let manifest, initialEnvironment;
+  if (existsSync(join(root, "installation.json"))) {
     manifest = readManifest(root);
-    if (["executors", "cwd", "provider", "model", "port"].some(key => options[key] !== undefined)) throw new Error("Installation already exists; initialization options cannot replace existing configuration");
-    if (manifest.phase !== "ready" && !options.resume) throw new Error("Incomplete components; use --resume explicitly (configuration will be preserved)");
+    if (Object.keys(options).some(key => !["home", "check", "resume"].includes(key))) throw new Error("Installation exists; use configuration commands instead of initialization flags");
+    if (manifest.phase !== "ready" && !options.resume) throw new Error("Incomplete initialization; inspect private files and use --resume explicitly");
   } else {
-    if (options.check || options.probe || options.resume) throw new Error("No installation to check/resume");
-    if (!options.executors || !options.cwd) throw new Error("Select --executors pi,codex,claude,opencode|none and --cwd ABSOLUTE_DIR");
-    const selected = options.executors === "none" ? [] : options.executors.split(",");
-    if (selected.some(id => !Object.hasOwn(packages, id)) || new Set(selected).size !== selected.length) throw new Error("Invalid executor selection");
-    if (!options.cwd.startsWith("/") || !lstatSync(realpathSync(options.cwd)).isDirectory()) throw new Error("cwd must be an existing absolute directory");
-    const cwd = realpathSync(options.cwd);
-    if ([root, packageRoot].some(path => cwd === path || cwd.startsWith(path + "/"))) throw new Error("Workspace must be outside the installation home and npm package");
-    if (Boolean(options.provider) !== Boolean(options.model) || (options.provider && !["openai", "anthropic", "deepseek"].includes(options.provider))) throw new Error("Specify a supported --provider together with --model");
-    const port = Number(options.port ?? 8765);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid port");
-    // Reject unowned artifacts. This script never adopts or clears an existing installation.
-    for (const name of ["components", "launch.json", "data"]) {
-      if (existsSync(join(root, name))) throw new Error("Existing unowned installation artifact: " + name);
-    }
-    manifest = { project: "agent-task", root, home: homedir(), platform: process.platform, node: process.execPath, app: packageRoot,
-      selected, cwd, port, coordinator: options.provider ? { provider: options.provider, model: options.model } : undefined,
-      phase: "installing", files: [] };
-    createFile(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
-  }
-  const app = manifest.app, components = join(root, "components");
-  if (!existsSync(join(app, "dist/application/main.js"))) throw new Error("Prebuilt runtime is missing; reinstall the npm package (source contributors: npm run build)");
-  if (manifest.phase !== "ready") {
-    for (const name of ["components"]) {
-      if (!existsSync(join(root, name))) continue;
-      const known = new Set(manifest.files);
-      if (inventory(root, name).some(file => !known.has(file))) throw new Error("Uninventoried component files exist; refusing to overwrite them during resume");
+    if (options.check || options.resume) throw new Error("No installation to check/resume");
+    if (!options.yes || !options.home || !options["data-dir"] || options.port === undefined ||
+      (!options["generate-tokens"] && !options["credentials-file"])) throw new Error("Confirm initialization with --home, --data-dir, --port, --generate-tokens/--credentials-file and --yes");
+    const dataDir = installRoot({ home: options["data-dir"] });
+    if (dataDir === root || dataDir === packageRoot || dataDir.startsWith(packageRoot + "/")) throw new Error("Data directory must be separate from the installation root and npm package");
+    const coordinator = !options.provider || options.provider === "none" ? undefined : {
+      provider: options.provider, model: options.model,
+      ...(options.provider === "openai-compatible" ? { baseUrl: options["base-url"], api: options.api,
+        apiKeyEnv: options["api-key-env"], contextWindow: Number(options["context-window"]), maxTokens: Number(options["max-tokens"]), reasoning: false } : {}),
+    };
+    const config = validateConfig(configSchema.parse({ dataDir, port: Number(options.port), tokenEnv: options["token-env"] ?? "AGENT_TASK_TOKEN", coordinator, disabledExecutors: [] }));
+    initialEnvironment = options["credentials-file"] ? parseEnvironment(JSON.stringify(json(options["credentials-file"]))) : {};
+    if (options["generate-tokens"]) {
+      if (initialEnvironment[config.tokenEnv] || initialEnvironment.AGENT_TASK_ADMIN_TOKEN) throw new Error("Choose either supplied service/admin tokens or generated tokens");
+      initialEnvironment[config.tokenEnv] = randomBytes(32).toString("hex");
+      initialEnvironment.AGENT_TASK_ADMIN_TOKEN = randomBytes(32).toString("hex");
     }
-    try {
-      mkdirSync(components, { recursive: true, mode: 0o700 });
-      if (!existsSync(join(components, "package.json"))) createFile(join(components, "package.json"), JSON.stringify({ private: true }));
-      const dependencies = manifest.selected.flatMap(id => packages[id]);
-      if (dependencies.length) {
-        console.log("Installing selected ACP executors...");
-        const installArgs = existsSync(join(components, "package-lock.json"))
-          ? ["ci", "--ignore-scripts", "--no-audit", "--no-fund"]
-          : ["install", "--save-exact", "--ignore-scripts", "--no-audit", "--no-fund", ...dependencies];
-        run("npm", installArgs, { cwd: components });
-        if (manifest.selected.includes("opencode")) {
-          // This pinned package requires copying its platform binary. No other lifecycle scripts run.
-          run(manifest.node, [join(components, "node_modules/opencode-ai/postinstall.mjs")], { cwd: components });
-        }
-      }
-      mkdirSync(join(root, "data/results"), { recursive: true, mode: 0o700 });
-      const dataDir = join(root, "data");
-      if (!existsSync(join(root, "launch.json"))) createFile(join(root, "launch.json"), JSON.stringify({ dataDir }) + "\n");
-      if (!existsSync(join(dataDir, "environment.json"))) createFile(join(dataDir, "environment.json"), JSON.stringify({ AGENT_TASK_TOKEN: randomBytes(32).toString("hex"), AGENT_TASK_ADMIN_TOKEN: randomBytes(32).toString("hex") }, null, 2) + "\n");
-      if (!existsSync(join(dataDir, "config.json"))) createFile(join(dataDir, "config.json"), JSON.stringify({ dataDir, port: manifest.port,
-        tokenEnv: "AGENT_TASK_TOKEN", coordinator: manifest.coordinator,
-        executors: manifest.selected.map(id => ({ id, type: id, note: "", cwd: manifest.cwd, unattendedApproved: false })) }, null, 2) + "\n");
-      manifest.phase = "ready";
-      delete manifest.port; delete manifest.cwd; delete manifest.coordinator;
-    } finally {
-      manifest.files = ["components"].filter(name => existsSync(join(root, name))).flatMap(name => inventory(root, name));
-      saveManifest(root, manifest);
+    if (coordinator && options.coordinatorKey) initialEnvironment[coordinatorCredentialEnv(config.coordinator)] = options.coordinatorKey;
+    validateServiceEnvironment(config, initialEnvironment);
+    if (!initialEnvironment.AGENT_TASK_ADMIN_TOKEN) throw new Error("An independent administrator token is required for initialization");
+    if (coordinator && !initialEnvironment[coordinatorCredentialEnv(config.coordinator)]) throw new Error("Coordinator credential is missing; supply it through the private credentials file");
+    for (const path of [join(root, "launch.json"), join(dataDir, "config.json"), join(dataDir, "environment.json")]) {
+      if (existsSync(path)) throw new Error("Existing unowned initialization file; refusing to overwrite: " + path);
     }
+    checkDataDirectory(root); checkDataDirectory(dataDir);
+    manifest = { project: "agent-task", root, home: homedir(), platform: process.platform, node: process.execPath,
+      app: packageRoot, phase: "initializing", dataDir, config };
   }
-  const paths = startupPaths(root), env = runtimeBaseEnv(manifest);
-  // Use the same native launch environment; private values are read separately, never passed to probes.
-  run(manifest.node, ["--input-type=module", "-e", `import {loadConfig} from ${JSON.stringify(pathToFileURL(join(app, "dist/configuration/files.js")).href)}; loadConfig(process.argv[1]);`, paths.configPath], { env });
-  const config = json(paths.configPath);
-  for (const id of manifest.selected) {
-    const cliEnv = executorEnvironment(env, readEnvironment(paths.environmentPath), config);
-    executorCommand(id, cliEnv); // No native process is launched without an explicit --probe.
-  }
-  const report = { platform: process.platform, dependencies: "ready", configuration: "valid",
-    coordinator: config.coordinator ? "configured; authentication not verified" : "not configured; task admission disabled",
-    executors: config.executors.map(executor => ({ id: executor.id, authorized: executor.unattendedApproved,
-      handshake: "not checked", execution: "not verified by setup" })) };
-  if (options.probe) {
-    for (const entry of report.executors) {
-      try { run(manifest.node, [join(app, "scripts/probe-agent.mjs"), paths.configPath, entry.id], { env, timeout: 20000 }); entry.handshake = "passed (initialize only)"; }
-      catch { entry.handshake = "failed; inspect native dependencies/configuration separately"; process.exitCode = 1; }
+  mkdirSync(root, { recursive: true, mode: 0o700 });
+  if (realpathSync(root) !== root || lstatSync(root).uid !== process.getuid() || (lstatSync(root).mode & 0o077)) throw new Error("Installation home must be canonical, owned and private");
+  unlock = operationLock(root);
+  if (!existsSync(join(root, "installation.json"))) createFile(join(root, "installation.json"), JSON.stringify(manifest, null, 2) + "\n");
+  if (!existsSync(join(packageRoot, "dist/application/main.js"))) throw new Error("Prebuilt runtime missing; reinstall the package");
+  if (manifest.phase !== "ready") {
+    if (!isAbsolute(manifest.dataDir) || !manifest.config) throw new Error("Incomplete installation record; no repair performed");
+    const dataDir = manifest.dataDir;
+    mkdirSync(dataDir, { recursive: true, mode: 0o700 }); checkDataDirectory(dataDir);
+    const environmentPath = join(dataDir, "environment.json"), configPath = join(dataDir, "config.json");
+    if (!existsSync(environmentPath)) {
+      if (!initialEnvironment) throw new Error("Initialization has no saved credentials; inspect the private directory before resuming");
+      createFile(environmentPath, JSON.stringify(initialEnvironment, null, 2) + "\n");
     }
+    if (!existsSync(configPath)) createFile(configPath, JSON.stringify(manifest.config, null, 2) + "\n");
+    const config = loadConfig(configPath), environment = readEnvironment(environmentPath);
+    if (JSON.stringify(config) !== JSON.stringify(manifest.config)) throw new Error("Saved initialization configuration differs; no repair performed");
+    validateServiceEnvironment(config, environment);
+    if (!existsSync(join(root, "launch.json"))) createFile(join(root, "launch.json"), JSON.stringify({ dataDir }) + "\n");
+    if (startupPaths(root).dataDir !== dataDir) throw new Error("Launch locator differs from initialization");
+    manifest.phase = "ready"; delete manifest.config; delete manifest.dataDir;
+    saveManifest(root, manifest);
   }
-  console.log(JSON.stringify(report, null, 2));
-  if (!options.check) {
-    console.log(`Config: ${paths.configPath}\nCredentials: ${paths.environmentPath}\nConsole: http://127.0.0.1:${config.port}/admin/\nSign in with AGENT_TASK_ADMIN_TOKEN from the credentials file.`);
-    if (config.executors.length) console.log("Prepare native executor authentication and review permissions before approving unattended execution.");
-    console.log(`Start: agent-task start --home '${root.replaceAll("'", "'\"'\"'")}'`);
-  }
+  const paths = startupPaths(root), config = loadConfig(paths.configPath);
+  validateServiceEnvironment(config, readEnvironment(paths.environmentPath));
+  console.log(JSON.stringify({ configuration: "valid", coordinator: config.coordinator ? "configured; authentication not verified" : "not configured",
+    configPath: paths.configPath, credentialsPath: paths.environmentPath, executorDiscovery: "on MCP connection" }, null, 2));
+  if (!options.check) console.log("Add agent-task with args [mcp] to your MCP client (include --home for a custom installation). Token values are not printed. Use agent-task start for foreground management.");
 } catch (error) {
-  console.error(error.message); process.exitCode = 1;
+  console.error(error.name === "ZodError" ? "Invalid initialization configuration; check provider, model, directories and port" : error.message);
+  process.exitCode = 1;
 } finally { unlock?.(); }