macro-agent 0.1.0 → 0.1.2

package/src/auth/token.ts

@@ -0,0 +1,82 @@
+/**
+ * Authentication Token Utilities
+ *
+ * Provides token generation, secure comparison, and per-agent
+ * token management for the macro-agent server.
+ */
+
+import * as crypto from "crypto";
+
+// =============================================================================
+// Token Generation
+// =============================================================================
+
+/**
+ * Generate a cryptographically random hex token.
+ */
+export function generateToken(bytes = 32): string {
+  return crypto.randomBytes(bytes).toString("hex");
+}
+
+// =============================================================================
+// Secure Comparison
+// =============================================================================
+
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ */
+export function secureCompare(a: string, b: string): boolean {
+  if (a.length !== b.length) {
+    return false;
+  }
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+// =============================================================================
+// Agent Token Manager
+// =============================================================================
+
+/**
+ * Manages per-agent authentication tokens.
+ *
+ * Each spawned agent gets a unique token at spawn time. The token is
+ * passed to the subprocess via environment variable and validated on
+ * every MCP bridge RPC call.
+ */
+export class AgentTokenManager {
+  private tokens = new Map<string, string>();
+
+  /**
+   * Create and store a token for an agent. Returns the generated token.
+   */
+  createToken(agentId: string): string {
+    const token = generateToken();
+    this.tokens.set(agentId, token);
+    return token;
+  }
+
+  /**
+   * Verify that a token matches the one stored for an agent.
+   */
+  verifyToken(agentId: string, token: string): boolean {
+    const stored = this.tokens.get(agentId);
+    if (!stored) return false;
+    return secureCompare(stored, token);
+  }
+
+  /**
+   * Revoke an agent's token (e.g., on terminate).
+   */
+  revokeToken(agentId: string): boolean {
+    return this.tokens.delete(agentId);
+  }
+
+  /**
+   * Check if an agent has a registered token.
+   */
+  hasToken(agentId: string): boolean {
+    return this.tokens.has(agentId);
+  }
+}

package/src/cli/__tests__/acp.test.ts

@@ -6,7 +6,7 @@
  */
 
 import { describe, it, expect } from "vitest";
-import { parseArgs, type ACPServerOptions } from "../acp.js";
+import { parseArgs, type ACPServerOptions } from "../parse-args.js";
 
 // ─────────────────────────────────────────────────────────────────
 // parseArgs Tests

package/src/cli/__tests__/stable-instance-id.test.ts

@@ -7,7 +7,7 @@
 
 import { describe, it, expect } from "vitest";
 import { resolve } from "node:path";
-import { getStableInstanceId } from "../acp.js";
+import { getStableInstanceId } from "../stable-instance-id.js";
 
 describe("getStableInstanceId", () => {
   it("should return the same ID for the same path", () => {

package/src/cli/acp.ts

@@ -38,11 +38,7 @@
  *   });
  */
 
-import { readFileSync } from "node:fs";
-import { createHash } from "node:crypto";
-import { dirname, join, resolve } from "node:path";
 import { Readable } from "node:stream";
-import { fileURLToPath } from "node:url";
 import {
   AgentSideConnection,
   ndJsonStream,
@@ -52,6 +48,7 @@ import { createAgentManager } from "../agent/agent-manager.js";
 import { createTaskManager } from "../task/task-manager.js";
 import { createMessageRouter } from "../router/message-router.js";
 import { MacroAgent } from "../acp/macro-agent.js";
+import { TeamManager } from "../teams/team-manager.js";
 import {
   createCombinedServer,
   type CombinedServer,
@@ -73,63 +70,13 @@ import type { AgentId, EventId } from "../store/types/index.js";
 // Configuration
 // ─────────────────────────────────────────────────────────────────
 
-export interface ACPServerOptions {
-  /** Working directory for agents */
-  cwd?: string;
-  /** Stdio ACP-only mode (for embedded use with acp-factory) */
-  acp?: boolean;
-  /** Port for server (default: 3001) */
-  port?: number;
-  /** Host for server (default: localhost) */
-  host?: string;
-  /** Instance ID to reuse an existing event store (omit for new instance) */
-  instanceId?: string;
-}
+import { parseArgs } from "./parse-args.js";
+import { getStableInstanceId } from "./stable-instance-id.js";
+import { loadMergedConfig } from "../config/project-config.js";
 
-/**
- * Parse command line arguments.
- * @param argv Optional array of arguments (defaults to process.argv.slice(2))
- */
-export function parseArgs(argv?: string[]): ACPServerOptions {
-  const args = argv ?? process.argv.slice(2);
-  const options: ACPServerOptions = {};
-
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--version" || args[i] === "-v") {
-      const __dirname = dirname(fileURLToPath(import.meta.url));
-      const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));
-      console.log(pkg.version);
-      process.exit(0);
-    } else if (args[i] === "--cwd" && args[i + 1]) {
-      options.cwd = args[i + 1];
-      i++;
-    } else if (args[i] === "--acp") {
-      options.acp = true;
-    } else if (args[i] === "--port" && args[i + 1]) {
-      options.port = parseInt(args[i + 1], 10);
-      i++;
-    } else if (args[i] === "--host" && args[i + 1]) {
-      options.host = args[i + 1];
-      i++;
-    } else if (args[i] === "--instance-id" && args[i + 1]) {
-      options.instanceId = args[i + 1];
-      i++;
-    }
-  }
-
-  return options;
-}
-
-/**
- * Generate a stable instance ID from the working directory.
- * This ensures the same project always uses the same EventStore,
- * so agents and sessions persist across server restarts.
- */
-export function getStableInstanceId(cwd: string): string {
-  const normalizedPath = resolve(cwd);
-  const hash = createHash("sha256").update(normalizedPath).digest("hex").slice(0, 12);
-  return `inst_${hash}`;
-}
+// Re-export utilities for backwards compatibility
+export { parseArgs, type ACPServerOptions } from "./parse-args.js";
+export { getStableInstanceId } from "./stable-instance-id.js";
 
 // ─────────────────────────────────────────────────────────────────
 // Stream Setup
@@ -272,10 +219,154 @@ async function main() {
     wakeHandler: routerWakeHandler,
   });
 
+  // Load merged config (global → project → env vars)
+  const mergedConfig = loadMergedConfig(defaultCwd);
+
+  // Compute server URL for thin-client MCP mode (only in server mode, not stdio ACP)
+  const serverUrl = options.acp
+    ? undefined
+    : `http://${options.host ?? mergedConfig.host ?? "localhost"}:${options.port ?? mergedConfig.port ?? 3001}`;
+
+  // Set up authentication tokens from merged config
+  const noAuth = options.noAuth || mergedConfig.auth?.disabled === true;
+  let serverToken: string | undefined;
+  let agentTokenManager: import("../auth/token.js").AgentTokenManager | undefined;
+
+  if (!noAuth && mergedConfig.auth?.secret) {
+    const { AgentTokenManager } = await import("../auth/token.js");
+    serverToken = mergedConfig.auth.secret;
+    agentTokenManager = new AgentTokenManager();
+  }
+
+  // Create WorkspaceManager for workspace isolation (optional — requires git repo)
+  let workspaceManager: import("../workspace/types.js").WorkspaceManager | undefined;
+  try {
+    const { createWorkspaceManager } = await import("../workspace/workspace-manager.js");
+    const poolSize = parseInt(process.env.MACRO_WORKSPACE_POOL_SIZE ?? "10", 10);
+    workspaceManager = createWorkspaceManager({
+      enabled: true,
+      repoPath: defaultCwd,
+      pool: {
+        enabled: poolSize > 0,
+        maxSize: poolSize,
+      },
+    });
+    console.error(`[acp] WorkspaceManager created (pool: ${poolSize})`);
+  } catch (err) {
+    console.error(`[acp] WorkspaceManager not available: ${err instanceof Error ? err.message : err}`);
+  }
+
   // Now create the agentManager with the real router
-  agentManager = createAgentManager(eventStore, messageRouter);
+  agentManager = createAgentManager(eventStore, messageRouter, {
+    serverUrl,
+    serverToken: serverUrl ? serverToken : undefined,
+    agentTokenManager: serverUrl ? agentTokenManager : undefined,
+    taskBackend: mergedConfig.task?.backend,
+    openTasksSocketPath: mergedConfig.task?.opentasks?.socket_path,
+    workspaceManager,
+  });
   const taskManager = createTaskManager(eventStore);
 
+  // Create task backend for dynamic task tools (create_task, get_task, etc.)
+  const { createTaskBackend, loadTaskConfigFromMerged } = await import("../task/backend/index.js");
+  const { UnifiedTaskToolProvider } = await import("../task/backend/unified-tool-provider.js");
+
+  let taskBackend: import("../task/backend/types.js").TaskBackend | undefined;
+  let taskToolProvider: import("../task/backend/types.js").TaskToolProvider | undefined;
+  let taskBackendShutdown: (() => Promise<void>) | undefined;
+
+  // Mutable context holder for the task tool provider. Bridge handlers set
+  // this before each tool call so the provider uses the calling agent's ID.
+  // Safe because Node.js is single-threaded.
+  const taskToolContext = { agent_id: "" as string };
+
+  // Connect-on-spawn callback: auto-connect project .opentasks/ dirs to central daemon
+  let connectProject: ((projectPath: string) => Promise<void>) | undefined;
+  let getConnectedProjects: (() => string[]) | undefined;
+
+  try {
+    const taskConfig = loadTaskConfigFromMerged(mergedConfig);
+    const result = await createTaskBackend(taskConfig, eventStore);
+    taskBackend = result.backend;
+    taskBackendShutdown = result.shutdown;
+    connectProject = result.connectProject;
+    getConnectedProjects = result.getConnectedProjects;
+
+    taskToolProvider = new UnifiedTaskToolProvider(
+      taskBackend,
+      () => taskToolContext,
+      result.openTasksClient
+    );
+    console.error(`[acp] Task backend created: ${taskConfig.backend.type}`);
+
+    // Propagate runtime socket path to child agents so they skip daemon discovery
+    if (result.socketPath) {
+      agentManager.setOpenTasksSocketPath(result.socketPath);
+    }
+
+    // Auto-connect the server's own project directory on startup
+    if (connectProject) {
+      connectProject(defaultCwd).catch(() => {});
+    }
+  } catch (err) {
+    // Fall back to in-memory backend if opentasks connection fails
+    console.error(`[acp] Failed to create task backend (${err}), falling back to memory`);
+    try {
+      const fallbackResult = await createTaskBackend({ backend: { type: "memory" } }, eventStore);
+      taskBackend = fallbackResult.backend;
+      taskToolProvider = new UnifiedTaskToolProvider(
+        taskBackend,
+        () => taskToolContext,
+      );
+      console.error(`[acp] Task backend created: memory (fallback)`);
+    } catch (fallbackErr) {
+      console.error(`[acp] Memory fallback also failed: ${fallbackErr}. Task tools will be unavailable.`);
+    }
+  }
+
+  // Create TeamManager for dynamic team loading (server mode only)
+  const teamManager = new TeamManager({ agentManager, messageRouter, eventStore, workspaceManager, taskBackend });
+  teamManager.install(); // Composite interceptor/filter/validator
+
+  // Seed default team templates if they don't exist yet
+  try {
+    const { seedDefaultTemplates } = await import("../teams/seed-defaults.js");
+    const seeded = await seedDefaultTemplates(defaultCwd);
+    if (seeded.length > 0) {
+      console.error(`[acp] Seeded default team templates: ${seeded.join(", ")}`);
+    }
+  } catch (err) {
+    console.error(`[acp] Failed to seed default templates: ${err}`);
+  }
+
+  // Auto-start teams from config
+  if (!options.acp) {
+    // Default team (backward compat)
+    if (mergedConfig.team) {
+      try {
+        const instance = await teamManager.startTeam(mergedConfig.team, defaultCwd);
+        console.error(`[acp] Team '${mergedConfig.team}' started (${instance.id}): root=${instance.result.rootId}, companions=[${instance.result.companionIds.join(", ")}]`);
+      } catch (err) {
+        console.error(`[acp] Failed to start team '${mergedConfig.team}': ${err}`);
+      }
+    }
+
+    // Additional teams with autoStart (skip if already started as default team)
+    if (mergedConfig.teams) {
+      for (const [name, entry] of Object.entries(mergedConfig.teams)) {
+        if (!entry.autoStart) continue;
+        const template = entry.template ?? name;
+        if (template === mergedConfig.team) continue; // Already started above
+        try {
+          const instance = await teamManager.startTeam(template, defaultCwd);
+          console.error(`[acp] Team '${template}' started (${instance.id}): root=${instance.result.rootId}, companions=[${instance.result.companionIds.join(", ")}]`);
+        } catch (err) {
+          console.error(`[acp] Failed to start team '${template}': ${err}`);
+        }
+      }
+    }
+  }
+
   // Create ActivityWatcher for event-driven agent waking
   const sessionProvider = createSessionProviderFromAgentManager(agentManager);
   const wakeHandler = createWakeHandler(sessionProvider, agentManager);
@@ -332,9 +423,11 @@ async function main() {
   activityWatcher.start();
 
   // Auto-subscribe Monitor agents to health events when they spawn
+  // and auto-connect project .opentasks/ directories to central daemon
   agentManager.onLifecycleEvent((event) => {
     if (event.type === "spawned") {
       const agent = event.agent;
+
       // Check if this is a Monitor agent
       if (agent.role === "monitor" || agent.role?.startsWith("monitor.")) {
         subscribeAgentToEvents(
@@ -346,23 +439,48 @@ async function main() {
         );
         console.error(`[acp] Auto-subscribed Monitor ${agent.id} to health events`);
       }
+
+      // Connect-on-spawn: auto-connect project .opentasks/ to central daemon
+      if (connectProject && agent.cwd) {
+        connectProject(agent.cwd).catch(() => {
+          // Non-fatal — logged inside connectProject
+        });
+      }
     }
   });
 
   // Combined server (when --ws is enabled)
   let combinedServer: CombinedServer | undefined;
 
-  // Cleanup function
+  // Cleanup function — best-effort, each step isolated
   const cleanup = async () => {
-    // Stop ActivityWatcher
-    activityWatcher.stop();
+    try { activityWatcher.stop(); } catch (err) {
+      console.error(`[cleanup] ActivityWatcher stop failed: ${err}`);
+    }
 
-    // Stop combined server if running
     if (combinedServer) {
-      await combinedServer.stop();
+      try { await combinedServer.stop(); } catch (err) {
+        console.error(`[cleanup] Combined server stop failed: ${err}`);
+      }
+    }
+
+    try { await teamManager.teardownAll(); } catch (err) {
+      console.error(`[cleanup] TeamManager teardown failed: ${err}`);
+    }
+
+    try { await agentManager.close(); } catch (err) {
+      console.error(`[cleanup] AgentManager close failed: ${err}`);
+    }
+
+    if (taskBackendShutdown) {
+      try { await taskBackendShutdown(); } catch (err) {
+        console.error(`[cleanup] Task backend shutdown failed: ${err}`);
+      }
+    }
+
+    try { await eventStore.close(); } catch (err) {
+      console.error(`[cleanup] EventStore close failed: ${err}`);
     }
-    await agentManager.close();
-    await eventStore.close();
   };
 
   try {
@@ -401,15 +519,22 @@ async function main() {
       await cleanup();
     } else {
       // Full server mode (default): WebSocket ACP + MAP + REST API
-      const host = options.host ?? "localhost";
-      const port = options.port ?? 3001;
+      const host = options.host ?? mergedConfig.host ?? "localhost";
+      const port = options.port ?? mergedConfig.port ?? 3001;
 
       combinedServer = createCombinedServer(
-        { eventStore, agentManager, taskManager, messageRouter, activityWatcher },
-        { port, host, defaultCwd }
+        { eventStore, agentManager, taskManager, messageRouter, activityWatcher, taskBackend, taskToolProvider, taskToolContext, agentTokenManager, getConnectedProjects, teamManager, workspaceManager },
+        { port, host, defaultCwd, serverToken, noAuth }
       );
 
       await combinedServer.start();
+      if (serverToken) {
+        console.error(`[acp] Server token: ${serverToken.substring(0, 8)}...`);
+      } else if (noAuth) {
+        console.error(`[acp] Auth: explicitly disabled`);
+      } else {
+        console.error(`[acp] Auth: off (set auth.secret in config or MACRO_SERVER_SECRET to enable)`);
+      }
 
       // Keep process alive - will exit via SIGINT/SIGTERM handlers
       await new Promise<void>(() => {

package/src/cli/index.ts

@@ -16,8 +16,9 @@ import { createAgentManager } from "../agent/agent-manager.js";
 import { createTaskManager } from "../task/task-manager.js";
 import { createMessageRouter } from "../router/message-router.js";
 import { createAPIServer } from "../api/server.js";
-import { loadProjectConfig } from "../config/project-config.js";
+import { loadMergedConfig } from "../config/project-config.js";
 import { loadTeam, TeamRuntime } from "../teams/index.js";
+import { createTaskBackend, loadTaskConfigFromMerged } from "../task/backend/index.js";
 import type { Agent, Task } from "../store/types/index.js";
 
 // ─────────────────────────────────────────────────────────────────
@@ -127,15 +128,52 @@ program
     console.log(chalk.blue("Starting multi-agent server..."));
 
     try {
+      // Load merged config (global → project → env vars)
+      const mergedConfig = loadMergedConfig(options.cwd);
+
       // Initialize services
       const eventStore = await createEventStore({ inMemory: false });
       const messageRouter = createMessageRouter(eventStore);
-      const agentManager = createAgentManager(eventStore, messageRouter);
+      const serverUrl = `http://${options.host}:${options.port}`;
+      const agentManager = createAgentManager(eventStore, messageRouter, {
+        serverUrl,
+        taskBackend: mergedConfig.task?.backend,
+        openTasksSocketPath: mergedConfig.task?.opentasks?.socket_path,
+      });
       const taskManager = createTaskManager(eventStore);
 
-      // Determine team name: CLI flag > project config > none
-      const projectConfig = loadProjectConfig(options.cwd);
-      const teamName = options.team ?? projectConfig.team;
+      // Create task backend from merged config
+      const taskConfig = loadTaskConfigFromMerged(mergedConfig);
+      let taskBackendShutdown: (() => Promise<void>) | undefined;
+      let connectProject: ((projectPath: string) => Promise<void>) | undefined;
+      try {
+        const result = await createTaskBackend(taskConfig, eventStore);
+        taskBackendShutdown = result.shutdown;
+        connectProject = result.connectProject;
+        console.log(chalk.blue(`Task backend: ${taskConfig.backend.type}`));
+
+        // Propagate runtime socket path to child agents so they skip daemon discovery
+        if (result.socketPath) {
+          agentManager.setOpenTasksSocketPath(result.socketPath);
+        }
+
+        // Auto-connect the server's own project directory on startup
+        if (connectProject) {
+          connectProject(options.cwd ?? process.cwd()).catch(() => {});
+        }
+      } catch (err) {
+        // Fall back to in-memory backend if opentasks connection fails
+        console.log(chalk.yellow(`Task backend creation failed (${err}), falling back to memory`));
+        try {
+          await createTaskBackend({ backend: { type: "memory" } }, eventStore);
+        } catch { /* non-critical */ }
+      }
+
+      // Determine team name: CLI flag > merged config
+      if (options.team) {
+        console.warn(chalk.yellow("[DEPRECATED] --team flag on multiagent-cli start is deprecated. Use 'multiagent' with .multiagent/config.json instead."));
+      }
+      const teamName = options.team ?? mergedConfig.team;
 
       // Load and initialize team if specified
       let teamRuntime: TeamRuntime | null = null;
@@ -159,10 +197,14 @@ program
         );
       }
 
+      // Resolve auth from merged config
+      const noAuth = mergedConfig.auth?.disabled ?? false;
+      const serverToken = noAuth ? undefined : (mergedConfig.auth?.secret ?? undefined);
+
       // Create API server
       const server = createAPIServer(
         { eventStore, agentManager, taskManager, messageRouter },
-        { port: parseInt(options.port), host: options.host }
+        { port: parseInt(options.port), host: options.host, serverToken }
       );
 
       // Start server
@@ -171,6 +213,11 @@ program
       console.log(
         chalk.green(`Server running at http://${options.host}:${options.port}`)
       );
+      if (serverToken) {
+        console.log(chalk.gray(`Server token: ${serverToken.substring(0, 8)}...`));
+      } else {
+        console.log(chalk.yellow(`Auth: disabled (MACRO_NO_AUTH)`));
+      }
 
       // Bootstrap team agents after server is running
       if (teamRuntime) {
@@ -185,15 +232,39 @@ program
         );
       }
 
+      // Connect-on-spawn: auto-connect project .opentasks/ dirs when agents spawn
+      if (connectProject) {
+        agentManager.onLifecycleEvent((event) => {
+          if (event.type === "spawned" && event.agent.cwd && connectProject) {
+            connectProject(event.agent.cwd).catch(() => {});
+          }
+        });
+      }
+
       console.log(chalk.gray("Press Ctrl+C to stop"));
 
-      // Handle shutdown
+      // Handle shutdown — best-effort, each step isolated
       process.on("SIGINT", async () => {
         console.log(chalk.yellow("\nShutting down..."));
-        if (teamRuntime) await teamRuntime.teardown();
-        await server.stop();
-        await agentManager.close();
-        await eventStore.close();
+        if (teamRuntime) {
+          try { await teamRuntime.teardown(); } catch (err) {
+            console.error(`[cleanup] Team teardown failed: ${err}`);
+          }
+        }
+        try { await server.stop(); } catch (err) {
+          console.error(`[cleanup] Server stop failed: ${err}`);
+        }
+        try { await agentManager.close(); } catch (err) {
+          console.error(`[cleanup] AgentManager close failed: ${err}`);
+        }
+        if (taskBackendShutdown) {
+          try { await taskBackendShutdown(); } catch (err) {
+            console.error(`[cleanup] Task backend shutdown failed: ${err}`);
+          }
+        }
+        try { await eventStore.close(); } catch (err) {
+          console.error(`[cleanup] EventStore close failed: ${err}`);
+        }
         process.exit(0);
       });
     } catch (error) {
@@ -237,6 +308,21 @@ program
         output: process.stdout,
       });
 
+      // Handle Ctrl+C and SIGTERM to clean up child processes
+      const cleanup = async () => {
+        console.log(chalk.yellow("\nShutting down..."));
+        try { await agentManager.close(); } catch (err) {
+          console.error(`[cleanup] AgentManager close failed: ${err}`);
+        }
+        try { await eventStore.close(); } catch (err) {
+          console.error(`[cleanup] EventStore close failed: ${err}`);
+        }
+        rl.close();
+        process.exit(0);
+      };
+      process.on("SIGINT", cleanup);
+      process.on("SIGTERM", cleanup);
+
       const prompt = () => {
         rl.question(chalk.cyan("You: "), async (input) => {
           const trimmed = input.trim();
@@ -632,7 +718,8 @@ program
       const path = await import("path");
       const os = await import("os");
 
-      const storagePath = path.join(os.homedir(), ".multiagent", "store.json");
+      const baseDir = process.env.MACRO_AGENT_HOME || path.join(os.homedir(), ".multiagent");
+      const storagePath = path.join(baseDir, "store.json");
 
       if (fs.existsSync(storagePath)) {
         fs.unlinkSync(storagePath);
@@ -723,6 +810,20 @@ program
       agentManager = createAgentManager(eventStore, messageRouter);
       const taskManager = createTaskManager(eventStore);
 
+      // Create task backend from merged config
+      const acpMergedConfig = loadMergedConfig(defaultCwd);
+      const taskConfig = loadTaskConfigFromMerged(acpMergedConfig);
+      let acpTaskBackendShutdown: (() => Promise<void>) | undefined;
+      try {
+        const result = await createTaskBackend(taskConfig, eventStore);
+        acpTaskBackendShutdown = result.shutdown;
+      } catch {
+        // Fall back to memory if opentasks connection fails
+        try {
+          await createTaskBackend({ backend: { type: "memory" } }, eventStore);
+        } catch { /* non-critical */ }
+      }
+
       // Create stdio streams for ACP communication
       const input = Readable.toWeb(process.stdin) as ReadableStream<Uint8Array>;
       const output = new WritableStream<Uint8Array>({
@@ -753,13 +854,22 @@ program
         stream
       );
 
-      // Handle graceful shutdown
+      // Handle graceful shutdown — best-effort, each step isolated
       const cleanup = async () => {
         if (agentManager) {
-          await agentManager.close();
+          try { await agentManager.close(); } catch (err) {
+            console.error(`[cleanup] AgentManager close failed: ${err}`);
+          }
+        }
+        if (acpTaskBackendShutdown) {
+          try { await acpTaskBackendShutdown(); } catch (err) {
+            console.error(`[cleanup] Task backend shutdown failed: ${err}`);
+          }
         }
         if (eventStore) {
-          await eventStore.close();
+          try { await eventStore.close(); } catch (err) {
+            console.error(`[cleanup] EventStore close failed: ${err}`);
+          }
         }
         process.exit(0);
       };