nexus-agentd 0.2.5 → 0.3.0

package/dist/control-plane.js

@@ -1,7 +1,9 @@
-import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { ControlPlaneError, validateRuntimeSettings, validateUpdate, validateAgentId, validateOpaqueId, validatePassword, validateKeyName, validateApiKeySecret, validateA2ASecret, validateAgentUrl, defaultAgentCardUrl, clampTimeout, preservedAcpAdvanced, setOptionalString, validHeaderName, safeSecretEqual, cleanString, recordValue, isRecord, errorMessage } from './control-plane-validation.js';
+export { ControlPlaneError } from './control-plane-validation.js';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { chmod, open, readFile, rename, rm } from 'node:fs/promises';
 import path from 'node:path';
-import { hashAdminPassword, validateAdminPassword, verifyAdminPassword } from './auth.js';
+import { hashAdminPassword, verifyAdminPassword } from './auth.js';
 import { loadAgentdConfig } from './config.js';
 import { createDriverRegistry } from './drivers/index.js';
 import { agentdDriverKinds } from './types.js';
@@ -10,12 +12,33 @@ export class AgentdControlPlane {
     configPath;
     config;
     sessions;
+    /** Process-local proof, delivered only through the local CLI / embedding API. */
+    setupToken;
     queue = Promise.resolve();
     usageTimer;
+    keyWatchers = new Set();
+    /** Observe authorization without updating last-used time or retaining a stale scope. */
+    watchApiKey(keyId, secret, agentId, revoked) {
+        const check = () => {
+            const key = this.config.apiKeys?.find((item) => item.id === keyId && item.enabled && safeSecretEqual(item.secret, secret));
+            if (!key || (!key.scope.allAgents && !key.scope.agentIds.includes(agentId))) {
+                this.keyWatchers.delete(check);
+                revoked();
+            }
+        };
+        this.keyWatchers.add(check);
+        check();
+        return () => { this.keyWatchers.delete(check); };
+    }
     constructor(configPath, config, sessions) {
         this.configPath = configPath;
         this.config = config;
         this.sessions = sessions;
+        if (!config.adminPasswordHash)
+            this.setupToken = randomBytes(32).toString('base64url');
+    }
+    verifySetupToken(token) {
+        return Boolean(this.setupToken && safeSecretEqual(token, this.setupToken));
     }
     snapshot() {
         return {
@@ -54,6 +77,7 @@ export class AgentdControlPlane {
             if (!Array.isArray(raw.apiKeys))
                 raw.apiKeys = [];
             await this.persist(raw);
+            this.setupToken = undefined;
             return { initialized: true, adminSetupRequired: false };
         });
     }
@@ -188,7 +212,17 @@ export class AgentdControlPlane {
             if (!workspaceRoots.length) {
                 throw new ControlPlaneError(400, 'workspaceRoots must contain at least one path');
             }
-            await WorkspacePolicy.create(workspaceRoots);
+            const policy = await WorkspacePolicy.create(workspaceRoots);
+            for (const [id, agent] of Object.entries(this.config.agents)) {
+                if (agent.protocol === 'a2a' || !agent.workspace)
+                    continue;
+                try {
+                    await policy.resolve(agent.workspace);
+                }
+                catch {
+                    throw new ControlPlaneError(409, `Workspace change would exclude agent: ${id}`);
+                }
+            }
             const raw = await this.readRawConfig();
             raw.workspaceRoots = workspaceRoots;
             await this.persist(raw);
@@ -240,7 +274,7 @@ export class AgentdControlPlane {
         const agents = recordValue(raw.agents);
         const previous = recordValue(agents[id]);
         let next;
-        const protocol = update.protocol || 'acp';
+        const protocol = update.protocol || previous.protocol || 'acp';
         if (protocol === 'a2a') {
             const requestedAgentCardUrl = cleanString(update.agentCardUrl);
             const requestedAgentUrl = cleanString(update.agentUrl);
@@ -284,8 +318,14 @@ export class AgentdControlPlane {
                     ...(authType !== 'none' ? { value: authValue } : {}),
                     ...(authType === 'header' ? { headerName: authHeaderName } : {})
                 },
-                timeoutMs: clampTimeout(update.timeoutMs, 60_000, 1000, 30 * 60_000)
+                timeoutMs: clampTimeout(update.timeoutMs ?? previous.timeoutMs, 60_000, 1000, 30 * 60_000)
             };
+            for (const field of ['taskTimeoutMs', 'streamIdleTimeoutMs']) {
+                const value = update[field] === undefined ? previous[field] : update[field];
+                if (value != null) {
+                    next[field] = clampTimeout(value, 60_000, field === 'taskTimeoutMs' ? 10_000 : 1000, field === 'taskTimeoutMs' ? 24 * 60 * 60_000 : 30 * 60_000);
+                }
+            }
         }
         else {
             const driver = update.driver || cleanString(previous.driver);
@@ -304,7 +344,7 @@ export class AgentdControlPlane {
                 enabled: update.enabled ?? previous.enabled !== false,
                 workspace,
                 permissionPolicy: update.permissionPolicy || cleanString(previous.permissionPolicy) || 'ask',
-                permissionTimeoutMs: clampTimeout(update.permissionTimeoutMs, 15 * 60_000, 1000, 24 * 60 * 60 * 1000),
+                permissionTimeoutMs: clampTimeout(update.permissionTimeoutMs ?? previous.permissionTimeoutMs, 15 * 60_000, 1000, 24 * 60 * 60 * 1000),
                 ...preservedAcpAdvanced(previous)
             };
             if (cleanString(update.name) || cleanString(previous.name)) {
@@ -323,7 +363,7 @@ export class AgentdControlPlane {
         }
         const agentIds = Array.from(new Set(input.agentIds.map(validateAgentId)));
         for (const id of agentIds) {
-            if (!this.config.agents[id]) {
+            if (!Object.hasOwn(this.config.agents, id)) {
                 throw new ControlPlaneError(400, `Configured agent not found: ${id}`);
             }
         }
@@ -435,6 +475,8 @@ export class AgentdControlPlane {
             await chmod(target, 0o600).catch(() => undefined);
             this.config = nextConfig;
             this.sessions.reconfigure(nextConfig, workspacePolicy, drivers);
+            for (const check of this.keyWatchers)
+                check();
         }
         finally {
             if (!moved)
@@ -457,7 +499,9 @@ export class AgentdControlPlane {
                     headerName: config.auth?.headerName,
                     configured: Boolean(config.auth?.value)
                 },
-                timeoutMs: config.timeoutMs || 60_000
+                timeoutMs: config.timeoutMs || 60_000,
+                taskTimeoutMs: config.taskTimeoutMs,
+                streamIdleTimeoutMs: config.streamIdleTimeoutMs
             };
         }
         return {
@@ -478,153 +522,3 @@ export class AgentdControlPlane {
         return result;
     }
 }
-export class ControlPlaneError extends Error {
-    status;
-    constructor(status, message) {
-        super(message);
-        this.status = status;
-    }
-}
-function validateRuntimeSettings(update) {
-    validateIntegerRange(update.sessionTtlMs, 60_000, 30 * 24 * 60 * 60 * 1000, 'sessionTtlMs');
-    validateIntegerRange(update.promptTimeoutMs, 10_000, 24 * 60 * 60 * 1000, 'promptTimeoutMs');
-    validateIntegerRange(update.cleanupIntervalMs, 5_000, 60 * 60 * 1000, 'cleanupIntervalMs');
-}
-function validateIntegerRange(value, min, max, name) {
-    if (!Number.isInteger(value) || value < min || value > max) {
-        throw new ControlPlaneError(400, `${name} must be between ${min} and ${max}`);
-    }
-}
-function validateUpdate(update) {
-    if (update.protocol !== undefined && update.protocol !== 'acp' && update.protocol !== 'a2a') {
-        throw new ControlPlaneError(400, 'protocol must be acp or a2a');
-    }
-    if (update.permissionPolicy !== undefined &&
-        update.permissionPolicy !== 'ask' &&
-        update.permissionPolicy !== 'allow' &&
-        update.permissionPolicy !== 'deny') {
-        throw new ControlPlaneError(400, 'permissionPolicy must be ask, allow, or deny');
-    }
-    if (update.preferredTransport !== undefined &&
-        !['auto', 'jsonrpc', 'http-json'].includes(update.preferredTransport)) {
-        throw new ControlPlaneError(400, 'preferredTransport must be auto, jsonrpc, or http-json');
-    }
-}
-function validateAgentId(value) {
-    const id = decodeURIComponent(value).trim().toLowerCase();
-    if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(id)) {
-        throw new ControlPlaneError(400, 'Invalid Agent ID');
-    }
-    return id;
-}
-function validateOpaqueId(value, label) {
-    const id = decodeURIComponent(value).trim();
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(id)) {
-        throw new ControlPlaneError(400, `Invalid ${label} ID`);
-    }
-    return id;
-}
-function validatePassword(value, confirmation) {
-    if (value !== confirmation) {
-        throw new ControlPlaneError(400, 'Console Password confirmation does not match');
-    }
-    try {
-        return validateAdminPassword(value);
-    }
-    catch (error) {
-        throw new ControlPlaneError(400, errorMessage(error));
-    }
-}
-function validateKeyName(value) {
-    const name = cleanString(value);
-    if (!name)
-        throw new ControlPlaneError(400, 'API Key name is required');
-    if (name.length > 80)
-        throw new ControlPlaneError(400, 'API Key name is too long');
-    return name;
-}
-function validateApiKeySecret(value) {
-    const secret = cleanString(value);
-    if (secret.length < 16) {
-        throw new ControlPlaneError(400, 'Custom API Key must contain at least 16 characters');
-    }
-    if (Buffer.byteLength(secret, 'utf8') > 512) {
-        throw new ControlPlaneError(400, 'Custom API Key must not exceed 512 bytes');
-    }
-    if (/^env:/i.test(secret) || /[\u0000-\u001f\u007f]/.test(secret)) {
-        throw new ControlPlaneError(400, 'Custom API Key contains an unsupported value');
-    }
-    return secret;
-}
-function validateA2ASecret(value) {
-    const secret = cleanString(value);
-    if (!secret)
-        return '';
-    if (/^env:/i.test(secret) ||
-        Buffer.byteLength(secret, 'utf8') > 4096 ||
-        /[\u0000\r\n]/.test(secret)) {
-        throw new ControlPlaneError(400, 'A2A authentication value is invalid');
-    }
-    return secret;
-}
-function validateAgentUrl(value) {
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new ControlPlaneError(400, 'A2A Agent Card URL is invalid');
-    }
-    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) {
-        throw new ControlPlaneError(400, 'A2A Agent Card URL must use http(s) without credentials or a fragment');
-    }
-    return url.toString().replace(/\/$/, '');
-}
-function defaultAgentCardUrl(agentUrl) {
-    if (!agentUrl)
-        return undefined;
-    return new URL('/.well-known/agent-card.json', agentUrl).toString();
-}
-function clampTimeout(value, fallback, min, max) {
-    if (value === undefined)
-        return fallback;
-    if (!Number.isInteger(value) || value < min || value > max) {
-        throw new ControlPlaneError(400, `timeout must be between ${min} and ${max}`);
-    }
-    return value;
-}
-function preservedAcpAdvanced(previous) {
-    const result = {};
-    for (const key of ['command', 'args', 'inheritEnv', 'env']) {
-        if (previous[key] !== undefined)
-            result[key] = structuredClone(previous[key]);
-    }
-    return result;
-}
-function setOptionalString(target, key, value) {
-    const text = cleanString(value);
-    if (text)
-        target[key] = text;
-    else
-        delete target[key];
-}
-function validHeaderName(value) {
-    return /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(value);
-}
-function safeSecretEqual(left, right) {
-    const leftBuffer = Buffer.from(left);
-    const rightBuffer = Buffer.from(right);
-    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
-}
-function cleanString(value) {
-    return typeof value === 'string' ? value.trim() : '';
-}
-function recordValue(value) {
-    return isRecord(value) ? { ...value } : {};
-}
-function isRecord(value) {
-    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
-}
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/drivers/index.js

@@ -4,6 +4,7 @@ import { createHermesDriver } from './hermes.js';
 import { createOpenCodeDriver } from './opencode.js';
 import { createOpenClawDriver } from './openclaw.js';
 import { createPiDriver } from './pi.js';
+import { createStdioAcpDriver } from './stdio.js';
 export function createDriverRegistry(config) {
     const drivers = new Map();
     for (const [id, driver] of Object.entries(config.agents)) {
@@ -12,6 +13,17 @@ export function createDriverRegistry(config) {
         if (driver.enabled === false)
             continue;
         switch (driver.driver) {
+            case 'stdio':
+                if (!driver.command)
+                    break;
+                drivers.set(id, createStdioAcpDriver(id, driver, {
+                    name: driver.name || id,
+                    description: driver.description || 'Custom ACP agent over stdio',
+                    command: driver.command,
+                    args: driver.args || [],
+                    probeArgs: driver.probeArgs
+                }));
+                break;
             case 'opencode':
                 drivers.set(id, createOpenCodeDriver(id, driver));
                 break;

package/dist/drivers/pi.js

@@ -15,7 +15,7 @@ export function createPiDriver(id, config) {
                 return adapter;
             const command = driver.env.PI_ACP_PI_COMMAND || 'pi';
             try {
-                const version = await probeCommand(command, ['--version'], driver.env, 'Pi runtime');
+                const version = await probeCommand(command, ['--version'], driver.env, 'Pi runtime', { ownsProcessGroup: process.platform !== 'win32' });
                 return { ...adapter, version };
             }
             catch (error) {

package/dist/drivers/stdio.d.ts

@@ -10,4 +10,7 @@ export interface StdioAcpDriverDefaults {
 }
 export declare function createStdioAcpDriver(id: string, config: AgentdDriverConfig, defaults: StdioAcpDriverDefaults): AgentDriver;
 export declare function buildEnvironment(config: AgentdDriverConfig, defaults?: Record<string, string>): NodeJS.ProcessEnv;
-export declare function probeCommand(command: string, args: string[], env: NodeJS.ProcessEnv, label: string): Promise<string>;
+export declare function probeCommand(command: string, args: string[], env: NodeJS.ProcessEnv, label: string, options?: {
+    ownsProcessGroup?: boolean;
+    timeoutMs?: number;
+}): Promise<string>;

package/dist/drivers/stdio.js

@@ -1,5 +1,9 @@
 import { spawn } from 'node:child_process';
+import { existsSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { resolveSecret } from '../config.js';
+import { terminateProcessTree } from '../process-tree.js';
 const BASE_ENV_KEYS = [
     'PATH',
     'HOME',
@@ -11,7 +15,17 @@ const BASE_ENV_KEYS = [
     'TMPDIR',
     'TEMP',
     'LANG',
-    'LC_ALL'
+    'LC_ALL',
+    // Node's Windows process creation and a number of ACP launchers require
+    // these values even when the command itself is an absolute path.
+    'SystemRoot',
+    'ComSpec',
+    'USERPROFILE',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'ProgramFiles',
+    'ProgramFiles(x86)',
+    'PATHEXT'
 ];
 export function createStdioAcpDriver(id, config, defaults) {
     const command = config.command || defaults.command;
@@ -31,7 +45,7 @@ export function createStdioAcpDriver(id, config, defaults) {
         ownsProcessGroup: process.platform !== 'win32',
         async probe() {
             try {
-                const version = await probeCommand(command, defaults.probeArgs || ['--version'], env, name);
+                const version = await probeCommand(command, config.probeArgs || defaults.probeArgs || ['--version'], env, name, { ownsProcessGroup: process.platform !== 'win32' });
                 return {
                     id,
                     name,
@@ -53,7 +67,7 @@ export function createStdioAcpDriver(id, config, defaults) {
             }
         },
         spawn(workspace) {
-            return spawn(command, args, {
+            return spawnCommand(command, args, {
                 cwd: workspace,
                 env,
                 detached: process.platform !== 'win32',
@@ -75,42 +89,144 @@ export function buildEnvironment(config, defaults = {}) {
     }
     return result;
 }
-export function probeCommand(command, args, env, label) {
+export function probeCommand(command, args, env, label, options = {}) {
     return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
+        const child = spawnCommand(command, args, {
             env,
-            stdio: ['ignore', 'pipe', 'pipe']
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: options.ownsProcessGroup ?? process.platform !== 'win32',
+            windowsHide: true
         });
         let output = '';
         let settled = false;
+        let finishing = false;
+        let timedOut = false;
+        let timer;
         const finish = (error) => {
             if (settled)
                 return;
             settled = true;
-            clearTimeout(timer);
+            if (timer)
+                clearTimeout(timer);
             if (error)
                 reject(error);
             else
                 resolve(output.trim().split(/\r?\n/)[0] || 'unknown');
         };
-        const timer = setTimeout(() => {
-            child.kill();
-            finish(new Error(`${label} probe timed out`));
-        }, 5000);
+        const ownsProcessGroup = options.ownsProcessGroup ?? process.platform !== 'win32';
+        const cleanup = () => terminateProcessTree(child, {
+            ownsProcessGroup,
+            graceMs: 250
+        });
+        const cleanupFailure = (error) => error instanceof Error ? error.message : String(error);
+        const settleExit = (code, signal) => {
+            if (settled || finishing || timedOut)
+                return;
+            finishing = true;
+            if (timer)
+                clearTimeout(timer);
+            // A successful wrapper can leave a child in its process group.
+            // Clean the group before exposing probe success/failure.
+            void cleanup().then(() => {
+                if (timedOut || settled)
+                    return;
+                finishing = false;
+                if (code === 0)
+                    finish();
+                else {
+                    finish(new Error(output.trim() ||
+                        `${label} probe exited with ${signal || code || 'unknown'}`));
+                }
+            }, (error) => {
+                if (settled)
+                    return;
+                finishing = false;
+                finish(new Error(`${label} probe cleanup failed: ${cleanupFailure(error)}`));
+            });
+        };
+        timer = setTimeout(() => {
+            if (settled || finishing || timedOut)
+                return;
+            timedOut = true;
+            finishing = true;
+            if (timer)
+                clearTimeout(timer);
+            // Probe commands are allowed to be wrappers that launch another
+            // process. Wait for tree termination before rejecting so a timed
+            // out health check cannot leave an agent running in the background.
+            void cleanup().then(() => finish(new Error(`${label} probe timed out`)), (error) => finish(new Error(`${label} probe timed out; cleanup failed: ${cleanupFailure(error)}`)));
+        }, options.timeoutMs ?? 5000);
+        timer.unref?.();
         child.stdout.on('data', (chunk) => {
             output = `${output}${String(chunk)}`.slice(-8192);
         });
         child.stderr.on('data', (chunk) => {
             output = `${output}${String(chunk)}`.slice(-8192);
         });
-        child.once('error', (error) => finish(error));
-        child.once('exit', (code, signal) => {
-            if (code === 0)
-                finish();
-            else {
-                finish(new Error(output.trim() ||
-                    `${label} probe exited with ${signal || code || 'unknown'}`));
-            }
+        child.once('error', (error) => {
+            if (settled || finishing || timedOut)
+                return;
+            finishing = true;
+            if (timer)
+                clearTimeout(timer);
+            void cleanup().then(() => finish(error), (cleanupError) => finish(new Error(`${label} probe failed (${error.message}); cleanup failed: ${cleanupFailure(cleanupError)}`)));
         });
+        child.once('exit', (code, signal) => settleExit(code, signal));
     });
 }
+function needsWindowsShell(command) {
+    return process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(command);
+}
+function spawnCommand(command, args, options) {
+    const resolvedCommand = resolveWindowsCommand(command, options.env, options.cwd);
+    if (!needsWindowsShell(resolvedCommand)) {
+        return spawn(resolvedCommand, args, options);
+    }
+    // cmd.exe's /S /C parser needs an outer pair around the complete command
+    // when the batch path itself is quoted; otherwise it treats the first
+    // argument as part of the executable path.
+    const commandLine = `"${[quoteWindowsArg(resolvedCommand), ...args.map(quoteWindowsArg)].join(' ')}"`;
+    return spawn(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', commandLine], {
+        ...options,
+        windowsVerbatimArguments: true,
+        shell: false
+    });
+}
+function resolveWindowsCommand(command, env, cwd) {
+    if (process.platform !== 'win32')
+        return command;
+    const pathValue = env?.PATH || process.env.PATH || '';
+    const directory = cwd instanceof URL ? fileURLToPath(cwd) : cwd || process.cwd();
+    const pathEntries = pathValue.split(path.delimiter).filter(Boolean).map((entry) => entry.replace(/^"|"$/g, ''));
+    const pathExtValue = env?.PATHEXT || process.env.PATHEXT || '.COM;.EXE;.BAT;.CMD';
+    const extensions = pathExtValue
+        .split(';')
+        .map((extension) => extension.trim())
+        .filter((extension) => /^\.(?:com|exe|bat|cmd)$/i.test(extension));
+    // npm installs a POSIX shim without an extension beside its .cmd shim.
+    // That file is not a Windows executable; selecting it makes real npm
+    // commands fail even though a runnable .cmd exists in the same directory.
+    const names = /\.(?:com|exe|bat|cmd)$/i.test(command)
+        ? [command] : extensions.map((extension) => `${command}${extension}`);
+    const candidates = commandHasPath(command)
+        ? names.map((name) => path.resolve(directory, name))
+        : [directory, ...pathEntries].flatMap((entry) => names.map((name) => path.resolve(directory, entry, name)));
+    const match = candidates.find(isRegularFile);
+    return match || command;
+}
+function commandHasPath(command) {
+    return command.includes('\\') || command.includes('/') || path.win32.isAbsolute(command);
+}
+function isRegularFile(file) {
+    try {
+        return existsSync(file) && statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function quoteWindowsArg(value) {
+    if (!/[\s"&()^|<>]/.test(value))
+        return value;
+    return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/g, '$1$1')}"`;
+}

package/dist/events.d.ts

@@ -8,6 +8,15 @@ export declare class SessionEventLog {
     constructor(sessionId: string, maxEvents: number);
     append(type: AgentdEventType, data?: unknown): AgentdEvent;
     after(id?: string): AgentdEvent[];
+    replay(id?: string): {
+        earliestId: string;
+        latestId: string;
+        reset: {
+            reason: string;
+            requestedAfter: string | null;
+        } | undefined;
+        events: AgentdEvent[];
+    };
     subscribe(listener: (event: AgentdEvent) => void): () => boolean;
     get lastId(): string | undefined;
 }

package/dist/events.js

@@ -36,10 +36,23 @@ export class SessionEventLog {
         return event;
     }
     after(id) {
-        const sequence = Number(id || 0);
-        return this.events
-            .filter((event) => Number(event.id) > sequence)
-            .map((event) => structuredClone(event));
+        return this.replay(id).events;
+    }
+    replay(id) {
+        const sequence = id === undefined ? 0 : Number(id);
+        const earliest = Number(this.events[0]?.id || this.sequence + 1);
+        const reason = id !== undefined && (!/^\d+$/.test(id) || !Number.isSafeInteger(sequence))
+            ? 'invalid'
+            : sequence > this.sequence ? 'ahead'
+                : sequence < earliest - 1 ? 'expired' : undefined;
+        return {
+            earliestId: this.events[0]?.id ?? null,
+            latestId: String(this.sequence),
+            reset: reason ? { reason, requestedAfter: id ?? null } : undefined,
+            events: reason ? [] : this.events
+                .filter((event) => Number(event.id) > sequence)
+                .map((event) => structuredClone(event))
+        };
     }
     subscribe(listener) {
         this.listeners.add(listener);

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export declare function startAgentd(configPath: string): Promise<{
     sessions: SessionManager;
     runStore: RunStore;
     controlPlane: AgentdControlPlane;
-    close(): Promise<void>;
+    close: () => Promise<void>;
 }>;
 export declare function closeServer(server: Server, graceMs?: number): Promise<void>;
 export * from './config.js';

package/dist/index.js

@@ -9,24 +9,51 @@ import { WorkspacePolicy } from './workspace.js';
 export async function startAgentd(configPath) {
     const absoluteConfigPath = path.resolve(configPath);
     const config = await loadAgentdConfig(absoluteConfigPath);
-    const runStore = new RunStore(runStorePathForConfig(absoluteConfigPath), 1000, config.maxRequestBytes);
+    const runStore = new RunStore(runStorePathForConfig(absoluteConfigPath), {
+        maxRuns: config.history?.maxRuns ?? 1000,
+        maxTaskChars: config.maxRequestBytes,
+        historyRetentionDays: config.history?.retentionDays ?? 30,
+        historyMaxBytes: config.history?.maxBytes ?? 64 * 1024 * 1024,
+        retentionDays: config.artifacts?.retentionDays ?? 30,
+        maxTotalBytes: config.artifacts?.maxBytes ?? 512 * 1024 * 1024,
+        maxArtifactBytes: config.artifacts?.maxArtifactBytes ?? 12 * 1024 * 1024,
+        maxQueuedBytes: config.artifacts?.maxQueuedBytes ?? 64 * 1024 * 1024
+    });
     await runStore.init();
     const workspacePolicy = await WorkspacePolicy.create(config.workspaceRoots);
     const sessions = new SessionManager(config, workspacePolicy, createDriverRegistry(config), runStore);
     sessions.startCleanup();
     const controlPlane = new AgentdControlPlane(absoluteConfigPath, config, sessions);
     const server = createAgentdServer(config, sessions, controlPlane);
-    await listen(server, config.listen.port, config.listen.host);
+    let closing;
+    const close = () => closing ??= (async () => {
+        const results = await Promise.allSettled([closeServer(server), sessions.shutdown()]);
+        await runStore.flush();
+        const failed = results.find((result) => result.status === 'rejected');
+        if (failed)
+            throw failed.reason;
+    })();
+    try {
+        await listen(server, config.listen.port, config.listen.host);
+    }
+    catch (error) {
+        await sessions.shutdown();
+        await runStore.flush();
+        throw error;
+    }
+    server.on('error', (error) => {
+        console.error(JSON.stringify({ level: 'error', event: 'server_failed', message: error.message }));
+        void close().catch((closeError) => {
+            console.error(JSON.stringify({ level: 'error', event: 'server_shutdown_failed', message: String(closeError) }));
+        });
+    });
     return {
         config,
         server,
         sessions,
         runStore,
         controlPlane,
-        async close() {
-            await Promise.all([closeServer(server), sessions.shutdown()]);
-            await runStore.flush();
-        }
+        close
     };
 }
 function listen(server, port, host) {