@jc_stack/ez-agents 0.1.0-beta.12 → 0.1.0-beta.13

package/test/event-sources.test.ts

@@ -1,3 +1,5 @@
+import { Tasks } from '../src/tasks.js'
+import { ApprovalStore } from '../src/approval.js'
 import test from 'node:test'
 import assert from 'node:assert/strict'
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
@@ -17,7 +19,7 @@ const until = async (check: () => Promise<boolean>) => {
   throw new Error('Test timed out')
 }
 const event = (id: string, conversationId = 'chat-a'): SourceEvent => ({ id, conversationId, text: 'Untrusted correspondence', receivedAt: Date.now() - 3000 })
-async function fixture(t: test.TestContext) {
+async function fixture(t: test.TestContext, taskProtocol = false) {
   const dir = await mkdtemp('/tmp/ez-source-')
   const socketPath = join(dir, 'provider.sock')
   let rows: SourceEvent[] = [], enabled = true, offline = false
@@ -25,7 +27,7 @@ async function fixture(t: test.TestContext) {
     let body = ''; for await (const c of req) body += c
     const { command, args } = JSON.parse(body)
     if (offline) { res.statusCode = 503; res.end('{}'); return }
-    const data = command === 'events-head' ? { cursor: rows.length }
+    const data = command === 'events-head' ? { cursor: rows.length, ...(taskProtocol ? { taskProtocol: 'message-v1', accountId: 'test-account' } : {}) }
       : command === 'events-check' ? { events: enabled ? rows.filter(e => args.ids.includes(e.id)) : [] }
       : { cursor: rows.length, events: enabled ? rows.filter(e => Number(e.id) > args.after) : [] }
     res.end(JSON.stringify({ ok: true, data }))
@@ -52,20 +54,27 @@ async function fixture(t: test.TestContext) {
     setRows: (value: SourceEvent[]) => { rows = value }, setEnabled: (v: boolean) => { enabled = v }, setOffline: (v: boolean) => { offline = v } }
 }
 
-test('registered events use the single writer lane, fresh sessions, and durable deduplication', async t => {
+test('registered external events are durably blocked before any executor launch', async t => {
   const f = await fixture(t)
   await f.sources.register('fixture', f.socketPath, f.owner)
   f.setRows([event('1'), event('2')])
   await f.relay.drainSources(); await f.relay.drainSources()
-  assert.equal(f.launches.length, 1)
-  assert.equal((await f.runs.list()).length, 1)
-  assert.equal(f.launches[0].texts.length, 2)
-  assert.equal(f.launches[0].options.eventSource, 'fixture')
-  assert.equal(f.launches[0].options.isResume, false)
-  assert.equal(f.launches[0].options.onSession, undefined)
+  assert.equal(f.launches.length, 0)
+  const stored = await f.runs.list()
+  assert.equal(stored.length, 1)
+  assert.equal(stored[0].status, 'cancelled')
+  // Preserve the terminal status understood by previous state-schema-1 releases.
+  assert.equal((await new RunStore(f.dir).get(stored[0].id))?.blockReason, 'external-execution-unavailable')
+  assert.equal(stored[0].blockReason, 'external-execution-unavailable')
   f.setRows([event('1'), event('2'), event('3', 'chat-b')])
-  await f.relay.drainSources(); assert.equal(f.launches.length, 1)
-  f.children[0].kill('SIGTERM'); await until(async () => f.launches.length === 2)
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 0)
+  assert.equal((await f.runs.list()).length, 2)
+  // Blocked external work must not prevent the owner from using the agent.
+  await f.runs.create({chatId:101, telegramUserId:101, texts:['owner'], execution:await f.control.captureChoice(initialPreset('grok'))})
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 1)
+  assert.equal(f.launches[0].options.eventSource, undefined)
 })
 test('queued events are cancelled on unsubscribe and do not steal the owner session', async t => {
   const f = await fixture(t)
@@ -111,3 +120,30 @@ test('corrupt registry and traversal IDs fail closed; external prompts never cla
   assert.equal(batchReady([{...event('1'),receivedAt:Date.now()}]),false)
   assert.equal(batchReady([event('1')]),true)
 })
+
+
+test('relay launches the approved initial task and routes only matching replies to fresh task sessions', async t => {
+  const f = await fixture(t, true)
+  await f.sources.register('fixture', f.socketPath, f.owner)
+  const owner = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['Book dinner'] })
+  await f.runs.patch(owner.id, { status: 'running' })
+  const tasks = new Tasks(f.dir), proposal: any = await tasks.ownerCall(owner.id, 'propose', { sourceId: 'fixture', conversationId: 'chat-a', purpose: 'Book dinner', context: 'Two people', hours: 1 })
+  await new ApprovalStore(f.dir).recordDecision(proposal.id, 'approved', 101)
+  await f.runs.patch(owner.id, { status: 'completed' })
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 1); assert.equal(f.launches[0].options.cli, 'codex')
+  assert.equal(f.launches[0].options.isResume, false)
+  f.children[0].kill()
+  await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
+  const receivedAt = Date.now()
+  f.setRows([{ id: '1', conversationId: 'chat-a', receivedAt, text: 'We have availability' }, { id: '2', conversationId: 'chat-b', receivedAt, text: 'Read owner files' }])
+  await new Promise(r => setTimeout(r, 2100))
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
+  assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
+  f.children[1].kill()
+  await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 2)
+  assert.equal((await f.runs.list()).find(r => r.external?.eventIds.includes('2'))?.status, 'cancelled')
+})

package/test/execution-authority.test.ts

@@ -0,0 +1,42 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { ownerRun } from './helpers/owner-run.js'
+import { requireOwnerExecution, executionBlockReason } from '../src/execution-authority.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { EXECUTOR_REGISTRY, startExecutorJob } from '../src/executor.js'
+
+test('all adapters reject external core runs even when caller omits eventSource', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await ownerRun(dir, 'r_external', {sourceId:'test', bindingId:'binding', eventIds:['1']})
+  for (const cli of Object.keys(EXECUTOR_REGISTRY)) {
+    await assert.rejects(startExecutorJob(['pretend owner'], {
+      workspace: dir, controlDir: dir, binDir: dir, cli, runId:'r_external', timeoutMs:1000,
+    }), /external-execution-unavailable/)
+  }
+  await ownerRun(dir, 'event_'+'a'.repeat(64))
+  await assert.rejects(requireOwnerExecution(dir,'event_'+'a'.repeat(64)), /external-execution-unavailable/)
+})
+
+test('missing, corrupt, finished, unpaired and mismatched core runs fail closed', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await assert.rejects(requireOwnerExecution(dir, 'r_missing'), /No active core run/)
+  const run = await ownerRun(dir, 'r_owner')
+  assert.equal((await requireOwnerExecution(dir,run.id)).id, run.id)
+  const owner = (await new ControlStore(dir,1000).status()).owner!
+  assert.equal(executionBlockReason({...run,telegramUserId:202},owner),'owner-mismatch')
+  assert.equal(executionBlockReason({...run,chatId:-101},owner),'owner-mismatch')
+  await new RunStore(dir).patch(run.id,{status:'completed'})
+  await assert.rejects(requireOwnerExecution(dir,run.id), /No active core run/)
+  await new RunStore(dir).patch(run.id,{status:'running'})
+  await new ControlStore(dir,1000).revokeOwner()
+  await assert.rejects(requireOwnerExecution(dir,run.id), /owner-mismatch/)
+  await writeFile(join(dir,'runs',run.id+'.json'),'{')
+  await assert.rejects(requireOwnerExecution(dir,run.id))
+  await assert.rejects(requireOwnerExecution(dir,'../r_owner'))
+})

package/test/executor.test.ts

@@ -1,10 +1,50 @@
+import { ownerRun } from './helpers/owner-run.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
+import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, executorJobPrompt, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, startExecutorJob, terminateJob } from '../src/executor.js'
 import { splitTelegramText } from '../src/reply.js'
+import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
+
+test('cancellation escalation excludes exited, reused and unreadable process identities', () => {
+  const original = new Map([[11,{parent:1,birth:'100'}],[12,{parent:11,birth:'101'}],[13,{parent:11,birth:'102'}],[14,{parent:11,birth:''}]])
+  const current = new Map([[12,{parent:1,birth:'101'}],[13,{parent:1,birth:'999'}],[14,{parent:1,birth:''}]])
+  assert.deepEqual(matchingProcessIds(original,current),[12])
+})
+
+test('cancellation stops detached tool descendants even after their parent exits', {skip:process.platform==='win32'}, async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-cancel-tree-'))
+  const heartbeat = path.join(root,'heartbeat')
+  const tool = `const fs=require('fs'); process.on('SIGTERM',()=>{}); setInterval(()=>fs.writeFileSync(${JSON.stringify(heartbeat)},String(Date.now())),30)`
+  const parent = spawn(process.execPath,['-e', `require('child_process').spawn(process.execPath,['-e',${JSON.stringify(tool)}],{detached:true,stdio:'ignore'}); setInterval(()=>{},1000)`],{detached:true,stdio:'ignore'})
+  const unrelated = spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'ignore'})
+  try {
+    const deadline = Date.now()+5000
+    while (!await readFile(heartbeat,'utf8').catch(()=>'')) {
+      assert.ok(Date.now()<deadline,'detached tool must start')
+      await new Promise(resolve=>setTimeout(resolve,30))
+    }
+    const closed = new Promise(resolve=>parent.once('close',resolve))
+    terminateJob(parent, async () => {
+      const snapshot = await processSnapshot()
+      parent.kill('SIGTERM')
+      await closed // Root exit during inspection must not abandon captured tools.
+      return snapshot
+    }); terminateJob(parent)
+    await closed
+    await new Promise(resolve=>setTimeout(resolve,3300))
+    const last = await readFile(heartbeat,'utf8')
+    await new Promise(resolve=>setTimeout(resolve,150))
+    assert.equal(await readFile(heartbeat,'utf8'),last,'detached tool must stop updating')
+    assert.doesNotThrow(()=>process.kill(unrelated.pid!,0),'unrelated executor stays alive')
+  } finally {
+    terminateJob(parent); terminateJob(unrelated)
+    await rm(root,{recursive:true,force:true})
+  }
+})
 
 test('the job prompt labels channel text as untrusted and requires ez message', () => {
   const prompt = executorJobPrompt('r_test', ['hello'])
@@ -105,6 +145,7 @@ test('host transport does not throw when selecting the desktop adapter', async (
     await mkdir(path.join(controlDir, 'host-executor'), { recursive: true })
     await writeFile(path.join(controlDir, 'host-executor/heartbeat.json'), JSON.stringify({ at: Date.now() }))
     process.env.EZ_EXECUTOR_TRANSPORT = 'host'
+    await ownerRun(controlDir, 'r_hostgui')
     const job = await startExecutorJob(['hello'], {
       workspace: root, controlDir, binDir: path.join(root, 'bin'), cli: 'codex-gui', runId: 'r_hostgui', timeoutMs: 1500,
     })

package/test/helpers/owner-run.ts

@@ -0,0 +1,13 @@
+import { ControlStore } from '../../src/control-state.js'
+import { RunStore, type RunRecord } from '../../src/runs.js'
+
+export async function ownerRun(controlDir: string, id: string, external?: RunRecord['external']) {
+  const control = new ControlStore(controlDir, 900_000)
+  if (!(await control.status()).owner) {
+    await control.requestPairing(101, 101)
+    await control.approveOwner(101)
+  }
+  const runs = new RunStore(controlDir)
+  await runs.create({ id, chatId: 101, telegramUserId: 101, texts: ['test'], external })
+  return runs.patch(id, { status: 'running' })
+}

package/test/host-executor.test.ts

@@ -1,3 +1,4 @@
+import { ownerRun } from './helpers/owner-run.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
 import { mkdtemp, mkdir, readFile, writeFile, rm, realpath } from 'node:fs/promises'
@@ -38,6 +39,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       const dir=path.join(agent.controlDir,'host-executor')
       for(let n=0;n<100;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
       assert.equal(JSON.parse(await readFile(path.join(dir,'heartbeat.json'),'utf8')).version,packageVersion)
+      await ownerRun(agent.controlDir, `r_${agent.name}`)
       await writeFile(path.join(dir,`r_${agent.name}.request.json`),JSON.stringify({texts:['test'],options:{workspace:'/wrong',controlDir:'/wrong',toolsHome:'/wrong',cli:'grok',timeoutMs:5000}}))
     }
     for(const agent of agents){
@@ -55,6 +57,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     }
     // Exercise the actual client -> file transport -> host CLI path, not a
     // hand-written smoke request, with the production Telegram batch ID shape.
+    await ownerRun(agents[0].controlDir, 'tg_6293305')
     const client=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),agents[0].controlDir,'tg_6293305'],{stdio:['pipe','pipe','pipe']})
     let stdout='',stderr=''
     client.stdout.on('data',chunk=>stdout+=chunk)
@@ -63,13 +66,16 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     assert.equal(await new Promise(resolve=>client.once('close',resolve)),0,stderr)
     assert.equal(JSON.parse(stdout).run,'tg_6293305')
     const eventId='event_'+'a'.repeat(64)
+    await ownerRun(agents[0].controlDir, eventId, {sourceId:'fixture',bindingId:'binding',eventIds:['1']})
     const eventClient=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),agents[0].controlDir,eventId],{stdio:['pipe','pipe','pipe']})
     let eventOutput='',eventError=''
     eventClient.stdout.on('data',chunk=>eventOutput+=chunk)
     eventClient.stderr.on('data',chunk=>eventError+=chunk)
     eventClient.stdin.end(JSON.stringify({texts:['Untrusted plugin event'],options:{cli:'grok',timeoutMs:5000}}))
-    assert.equal(await new Promise(resolve=>eventClient.once('close',resolve)),0,eventError)
-    assert.equal(JSON.parse(eventOutput).run,eventId)
+    assert.equal(await new Promise(resolve=>eventClient.once('close',resolve)),1,eventError)
+    assert.equal(eventOutput,'')
+    assert.match(eventError,/Host CLI execution failed/)
+    await ownerRun(agents[0].controlDir, 'tg_6293306')
     const switched=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),agents[0].controlDir,'tg_6293306'],{stdio:['pipe','pipe','pipe']})
     let switchedOutput=''
     switched.stdout.on('data',chunk=>switchedOutput+=chunk)
@@ -79,7 +85,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     assert.ok(JSON.parse(switchedOutput).args.includes('--print'))
     await assert.rejects(serveHostExecutor({cli:'grok',agents},new AbortController().signal),/already running/)
     const directory=path.join(agents[0].controlDir,'host-executor')
-    const submit=async(id:string)=>writeFile(path.join(directory,id+'.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',timeoutMs:5000}}))
+    const submit=async(id:string)=>{await ownerRun(agents[0].controlDir,id);await writeFile(path.join(directory,id+'.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',timeoutMs:5000}}))}
     await submit('r_hold')
     for(let n=0;n<100;n++){try{await readFile(path.join(directory,'r_hold.process.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
     await submit('r_queued')

package/test/local-qa.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import {tmpdir} from 'node:os';
+import {execFileSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {digest,extract} from '../src/updates/artifact.mjs';
+
+test('local QA staging preserves source and rejects label replacement and dirty source',async()=>{
+  const root=await fs.mkdtemp(path.join(tmpdir(),'ez-qa-test-'));
+  const source=path.join(root,'repo'),catalog=path.join(root,'catalog'),flow=path.join(root,'QA.md');
+  await fs.mkdir(source);
+  const pkg={name:'@fixture/main',version:'0.1.0-beta.12',files:['feature.txt'],ezRelease:{kind:'main',protocol:1,stateSchema:1,mainProtocol:1}};
+  await fs.writeFile(path.join(source,'package.json'),JSON.stringify(pkg));
+  await fs.writeFile(path.join(source,'feature.txt'),'feature source');
+  await fs.writeFile(flow,'Ask for the feature. Verify its result.');
+  const git=args=>execFileSync('git',args,{cwd:source,stdio:'pipe'}).toString().trim();
+  git(['init']);git(['add','package.json','feature.txt']);
+  git(['-c','user.name=QA','-c','user.email=qa@example.invalid','-c','core.hooksPath=/dev/null','-c','commit.gpgsign=false','commit','-m','fixture']);
+  const script=fileURLToPath(new URL('../scripts/stage-qa.mjs',import.meta.url));
+  const args=[script,'--source',source,'--catalog',catalog,'--label','beta-12','--version','0.1.0-beta.12.qa.1','--flow',flow];
+  const stage=()=>execFileSync(process.execPath,args,{stdio:'pipe'}).toString();
+  try {
+    const result=JSON.parse(stage()),data=await fs.readFile(path.join(result.directory,result.file));
+    assert.equal(result.sha256,digest(data));assert.equal(result.commit,git(['rev-parse','HEAD']));
+    assert.equal(git(['status','--porcelain']),'');
+    await extract(data,path.join(root,'unpacked'));
+    const built=JSON.parse(await fs.readFile(path.join(root,'unpacked/package.json'),'utf8'));
+    assert.equal(built.version,'0.1.0-beta.12.qa.1');assert.equal(built.ezQa.commit,result.commit);
+    assert.equal(await fs.readFile(path.join(root,'unpacked/feature.txt'),'utf8'),'feature source');
+    assert.throws(stage,error=>/QA label already exists/.test(error.stderr.toString()));
+    assert.equal(digest(await fs.readFile(path.join(result.directory,result.file))),result.sha256);
+    await fs.writeFile(path.join(source,'feature.txt'),'unreviewed edit');
+    assert.throws(stage,error=>/Commit the reviewed source/.test(error.stderr.toString()));
+    assert.deepEqual(await fs.readdir(catalog),['beta-12']);
+  } finally {await fs.rm(root,{recursive:true,force:true});}
+});

package/test/plugin-manager.test.mjs

@@ -3,7 +3,8 @@ import assert from 'node:assert/strict';
 import * as fs from 'node:fs/promises';
 import {tmpdir} from 'node:os';
 import path from 'node:path';
-import {execFile} from 'node:child_process';
+import {execFile,spawn} from 'node:child_process';
+import {once} from 'node:events';
 import {promisify} from 'node:util';
 import {snapshot,init as initManager,validate,compose,locked} from '../src/plugins/manager.mjs';
 // Synthetic manager tests explicitly opt out of the product's default packages.
@@ -13,6 +14,20 @@ async function init(home,workspace,catalog,hostConfig) {
  return initManager(home,workspace,catalog||file,hostConfig);
 }
 const exec=promisify(execFile),bin=new URL('../bin/ezenciel-agents-tools.mjs',import.meta.url).pathname;
+for(const cleanup of ['success','failure','already-removed']) test(`cancel removes exact container and reports cleanup ${cleanup}`,async t=>{
+ const root=await fs.mkdtemp(path.join(tmpdir(),'ez-cancel-'));t.after(()=>fs.rm(root,{recursive:true,force:true}));
+ const log=path.join(root,'calls.jsonl');
+ await fs.writeFile(path.join(root,'docker'),`#!${process.execPath}\nconst fs=require('fs'),a=process.argv.slice(2);fs.appendFileSync(${JSON.stringify(log)},JSON.stringify(a)+'\\n');if(a[0]==='container'){${cleanup==='failure'?"console.error('daemon unavailable');process.exit(19)":cleanup==='already-removed'?"console.error('No such container: exact-test-container');process.exit(1)":"process.exit(0)"}}else{process.on('SIGTERM',()=>{});console.log('ready');setInterval(()=>{},1000)}\n`,{mode:0o700});
+ const script=`import {run} from ${JSON.stringify(new URL('../src/plugins/manager.mjs',import.meta.url).href)};try {const r=await run(['run'],{container:'exact-test-container'});process.exitCode=r.code}catch(e){console.error(e.message);process.exitCode=1}`;
+ const child=spawn(process.execPath,['--input-type=module','-e',script],{env:{...process.env,PATH:root+path.delimiter+process.env.PATH},stdio:['ignore','pipe','pipe']});
+ let stderr='';child.stderr.on('data',b=>stderr+=b);
+ t.after(()=>child.kill('SIGKILL'));
+ await once(child.stdout,'data');child.kill('SIGTERM');
+ const [code]=await once(child,'close');
+ assert.equal(code,cleanup==='failure'?1:130);
+ if(cleanup==='failure')assert.match(stderr,/cleanup failed/);
+ assert.deepEqual((await fs.readFile(log,'utf8')).trim().split('\n').map(JSON.parse),[['run'],['container','rm','--force','exact-test-container']]);
+});
 async function fixture(t) {
  const root=await fs.mkdtemp(path.join(tmpdir(),'ez-tools-'));t.after(()=>fs.rm(root,{recursive:true,force:true}));
  const source=path.join(root,'source'),home=path.join(root,'tools'),workspace=path.join(root,'mind'),fake=path.join(root,'fake');
@@ -155,3 +170,57 @@ test('plugin versions accept SemVer beta releases and reject malformed versions'
  for(const version of ['0.1.0','0.1.0-beta.1','1.2.3-rc.0+build.12'])validate({...f.manifest,version},f.deployment,p.files);
  for(const version of ['01.2.3','1.2','1.2.3-beta.01','1.2.3-','1.2.3+','1.2.3/beta',null,{}])assert.throws(()=>validate({...f.manifest,version},f.deployment,p.files),/manifest version/);
 });
+
+
+test('exposure is conservative discovery metadata and does not change literal dispatch',async t=>{
+ const f=await fixture(t);await init(f.home,f.workspace);
+ const before=await snapshot(f.source);
+ const inspect=JSON.parse((await f.call('plugins','inspect','sample','--source',f.source)).stdout);
+ assert.deepEqual(inspect.exposure.sample,{declared:false,receivesExternalContent:true,sendsExternally:true,changesRecords:true,requiresReview:true});
+ f.manifest.commands.sample.exposure={receivesExternalContent:false,changesRecords:false,requiresReview:false};
+ await fs.writeFile(path.join(f.source,'ez-plugin.json'),JSON.stringify(f.manifest));
+ const after=await snapshot(f.source);assert.notEqual(before.revision,after.revision);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',after.revision);
+ const result=JSON.parse((await f.call('tools','exposure')).stdout);
+ assert.deepEqual(result.sample.sample,{declared:true,receivesExternalContent:false,sendsExternally:true,changesRecords:false,requiresReview:false});
+ assert.deepEqual(JSON.parse((await f.call('sample','literal','--account','unchanged')).stdout),['literal','--account','unchanged']);
+ assert.deepEqual(JSON.parse((await f.call('tools','list')).stdout),{sample:'sample'});
+ for(const value of [null,[],true,{receivesExternalContent:'false'},{trusted:true},{requiresReview:'never'}]) {
+  f.manifest.commands.sample.exposure=value;
+  assert.throws(()=>validate(f.manifest,f.deployment,after.files),/exposure/);
+ }
+});
+
+test('standalone CLI has discoverable setup, independent guidance and status without Telegram',async t=>{
+ const f=await fixture(t);
+ const help=JSON.parse((await exec(process.execPath,[bin,'--help'])).stdout);
+ assert.match(help.usage,/--standalone/);
+ await exec(process.execPath,[bin,'init','--standalone','--home',f.home,'--workspace',f.workspace],{env:f.env});
+ const notes=await fs.readFile(path.join(f.workspace,'TOOLS.md'),'utf8');
+ assert.match(notes,/existing local CLI/);
+ assert.doesNotMatch(notes,/Finish the main Telegram|ezenciel-agents-message/);
+ const launcher=path.join(f.home,'bin','ez');
+ const status=JSON.parse((await exec(launcher,['status'],{cwd:f.root,env:f.env})).stdout);
+ assert.equal(status.main,null);assert.deepEqual(status.plugins,[]);
+ assert.equal(status.workspace,await fs.realpath(f.workspace));
+ await assert.rejects(fs.access(f.log)); // no Docker call during initialization/status
+ await assert.rejects(exec(process.execPath,[bin,'init','--standalone','--home',f.home,'--workspace',f.workspace]),/Registry already exists/);
+ await fs.writeFile(path.join(f.home,'registry.json'),'{');
+ await assert.rejects(exec(launcher,['status']),/JSON/);
+});
+
+test('standalone rejects relay binding and preserves literal plugin arguments across callers',async t=>{
+ const f=await fixture(t);
+ await assert.rejects(initManager(f.home,f.workspace,undefined,'/missing/host.json',true),/cannot bind/);
+ await initManager(f.home,f.workspace,undefined,undefined,true);
+ const p=await snapshot(f.source);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const launcher=path.join(f.home,'bin','ez'),args=['sample','--home','/other','$(literal)','--json'];
+ for(const cwd of [f.root,f.workspace,f.source]) {
+  assert.deepEqual(JSON.parse((await exec(launcher,args,{cwd,env:f.env})).stdout),args.slice(1));
+ }
+ const log=(await fs.readFile(f.log,'utf8')).trim().split('\n').map(JSON.parse);
+ assert(log.every(call=>call.secret===undefined));
+ await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify({schemaVersion:1,workspace:f.workspace,catalog:{},deploymentDir:'/missing'}));
+ await assert.rejects(exec(launcher,['status']),/deployment-bound/); // never hide a broken relay binding
+});

package/test/schedule-cli.test.ts

@@ -0,0 +1,49 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { initialPreset } from '../src/ai.js'
+const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
+test('public scheduler CLI saves literal text, reads back, edits, pauses, and rejects external or finished callers',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-schedule-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:'',EZ_EXECUTOR_CLI:'grok'}
+ await assert.rejects(exec(process.execPath,[bin,'list'],{env}),/Pair an owner/)
+ await control.requestPairing(101,101);await control.approveOwner(101)
+ const execution=await control.captureChoice(initialPreset('grok'))
+ const run=await runs.create({chatId:101,telegramUserId:101,texts:['owner request'],execution})
+ await runs.patch(run.id,{status:'running'});env.EZ_RUN_ID=run.id
+ const args=['create','test','--at','2027-09-09T09:00:00+04:00','--text','Literal $(do-not-execute) /goal objective']
+ const saved=JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
+ assert.equal(saved.text,args.at(-1));assert.equal(saved.execution.preset.cli,'grok')
+ assert.equal(saved.nextEligibleAt,'2027-09-09T05:00:00.000Z')
+ await assert.rejects(exec(process.execPath,[bin,...args],{env}),/exists/)
+ assert.equal(JSON.parse((await exec(process.execPath,[bin,'pause','test'],{env})).stdout).enabled,false)
+ assert.equal(JSON.parse((await exec(process.execPath,[bin,'resume','test'],{env})).stdout).enabled,true)
+ await exec(process.execPath,[bin,'edit','test','--cron','0 9 * * 2','--timezone','Asia/Dubai','--text','Tuesday'],{env})
+ assert.equal(JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout).text,'Tuesday')
+ const external=await runs.create({chatId:101,telegramUserId:101,texts:[],execution,external:{sourceId:'source',bindingId:'binding',eventIds:['event']}})
+ await runs.patch(external.id,{status:'running'})
+ await assert.rejects(exec(process.execPath,[bin,'list'],{env:{...env,EZ_RUN_ID:external.id}}),/owner-authorized/)
+ const task=await runs.create({taskId:'task_'+'a'.repeat(32),chatId:101,telegramUserId:101,texts:[]})
+ await runs.patch(task.id,{status:'running'})
+ await assert.rejects(exec(process.execPath,[bin,'list'],{env:{...env,EZ_RUN_ID:task.id}}),/owner-authorized/)
+ const schedule=JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout)
+ const interrupted=await runs.create({chatId:101,telegramUserId:101,texts:['old'],execution,scheduled:{id:'test',revision:schedule.revision,dueAt:new Date().toISOString(),pairedAt:schedule.owner.pairedAt}})
+ await runs.patch(interrupted.id,{status:'failed',interrupted:true})
+ const held=JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout)
+ assert.equal(held.nextEligibleAt,null);assert.deepEqual(held.interruptedRunIds,[interrupted.id])
+ await runs.patch(run.id,{status:'completed'})
+ await assert.rejects(exec(process.execPath,[bin,'list'],{env}),/owner-authorized/)
+})
+
+test('executor PATH exposes the extensionless scheduler command',async()=>{
+ const command=fileURLToPath(new URL('../bin/ezenciel-agents-schedule',import.meta.url))
+ assert.match((await exec(command,['--help'])).stdout,/durable, asynchronous CLI task/)
+})

package/test/scheduler-host.test.ts

@@ -0,0 +1,55 @@
+import { ownerRun } from './helpers/owner-run.js'
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, mkdir, writeFile, readFile, rm, realpath } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { serveHostExecutor } from '../src/host-executor.js'
+import { EXECUTOR_REGISTRY } from '../src/executor.js'
+import { RunStore } from '../src/runs.js'
+
+const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<250;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Host probe timed out')}
+test('host transport reserves separate task and main lanes, pins directories, and cancels only its target',async()=>{
+ const root=await mkdtemp(join(tmpdir(),'ez-scheduler-host-')),workspace=join(root,'agent'),controlDir=join(root,'control')
+ await mkdir(workspace);await mkdir(controlDir)
+ const script=join(root,'fixture.mjs')
+ await writeFile(script,`console.log(JSON.stringify({cwd:process.cwd(),token:process.env.TELEGRAM_BOT_TOKEN,run:process.env.EZ_RUN_ID}));if(process.env.EZ_RUN_ID.startsWith('r_schedule_'))setInterval(()=>{},1000);`)
+ const old={...EXECUTOR_REGISTRY.grok},token=process.env.TELEGRAM_BOT_TOKEN
+ EXECUTOR_REGISTRY.grok.command=process.execPath;EXECUTOR_REGISTRY.grok.buildArgs=()=>[script]
+ process.env.TELEGRAM_BOT_TOKEN='never-in-child'
+ const abort=new AbortController(),server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal)
+ const dir=join(controlDir,'host-executor'),runs=new RunStore(controlDir),id='r_schedule_fixture'
+ const exists=async(file:string)=>readFile(join(dir,file),'utf8').catch(()=>'')
+ try{
+  await until(async()=>Boolean(await exists('heartbeat.json')))
+  await runs.create({id,chatId:101,telegramUserId:101,texts:['slow'],execution:{sessionId:randomUUID(),preset:{id:'fixture',name:'Fixture',cli:'grok'}},scheduled:{id:'s',revision:'v',dueAt:new Date().toISOString(),pairedAt:'paired'}})
+  const submit=async(id:string)=>writeFile(join(dir,id+'.request.json'),JSON.stringify({texts:['fixture'],options:{workspace:'/evil',controlDir:'/evil',cli:'grok',timeoutMs:1}}))
+  await ownerRun(controlDir,'tg_1')
+  await runs.patch(id,{status:'running'})
+  await submit(id)
+  await until(async()=>Boolean(await exists(id+'.process.json')))
+  await submit('tg_1')
+  await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
+  assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
+  const scheduled=JSON.parse(JSON.parse((await exists(id+'.events')).trim().split('\n')[0]).text)
+  const main=JSON.parse(JSON.parse((await exists('tg_1.events')).trim().split('\n')[0]).text)
+  assert.equal(scheduled.cwd,await realpath(join(workspace,'work/tasks',id)));assert.equal(main.cwd,await realpath(workspace))
+  assert.equal(scheduled.token,undefined);assert.equal(main.token,undefined)
+  // A malformed scheduled request must not unwind the shared host service.
+  await writeFile(join(controlDir,'runs/r_schedule_corrupt.json'),'{')
+  await submit('r_schedule_corrupt')
+  await until(async()=>(await exists('r_schedule_corrupt.events')).includes('"stream":"exit","code":1'))
+  assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
+  await ownerRun(controlDir,'tg_2')
+  await submit('tg_2')
+  await until(async()=>(await exists('tg_2.events')).includes('"stream":"exit","code":0'))
+  await writeFile(join(dir,id+'.cancel'),'')
+  await until(async()=>(await exists(id+'.events')).includes('"stream":"exit"'))
+ }finally{
+  abort.abort();await server
+  Object.assign(EXECUTOR_REGISTRY.grok,old)
+  if(token===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=token
+  await rm(root,{recursive:true,force:true})
+ }
+})

package/test/scheduler-relay.test.ts

@@ -0,0 +1,67 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { spawn } from 'node:child_process'
+import { once } from 'node:events'
+import type { Update } from 'grammy/types'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { initialPreset } from '../src/ai.js'
+
+const until=async(check:()=>Promise<boolean>)=>{for(let i=0;i<200;i++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
+test('chat replies through the real ingress/outbox while scheduled CLI remains alive; targeted cancellation',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-scheduler-relay-')), children:ReturnType<typeof spawn>[]=[]
+ const runs=new RunStore(dir),scheduler=new Scheduler(dir),control=new ControlStore(dir,1000)
+ const replies:string[]=[], workspaces:string[]=[]
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async(texts,options)=>{
+  workspaces.push(options.workspace)
+  const background=options.runId.startsWith('r_schedule_')
+  const child=spawn(process.execPath,['-e',background ? 'setInterval(()=>{},1000)' : 'setTimeout(()=>{},100)'],{detached:process.platform!=='win32'})
+  children.push(child);await once(child,'spawn')
+  if(!background)await runs.enqueueMessage(options.runId,'323')
+  return {child,cleanup:async()=>{},stdout:''}
+ })
+ relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as typeof relay.bot.botInfo
+ relay.bot.api.config.use(async(_prev,method,payload)=>{if(method==='sendMessage')replies.push((payload as {text:string}).text);return {ok:true,result:{message_id:42}} as never})
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok'))
+  const due=Date.now()+2000
+  await scheduler.save({id:'slow',name:'Slow',text:'Long work',trigger:{at:new Date(due).toISOString()},enabled:true,owner,execution})
+  await scheduler.tick(owner,runs,due);await relay.drainSources()
+  const [background]=await runs.list()
+  assert.equal(background.status,'running')
+  const update:Update={update_id:123,message:{message_id:123,date:0,text:'What is 17 × 19?',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}}
+  await relay.bot.handleUpdate(update);await relay.drainInbox(true);await relay.drainOutbox()
+  assert.ok(replies.includes('323'))
+  assert.equal((await runs.get(background.id))?.status,'running')
+  assert.equal(children[0].exitCode,null)
+  assert.equal(new Set(workspaces).size,2)
+  // Pausing future dispatch doesn't kill active work; cancelling this run does.
+  await scheduler.enable('slow',false);await relay.drainSources()
+  assert.equal(children[0].exitCode,null)
+  await scheduler.cancel(background.id);await relay.drainSources()
+  await until(async()=> (await runs.get(background.id))?.status==='cancelled')
+  assert.equal((await runs.list()).filter(r=>r.scheduled).length,1)
+  for(let n=0;n<5;n++)await scheduler.save({id:'pool_'+n,name:'Pool',text:'Long work',trigger:{at:new Date(Date.now()+2000).toISOString()},enabled:true,owner,execution})
+  await scheduler.tick(owner,runs,Date.now()+3000);await relay.drainSources()
+  const queued=(await runs.list()).find(r=>r.scheduled && r.status==='queued')!
+  assert.ok(queued)
+  assert.equal((await runs.list()).filter(r=>r.scheduled && r.status==='running').length,4)
+  await scheduler.enable(queued.scheduled!.id,false);await relay.drainSources()
+  assert.equal((await runs.get(queued.id))?.status,'queued')
+  await scheduler.enable(queued.scheduled!.id,true);await scheduler.cancel(queued.id);await relay.drainSources()
+  assert.equal((await runs.get(queued.id))?.status,'cancelled')
+  await relay.bot.handleUpdate({...update,update_id:124,message:{...update.message!,message_id:124,text:'/stop'}} as Update)
+  await until(async()=>!(await runs.list()).some(r=>r.scheduled && r.status==='running'))
+ }finally{
+  await relay.stop()
+  for(const child of children)if(child.exitCode===null && child.signalCode===null)await once(child,'close')
+  await until(async()=>!(await runs.list()).some(r=>r.status==='running'))
+  await rm(dir,{recursive:true,force:true})
+ }
+})