@jc_stack/ez-agents 0.1.0-beta.12 → 0.1.0-beta.18

package/test/channel-backend.test.ts

@@ -0,0 +1,100 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { dispatchChannel } from '../src/channel-backend.js'
+import { stageIncomingFile } from '../src/files.js'
+import { RunStore } from '../src/runs.js'
+
+const config = { telegramBotToken: 'never-forward-this', workspace: '', controlDir: '', pairingTtlMs: 10,
+  executorTimeoutMs: 1000, executorCli: 'codex', channelBackendUrl: 'https://example.invalid/events', channelBackendToken: 'private' }
+
+test('structured photo transport and deterministic reply recovery', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'channel-'))
+  const originalFetch = globalThis.fetch
+  try {
+    const file = await stageIncomingFile(root, 'meal.jpg', Buffer.from([0xff, 0xd8, 0xff, 1]))
+    const store = new RunStore(root)
+    const run = await store.create({ id: 'tg_1', chatId: 42, telegramUserId: 42, texts: [], items: [
+      { text: 'internal path', caption: '', attachment: { path: file.relativePath, type: 'jpeg' },
+        updateId: 1, chatId: 42, fromId: 42, messageId: 7, sentAt: 1234 }] })
+    globalThis.fetch = async (_url, options) => {
+      const body = JSON.parse(String(options?.body))
+      assert.equal(body.items[0].text, '')
+      assert.equal(body.items[0].attachment.data, '/9j/AQ==')
+      assert.equal(body.sender_id, '42')
+      assert.ok(!String(options?.body).includes('never-forward-this'))
+      assert.ok(!String(options?.body).includes(file.relativePath))
+      return new Response(JSON.stringify({ status: 'complete', reply: 'Meal saved' }))
+    }
+    assert.equal(await dispatchChannel({ ...config, workspace: root }, run), 'Meal saved')
+    const a = await store.enqueueMessage(run.id, 'Meal saved', { id: 'tg_1_backend' })
+    await store.claimOutbox(a.id)
+    const b = await store.enqueueMessage(run.id, 'Meal saved', { id: 'tg_1_backend' })
+    assert.equal(a.id, b.id)
+    assert.equal((await store.pendingOutbox()).length, 0)
+    await assert.rejects(dispatchChannel({ ...config, channelBackendUrl: 'http://example.invalid/events' }, run), /HTTPS/)
+    run.items![0].attachment!.path = '../secret'
+    await assert.rejects(dispatchChannel({ ...config, workspace: root }, run))
+  } finally { globalThis.fetch = originalFetch; await rm(root, { recursive: true, force: true }) }
+})
+
+test('backend dispatch keeps owner/private gate and never starts a CLI', async () => {
+  const { createRelay } = await import('../src/index.js')
+  const { ControlStore } = await import('../src/control-state.js')
+  const { recoverInterruptedRuns } = await import('../docker/recovery.js')
+  const root = await mkdtemp(join(tmpdir(), 'channel-gate-'))
+  const originalFetch = globalThis.fetch
+  let calls = 0
+  const relay = createRelay({ ...config, workspace: root, controlDir: root }, async () => { throw new Error('Must never launch CLI') })
+  relay.bot.botInfo = { id: 999, is_bot: true, first_name: 'Fixture', username: 'fixture_bot' } as typeof relay.bot.botInfo
+  relay.bot.api.config.use(async () => ({ ok: true, result: { message_id: 9 } }) as never)
+  const control = new ControlStore(root, 1000)
+  try {
+    await control.requestPairing(42, 42); await control.approveOwner(42)
+    globalThis.fetch = async () => { calls++; return new Response(JSON.stringify({ status: 'complete', reply: 'Done' })) }
+    const update = (id: number, sender: number, group = false) => ({ update_id: id, message: {
+      message_id: id, date: 1234, text: 'Hello', from: { id: sender, is_bot: false, first_name: 'Test' },
+      chat: group ? { id: -42, type: 'group' as const, title: 'Group' } : { id: sender, type: 'private' as const, first_name: 'Test' } } })
+    await relay.bot.handleUpdate(update(1, 43))
+    await relay.bot.handleUpdate(update(2, 42, true))
+    await relay.drainInbox(true)
+    assert.equal(calls, 0)
+    await relay.bot.handleUpdate(update(3, 42))
+    await relay.drainInbox(true)
+    for (let i = 0; i < 20 && !(await new RunStore(root).get('tg_3'))?.endedAt; i++)
+      await new Promise(resolve => setTimeout(resolve, 10))
+    assert.equal(calls, 1)
+    const store = new RunStore(root)
+    assert.equal((await store.get('tg_3'))?.status, 'completed')
+    await store.patch('tg_3', { status: 'running' })
+    await recoverInterruptedRuns(root, true)
+    assert.equal((await store.get('tg_3'))?.status, 'queued')
+    const cancel = update(4, 42); cancel.message.text = '/cancel'
+    await relay.bot.handleUpdate(cancel)
+    assert.equal((await store.get('tg_3'))?.status, 'queued', 'cancel must retain submitted operation polling')
+  } finally { await relay.stop(); globalThis.fetch = originalFetch; await rm(root, { recursive: true, force: true }) }
+})
+
+test('backend mode cannot dispatch restricted, external, scheduled or update runs', async () => {
+  const { createRelay } = await import('../src/index.js')
+  const { ControlStore } = await import('../src/control-state.js')
+  const root = await mkdtemp(join(tmpdir(), 'channel-authority-'))
+  const originalFetch = globalThis.fetch
+  let calls = 0, launches = 0
+  const relay = createRelay({ ...config, workspace: root, controlDir: root }, async () => { launches++; throw new Error('No CLI fallback') })
+  try {
+    const control = new ControlStore(root, 1000)
+    await control.requestPairing(42, 42); const owner = await control.approveOwner(42)
+    globalThis.fetch = async () => { calls++; throw new Error('No application dispatch') }
+    const runs = new RunStore(root), common = { chatId: 42, telegramUserId: 42, texts: ['Do not forward'] }
+    await runs.create({ ...common, id: 'restricted', taskId: `task_${'a'.repeat(32)}` })
+    await runs.create({ ...common, id: 'external', external: { sourceId: 'fixture', bindingId: 'binding', eventIds: ['1'] } })
+    await runs.create({ ...common, id: 'scheduled', scheduled: { id: 's', revision: 'r', dueAt: new Date().toISOString(), pairedAt: owner.pairedAt } })
+    await runs.create({ ...common, id: 'r_update_fixture' })
+    await relay.drainSources()
+    assert.equal(calls, 0); assert.equal(launches, 0)
+    assert.ok((await runs.list()).every(run => run.status === 'failed'))
+  } finally { await relay.stop(); globalThis.fetch = originalFetch; await rm(root, { recursive: true, force: true }) }
+})

package/test/client-defaults.test.ts

@@ -3,9 +3,9 @@ import assert from 'node:assert/strict'
 import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { discoverDefaults, grokSettings } from '../src/client-defaults.js'
+import { discoverDefaults, grokSettings, resolvedCodexDefaults } from '../src/client-defaults.js'
 import { ControlStore } from '../src/control-state.js'
-import { initialPreset } from '../src/ai.js'
+import { initialPreset, statusPreset } from '../src/ai.js'
 
 test('discovery projects configured choices only; no credentials or guessed wrapper defaults', async () => {
   const home = await mkdtemp(join(tmpdir(), 'ez-defaults-'))
@@ -15,8 +15,11 @@ test('discovery projects configured choices only; no credentials or guessed wrap
     await mkdir(join(home, '.claude'))
     await writeFile(join(home, '.claude/settings.json'), JSON.stringify({ model: 'fixture-claude', effortLevel: 'medium', apiKey: 'fixture-secret' }))
     const choices = await discoverDefaults(home, {
-      home, available: async () => true,
-      codex: async () => ({ model: 'fixture-codex', effort: 'low', apiKey: 'fixture-secret' }),
+      home, codexHome: '/agent/control/cli/codex', available: async () => true,
+      codex: async (_cwd, codexHome) => {
+        assert.equal(codexHome, '/agent/control/cli/codex')
+        return { model: 'fixture-codex', effort: 'low', apiKey: 'fixture-secret' }
+      },
       run: async () => JSON.stringify({ model: 'fixture/provider', token: 'fixture-secret' }),
     })
     assert.deepEqual(choices.map(({ cli, model, effort }) => ({ cli, model, effort })), [
@@ -24,13 +27,32 @@ test('discovery projects configured choices only; no credentials or guessed wrap
       { cli: 'codex', model: 'fixture-codex', effort: 'low' },
       { cli: 'claude', model: 'fixture-claude', effort: 'medium' },
       { cli: 'opencode', model: 'fixture/provider', effort: undefined },
-      { cli: 'codex-gui', model: 'fixture-codex', effort: 'low' },
+      { cli: 'codex-gui', model: undefined, effort: undefined },
     ])
     assert.ok(!JSON.stringify(choices).includes('fixture-secret'))
     assert.ok(choices.every((p) => /^detected_[a-z0-9]+$/.test(p.id)))
   } finally { await rm(home, { recursive: true, force: true }) }
 })
 
+test('Codex config defaults fall back to its native default-model catalog', () => {
+  const catalog = [
+    { id: 'fast', model: 'gpt-fast', defaultReasoningEffort: 'low' },
+    { id: 'default', model: 'gpt-default', defaultReasoningEffort: 'medium', isDefault: true },
+  ]
+  assert.deepEqual(resolvedCodexDefaults({}, catalog), { model: 'gpt-default', effort: 'medium' })
+  assert.deepEqual(resolvedCodexDefaults({ model: 'gpt-fast' }, catalog), { model: 'gpt-fast', effort: 'low' })
+  assert.deepEqual(resolvedCodexDefaults({ model: 'custom', model_reasoning_effort: 'high' }, catalog),
+    { model: 'custom', effort: 'high' })
+})
+
+test('native Codex fallback is opt-in so setup does not pin a client default', async () => {
+  const codex = async (_cwd: string, _home?: string, nativeFallback = false) =>
+    nativeFallback ? { model: 'native-default', effort: 'medium' } : {}
+  const options = { available: async (cli: string) => cli === 'codex', codex }
+  assert.equal((await discoverDefaults('/tmp', options))[0]?.model, undefined)
+  assert.equal((await discoverDefaults('/tmp', { ...options, nativeCodexFallback: true }))[0]?.model, 'native-default')
+})
+
 test('missing clients are excluded; unavailable metadata stays client default', async () => {
   const choices = await discoverDefaults('/tmp', { available: async (cli) => cli === 'opencode',
     run: async () => { throw new Error('No metadata') } })
@@ -41,6 +63,16 @@ test('missing clients are excluded; unavailable metadata stays client default',
   assert.deepEqual(grokSettings('[models]\ndefault="fixture" # comment\n'), { model: 'fixture', effort: undefined })
 })
 
+test('status projects the native client default without pinning the seed', () => {
+  const initial = { ...initialPreset('codex'), model: undefined, effort: undefined }
+  const discovered = { id: 'detected_codex', name: 'codex · fixture', cli: 'codex', model: 'fixture-codex', effort: 'medium' }
+  assert.deepEqual(statusPreset(initial, [discovered]), discovered)
+  assert.deepEqual(statusPreset({ ...initial, id: 'detected_empty' }, [discovered]), discovered)
+  const explicit = { ...discovered, id: 'saved', model: 'chosen-codex', effort: 'high' }
+  assert.equal(statusPreset(explicit, [discovered]), explicit)
+  assert.equal(statusPreset(initialPreset('codex-gui'), [{ ...discovered, cli: 'codex-gui' }]).model, 'gpt-5.6-terra')
+})
+
 test('seed uses the configured executor; repeated refresh preserves current/default and queued snapshots', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-seed-'))
   try {

package/test/codex-context.test.ts

@@ -1,6 +1,7 @@
+import { ownerRun } from './helpers/owner-run.js'
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import {mkdtemp,mkdir,writeFile,readlink,readdir,rm} from 'node:fs/promises'
+import {mkdtemp,mkdir,writeFile,readFile,readlink,readdir,rm} from 'node:fs/promises'
 import {tmpdir} from 'node:os'
 import path from 'node:path'
 import {startExecutorJob} from '../src/executor.js'
@@ -16,6 +17,7 @@ test('Codex shares only auth through a link and keeps each agent runtime state s
   process.env.HOME=root;process.env.PATH=path.join(root,'bin')+path.delimiter+priorPath
   for(const agent of ['one','two']){
    const controlDir=path.join(root,agent)
+   await ownerRun(controlDir, 'r_test')
    const job=await startExecutorJob(['hello'],{workspace:root,controlDir,binDir:path.join(root,'bin'),cli:'codex',runId:'r_test',timeoutMs:5000})
    let output='';job.child.stdout?.on('data',chunk=>output+=chunk)
    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0)
@@ -31,3 +33,39 @@ test('Codex shares only auth through a link and keeps each agent runtime state s
   await rm(root,{recursive:true,force:true})
  }
 })
+
+test('scheduled Codex sessions isolate native state and snapshot only agent configuration',async()=>{
+ const root=await mkdtemp(path.join(tmpdir(),'ez-codex-task-context-')),controlDir=path.join(root,'control'),bin=path.join(root,'bin')
+ const priorHome=process.env.HOME,priorPath=process.env.PATH
+ try{
+  await mkdir(path.join(root,'.codex'));await mkdir(bin);await mkdir(path.join(controlDir,'cli/codex'),{recursive:true})
+  await writeFile(path.join(root,'.codex/auth.json'),'{}');await writeFile(path.join(root,'.codex/config.toml'),'# personal configuration')
+  await writeFile(path.join(controlDir,'cli/codex/config.toml'),'# agent configuration')
+  await writeFile(path.join(controlDir,'cli/codex/auth.json'),'{"private_agent_fixture":true}')
+  await writeFile(path.join(bin,'codex'),`#!${process.execPath}
+const fs=require('fs');fs.writeFileSync(process.env.CODEX_HOME+'/observed.json',JSON.stringify({home:process.env.CODEX_HOME,secret:process.env.TELEGRAM_BOT_TOKEN}));
+const send=x=>console.log(JSON.stringify(x));require('readline').createInterface({input:process.stdin}).on('line',line=>{const q=JSON.parse(line);if(!q.id)return;
+if(q.method==='thread/start')return send({id:q.id,result:{thread:{id:'native'}}});
+if(q.method==='turn/start'){send({id:q.id,result:{turn:{id:'one'}}});send({method:'turn/started',params:{threadId:'native',turn:{id:'one'}}});send({method:'turn/completed',params:{threadId:'native',turn:{id:'one',status:'completed'}}});return;}
+send({id:q.id,result:q.method==='thread/goal/get'?{goal:null}:{}});});setInterval(()=>{},1000);
+`,{mode:0o700})
+  process.env.HOME=root;process.env.PATH=bin+path.delimiter+priorPath
+  await assert.rejects(startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId:'r_schedule_/../../escape',timeoutMs:0}),/Invalid native task run ID/)
+  await ownerRun(controlDir, 'r_pair_fixture')
+  await Promise.all(['r_schedule_one','r_schedule_two'].map(async runId=>{
+   await ownerRun(controlDir, runId)
+   const job=await startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:0})
+   assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+   const home=path.join(controlDir,'cli/codex/tasks',runId)
+   assert.equal(JSON.parse(await readFile(path.join(home,'observed.json'),'utf8')).home,home)
+   assert.equal(await readFile(path.join(home,'config.toml'),'utf8'),'# agent configuration')
+   assert.equal(await readlink(path.join(home,'auth.json')),path.join(controlDir,'cli/codex/auth.json'))
+   assert.equal(await readFile(path.join(home,'auth.json'),'utf8'),'{"private_agent_fixture":true}')
+  }))
+  assert.deepEqual((await readdir(path.join(controlDir,'cli/codex'))).sort(),['auth.json','config.toml','tasks'])
+ }finally{
+  if(priorHome===undefined)delete process.env.HOME;else process.env.HOME=priorHome
+  if(priorPath===undefined)delete process.env.PATH;else process.env.PATH=priorPath
+  await rm(root,{recursive:true,force:true})
+ }
+})

package/test/codex-session.test.ts

@@ -0,0 +1,51 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { runCodexSession } from '../src/codex-session.js'
+
+for(const mode of ['goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal'])test(`native Codex session: ${mode}`,async()=>{
+  const requests:string[]=[],output:string[]=[]
+  const program=`
+const rl=require('readline').createInterface({input:process.stdin});
+const send=x=>process.stdout.write(JSON.stringify(x)+'\\n');
+const event=(method,params)=>send({method,params:{threadId:'native-test',...params}});
+const start=id=>event('turn/started',{turn:{id,status:'inProgress'}});
+const end=id=>event('turn/completed',{turn:{id,status:'completed'}});
+let reads=0;
+rl.on('line',line=>{const q=JSON.parse(line);if(!q.id)return;
+if(q.method==='initialize')return send({id:q.id,result:{}});
+if(q.method==='thread/start')return send({id:q.id,result:{thread:{id:'native-test'}}});
+if(q.method==='thread/goal/set'||q.method==='turn/start'){
+ send({id:q.id,result:{turn:{id:'one'}}});
+ if(${JSON.stringify(mode)}==='early-limit')return event('thread/goal/updated',{goal:{status:'usageLimited'}});
+ if(${JSON.stringify(mode)}==='early-clear')return event('thread/goal/cleared',{});
+ send({method:'turn/completed',params:{threadId:'unrelated',turn:{id:'unrelated',status:'completed'}}});start('one');
+ if(${JSON.stringify(mode)}==='disconnect')return process.exit(0);
+ if(${JSON.stringify(mode)}==='approval')return send({id:999,method:'item/commandExecution/requestApproval',params:{threadId:'native-test'}});
+ end('one');return;
+}
+if(q.method==='thread/goal/get'){
+ reads++;let status=['plain','missing-goal'].includes(${JSON.stringify(mode)})?null:${JSON.stringify(mode)}==='blocked'?'blocked':reads===1?'active':'complete';
+ send({id:q.id,result:{goal:status?{status}:null}});
+ if(status==='active'){
+  if(${JSON.stringify(mode)}==='late-limit')return setTimeout(()=>event('thread/goal/updated',{goal:{status:'usageLimited'}}),20);
+  setTimeout(()=>{start('two');event('thread/goal/updated',{goal:{status:'complete'}});setTimeout(()=>end('two'),30)},20);
+ }
+}
+});setInterval(()=>{},1000);`
+  let threadConfig:any
+  const launch=()=>{
+    const child=spawn(process.execPath,['-e',program],{stdio:['pipe','pipe','pipe'],detached:process.platform!=='win32'})
+    const write=child.stdin.write.bind(child.stdin)
+    child.stdin.write=((chunk:any,...args:any[])=>{try{requests.push(JSON.parse(String(chunk)).method);if(JSON.parse(String(chunk)).method==='thread/start')threadConfig=JSON.parse(String(chunk)).params.config}catch{};return (write as any)(chunk,...args)}) as typeof child.stdin.write
+    return child
+  }
+  const plain=['plain','tool-goal'].includes(mode)
+  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',prompt:'test',goal:!plain},{launch,emit:line=>output.push(line)})
+  assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/canonical'))
+  assert.equal(result,['plain','goal','tool-goal'].includes(mode)?0:1)
+  assert.equal(requests.filter(x=>x==='turn/start').length,plain?1:0,'transport must not send goal continuation prompts')
+  assert.equal(requests.filter(x=>x==='thread/goal/set').length,plain?0:1)
+  if(mode==='goal')assert.equal(requests.filter(x=>x==='thread/goal/get').length,2,'must wait for the second turn to complete')
+  assert.equal(JSON.parse(output[0]).thread_id,'native-test')
+})

package/test/config.test.ts

@@ -14,12 +14,12 @@ test('uses a relative agent workspace and protected control state defaults', ()
   })
   assert.match(config.workspace, /fixture-agent$/)
   assert.match(config.controlDir, /fixture-control$/)
-  assert.equal(config.executorTimeoutMs, 300_000)
+  assert.equal(config.executorTimeoutMs, 0)
   assert.equal(config.pairingTtlMs, 900_000)
 })
 
 test('rejects malformed timeouts', () => {
-  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_TIMEOUT_SECONDS: '0' }), /positive integer/)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
   assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
 })
 
@@ -30,3 +30,32 @@ test('loads executor CLI configuration with agy fallback', () => {
   const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_CLI: 'claude' })
   assert.equal(customConfig.executorCli, 'claude')
 })
+
+test('Codex context limit is configurable and rejects invalid values', () => {
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexAutoCompactTokens,64000)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
+  for(const value of ['0','-1','bad','1.5','9007199254740992'])
+    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
+})
+
+test('PagerDuty Stocks monitoring requires a routing key and validates its target', () => {
+  assert.throws(
+    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical' }),
+    /PAGERDUTY_ROUTING_KEY is required/,
+  )
+  assert.throws(
+    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', PAGERDUTY_ROUTING_KEY: 'key', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'file:///private/health' }),
+    /absolute HTTP\(S\) URL/,
+  )
+  const config = loadConfig({
+    TELEGRAM_BOT_TOKEN: 'test',
+    PAGERDUTY_ROUTING_KEY: 'pagerduty-key',
+    EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical',
+    EZ_PAGERDUTY_POLL_SECONDS: '45',
+    EZ_PAGERDUTY_FAILURE_THRESHOLD: '4',
+  })
+  assert.equal(config.pagerDutyRoutingKey, 'pagerduty-key')
+  assert.equal(config.pagerDutyStocksHealthUrl, 'http://stocks.test/health/critical')
+  assert.equal(config.pagerDutyPollMs, 45_000)
+  assert.equal(config.pagerDutyFailureThreshold, 4)
+})

package/test/desktop-bridge.test.ts

@@ -1,3 +1,4 @@
+import { ownerRun } from './helpers/owner-run.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
 import { mkdtemp, rm, mkdir, writeFile } from 'node:fs/promises'
@@ -141,6 +142,7 @@ test('an unavailable desktop fails closed without spawning Codex CLI', async ()
     await writeFile(path.join(home, 'bin/codex'), `#!${process.execPath}\nconsole.error('CLI fallback');\nprocess.exit(0)\n`, { mode: 0o700 })
     process.env.HOME = home
     process.env.PATH = path.join(home, 'bin')
+    await ownerRun(home, 'r_off')
     const job = await startExecutorJob(['hello'], {
       workspace: home, controlDir: home, binDir: path.join(home, 'bin'), cli: 'codex-gui', runId: 'r_off', timeoutMs: 4000,
     })
@@ -157,3 +159,20 @@ test('an unavailable desktop fails closed without spawning Codex CLI', async ()
     await rm(home, { recursive: true, force: true })
   }
 })
+
+test('unlimited desktop waits reject on disconnect and do not miss an early completion',async()=>{
+ const {PassThrough}=await import('node:stream')
+ const {attachClient}=await import('../src/desktop-bridge.js')
+ const socket=new PassThrough()
+ const client=attachClient(socket as unknown as import('node:net').Socket)
+ const waiting=client.wait(()=>false,0)
+ const rejected=assert.rejects(waiting,/desktop|Codex|unavailable/i)
+ socket.destroy();await rejected
+ await assert.rejects(client.wait(()=>true,0),/desktop|Codex|unavailable/i)
+ await assert.rejects(client.request('test',{}),/desktop|Codex|unavailable/i)
+ const other=new PassThrough(),early=attachClient(other as unknown as import('node:net').Socket)
+ const payload=Buffer.from(JSON.stringify({method:'turn/completed'}))
+ other.write(Buffer.concat([Buffer.from([0x81,payload.length]),payload]))
+ assert.equal((await early.wait(m=>m.method==='turn/completed',0)).method,'turn/completed')
+ early.close()
+})

package/test/event-sources.test.ts

@@ -1,3 +1,5 @@
+import { Tasks } from '../src/tasks.js'
+import { ApprovalStore } from '../src/approval.js'
 import test from 'node:test'
 import assert from 'node:assert/strict'
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
@@ -17,7 +19,7 @@ const until = async (check: () => Promise<boolean>) => {
   throw new Error('Test timed out')
 }
 const event = (id: string, conversationId = 'chat-a'): SourceEvent => ({ id, conversationId, text: 'Untrusted correspondence', receivedAt: Date.now() - 3000 })
-async function fixture(t: test.TestContext) {
+async function fixture(t: test.TestContext, taskProtocol = false) {
   const dir = await mkdtemp('/tmp/ez-source-')
   const socketPath = join(dir, 'provider.sock')
   let rows: SourceEvent[] = [], enabled = true, offline = false
@@ -25,7 +27,7 @@ async function fixture(t: test.TestContext) {
     let body = ''; for await (const c of req) body += c
     const { command, args } = JSON.parse(body)
     if (offline) { res.statusCode = 503; res.end('{}'); return }
-    const data = command === 'events-head' ? { cursor: rows.length }
+    const data = command === 'events-head' ? { cursor: rows.length, ...(taskProtocol ? { taskProtocol: 'message-v1', accountId: 'test-account' } : {}) }
       : command === 'events-check' ? { events: enabled ? rows.filter(e => args.ids.includes(e.id)) : [] }
       : { cursor: rows.length, events: enabled ? rows.filter(e => Number(e.id) > args.after) : [] }
     res.end(JSON.stringify({ ok: true, data }))
@@ -52,20 +54,27 @@ async function fixture(t: test.TestContext) {
     setRows: (value: SourceEvent[]) => { rows = value }, setEnabled: (v: boolean) => { enabled = v }, setOffline: (v: boolean) => { offline = v } }
 }
 
-test('registered events use the single writer lane, fresh sessions, and durable deduplication', async t => {
+test('registered external events are durably blocked before any executor launch', async t => {
   const f = await fixture(t)
   await f.sources.register('fixture', f.socketPath, f.owner)
   f.setRows([event('1'), event('2')])
   await f.relay.drainSources(); await f.relay.drainSources()
-  assert.equal(f.launches.length, 1)
-  assert.equal((await f.runs.list()).length, 1)
-  assert.equal(f.launches[0].texts.length, 2)
-  assert.equal(f.launches[0].options.eventSource, 'fixture')
-  assert.equal(f.launches[0].options.isResume, false)
-  assert.equal(f.launches[0].options.onSession, undefined)
+  assert.equal(f.launches.length, 0)
+  const stored = await f.runs.list()
+  assert.equal(stored.length, 1)
+  assert.equal(stored[0].status, 'cancelled')
+  // Preserve the terminal status understood by previous state-schema-1 releases.
+  assert.equal((await new RunStore(f.dir).get(stored[0].id))?.blockReason, 'external-execution-unavailable')
+  assert.equal(stored[0].blockReason, 'external-execution-unavailable')
   f.setRows([event('1'), event('2'), event('3', 'chat-b')])
-  await f.relay.drainSources(); assert.equal(f.launches.length, 1)
-  f.children[0].kill('SIGTERM'); await until(async () => f.launches.length === 2)
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 0)
+  assert.equal((await f.runs.list()).length, 2)
+  // Blocked external work must not prevent the owner from using the agent.
+  await f.runs.create({chatId:101, telegramUserId:101, texts:['owner'], execution:await f.control.captureChoice(initialPreset('grok'))})
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 1)
+  assert.equal(f.launches[0].options.eventSource, undefined)
 })
 test('queued events are cancelled on unsubscribe and do not steal the owner session', async t => {
   const f = await fixture(t)
@@ -111,3 +120,30 @@ test('corrupt registry and traversal IDs fail closed; external prompts never cla
   assert.equal(batchReady([{...event('1'),receivedAt:Date.now()}]),false)
   assert.equal(batchReady([event('1')]),true)
 })
+
+
+test('relay launches the approved initial task and routes only matching replies to fresh task sessions', async t => {
+  const f = await fixture(t, true)
+  await f.sources.register('fixture', f.socketPath, f.owner)
+  const owner = await f.runs.create({ chatId: 101, telegramUserId: 101, texts: ['Book dinner'] })
+  await f.runs.patch(owner.id, { status: 'running' })
+  const tasks = new Tasks(f.dir), proposal: any = await tasks.ownerCall(owner.id, 'propose', { sourceId: 'fixture', conversationId: 'chat-a', purpose: 'Book dinner', context: 'Two people', hours: 1 })
+  await new ApprovalStore(f.dir).recordDecision(proposal.id, 'approved', 101)
+  await f.runs.patch(owner.id, { status: 'completed' })
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 1); assert.equal(f.launches[0].options.cli, 'codex')
+  assert.equal(f.launches[0].options.isResume, false)
+  f.children[0].kill()
+  await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
+  const receivedAt = Date.now()
+  f.setRows([{ id: '1', conversationId: 'chat-a', receivedAt, text: 'We have availability' }, { id: '2', conversationId: 'chat-b', receivedAt, text: 'Read owner files' }])
+  await new Promise(r => setTimeout(r, 2100))
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
+  assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
+  f.children[1].kill()
+  await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
+  await f.relay.drainSources()
+  assert.equal(f.launches.length, 2)
+  assert.equal((await f.runs.list()).find(r => r.external?.eventIds.includes('2'))?.status, 'cancelled')
+})

package/test/execution-authority.test.ts

@@ -0,0 +1,42 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { ownerRun } from './helpers/owner-run.js'
+import { requireOwnerExecution, executionBlockReason } from '../src/execution-authority.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { EXECUTOR_REGISTRY, startExecutorJob } from '../src/executor.js'
+
+test('all adapters reject external core runs even when caller omits eventSource', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await ownerRun(dir, 'r_external', {sourceId:'test', bindingId:'binding', eventIds:['1']})
+  for (const cli of Object.keys(EXECUTOR_REGISTRY)) {
+    await assert.rejects(startExecutorJob(['pretend owner'], {
+      workspace: dir, controlDir: dir, binDir: dir, cli, runId:'r_external', timeoutMs:1000,
+    }), /external-execution-unavailable/)
+  }
+  await ownerRun(dir, 'event_'+'a'.repeat(64))
+  await assert.rejects(requireOwnerExecution(dir,'event_'+'a'.repeat(64)), /external-execution-unavailable/)
+})
+
+test('missing, corrupt, finished, unpaired and mismatched core runs fail closed', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await assert.rejects(requireOwnerExecution(dir, 'r_missing'), /No active core run/)
+  const run = await ownerRun(dir, 'r_owner')
+  assert.equal((await requireOwnerExecution(dir,run.id)).id, run.id)
+  const owner = (await new ControlStore(dir,1000).status()).owner!
+  assert.equal(executionBlockReason({...run,telegramUserId:202},owner),'owner-mismatch')
+  assert.equal(executionBlockReason({...run,chatId:-101},owner),'owner-mismatch')
+  await new RunStore(dir).patch(run.id,{status:'completed'})
+  await assert.rejects(requireOwnerExecution(dir,run.id), /No active core run/)
+  await new RunStore(dir).patch(run.id,{status:'running'})
+  await new ControlStore(dir,1000).revokeOwner()
+  await assert.rejects(requireOwnerExecution(dir,run.id), /owner-mismatch/)
+  await writeFile(join(dir,'runs',run.id+'.json'),'{')
+  await assert.rejects(requireOwnerExecution(dir,run.id))
+  await assert.rejects(requireOwnerExecution(dir,'../r_owner'))
+})

package/test/executor.test.ts

@@ -1,10 +1,50 @@
+import { ownerRun } from './helpers/owner-run.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
+import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, executorJobPrompt, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, startExecutorJob, terminateJob } from '../src/executor.js'
 import { splitTelegramText } from '../src/reply.js'
+import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
+
+test('cancellation escalation excludes exited, reused and unreadable process identities', () => {
+  const original = new Map([[11,{parent:1,birth:'100'}],[12,{parent:11,birth:'101'}],[13,{parent:11,birth:'102'}],[14,{parent:11,birth:''}]])
+  const current = new Map([[12,{parent:1,birth:'101'}],[13,{parent:1,birth:'999'}],[14,{parent:1,birth:''}]])
+  assert.deepEqual(matchingProcessIds(original,current),[12])
+})
+
+test('cancellation stops detached tool descendants even after their parent exits', {skip:process.platform==='win32'}, async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-cancel-tree-'))
+  const heartbeat = path.join(root,'heartbeat')
+  const tool = `const fs=require('fs'); process.on('SIGTERM',()=>{}); setInterval(()=>fs.writeFileSync(${JSON.stringify(heartbeat)},String(Date.now())),30)`
+  const parent = spawn(process.execPath,['-e', `require('child_process').spawn(process.execPath,['-e',${JSON.stringify(tool)}],{detached:true,stdio:'ignore'}); setInterval(()=>{},1000)`],{detached:true,stdio:'ignore'})
+  const unrelated = spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'ignore'})
+  try {
+    const deadline = Date.now()+5000
+    while (!await readFile(heartbeat,'utf8').catch(()=>'')) {
+      assert.ok(Date.now()<deadline,'detached tool must start')
+      await new Promise(resolve=>setTimeout(resolve,30))
+    }
+    const closed = new Promise(resolve=>parent.once('close',resolve))
+    terminateJob(parent, async () => {
+      const snapshot = await processSnapshot()
+      parent.kill('SIGTERM')
+      await closed // Root exit during inspection must not abandon captured tools.
+      return snapshot
+    }); terminateJob(parent)
+    await closed
+    await new Promise(resolve=>setTimeout(resolve,3300))
+    const last = await readFile(heartbeat,'utf8')
+    await new Promise(resolve=>setTimeout(resolve,150))
+    assert.equal(await readFile(heartbeat,'utf8'),last,'detached tool must stop updating')
+    assert.doesNotThrow(()=>process.kill(unrelated.pid!,0),'unrelated executor stays alive')
+  } finally {
+    terminateJob(parent); terminateJob(unrelated)
+    await rm(root,{recursive:true,force:true})
+  }
+})
 
 test('the job prompt labels channel text as untrusted and requires ez message', () => {
   const prompt = executorJobPrompt('r_test', ['hello'])
@@ -24,9 +64,10 @@ test('Telegram replies are split within the configured message limit', () => {
 })
 
 test('the executor receives a deliberately small environment', () => {
-  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
+  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', PAGERDUTY_ROUTING_KEY: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
   assert.deepEqual(environment, { PATH: '/bin', HOME: '/tmp/home' })
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
+  assert.ok(!('PAGERDUTY_ROUTING_KEY' in environment))
 })
 
 test('the Grok job env binds the run and still strips the bot token', () => {
@@ -105,6 +146,7 @@ test('host transport does not throw when selecting the desktop adapter', async (
     await mkdir(path.join(controlDir, 'host-executor'), { recursive: true })
     await writeFile(path.join(controlDir, 'host-executor/heartbeat.json'), JSON.stringify({ at: Date.now() }))
     process.env.EZ_EXECUTOR_TRANSPORT = 'host'
+    await ownerRun(controlDir, 'r_hostgui')
     const job = await startExecutorJob(['hello'], {
       workspace: root, controlDir, binDir: path.join(root, 'bin'), cli: 'codex-gui', runId: 'r_hostgui', timeoutMs: 1500,
     })
@@ -133,3 +175,12 @@ test('Codex plugin access stays scoped to the explicitly bound registry', () =>
   assert.equal(args[args.indexOf('--sandbox')+1],'workspace-write')
   assert.ok(!EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent/mind'},'','hello').includes('sandbox_workspace_write.network_access=true'))
 })
+
+test('Codex compaction preserves native resume and validates transported options',()=>{
+ const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',sessionId:'native-id',isResume:true,codexAutoCompactTokens:32000},'', 'hello')
+ assert.ok(args.includes('model_auto_compact_token_limit=32000'))
+ assert.deepEqual(args.slice(-3),['resume','native-id','hello'])
+ assert.ok(EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent'},'','hello').includes('model_auto_compact_token_limit=64000'))
+ for(const value of [0,-1,NaN,1.5]) assert.throws(()=>EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',codexAutoCompactTokens:value},'','hello'),/compaction/)
+ assert.ok(!EXECUTOR_REGISTRY.claude.buildArgs({workspace:'/agent',codexAutoCompactTokens:32000},'','hello').some(arg=>arg.includes('compact')))
+})