@jc_stack/ez-agents 0.1.0-beta.12 → 0.1.0-beta.18

package/test/telegram-source.test.ts

@@ -0,0 +1,75 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { TelegramSource } from '../src/telegram-source.js'
+import { ControlStore } from '../src/control-state.js'
+import { EventSources } from '../src/event-sources.js'
+import { Tasks } from '../src/tasks.js'
+import { ApprovalStore } from '../src/approval.js'
+import { RunStore } from '../src/runs.js'
+import { requireOwnerExecution } from '../src/execution-authority.js'
+import { ownerRun } from './helpers/owner-run.js'
+
+test('Telegram uses the existing persistent conversation grant, restricted context, receipts and revocation',async t=>{
+  const dir=await mkdtemp('/tmp/ez-tg-test-'),sent:any[]=[]
+  await ownerRun(dir,'owner')
+  const source=new TelegramSource(dir,'999',async(chat,text)=>{sent.push({chat,text});return [sent.length]})
+  t.after(async()=>{await source.stop();await rm(dir,{recursive:true,force:true})})
+  await source.start((await new ControlStore(dir,900000).status()).owner!)
+  const tasks=new Tasks(dir),runs=new RunStore(dir),sources=new EventSources(dir)
+  const message=(chat=-101)=>({message_id:1,date:Math.ceil(Date.now()/1000),chat:{id:chat,type:'group',title:'Family'},text:'Hi Annie'} as any)
+  const sender={id:202,is_bot:false,first_name:'Family member'}
+  assert.equal(await source.capture(1,{...message(),message_id:2},sender),false)
+  await assert.rejects(tasks.ownerCall('owner','propose',{sourceId:'telegram',conversationId:'-101',purpose:'Family chat',context:'Only family-group context',hours:24,untilRevoked:true}),/incoming-only/)
+  const proposed=await tasks.ownerCall('owner','propose',{sourceId:'telegram',conversationId:'-101',purpose:'Family chat',context:'Only family-group context',hours:24,waitForIncoming:true,untilRevoked:true}) as any
+  const approval=new ApprovalStore(dir)
+  assert.match((await approval.getDecision(proposed.id))!.prompt,/until owner revocation/)
+  await tasks.decide(proposed.id)
+  assert.equal(await source.capture(2,message(),sender),false)
+  await approval.recordDecision(proposed.id,'approved',101);await tasks.decide(proposed.id)
+  assert.equal((await runs.list()).length,1) // No opening send or run.
+  assert.equal(await source.capture(3,message(),sender),true)
+  assert.equal(await source.capture(3,message(),sender),true) // Durable duplicate intake.
+  assert.equal(await source.capture(4,message(-202),sender),false)
+  const registration=(await sources.list())[0],batch=await sources.batch(registration)
+  assert.equal(batch.events.length,1)
+  const task=(await tasks.get(proposed.id))!
+  assert.equal(task.version,3)
+  const run=await runs.create({id:'event_group_test',taskId:task.id,chatId:101,telegramUserId:101,texts:[],external:{sourceId:registration.id,bindingId:registration.bindingId,eventIds:batch.events.map(e=>e.id)}})
+  await runs.patch(run.id,{status:'running'})
+  await assert.rejects(requireOwnerExecution(dir,run.id),/blocked/)
+  const context:any=await tasks.workerCall(run.id,'context',{})
+  assert.equal(context.context,'Only family-group context');assert.equal(context.expiresAt,null)
+  assert.match(context.incoming[0].text,/Family member/)
+  await tasks.workerCall(run.id,'send',{text:'Hello!',key:'reply',conversationId:'-202'})
+  await tasks.workerCall(run.id,'send',{text:'Hello!',key:'reply'})
+  assert.deepEqual(sent,[{chat:-101,text:'Hello!'}])
+  await assert.rejects(tasks.workerCall(run.id,'send',{text:'Changed',key:'reply'}),/different text/)
+  await assert.rejects(source.call('task-send',{accountId:'wrong',conversationId:'-101',key:'x',text:'no'}),/binding/)
+  await assert.rejects(tasks.ownerCall(run.id,'propose',{}),/blocked/)
+  // Persistent grants survive more than 30 total replies, with per-run keys.
+  for(let i=0;i<31;i++) {
+    const next=await runs.create({id:`event_followup_${i}`,taskId:task.id,chatId:101,telegramUserId:101,texts:[],external:run.external})
+    await runs.patch(next.id,{status:'running'})
+    await tasks.workerCall(next.id,'send',{text:`Reply ${i}`,key:'reply'})
+    await runs.patch(next.id,{status:'completed'})
+  }
+  assert.equal(sent.length,32)
+  // Update IDs may move backwards after idle; local cursors must still advance.
+  await sources.advance(registration,batch.cursor)
+  assert.equal(await source.capture(1,{...message(),message_id:2},sender),true)
+  assert.equal((await sources.batch(registration)).events[0].id,'tg_n101_2')
+  const call=source.call.bind(source)
+  source.call=async(command,args)=>{if(command==='task-unwatch')throw new Error('Provider offline');return call(command,args)}
+  await assert.rejects(tasks.ownerCall('owner','revoke',{taskId:task.id}))
+  assert.equal((await tasks.get(task.id))!.unwatchPending,true)
+  await assert.rejects(tasks.ownerCall('owner','propose',{sourceId:'telegram',conversationId:'-101',purpose:'Family chat',context:'Only group context',hours:24,waitForIncoming:true,untilRevoked:true}),/already has a task/)
+  source.call=call
+  await new Tasks(dir).decide(task.id) // Reconciles after a restart or outage.
+  assert.equal((await tasks.get(task.id))!.unwatchPending,undefined)
+  await tasks.ownerCall('owner','revoke',{taskId:task.id}) // Idempotent.
+
+  await assert.rejects(tasks.workerCall(run.id,'send',{text:'After revoke',key:'late'}),/inactive/)
+  assert.equal(sent.length,32)
+  assert.equal(await source.capture(5,message(),sender),false)
+})

package/test/trusted-beta.test.mjs

@@ -0,0 +1,224 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { identity, sha256, validateManifest, validateReceipt, validateChecks, tarManifest, validateSource, registryState, publishOnce, githubClient } from '../scripts/trusted-beta.mjs';
+
+const env = { RELEASE_ID: '123', RELEASE_REPOSITORY: 'jdorado/ez-agents', RELEASE_PACKAGE: '@jc_stack/ez-agents', RELEASE_VERSION: '1.2.3-beta.1', RELEASE_SOURCE_SHA: 'a'.repeat(40), RELEASE_SHA256: sha256(Buffer.from('candidate')), RELEASE_REQUIRED_CHECKS: '["verify (22)"]', GITHUB_REPOSITORY: 'jdorado/ez-agents', GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REF: 'refs/heads/main', GITHUB_SHA: 'a'.repeat(40) };
+const expected = identity(env);
+const manifest = { name: expected.package, version: expected.version, repository: { url: 'git+https://github.com/jdorado/ez-agents.git' }, publishConfig: { access: 'public', tag: 'latest' } };
+const receipt = { ...Object.fromEntries(['repository', 'package', 'version', 'sourceSha', 'sha256'].map(key => [key, expected[key]])), independentReviewUrl: 'https://github.com/jdorado/ez-agents/pull/41#issuecomment-123', testEvidenceUrls: ['https://github.com/jdorado/ez-agents/actions/runs/123'] };
+const mainRun = { id: 123, run_attempt: 1, head_sha: expected.sourceSha, event: 'push', head_branch: 'main', path: '.github/workflows/ci.yml', status: 'completed', conclusion: 'success' };
+const runsPath = `/repos/${expected.repository}/actions/workflows/ci.yml/runs?branch=main&event=push&head_sha=${expected.sourceSha}&per_page=100&page=1`;
+const jobsPath = `/repos/${expected.repository}/actions/runs/123/attempts/1/jobs?per_page=100&page=1`;
+const checkPath = `/repos/${expected.repository}/check-runs/1`;
+const job = { id: 456, run_id: 123, run_attempt: 1, head_sha: expected.sourceSha, name: 'verify (22)', status: 'completed', conclusion: 'success', check_run_url: `https://api.github.com${checkPath}` };
+const check = { id: 1, details_url: 'https://github.com/jdorado/ez-agents/actions/runs/123/job/456', name: 'verify (22)', head_sha: expected.sourceSha, app: { id: 15368 }, status: 'completed', conclusion: 'success' };
+
+test('identity rejects source, repository, trigger, channel and empty check substitution', () => {
+  for (const changed of [{ RELEASE_VERSION: '1.2.3' }, { RELEASE_VERSION: '1.2.3-alpha.1' }, { RELEASE_VERSION: '1.2.3-beta.01' }, { RELEASE_VERSION: '1.2.3-beta.1+build' }, { RELEASE_REPOSITORY: 'attacker/ez-agents' }, { GITHUB_REPOSITORY: 'jdorado/other' }, { GITHUB_REF: 'refs/heads/feature' }, { GITHUB_EVENT_NAME: 'push' }, { GITHUB_SHA: 'b'.repeat(40) }, { RELEASE_REQUIRED_CHECKS: '[]' }, { RELEASE_REQUIRED_CHECKS: '["a","a"]' }, { RELEASE_SHA256: 'oops' }]) assert.throws(() => identity({ ...env, ...changed }));
+});
+
+test('manifest and receipt are bound to independent dispatch identity', () => {
+  validateManifest(manifest, expected); validateReceipt(receipt, expected);
+  for (const changed of [{ name: '@jc_stack/other' }, { version: '1.2.3' }, { private: true }, { repository: 'https://github.com/attacker/repo' }, { publishConfig: { tag: 'beta' } }, { publishConfig: { access: 'restricted' } }, { publishConfig: { registry: 'https://evil.example/' } }, { publishConfig: { provenance: false } }]) assert.throws(() => validateManifest({ ...manifest, ...changed }, expected));
+  for (const changed of [{ repository: 'jdorado/other' }, { sourceSha: 'b'.repeat(40) }, { sha256: '0'.repeat(64) }, { independentReviewUrl: 'https://evil.example/pull/1' }, { independentReviewUrl: 'https://github.com/jdorado/ez-agents/issues/1' }, { testEvidenceUrls: [] }, { testEvidenceUrls: ['https://github.com/jdorado/ez-agents/actions/runs/1/../../evil'] }]) assert.throws(() => validateReceipt({ ...receipt, ...changed }, expected));
+});
+
+test('checks cannot pass vacuously, from another app/source or an earlier run', () => {
+  validateChecks([check], expected);
+  for (const checks of [[], [{ ...check, app: { id: 1 } }], [{ ...check, head_sha: 'b'.repeat(40) }], [{ ...check, conclusion: 'skipped' }], [check, { ...check, id: 2, status: 'in_progress', conclusion: null }]]) assert.throws(() => validateChecks(checks, expected));
+});
+
+function sourceApi(overrides = {}) {
+  const responses = {
+    [runsPath]: { workflow_runs: [mainRun] },
+    [jobsPath]: { jobs: [job] },
+    [checkPath]: check,
+    '/repos/jdorado/ez-agents': { full_name: expected.repository, private: false, visibility: 'public', default_branch: 'main' },
+    '/repos/jdorado/ez-agents/contents/docs/plugin-catalog.md?ref=main': { content: Buffer.from('| [Plugin](https://github.com/jdorado/ez-whatsapp) | `@jc_stack/ez-whatsapp` |').toString('base64') },
+    '/repos/jdorado/ez-agents/git/ref/heads/main': { object: { sha: expected.sourceSha } },
+    [`/repos/jdorado/ez-agents/contents/package.json?ref=${expected.sourceSha}`]: { content: Buffer.from(JSON.stringify(manifest)).toString('base64') },
+    [`/repos/jdorado/ez-agents/git/ref/tags/v${expected.version}`]: { object: { type: 'commit', sha: expected.sourceSha } },
+    ...overrides,
+  };
+  return async path => { assert.ok(path in responses, `Unexpected API request ${path}`); return responses[path]; };
+}
+
+test('source gates reject private repository, changed main, wrong tag and failed CI', async () => {
+  await validateSource(expected, sourceApi());
+  for (const override of [
+    { '/repos/jdorado/ez-agents': { full_name: expected.repository, private: true, visibility: 'private', default_branch: 'main' } },
+    { '/repos/jdorado/ez-agents/git/ref/heads/main': { object: { sha: 'b'.repeat(40) } } },
+    { [`/repos/jdorado/ez-agents/git/ref/tags/v${expected.version}`]: { object: { type: 'commit', sha: 'b'.repeat(40) } } },
+    { [jobsPath]: { jobs: [] } },
+  ]) await assert.rejects(validateSource(expected, sourceApi(override)));
+  await assert.rejects(validateSource({ ...expected, repository: 'jdorado/ez-library', package: '@jc_stack/ez-library' }, async path => path.endsWith('ez-library') ? { full_name: 'jdorado/ez-library', private: false, visibility: 'public', default_branch: 'main' } : { content: Buffer.from('').toString('base64') }), /not enrolled/);
+});
+
+test('tarball parser reads one regular manifest without extracting files', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'beta-tar-test-'));
+  try {
+    await mkdir(join(dir, 'package'));
+    await writeFile(join(dir, 'package/package.json'), JSON.stringify(manifest));
+    execFileSync('tar', ['-czf', join(dir, 'good.tgz'), '-C', dir, 'package/package.json']);
+    assert.deepEqual(tarManifest(join(dir, 'good.tgz')), manifest);
+    execFileSync('tar', ['-czf', join(dir, 'duplicate.tgz'), '-C', dir, 'package/package.json', 'package/package.json']);
+    assert.throws(() => tarManifest(join(dir, 'duplicate.tgz')), /exactly one/);
+    execFileSync('ln', ['-s', '/etc/passwd', join(dir, 'package/link')]);
+    execFileSync('tar', ['-czf', join(dir, 'link.tgz'), '-C', dir, 'package']);
+    assert.throws(() => tarManifest(join(dir, 'link.tgz')), /links or special/);
+  } finally { await rm(dir, { recursive: true, force: true }); }
+});
+
+test('registry distinguishes missing version, absent package, server failures and changed bytes', async () => {
+  const document = { name: expected.package, versions: {}, 'dist-tags': { latest: '1.0.0', beta: '1.2.3-beta.0' } };
+  const response = data => new Response(JSON.stringify(data));
+  assert.deepEqual(await registryState(expected, async () => response(document)), { exists: false, latest: '1.0.0', beta: '1.2.3-beta.0' });
+  await assert.rejects(registryState(expected, async () => new Response('', { status: 404 })), /first reviewed beta/);
+  await assert.rejects(registryState(expected, async () => new Response('', { status: 503 })), /HTTP 503/);
+  const published = { ...manifest, dist: { tarball: 'https://registry.npmjs.org/file.tgz' } };
+  const existing = { ...document, versions: { [expected.version]: published } };
+  let n = 0;
+  const read = await registryState(expected, async () => n++ === 0 ? response(existing) : new Response('candidate'));
+  assert.equal(read.exists, true);
+  n = 0;
+  await assert.rejects(registryState(expected, async () => n++ === 0 ? response(existing) : new Response('changed')), /differs/);
+  await assert.rejects(registryState(expected, async () => response({ ...existing, versions: { [expected.version]: { ...published, dist: { tarball: 'https://evil.example/file' } } } })), /tarball host/);
+});
+
+test('publish writes once and reconciles a timeout using exact registry readback', async () => {
+  let writes = 0; let reads = 0;
+  const result = await publishOnce(expected, { readState: async () => reads++ === 0 ? { exists: false, latest: '1.0.0' } : { exists: true, latest: expected.version, beta: 'old' }, publishTarball: async () => { writes++; throw new Error('timeout'); }, sleep: async () => {}, report: () => {} });
+  assert.equal(writes, 1); assert.equal(result.status, 'published');
+});
+
+test('existing matching publication is read-only; partial or changed tag never republished', async () => {
+  let writes = 0;
+  const options = { readState: async () => ({ exists: true, latest: expected.version }), publishTarball: async () => { writes++; } };
+  assert.equal((await publishOnce(expected, options)).status, 'already-published');
+  await assert.rejects(publishOnce(expected, { ...options, readState: async () => ({ exists: true, latest: 'other' }) }), /reconcile/);
+  assert.equal(writes, 0);
+  for (const after of [{ exists: true, latest: 'changed', beta: expected.version }, { exists: true, latest: '1.0.0', beta: 'other' }, { exists: false, latest: '1.0.0' }]) {
+    let reads = 0;
+    await assert.rejects(publishOnce(expected, { readState: async () => reads++ === 0 ? { exists: false, latest: '1.0.0' } : after, publishTarball: async () => { writes++; }, sleep: async () => {} }), /do not repeat/);
+  }
+  assert.equal(writes, 3);
+});
+
+test('asset redirect never carries GitHub authorization to storage host', async () => {
+  let count = 0;
+  const api = githubClient('sensitive', async (url, options) => {
+    if (count++ === 0) { assert.equal(options.headers.Authorization, 'Bearer sensitive'); return new Response('', { status: 302, headers: { location: 'https://release-assets.githubusercontent.com/file' } }); }
+    assert.equal(options.headers, undefined); return new Response('candidate');
+  });
+  assert.equal((await api('/repos/jdorado/ez-agents/releases/assets/1', true)).toString(), 'candidate');
+  await assert.rejects(githubClient('sensitive', async () => new Response('', { status: 302, headers: { location: 'https://evil.example/file' } }))('/repos/jdorado/ez-agents/releases/assets/1', true), /Unexpected asset redirect/);
+});
+
+test('workflow reruns can verify success but cannot repeat an absent-version write', async () => {
+  let writes = 0;
+  const options = { allowWrite: false, publishTarball: async () => { writes++; } };
+  await assert.rejects(publishOnce(expected, { ...options, readState: async () => ({ exists: false }) }), /fresh authorized dispatch/);
+  assert.equal((await publishOnce(expected, { ...options, readState: async () => ({ exists: true, latest: expected.version }) })).status, 'already-published');
+  assert.equal(writes, 0);
+});
+
+test('write-started receipt precedes publication and readback records partial failures', async () => {
+  const events = []; let read = 0;
+  await assert.rejects(publishOnce(expected, { readState: async () => read++ === 0 ? { exists: false, latest: '1' } : { exists: false, latest: '1' }, record: async event => events.push(event), publishTarball: async () => { assert.equal(events.at(-1).phase, 'write-started'); throw new Error('timeout'); }, sleep: async () => {} }), /unresolved/);
+  assert.equal(events[0].phase, 'preflight');
+  assert.ok(events.some(event => event.phase === 'readback' && event.publishCommandFailed));
+});
+
+test('required check workflow must be main push CI, not a same-named alternate workflow', async () => {
+  for (const changed of [{ event: 'pull_request' }, { head_branch: 'feature' }, { path: '.github/workflows/unrelated.yml' }, { conclusion: 'failure' }, { head_sha: 'b'.repeat(40) }]) {
+    await assert.rejects(validateSource(expected, sourceApi({ [runsPath]: { workflow_runs: [{ ...mainRun, ...changed }] } })), /main push CI/);
+  }
+});
+
+test('publish environment contains only required platform identity and OIDC capabilities', async () => {
+  const { publishEnvironment } = await import('../scripts/trusted-beta.mjs');
+  const clean = publishEnvironment({ PATH: '/bin', HOME: '/tmp', GITHUB_SHA: expected.sourceSha, ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'oidc-only', GH_TOKEN: 'secret', GITHUB_TOKEN: 'secret', NPM_TOKEN: 'secret', TELEGRAM_BOT_TOKEN: 'secret', npm_config_registry: 'https://evil.example', NODE_OPTIONS: '--require=/evil.js' });
+  assert.deepEqual(clean, { PATH: '/bin', HOME: '/tmp', GITHUB_SHA: expected.sourceSha, ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'oidc-only' });
+});
+
+test('generated caller pins shared code, permits manual dispatch only and rejects YAML injection', async () => {
+  const { generateCaller } = await import('../scripts/generate-publish-caller.mjs');
+  const config = { repository: 'jdorado/ez-whatsapp', packageName: '@jc_stack/ez-whatsapp', publisherSha: 'a'.repeat(40), checks: ['verify (22)', 'docker'] };
+  const caller = generateCaller(config);
+  assert.ok(caller.includes(`uses: jdorado/ez-agents/.github/workflows/npm-beta-shared.yml@${config.publisherSha}`));
+  assert.ok(caller.includes('  workflow_dispatch:'));
+  assert.ok(!/^\s+(?:push|pull_request|workflow_run):/m.test(caller));
+  assert.ok(caller.includes('      release-id: ${{ inputs.release-id }}'));
+  const matrixChecks = ['test (ubuntu-latest, 22)', 'test (macos-latest, 24)', 'docker'];
+  assert.ok(generateCaller({ ...config, checks: matrixChecks }).includes(`required-checks: '${JSON.stringify(matrixChecks)}'`));
+  assert.ok(generateCaller({ ...config, repository: 'jdorado/ez-agents', packageName: '@jc_stack/ez-agents' }).includes('uses: ./.github/workflows/npm-beta-shared.yml'));
+  for (const invalid of [{ repository: "jdorado/repo'\nsteps:" }, { packageName: "@jc_stack/p'\nsteps:" }, { publisherSha: 'main' }, { checks: ['a\nsteps:'] }, { checks: [] }]) assert.throws(() => generateCaller({ ...config, ...invalid }));
+});
+
+test('npm publication disables transport retries and scripts, using the explicit latest tag', async () => {
+  const { publishArguments } = await import('../scripts/trusted-beta.mjs');
+  const args = publishArguments('/candidate.tgz', '/user-npmrc', '/global-npmrc');
+  assert.ok(args.includes('--fetch-retries=0'));
+  assert.ok(args.includes('--ignore-scripts'));
+  assert.equal(args[args.indexOf('--tag') + 1], 'latest');
+  assert.equal(args[args.indexOf('--registry') + 1], 'https://registry.npmjs.org/');
+  assert.notEqual(args[args.indexOf('--userconfig') + 1], args[args.indexOf('--globalconfig') + 1]);
+});
+
+
+test('newer same-SHA tag, PR and alternate workflow runs cannot shadow main CI', async () => {
+  for (const changed of [{ head_branch: 'v1.2.3-beta.1' }, { event: 'pull_request' }, { path: '.github/workflows/other.yml' }, { head_sha: 'b'.repeat(40) }]) {
+    await validateSource(expected, sourceApi({
+      [runsPath]: { workflow_runs: [mainRun, { ...mainRun, id: 124, ...changed }] },
+    }));
+  }
+});
+
+test('latest eligible main CI cannot fall back to older success or missing checks', async () => {
+  for (const changed of [{ conclusion: 'failure' }, { conclusion: 'cancelled' }, { status: 'in_progress', conclusion: null }, { status: 'queued', conclusion: null }]) {
+    await assert.rejects(validateSource(expected, sourceApi({
+      [runsPath]: { workflow_runs: [mainRun, { ...mainRun, id: 124, ...changed }] },
+    })), /main push CI/);
+  }
+  await assert.rejects(validateSource(expected, sourceApi({
+    [runsPath]: { workflow_runs: [mainRun, { ...mainRun, id: 124 }] },
+    [jobsPath.replace('/123/', '/124/')]: { jobs: [] },
+  })), /Missing or ambiguous/);
+});
+
+test('latest attempt cannot borrow successful jobs from prior attempts or runs', async () => {
+  const attemptPath = jobsPath.replace('/attempts/1/', '/attempts/2/');
+  for (const jobs of [[], [job], [{ ...job, run_attempt: 2, run_id: 124 }], [{ ...job, run_attempt: 2, head_sha: 'b'.repeat(40) }], [{ ...job, run_attempt: 2, conclusion: 'failure' }], [{ ...job, run_attempt: 2, status: 'in_progress', conclusion: null }]]) {
+    await assert.rejects(validateSource(expected, sourceApi({
+      [runsPath]: { workflow_runs: [{ ...mainRun, run_attempt: 2 }] },
+      [attemptPath]: { jobs },
+    })), /Missing or ambiguous|not successful/);
+  }
+  await validateSource(expected, sourceApi({
+    [runsPath]: { workflow_runs: [{ ...mainRun, run_attempt: 2 }] },
+    [attemptPath]: { jobs: [{ ...job, run_attempt: 2 }] },
+  }));
+});
+
+test('required job and check evidence cannot substitute repository, identity or outcomes', async () => {
+  for (const changed of [{ check_run_url: job.check_run_url.replace('jdorado/ez-agents', 'attacker/ez-agents') }, { check_run_url: job.check_run_url + '/extra' }, { check_run_url: undefined }, { conclusion: 'skipped' }]) {
+    await assert.rejects(validateSource(expected, sourceApi({ [jobsPath]: { jobs: [{ ...job, ...changed }] } })));
+  }
+  for (const changed of [{ details_url: check.details_url.replace('/123/', '/124/') }, { details_url: undefined }, { name: 'other' }, { app: { id: 1 } }, { head_sha: 'b'.repeat(40) }, { conclusion: 'failure' }]) {
+    await assert.rejects(validateSource(expected, sourceApi({ [checkPath]: { ...check, ...changed } })));
+  }
+  await assert.rejects(validateSource(expected, sourceApi({ [jobsPath]: { jobs: [job, job] } })), /ambiguous/);
+});
+
+test('workflow runs and attempt jobs are paginated before selecting required evidence', async () => {
+  await validateSource(expected, sourceApi({
+    [runsPath]: { workflow_runs: Array.from({ length: 100 }, (_, i) => ({ ...mainRun, id: i + 200, event: 'pull_request' })) },
+    [runsPath.replace('&page=1', '&page=2')]: { workflow_runs: [mainRun] },
+    [jobsPath]: { jobs: Array.from({ length: 100 }, (_, i) => ({ ...job, name: `other-${i}` })) },
+    [jobsPath.replace('&page=1', '&page=2')]: { jobs: [job] },
+  }));
+});

package/test/updates.test.mjs

@@ -113,9 +113,13 @@ test('archive admission rejects traversal, links, special files, duplicates and
  await assert.rejects(extract(Buffer.from('not gzip'),path.join(f.root,'bad')));
  await assert.rejects(fs.access(path.join(f.root,'bad')));
 });
-test('policy defaults stable; prepared local candidates need explicit authority and a live supervisor',async t=>{
+test('policy defaults beta; prepared local candidates need explicit authority and a live supervisor',async t=>{
  const f=await fixture(t),job=await prepare(f.home,'main',{file:await f.pack()});
+ assert.deepEqual(await command(f.home,['policy','main']),{automatic:true,channel:'beta'});
+ assert.deepEqual(await command(f.home,['policy','sample']),{automatic:true,channel:'beta'});
+ await command(f.home,['policy','main','stable']);
  assert.deepEqual(await command(f.home,['policy','main']),{automatic:true,channel:'stable'});
+ assert.deepEqual(await command(f.home,['policy','sample']),{automatic:true,channel:'beta'});
  await assert.rejects(submit(f.home,job.id,false));
  await atomic(path.join(f.home,'updates/supervisor.json'),{at:Date.now()});
  await assert.rejects(submit(f.home,job.id,true),/Local/);
@@ -183,7 +187,13 @@ test('interrupted activation recovers previous code; rollback failure is explici
  const retried=await read(path.join(jobPath(f.home,interrupted.id),'job.json'));assert.equal((await perform(f.home,retried,r)).status,'rolled-back');
 });
 test('bound dispatch follows active package root and retains private scope',async t=>{
- const f=await fixture(t);await bindUpdates(f.home,path.join(f.config.deploymentDir,'host-executor.json'));
+ const f=await fixture(t);
+ await fs.appendFile(path.join(f.agent.workspace,'TOOLS.md'),"\n## Software updates\nThe default policy\nauthorizes compatible stable updates without asking again. Respect an owner's\nmanual policy or beta opt-in.\nOwner notes stay here.\n");
+ const bound=await bindUpdates(f.home,path.join(f.config.deploymentDir,'host-executor.json'));
+ assert.match(bound.policy,/beta-channel/);
+ const guidance=await fs.readFile(path.join(f.agent.workspace,'TOOLS.md'),'utf8');
+ assert.match(guidance,/beta channel/);assert.match(guidance,/Owner notes stay here/);
+ assert.doesNotMatch(guidance,/beta opt-in/);
  const config=await read(path.join(f.home,'config.json'));config.packageRoot=f.source;await atomic(path.join(f.home,'config.json'),config);
  // A native launcher from the real package looks up its entry point in the active root.
  await fs.writeFile(path.join(f.source,'bin/ezenciel-agents.mjs'),'#!/usr/bin/env node\nconsole.log(process.env.EZ_DEPLOYMENT_DIR)',{mode:0o755});
@@ -252,7 +262,11 @@ for(const provider of ['pnpm','corepack']) test(`supervisor with only ${provider
  await fs.rm(running);
  await wait(async()=>{const j=await read(path.join(jobPath(f.home,job.id),'job.json'));if(j.status==='failed'||j.status==='rolled-back')throw Error(JSON.stringify(j)+first.output());return j.status==='completed';});
  const newBeat=await heartbeat();assert.notEqual(newBeat.pid,oldBeat.pid);assert(first.p.exitCode===null);
- assert((await read(path.join(f.agent.controlDir,'update-attention.json'))).id);
+ // Completion is persisted before the supervisor publishes its attention receipt.
+ await wait(async()=>{
+  try{return (await read(path.join(f.agent.controlDir,'update-attention.json'))).id===digest(job.id);}
+  catch(error){if(error.code==='ENOENT')return false;throw error;}
+ });
  const closed=new Promise(r=>first.p.once('close',r));first.p.kill('SIGTERM');await closed;
  const active=(await read(path.join(f.home,'config.json'))).packageRoot;assert(active.endsWith('/runtime'));
  assert.equal((await read(path.join(jobPath(f.home,job.id),'job.json'))).packageManager.command,provider);
@@ -280,3 +294,21 @@ test('npm candidates verify exact version and integrity; automatic policy is enf
  pkg.dist.integrity='sha512-bad';await assert.rejects(prepare(f.home,'main',{release:'0.1.1'}),/integrity/);
  pkg.version='0.1.2';await assert.rejects(prepare(f.home,'main',{release:'0.1.1'}),/version mismatch/);
 });
+
+test('update discovery follows latest while preserving legacy beta and stable-only policies',async t=>{
+ const {registryCandidate}=await import('../src/updates/artifact.mjs');
+ const name='@ez-test/example',pkg=v=>({name,version:v});
+ const data={name,'dist-tags':{latest:'0.2.0-beta.2',beta:'0.2.0-beta.1'},versions:{'0.1.0':pkg('0.1.0'),'0.2.0-beta.1':pkg('0.2.0-beta.1'),'0.2.0-beta.2':pkg('0.2.0-beta.2')}};
+ const original=globalThis.fetch;globalThis.fetch=async()=>new Response(JSON.stringify(data));t.after(()=>globalThis.fetch=original);
+ assert.equal((await registryCandidate(name,'beta')).version,'0.2.0-beta.2');
+ assert.equal((await registryCandidate(name,'stable')).version,'0.1.0');
+ data['dist-tags']={latest:'0.1.0',beta:'0.2.0-beta.2'};
+ assert.equal((await registryCandidate(name,'beta')).version,'0.2.0-beta.2');
+ delete data.versions['0.1.0'];data['dist-tags']={latest:'0.2.0-beta.2'};
+ assert.equal(await registryCandidate(name,'stable'),null);
+ assert.equal((await registryCandidate(name,'beta')).version,'0.2.0-beta.2');
+ data.versions['0.2.0-beta.2'].deprecated='withdrawn';assert.equal(await registryCandidate(name,'beta'),null);
+ delete data.versions['0.2.0-beta.2'].deprecated;
+ data.versions['0.2.0-beta.2'].name='@wrong/package';await assert.rejects(registryCandidate(name,'beta'),/identity|version mismatch/i);
+ data.name='@wrong/package';await assert.rejects(registryCandidate(name,'beta'),/identity mismatch/i);
+});