@jc_stack/ez-agents 0.1.0-beta.13 → 0.1.0-beta.18

package/docs/scheduling.md

@@ -32,6 +32,14 @@ the host changes zones. Nonexistent DST wall times are skipped; repeated wall
 times fire once, at the earlier instant. Search is bounded to eight years.
 Public-holiday calendars and arbitrary RRULE syntax are not implemented.
 
+New tasks, including work deferred by a busy reply session, default to Codex
+`gpt-5.6-terra` with `high` reasoning independently of the creating chat.
+Use `--cli`, `--model`, and `--effort` to specify another choice; reasoning
+explicitly selected above `high` is rejected for every model. Non-Codex adapters
+inherit native effort when unset. Editing preserves the existing AI
+choice unless those flags override it. Stored choices are checked again at
+launch, including schedules saved before the cap.
+
 ## Execution and authority
 
 The relay checks due work once per second. Each occurrence enters the durable
@@ -41,7 +49,7 @@ Instructions must include any needed context or source paths; full chat history
 is not copied. Task folders remain for inspection and artifact delivery.
 
 One writer runs per task directory. Up to four background tasks can run alongside
-the sequential main conversation. A recurring schedule has at most one pending
+the main conversation. When a Codex owner message arrives while work is busy, a separate restricted session reads recent messages and run progress and answers through the normal outbox. It can queue requested work through the scheduler, but cannot run shell commands, access plugins, or edit the agent workspace. Only one reply session runs at a time and it releases its slot after a 60-second reply deadline; this deadline does not apply to writer jobs. Its context is a bounded snapshot, not a shared native transcript. Delivered parallel replies are included as historical context in the next normal conversation turn. Codex 0.153.4 and 0.154.0 are supported for this restricted adapter. Other versions fail closed pending tool-surface validation. A recurring schedule has at most one pending
 or active occurrence. Agents should delegate long work with `create --now`, return
 to chat, and inspect `runs` or task progress when asked. Native subagents can be
 used inside the worker. Sharing provider profiles does not make concurrent CRM,
@@ -70,8 +78,8 @@ The foreground chat still uses `codex exec`. That invocation exits after one
 requested turn even if a goal is active, so delegate persistent work to the
 scheduler. Desktop and other executor goal lifecycles need separate validation.
 
-The CLI binds jobs to the paired owner and current AI selection. Queued/scheduled
-work retains that selection after the chat switches AI. Revoking/re-pairing an
+The CLI binds jobs to the paired owner and the task AI choice. Queued/scheduled
+work retains that choice after the chat switches AI. Revoking/re-pairing an
 owner invalidates their old schedules, including re-pairing the same Telegram ID.
 External event turns cannot use the scheduling CLI. Credentials still pass only
 through the existing whitelist and installed host binding.
@@ -88,7 +96,7 @@ queued occurrence; already-running work continues until explicitly cancelled.
 `/stop` stops all active work; `cancel RUN_ID` stops one background task. `/cancel`
 clears queued work. Pause/remove a recurring schedule to prevent future runs.
 Stopping the relay also stops its workers. A crashed or interrupted execution is
-not automatically replayed. Runs found active at startup are marked failed with
+not automatically replayed. Status labels failed runs as history and shows recent reasons; new failures retain their exit code or interruption cause. Typing indicators stop after 30 seconds even when work continues. Runs found active at startup are marked failed with
 `interrupted: true`; their schedule revision stays held until the agent inspects
 the evidence and explicitly edits the schedule. Inspect the task's files, native session and delivery
 receipts before deciding whether to resume. A clock cannot reconstruct an
@@ -125,3 +133,21 @@ minutes. Verify `finished.txt` and exactly one completion in Telegram. Separatel
 exercise cancellation, downtime catch-up and an explicitly requested native goal
 that needs more than one turn. Synthetic provider evidence does not prove real
 Telegram delivery, and a sleep test does not prove native goal persistence.
+
+Busy-chat regression probe (real Codex, synthetic Telegram):
+
+```sh
+pnpm exec tsx scripts/smoke-busy-reply.ts --transport
+```
+
+The probe holds a writer on a shared workspace, asks an owner question through
+the relay and host transport, and requires the restricted reply to complete
+while the writer remains active. It sends no real Telegram messages.
+
+## Optional failure review
+
+Create a normal recurring schedule with `--every-seconds 900 --when unreviewed-failures --text-file templates/failure-review.md`. The condition advances empty occurrences without launching an executor. It considers only failures belonging to the paired owner. No separate monitor or automatic retry is introduced.
+
+`failures [--all] [--limit N]` returns failedAt, reason, exit code, native session, captured error and runtime versions. Capture keeps at most 4 KiB of redacted stderr; historical failures are not backfilled. `run RUN_ID` reads an owned run. `review RUN_ID --failed-at ISO --status resolved|attention --diagnosis TEXT --recovery TEXT --outcome TEXT` records the investigation without rewriting execution history. A stale timestamp is rejected; a later failure needs a new review. Restricted reply, external and isolated-task callers cannot review failures. An attention review is handed off, not repeatedly relaunched; another new failure wakes the next review.
+
+The prompt controls diagnosis, authorized recovery and quiet notification behavior. Inspect prior effects and receipts before retrying anything. A failed review run itself remains visible as a new failure for the next occurrence.

package/docs/selective-monitoring.md

@@ -33,7 +33,7 @@ Infer the complete job from ordinary language:
 
 Apply the required core confirmation to the concrete proposal, not an extra
 questionnaire. Use the owner's existing contact, purpose and disclosure limits.
-Avoid claiming indefinite service where v1 is bounded. Explain the expiry only
+For an ongoing incoming-only conversation, use `--until-revoked`; finite tasks remain bounded. Explain the expiry only
 when it matters to that proposed job; never silently expand or renew permission.
 
 ## Three capture modes, separate reply authority
@@ -83,9 +83,17 @@ registered source, canonical contact, purpose, explicitly shareable context file
 and expiry. No need to invent a booking objective: “conversational replies to
 this contact, no private disclosures or commitments” is a legitimate purpose.
 If no private facts may be shared, say so in the context file; do not include
-owner memory. V1 supports at most 72 hours, not indefinite “until stopped.” Offer
-that bounded duration in the exact approval, explaining the limit without asking
-the owner to restate their request. Do not silently renew it.
+owner memory. Finite jobs support at most 72 hours. For an ongoing conversation requested by
+the owner, add `--incoming-only --until-revoked`. This authorizes that exact
+conversation until owner revocation, without a total reply quota. Do not silently
+convert a finite job into an ongoing permission.
+
+For Telegram groups, the relay registers source `telegram` automatically when
+paired. Use the exact negative group ID from discovery, never its display name.
+Keep the shared context limited to what every group member may know. All human
+members of that approved group may converse; this does not grant owner tools.
+The group runs with the existing restricted messaging runner, and its notes are
+separate from private PA memory. Group text is supported; media is not yet.
 
 The core presents the exact proposal for owner confirmation. Ordinary messages
 inside that grant need no repeated confirmations. Incoming-only grants create

package/docs/setup.md

@@ -1,5 +1,27 @@
 # Agent-led setup
 
+## A group as owner
+
+An installer can explicitly approve one Telegram group as the agent's owner.
+Every human member in that group then has owner access, including settings,
+approvals and scheduling. The conversation and replies are shared in that group.
+New members inherit this access. Bots and anonymous sender-chat posts are ignored.
+
+Add the bot to the intended group and send it a message addressed to its username.
+`ezenciel-agents-owner status` shows the pending group title and negative chat ID;
+verify the exact group with the installer, then run
+`ezenciel-agents-owner approve-group <negative-chat-id>`. Pairing never happens
+automatically. The existing `approve <user-id>` command approves DMs only.
+An existing owner must be explicitly revoked before replacement; use a fresh
+deployment when its existing workspace contains information unsuitable for the group.
+
+Make the bot a group admin so Telegram delivers ordinary member messages and
+allows membership verification for approval and control buttons. Group ownership only authorizes
+the exact approved chat, not other groups or members' private DMs. Telegram group
+migration to a new chat ID requires a new explicit binding. Verify a real group
+reply before considering setup complete. All other groups retain their existing
+restricted conversation-grant behavior.
+
 Ez supports two independent, composable uses: an autonomous Telegram agent and
 workspace-scoped plugins called by your existing local CLI/GUI executor.
 For CLI-only requests, follow [standalone setup](standalone-cli.md): no Telegram
@@ -30,6 +52,23 @@ owner request for standalone plugin development is a separate workflow.
 
 ## Defaults and host prerequisites
 
+New agents using `codex` or `codex-gui` start with `gpt-5.6-terra` and `high`
+reasoning, including when initialized with `ezenciel-agents-setup init`. This
+Ez default takes precedence over discovered host client defaults. Saved agent
+selections at or below high are preserved; use the AI settings to choose another model or effort.
+Ez rejects explicit reasoning above `high` for every model at selection and execution,
+including old saved or queued choices. Unset Codex model/effort resolves to
+Terra/high at launch. This governs Ez-managed launches; it is not an account-wide
+limit on independently launched native clients or executor-created native subagents.
+Other adapters inherit their native effort when none is selected in Ez. That
+inherited configuration is not capped by Ez; explicit above-high Ez selections
+are still rejected. Only Codex adapters receive the default `high` effort.
+
+New scheduled and one-off background tasks default to Codex Terra/high independently
+of the creating chat. Use scheduler `--cli`, `--model`, and `--effort` flags for
+explicit overrides. Editing a schedule preserves its settings unless overridden.
+Restricted messaging tasks also use Terra/high when no settings are supplied.
+
 Use the existing owner's host account. Unless a layout was supplied, use
 `${XDG_DATA_HOME:-$HOME/.local/share}/ez/packages/<version>/` for extracted main
 packages and `${XDG_DATA_HOME:-$HOME/.local/share}/ez/agents/` for private deployments.

package/docs/trusted-publishing.md

@@ -0,0 +1,140 @@
+# Verified beta publication
+
+The Mac prepares and independently tests the release. GitHub-hosted Actions
+publishes the exact approved tarball using npm OIDC. The shared implementation
+is `.github/workflows/npm-beta-shared.yml` in this repository; each package has a
+small manually dispatched `publish-beta.yml` caller. This setup does not grant
+release authority or establish npm trust automatically.
+
+## Enroll a repository once
+
+1. Verify the source is public and explicitly registered in the current
+   [public catalog](plugin-catalog.md), or is core itself. Registration does not
+   prove a registry release exists. Excluded or private repositories cannot use
+   this publisher.
+2. Review and merge the shared publisher first. Generate the caller using its
+   full immutable commit SHA and the repository's required CI check names:
+
+   ```sh
+   node scripts/generate-publish-caller.mjs jdorado/ez-whatsapp \
+     @jc_stack/ez-whatsapp FULL_SHARED_COMMIT_SHA \
+     '["test (ubuntu-latest, 22)","test (ubuntu-latest, 24)","test (macos-latest, 22)","test (macos-latest, 24)","docker"]' > publish-beta.yml
+   ```
+
+   Put that file in the plugin's `.github/workflows/` through its own reviewed
+   PR. Inspect the actual CI names; the example does not establish the policy.
+   Keep the reusable workflow reference and `publisher-sha` on the same reviewed
+   commit. Core uses a local reusable workflow at the dispatch commit. The
+   generator writes stdout only; it never grants repository scope or edits npm.
+3. The npm package owner authenticates separately and enrolls the exact caller
+   repository and filename `publish-beta.yml` as a trusted publisher. Enable
+   **direct publication** explicitly; new trust configurations can default to
+   staged publication only. If an environment is configured on npm, add that
+   exact environment to the shared publishing job through review before use.
+   This workflow currently uses no environment.
+4. Verify enrollment through npm settings or `npm trust list PACKAGE`. npm
+   validates the **calling** workflow for reusable workflows. Both caller and
+   publishing job need `id-token: write`; test/validation jobs do not receive it. GitHub requires `contents: write`
+   to read unpublished draft assets: only the validation job receives that
+   capability and makes GET requests only. The separate OIDC job has
+   `contents: read`. No package code or lifecycle scripts run in validation.
+   Do not add `NODE_AUTH_TOKEN`, npm tokens, or private profiles to these jobs.
+
+An npm package must already exist before trust enrollment. If a registered
+plugin has no registry package, the owner must perform a real, approved initial
+beta publication using authenticated npm, with all release checks and exact
+artifact readback. Then enroll trust. Do not create a dummy release to test
+login. A missing GitHub release likewise remains missing until actually created
+and read back; a catalog link or workflow PR is not publication evidence.
+
+Current npm requirements and enrollment fields are documented in
+[npm trusted publishers](https://docs.npmjs.com/trusted-publishers/) and
+[npm trust](https://docs.npmjs.com/cli/v11/commands/npm-trust/).
+The workflow uses Node 24 and npm 11.19.1 on GitHub-hosted Ubuntu runners.
+
+## Prepare and dispatch one beta
+
+Follow [releasing](releasing.md), including isolated Mac tests, packed artifact
+inspection, independent review, required CI and authorized merge. The source
+must be the exact current `main` commit; after a merge, verify that its tree
+matches the tested source and renew invalidated evidence. Wait for that commit's
+CI from `.github/workflows/ci.yml`, triggered by a push on `main`. The caller's reviewed list of required checks is a fail-closed minimum;
+update it when repository policy adds checks. The validator selects the newest
+main-push CI run for that source before checking success, then requires the named
+jobs from its latest attempt. Tag, PR and other workflow runs cannot shadow it;
+failed, pending or incomplete main CI cannot fall back to an older success.
+
+Create the `vVERSION` tag at that exact source commit and a **draft prerelease**
+with these assets, using native `gh release create --draft --prerelease` and
+`gh release upload` under existing release authority:
+
+- `candidate.tgz`: the exact Mac-tested bytes from `npm pack --ignore-scripts`.
+  Do not rebuild it on Actions.
+- `release-receipt.json`: a sanitized record with this shape:
+
+  ```json
+  {
+    "repository": "jdorado/ez-agents",
+    "package": "@jc_stack/ez-agents",
+    "version": "0.1.0-beta.14",
+    "sourceSha": "FULL_TESTED_MAIN_COMMIT_SHA",
+    "sha256": "SHA256_OF_CANDIDATE_TGZ",
+    "independentReviewUrl": "https://github.com/jdorado/ez-agents/pull/PR_NUMBER#issuecomment-ID",
+    "testEvidenceUrls": ["https://github.com/jdorado/ez-agents/actions/runs/RUN_ID"]
+  }
+  ```
+
+The maintainer verifies those evidence links substantiate independent final-diff
+review, artifact tests and accepted beta limitations before dispatch. The receipt
+binds that attestation to the commit and digest; a syntactically valid URL alone
+cannot prove review quality or release authority.
+
+Read the draft's numeric `id` with `gh api repos/OWNER/REPO/releases` (the
+release-by-tag API only returns published releases). Dispatch `publish-beta.yml`
+on `main` with `release-id`, `version`, `source-sha` and
+`artifact-sha256`. Copy the digest from the independently verified Mac receipt,
+not an unreviewed replacement release asset. The validator checks current public
+scope, source/tag identity, required GitHub Actions checks, receipt identity,
+package metadata and tarball hash. It transfers the validated bytes using an
+immutable Actions artifact ID. A fresh job revalidates before publication and
+runs npm from a clean directory without package lifecycle scripts.
+
+Only `X.Y.Z-beta.N` versions are supported. Publish to npm `latest` so the
+package page and default installs show the newest approved release. Manifests
+must use `publishConfig.tag: "latest"` (or omit the tag). The version remains a
+SemVer prerelease and the GitHub release remains a prerelease. Private
+packages, wrong package/repository identities and stable versions fail before
+publication. No npm login smoke publication or stable-version release occurs.
+
+## Readback, failure and release completion
+
+The publisher reads registry metadata, checks that `latest` identifies the released version and downloads the
+published tarball to compare its SHA-256. Preserve the workflow's readback receipt, run URL and source/artifact
+identity on the release PR. A failed command after the publish call may mean npm
+accepted it: inspect registry state first. A rerun may verify an existing exact
+version; if the version is absent it refuses a second write. Reconcile first,
+then create a fresh authorized dispatch if appropriate. Never repeat or overwrite that version or silently repair tags.
+Missing trust or registry access is an external dependency, not a reason to use
+a token workaround.
+
+After successful registry readback, finish the GitHub prerelease with the tested
+artifact/checksum and verify its public availability. Perform the clean-host
+installation and runtime/provider checks required by the package's release
+rules. Actions success proves registry delivery only; it does not prove a
+running agent was upgraded. Respect each installation's saved update policy.
+
+## Migration from the legacy beta tag
+
+Existing plugin callers are SHA-pinned: regenerate each caller against the merged
+shared-publisher revision and update its package publishConfig together through
+review. Old pins retain the old behavior. Do not mutate an already staged or
+published artifact; prepare a new version when package metadata changes.
+
+The publisher uses one native npm publish operation with OIDC and `--tag latest`.
+It does not synchronize the legacy `beta` tag: npm trusted publishing does not
+support standalone dist-tag changes. No extra registry token is needed. Ez beta
+update discovery considers both latest and legacy beta during migration; stable-only
+policies select non-deprecated stable versions and cannot automatically install a
+prerelease. Older installed updaters still following only beta require an explicit
+exact-version update to a core release containing this discovery change. Existing
+registry versions/tags are not changed by merging the publisher.

package/docs/upgrades.md

@@ -2,8 +2,9 @@
 
 Available in this beta. Earlier main upgrade/rollback VM QA passed; final-release
 fresh-host/reboot and live plugin upgrade acceptance remain pending. npm
-publication is not required to test this feature. Stable releases are the default
-automatic channel. The existing owner may select beta or manual policy per target.
+publication is not required to test this feature. The beta channel is the default
+automatic channel for core and plugins without a saved policy. Existing explicit
+stable or manual policies are preserved. The owner may select either per target.
 The main target and installed plugins version independently.
 
 The agent owns release review, policy decisions and communication. The host
@@ -109,8 +110,8 @@ live. A healthy container alone does not prove a Telegram or plugin reply.
 
 ```sh
 ez updates check
-ez updates policy main                 # defaults: automatic, stable
-ez updates policy whatsapp beta        # only under owner authorization
+ez updates policy main                 # defaults: automatic, beta
+ez updates policy whatsapp stable      # opt into stable-only updates
 ez updates policy main manual          # disable unattended upgrades
 ez updates prepare main --version 0.1.0-beta.4
 # Or a local candidate, independently of npm:
@@ -191,3 +192,22 @@ changes also need supervisor restart and requesting-process-exit tests. Run
 `node docker/upgrade-smoke.mjs` with a local `EZ_WHATSAPP_SOURCE` containing the
 WhatsApp fixture. The smoke uses synthetic transport only. VM installation,
 agent-led upgrades, restart and real account acceptance remain separate QA gates.
+
+Beta policy discovers the newer of npm latest and the legacy beta tag. Stable-only
+policy selects non-deprecated stable versions, even when latest is a prerelease.
+No eligible version is reported as available:null with newer:false. Older installed
+updaters need an exact-version core update to adopt this discovery behavior.
+
+## Shared agent guidance
+
+Ez includes `templates/agent-guidance.md` from the running package in every
+owner-worker prompt, including resumed CLI and desktop conversations and scheduled
+owner work. After the runtime upgrades, the next turn receives the new guidance.
+An already running turn keeps its original prompt. Restricted contact tasks and
+reply-only workers retain their separate, bounded instructions.
+
+Keep general operating defaults in this package-owned file. Keep agent purpose,
+preferences and local conventions in the workspace's `AGENTS.md`, `SOUL.md`,
+`USER.md` and memory files; upgrades preserve them. Shared guidance does not
+grant permissions, and explicit owner instructions take precedence over its
+defaults within existing execution permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.13",
+  "version": "0.1.0-beta.18",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",
@@ -47,11 +47,14 @@
     "test",
     "tsconfig.json",
     "scripts/assert-local-registry.mjs",
-    ".dockerignore"
+    ".dockerignore",
+    "scripts/trusted-beta.mjs",
+    "scripts/generate-publish-caller.mjs",
+    "scripts/smoke-busy-reply.ts"
   ],
   "publishConfig": {
     "access": "public",
-    "tag": "beta"
+    "tag": "latest"
   },
   "scripts": {
     "setup": "tsx --env-file-if-exists=.env src/setup.ts",

package/scripts/generate-publish-caller.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+// Print a reviewed caller. Does not write repositories or enroll npm trust.
+import assert from 'node:assert/strict';
+import { pathToFileURL } from 'node:url';
+
+export function generateCaller({ repository, packageName, publisherSha, checks }) {
+  assert.match(repository, /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/, 'Invalid repository');
+  assert.match(packageName, /^@[a-z0-9_-]+\/[a-z0-9_.-]+$/, 'Expected scoped npm package');
+  assert.match(publisherSha, /^[a-f0-9]{40}$/, 'Pin the reviewed shared publisher to a full commit SHA');
+  assert(Array.isArray(checks) && checks.length > 0 && checks.every(c => typeof c === 'string' && /^[A-Za-z0-9 (),_.-]+$/.test(c)), 'Required CI check names are mandatory');
+  const core = repository === 'jdorado/ez-agents';
+  const reference = core ? './.github/workflows/npm-beta-shared.yml' : `jdorado/ez-agents/.github/workflows/npm-beta-shared.yml@${publisherSha}`;
+  return `# Generated by scripts/generate-publish-caller.mjs; review changes before merging.
+name: Publish verified npm beta
+on:
+  workflow_dispatch:
+    inputs:
+      release-id:
+        description: 'Numeric ID of the staged draft prerelease'
+        required: true
+        type: string
+      version:
+        description: 'Reviewed beta version staged as draft release vVERSION'
+        required: true
+        type: string
+      source-sha:
+        description: 'Full tested commit SHA; must be current main'
+        required: true
+        type: string
+      artifact-sha256:
+        description: 'SHA-256 of the exact independently verified candidate.tgz'
+        required: true
+        type: string
+permissions: {}
+jobs:
+  publish:
+    if: github.repository == '${repository}' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+      checks: read
+      actions: read
+      pull-requests: read
+      id-token: write
+    uses: ${reference}
+    with:
+      package: '${packageName}'
+      publisher-sha: ${core ? '${{ github.sha }}' : `'${publisherSha}'`}
+      required-checks: '${JSON.stringify(checks)}'
+      release-id: \${{ inputs.release-id }}
+      version: \${{ inputs.version }}
+      source-sha: \${{ inputs.source-sha }}
+      artifact-sha256: \${{ inputs.artifact-sha256 }}
+`;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const [repository, packageName, publisherSha, checksJson, ...extra] = process.argv.slice(2);
+  if (!checksJson || extra.length) throw new Error('Usage: node scripts/generate-publish-caller.mjs OWNER/REPO @SCOPE/PACKAGE SHARED_COMMIT_SHA \'["required CI name"]\'');
+  process.stdout.write(generateCaller({ repository, packageName, publisherSha, checks: JSON.parse(checksJson) }));
+}

package/scripts/smoke-busy-reply.ts

@@ -0,0 +1,58 @@
+// Real restricted Codex reply while a synthetic writer stays active. No Telegram network.
+import { mkdtemp, mkdir, writeFile, symlink } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { spawn } from 'node:child_process'
+import { createRelay } from '../src/index.js'
+import { RunStore } from '../src/runs.js'
+import { ControlStore } from '../src/control-state.js'
+import { initialPreset } from '../src/ai.js'
+import { startExecutorJob } from '../src/executor.js'
+import { serveHostExecutor } from '../src/host-executor.js'
+import { fileURLToPath } from 'node:url'
+import { initializeWorkspace } from '../src/workspace.js'
+import type { Update } from 'grammy/types'
+if (process.argv.includes('--host')) {
+ const root=process.argv[process.argv.indexOf('--host')+1], abort=new AbortController()
+ process.once('SIGTERM',()=>abort.abort())
+ await serveHostExecutor({cli:'codex',agents:[{name:'fixture',workspace:join(root,'mind'),controlDir:join(root,'control'),binDir:fileURLToPath(new URL('../bin',import.meta.url)),sharedWorkspace:join(root,'mind')}]},abort.signal,async(texts,options)=>{
+  if((await new RunStore(options.controlDir).get(options.runId))?.replyOnly)return startExecutorJob(texts,options)
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:['pipe','pipe','pipe']})
+  return {child,stdout:'',cleanup:async()=>{}}
+ })
+ process.exit(0)
+}
+const root=await mkdtemp(join(tmpdir(),'ez-busy-reply-')), workspace=join(root,'mind'), controlDir=join(root,'control')
+await initializeWorkspace(workspace);await mkdir(controlDir,{recursive:true})
+if(process.env.EZ_REPLY_QA_AUTH){await mkdir(join(controlDir,'cli','codex'),{recursive:true});await symlink(process.env.EZ_REPLY_QA_AUTH,join(controlDir,'cli','codex','auth.json'))}
+const hostMode=process.argv.includes('--transport')
+const hostEnvironment={...process.env};delete hostEnvironment.EZ_EXECUTOR_TRANSPORT
+const host=hostMode?spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(import.meta.url),'--host',root],{env:hostEnvironment,stdio:['ignore','inherit','inherit']}):undefined
+if(hostMode)process.env.EZ_EXECUTOR_TRANSPORT='host'
+const control=new ControlStore(controlDir,1000),runs=new RunStore(controlDir)
+await control.requestPairing(101,101);await control.approveOwner(101)
+let writer:any,replyEvents=''
+const relay=createRelay({workspace,controlDir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(texts,options)=>{
+ if(hostMode)return startExecutorJob(texts,options)
+ const run=await runs.get(options.runId)
+ if(run?.replyOnly){const job=await startExecutorJob(texts,options);job.child.stdout?.on('data',c=>{replyEvents+=c});return job}
+ const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:['pipe','pipe','pipe']});writer=child
+ return {child,stdout:'',cleanup:async()=>{}}
+})
+relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
+const replies:string[]=[]
+relay.bot.api.config.use(async(_p,method,payload)=>{if(method==='sendMessage')replies.push((payload as any).text);return {ok:true,result:method==='sendMessage'?{message_id:replies.length,date:0,chat:{id:101,type:'private'},text:(payload as any).text}:true} as any})
+const msg=(id:number,text:string):Update=>({update_id:id,message:{message_id:id,date:0,text,from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}})
+try{
+ await relay.bot.handleUpdate(msg(1,'Long work'));await relay.drainInbox(true)
+ await relay.bot.handleUpdate(msg(2,'What is running? Also calculate 17 times 19. Use your available reply tools. Do not queue any work.'));await relay.drainInbox(true)
+ const started=Date.now()
+ while(!replies.length && Date.now()-started<120000){await relay.drainOutbox();await new Promise(r=>setTimeout(r,250))}
+ if(!replies.some(s=>s.includes('323')))throw new Error('No verified arithmetic reply: '+JSON.stringify(replies))
+ if((await runs.get('tg_1'))?.status!=='running')throw new Error('Writer stopped')
+ while((await runs.get('tg_2'))?.status==='running' && Date.now()-started<120000)await new Promise(r=>setTimeout(r,250))
+ if((await runs.get('tg_2'))?.status!=='completed')throw new Error('Reply did not finish successfully')
+ const reply=await runs.get('tg_2');if(!reply?.replyOnly)throw new Error('No restricted reply lane')
+ await writeFile(join(root,'evidence.json'),JSON.stringify({replyMs:Date.now()-started,replies,writerRunning:(await runs.get('tg_1'))?.status==='running',replyEvents},null,2))
+ console.log(JSON.stringify({root,replyMs:Date.now()-started,replies,writerRunning:true}))
+}finally{await relay.stop();writer?.kill();host?.kill();delete process.env.EZ_EXECUTOR_TRANSPORT}