@jc_stack/ez-agents 0.1.0-beta.13 → 0.1.0-beta.18

package/test/failure.test.ts

@@ -0,0 +1,250 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, mkdir, readFile, writeFile, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { execFile, spawn } from 'node:child_process'
+import { promisify } from 'node:util'
+import { fileURLToPath } from 'node:url'
+import { once } from 'node:events'
+import { redactFailure, failureStamp, needsFailureReview } from '../src/failure.js'
+import { RunStore } from '../src/runs.js'
+import { ControlStore } from '../src/control-state.js'
+import { Scheduler } from '../src/scheduler.js'
+import { initialPreset } from '../src/ai.js'
+import { createRelay } from '../src/index.js'
+import { TelegramSource } from '../src/telegram-source.js'
+import { packageVersion } from '../src/version.js'
+import type { Update } from 'grammy/types'
+const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
+const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<200;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
+
+test('failure evidence is bounded and redacts configured credentials, headers, tokens, URLs and keys',()=>{
+ const token='123456789:abcdefghijklmnopqrstuvwxyz123456789'
+ const text=redactFailure('x'.repeat(5000)+'\nMissing input\nAuthorization: Bearer sensitive123\n{"api_key":"api-credential"}\npassword=private123\nhttps://alice:pass@example.com/file?token=abc#secret\nhttps://api.telegram.org/bot'+token+'/sendMessage\nCustomSecret\nsk-abcdefghijk\neyJabc.def.ghi\n-----BEGIN RSA PRIVATE KEY-----\nABC\n-----END RSA PRIVATE KEY-----',['CustomSecret'])
+ for(const value of ['sensitive123','api-credential','private123','alice','pass@','token=abc',token,'CustomSecret','sk-abcdefghijk','eyJabc.def.ghi','ABC'])assert.ok(!text.includes(value),value)
+ assert.ok(text.includes('Missing input'));assert.ok(text.length<=4096)
+})
+
+test('failure review CLI is owner-bound, rejects stale reviews, and keeps failure evidence immutable',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-failure-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const runs=new RunStore(dir),control=new ControlStore(dir,1000)
+ const env={...process.env,EZ_CONTROL_DIR:dir,EZ_EXECUTOR_CLI:'grok',EZ_RUN_ID:''}
+ const cli=(args:string[],overrides={})=>exec(process.execPath,[bin,...args],{env:{...env,...overrides}})
+ await assert.rejects(cli(['failures']),/Pair an owner/)
+ await control.requestPairing(101,101);await control.approveOwner(101)
+ const execution=await control.captureChoice(initialPreset('grok'))
+ await runs.create({id:'r_failed',chatId:101,telegramUserId:101,texts:['test'],execution})
+ await runs.patch('r_failed',{status:'failed',endedAt:'2026-09-10T07:00:00.000Z',exitCode:7,failureReason:'executor-exit'})
+ await runs.create({id:'r_other',chatId:202,telegramUserId:202,texts:['private']});await runs.patch('r_other',{status:'failed'})
+ const failures=JSON.parse((await cli(['failures'])).stdout)
+ assert.deepEqual(failures.runs.map((r:any)=>r.id),['r_failed'])
+ assert.equal(failures.runs[0].failure.relayVersion,packageVersion)
+ const review=['review','r_failed','--failed-at','2026-09-10T07:00:00.000Z','--status','resolved','--diagnosis','Missing input','--recovery','Created fixture','--outcome','Check exited zero']
+ const stale=[...review];stale[3]='2026-09-10T06:00:00Z';await assert.rejects(cli(stale),/Failure changed/)
+ await assert.rejects(cli(['run','r_other']),/Unknown owner/)
+ await assert.rejects(cli(['run','../escape']),/Invalid/)
+ await cli(review)
+ assert.equal(JSON.parse((await cli(['failures'])).stdout).total,0)
+ const record=JSON.parse((await cli(['run','r_failed'])).stdout)
+ assert.equal(record.status,'failed');assert.equal(record.exitCode,7);assert.equal(record.failureReview.status,'resolved')
+ assert.equal(JSON.parse((await cli(['failures','--all'])).stdout).total,1)
+ await runs.patch('r_failed',{status:'failed',endedAt:'2026-09-10T08:00:00.000Z'})
+ assert.equal(JSON.parse((await cli(['failures'])).stdout).total,1)
+ for(const [id,extra] of [['r_external',{external:{sourceId:'s',bindingId:'b',eventIds:['e']}}],['r_task',{taskId:'task_'+'a'.repeat(32)}],['tg_1',{replyOnly:true}]] as const){
+  await runs.create({id,chatId:101,telegramUserId:101,texts:['test'],...('taskId' in extra?{taskId:extra.taskId}:{}),...('external' in extra?{external:{...extra.external,eventIds:[...extra.external.eventIds]}}:{})})
+  await runs.patch(id,{status:'running',...('replyOnly' in extra?{replyOnly:true}:{})})
+  await assert.rejects(cli(review,{EZ_RUN_ID:id}),/owner-authorized/)
+ }
+ await writeFile(join(dir,'runs','r_bad.json'),'{broken')
+ assert.equal(JSON.parse((await cli(['failures'])).stdout).total,1)
+})
+
+test('failure capture, diagnosis, verified recovery and conditional quiet next tick through real CLI and relay',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-failure-loop-')),runs=new RunStore(dir),control=new ControlStore(dir,1000),scheduler=new Scheduler(dir)
+ const replies:string[]=[],children:ReturnType<typeof spawn>[]=[],fixture=join(dir,'fixture.txt')
+ let reviews=0
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture-token'},async(_texts,options)=>{
+  const scheduled=options.runId.startsWith('r_schedule_')
+  if(scheduled){
+   reviews++
+   const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:options.runId,EZ_EXECUTOR_CLI:'grok'}
+   const pending=JSON.parse((await exec(process.execPath,[bin,'failures'],{env})).stdout)
+   assert.equal(pending.total,1);assert.match(pending.runs[0].failure.error,/Missing fixture/)
+   await writeFile(fixture,'ready')
+   await exec(process.execPath,['-e',`if(require('fs').readFileSync(process.argv[1],'utf8')!=='ready')process.exit(9)`,fixture])
+   await runs.enqueueMessage(options.runId,'Fixture recovery verified')
+   await exec(process.execPath,[bin,'review',pending.runs[0].id,'--failed-at',pending.runs[0].failedAt,'--status','resolved','--diagnosis','Missing fixture','--recovery','Created expected fixture','--outcome','Independent check exited zero'],{env})
+  }
+  const child=spawn(process.execPath,['-e',scheduled?'setTimeout(()=>{},30)':`setTimeout(()=>{console.error('Missing fixture; authorization: Bearer secret-value');process.exit(7)},30)`],{stdio:['pipe','pipe','pipe'],detached:true})
+  children.push(child);await once(child,'spawn');return {child,cleanup:async()=>{if(options.runId==='tg_11')throw new Error('Cleanup after stop')},stdout:''}
+ })
+ relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
+ relay.bot.api.config.use(async(_p,method,payload)=>{if(method==='sendMessage')replies.push((payload as any).text);return {ok:true,result:{message_id:replies.length}} as any})
+ const originalPatch=RunStore.prototype.patch
+ t.mock.method(RunStore.prototype,'patch',async function(this:RunStore,...args:Parameters<RunStore['patch']>){
+  // Hold the PID write until the fast child has closed, reproducing slow disk
+  // without a timer or depending on runner load. Stderr must already be captured.
+  if(args[0]==='tg_10' && args[1].pid && children[0].exitCode===null) await once(children[0],'close')
+  return originalPatch.apply(this,args)
+ })
+ try{
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  const owner=(await control.status()).owner!,execution=await control.captureChoice(initialPreset('grok')),start=Date.now()+2000
+  await scheduler.save({id:'review',name:'Review failures',text:'Review failures',trigger:{everySeconds:60,start:new Date(start).toISOString()},when:'unreviewed-failures',enabled:true,owner,execution})
+  await scheduler.tick(owner,runs,start)
+  assert.equal((await runs.list()).length,0,'no model job for an empty inbox')
+  const update:Update={update_id:10,message:{message_id:10,date:0,text:'Run fixture',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}}
+  await relay.bot.handleUpdate(update);await relay.drainInbox(true)
+  await until(async()=>(await runs.get('tg_10'))?.status==='failed')
+  const failed=(await runs.get('tg_10'))!
+  assert.equal(failed.exitCode,7);assert.equal(failed.failure?.relayVersion,packageVersion);assert.ok(!failed.failure?.error.includes('secret-value'))
+  await scheduler.tick(owner,runs,start+60000);await relay.drainSources()
+  await until(async()=>(await runs.list()).some(r=>r.scheduled && r.status==='completed'))
+  await relay.drainOutbox();assert.deepEqual(replies,['Fixture recovery verified'])
+  assert.equal((await runs.get('tg_10'))?.status,'failed');assert.equal(needsFailureReview((await runs.get('tg_10'))!),false)
+  await scheduler.tick(owner,runs,start+120000);await relay.drainSources();await relay.drainOutbox()
+  assert.equal(reviews,1);assert.equal(replies.length,1)
+  await relay.bot.handleUpdate({...update,update_id:11,message:{...update.message!,message_id:11}});await relay.drainInbox(true)
+  await relay.bot.handleUpdate({...update,update_id:12,message:{...update.message!,message_id:12,text:'/stop'}})
+  await until(async()=>(await runs.get('tg_11'))?.status==='cancelled')
+  assert.equal(needsFailureReview((await runs.get('tg_11'))!),false)
+ }finally{await relay.stop();for(const child of children)child.kill();await rm(dir,{recursive:true,force:true})}
+})
+
+
+test('relay shutdown waits for executor cleanup and final run state', async () => {
+ const dir=await mkdtemp(join(tmpdir(),'ez-stop-finalize-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ let release!:()=>void,entered!:()=>void
+ const gate=new Promise<void>(resolve=>{release=resolve}),cleaning=new Promise<void>(resolve=>{entered=resolve})
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{
+  const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:['pipe','pipe','pipe']})
+  await once(child,'spawn')
+  return {child,cleanup:async()=>{entered();await gate},stdout:''}
+ })
+ relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
+ relay.bot.api.config.use(async()=>({ok:true,result:{message_id:1}} as any))
+ try {
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  await relay.bot.handleUpdate({update_id:90,message:{message_id:90,date:0,text:'fixture',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}})
+  await relay.drainInbox(true)
+  let stopped=false
+  const stop=relay.stop().then(()=>{stopped=true})
+  await cleaning
+  assert.equal(stopped,false,'stop must not finish before cleanup')
+  release();await stop
+  assert.notEqual((await runs.get('tg_90'))?.status,'running')
+ } finally {release();await relay.stop();await rm(dir,{recursive:true,force:true})}
+})
+
+for (const cleanupFails of [false,true]) test(`fatal polling conflict waits for shared shutdown without retrying (cleanup fails: ${cleanupFails})`, async t => {
+ const dir=await mkdtemp(join(tmpdir(),'ez-polling-conflict-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ let release!:()=>void,entered!:()=>void,releaseDelivery!:()=>void,sending!:()=>void,child:ReturnType<typeof spawn>|undefined,polls=0
+ const gate=new Promise<void>(resolve=>{release=resolve}),cleaning=new Promise<void>(resolve=>{entered=resolve})
+ const deliveryGate=new Promise<void>(resolve=>{releaseDelivery=resolve}),deliveryStarted=new Promise<void>(resolve=>{sending=resolve})
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{
+  child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:['pipe','pipe','pipe']})
+  await once(child,'spawn')
+  return {child,cleanup:async()=>{entered();await gate;await control.status()},stdout:''}
+ })
+ const stopSource=TelegramSource.prototype.stop
+ let sourceStops=0
+ t.mock.method(TelegramSource.prototype,'stop',async function(this:TelegramSource){
+  sourceStops++;await stopSource.call(this)
+  if(cleanupFails) throw new Error('Synthetic shutdown failure')
+ })
+ relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
+ relay.bot.api.config.use(async(_prev,method)=>{
+  if(method==='getUpdates') {
+   polls++
+   return {ok:false,error_code:409,description:'Conflict: another getUpdates request'} as any
+  }
+  if(method==='sendMessage') {sending();await deliveryGate}
+  return {ok:true,result:{message_id:1}} as any
+ })
+ try {
+  await control.requestPairing(101,101);await control.approveOwner(101)
+  await relay.bot.handleUpdate({update_id:92,message:{message_id:92,date:0,text:'fixture',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}})
+  await relay.drainInbox(true)
+  const item=await runs.enqueueMessage('tg_92','Fixture reply')
+  const delivery=relay.drainOutbox()
+  await deliveryStarted
+  let finished=false
+  const start=assert.rejects(relay.start(),/409.*Conflict/).then(()=>{finished=true})
+  await cleaning
+  const stopping=relay.stop()
+  assert.equal(relay.stop(),stopping,'concurrent stop calls share one promise')
+  const stopped=cleanupFails?assert.rejects(stopping,/Synthetic shutdown failure/):stopping
+  assert.equal(finished,false,'polling failure must wait for executor cleanup')
+  release()
+  await until(async()=>(await runs.get('tg_92'))?.status!=='running')
+  assert.equal(finished,false,'polling failure must wait for the in-flight delivery receipt')
+  releaseDelivery();await delivery;await start;await stopped
+  assert.equal(relay.stop(),stopping,'finished shutdown remains idempotent')
+  assert.equal(sourceStops,1)
+  assert.deepEqual(JSON.parse(await readFile(join(dir,'outbox',`${item.id}.sent.json`),'utf8')).receipt.messageIds,[1])
+  assert.equal(polls,1,'a conflict must not start another polling loop')
+  assert.equal(relay.bot.isRunning(),false)
+  assert.ok(child && (child.exitCode!==null || child.signalCode!==null))
+  assert.notEqual((await runs.get('tg_92'))?.status,'running')
+  await assert.rejects(readFile(join(dir,'control-state.lock')), {code:'ENOENT'})
+  assert.equal((await control.status()).owner?.telegramUserId,101)
+ } finally {release();releaseDelivery();child?.kill();await relay.stop().catch(()=>{});await rm(dir,{recursive:true,force:true})}
+})
+
+for (const intake of [true,false]) test(`relay shutdown terminates an in-flight ${intake?'intake':'scheduled'} launch`, async () => {
+ const dir=await mkdtemp(join(tmpdir(),'ez-stop-launch-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ let release!:()=>void,entered!:()=>void,child:ReturnType<typeof spawn>|undefined,cleaned=false
+ const gate=new Promise<void>(resolve=>{release=resolve}),launching=new Promise<void>(resolve=>{entered=resolve})
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{
+  entered();await gate
+  child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:['pipe','pipe','pipe']})
+  await once(child,'spawn')
+  return {child,cleanup:async()=>{cleaned=true},stdout:''}
+ })
+ relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
+ relay.bot.api.config.use(async()=>({ok:true,result:{message_id:1}} as any))
+ try {
+  await control.requestPairing(101,101);const owner=await control.approveOwner(101)
+  if(intake) await relay.bot.handleUpdate({update_id:91,message:{message_id:91,date:0,text:'fixture',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:101,type:'private',first_name:'Fixture'}}})
+  else {
+   const scheduler=new Scheduler(dir),at=Date.now()+1000,execution=await control.captureChoice(initialPreset('grok'))
+   await scheduler.save({id:'fixture',name:'Fixture',text:'fixture',trigger:{at:new Date(at).toISOString()},enabled:true,owner,execution})
+   await scheduler.tick(owner,runs,at)
+  }
+  const drain=intake?relay.drainInbox(true):relay.drainSources()
+  await launching
+  let stopped=false
+  const stop=relay.stop().then(()=>{stopped=true})
+  await new Promise(resolve=>setImmediate(resolve))
+  assert.equal(stopped,false,'stop must wait for the pending launch')
+  release();await drain
+  // Bound regressions without leaving a real child running on a failed check.
+  await until(async()=>stopped)
+  await stop
+  assert.equal(cleaned,true)
+  assert.ok(child && (child.exitCode!==null || child.signalCode!==null))
+  assert.ok((await runs.list()).every(run=>run.status!=='running'))
+ } finally {release();child?.kill();await relay.stop();await rm(dir,{recursive:true,force:true})}
+})
+
+test('group members can inspect failures and wake review without exposing other chats', async t => {
+ const dir=await mkdtemp(join(tmpdir(),'ez-group-failure-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const runs=new RunStore(dir),control=new ControlStore(dir,900000),scheduler=new Scheduler(dir)
+ await control.requestPairing(101,-123,'Fixture');const owner=await control.approveOwner(-123,true)
+ const execution=await control.captureChoice(initialPreset('grok'))
+ await runs.create({id:'tg_1',chatId:-123,telegramUserId:202,texts:['failed'],execution})
+ await runs.patch('tg_1',{status:'failed',endedAt:new Date().toISOString()})
+ await runs.create({id:'tg_2',chatId:-124,telegramUserId:202,texts:['private'],execution})
+ await runs.patch('tg_2',{status:'failed'})
+ await runs.create({id:'tg_3',chatId:-123,telegramUserId:303,texts:['review'],execution})
+ await runs.patch('tg_3',{status:'running'})
+ const env={...process.env,EZ_CONTROL_DIR:dir,EZ_EXECUTOR_CLI:'grok',EZ_RUN_ID:'tg_3'}
+ const result=JSON.parse((await exec(process.execPath,[bin,'failures'],{env})).stdout)
+ assert.deepEqual(result.runs.map((r:any)=>r.id),['tg_1'])
+ const at=Date.now()+1000
+ await scheduler.save({id:'review',name:'Review',text:'Review failures',trigger:{at:new Date(at).toISOString()},when:'unreviewed-failures',enabled:true,owner,execution})
+ await scheduler.tick(owner,runs,at)
+ assert.equal((await runs.list()).filter(r=>r.scheduled).length,1)
+ await assert.rejects(exec(process.execPath,[bin,'run','tg_2'],{env}),/Unknown owner/)
+})

package/test/group-owner.test.ts

@@ -0,0 +1,36 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { ControlStore } from '../src/control-state.js'
+import { isOwner, ownsRun } from '../src/identity.js'
+import { executionBlockReason } from '../src/execution-authority.js'
+import { RunStore } from '../src/runs.js'
+
+test('group pairing requires explicit group approval and grants only the exact group', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-group-owner-'))
+  try {
+    const store = new ControlStore(dir, 900000)
+    await store.requestPairing(101, -123, 'Test group')
+    assert.equal((await store.status()).owner, null)
+    await assert.rejects(store.approveOwner(101), /No active/)
+    await assert.rejects(store.approveOwner(-124, true), /No active/)
+    const owner = await store.approveOwner(-123, true)
+    assert.equal(owner.kind, 'group')
+    const ctx = (id: number, chat = -123, bot = false) => ({from: {id, is_bot: bot, first_name: 'Member'}, chat: {id: chat, type: 'supergroup' as const, title: 'Test'}})
+    assert.equal(isOwner(ctx(101), owner), true)
+    assert.equal(isOwner(ctx(202), owner), true)
+    assert.equal(isOwner(ctx(202, -124), owner), false)
+    assert.equal(isOwner(ctx(202, -123, true), owner), false)
+    assert.equal(isOwner({...ctx(101), chat: {id: 101, type: 'private', first_name: 'User'}}, owner), false)
+    const run = await new RunStore(dir).create({id: 'tg_1', chatId: -123, telegramUserId: 202, texts: ['Hi']})
+    assert.equal(executionBlockReason(run, owner), undefined)
+    assert.equal(executionBlockReason({...run, chatId: -124}, owner), 'owner-mismatch')
+    assert.equal(ownsRun(owner, {...run, telegramUserId: 0}), false)
+    const restored = (await new ControlStore(dir, 900000).status()).owner
+    assert.deepEqual(restored, owner)
+    await store.revokeOwner()
+    assert.equal(ownsRun((await store.status()).owner, run), false)
+  } finally { await rm(dir, {recursive: true, force: true}) }
+})

package/test/host-executor.test.ts

@@ -1,7 +1,7 @@
 import { ownerRun } from './helpers/owner-run.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtemp, mkdir, readFile, writeFile, rm, realpath } from 'node:fs/promises'
+import { mkdtemp, mkdir, readFile, writeFile, rm, realpath, symlink } from 'node:fs/promises'
 import path from 'node:path'
 import { tmpdir } from 'node:os'
 import { serveHostExecutor } from '../src/host-executor.js'
@@ -9,7 +9,9 @@ import { spawn } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 import { isHostRunId } from '../src/host-executor-protocol.js'
 import { EXECUTOR_REGISTRY } from '../src/executor.js'
+import { RunStore } from '../src/runs.js'
 import { packageVersion } from '../src/version.js'
+import { executionDefaults } from '../src/model-policy.js'
 
 test('one installed CLI executes two agent bindings with separate minds and sanitized environment', async () => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-'))
@@ -23,16 +25,19 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     const binary=path.join(root,'cli')
     await writeFile(binary,`#!${process.execPath}\nif(process.env.EZ_RUN_ID==='r_hold')setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,args:process.argv.slice(2)}));\n`,{mode:0o700})
     await writeFile(path.join(root,'claude'),await readFile(binary),{mode:0o700})
+    await writeFile(path.join(root,'codex'),await readFile(binary),{mode:0o700})
     process.env.PATH=root+path.delimiter+oldPath
     EXECUTOR_REGISTRY.grok.command=binary
     EXECUTOR_REGISTRY.grok.buildArgs=EXECUTOR_REGISTRY.codex.buildArgs
     process.env.TELEGRAM_BOT_TOKEN='must-not-reach-host-cli'
+    const sharedAlias=path.join(root,'shared-alias')
+    await symlink(root,sharedAlias)
     const agents=await Promise.all(['one','two'].map(async name=>{
       const workspace=path.join(root,name,'mind'),controlDir=path.join(root,name,'control')
       await mkdir(workspace,{recursive:true});await mkdir(controlDir,{recursive:true})
       const toolsHome=path.join(root,name,'tools');await mkdir(toolsHome)
       await writeFile(path.join(toolsHome,'config.json'),JSON.stringify({schemaVersion:1,workspace:await realpath(workspace)}))
-      return {name,workspace,controlDir,binDir:path.join(root,'bin'),toolsHome}
+      return {name,workspace,controlDir,binDir:path.join(root,'bin'),toolsHome,sharedWorkspace:name==='two'?sharedAlias:root}
     }))
     server=serveHostExecutor({cli:'grok',agents},abort.signal)
     for(const agent of agents){
@@ -51,7 +56,9 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       assert.equal(result.cwd,await realpath(agent.workspace))
       assert.equal(result.control,agent.controlDir)
       assert.equal(result.token,undefined)
+      assert.match(result.args.join(' '),/you are its repairer/)
       assert.ok(result.args.includes(agent.toolsHome))
+      assert.ok(result.args.includes(await realpath(root)))
       assert.ok(!result.args.includes('/wrong'))
       assert.equal(result.home,process.env.HOME)
     }
@@ -62,9 +69,12 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     let stdout='',stderr=''
     client.stdout.on('data',chunk=>stdout+=chunk)
     client.stderr.on('data',chunk=>stderr+=chunk)
-    client.stdin.end(JSON.stringify({texts:['Telegram message'],options:{cli:'grok',timeoutMs:5000}}))
+    client.stdin.end(JSON.stringify({texts:['Telegram message'],options:{cli:'grok',timeoutMs:5000,codexAutoCompactTokens:32000,repairEnabled:false}}))
     assert.equal(await new Promise(resolve=>client.once('close',resolve)),0,stderr)
     assert.equal(JSON.parse(stdout).run,'tg_6293305')
+    assert.match(JSON.parse(stdout).args.join(' '),/Automatic repair is disabled/)
+    assert.doesNotMatch(JSON.parse(stdout).args.join(' '),/you are its repairer/)
+    assert.ok(JSON.parse(stdout).args.includes('model_auto_compact_token_limit=32000'))
     const eventId='event_'+'a'.repeat(64)
     await ownerRun(agents[0].controlDir, eventId, {sourceId:'fixture',bindingId:'binding',eventIds:['1']})
     const eventClient=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),agents[0].controlDir,eventId],{stdio:['pipe','pipe','pipe']})
@@ -80,22 +90,43 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     let switchedOutput=''
     switched.stdout.on('data',chunk=>switchedOutput+=chunk)
     switched.stderr.resume()
-    switched.stdin.end(JSON.stringify({texts:['Explicit CLI change'],options:{cli:'claude',timeoutMs:5000}}))
+    switched.stdin.end(JSON.stringify({texts:['Explicit CLI change'],options:executionDefaults('claude',{cli:'claude',timeoutMs:5000,effort:undefined})}))
     assert.equal(await new Promise(resolve=>switched.once('close',resolve)),0)
     assert.ok(JSON.parse(switchedOutput).args.includes('--print'))
+    // The bound cache may advertise a model absent from the host's cache.
+    const codexHome=path.join(agents[0].controlDir,'cli','codex')
+    await mkdir(codexHome,{recursive:true})
+    await writeFile(path.join(codexHome,'models_cache.json'),JSON.stringify({models:[{slug:'agent-only-fixture',visibility:'list',display_name:'Agent model',supported_reasoning_levels:[]}]}))
+    await ownerRun(agents[0].controlDir,'tg_6293307')
+    const bound=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),agents[0].controlDir,'tg_6293307'],{stdio:['pipe','pipe','pipe']})
+    let boundOutput='',boundError=''
+    bound.stdout.on('data',chunk=>boundOutput+=chunk)
+    bound.stderr.on('data',chunk=>boundError+=chunk)
+    bound.stdin.end(JSON.stringify({texts:['Switch to agent model'],options:{cli:'codex',model:'agent-only-fixture',timeoutMs:5000}}))
+    assert.equal(await new Promise(resolve=>bound.once('close',resolve)),0,boundError)
+    assert.ok(JSON.parse(boundOutput).args.includes('agent-only-fixture'))
     await assert.rejects(serveHostExecutor({cli:'grok',agents},new AbortController().signal),/already running/)
     const directory=path.join(agents[0].controlDir,'host-executor')
     const submit=async(id:string)=>{await ownerRun(agents[0].controlDir,id);await writeFile(path.join(directory,id+'.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',timeoutMs:5000}}))}
     await submit('r_hold')
     for(let n=0;n<100;n++){try{await readFile(path.join(directory,'r_hold.process.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
-    await submit('r_queued')
+    await new RunStore(agents[0].controlDir).create({id:'r_schedule_queued',chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'shared',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
+    await new RunStore(agents[0].controlDir).patch('r_schedule_queued',{status:'running'})
+    await writeFile(path.join(directory,'r_schedule_queued.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',sharedWorkspace:'/wrong'}}))
+    const otherDirectory=path.join(agents[1].controlDir,'host-executor')
+    await ownerRun(agents[1].controlDir,'r_other_shared')
+    await writeFile(path.join(otherDirectory,'r_other_shared.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok'}}))
     await new Promise(r=>setTimeout(r,350))
-    await assert.rejects(readFile(path.join(directory,'r_queued.running.json')),{code:'ENOENT'})
+    await assert.rejects(readFile(path.join(directory,'r_schedule_queued.running.json')),{code:'ENOENT'})
+    await assert.rejects(readFile(path.join(otherDirectory,'r_other_shared.running.json')),{code:'ENOENT'})
+    await assert.rejects(readFile(path.join(otherDirectory,'r_other_shared.events')),{code:'ENOENT'})
     await writeFile(path.join(directory,'r_hold.cancel'),'')
     let output=''
-    for(let n=0;n<200;n++){try{output=await readFile(path.join(directory,'r_queued.events'),'utf8');if(output.includes('"stream":"exit"'))break}catch{}await new Promise(r=>setTimeout(r,20))}
+    for(let n=0;n<200;n++){try{output=await readFile(path.join(directory,'r_schedule_queued.events'),'utf8');if(output.includes('"stream":"exit"'))break}catch{}await new Promise(r=>setTimeout(r,20))}
     assert.match(output, /"stream":"exit","code":0/)
     assert.match(await readFile(path.join(directory,'r_hold.events'),'utf8'), /"stream":"exit","code":1/)
+    for(let n=0;n<200;n++){try{output=await readFile(path.join(otherDirectory,'r_other_shared.events'),'utf8');if(output.includes('"stream":"exit"'))break}catch{}await new Promise(r=>setTimeout(r,20))}
+    assert.match(output, /"stream":"exit","code":0/)
   } finally {
     abort.abort();await server
     EXECUTOR_REGISTRY.grok.command=old

package/test/intake-relay.test.ts

@@ -11,6 +11,8 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { InboxStore } from '../src/inbox.js'
 import { ApprovalStore } from '../src/approval.js'
+import { Tasks } from '../src/tasks.js'
+import { ownerRun } from './helpers/owner-run.js'
 import { packageVersion } from '../src/version.js'
 
 const message = (id: number, text = 'hello'): Update => ({
@@ -27,6 +29,7 @@ const fixture = async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-intake-relay-'))
   const launched: string[][] = []
   const replies: string[] = []
+  const members = new Map<number, string>()
   const keyboards: { text: string; callback_data: string }[][][] = []
   const children: ReturnType<typeof spawn>[] = []
   const config = {
@@ -53,12 +56,13 @@ const fixture = async () => {
       username: 'fixture_bot',
     } as typeof relay.bot.botInfo
     relay.bot.api.config.use(async (_previous, method, payload) => {
+      if (method === 'getChatMember' && members.get((payload as {user_id: number}).user_id) === 'error') throw new Error('Fixture membership unavailable')
       if (method === 'sendMessage') replies.push((payload as { text: string }).text)
       const keyboard = (payload as { reply_markup?: { inline_keyboard?: { text: string; callback_data: string }[][] } }).reply_markup?.inline_keyboard
       if (keyboard) keyboards.push(keyboard)
       return {
         ok: true,
-        result: method === 'getFile' ? { file_path: 'fixture.ogg' } : { message_id: 42 },
+        result: method === 'getFile' ? { file_path: 'fixture.ogg' } : method === 'getChatMember' ? {status: members.get((payload as {user_id: number}).user_id) ?? 'member'} : { message_id: 42 },
       } as never
     })
     return relay
@@ -71,6 +75,7 @@ const fixture = async () => {
     dir,
     launched,
     replies,
+    members,
     keyboards,
     get relay() {
       return relay
@@ -94,6 +99,108 @@ const fixture = async () => {
   }
 }
 
+test('approved owner group accepts different members, controls and group delivery; rejects other chats and anonymous posts', async () => {
+  const f = await fixture()
+  const control = new ControlStore(f.dir, 900000)
+  const group = (id: number, sender = 202, chatId = -101): Update => ({update_id: id, message: {
+    message_id: id, date: 0, text: 'Hello', from: {id: sender, is_bot: false, first_name: 'Member'},
+    chat: {id: chatId, type: 'supergroup', title: 'Team'},
+  }})
+  try {
+    await control.revokeOwner()
+    await f.relay.bot.handleUpdate(group(1))
+    assert.equal(f.launched.length, 0)
+    assert.equal((await control.status()).pending[0].title, 'Team')
+    await control.approveOwner(-101, true)
+    await f.relay.bot.handleUpdate(group(2, 303))
+    await f.relay.bot.handleUpdate(group(3, 404))
+    await f.relay.drainInbox(true)
+    const run = (await new RunStore(f.dir).list())[0]
+    assert.equal(run.chatId, -101)
+    assert.equal(run.telegramUserId, 303)
+    assert.equal(run.texts.length, 2)
+    assert.match(run.texts[0], /303/)
+    assert.match(run.texts[1], /404/)
+    assert.equal(f.launched.length, 1)
+    await new RunStore(f.dir).enqueueMessage(run.id, 'Group reply')
+    await f.relay.drainOutbox()
+    assert.ok(f.replies.includes('Group reply'))
+    const approval = new ApprovalStore(f.dir)
+    await approval.requestApproval('group_action', 'Approve this?', run.id)
+    f.members.set(707, 'left')
+    await f.relay.bot.handleUpdate({update_id: 12, callback_query: {
+      id: 'outsider', chat_instance: 'test', from: {id: 707, is_bot: false, first_name: 'Outsider'},
+      message: group(12).message!, data: 'approval:group_action:approve',
+    }})
+    assert.equal((await approval.getDecision('group_action'))?.decision, 'pending')
+    f.members.set(707, 'error')
+    await assert.rejects(f.relay.bot.handleUpdate({update_id: 13, callback_query: {
+      id: 'unavailable', chat_instance: 'test', from: {id: 707, is_bot: false, first_name: 'Member'},
+      message: group(13).message!, data: 'approval:group_action:approve',
+    }}), /membership verification unavailable/)
+    await f.relay.bot.handleUpdate({update_id: 4, callback_query: {
+      id: 'callback', chat_instance: 'test', from: {id: 404, is_bot: false, first_name: 'Second'},
+      message: group(4).message!, data: 'approval:group_action:approve',
+    }})
+    await f.relay.drainInbox(true)
+    assert.equal((await approval.getDecision('group_action'))?.decidedBy, 404)
+    await f.relay.bot.handleUpdate(group(5, 202, -102))
+    await f.relay.bot.handleUpdate(message(6))
+    const anonymous = group(7); anonymous.message!.sender_chat = anonymous.message!.chat
+    await f.relay.bot.handleUpdate(anonymous)
+    const bot = group(8); bot.message!.from!.is_bot = true
+    await f.relay.bot.handleUpdate(bot)
+    assert.equal((await new InboxStore(f.dir).status()).pending, 0)
+    const status = group(9); status.message!.text = '/status'
+    await f.relay.bot.handleUpdate(status)
+    assert.ok(f.replies.some(text => text.includes('🟢 Ez is online')))
+    assert.ok(f.replies.some(text => text.includes('Queue:')))
+    // Seed the retry fixture only after the relay writer and its timer are idle.
+    await f.relay.stop()
+    await f.relay.drainInbox()
+    const inbox = new InboxStore(f.dir)
+    await inbox.accept(group(10, 505))
+    const failed = await inbox.next(true)
+    await inbox.finish(failed!.id, true)
+    await f.relay.bot.handleUpdate({update_id: 11, callback_query: {
+      id: 'retry', chat_instance: 'test', from: {id: 606, is_bot: false, first_name: 'Third'},
+      message: group(11).message!, data: 'menu:retry',
+    }})
+    assert.equal(await inbox.pending(failed!.id), true)
+    await inbox.cancel()
+    await control.revokeOwner()
+    await assert.rejects(new RunStore(f.dir).enqueueMessage('not_a_run', 'no'))
+  } finally { await f.close() }
+})
+
+test('owner group discovery routes only to the private chat and rechecks identity', async () => {
+  const f = await fixture()
+  const group = (id: number, sender = 101): Update => ({update_id: id, message: {
+    message_id: id, date: 0, text: 'Hi from the group',
+    from: {id: sender, is_bot: false, first_name: 'Fixture'},
+    chat: {id: -101, type: 'supergroup', title: 'Family'},
+  }})
+  try {
+    await f.relay.bot.handleUpdate(group(1, 202))
+    const anonymous = group(2)
+    anonymous.message!.sender_chat = anonymous.message!.chat
+    await f.relay.bot.handleUpdate(anonymous)
+    assert.equal((await new InboxStore(f.dir).status()).pending, 0)
+    await f.relay.bot.handleUpdate(group(3))
+    await f.relay.drainInbox(true)
+    const run = (await new RunStore(f.dir).list())[0]
+    assert.equal(run.chatId, 101)
+    assert.equal(run.messageId, undefined)
+    assert.match(run.texts[0], /Reply privately/)
+    assert.match(run.texts[0], /"chatId":-101/)
+    assert.equal(f.launched.length, 1)
+    await f.relay.bot.handleUpdate(group(4))
+    await new ControlStore(f.dir, 1000).revokeOwner()
+    await f.relay.drainInbox(true)
+    assert.equal(f.launched.length, 1)
+  } finally { await f.close() }
+})
+
 test('four-item menu is owner-only; saved AI buttons work and forged/stale buttons cannot change settings', async () => {
   const f = await fixture()
   const callback = (id: number, data: string, user = 101): Update => ({
@@ -188,7 +295,7 @@ test('slow voice normalization preserves instruction order and leaves controls r
     await downloading
     await f.relay.bot.handleUpdate(message(3, '/status'))
     assert.ok(f.replies.some((text) => text.includes('2 incoming messages')))
-    assert.ok(f.replies.some((text) => text.includes(`Ez relay: ${packageVersion} (running)`)))
+    assert.ok(f.replies.some((text) => text.includes(`Relay: running · v${packageVersion}`)))
     await f.relay.bot.handleUpdate(message(4, 'Next instruction'))
     assert.equal(f.launched.length, 0)
     release()
@@ -218,8 +325,8 @@ test('cancel clears accepted and queued work, never spawns a cancelled run, and
     assert.equal(f.launched.length, 0)
     assert.equal((await runs.get(run.id))?.status, 'cancelled')
     await f.relay.bot.handleUpdate(message(3, '/status'))
-    assert.match(f.replies.at(-1)!, /0 runs; 0 incoming messages/)
-    assert.match(f.replies.at(-1)!, /1 unknown/)
+    assert.match(f.replies.at(-1)!, /Queue: empty/)
+    assert.match(f.replies.at(-1)!, /1 delivery is awaiting confirmation/)
   } finally {
     await f.close()
   }
@@ -335,3 +442,33 @@ test('media failure quarantines its instruction batch instead of executing incom
     await f.close()
   }
 })
+
+
+test('approved family messages enter restricted task runs, never the owner session', async()=>{
+  const f=await fixture()
+  const group=(id:number,sender=202):Update=>({update_id:id,message:{message_id:id,date:Math.ceil(Date.now()/1000),text:'hello Annie',from:{id:sender,is_bot:false,first_name:'Member'},chat:{id:-101,type:'group',title:'Family'}}})
+  try {
+    await f.relay.bot.handleUpdate(group(100)) // Registers transport, grants nothing.
+    assert.equal(f.launched.length,0)
+    await ownerRun(f.dir,'setup')
+    const tasks=new Tasks(f.dir),runs=new RunStore(f.dir)
+    const proposal=await tasks.ownerCall('setup','propose',{sourceId:'telegram',conversationId:'-101',purpose:'Family conversation',context:'Only group context',hours:24,waitForIncoming:true,untilRevoked:true}) as {id:string}
+    await new ApprovalStore(f.dir).recordDecision(proposal.id,'approved',101)
+    await tasks.decide(proposal.id)
+    await runs.patch('setup',{status:'completed'})
+    await f.relay.bot.handleUpdate(group(101))
+    const anonymous=group(102);anonymous.message!.sender_chat=anonymous.message!.chat
+    await f.relay.bot.handleUpdate(anonymous)
+    const bot=group(103);bot.message!.from!.is_bot=true;await f.relay.bot.handleUpdate(bot)
+    await new Promise(r=>setTimeout(r,3100))
+    await f.relay.drainSources()
+    const launched=(await runs.list()).filter(r=>r.taskId)
+    assert.equal(launched.length,1)
+    assert.equal(launched[0].taskId,proposal.id)
+    assert.equal(launched[0].external!.eventIds.length,1)
+    assert.equal(launched[0].external!.eventIds[0],'tg_n101_101')
+    assert.equal(f.launched.length,1)
+    assert.match(f.launched[0][0],/Member/)
+    await tasks.ownerCall('setup','list',{}).then(()=>assert.fail('completed run cannot change grants'),()=>{})
+  } finally {await f.close()}
+})