@jc_stack/ez-agents 0.1.0-beta.18 → 0.1.0-beta.19

package/src/workforce-watch-cli.ts

@@ -0,0 +1,14 @@
+import { WorkforceWatch, WorkforceWatchServer } from './workforce-watch.js'
+import { readFileSync } from 'node:fs'
+const positive=(value:string|undefined,name:string,fallback:number):number=>{if(!value)return fallback;const parsed=Number(value);if(!Number.isSafeInteger(parsed)||parsed<=0)throw new Error(`${name} must be a positive integer`);return parsed}
+const pagerDutyRoutingKey=()=>{const secretFile='/run/secrets/workforce_watch_pagerduty';try{const value=readFileSync(secretFile,'utf8').trim();if(!value||/[\r\n]/.test(value))throw new Error('Workforce PagerDuty secret must contain exactly one routing key');return value}catch(error){if((error as NodeJS.ErrnoException).code==='ENOENT')return undefined;throw error}}
+const enrollmentToken=process.env.EZ_WATCH_ENROLL_TOKEN?.trim();if(!enrollmentToken)throw new Error('EZ_WATCH_ENROLL_TOKEN is required')
+const telegramToken=process.env.TELEGRAM_BOT_TOKEN?.trim(),telegramChatId=process.env.EZ_WATCH_TELEGRAM_CHAT_ID?.trim();if(Boolean(telegramToken)!==Boolean(telegramChatId))throw new Error('Set both TELEGRAM_BOT_TOKEN and EZ_WATCH_TELEGRAM_CHAT_ID, or neither')
+const routingKey=pagerDutyRoutingKey()
+const notify=telegramToken&&telegramChatId?async(text:string)=>{const response=await fetch(`https://api.telegram.org/bot${telegramToken}/sendMessage`,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({chat_id:telegramChatId,text,disable_web_page_preview:true}),redirect:'error',signal:AbortSignal.timeout(10000)});if(!response.ok)throw new Error(`Telegram delivery returned HTTP ${response.status}`)}:undefined
+const page=routingKey?async(event:import('./workforce-watch.js').WorkforcePage)=>{const response=await fetch('https://events.pagerduty.com/v2/enqueue',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({routing_key:routingKey,event_action:event.action,dedup_key:event.dedupKey,payload:{summary:event.summary,source:event.source,severity:event.severity,component:event.dedupKey.slice('ez:workforce:'.length),custom_details:event.customDetails}}),redirect:'error',signal:AbortSignal.timeout(10000)});if(!response.ok)throw new Error(`PagerDuty delivery returned HTTP ${response.status}`)}:undefined
+if(!page)throw new Error('Mount the workforce PagerDuty secret at /run/secrets/workforce_watch_pagerduty')
+const watch=new WorkforceWatch({stateDir:process.env.EZ_WATCH_STATE_DIR?.trim()||'/state',enrollmentToken,recoveryThreshold:positive(process.env.EZ_WATCH_RECOVERY_CHECKS,'EZ_WATCH_RECOVERY_CHECKS',2),notify,page,log:message=>console.error(message)})
+const port=positive(process.env.EZ_WATCH_PORT,'EZ_WATCH_PORT',8080),host=process.env.EZ_WATCH_HOST?.trim()||'0.0.0.0',evaluateMs=positive(process.env.EZ_WATCH_EVALUATE_SECONDS,'EZ_WATCH_EVALUATE_SECONDS',30)*1000,server=new WorkforceWatchServer(watch,enrollmentToken)
+await server.listen(port,host);watch.start(evaluateMs);console.log(`Workforce Watch listening on ${host}:${port}`)
+for(const signal of ['SIGINT','SIGTERM'] as const)process.once(signal,()=>{watch.stop();void server.close().finally(()=>process.exit(0))})

package/src/workforce-watch.ts

@@ -0,0 +1,155 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+
+export type WatchStatus = 'ok' | 'failed'
+export type WatchSeverity = 'warning' | 'critical'
+export type WatchEvent = { at: string; status: WatchStatus; activity?: string; error?: string; runId?: string; logsHint?: string; terminal?: boolean }
+export type WorkforcePage = { action: 'trigger' | 'resolve'; dedupKey: string; summary: string; severity: WatchSeverity; source: string; customDetails: Record<string, string> }
+type Incident = { openedAt: number; reason: 'missed-check-in' | 'terminal-failure'; notifiedAt?: number; pagerDutyTriggeredAt?: number; recoveredAt?: number; telegramRecoveredAt?: number; pagerDutyResolvedAt?: number }
+type Worker = { id: string; tokenHash: string; checkInMs: number; graceMs: number; severity: WatchSeverity; runbookUrl?: string; createdAt: number; lastSeenAt: number; recoveryChecks: number; history: WatchEvent[]; incident?: Incident }
+type State = { version: 1; workers: Record<string, Worker> }
+export type EnrollRequest = { workerId: string; checkInSeconds: number; graceSeconds: number; severity?: WatchSeverity; runbookUrl?: string }
+export type CheckInRequest = { status: WatchStatus; activity?: string; error?: string; runId?: string; logsHint?: string; terminal?: boolean }
+export type WorkforceWatchOptions = { stateDir: string; enrollmentToken: string; recoveryThreshold?: number; notify?: (message: string) => Promise<void>; page?: (event: WorkforcePage) => Promise<void>; now?: () => number; log?: (message: string) => void }
+
+const WORKER_ID = /^[a-z][a-z0-9-]{0,63}$/
+const MAX_HISTORY = 5, MAX_BODY_BYTES = 8192
+const hash = (value: string): string => createHash('sha256').update(value).digest('hex')
+const sameSecret = (candidate: string, expectedHash: string): boolean => {
+  const a = Buffer.from(hash(candidate), 'hex'), b = Buffer.from(expectedHash, 'hex')
+  return a.length === b.length && timingSafeEqual(a, b)
+}
+const positive = (value: unknown, field: string, minimum: number, maximum: number): number => {
+  if (!Number.isSafeInteger(value) || (value as number) < minimum || (value as number) > maximum) throw new Error(`${field} must be an integer from ${minimum} to ${maximum}`)
+  return value as number
+}
+const text = (value: unknown, field: string, maximum: number): string | undefined => {
+  if (value === undefined) return undefined
+  if (typeof value !== 'string' || !value.trim() || value.length > maximum) throw new Error(`Invalid ${field}`)
+  return value.trim()
+}
+const validateEnroll = (value: unknown): EnrollRequest => {
+  if (!value || typeof value !== 'object') throw new Error('Invalid enrollment')
+  const input = value as Record<string, unknown>, severity = input.severity === undefined ? 'critical' : input.severity
+  if (typeof input.workerId !== 'string' || !WORKER_ID.test(input.workerId)) throw new Error('Invalid workerId')
+  if (severity !== 'warning' && severity !== 'critical') throw new Error('Invalid severity')
+  const runbookUrl = text(input.runbookUrl, 'runbookUrl', 500)
+  if (runbookUrl) { let url: URL; try { url = new URL(runbookUrl) } catch { throw new Error('Invalid runbookUrl') }; if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash) throw new Error('Invalid runbookUrl') }
+  return { workerId: input.workerId, checkInSeconds: positive(input.checkInSeconds, 'checkInSeconds', 10, 86400), graceSeconds: positive(input.graceSeconds, 'graceSeconds', 0, 86400), severity, runbookUrl }
+}
+const validateCheckIn = (value: unknown): CheckInRequest => {
+  if (!value || typeof value !== 'object') throw new Error('Invalid check-in')
+  const input = value as Record<string, unknown>
+  if (input.status !== 'ok' && input.status !== 'failed') throw new Error('Invalid status')
+  if (input.terminal !== undefined && typeof input.terminal !== 'boolean') throw new Error('Invalid terminal')
+  return { status: input.status, activity: text(input.activity, 'activity', 300), error: text(input.error, 'error', 500), runId: text(input.runId, 'runId', 120), logsHint: text(input.logsHint, 'logsHint', 500), terminal: input.terminal }
+}
+const errorText = (error: unknown): string => error instanceof Error ? error.message : 'unknown error'
+
+export class WorkforceWatch {
+  private readonly recoveryThreshold: number
+  private readonly now: () => number
+  private serial: Promise<unknown> = Promise.resolve()
+  private timer?: ReturnType<typeof setInterval>
+  constructor(private readonly options: WorkforceWatchOptions) {
+    if (!options.enrollmentToken.trim()) throw new Error('EZ_WATCH_ENROLL_TOKEN is required')
+    this.recoveryThreshold = positive(options.recoveryThreshold ?? 2, 'recoveryThreshold', 1, 10); this.now = options.now ?? Date.now
+  }
+  private get stateFile(): string { return join(this.options.stateDir, 'workforce-watch.json') }
+  private async state(): Promise<State> {
+    await mkdir(this.options.stateDir, { recursive: true, mode: 0o700 })
+    await chmod(this.options.stateDir, 0o700)
+    try { const parsed: unknown = JSON.parse(await readFile(this.stateFile, 'utf8')); if (!parsed || typeof parsed !== 'object' || (parsed as {version?:unknown}).version !== 1 || typeof (parsed as {workers?:unknown}).workers !== 'object') throw new Error('Invalid workforce watch state'); return parsed as State }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { version: 1, workers: {} }; throw error }
+  }
+  private async save(state: State): Promise<void> { const temporary = `${this.stateFile}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`; await writeFile(temporary, `${JSON.stringify(state)}\n`, { mode: 0o600 }); await rename(temporary, this.stateFile) }
+  private enqueue<T>(work: () => Promise<T>): Promise<T> { const result = this.serial.then(work, work); this.serial = result.then(() => undefined, () => undefined); return result }
+  private latest(worker: Worker): WatchEvent | undefined { return worker.history.at(-1) }
+  private format(worker: Worker, action: 'opened' | 'recovered'): string {
+    const latest = this.latest(worker), lines = [`Workforce Watch ${action === 'opened' ? 'alert' : 'recovered'}: ${worker.id}`, action === 'opened' ? `Reason: ${worker.incident?.reason === 'terminal-failure' ? 'terminal failure' : 'missed check-in'}` : 'Recovery: required clean check-ins received', `Severity: ${worker.severity}`]
+    if (latest?.activity) lines.push(`Last activity: ${latest.activity}`); if (latest?.error) lines.push(`Last error: ${latest.error}`); if (latest?.runId) lines.push(`Run: ${latest.runId}`); if (latest) lines.push(`Last seen: ${latest.at}`); if (latest?.logsHint) lines.push(`Next: ${latest.logsHint}`); if (worker.runbookUrl) lines.push(`Runbook: ${worker.runbookUrl}`)
+    return lines.join('\n')
+  }
+  private page(worker: Worker, action: 'trigger' | 'resolve'): WorkforcePage {
+    const latest = this.latest(worker), incident = worker.incident!
+    const customDetails: Record<string, string> = { reason: incident.reason, lastSeen: latest?.at ?? new Date(worker.lastSeenAt).toISOString() }
+    if (latest?.activity) customDetails.activity = latest.activity
+    if (latest?.error) customDetails.error = latest.error
+    if (latest?.runId) customDetails.runId = latest.runId
+    if (latest?.logsHint) customDetails.logsHint = latest.logsHint
+    if (worker.runbookUrl) customDetails.runbookUrl = worker.runbookUrl
+    return { action, dedupKey: `ez:workforce:${worker.id}`, summary: `Workforce Watch ${action}: ${worker.id}`, severity: worker.severity, source: 'ez-workforce-watch', customDetails }
+  }
+  private reopen(worker: Worker, now: number, reason: Incident['reason']): void {
+    const incident = worker.incident
+    if (!incident) { worker.incident = { openedAt: now, reason }; return }
+    if (incident.recoveredAt === undefined) return
+    if (incident.pagerDutyResolvedAt !== undefined) delete incident.pagerDutyTriggeredAt
+    if (incident.telegramRecoveredAt !== undefined) delete incident.notifiedAt
+    delete incident.pagerDutyResolvedAt
+    delete incident.telegramRecoveredAt
+    delete incident.recoveredAt
+    incident.openedAt = now
+    incident.reason = reason
+    worker.recoveryChecks = 0
+  }
+  private async notifyOpen(state: State, worker: Worker): Promise<void> {
+    const incident = worker.incident; if (!incident) return
+    let failure: unknown, changed = false
+    if (incident.pagerDutyTriggeredAt === undefined && this.options.page) try { await this.options.page(this.page(worker, 'trigger')); incident.pagerDutyTriggeredAt = this.now(); changed = true } catch (error) { failure ??= error }
+    if (incident.notifiedAt === undefined && this.options.notify) try { await this.options.notify(this.format(worker, 'opened')); incident.notifiedAt = this.now(); changed = true } catch (error) { failure ??= error }
+    if (changed) await this.save(state)
+    if (failure) throw failure
+  }
+  private async notifyRecovery(state: State, worker: Worker): Promise<void> {
+    const incident = worker.incident; if (incident?.recoveredAt === undefined) return
+    let failure: unknown, changed = false
+    if (incident.pagerDutyTriggeredAt !== undefined && incident.pagerDutyResolvedAt === undefined && this.options.page) try { await this.options.page(this.page(worker, 'resolve')); incident.pagerDutyResolvedAt = this.now(); changed = true } catch (error) { failure ??= error }
+    if (incident.notifiedAt !== undefined && incident.telegramRecoveredAt === undefined && this.options.notify) try { await this.options.notify(this.format(worker, 'recovered')); incident.telegramRecoveredAt = this.now(); changed = true } catch (error) { failure ??= error }
+    const pagerDutyComplete = incident.pagerDutyTriggeredAt === undefined || incident.pagerDutyResolvedAt !== undefined
+    const telegramComplete = incident.notifiedAt === undefined || incident.telegramRecoveredAt !== undefined
+    if (changed && !(pagerDutyComplete && telegramComplete)) await this.save(state)
+    if (failure) throw failure
+    if (!(pagerDutyComplete && telegramComplete)) return
+    worker.incident = undefined
+    worker.recoveryChecks = 0
+    await this.save(state)
+  }
+  async enroll(token: string, input: unknown): Promise<{workerId:string;workerToken:string}> {
+    if (!sameSecret(token, hash(this.options.enrollmentToken))) throw new Error('Unauthorized')
+    const request = validateEnroll(input)
+    return this.enqueue(async () => { const state = await this.state(); if (state.workers[request.workerId]) throw new Error('Worker already enrolled'); const workerToken = randomBytes(32).toString('base64url'), now = this.now(); state.workers[request.workerId] = { id:request.workerId, tokenHash:hash(workerToken), checkInMs:request.checkInSeconds*1000, graceMs:request.graceSeconds*1000, severity:request.severity ?? 'critical', runbookUrl:request.runbookUrl, createdAt:now, lastSeenAt:now, recoveryChecks:0, history:[] }; await this.save(state); return {workerId:request.workerId,workerToken} })
+  }
+  async checkIn(workerId: string, token: string, input: unknown): Promise<{incident:boolean}> {
+    if (!WORKER_ID.test(workerId)) throw new Error('Unauthorized'); const request = validateCheckIn(input)
+    return this.enqueue(async () => { const state = await this.state(), worker = state.workers[workerId]; if (!worker || !sameSecret(token,worker.tokenHash)) throw new Error('Unauthorized'); const now = this.now(), event:WatchEvent={at:new Date(now).toISOString(),...request}; worker.lastSeenAt=now; worker.history=[...worker.history,event].slice(-MAX_HISTORY)
+      if (request.terminal) { worker.recoveryChecks=0; this.reopen(worker,now,'terminal-failure') }
+      else if (worker.incident?.recoveredAt !== undefined) { if(request.status==='failed') this.reopen(worker,now,worker.incident.reason) }
+      else if (worker.incident && request.status==='ok') { worker.recoveryChecks += 1; if (worker.recoveryChecks >= this.recoveryThreshold) { worker.incident.recoveredAt=now; await this.save(state); await this.notifyRecovery(state,worker); return {incident:Boolean(worker.incident)} } }
+      else if (request.status==='failed') worker.recoveryChecks=0
+      await this.save(state); await this.notifyOpen(state,worker); return {incident:Boolean(worker.incident)} })
+  }
+  async rotate(token: string, workerId: string): Promise<{workerId:string;workerToken:string}> {
+    if (!sameSecret(token, hash(this.options.enrollmentToken)) || !WORKER_ID.test(workerId)) throw new Error('Unauthorized')
+    return this.enqueue(async () => { const state=await this.state(), worker=state.workers[workerId]; if(!worker) throw new Error('Not found'); const workerToken=randomBytes(32).toString('base64url'); worker.tokenHash=hash(workerToken); worker.lastSeenAt=this.now(); worker.recoveryChecks=0; await this.save(state); return {workerId,workerToken} })
+  }
+  async evaluate(): Promise<void> { await this.enqueue(async () => { const state=await this.state(), now=this.now(); let changed=false; for (const worker of Object.values(state.workers)) if ((!worker.incident || worker.incident.recoveredAt !== undefined) && now > worker.lastSeenAt+worker.checkInMs+worker.graceMs) { this.reopen(worker,now,'missed-check-in'); worker.recoveryChecks=0; changed=true }; if(changed) await this.save(state); for(const worker of Object.values(state.workers)) { if(worker.incident?.recoveredAt !== undefined) await this.notifyRecovery(state,worker); else await this.notifyOpen(state,worker) } }) }
+  async inspect(workerId?: string): Promise<unknown> { return this.enqueue(async () => { const state=await this.state(); const at=(value:number|undefined):string|undefined=>value===undefined?undefined:new Date(value).toISOString(), redact=(worker:Worker) => ({id:worker.id,checkInSeconds:worker.checkInMs/1000,graceSeconds:worker.graceMs/1000,severity:worker.severity,runbookUrl:worker.runbookUrl,createdAt:new Date(worker.createdAt).toISOString(),lastSeenAt:new Date(worker.lastSeenAt).toISOString(),incident:worker.incident&&{openedAt:at(worker.incident.openedAt),reason:worker.incident.reason,notifiedAt:at(worker.incident.notifiedAt),pagerDutyTriggeredAt:at(worker.incident.pagerDutyTriggeredAt),recoveredAt:at(worker.incident.recoveredAt),telegramRecoveredAt:at(worker.incident.telegramRecoveredAt),pagerDutyResolvedAt:at(worker.incident.pagerDutyResolvedAt)},history:worker.history}); if(workerId){const worker=state.workers[workerId];if(!worker)throw new Error('Not found');return redact(worker)} return Object.values(state.workers).map(redact) }) }
+  start(evaluateMs: number): void { if(this.timer)return; void this.evaluate().catch(e=>this.options.log?.(`Initial evaluation failed: ${errorText(e)}`)); this.timer=setInterval(()=>void this.evaluate().catch(e=>this.options.log?.(`Evaluation failed: ${errorText(e)}`)),evaluateMs);this.timer.unref() }
+  stop(): void { if(this.timer)clearInterval(this.timer);this.timer=undefined }
+}
+
+const bearer = (request:IncomingMessage): string|undefined => request.headers.authorization?.startsWith('Bearer ') ? request.headers.authorization.slice(7) : undefined
+const json = (response:ServerResponse,status:number,value:unknown):void => { response.writeHead(status,{'content-type':'application/json; charset=utf-8','cache-control':'no-store'});response.end(JSON.stringify(value)) }
+const requestJson = async (request:IncomingMessage):Promise<unknown> => { let body='';for await(const chunk of request){body+=chunk;if(Buffer.byteLength(body)>MAX_BODY_BYTES)throw new Error('Request too large')}try{return JSON.parse(body)}catch{throw new Error('Invalid JSON')} }
+export class WorkforceWatchServer {
+  private server?:Server
+  constructor(private readonly watch:WorkforceWatch,private readonly enrollmentToken:string,private readonly log:(message:string)=>void=console.error) {}
+  async listen(port:number,host:string):Promise<void> { if(this.server)throw new Error('Server already listening');this.server=createServer((request,response)=>void this.route(request,response));await new Promise<void>((resolve,reject)=>{this.server!.once('error',reject);this.server!.listen(port,host,resolve)}) }
+  async close():Promise<void> { if(!this.server)return;await new Promise<void>((resolve,reject)=>this.server!.close(error=>error?reject(error):resolve()));this.server=undefined }
+  port():number { const address=this.server?.address(); if (!address || typeof address === 'string') throw new Error('Server is not listening'); return address.port }
+  private authorized(token:string|undefined):boolean { return Boolean(token)&&sameSecret(token!,hash(this.enrollmentToken)) }
+  private async route(request:IncomingMessage,response:ServerResponse):Promise<void> { try { const url=new URL(request.url??'/','http://localhost');if(request.method==='GET'&&url.pathname==='/healthz')return json(response,200,{status:'ok'});if(request.method==='POST'&&url.pathname==='/v1/enroll'){const token=bearer(request);if(!this.authorized(token))return json(response,401,{error:'unauthorized'});return json(response,201,await this.watch.enroll(token!,await requestJson(request)))}if(request.method==='GET'&&(url.pathname==='/v1/workers'||/^\/v1\/workers\/[a-z][a-z0-9-]{0,63}$/.test(url.pathname))){if(!this.authorized(bearer(request)))return json(response,401,{error:'unauthorized'});return json(response,200,await this.watch.inspect(url.pathname==='/v1/workers'?undefined:url.pathname.slice(12)))}const rotate=request.method==='POST'&&url.pathname.match(/^\/v1\/workers\/([a-z][a-z0-9-]{0,63})\/rotate$/);if(rotate){const token=bearer(request);if(!this.authorized(token))return json(response,401,{error:'unauthorized'});return json(response,200,await this.watch.rotate(token!,rotate[1]))}const match=request.method==='POST'&&url.pathname.match(/^\/v1\/workers\/([a-z][a-z0-9-]{0,63})\/check-in$/);if(match){try{return json(response,200,await this.watch.checkIn(match[1],bearer(request)??'',await requestJson(request)))}catch(error){if(errorText(error)==='Unauthorized')return json(response,401,{error:'unauthorized'});throw error}}return json(response,404,{error:'not found'}) }catch(error){this.log(`Workforce Watch request failed: ${errorText(error)}`);return json(response,400,{error:'invalid request'})} }
+}

package/templates/agent-guidance.md

@@ -11,3 +11,14 @@ brief, relevant files, acceptance criteria, and a stopping point. Choose
 delegation, model, and effort from the task—not a fixed routing rule. Keep one
 writer per workspace; the primary agent owns integration, verification, and
 external actions.
+
+## Telegram replies
+
+Use the messaging CLI for the current run's source chat, normally the paired
+owner/admin Telegram chat. It cannot choose another recipient; never put a chat
+ID in a message command. Format the payload as Telegram text: use actual newline
+characters for paragraphs and lists. The literal strings `\n`, `\\n`, or `/n` are
+visible text, not line breaks. For multiline replies, prefer
+`ezenciel-agents-message --text-file ./work/reply.md` and put the real line
+breaks in that file. Keep replies concise and use ordinary Markdown where it
+improves readability.

package/templates/chat-guidance.md

@@ -0,0 +1,23 @@
+# Responsive conversation
+
+Treat a chat channel as a conversation with the person, whether Telegram,
+WhatsApp, or another connected channel. Keep the turn focused and respond
+concisely using the current conversation and verified receipts. Read more
+context only when the answer or action requires it; do not reload history,
+explore files, or narrate a plan for a simple reply.
+
+Complete small authorized actions directly and check their receipts. For
+substantial work, use an available, authorized durable handoff tool, then end
+the conversational turn after it returns a task ID. Do not wait or poll here
+for the worker. Never claim work was delegated before that receipt exists.
+If this session lacks a delegation capability, use its available reporting
+path to explain the limitation; do not invent a tool or expand permissions.
+
+Choose the worker's model and effort for the difficulty and consequences of
+the job, independently of the conversational choice. Include the objective,
+relevant context and paths, constraints, authorized actions, acceptance checks,
+and where to deliver the result. Use native subagents within the worker when
+useful. Preserve one writer per workspace and coordinate shared resources.
+The worker owns completing and verifying the job and delivering the result;
+a quick conversational reply is not completion. If the person asks for status,
+check actual task evidence and distinguish queued, running, and verified results.

package/test/agent-guidance.test.ts

@@ -8,6 +8,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { promisify } from 'node:util'
 import test from 'node:test'
 import { desktopJobPrompt } from '../src/desktop-bridge.js'
+import { chatGuidance } from '../src/agent-guidance.js'
 import { executorJobPrompt } from '../src/executor.js'
 import { taskArguments } from '../src/task-executor.js'
 import { initializeWorkspace } from '../src/workspace.js'
@@ -27,7 +28,21 @@ test('CLI and desktop prompt builders use current package guidance', async () =>
     ['desktop', desktopJobPrompt('tg_owner_gui', ['owner request'], undefined, '/tmp/bin', '/tmp/control')],
   ] as const
   for (const [kind, prompt] of prompts)
+    {
     assert.ok(prompt.includes(shared), `${kind} prompt is missing the current package guidance`)
+    assert.ok(prompt.includes(chatGuidance()), `${kind} prompt is missing channel guidance`)
+  }
+  assert.ok(!executorJobPrompt('r_schedule_job', ['work']).includes(chatGuidance()))
+})
+
+test('shared guidance teaches source-chat delivery and real Telegram line breaks', async () => {
+  const shared = await readFile(sharedGuidancePath, 'utf8')
+  assert.ok(shared.includes("current run's source chat"))
+  assert.match(shared, /actual newline\s+characters/)
+  assert.ok(shared.includes('`\\n`'))
+  assert.ok(shared.includes('`\\\\n`'))
+  assert.ok(shared.includes('`/n`'))
+  assert.ok(shared.includes('ezenciel-agents-message --text-file ./work/reply.md'))
 })
 
 test('package guidance resolution ignores a workspace shadow file', async () => {

package/test/ai.test.ts

@@ -4,7 +4,7 @@ import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { ControlStore } from '../src/control-state.js'
-import { initialPreset, readModels, isPreset } from '../src/ai.js'
+import { initialPreset, chatPreset, readModels, isPreset } from '../src/ai.js'
 import { EXECUTOR_REGISTRY, nativeSessionId } from '../src/executor.js'
 import { InboxStore } from '../src/inbox.js'
 import type { Update } from 'grammy/types'
@@ -80,10 +80,13 @@ test('model catalog projects native metadata only, excluding hidden entries and
       { slug: 'fixture-model', display_name: 'Fixture', visibility: 'list',
         supported_reasoning_levels: [{ effort: 'medium' }, { effort: 'bad value' }],
         model_messages: 'Untrusted instructions must not be imported', api_key: 'fixture-secret' },
+      { slug: 'gpt-5.6-luna', display_name: 'Luna', visibility: 'list',
+        supported_reasoning_levels: [{ effort: 'high' }, { effort: 'xhigh' }, { effort: 'max' }] },
       { slug: 'hidden-model', visibility: 'hide' },
     ] }))
     assert.deepEqual(await readModels(home, async (cli) => cli === 'codex'), [
       { cli: 'codex', model: 'fixture-model', name: 'Fixture', efforts: ['medium'] },
+      { cli: 'codex', model: 'gpt-5.6-luna', name: 'Luna', efforts: ['high', 'xhigh'] },
     ])
     assert.equal(isPreset({ id: 'x', name: 'x', cli: 'grok', model: '--shell escape' }), false)
   } finally { await rm(home, { recursive: true, force: true }) }
@@ -144,3 +147,39 @@ for (const cli of ['codex', 'codex-gui']) {
     } finally { await rm(dir, { recursive: true, force: true }) }
   })
 }
+
+for (const cli of ['codex', 'codex-gui']) {
+  test(`${cli} separates responsive chat from worker defaults and preserves upgrade choices`, async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'ez-chat-default-'))
+    try {
+      const store = new ControlStore(dir, 1000)
+      await store.syncClientPresets(chatPreset(cli), [])
+      const chat = await store.captureChoice(chatPreset(cli))
+      assert.equal(chat.preset.model, 'gpt-5.6-sol')
+      assert.equal(chat.preset.effort, 'medium')
+      assert.equal(initialPreset(cli).model, 'gpt-5.6-terra')
+      assert.equal(initialPreset(cli).effort, 'high')
+      const old = initialPreset(cli)
+      await store.savePreset(old)
+      await store.defaultPreset(old.id)
+      await store.resetSession()
+      const captured = await store.captureChoice(old)
+      await store.syncClientPresets(chatPreset(cli), [])
+      assert.deepEqual(await store.captureChoice(chatPreset(cli)), captured)
+      assert.equal((await store.aiState(chatPreset(cli))).presets.filter(p => p.id === 'chat-default').length, 1)
+    } finally { await rm(dir, { recursive: true, force: true }) }
+  })
+}
+
+test('upgrades expose responsive chat without replacing an existing default or queued snapshot', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-chat-upgrade-'))
+  try {
+    const store = new ControlStore(dir, 1000), old = initialPreset('codex')
+    const captured = await store.captureChoice(old)
+    await store.syncClientPresets(chatPreset('codex'), [])
+    assert.deepEqual(await store.captureChoice(chatPreset('codex')), captured)
+    const state = await store.aiState(chatPreset('codex'))
+    assert.equal(state.defaultId, old.id)
+    assert.ok(state.presets.some(p => p.id === 'chat-default'))
+  } finally { await rm(dir, { recursive: true, force: true }) }
+})

package/test/event-sources.test.ts

@@ -133,6 +133,8 @@ test('relay launches the approved initial task and routes only matching replies
   await f.relay.drainSources()
   assert.equal(f.launches.length, 1); assert.equal(f.launches[0].options.cli, 'codex')
   assert.equal(f.launches[0].options.isResume, false)
+  assert.equal(f.launches[0].options.model, 'gpt-5.6-sol')
+  assert.equal(f.launches[0].options.effort, 'medium')
   f.children[0].kill()
   await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
   const receivedAt = Date.now()
@@ -141,6 +143,8 @@ test('relay launches the approved initial task and routes only matching replies
   await f.relay.drainSources()
   assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
   assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
+  assert.equal(f.launches[1].options.model, 'gpt-5.6-sol')
+  assert.equal(f.launches[1].options.effort, 'medium')
   f.children[1].kill()
   await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
   await f.relay.drainSources()

package/test/failure.test.ts

@@ -137,7 +137,7 @@ test('relay shutdown waits for executor cleanup and final run state', async () =
  } finally {release();await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
-for (const cleanupFails of [false,true]) test(`fatal polling conflict waits for shared shutdown without retrying (cleanup fails: ${cleanupFails})`, async t => {
+for (const cleanupFails of [false,true]) test(`polling conflict preserves work until an explicit shutdown (cleanup fails: ${cleanupFails})`, async t => {
  const dir=await mkdtemp(join(tmpdir(),'ez-polling-conflict-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
  let release!:()=>void,entered!:()=>void,releaseDelivery!:()=>void,sending!:()=>void,child:ReturnType<typeof spawn>|undefined,polls=0
  const gate=new Promise<void>(resolve=>{release=resolve}),cleaning=new Promise<void>(resolve=>{entered=resolve})
@@ -170,20 +170,26 @@ for (const cleanupFails of [false,true]) test(`fatal polling conflict waits for
   const delivery=relay.drainOutbox()
   await deliveryStarted
   let finished=false
-  const start=assert.rejects(relay.start(),/409.*Conflict/).then(()=>{finished=true})
-  await cleaning
+  const start=relay.start().finally(()=>{finished=true})
+  await until(async()=>polls===1)
+  assert.equal(sourceStops,0,'a polling conflict must not stop the relay')
+  assert.equal((await runs.get('tg_92'))?.status,'running')
+  assert.ok(child && child.exitCode===null && child.signalCode===null)
   const stopping=relay.stop()
   assert.equal(relay.stop(),stopping,'concurrent stop calls share one promise')
   const stopped=cleanupFails?assert.rejects(stopping,/Synthetic shutdown failure/):stopping
-  assert.equal(finished,false,'polling failure must wait for executor cleanup')
+  assert.equal(finished,false,'relay start must wait for the explicit shutdown')
+  await cleaning
   release()
   await until(async()=>(await runs.get('tg_92'))?.status!=='running')
-  assert.equal(finished,false,'polling failure must wait for the in-flight delivery receipt')
-  releaseDelivery();await delivery;await start;await stopped
+  assert.equal(finished,false,'shutdown must wait for the in-flight delivery receipt')
+  releaseDelivery();await delivery
+  if(cleanupFails) await assert.rejects(start,/Synthetic shutdown failure/);else await start
+  await stopped
   assert.equal(relay.stop(),stopping,'finished shutdown remains idempotent')
   assert.equal(sourceStops,1)
   assert.deepEqual(JSON.parse(await readFile(join(dir,'outbox',`${item.id}.sent.json`),'utf8')).receipt.messageIds,[1])
-  assert.equal(polls,1,'a conflict must not start another polling loop')
+  assert.equal(polls,1,'a conflict must not start another polling loop before the retry delay')
   assert.equal(relay.bot.isRunning(),false)
   assert.ok(child && (child.exitCode!==null || child.signalCode!==null))
   assert.notEqual((await runs.get('tg_92'))?.status,'running')

package/test/host-executor.test.ts

@@ -160,6 +160,22 @@ test('client tolerates missing heartbeat and consumes completion before checking
  } finally {client.kill();await closed;await rm(root,{recursive:true,force:true})}
 })
 
+test('client records a relay interruption before exiting 130',async()=>{
+ const root=await mkdtemp(path.join(tmpdir(),'ez-host-interrupt-'))
+ const directory=path.join(root,'host-executor');await mkdir(directory)
+ const client=spawn(process.execPath,['--import',fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs',import.meta.url)),fileURLToPath(new URL('../src/host-executor-client.ts',import.meta.url)),root,'tg_97'],{stdio:['pipe','pipe','pipe']})
+ let stderr='';client.stderr.on('data',chunk=>stderr+=chunk);client.stdout.resume()
+ client.stdin.end(JSON.stringify({texts:['test'],options:{}}))
+ try {
+  for(let n=0;n<100;n++){try{await readFile(path.join(directory,'tg_97.request.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+  const closed=new Promise<number|null>(resolve=>client.once('close',resolve))
+  client.kill('SIGTERM')
+  assert.equal(await closed,130)
+  assert.equal(await readFile(path.join(directory,'tg_97.cancel'),'utf8'),'')
+  assert.match(stderr,/Host executor client interrupted by SIGTERM/)
+ } finally {if(client.exitCode===null && client.signalCode===null)client.kill();await rm(root,{recursive:true,force:true})}
+})
+
 test('client cancels on stale or invalid heartbeat instead of waiting indefinitely',async()=>{
  for(const heartbeat of [{at:Date.now()-60000},{at:'invalid'}]) {
   const root=await mkdtemp(path.join(tmpdir(),'ez-heartbeat-invalid-'))

package/test/intake-relay.test.ts

@@ -225,6 +225,10 @@ test('four-item menu is owner-only; saved AI buttons work and forged/stale butto
     assert.match(f.replies.at(-1)!, /Menu expired/)
     await f.relay.bot.handleUpdate(message(7, '/settings'))
     assert.match(f.replies.at(-1)!, /Default for new conversations/)
+    await f.relay.bot.handleUpdate(message(8, '/status'))
+    assert.ok(f.keyboards.at(-1)!.flat().some((button) => button.text === 'Scheduled tasks'))
+    await f.relay.bot.handleUpdate(callback(9, 'menu:scheduled-tasks'))
+    assert.match(f.replies.at(-1)!, /No scheduled tasks for this owner/)
     assert.equal(f.launched.length, 0)
   } finally { await f.close() }
 })

package/test/model-policy.test.ts

@@ -11,7 +11,7 @@ import { taskArguments } from '../src/task-executor.js'
 import { runCodexSession } from '../src/codex-session.js'
 import { runDesktopTurn } from '../src/desktop-bridge.js'
 
-test('all model selections and launches reject effort above high before spawning', async () => {
+test('all non-Luna model selections and launches reject effort above high before spawning', async () => {
   for (const cli of ['codex', 'codex-gui', 'grok', 'claude', 'opencode', 'agy']) {
     for (const effort of ['xhigh', 'max', 'ultra', 'unknown']) {
       const preset = { id:'blocked', name:'Blocked', cli, model:'any-model', effort }
@@ -23,6 +23,14 @@ test('all model selections and launches reject effort above high before spawning
   await assert.rejects(runDesktopTurn({workspace:'/unused',controlDir:'/unused',binDir:'/unused',runId:'unused',prompt:'',effort:'ultra'}), /capped at high/)
 })
 
+test('Codex Luna accepts xhigh while every other model and CLI remains capped', async () => {
+  const luna = { id:'luna', name:'Luna', cli:'codex', model:'gpt-5.6-luna', effort:'xhigh' }
+  await validateSelection(luna, [{ cli:'codex', model:'gpt-5.6-luna', name:'Luna', efforts:['high','xhigh'] }], async () => true)
+  assert.deepEqual(executionDefaults('codex', { model:'gpt-5.6-luna', effort:'xhigh' }), { model:'gpt-5.6-luna', effort:'xhigh' })
+  assert.throws(() => executionDefaults('grok', { model:'gpt-5.6-luna', effort:'xhigh' }), /capped at high/)
+  assert.throws(() => executionDefaults('codex', { model:'gpt-5.6-terra', effort:'xhigh' }), /capped at high/)
+})
+
 test('restricted tasks pin Terra high, preserve explicit choices and reject higher effort', () => {
   const args = taskArguments('/unused', ['broker'], 'prompt')
   assert.equal(args[args.indexOf('--model')+1], 'gpt-5.6-terra')

package/test/plugin-manager.test.mjs

@@ -225,3 +225,52 @@ test('standalone rejects relay binding and preserves literal plugin arguments ac
  await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify({schemaVersion:1,workspace:f.workspace,catalog:{},deploymentDir:'/missing'}));
  await assert.rejects(exec(launcher,['status']),/deployment-bound/); // never hide a broken relay binding
 });
+
+test('existing folders are read-only, persistent and fail closed when missing', async t => {
+ const f=await fixture(t);await init(f.home,f.workspace);
+ const inspected=JSON.parse((await f.call('plugins','inspect','sample','--source',f.source)).stdout);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',inspected.revision);
+ const source=await fs.realpath(f.workspace);
+ await f.call('plugins','folder-bind','sample','--service','sample','--source',source,'--target','/data/files');
+ const config=JSON.parse(await fs.readFile(path.join(f.home,'config.json'),'utf8'));
+ assert.deepEqual(config.folders.sample,[{service:'sample',source,target:'/data/files'}]);
+ const c=JSON.parse(await fs.readFile(path.join(f.home,'packages/sample/compose.json'),'utf8'));
+ assert.deepEqual(c.services.sample.volumes.find(v=>v.target==='/data/files'),{type:'bind',source,target:'/data/files',read_only:true,bind:{create_host_path:false}});
+ await assert.rejects(f.call('plugins','folder-bind','sample','--service','sample','--source',source,'--target','/data'),/child of a declared volume|Overlapping/);
+ await assert.rejects(f.call('plugins','folder-bind','sample','--service','sample','--source',source,'--target','/data/files/child'),/Overlapping/);
+ await assert.rejects(f.call('plugins','folder-bind','sample','--service','sample','--source',await fs.realpath(f.home),'--target','/data/private'),/private plugin state/);
+ await assert.rejects(f.call('plugins','folder-bind','sample','--service','sample','--source','/','--target','/data/root'),/private plugin state/);
+ await f.call('plugins','start','sample');
+ await fs.rename(f.workspace,f.workspace+'-moved');
+ await assert.rejects(f.call('plugins','start','sample'),/ENOENT/);
+ await assert.rejects(f.call('sample','read'),/ENOENT/);
+ await f.call('plugins','folder-unbind','sample','--service','sample','--target','/data/files');
+ assert.deepEqual(JSON.parse((await f.call('plugins','folders','sample')).stdout),[]);
+});
+
+test('folder bindings survive compatible descriptors and reject incompatible updates',async t=>{
+ const f=await fixture(t);const p=await snapshot(f.source);
+ const record={...p,project:'ezp-test-sample'};
+ const config={workspace:f.workspace,folders:{sample:[{service:'sample',source:f.workspace,target:'/data/files'}]}};
+ assert.equal(compose(config,record).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
+ const next=structuredClone(record);next.deployment.services.sample.volumes={data:'/new-state'};
+ assert.throws(()=>compose(config,next),/child of a declared volume/);
+});
+
+test('folder rebind rejects every live project container including one-shots',async t=>{
+ const f=await fixture(t);await init(f.home,f.workspace);const p=await snapshot(f.source);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nif(process.argv[2]==='ps')console.log('paused-or-restarting-or-one-shot');\n`,{mode:0o700});
+ await assert.rejects(f.call('plugins','folder-bind','sample','--service','sample','--source',await fs.realpath(f.workspace),'--target','/data/files'),/Stop the plugin/);
+});
+
+test('registered calls honor registry lock and regenerate stale Compose from current folders',async t=>{
+ const f=await fixture(t);await init(f.home,f.workspace);const p=await snapshot(f.source);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ await f.call('plugins','folder-bind','sample','--service','sample','--source',await fs.realpath(f.workspace),'--target','/data/files');
+ const file=path.join(f.home,'packages/sample/compose.json');await fs.writeFile(file,'{}');
+ await f.call('sample','read');
+ assert.equal(JSON.parse(await fs.readFile(file,'utf8')).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
+ await fs.writeFile(path.join(f.home,'registry.lock'),'test');
+ await assert.rejects(f.call('sample','read'),/busy|EEXIST|locked/i);
+});

package/test/reply.test.ts

@@ -129,3 +129,25 @@ test('a parallel reply delivered during a normal turn is retained for the follow
   assert.deepEqual(await parallelReplyHistory(root,current),[])
  }finally{await rm(root,{recursive:true,force:true})}
 })
+
+
+test('reply handoff accepts independent worker choices and rejects invalid or unauthorized overrides', async () => {
+ const root=await mkdtemp(join(tmpdir(),'ez-reply-worker-')), runs=new RunStore(root)
+ try {
+  await ownerRun(root,'owner')
+  await runs.create({id:'tg_10',chatId:101,telegramUserId:101,texts:['Analyze the report'],execution:{sessionId:'c5dd1edc-be24-47b8-a579-0bc70f44cf43',preset:{id:'chat',name:'Chat',cli:'codex',model:'gpt-5.6-sol',effort:'medium'}}})
+  await runs.patch('tg_10',{status:'running',replyOnly:true})
+  for (const args of [{model:42}, {model:'bad model'}, {effort:'ultra'}, {effort:'invalid'}, {cli:'claude'}])
+   await assert.rejects(replyCall(root,'tg_10',root,'defer',{text:'Analyze and verify the result',...args}))
+  await assert.rejects(replyCall(root,'tg_10',root,'send',{text:'Hello',model:'gpt-6-astra'}),/Unexpected/)
+  await replyCall(root,'tg_10',root,'defer',{text:'Analyze and verify the result',model:'gpt-6-astra',effort:'high'})
+  const file=join(root,'schedules','s_reply_tg_10.json')
+  const saved=JSON.parse(await readFile(file,'utf8'))
+  assert.equal(saved.execution.preset.model,'gpt-6-astra')
+  assert.equal(saved.execution.preset.effort,'high')
+  await replyCall(root,'tg_10',root,'defer',{text:'retry',model:'gpt-5.6-sol',effort:'low'})
+  assert.deepEqual(JSON.parse(await readFile(file,'utf8')),saved)
+  await new ControlStore(root,900000).revokeOwner()
+  await assert.rejects(replyCall(root,'tg_10',root,'defer',{text:'after revocation',model:'gpt-6-astra'}),/owner-mismatch/)
+ } finally { await rm(root,{recursive:true,force:true}) }
+})

package/test/runs.test.ts

@@ -22,6 +22,13 @@ test('creates a queued run and binds chat id outside the workspace', async () =>
   assert.equal((await store.get(created.id))?.chatId, 101)
 }))
 
+test('running does not reap a process from another executor namespace', async () => fixture(async (store) => {
+  const created = await store.create({ chatId: 101, telegramUserId: 101, texts: ['host-backed'] })
+  await store.patch(created.id, { status: 'running', pid: 999_999_999 })
+  assert.equal((await store.running())?.id, created.id)
+  assert.equal((await store.get(created.id))?.status, 'running')
+}))
+
 test('ez message writes an outbox item for the bound run, not a telegram send', async () => fixture(async (store) => {
   const created = await store.create({ chatId: 9, telegramUserId: 9, texts: ['hello'] })
   await store.patch(created.id, { status: 'running' })

package/test/schedule-cli.test.ts

@@ -24,6 +24,8 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
  assert.equal(saved.text,args.at(-1));assert.equal(saved.execution.preset.cli,'codex')
  assert.equal(saved.execution.preset.model,'gpt-5.6-terra');assert.equal(saved.execution.preset.effort,'high')
  await assert.rejects(exec(process.execPath,[bin,'create','blocked','--at','2027-09-09T09:00:00+04:00','--text','test','--effort','xhigh'],{env}),/capped at high/)
+ const luna=JSON.parse((await exec(process.execPath,[bin,'create','luna','--at','2027-09-10T09:00:00+04:00','--text','Luna xhigh task','--model','gpt-5.6-luna','--effort','xhigh'],{env})).stdout)
+ assert.equal(luna.execution.preset.model,'gpt-5.6-luna');assert.equal(luna.execution.preset.effort,'xhigh')
  assert.equal(saved.nextEligibleAt,'2027-09-09T05:00:00.000Z')
  await assert.rejects(exec(process.execPath,[bin,...args],{env}),/exists/)
  assert.equal(JSON.parse((await exec(process.execPath,[bin,'pause','test'],{env})).stdout).enabled,false)

package/test/scheduled-tasks.test.ts

@@ -0,0 +1,43 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { access, mkdtemp, readFile, readdir, rm } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { Scheduler } from '../src/scheduler.js'
+import { scheduledTasksText } from '../src/scheduled-tasks.js'
+
+const owner = { telegramUserId: 101, telegramChatId: 101, pairedAt: '2026-09-11T00:00:00.000Z' }
+const execution = { sessionId: randomUUID(), preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } }
+
+test('scheduled task view is read-only, owner-bound, and shows stored task contents', async (t) => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-scheduled-tasks-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const scheduler = new Scheduler(dir)
+
+  assert.deepEqual(await scheduler.listReadOnly(), [])
+  await assert.rejects(access(join(dir, 'schedules')), /ENOENT/)
+
+  await scheduler.save({
+    id: 'owner-task', name: 'Daily report', text: 'Read the ledger and send the owner a concise report.', owner, execution, enabled: true,
+    trigger: { cron: '0 9 * * 1-5', timezone: 'Asia/Dubai', start: '2026-01-01T00:00:00.000Z' },
+  })
+  await scheduler.save({
+    id: 'other-task', name: 'Other owner task', text: 'This must never be visible.',
+    owner: { ...owner, telegramUserId: 202, telegramChatId: 202 }, execution, enabled: true,
+    trigger: { at: '2027-01-01T00:00:00.000Z' },
+  })
+  const scheduleDir = join(dir, 'schedules')
+  const before = await readFile(join(scheduleDir, 'owner-task.json'), 'utf8')
+  const entries = await readdir(scheduleDir)
+  const text = scheduledTasksText(await scheduler.listReadOnly(), owner, Date.parse('2026-09-11T00:00:00.000Z'))
+
+  assert.match(text, /Title: Daily report/)
+  assert.match(text, /Instructions:\nRead the ledger and send the owner a concise report\./)
+  assert.match(text, /Timing: Cron 0 9 \* \* 1-5 · Asia\/Dubai/)
+  assert.match(text, /State: Scheduled/)
+  assert.match(text, /Next run: 2026-09-11T05:00:00.000Z/)
+  assert.doesNotMatch(text, /Other owner task|This must never be visible/)
+  assert.equal(await readFile(join(scheduleDir, 'owner-task.json'), 'utf8'), before)
+  assert.deepEqual(await readdir(scheduleDir), entries)
+})