@jc_stack/ez-agents 0.1.0-beta.23 → 0.1.0-beta.25

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.0-beta.25
+
+- Enable Codex Luna `max` reasoning for durable work, schedules and deferred
+  owner handoffs. New durable work defaults to Luna/max while responsive chat
+  remains Sol/medium.
+- Preserve the strict cap for every other model and expose Luna/max from the
+  installed model catalog.
+- Persist Luna/max defaults in rollback-readable form; launch-time policy still
+  resolves Luna without an explicit effort to `max`.
+
+## 0.1.0-beta.24
+
+- Preserve host-owned private plugin networks across generated Compose services,
+  one-shot commands and compatible updates. Bind routes to reviewed plugin
+  revisions and retain plugin-local connectivity.
+- Support existing deployments on their first upgrade. Network authorization
+  remains outside the agent-writable registry. Existing beta acceptance limits remain.
+
 ## 0.1.0-beta.23
 
 - Identify failed publisher API reads and missing release tags without exposing

package/docs/architecture/ai-selection.md

@@ -39,7 +39,7 @@ opaque wrappers remain explicitly “client default”. No credentials are store
 no inference runs, no new dependency, and no cross-CLI session transfer.
 
 New Codex CLI and desktop agents seed **Responsive chat** (`gpt-5.6-sol`,
-`medium`). Durable work keeps its independent `gpt-5.6-terra` / `high` default;
+`medium`). Durable work keeps its independent `gpt-5.6-luna` / `max` default;
 workers can explicitly select another model and effort for the job. Native
 choices for other executors remain unchanged. No fallback is selected when a
 model is unavailable.

package/docs/plugins.md

@@ -198,12 +198,33 @@ Secrets persist privately across reinstall and are never included in registry
 responses. Twenty provides a complete v2 backend example.
 
 Compose JSON is generated, not accepted from untrusted arbitrary Compose input.
-No ports, host network, privileged services, host env inheritance, arbitrary bind mounts,
-Docker socket or raw Compose args can be supplied. Project names include a hash
-of the canonical registry path; networks and volumes inherit that namespace.
+No ports, host-network mode, privileged services, host env inheritance, arbitrary bind mounts,
+Docker socket or raw Compose args can be supplied. Package descriptors cannot select
+Docker networks. Project names include a hash of the canonical registry path;
+networks and volumes inherit that namespace.
 Images use release-specific names. All containers drop capabilities and run as
 UID 1000 by default; v2 can declare another non-root UID:GID. Plugins sharing a profile remain in the same owning deployment.
 
+### Host-owned private networks
+
+Some private deployments need a reviewed plugin service to reach another private
+Compose project. The installation host may save `pluginNetworkBindings` on that
+agent's entry in its host-owned `host-executor.json`, keyed by plugin id. Each
+route records the explicitly approved reviewed plugin `revisions` and literal
+`{service, network}` entries. The manager re-hashes the installed snapshot
+before accepting a route, then emits it for both persistent services and
+one-shot command containers. Bound services keep their plugin's default network
+as well, so they retain access to plugin-local dependencies. Routes therefore
+survive command-time Compose regeneration and restarts. Before a routed plugin
+update, the host adds the inspected candidate revision to that route; both the
+current and candidate revisions may remain authorized during the transition.
+
+This is deployment configuration, not a package-descriptor field or an `ez`
+command: agents and plugins cannot request or alter host networks. The host
+installer owns the binding and must ensure the selected service is stopped
+before changing its network topology. The executor's writable tool registry is
+never a source of network attachment authority.
+
 Commands run in one-shot client containers against their own service's volumes;
 stdin, stdout, stderr, literal arguments and exit codes are preserved. SIGINT/
 SIGTERM cancel the Docker call and remove its unique client container. The manager

package/docs/responsive-channels.md

@@ -8,12 +8,12 @@ the handoff is saved, instead of waiting for the worker. This is agent guidance,
 not a keyword classifier, automatic acknowledgement, or latency guarantee.
 
 New Codex agents use Sol / medium for chat. Scheduled work defaults independently
-to Terra / high; the agent can choose another model and effort for complex work.
-`ezenciel-agents-schedule create --now --text-file FILE --model MODEL --effort high`
+to Luna / max; the agent can choose another model and effort for complex work.
+`ezenciel-agents-schedule create --now --text-file FILE --model MODEL --effort max`
 uses the existing scheduler (include `--name` for a useful task label). Busy owner
 reply sessions expose the same independent model/effort choice through `defer`.
 Its retry returns the first saved schedule; changing arguments does not revise
-an accepted job. `xhigh` is available only for Luna; other models remain capped at high.
+an accepted job. `xhigh` and `max` are available only for Luna; other models remain capped at high.
 
 A handoff includes the objective, relevant context and paths, constraints,
 authorized actions, acceptance checks and delivery destination. Background

package/docs/scheduling.md

@@ -33,11 +33,11 @@ times fire once, at the earlier instant. Search is bounded to eight years.
 Public-holiday calendars and arbitrary RRULE syntax are not implemented.
 
 New tasks, including work deferred by a busy reply session, default to Codex
-`gpt-5.6-terra` with `high` reasoning independently of the creating chat.
+`gpt-5.6-luna` with `max` reasoning independently of the creating chat.
 New chats use the separate Sol/medium preset. Busy reply `defer` accepts optional
 `model` and `effort` fields; retries preserve the first saved task choice.
-Use `--cli`, `--model`, and `--effort` to specify another choice. `xhigh` is
-available only with Codex `gpt-5.6-luna`; every other model remains capped at
+Use `--cli`, `--model`, and `--effort` to specify another choice. `xhigh` and
+`max` are available only with Codex `gpt-5.6-luna`; every other model remains capped at
 `high`. Non-Codex adapters inherit native effort when unset. Editing preserves the existing AI
 choice unless those flags override it. Stored choices are checked again at
 launch, including schedules saved before a policy change.

package/docs/setup.md

@@ -56,17 +56,17 @@ New agents using `codex` or `codex-gui` start with `gpt-5.6-sol` and `medium`
 reasoning, including when initialized with `ezenciel-agents-setup init`. This
 Ez default takes precedence over discovered host client defaults. Saved agent
 selections permitted by the current policy are preserved; use the AI settings to choose another model or effort.
-Ez accepts `xhigh` only for `gpt-5.6-luna`; every other model rejects explicit
+Ez accepts `xhigh` and `max` only for `gpt-5.6-luna`; every other model rejects explicit
 reasoning above `high` at selection and execution, including old saved or queued choices.
 Unset Codex model/effort resolves to
-Terra/high at launch. This governs Ez-managed launches; it is not an account-wide
+Luna/max at launch. This governs Ez-managed launches; it is not an account-wide
 limit on independently launched native clients or executor-created native subagents.
 Other adapters inherit their native effort when none is selected in Ez. That
 inherited configuration is not capped by Ez; explicit above-high Ez selections
-are rejected unless they are Codex Luna/xhigh. Conversation presets pin Sol/medium; the lower-level
-Codex fallback remains Terra/high for work without an explicit choice.
+are rejected unless they are Codex Luna/xhigh or Luna/max. Conversation presets pin Sol/medium; the lower-level
+Codex fallback is Luna/max for work without an explicit choice.
 
-New scheduled and one-off background tasks default to Codex Terra/high independently
+New scheduled and one-off background tasks default to Codex Luna/max independently
 of the creating chat. Use scheduler `--cli`, `--model`, and `--effort` flags for
 explicit overrides. Editing a schedule preserves its settings unless overridden.
 Restricted messaging tasks use Sol/medium while retaining their approved tool

package/docs/upgrades.md

@@ -185,6 +185,12 @@ written by the new one. Increment it for incompatible writes; this updater will
 refuse that migration. `mainProtocol` identifies the supported updater/registry
 contract, currently 1. Plugin package and manifest versions must match.
 
+The Luna/max durable default keeps this contract: persisted Codex Luna presets
+omit the effort field so older runtimes can read and fail over to their native
+safe default, while the current launcher resolves an omitted Luna effort to
+`max`. The execution choice, rather than the storage encoding, is the policy
+surface.
+
 Verify upgrade from the previous supported artifact, retained identity/state,
 failed-health rollback, and rejection of incompatible candidates. Main runtime
 changes also need supervisor restart and requesting-process-exit tests. Run

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.23",
+  "version": "0.1.0-beta.25",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",

package/src/ai.ts

@@ -21,7 +21,9 @@ export const isExecutionChoice = (v: unknown): v is ExecutionChoice => {
   const c = v as ExecutionChoice | undefined
   return Boolean(c && /^[0-9a-f-]{36}$/i.test(c.sessionId) && isPreset(c.preset))
 }
-export const presetLabel = (p: AiPreset) => `${p.cli} · ${p.model || 'client default'} · ${p.effort || 'default effort'}`
+export const presetLabel = (p: AiPreset) => `${p.cli} · ${p.model || 'client default'} · ${p.effort || (
+  ['codex', 'codex-gui'].includes(p.cli) && p.model === 'gpt-5.6-luna' ? DEFAULT_EFFORT : 'default effort'
+)}`
 // The seed delegates model selection to the native client. Project its resolved
 // settings for status without pinning future conversations to that snapshot.
 export const statusPreset = (preset: AiPreset, discovered: AiPreset[]): AiPreset =>
@@ -39,6 +41,14 @@ export const initialPreset = (cli: string): AiPreset => {
   }
 }
 
+// Keep persisted state readable by older releases. Luna/max is an execution
+// default; the launcher resolves an omitted Luna effort back to max.
+export const persistedPreset = (preset: AiPreset): AiPreset => {
+  if (!['codex', 'codex-gui'].includes(preset.cli) || preset.model !== 'gpt-5.6-luna' || preset.effort !== 'max') return preset
+  const { effort: _effort, ...rollbackReadable } = preset
+  return rollbackReadable
+}
+
 // Conversation defaults are independent of durable work and explicit saved choices.
 export const chatPreset = (cli: string): AiPreset => {
   const preset = initialPreset(cli)

package/src/control-state.ts

@@ -1,7 +1,7 @@
 import { assertEffort } from './model-policy.js'
 import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import path from 'node:path'
-import { isPreset, type AiPreset, type ExecutionChoice } from './ai.js'
+import { isPreset, persistedPreset, type AiPreset, type ExecutionChoice } from './ai.js'
 
 export type Owner = {
   kind?: 'group'
@@ -94,6 +94,7 @@ export class ControlStore {
     try {
       const parsed: unknown = JSON.parse(await readFile(this.statePath, 'utf8'))
       if (!isState(parsed)) throw new Error('Control state has an unsupported shape')
+      if (parsed.ai) parsed.ai.presets = parsed.ai.presets.map(persistedPreset)
       return parsed
     } catch (error: unknown) {
       if ((error as NodeJS.ErrnoException).code === 'ENOENT') return emptyState()
@@ -261,7 +262,7 @@ export class ControlStore {
   async aiState(initial: AiPreset) {
     return this.withLock(async () => {
       const state = await this.readState()
-      state.ai ??= { presets: [initial], defaultId: initial.id, selectedId: initial.id }
+      state.ai ??= { presets: [persistedPreset(initial)], defaultId: initial.id, selectedId: initial.id }
       await this.writeState(state)
       return state.ai
     })
@@ -273,13 +274,13 @@ export class ControlStore {
       const state = await this.readState()
       const first = initial.cli === 'codex' || initial.cli === 'codex-gui'
         ? initial : discovered.find((p) => p.cli === initial.cli) ?? initial
-      state.ai ??= { presets: [first], defaultId: first.id, selectedId: first.id }
+      state.ai ??= { presets: [persistedPreset(first)], defaultId: first.id, selectedId: first.id }
       const ai = state.ai
       // Refresh discovery entries, but never rewrite an active/default or user-saved choice.
       const preserved = ai.presets.filter((p) => !p.id.startsWith('detected_') ||
-        p.id === ai.selectedId || p.id === ai.defaultId)
-      ai.presets = [...preserved, ...discovered.filter((p) => !preserved.some((old) => old.id === p.id))]
-      if (initial.id === 'chat-default' && !ai.presets.some(p => p.id === initial.id)) ai.presets.push(initial)
+        p.id === ai.selectedId || p.id === ai.defaultId).map(persistedPreset)
+      ai.presets = [...preserved, ...discovered.map(persistedPreset).filter((p) => !preserved.some((old) => old.id === p.id))]
+      if (initial.id === 'chat-default' && !ai.presets.some(p => p.id === initial.id)) ai.presets.push(persistedPreset(initial))
       await this.writeState(state)
     })
   }
@@ -287,7 +288,7 @@ export class ControlStore {
   async captureChoice(initial: AiPreset): Promise<ExecutionChoice> {
     return this.withLock(async () => {
       const state = await this.readState()
-      state.ai ??= { presets: [initial], defaultId: initial.id, selectedId: initial.id }
+      state.ai ??= { presets: [persistedPreset(initial)], defaultId: initial.id, selectedId: initial.id }
       const preset = state.ai.presets.find((p) => p.id === state.ai!.selectedId)!
       state.activeSession ??= { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli }
       if (!state.activeSession.cli && !state.activeSession.hasStarted) state.activeSession.cli = preset.cli
@@ -331,7 +332,7 @@ export class ControlStore {
       if (!state.ai) throw new Error('AI settings not initialized')
       if (state.ai.presets.length >= 12 && !state.ai.presets.some((p) => p.id === preset.id))
         throw new Error('Keep it small: at most 12 saved AIs.')
-      state.ai.presets = [...state.ai.presets.filter((p) => p.id !== preset.id), preset]
+      state.ai.presets = [...state.ai.presets.filter((p) => p.id !== preset.id), persistedPreset(preset)]
       await this.writeState(state)
     })
   }

package/src/host-executor.ts

@@ -13,7 +13,8 @@ import { taskWorkspace } from './task-workspace.js'
 import { packageVersion } from './version.js'
 import { installedPluginVersions } from './software-status.js'
 
-export type HostBinding = { name: string; workspace: string; controlDir: string; binDir: string; toolsHome?: string; sharedWorkspace?: string }
+export type PluginNetworkRoute = { revisions:string[]; bindings:{service:string;network:string}[] }
+export type HostBinding = { name: string; workspace: string; controlDir: string; binDir: string; toolsHome?: string; sharedWorkspace?: string; pluginNetworkBindings?: Record<string, PluginNetworkRoute> }
 export type HostInstallation = { cli: string; agents: HostBinding[] }
 
 export const serveHostExecutor = async (installation: HostInstallation, signal: AbortSignal, launch = startExecutorJob) => {

package/src/index.ts

@@ -31,7 +31,7 @@ import { transcribeAudio, synthesizeSpeech } from './audio.js'
 import { normalizeReactionEmoji } from './reaction.js'
 import { downloadTelegramFile } from './read-request.js'
 import { createAiMenu, mainCommands, mainKeyboard } from './menu.js'
-import { chatPreset, presetLabel, statusPreset } from './ai.js'
+import { chatPreset, initialPreset, persistedPreset, presetLabel, statusPreset } from './ai.js'
 import { discoverDefaults } from './client-defaults.js'
 import { initializeWorkspace } from './workspace.js'
 import { softwareStatus } from './software-status.js'
@@ -65,6 +65,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
   let drainTimer: ReturnType<typeof setInterval> | undefined
   const codexHome = join(config.controlDir, 'cli', 'codex')
   const aiMenu = createAiMenu(control, config.executorCli, undefined, config.workspace, codexHome)
+  const durableWorkerChoice = () => ({ sessionId: randomUUID(), preset: persistedPreset(initialPreset('codex')) })
   const binDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'bin')
   const pagerDuty = config.pagerDutyRoutingKey && config.pagerDutyStocksHealthUrl
     ? new PagerDutyStocksMonitor({
@@ -310,7 +311,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
       for (const task of await tasks.list()) if (task.state === 'pending' || task.state === 'active' || task.unwatchPending) {
         try { await tasks.decide(task.id) } catch { /* Failed or stale grants cannot launch. */ }
       }
-      await queueUpdateAttention(config.controlDir,owner,runs,await control.captureChoice(aiMenu.initial))
+      await queueUpdateAttention(config.controlDir,owner,runs,durableWorkerChoice())
       }
       for (const source of config.channelBackendUrl ? [] : await sources.available(owner)) {
         try {
@@ -327,7 +328,7 @@ export const createRelay = (config: Config, launch = startExecutorJob) => {
               await runs.create({
               taskId: task?.id,
               id: eventRunId(source, events), chatId: owner.telegramChatId, telegramUserId: owner.telegramUserId,
-              texts: [], execution: await control.captureChoice(aiMenu.initial),
+              texts: [], execution: durableWorkerChoice(),
               external: { sourceId: source.id, bindingId: source.bindingId, eventIds: events.map(e => e.id) },
             })
             }

package/src/model-policy.ts

@@ -1,18 +1,33 @@
 export const CODEX_CHAT_MODEL = 'gpt-5.6-sol'
 export const CHAT_EFFORT = 'medium'
-export const CODEX_DEFAULT_MODEL = 'gpt-5.6-terra'
-export const DEFAULT_EFFORT = 'high'
+export const CODEX_DEFAULT_MODEL = 'gpt-5.6-luna'
+export const DEFAULT_EFFORT = 'max'
 export const allowedEffort = (effort?: string, model?: string, cli?: string) => effort === undefined ||
   ['none', 'minimal', 'low', 'medium', 'high'].includes(effort) ||
-  (effort === 'xhigh' && model === 'gpt-5.6-luna' && ['codex', 'codex-gui'].includes(cli || ''))
+  (['xhigh', 'max'].includes(effort) && model === 'gpt-5.6-luna' && ['codex', 'codex-gui'].includes(cli || ''))
 export function assertEffort(effort?: string, model?: string, cli?: string) {
-  if (!allowedEffort(effort, model, cli)) throw new Error('Reasoning effort is capped at high, except Codex Luna/xhigh; choose none, minimal, low, medium, high, or xhigh with gpt-5.6-luna.')
+  if (!allowedEffort(effort, model, cli)) throw new Error('Reasoning effort is capped at high, except Codex Luna/xhigh/max; choose none, minimal, low, medium, high, xhigh, or max with gpt-5.6-luna.')
 }
 export function executionDefaults<T extends { model?: string; effort?: string }>(cli: string, options: T): T {
   assertEffort(options.effort, options.model, cli)
+  const model = options.model || CODEX_DEFAULT_MODEL
   return { ...options,
-    ...(['codex', 'codex-gui'].includes(cli) ? { model: options.model || CODEX_DEFAULT_MODEL } : {}),
+    ...(['codex', 'codex-gui'].includes(cli) ? { model } : {}),
     ...(['codex', 'codex-gui'].includes(cli)
-      ? { effort: options.effort || DEFAULT_EFFORT } : {}),
+      ? { effort: options.effort || (model === 'gpt-5.6-luna' ? DEFAULT_EFFORT : 'high') } : {}),
   }
 }
+
+export function executionOverrides<T extends { model?: string; effort?: string }>(
+  cli: string,
+  base: T,
+  model?: string,
+  effort?: string,
+): T {
+  const options = {
+    ...base,
+    ...(model !== undefined ? { model, ...(effort === undefined ? { effort: undefined } : {}) } : {}),
+    ...(effort !== undefined ? { effort } : {}),
+  } as T
+  return executionDefaults(cli, options)
+}

package/src/plugins/manager.mjs

@@ -5,9 +5,11 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createHash, randomUUID, randomBytes } from 'node:crypto';
 import { spawn } from 'node:child_process';
+import { readFileSync, realpathSync } from 'node:fs';
 
 const reserved = new Set(['status','updates','plugins','tools','message','owner','approval','react','setup','help','version']);
 const id = value => { if(typeof value !== 'string' || !/^[a-z][a-z0-9-]{0,39}$/.test(value)) throw Error('Invalid identifier'); return value; };
+const dockerNetwork = value => { if(typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(value)) throw Error('Invalid Docker network'); return value; };
 const hash = data => createHash('sha256').update(data).digest('hex');
 const json = async file => JSON.parse(await fs.readFile(file,'utf8'));
 const emit = value => console.log(JSON.stringify(value));
@@ -142,9 +144,67 @@ export async function checkFolders(config, record) {
       throw Error('Folder source must remain an existing real directory');
   }
 }
-export function compose(config, record, secrets={}) {
-  const services={}, volumes={};
+const childOf = (candidate, parent) => candidate === parent || candidate.startsWith(parent + path.sep);
+// Host-owned private network bindings remain separate from portable package descriptors.
+// The executor may write toolsHome, so the binding source must stay in its host config.
+export async function hostNetworkBindings(config, record, home) {
+  const configuredHost = config.hostConfig ?? (typeof config.deploymentDir === 'string' && path.isAbsolute(config.deploymentDir) ? path.join(config.deploymentDir, 'host-executor.json') : undefined);
+  if (configuredHost === undefined) return [];
+  if (!home || typeof configuredHost !== 'string' || !path.isAbsolute(configuredHost)) throw Error('Invalid host network binding');
+  home = realpathSync(home);
+  const hostConfig = realpathSync(configuredHost);
+  if (hostConfig !== configuredHost || path.basename(hostConfig) !== 'host-executor.json' || childOf(hostConfig, home))
+    throw Error('Host network bindings require an external host config');
+  const host = JSON.parse(readFileSync(hostConfig, 'utf8'));
+  if (!host || typeof host !== 'object' || !Array.isArray(host.agents)) throw Error('Invalid host network bindings');
+  const candidates = host.agents.filter(agent => agent && typeof agent === 'object' && typeof agent.toolsHome === 'string' && realpathSync(agent.toolsHome) === home);
+  if (candidates.length !== 1) throw Error('Host network binding does not belong to this registry');
+  const agent = candidates[0], deployment = path.dirname(hostConfig);
+  if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
+      realpathSync(agent.workspace) !== config.workspace || realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
+      realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir) ||
+      childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
+    throw Error('Invalid host network binding deployment');
+  const configured = agent.pluginNetworkBindings;
+  if (configured !== undefined && (!configured || typeof configured !== 'object' || Array.isArray(configured)))
+    throw Error('Invalid host network bindings');
+  const route = configured?.[record.manifest?.id];
+  if (route === undefined) return [];
+  keys(route, ['revisions', 'bindings']);
+  const trusted = await snapshot(record.source);
+  if (record.revision !== trusted.revision || record.source !== trusted.source ||
+      JSON.stringify(record.manifest) !== JSON.stringify(trusted.manifest) ||
+      JSON.stringify(record.deployment) !== JSON.stringify(trusted.deployment))
+    throw Error('Registry plugin identity is not the reviewed source');
+  if (record.manifest.id !== trusted.manifest.id) throw Error('Registry plugin identity is not the reviewed source');
+  if (!Array.isArray(route.revisions) || route.revisions.some(revision => typeof revision !== 'string' || !/^sha256:[a-f0-9]{64}$/.test(revision)) ||
+      !route.revisions.includes(trusted.revision)) throw Error('Host network binding is not pinned to the reviewed plugin revision');
+  const bindings = route.bindings;
+  if (!Array.isArray(bindings)) throw Error('Invalid host network bindings');
+  const seen = new Set();
+  for (const binding of bindings) {
+    keys(binding, ['service', 'network']);
+    id(binding.service); dockerNetwork(binding.network);
+    if (!record.deployment.services[binding.service]) throw Error('Unknown host network service');
+    const key = `${binding.service}\0${binding.network}`;
+    if (seen.has(key)) throw Error('Duplicate host network binding');
+    seen.add(key);
+  }
+  return bindings;
+}
+export async function compose(config, record, secrets={}, home) {
+  const services={}, volumes={}, networks={}, serviceNetworks=new Map();
   const folders = folderMounts(config, record);
+  for (const binding of await hostNetworkBindings(config, record, home)) {
+    // A service with an explicit network list loses Compose's implicit default.
+    // Keep the plugin's own network so bound services retain sibling access.
+    networks.default = {};
+    const key = `host-${hash(binding.network).slice(0,16)}`;
+    networks[key] = { external: true, name: binding.network };
+    const attached = serviceNetworks.get(binding.service) || ['default'];
+    if (!attached.includes(key)) attached.push(key);
+    serviceNetworks.set(binding.service, attached);
+  }
   for(const [name,s] of Object.entries(record.deployment.services)) {
     const mounts=[];
     for(const [volume,target] of Object.entries(s.volumes||{})) { volumes[volume]={};mounts.push({type:'volume',source:volume,target}); }
@@ -156,13 +216,14 @@ export function compose(config, record, secrets={}) {
       ...(s.dependsOn?{depends_on:Object.fromEntries(s.dependsOn.map(dep=>[dep,{condition:'service_healthy'}]))}:{}),
       ...(s.memoryMiB?{mem_limit:`${s.memoryMiB}m`}:{}),
       ...(s.cpus?{cpus:s.cpus}:{}),
+      ...(serviceNetworks.get(name)?.length?{networks:serviceNetworks.get(name)}:{}),
       ...(s.environment?{environment:Object.fromEntries(Object.entries(s.environment).map(([key,value])=>{
         if(typeof value==='string')return [key,value];
         if(!/^[a-f0-9]{64}$/.test(secrets[value.secret]||''))throw Error('Missing or invalid private deployment secret');
         return [key,(value.prefix||'')+secrets[value.secret]+(value.suffix||'')];
       }))}:{}),...(s.command?{command:s.command}:{})};
   }
-  return attachShared({name:record.project,services,volumes}, record);
+  return attachShared({name:record.project,services,volumes,...(Object.keys(networks).length?{networks}:{})}, record);
 }
 function dockerEnv() {
   return Object.fromEntries(['HOME','PATH','LANG','LC_ALL','TMPDIR','DOCKER_HOST','DOCKER_CONTEXT','DOCKER_CONFIG','BUILDX_CONFIG'].filter(k=>process.env[k]!==undefined).map(k=>[k,process.env[k]]));
@@ -205,14 +266,14 @@ async function registry(home) {
 export async function init(home,workspace,catalogFile,hostConfig,standalone=false) {
   if(standalone && hostConfig) throw Error('Standalone setup cannot bind a relay host config');
   if(typeof home!=='string'||typeof workspace!=='string'||!path.isAbsolute(home)||!path.isAbsolute(workspace)||/[\r\n\0$:,]/.test(home+workspace)) throw Error('Explicit absolute home/workspace required');
-  workspace=await fs.realpath(workspace);await privateDir(home);home=await fs.realpath(home);
+  workspace=await fs.realpath(workspace);await privateDir(home);home=await fs.realpath(home);if(hostConfig)hostConfig=await fs.realpath(hostConfig);
   if(await fs.lstat(path.join(home,'registry.json')).catch(()=>null)) throw Error('Registry already exists; refusing replacement');
   catalogFile=path.resolve(catalogFile||fileURLToPath(new URL('../../default-plugins.json',import.meta.url)));
   const sources=await json(catalogFile);
   const catalog={};
   for(const [name,source] of Object.entries(sources)) {id(name);if(typeof source!=='string'||!source)throw Error('Catalog source must be a nonempty path');const resolved=path.resolve(path.dirname(catalogFile),source);const p=await snapshot(resolved).catch(error=>{throw Error(`Cannot load reviewed plugin ${name} from ${resolved}: ${error.message}. Supply its checkout or an explicit --catalog file.`)});if(p.manifest.id!==name) throw Error('Catalog ID mismatch');catalog[name]={source:p.source,revision:p.revision};}
   await locked(home,async()=>{
-    await atomic(path.join(home,'config.json'),{schemaVersion:1,workspace,catalog});
+    await atomic(path.join(home,'config.json'),{schemaVersion:1,workspace,catalog,...(hostConfig&&path.basename(hostConfig)==='host-executor.json'?{hostConfig}:{})});
     await atomic(path.join(home,'registry.json'),{schemaVersion:1,owner:home,plugins:{},commands:{}});
     const bin=path.join(home,'bin');await privateDir(bin);
     await fs.writeFile(path.join(bin,'ez'),`#!${process.execPath}\nimport(${JSON.stringify(new URL('./manager.mjs',import.meta.url).href)}).then(m=>m.main(['--home',${JSON.stringify(home)},...process.argv.slice(2)])).catch(e=>{console.error(e.message);process.exitCode=1});\n`,{mode:0o700,flag:'wx'});
@@ -262,7 +323,7 @@ export async function install(home,config,name,source,revision) {
     let secrets;try{secrets=await json(secretsFile);}catch(error){if(error.code!=='ENOENT')throw error;secrets={};}
     for(const name of p.deployment.secrets||[])if(secrets[name]===undefined)secrets[name]=randomBytes(32).toString('hex');
     if(p.deployment.secrets?.length)await atomic(secretsFile,secrets);
-    await atomic(record.compose,compose(config,record,secrets));
+    await atomic(record.compose,await compose(config,record,secrets,home));
     // Build/pull is explicit installation mechanics. No services start and no onboarding is executed.
     for(const [service,s] of Object.entries(record.deployment.services)) await checked([...composeArgs(record),s.image?'pull':'build',service]);
     r.plugins[name]=record;for(const alias of Object.keys(p.manifest.commands)) r.commands[alias]=name;
@@ -327,7 +388,7 @@ export async function main(args) {
         settings.folders={...settings.folders,[name]:folders};
         await checkFolders(settings,latest);
         const secrets=await json(path.join(home,'packages',name,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
-        const generated=compose(settings,latest,secrets);
+        const generated=await compose(settings,latest,secrets,home);
         await atomic(path.join(home,'config.json'),settings);
         await atomic(latest.compose,generated);
         return emit({ok:true,plugin:name,folders,readOnly:true,started:false});
@@ -345,7 +406,7 @@ export async function main(args) {
         const result = action === 'shared-enable' ? await sharedService(latest, key, 'enable', run) : { state: 'detached' };
         latest.sharedEnabled = [...new Set([...(latest.sharedEnabled || []).filter(k => k !== key), ...(action === 'shared-enable' ? [key] : [])])];
         const secrets = await json(path.join(home, 'packages', name, 'secrets.json')).catch(e => { if (e.code === 'ENOENT') return {}; throw e; });
-        await atomic(latest.compose, compose(currentConfig, latest, secrets));
+        await atomic(latest.compose, await compose(currentConfig, latest, secrets, home));
         // Persist the binding before recreating clients; start can recover an interrupted recreation.
         await atomic(path.join(home, 'registry.json'), current);
         await checked([...composeArgs(latest), 'up', '-d', '--wait']);
@@ -371,7 +432,7 @@ export async function main(args) {
         const currentConfig=await json(path.join(home,'config.json'));
         await checkFolders(currentConfig,current.plugins[name]);
         const secrets=await json(path.join(home,'packages',name,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
-        await atomic(record.compose,compose(currentConfig,current.plugins[name],secrets));
+        await atomic(record.compose,await compose(currentConfig,current.plugins[name],secrets,home));
       }
       await checked([...composeArgs(record),...(action==='start'?['up','-d','--wait']:action==='stop'?['stop']:['down'])]);
       if(action==='uninstall') {delete current.plugins[name];for(const [alias,owner] of Object.entries(current.commands))if(owner===name)delete current.commands[alias];await atomic(path.join(home,'registry.json'),current);}
@@ -384,7 +445,7 @@ export async function main(args) {
   if(!binding)throw Error('Unknown registered CLI');
   await checkFolders(config,record);
   const secrets=await json(path.join(home,'packages',record.manifest.id,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
-  await atomic(record.compose,compose(config,record,secrets));
+  await atomic(record.compose,await compose(config,record,secrets,home));
   // Docker exec does not reliably forward cancellation to the in-container process.
   // Run each client as a one-shot Compose container; docker compose run forwards signals.
   const name=`${record.project}-call-${randomUUID()}`;

package/src/reply-context.ts

@@ -1,4 +1,4 @@
-import { assertEffort } from './model-policy.js'
+import { executionOverrides } from './model-policy.js'
 import { randomUUID } from 'node:crypto'
 import { initialPreset, isPreset } from './ai.js'
 import { readFile, readdir, lstat } from 'node:fs/promises'
@@ -40,9 +40,8 @@ export async function replyCall(controlDir: string, runId: string, workspace: st
   if (name === 'send') return runs.enqueueMessage(runId, args.text, { id: `${runId}_busy_reply`, replyToMessageId: run.messageId })
   if (name === 'defer') {
     if (!run.execution) throw new Error('Missing execution choice')
-    const preset = { ...initialPreset('codex'), ...(args.model !== undefined ? { model: args.model } : {}), ...(args.effort !== undefined ? { effort: args.effort } : {}) }
+    const preset = executionOverrides('codex', initialPreset('codex'), args.model as string | undefined, args.effort as string | undefined)
     if (!isPreset(preset)) throw new Error('Invalid worker model or effort')
-    assertEffort(preset.effort, preset.model, preset.cli)
     const owner = (await new ControlStore(controlDir, 900000).status()).owner!
     const scheduler = new Scheduler(controlDir), id = `s_reply_${runId}`
     try { return { id: (await scheduler.get(id)).id } } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error }

package/src/reply-mcp.ts

@@ -3,7 +3,7 @@ import { replyCall } from './reply-context.js'
 const [controlDir, runId, workspace] = process.argv.slice(2)
 const tools = [
   { name: 'context', description: 'Read this owner request, recent conversation, active and historical runs, and task progress.', inputSchema: { type: 'object', properties: {}, additionalProperties: false } },
-  ...['send', 'defer'].map(name => ({ name, description: name === 'send' ? 'Send one answer to the paired owner. Repeated calls reuse the same receipt.' : 'Queue the current owner request for a writer session. Include needed context and acceptance checks in text. Optional model and effort select the worker independently; defaults are gpt-5.6-terra/high. Repeated calls return the same schedule.', inputSchema: { type: 'object', properties: { text: { type: 'string', maxLength: 8000 }, ...(name === 'defer' ? { model: { type: 'string', maxLength: 160 }, effort: { type: 'string', enum: ['none', 'minimal', 'low', 'medium', 'high'] } } : {}) }, required: ['text'], additionalProperties: false } })),
+  ...['send', 'defer'].map(name => ({ name, description: name === 'send' ? 'Send one answer to the paired owner. Repeated calls reuse the same receipt.' : 'Queue the current owner request for a writer session. Include needed context and acceptance checks in text. Optional model and effort select the worker independently; defaults are gpt-5.6-luna/max. Repeated calls return the same schedule.', inputSchema: { type: 'object', properties: { text: { type: 'string', maxLength: 8000 }, ...(name === 'defer' ? { model: { type: 'string', maxLength: 160 }, effort: { type: 'string', enum: ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'] } } : {}) }, required: ['text'], additionalProperties: false } })),
 ]
 for await (const line of createInterface({ input: process.stdin })) {
   let request: any

package/src/schedule-cli.ts

@@ -6,6 +6,7 @@ import { loadControlConfig } from './config.js'
 import { ControlStore } from './control-state.js'
 import { RunStore } from './runs.js'
 import { initialPreset, isPreset } from './ai.js'
+import { executionOverrides } from './model-policy.js'
 import { Scheduler } from './scheduler.js'
 import { ownsRun } from './identity.js'
 import { nextOccurrence, type Trigger } from './schedule-time.js'
@@ -22,11 +23,11 @@ async function main() {
   review RUN_ID --failed-at ISO --status resolved|attention --diagnosis TEXT --recovery TEXT --outcome TEXT
   create [ID] | edit ID --name NAME (--text TEXT | --text-file FILE)
     --now | --at ISO_WITH_OFFSET | --every-seconds N | --cron 'MIN HOUR DAY MONTH WEEKDAY' --timezone IANA
-    [--cli EXECUTOR] [--model MODEL] [--effort none|minimal|low|medium|high|xhigh (Luna only)]
+    [--cli EXECUTOR] [--model MODEL] [--effort none|minimal|low|medium|high|xhigh|max (Luna only)]
     [--start ISO_WITH_OFFSET] [--until ISO_WITH_OFFSET] [--when unreviewed-failures]
 Failures default to unreviewed owner runs. Review records a diagnosis; it never changes execution status or retries work.
 A conditional review schedule consumes no model run when there are no unreviewed failures.
-New tasks default to Codex Terra/high, independently of the current chat. Explicit settings override these defaults; edit preserves existing settings unless overridden.
+New tasks default to Codex Luna/max, independently of the current chat. Explicit settings override these defaults; edit preserves existing settings unless overridden.
 Creates a durable, asynchronous CLI task. Instructions are text, never shell commands.
 Use --now to delegate long work and return to chat. Run completion is not delivery proof.
 Edit replaces the full schedule. Pause/remove affect future work; cancel stops a particular run.
@@ -73,7 +74,7 @@ Cron uses numeric five-field syntax, lists/ranges/steps, and traditional day/wee
       v.cron ? {cron:v.cron,timezone:v.timezone!,start,until:v.until} : {everySeconds:Number(v['every-seconds']),start,until:v.until}
     const previous = action === 'edit' ? (await scheduler.get(id!)).execution : undefined
     const base = v.cli ? initialPreset(v.cli) : previous?.preset || initialPreset('codex')
-    const preset = {...base, ...(v.model ? {model:v.model} : {}), ...(v.effort ? {effort:v.effort} : {})}
+    const preset = executionOverrides(base.cli, base, v.model, v.effort)
     if (!isPreset(preset)) throw new Error('Invalid task AI selection')
     result=await show(await scheduler.save({id:id || 's_'+randomUUID(),name:v.name || 'Task',
       text:v.text || await readFile(v['text-file']!,'utf8'),when:v.when as 'unreviewed-failures' | undefined,trigger,enabled:true,owner,

package/src/scheduler.ts

@@ -5,7 +5,7 @@ import { randomUUID, createHash } from 'node:crypto'
 import { join } from 'node:path'
 import type { Owner } from './control-state.js'
 import { assertId, ownsRun } from './identity.js'
-import { type ExecutionChoice, isExecutionChoice } from './ai.js'
+import { type ExecutionChoice, isExecutionChoice, persistedPreset } from './ai.js'
 import { type Trigger, validateTrigger, nextOccurrence } from './schedule-time.js'
 import { RunStore, type RunRecord } from './runs.js'
 
@@ -64,9 +64,10 @@ export class Scheduler {
   async save(input: Omit<Schedule,'version'|'revision'>, exclusive = false): Promise<Schedule> {
     await this.ensure(); assertId(input.id)
     if (input.when !== undefined && input.when !== 'unreviewed-failures') throw new Error('Unknown schedule condition')
-    if (!input.name || !input.text?.trim() || !isExecutionChoice(input.execution)) throw new Error('Schedule needs name, text and an AI selection')
-    assertEffort(input.execution.preset.effort, input.execution.preset.model, input.execution.preset.cli)
-    const s: Schedule = {...input,trigger:validateTrigger(input.trigger),version:1,revision:randomUUID()}
+    const execution: ExecutionChoice = {...input.execution, preset: persistedPreset(input.execution.preset)}
+    if (!input.name || !input.text?.trim() || !isExecutionChoice(execution)) throw new Error('Schedule needs name, text and an AI selection')
+    assertEffort(execution.preset.effort, execution.preset.model, execution.preset.cli)
+    const s: Schedule = {...input, execution, trigger:validateTrigger(input.trigger),version:1,revision:randomUUID()}
     if (nextOccurrence(s.trigger,Date.now()-1) === null) throw new Error('Schedule has no future occurrence within eight years')
     await atomic(join(this.dir,s.id+'.json'),s,exclusive)
     return s

package/src/updates/binding.mjs

@@ -11,7 +11,7 @@ export async function bindUpdates(home,hostConfig,packageRoot=fileURLToPath(new
   if(await fs.realpath(path.join(deploymentDir,'mind'))!==config.workspace||await fs.realpath(path.join(deploymentDir,'control'))!==host.agents[0].controlDir)throw Error('Noncanonical deployment state paths');
   packageRoot=await fs.realpath(packageRoot);
   await fs.mkdir(path.join(home,'updates'),{recursive:true,mode:0o700});
-  await atomic(path.join(home,'config.json'),{...config,packageRoot:packageRoot.replace(/\/$/,''),deploymentDir});
+  await atomic(path.join(home,'config.json'),{...config,hostConfig,packageRoot:packageRoot.replace(/\/$/,''),deploymentDir});
   const pkg=await read(path.join(packageRoot,'package.json')),bin=path.join(home,'bin');
   // Every invocation resolves the active root. Already-running workers retain
   // their old code; the next worker receives the new package after activation.

package/src/updates/runtime.mjs

@@ -58,7 +58,7 @@ function envValue(text,key,value) {
 }
 async function backupVolume(run,record,name,directory) {
   const services=Object.entries(record.deployment.services),service=services.find(([,s])=>s.volumes?.[name])?.[0];
-  const c=compose({workspace:'/unused'},record),image=c.services[service].image;
+  const c=await compose({workspace:'/unused'},record),image=c.services[service].image;
   // No writable profile mount, network, Docker socket, provider command or secrets.
   const found=(await run('docker',['volume','ls','--format','{{.Name}}','--filter',`name=^${record.project}_${name}$`])).trim();
   if(!found)return; // Installed but never started: no profile exists yet.
@@ -112,7 +112,7 @@ export async function perform(home,job,hooks) {
       const s=await snapshot(root),candidate={...old,source:root,revision:s.revision,manifest:s.manifest,deployment:s.deployment,sharedRevisions:s.sharedRevisions};
       for (const key of old.sharedEnabled || []) if (sharedIdentity(old, key).fingerprint !== sharedIdentity(candidate, key).fingerprint) throw Error('Shared worker changed; disable this client and coordinate an explicit shared worker upgrade before updating');
       await checkFolders(config,candidate);
-      const stage={...candidate,compose:path.join(dir,'compose.json')};await atomic(stage.compose,compose(config,stage,secrets));
+      const stage={...candidate,compose:path.join(dir,'compose.json')};await atomic(stage.compose,await compose(config,stage,secrets,home));
       for(const [service,spec] of Object.entries(stage.deployment.services))await run('docker',[...pluginArgs(stage),spec.image?'pull':'build',service]);
       const running=Boolean((await run('docker',[...pluginArgs(old),'ps','-q'])).trim());
       job.rollback={record:old,registry:r,compose:await read(old.compose),running};await save();
@@ -120,7 +120,7 @@ export async function perform(home,job,hooks) {
       const backup=path.join(dir,'backup');await fs.mkdir(backup,{mode:0o700});
       const volumes=new Set(Object.values(old.deployment.services).flatMap(s=>Object.keys(s.volumes||{})));
       for(const name of volumes)await backupVolume(run,old,name,backup);
-      await atomic(old.compose,compose(config,candidate,secrets));
+      await atomic(old.compose,await compose(config,candidate,secrets,home));
       if(running)await run('docker',[...pluginArgs(candidate),'up','-d','--wait','--wait-timeout','90','--no-build']);
       r.plugins[job.target]=candidate;await atomic(path.join(home,'registry.json'),r);
       job.runtimeVerified=running;

package/test/ai.test.ts

@@ -8,6 +8,7 @@ import { initialPreset, chatPreset, readModels, isPreset } from '../src/ai.js'
 import { createAiMenu } from '../src/menu.js'
 import { EXECUTOR_REGISTRY, nativeSessionId } from '../src/executor.js'
 import { InboxStore } from '../src/inbox.js'
+import { executionDefaults } from '../src/model-policy.js'
 import type { Update } from 'grammy/types'
 
 test('AI choices pin model, effort and session; defaults and CLI switches do not reroute old work', async () => {
@@ -87,7 +88,7 @@ test('model catalog projects native metadata only, excluding hidden entries and
     ] }))
     assert.deepEqual(await readModels(home, async (cli) => cli === 'codex'), [
       { cli: 'codex', model: 'fixture-model', name: 'Fixture', efforts: ['medium'] },
-      { cli: 'codex', model: 'gpt-5.6-luna', name: 'Luna', efforts: ['high', 'xhigh'] },
+      { cli: 'codex', model: 'gpt-5.6-luna', name: 'Luna', efforts: ['high', 'xhigh', 'max'] },
     ])
     assert.equal(isPreset({ id: 'x', name: 'x', cli: 'grok', model: '--shell escape' }), false)
   } finally { await rm(home, { recursive: true, force: true }) }
@@ -165,7 +166,7 @@ test('native executor flags carry the exact model and effort; only structured me
 })
 
 for (const cli of ['codex', 'codex-gui']) {
-  test(`${cli} initializes Terra high ahead of host defaults and preserves saved choices`, async () => {
+  test(`${cli} initializes Luna max ahead of host defaults and preserves saved choices`, async () => {
     const dir = await mkdtemp(join(tmpdir(), 'ez-ai-default-'))
     try {
       const store = new ControlStore(dir, 1000)
@@ -174,8 +175,9 @@ for (const cli of ['codex', 'codex-gui']) {
         model: 'host-model', effort: 'low' }]
       await store.syncClientPresets(initial, discovered)
       const first = await store.captureChoice(initial)
-      assert.equal(first.preset.model, 'gpt-5.6-terra')
-      assert.equal(first.preset.effort, 'high')
+      assert.equal(first.preset.model, 'gpt-5.6-luna')
+      assert.equal(first.preset.effort, undefined)
+      assert.equal(executionDefaults(cli, first.preset).effort, 'max')
       assert.equal(first.preset.cli, cli)
       const saved = { id: 'custom', name: 'Custom', cli, model: 'custom-model', effort: 'medium' }
       await store.savePreset(saved)
@@ -197,8 +199,8 @@ for (const cli of ['codex', 'codex-gui']) {
       const chat = await store.captureChoice(chatPreset(cli))
       assert.equal(chat.preset.model, 'gpt-5.6-sol')
       assert.equal(chat.preset.effort, 'medium')
-      assert.equal(initialPreset(cli).model, 'gpt-5.6-terra')
-      assert.equal(initialPreset(cli).effort, 'high')
+      assert.equal(initialPreset(cli).model, 'gpt-5.6-luna')
+      assert.equal(initialPreset(cli).effort, 'max')
       const old = initialPreset(cli)
       await store.savePreset(old)
       await store.defaultPreset(old.id)

package/test/client-defaults.test.ts

@@ -70,7 +70,7 @@ test('status projects the native client default without pinning the seed', () =>
   assert.deepEqual(statusPreset({ ...initial, id: 'detected_empty' }, [discovered]), discovered)
   const explicit = { ...discovered, id: 'saved', model: 'chosen-codex', effort: 'high' }
   assert.equal(statusPreset(explicit, [discovered]), explicit)
-  assert.equal(statusPreset(initialPreset('codex-gui'), [{ ...discovered, cli: 'codex-gui' }]).model, 'gpt-5.6-terra')
+  assert.equal(statusPreset(initialPreset('codex-gui'), [{ ...discovered, cli: 'codex-gui' }]).model, 'gpt-5.6-luna')
 })
 
 test('seed uses the configured executor; repeated refresh preserves current/default and queued snapshots', async () => {

package/test/model-policy.test.ts

@@ -3,10 +3,10 @@ import assert from 'node:assert/strict'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { executionDefaults } from '../src/model-policy.js'
+import { executionDefaults, executionOverrides } from '../src/model-policy.js'
 import { startExecutorJob } from '../src/executor.js'
 import { ControlStore } from '../src/control-state.js'
-import { initialPreset, readModels, validateSelection } from '../src/ai.js'
+import { initialPreset, persistedPreset, readModels, validateSelection } from '../src/ai.js'
 import { taskArguments } from '../src/task-executor.js'
 import { runCodexSession } from '../src/codex-session.js'
 import { runDesktopTurn } from '../src/desktop-bridge.js'
@@ -23,24 +23,34 @@ test('all non-Luna model selections and launches reject effort above high before
   await assert.rejects(runDesktopTurn({workspace:'/unused',controlDir:'/unused',binDir:'/unused',runId:'unused',prompt:'',effort:'ultra'}), /capped at high/)
 })
 
-test('Codex Luna accepts xhigh while every other model and CLI remains capped', async () => {
-  const luna = { id:'luna', name:'Luna', cli:'codex', model:'gpt-5.6-luna', effort:'xhigh' }
-  await validateSelection(luna, [{ cli:'codex', model:'gpt-5.6-luna', name:'Luna', efforts:['high','xhigh'] }], async () => true)
-  assert.deepEqual(executionDefaults('codex', { model:'gpt-5.6-luna', effort:'xhigh' }), { model:'gpt-5.6-luna', effort:'xhigh' })
-  assert.throws(() => executionDefaults('grok', { model:'gpt-5.6-luna', effort:'xhigh' }), /capped at high/)
-  assert.throws(() => executionDefaults('codex', { model:'gpt-5.6-terra', effort:'xhigh' }), /capped at high/)
+test('Codex Luna accepts xhigh and max while every other model and CLI remains capped', async () => {
+  for (const effort of ['xhigh', 'max']) {
+    const luna = { id:'luna', name:'Luna', cli:'codex', model:'gpt-5.6-luna', effort }
+    await validateSelection(luna, [{ cli:'codex', model:'gpt-5.6-luna', name:'Luna', efforts:['high','xhigh','max'] }], async () => true)
+    assert.deepEqual(executionDefaults('codex', { model:'gpt-5.6-luna', effort }), { model:'gpt-5.6-luna', effort })
+    assert.throws(() => executionDefaults('grok', { model:'gpt-5.6-luna', effort }), /capped at high/)
+    assert.throws(() => executionDefaults('codex', { model:'gpt-5.6-terra', effort }), /capped at high/)
+  }
 })
 
-test('restricted tasks pin Terra high, preserve explicit choices and reject higher effort', () => {
+test('restricted tasks pin Luna max, preserve explicit choices and reject higher effort', () => {
   const args = taskArguments('/unused', ['broker'], 'prompt')
-  assert.equal(args[args.indexOf('--model')+1], 'gpt-5.6-terra')
-  assert.ok(args.includes('model_reasoning_effort="high"'))
+  assert.equal(args[args.indexOf('--model')+1], 'gpt-5.6-luna')
+  assert.ok(args.includes('model_reasoning_effort="max"'))
   const custom = taskArguments('/unused', ['broker'], 'prompt', undefined, {model:'custom-model',effort:'low'})
   assert.equal(custom[custom.indexOf('--model')+1], 'custom-model')
   assert.ok(custom.includes('model_reasoning_effort="low"'))
   assert.throws(() => taskArguments('/unused', ['broker'], 'prompt', undefined, {effort:'xhigh'}), /capped at high/)
   assert.deepEqual(executionDefaults('codex', {model:'custom-model',effort:'medium'}), {model:'custom-model',effort:'medium'})
-  assert.deepEqual(executionDefaults('codex', {}), {model:'gpt-5.6-terra',effort:'high'})
+  assert.deepEqual(executionDefaults('codex', {model:'gpt-6-astra'}), {model:'gpt-6-astra',effort:'high'})
+  assert.deepEqual(executionDefaults('codex', {model:'gpt-5.6-terra'}), {model:'gpt-5.6-terra',effort:'high'})
+  assert.deepEqual(executionDefaults('codex', {model:'gpt-5.6-luna'}), {model:'gpt-5.6-luna',effort:'max'})
+  assert.deepEqual(executionDefaults('codex', {}), {model:'gpt-5.6-luna',effort:'max'})
+  assert.deepEqual(executionOverrides('codex', {model:'gpt-5.6-luna',effort:'max'}, 'gpt-6-astra'), {model:'gpt-6-astra',effort:'high'})
+  assert.deepEqual(executionOverrides('codex', {model:'gpt-5.6-luna',effort:'max'}, 'gpt-5.6-luna'), {model:'gpt-5.6-luna',effort:'max'})
+  const stored = persistedPreset({id:'luna',name:'Luna',cli:'codex',model:'gpt-5.6-luna',effort:'max'})
+  assert.equal(stored.effort, undefined)
+  assert.deepEqual(executionDefaults('codex', stored), {id:'luna',name:'Luna',cli:'codex',model:'gpt-5.6-luna',effort:'max'})
 })
 
 test('preset persistence rejects above-high choices without changing current settings', async () => {

package/test/plugin-manager.test.mjs

@@ -30,8 +30,8 @@ for(const cleanup of ['success','failure','already-removed']) test(`cancel remov
 });
 async function fixture(t) {
  const root=await fs.mkdtemp(path.join(tmpdir(),'ez-tools-'));t.after(()=>fs.rm(root,{recursive:true,force:true}));
- const source=path.join(root,'source'),home=path.join(root,'tools'),workspace=path.join(root,'mind'),fake=path.join(root,'fake');
- for(const d of [source,workspace,fake])await fs.mkdir(d);
+ const source=path.join(root,'source'),home=path.join(root,'tools'),deploymentDir=path.join(root,'deployment'),workspace=path.join(deploymentDir,'mind'),control=path.join(deploymentDir,'control'),hostConfig=path.join(deploymentDir,'host-executor.json'),fake=path.join(root,'fake');
+ for(const d of [source,workspace,control,fake])await fs.mkdir(d,{recursive:true});
  const manifest={schemaVersion:1,id:'sample',version:'0.1.0',description:'Synthetic',commands:{sample:{executable:'client.mjs',args:[]}},skills:['SKILL.md']};
  const deployment={schemaVersion:1,services:{sample:{buildTarget:'runtime',volumes:{data:'/data'},workspace:true,healthcheck:['node','--version']}},commands:{sample:{service:'sample',argv:['node','/app/client.mjs'],suffix:[]}}};
  for(const [name,value]of Object.entries({'package.json':JSON.stringify({files:['client.mjs','SKILL.md']}),'ez-plugin.json':JSON.stringify(manifest),'ez-deployment.json':JSON.stringify(deployment),'Dockerfile':'FROM scratch AS runtime','.dockerignore':'','client.mjs':'','SKILL.md':'Synthetic'}))await fs.writeFile(path.join(source,name),value);
@@ -39,7 +39,7 @@ async function fixture(t) {
  await fs.writeFile(path.join(fake,'docker'),`#!${process.execPath}\nrequire('fs').appendFileSync(${JSON.stringify(log)},JSON.stringify({argv:process.argv.slice(2),secret:process.env.TELEGRAM_BOT_TOKEN})+'\\n');\nif(process.argv.includes('run')){console.log(JSON.stringify(process.argv.slice(process.argv.indexOf('/app/client.mjs')+1)));process.exit(process.argv.includes('fail')?17:0)}\n`,{mode:0o700});
  const env={...process.env,PATH:fake+path.delimiter+process.env.PATH,TELEGRAM_BOT_TOKEN:'must-not-leak'};
  const call=(...args)=>exec(process.execPath,[bin,'--home',home,...args],{env});
- return {root,source,home,workspace,fake,log,manifest,deployment,env,call};
+ return {root,source,home,deploymentDir,workspace,control,hostConfig,fake,log,manifest,deployment,env,call};
 }
 test('catalog paths resolve relative to the catalog and pin each new agent independently',async t=>{
  const f=await fixture(t),catalog=path.join(f.root,'defaults.json');
@@ -95,13 +95,45 @@ test('registry corruption, active writer lock and alias collision fail closed',a
 });
 test('Compose resources are namespaced, private, and restricted to owning workspace',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);
- const c=compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:p.deployment});
+ const c=await compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:p.deployment});
  assert.equal(c.name,'ezp-synthetic');assert.equal(c.services.sample.ports,undefined);assert.equal(c.services.sample.privileged,undefined);assert.equal(c.services.sample.volumes[1].read_only,true);assert.deepEqual(c.services.sample.cap_drop,['ALL']);
 });
+test('host-owned private networks survive registered-call Compose regeneration',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const config=JSON.parse(await fs.readFile(path.join(f.home,'config.json'),'utf8'));
+ const binding={service:'sample',network:'stocks-vm_default'};
+ const host={cli:'synthetic',agents:[{name:'sample',workspace:f.workspace,controlDir:f.control,binDir:path.join(f.home,'bin'),toolsHome:f.home,pluginNetworkBindings:{sample:{revisions:[p.revision],bindings:[binding]}}}]};
+ await fs.writeFile(f.hostConfig,JSON.stringify(host));
+ config.hostConfig=await fs.realpath(f.hostConfig);
+ await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify(config));
+ const file=path.join(f.home,'packages/sample/compose.json');await fs.writeFile(file,'{}');
+ await f.call('sample','read');
+ const c=JSON.parse(await fs.readFile(file,'utf8'));
+ assert.deepEqual(c.networks.default,{});
+ const [key,network]=Object.entries(c.networks).find(([name])=>name!=='default');
+ assert.equal(network.name,'stocks-vm_default');assert.equal(network.external,true);
+ assert.deepEqual(c.services.sample.networks,['default',key]);
+ const compromised={...config,hostNetworkBindings:{sample:[{service:'sample',network:'untrusted_default'}]}};
+ assert.deepEqual((await compose(compromised,p,{},f.home)).services.sample.networks,['default',key]);
+ const upgraded={...config,hostConfig:undefined,deploymentDir:path.dirname(config.hostConfig)};
+ assert.deepEqual((await compose(upgraded,p,{},f.home)).services.sample.networks,['default',key]);
+ const unsafeHost=path.join(f.home,'host-executor.json');await fs.writeFile(unsafeHost,JSON.stringify(host));
+ await assert.rejects(compose({...config,hostConfig:unsafeHost},p,{},f.home),/external host config/);
+ const forged=structuredClone(p);forged.manifest.id='forged';
+ host.agents[0].pluginNetworkBindings={forged:{revisions:[p.revision],bindings:[binding]}};await fs.writeFile(f.hostConfig,JSON.stringify(host));
+ await assert.rejects(compose(config,forged,{},f.home),/reviewed source/);
+ for(const bindings of [
+   {sample:[{service:'missing',network:'stocks-vm_default'}]},
+   {sample:[{service:'sample',network:'bad/network'}]},
+   {sample:[{service:'sample',network:'stocks-vm_default'},{service:'sample',network:'stocks-vm_default'}]},
+   'not-a-binding-map'
+ ]) { host.agents[0].pluginNetworkBindings=bindings==='not-a-binding-map'?bindings:{sample:{revisions:[p.revision],bindings}};await fs.writeFile(f.hostConfig,JSON.stringify(host));await assert.rejects(compose(config,{source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment},{},f.home),/host network|Docker network/); }
+});
 test('host onboarding binds local ez without replacing global commands',async t=>{
  const f=await fixture(t),native=path.join(f.root,'native'),config=path.join(f.root,'host.json');await fs.mkdir(native);await fs.writeFile(path.join(native,'native-tool'),'hello');
  await fs.writeFile(config,JSON.stringify({cli:'synthetic',agents:[{name:'demo',workspace:f.workspace,binDir:native}]}));
- await init(f.home,f.workspace,undefined,config);const host=JSON.parse(await fs.readFile(config));assert.equal(host.agents[0].binDir,path.join(await fs.realpath(f.home),'bin'));assert.equal(host.agents[0].toolsHome,await fs.realpath(f.home));assert.equal(await fs.readFile(path.join(host.agents[0].binDir,'native-tool'),'utf8'),'hello');
+ await init(f.home,f.workspace,undefined,config);const host=JSON.parse(await fs.readFile(config));assert.equal(host.agents[0].binDir,path.join(await fs.realpath(f.home),'bin'));assert.equal(host.agents[0].toolsHome,await fs.realpath(f.home));assert.equal((JSON.parse(await fs.readFile(path.join(f.home,'config.json'),'utf8'))).hostConfig,undefined);assert.equal(await fs.readFile(path.join(host.agents[0].binDir,'native-tool'),'utf8'),'hello');
   await assert.rejects(init(f.home,f.workspace),/exists/);
 });
 test('host install exposes runnable public commands without source aliases',async t=>{
@@ -128,10 +160,10 @@ test('v2 supports bounded dependency graphs and generated private secrets',async
  d.services.database={image:'example/database@sha256:'+'a'.repeat(64),user:'999:999',healthcheck:['check'],memoryMiB:128,cpus:2,environment:{PASSWORD:{secret:'db-password'}}};
  d.services.sample.dependsOn=['database'];d.services.sample.environment={URL:{secret:'db-password',prefix:'db://',suffix:'@database'}};
  validate(f.manifest,d,p.files);
- const c=compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:d},{'db-password':'b'.repeat(64)});
+ const c=await compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:d},{'db-password':'b'.repeat(64)});
  assert.equal(c.services.database.user,'999:999');assert.equal(c.services.sample.depends_on.database.condition,'service_healthy');assert.equal(c.services.sample.environment.URL,'db://'+'b'.repeat(64)+'@database');
- assert.equal(c.services.database.mem_limit,'128m');assert.throws(()=>compose({workspace:f.workspace}, {source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:d}),/Missing/);
- assert.equal(c.services.database.cpus,2);assert.throws(()=>compose({workspace:f.workspace}, {source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:d}),/Missing/);
+ assert.equal(c.services.database.mem_limit,'128m');await assert.rejects(compose({workspace:f.workspace}, {source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:d}),/Missing/);
+ assert.equal(c.services.database.cpus,2);await assert.rejects(compose({workspace:f.workspace}, {source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:d}),/Missing/);
  for(const change of [x=>x.services.database.user='0:0',x=>x.services.database.cpus=0.01,x=>x.services.database.cpus=9,x=>x.services.database.environment.PASSWORD={secret:'undeclared'},x=>x.services.database.environment.PASSWORD='${HOST_SECRET}',x=>x.services.database.dependsOn=['sample'],x=>x.services.sample.dependsOn=['missing'],x=>x.services.sample.ports=['9999:9999']]){const bad=structuredClone(d);change(bad);assert.throws(()=>validate(f.manifest,bad,p.files));}
  const old=structuredClone(d);old.schemaVersion=1;assert.throws(()=>validate(f.manifest,old,p.files));
 });
@@ -252,9 +284,9 @@ test('folder bindings survive compatible descriptors and reject incompatible upd
  const f=await fixture(t);const p=await snapshot(f.source);
  const record={...p,project:'ezp-test-sample'};
  const config={workspace:f.workspace,folders:{sample:[{service:'sample',source:f.workspace,target:'/data/files'}]}};
- assert.equal(compose(config,record).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
+ assert.equal((await compose(config,record)).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
  const next=structuredClone(record);next.deployment.services.sample.volumes={data:'/new-state'};
- assert.throws(()=>compose(config,next),/child of a declared volume/);
+ await assert.rejects(compose(config,next),/child of a declared volume/);
 });
 
 test('folder rebind rejects every live project container including one-shots',async t=>{

package/test/reply.test.ts

@@ -44,7 +44,7 @@ test('reply native adapter exposes only context send defer with shell and networ
  assert.doesNotMatch(args,/--add-dir/)
 })
 
-test('reply handoff deduplicates the owner request and defaults independently to Terra high', async () => {
+test('reply handoff deduplicates the owner request and defaults independently to Luna max', async () => {
  const root=await mkdtemp(join(tmpdir(),'ez-reply-defer-')), runs=new RunStore(root)
  try {
   const control=new ControlStore(root,900000)
@@ -55,11 +55,17 @@ test('reply handoff deduplicates the owner request and defaults independently to
   const first=await replyCall(root,'tg_4',root,'defer',{text:'Prepare the report using the canonical sources'})
   assert.deepEqual(await replyCall(root,'tg_4',root,'defer',{text:'retry'}),first)
   const saved=JSON.parse(await readFile(join(root,'schedules','s_reply_tg_4.json'),'utf8'))
-  assert.equal(saved.execution.preset.model,'gpt-5.6-terra')
-  assert.equal(saved.execution.preset.effort,'high')
+  assert.equal(saved.execution.preset.model,'gpt-5.6-luna')
+  assert.equal(saved.execution.preset.effort,undefined)
   assert.notEqual(saved.execution.sessionId,execution.sessionId)
   assert.match(saved.text,/Make the report/)
   assert.equal(saved.owner.telegramChatId,101)
+  await runs.create({id:'tg_11',chatId:101,telegramUserId:101,texts:['Use Astra'],execution})
+  await runs.patch('tg_11',{status:'running',replyOnly:true})
+  await replyCall(root,'tg_11',root,'defer',{text:'Use Astra for this worker',model:'gpt-6-astra'})
+  const astra=JSON.parse(await readFile(join(root,'schedules','s_reply_tg_11.json'),'utf8'))
+  assert.equal(astra.execution.preset.model,'gpt-6-astra')
+  assert.equal(astra.execution.preset.effort,'high')
  }finally{await rm(root,{recursive:true,force:true})}
 })
 

package/test/schedule-cli.test.ts

@@ -22,10 +22,12 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
  const args=['create','test','--at','2027-09-09T09:00:00+04:00','--text','Literal $(do-not-execute) /goal objective']
  const saved=JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
  assert.equal(saved.text,args.at(-1));assert.equal(saved.execution.preset.cli,'codex')
- assert.equal(saved.execution.preset.model,'gpt-5.6-terra');assert.equal(saved.execution.preset.effort,'high')
- await assert.rejects(exec(process.execPath,[bin,'create','blocked','--at','2027-09-09T09:00:00+04:00','--text','test','--effort','xhigh'],{env}),/capped at high/)
- const luna=JSON.parse((await exec(process.execPath,[bin,'create','luna','--at','2027-09-10T09:00:00+04:00','--text','Luna xhigh task','--model','gpt-5.6-luna','--effort','xhigh'],{env})).stdout)
- assert.equal(luna.execution.preset.model,'gpt-5.6-luna');assert.equal(luna.execution.preset.effort,'xhigh')
+ assert.equal(saved.execution.preset.model,'gpt-5.6-luna');assert.equal(saved.execution.preset.effort,undefined)
+ await assert.rejects(exec(process.execPath,[bin,'create','blocked','--at','2027-09-09T09:00:00+04:00','--text','test','--model','gpt-5.6-terra','--effort','xhigh'],{env}),/capped at high/)
+ const astra=JSON.parse((await exec(process.execPath,[bin,'create','astra','--at','2027-09-09T10:00:00+04:00','--text','Astra task','--model','gpt-6-astra'],{env})).stdout)
+ assert.equal(astra.execution.preset.model,'gpt-6-astra');assert.equal(astra.execution.preset.effort,'high')
+ const luna=JSON.parse((await exec(process.execPath,[bin,'create','luna','--at','2027-09-10T09:00:00+04:00','--text','Luna max task','--model','gpt-5.6-luna','--effort','max'],{env})).stdout)
+ assert.equal(luna.execution.preset.model,'gpt-5.6-luna');assert.equal(luna.execution.preset.effort,undefined)
  assert.equal(saved.nextEligibleAt,'2027-09-09T05:00:00.000Z')
  await assert.rejects(exec(process.execPath,[bin,...args],{env}),/exists/)
  assert.equal(JSON.parse((await exec(process.execPath,[bin,'pause','test'],{env})).stdout).enabled,false)

package/test/updates.test.mjs

@@ -44,7 +44,7 @@ async function fixture(t,kind='main') {
  if(kind==='plugin') {
   const s=await snapshot(old),base=path.join(home,'packages',target);await fs.mkdir(base,{recursive:true});
   record={revision:s.revision,source:old,project:`ezp-${digest(home).slice(0,16)}-${target}`,manifest:s.manifest,deployment:s.deployment,compose:path.join(base,'compose.json')};
-  await atomic(record.compose,compose(config,record));
+  await atomic(record.compose,await compose(config,record,{},home));
  }
  await atomic(path.join(home,'registry.json'),{schemaVersion:1,owner:home,plugins:record?{sample:record}:{},commands:record?{sample:'sample'}:{}});
  await fs.cp(old,source,{recursive:true});pkg.version='0.1.1';await atomic(path.join(source,'package.json'),pkg);