@jc_stack/ez-agents 0.1.0-beta.26 → 0.1.0-beta.28

package/test/application-channel.test.ts

@@ -0,0 +1,283 @@
+import test from 'node:test'
+import { request as httpRequest } from 'node:http'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile, readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+import { randomBytes } from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+import { createRequire } from 'node:module'
+import { ApplicationChannel, ApplicationBindings, applicationScope } from '../src/application-channel.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { initialPreset } from '../src/ai.js'
+import { requireOwnerExecution } from '../src/execution-authority.js'
+import { createRelay } from '../src/index.js'
+import { EXECUTOR_REGISTRY, executorEnvironment } from '../src/executor.js'
+
+const token = () => randomBytes(32).toString('base64url')
+const owner = async (dir: string) => {
+  const control = new ControlStore(dir,1000)
+  await control.requestPairing(42,42); await control.approveOwner(42)
+  return (await control.status()).owner!
+}
+const waitFor = async (condition: () => Promise<boolean>) => {
+  for (let attempt=0; attempt<200; attempt++) { if (await condition()) return; await new Promise(resolve=>setTimeout(resolve,10)) }
+  throw new Error('Timed out waiting for application run')
+}
+
+test('HTTP auth, idempotency, origin/context isolation, revocation and persisted scope continuity', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-channel-'))
+  const owned=await owner(root), runs=new RunStore(root), control=new ControlStore(root,1000)
+  let wakes=0
+  const channel=new ApplicationChannel({controlDir:root,initial:initialPreset('codex'),wake:()=>{wakes++},cancel:async id=>{await runs.patch(id,{status:'cancelled'})}})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const firstToken=token(), secondToken=token()
+  const first=(await channel.bindings.register('first',firstToken,owned))!
+  const second=(await channel.bindings.register('second',secondToken,owned))!
+  const address=await channel.listen(0) as {port:number}
+  const url=`http://127.0.0.1:${address.port}`
+  const request=(path:string,bearer:string,body?:unknown)=>fetch(url+path,{method:body===undefined?'GET':'POST',headers:{Authorization:`Bearer ${bearer}`},...(body===undefined?{}:{body:JSON.stringify(body)})})
+  assert.equal((await request('/v1/runs','bad',{})).status,401)
+  assert.equal((await runs.list()).length,0)
+  const input={requestId:'request-1',scope:'person:program',text:'Discuss next lesson',context:{capability:'not-a-prompt',reference:'lesson'}}
+  const created=await request('/v1/runs',firstToken,input)
+  assert.equal(created.status,202)
+  const result=await created.json() as {id:string}
+  const retry=await request('/v1/runs',firstToken,{...input,context:{capability:'replacement'}})
+  assert.equal((await retry.json() as {id:string}).id,result.id)
+  assert.equal(wakes,1)
+  const unicode=Buffer.from(JSON.stringify({...input,requestId:'unicode',text:'Café lesson'}))
+  const split=unicode.indexOf(Buffer.from('é'))+1
+  const unicodeResponse=await new Promise<string>((resolve,reject)=>{
+    const req=httpRequest(url+'/v1/runs',{method:'POST',headers:{Authorization:`Bearer ${firstToken}`}},res=>{
+      let body='';res.setEncoding('utf8');res.on('data',chunk=>body+=chunk);res.on('end',()=>resolve(body))
+    });req.on('error',reject);req.write(unicode.subarray(0,split));setTimeout(()=>req.end(unicode.subarray(split)),20)
+  })
+  assert.equal((await runs.get(JSON.parse(unicodeResponse).id))?.texts[0],'Café lesson')
+
+  assert.equal((await runs.get(result.id))?.application?.context?.capability,'not-a-prompt')
+  assert.equal((await request('/v1/runs',firstToken,{...input,text:'changed'})).status,409)
+  assert.equal((await request('/v1/runs',firstToken,{...input,scope:'other'})).status,409)
+  assert.equal((await request(`/v1/runs/${result.id}`,secondToken)).status,404)
+  assert.equal((await request(`/v1/runs/${result.id}/cancel`,secondToken,{})).status,404)
+  assert.equal((await request('/v1/runs',firstToken,{...input,requestId:'../escape'})).status,400)
+  assert.equal((await request('/v1/runs',firstToken,{...input,requestId:'extra',workspace:'/etc'})).status,400)
+  const run=(await runs.get(result.id))!
+  assert.equal(run.messageId,undefined)
+  assert.equal(run.external,undefined)
+  await runs.patch(run.id,{status:'running'})
+  assert.equal((await requireOwnerExecution(root,run.id)).application?.scope,input.scope)
+  await control.saveNativeSession(run.execution!.sessionId,'native_scope_one')
+  const later=await channel.submit(first.bindingId,{...input,requestId:'later'})
+  assert.equal(later.execution?.sessionId,run.execution?.sessionId)
+  assert.equal((await new ControlStore(root,1000).executionSession(later.execution!)).nativeSessionId,'native_scope_one')
+  const otherScope=await channel.submit(first.bindingId,{...input,requestId:'other-scope',scope:'different'})
+  const otherBinding=await channel.submit(second.bindingId,input)
+  assert.notEqual(otherScope.execution?.sessionId,run.execution?.sessionId)
+  assert.notEqual(otherBinding.execution?.sessionId,run.execution?.sessionId)
+  assert.equal((await control.listSessions()).length,0,'app conversations do not replace or appear in Telegram selector')
+  const telegram=await control.captureChoice(initialPreset('codex'))
+  assert.notEqual(telegram.sessionId,run.execution?.sessionId)
+  const message=await runs.enqueueMessage(run.id,'Here is the proposal')
+  await runs.claimOutbox(message.id)
+  await channel.deliver(run,message)
+  assert.deepEqual(await runs.waitForDelivery(message.id),{delivered:true})
+  assert.deepEqual((await channel.snapshot(first.bindingId,run.id)).messages,[{id:message.id,text:'Here is the proposal'}])
+  await channel.bindings.register('first',null,owned)
+  await assert.rejects(requireOwnerExecution(root,run.id),/revoked/)
+  await assert.rejects(channel.deliver(run,message),/revoked/)
+  assert.equal((await request(`/v1/runs/${run.id}`,firstToken)).status,401)
+  await writeFile(join(root,'application-bindings.json'),'{')
+  assert.equal((await request('/v1/runs',secondToken,input)).status,401)
+})
+
+test('owner replacement invalidates binding and client secrets never enter native environment',async t=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-app-owner-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const first=await owner(root), bindings=new ApplicationBindings(root), secret=token()
+  await bindings.register('app',secret,first)
+  await new ControlStore(root,1000).revokeOwner()
+  await assert.rejects(bindings.authenticate(secret),/Unauthorized/)
+  assert.equal(executorEnvironment({TELEGRAM_BOT_TOKEN:'telegram-secret',EZ_APPLICATION_TOKEN:secret,PATH:'/bin'}).EZ_APPLICATION_TOKEN,undefined)
+  assert.equal(executorEnvironment({TELEGRAM_BOT_TOKEN:'telegram-secret'}).TELEGRAM_BOT_TOKEN,undefined)
+})
+
+test('app run uses real core executor process, scoped native resume and outbox without Telegram delivery',async t=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-app-executor-'))
+  const original=EXECUTOR_REGISTRY.codex
+  const prompts:string[]=[], resumeIds:(string|undefined)[]=[]
+  const require=createRequire(import.meta.url)
+  const fixture=join(root,'engine.mjs')
+  const nativeId='11111111-1111-1111-1111-111111111111'
+  await writeFile(fixture,`import {spawnSync} from 'node:child_process';
+console.log(JSON.stringify({type:'thread.started',thread_id:${JSON.stringify(nativeId)}}));
+const result=spawnSync(process.execPath,[${JSON.stringify(fileURLToPath(new URL('../bin/ezenciel-agents-message.mjs',import.meta.url)))},'--text','Fixture engine reply'],{env:process.env,encoding:'utf8'});
+if(result.status!==0){console.error(result.stderr);process.exit(1)};
+`)
+  EXECUTOR_REGISTRY.codex={...original,command:process.execPath,buildArgs:(options,_file,prompt)=>{prompts.push(prompt);resumeIds.push(options.isResume?options.sessionId:undefined);return ['--import',require.resolve('tsx'),fixture]}}
+  const relay=createRelay({controlDir:root,workspace:root,pairingTtlMs:1000,telegramBotToken:'fixture',executorTimeoutMs:0,executorCli:'codex'})
+  let telegramCalls=0
+  relay.bot.api.config.use(async()=>{telegramCalls++;return {ok:true,result:{message_id:1}} as never})
+  const owned=await owner(root), secret=token()
+  const binding=(await relay.applicationChannel.bindings.register('app',secret,owned))!
+  const drain=setInterval(()=>void relay.drainOutbox(),10)
+  t.after(async()=>{clearInterval(drain);await relay.stop();EXECUTOR_REGISTRY.codex=original;await rm(root,{recursive:true,force:true})})
+  const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'one',scope:'program',text:'Hello from the app',context:{secret:'must-stay-out-of-prompt'}})
+  await waitFor(async()=> (await new RunStore(root).get(first.id))?.status==='completed')
+  const second=await relay.applicationChannel.submit(binding.bindingId,{requestId:'two',scope:'program',text:'Continue'})
+  await waitFor(async()=> (await new RunStore(root).get(second.id))?.status==='completed')
+  assert.deepEqual(resumeIds,[undefined,nativeId])
+  assert.equal(telegramCalls,0)
+  assert.ok(prompts[0].startsWith('Hello from the app'))
+  assert.ok(prompts[0].includes('[Application channel]'))
+  assert.ok(!prompts[0].includes('must-stay-out-of-prompt'))
+  assert.equal((await relay.applicationChannel.snapshot(binding.bindingId,second.id)).messages[0].text,'Fixture engine reply')
+})
+
+
+test('packaged admin command discovery and existing core child cancellation',async t=>{
+  const help=spawnSync(process.execPath,[fileURLToPath(new URL('../bin/ezenciel-agents-application.mjs',import.meta.url)),'--help'],{encoding:'utf8'})
+  assert.equal(help.status,0,help.stderr)
+  assert.match(help.stdout,/--token-file/)
+  const root=await mkdtemp(join(tmpdir(),'ez-app-cancel-')), original=EXECUTOR_REGISTRY.codex
+  EXECUTOR_REGISTRY.codex={...original,command:process.execPath,buildArgs:()=>['-e','setInterval(()=>{},1000)']}
+  const relay=createRelay({controlDir:root,workspace:root,pairingTtlMs:1000,telegramBotToken:'fixture',executorTimeoutMs:0,executorCli:'codex'})
+  t.after(async()=>{await relay.stop();EXECUTOR_REGISTRY.codex=original;await rm(root,{recursive:true,force:true})})
+  const owned=await owner(root),secret=token(),binding=(await relay.applicationChannel.bindings.register('app',secret,owned))!
+  const address=await relay.applicationChannel.listen(0) as {port:number}
+  const run=await relay.applicationChannel.submit(binding.bindingId,{requestId:'cancel',scope:'scope',text:'Wait'})
+  await waitFor(async()=> (await new RunStore(root).get(run.id))?.status==='running')
+  const response=await fetch(`http://127.0.0.1:${address.port}/v1/runs/${run.id}/cancel`,{method:'POST',headers:{Authorization:`Bearer ${secret}`}})
+  assert.equal(response.status,200)
+  await waitFor(async()=> (await new RunStore(root).get(run.id))?.status==='cancelled')
+})
+
+test('native history assertion blocks accidental fresh cutover without choosing a native session', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-import-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const owned = await owner(root), control = new ControlStore(root, 1000)
+  const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
+  const binding = (await channel.bindings.register('app', token(), owned))!
+  const input = { requestId: 'job', scope: 'main', text: 'Continue', expectedNativeSessionId: 'existing-native' }
+  await assert.rejects(channel.submit(binding.bindingId, input), /import the existing scope/)
+  assert.equal((await new RunStore(root).list()).length, 0)
+  const choice = await control.captureApplicationChoice(initialPreset('codex'), applicationScope(binding.bindingId, 'main'))
+  await control.saveNativeSession(choice.sessionId, 'existing-native')
+  const run = await channel.submit(binding.bindingId, input)
+  assert.equal((await channel.snapshot(binding.bindingId, run.id)).nativeSessionId, 'existing-native')
+  await assert.rejects(channel.submit(binding.bindingId, { ...input, requestId: 'other', expectedNativeSessionId: 'someone-else' }), /conflicts/)
+})
+
+test('explicit shared channel grant resumes one native session from app and Telegram', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-shared-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const owned = await owner(root), control = new ControlStore(root, 1000)
+  const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
+  const binding = (await channel.bindings.register('app', token(), owned, true))!
+  const input = { requestId: 'app-1', scope: 'biology', text: 'Continue', activateTelegram: true }
+  const app = await channel.submit(binding.bindingId, input)
+  await control.saveNativeSession(app.execution!.sessionId, 'biology-history')
+  const telegram = await control.captureChoice(initialPreset('codex'))
+  assert.equal(telegram.sessionId, app.execution!.sessionId)
+  assert.equal((await control.executionSession(telegram)).nativeSessionId, 'biology-history')
+  const selection = await channel.submit(binding.bindingId, { ...input, requestId: 'selection', scope: 'selection:1', activateTelegram: false })
+  assert.notEqual(selection.execution!.sessionId, telegram.sessionId)
+  assert.equal((await control.captureChoice(initialPreset('codex'))).sessionId, telegram.sessionId)
+  const appAgain = await channel.submit(binding.bindingId, { ...input, requestId: 'app-2' })
+  assert.equal(appAgain.execution!.sessionId, telegram.sessionId)
+  assert.equal((await control.listSessions()).filter(s => s.sessionId === telegram.sessionId).length, 1)
+  const other = (await channel.bindings.register('private', token(), owned))!
+  await channel.submit(other.bindingId, { ...input, requestId: 'private' })
+  assert.equal((await control.captureChoice(initialPreset('codex'))).sessionId, telegram.sessionId, 'an unshared app cannot switch Telegram')
+})
+
+test('application AI choice retains same-engine history and rejects cross-engine resume and changed retries', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-ai-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
+  const binding = (await channel.bindings.register('app', token(), await owner(root)))!
+  const input = { requestId: 'one', scope: 'main:codex', text: 'Hello', ai: { cli: 'codex', model: 'gpt-5.6-luna', effort: 'high' } }
+  const first = await channel.submit(binding.bindingId, input)
+  assert.equal(first.execution!.preset.model, input.ai.model)
+  const second = await channel.submit(binding.bindingId, { ...input, requestId: 'two', ai: { ...input.ai, model: 'gpt-5.6-terra' } })
+  assert.equal(first.execution!.sessionId, second.execution!.sessionId)
+  await assert.rejects(channel.submit(binding.bindingId, { ...input, ai: { ...input.ai, model: 'gpt-5.6-terra' } }), /conflicts/)
+  await assert.rejects(channel.submit(binding.bindingId, { ...input, requestId: 'three', ai: { cli: 'grok' } }), /engine/)
+})
+
+test('rejected history assertion cannot activate Telegram and incomplete native metadata does not hide cancellation', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-assertion-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const owned = await owner(root), control = new ControlStore(root, 1000)
+  const before = await control.captureChoice(initialPreset('codex'))
+  const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
+  const binding = (await channel.bindings.register('app', token(), owned, true))!
+  const input = { requestId: 'one', scope: 'main', text: 'Hello', activateTelegram: true, expectedNativeSessionId: 'old-native' }
+  await assert.rejects(channel.submit(binding.bindingId, input), /import/)
+  assert.equal((await control.captureChoice(initialPreset('codex'))).sessionId, before.sessionId)
+  const run = await channel.submit(binding.bindingId, { ...input, expectedNativeSessionId: undefined })
+  await control.markSessionStarted(run.execution!.sessionId)
+  assert.equal((await channel.snapshot(binding.bindingId, run.id)).id, run.id)
+})
+
+test('HTTP admission errors distinguish absent work from an existing conflicting run', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-admission-'))
+  const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
+  t.after(async () => { await channel.stop(); await rm(root, { recursive: true, force: true }) })
+  const credential = token()
+  await channel.bindings.register('app', credential, await owner(root))
+  const address = await channel.listen(0) as { port: number }
+  const post = (body: unknown) => fetch(`http://127.0.0.1:${address.port}/v1/runs`, { method: 'POST', headers: { authorization: `Bearer ${credential}` }, body: JSON.stringify(body) })
+  const input = { requestId: 'same', scope: 'main', text: 'Hello' }
+  const rejected = await post({ ...input, expectedNativeSessionId: 'unimported' })
+  assert.equal(rejected.status, 409)
+  assert.equal((await rejected.json() as { admitted: boolean }).admitted, false)
+  const accepted = await post(input)
+  const run = await accepted.json() as { id: string }
+  const conflict = await post({ ...input, text: 'Changed' })
+  const error = await conflict.json() as { admitted: boolean; runId: string }
+  assert.equal(error.admitted, true); assert.equal(error.runId, run.id)
+})
+
+test('following Telegram uses current conversation and model, but retries retain admitted work', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-follow-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const owned = await owner(root), control = new ControlStore(root, 1000)
+  const initial = initialPreset('codex')
+  const channel = new ApplicationChannel({ controlDir: root, initial, wake: () => {}, cancel: async () => {} })
+  const binding = (await channel.bindings.register('app', token(), owned, true))!
+  const input = { requestId: 'first', scope: 'main', text: 'Continue', followTelegram: true }
+  const current = await control.captureChoice(initial)
+  const first = await channel.submit(binding.bindingId, input)
+  assert.deepEqual(first.execution, current)
+  await control.resetSession()
+  const selected = { ...initial, id: 'different', name: 'Different', model: 'gpt-6-astra', effort: 'high' }
+  await control.savePreset(selected)
+  await control.selectPreset(selected.id, (await control.getActiveSession())!.sessionId)
+  const next = await channel.submit(binding.bindingId, { ...input, requestId: 'second' })
+  assert.notEqual(next.execution!.sessionId, first.execution!.sessionId)
+  assert.equal(next.execution!.preset.effort, 'high')
+  assert.equal(next.execution!.preset.model, 'gpt-6-astra')
+  assert.deepEqual((await channel.submit(binding.bindingId, input)).execution, first.execution)
+  await assert.rejects(channel.submit(binding.bindingId, { ...input, followTelegram: false }), /conflicts/)
+  const detail = await channel.submit(binding.bindingId, { requestId: 'detail', scope: 'exercise', text: 'Discuss' })
+  assert.notEqual(detail.execution!.sessionId, next.execution!.sessionId)
+  assert.equal((await control.getActiveSession())!.sessionId, next.execution!.sessionId)
+})
+
+test('following Telegram requires an explicit sharing grant and cannot override selected state', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-follow-authority-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const owned = await owner(root)
+  const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
+  const binding = (await channel.bindings.register('app', token(), owned))!
+  const input = { requestId: 'one', scope: 'main', text: 'Continue', followTelegram: true }
+  await assert.rejects(channel.submit(binding.bindingId, input), /authority/)
+  const shared = (await channel.bindings.register('shared', token(), owned, true))!
+  for (const extra of [{ ai: { cli: 'codex' } }, { activateTelegram: true }, { expectedNativeSessionId: 'old' }, { followTelegram: 'true' }]) {
+    await assert.rejects(channel.submit(shared.bindingId, { ...input, ...extra }), /Invalid application/)
+  }
+  assert.equal((await new RunStore(root).list()).length, 0)
+})

package/test/application-client.test.mjs

@@ -0,0 +1,84 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, writeFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { applicationBinding, applicationCall, runApplication } from '../src/application-client.mjs'
+
+const id = `r_app_${'a'.repeat(64)}`
+test('control transport uses the same credential boundary without expanding arbitrary operations', async () => {
+  const calls = []
+  const connection = {url:'http://agent:8787',token:'secret',fetchImpl:async(url,options)=>{
+    calls.push([String(url),options.method]);return Response.json({activeSessionId:null})
+  }}
+  await applicationCall('/v1/control',undefined,connection)
+  await applicationCall('/v1/control',{action:'new',expectedSession:null},connection)
+  await applicationCall('/v1/scope-control?scope=exercise',undefined,connection)
+  await assert.rejects(applicationCall('/v1/control/../secrets',undefined,connection),/Invalid/)
+  assert.deepEqual(calls,[['http://agent:8787/v1/control','GET'],['http://agent:8787/v1/control','POST'],['http://agent:8787/v1/scope-control?scope=exercise','GET']])
+  await assert.rejects(applicationCall('/v1/scopes/../control',undefined,connection),/Invalid/)
+  for (const path of ['/v1/control','/v1/scope-control?scope=exercise']) {
+    await assert.rejects(applicationCall(path,{action:'new',expectedSession:null},{...connection,
+      fetchImpl:async()=>{throw new Error('lost response')}}),error=>error.retryable===false)
+  }
+})
+test('principal bindings fail closed on unknown, revoked, duplicate and shared endpoints', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-client-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const file = join(dir, 'bindings.json'), tokenFile = join(dir, 'token')
+  await writeFile(tokenFile, 'private-token\n', { mode: 0o600 })
+  let bindings = [{ principalId: 'alice', url: 'http://alice:8787', tokenFile }, { principalId: 'bob', url: 'http://bob:8787', tokenFile }]
+  const save = () => writeFile(file, JSON.stringify({ version: 1, bindings }))
+  await save()
+  assert.equal((await applicationBinding(file, 'alice')).url, 'http://alice:8787')
+  assert.equal((await applicationBinding(file, 'bob')).url, 'http://bob:8787')
+  await assert.rejects(applicationBinding(file, 'eve'), /No authorized/)
+  bindings[1].revoked = true; await save()
+  await assert.rejects(applicationBinding(file, 'bob'), /No authorized/)
+  bindings[1].url = 'http://alice:8787/'; await save()
+  await assert.rejects(applicationBinding(file, 'alice'), /separate Ez endpoints/)
+  bindings[1].url = 'http://bob:8787'; bindings[1].principalId = 'alice'; await save()
+  await assert.rejects(applicationBinding(file, 'alice'), /Invalid/)
+  await writeFile(file, '{')
+  await assert.rejects(applicationBinding(file, 'alice'))
+})
+
+test('shared client preserves one submission, exposes native continuity and bounds uncertain failure', async () => {
+  const calls = [], admitted = []
+  const fetchImpl = async (url, options) => {
+    calls.push({ url: String(url), ...options })
+    return Response.json({ id, status: calls.length === 1 ? 'queued' : 'completed', nativeSessionId: 'native-history', messages: [{ id: 'message', text: 'Done' }] })
+  }
+  const input = { requestId: 'same-job', scope: 'main', text: 'hello', context: { capability: 'scoped' } }
+  const result = await runApplication(input, { url: 'http://agent:8787', token: 'secret', fetchImpl, pollMs: 1, onAdmitted: value => admitted.push(value) })
+  assert.equal(result.reply, 'Done'); assert.equal(result.nativeSessionId, 'native-history')
+  assert.deepEqual(admitted, [id]); assert.equal(calls.length, 2)
+  assert.deepEqual(JSON.parse(calls[0].body), input)
+  assert.equal(calls[1].method, 'GET'); assert.equal(calls[0].redirect, 'error')
+  await assert.rejects(applicationCall('/v1/runs', input, { url: 'http://agent:8787', token: 'secret', fetchImpl: async () => new Response('{', { status: 200 }) }), error => error.retryable === true)
+  await assert.rejects(applicationCall('/v1/runs', input, { url: 'http://agent:8787', token: 'secret', fetchImpl: async () => new Response('', { status: 403 }) }), error => error.retryable === false)
+  await assert.rejects(applicationCall('//other-host', input, { url: 'http://agent:8787', token: 'secret', fetchImpl }), /Invalid/)
+  await assert.rejects(runApplication(input, { url: 'http://agent:8787', token: 'secret', fetchImpl: async () => Response.json({ id, status: 'cancelled' }) }), error => error.terminal === true)
+  assert.equal(calls.length, 2, 'invalid operation never sends a credential')
+})
+
+test('opt-in reconnect retains admission identity and polls through temporary network failure', async () => {
+  const calls = []
+  const input = { requestId: 'durable', scope: 'main', text: 'Update', context: { capability: 'original' } }
+  const result = await runApplication(input, { url: 'http://agent:8787', token: 'secret', pollMs: 1, reconnect: true,
+    fetchImpl: async (_url, options) => {
+      calls.push(options)
+      if (calls.length === 1 || calls.length === 3) throw new Error('connection lost')
+      return Response.json({ id, status: calls.length === 2 ? 'running' : 'completed', messages: [{ text: 'Saved' }] })
+    },
+  })
+  assert.equal(result.reply, 'Saved')
+  assert.equal(calls[0].body, calls[1].body)
+  assert.equal(calls[2].method, 'GET'); assert.equal(calls[3].method, 'GET')
+})
+
+test('client preserves definitive non-admission evidence without inventing it for authentication errors', async () => {
+  const connection = { url: 'http://agent:8787', token: 'secret' }
+  await assert.rejects(applicationCall('/v1/runs', {}, { ...connection, fetchImpl: async () => Response.json({ admitted: false }, { status: 409 }) }), error => error.admitted === false)
+  await assert.rejects(applicationCall('/v1/runs', {}, { ...connection, fetchImpl: async () => Response.json({ error: 'Unauthorized' }, { status: 401 }) }), error => error.admitted === undefined)
+})

package/test/application-controls.test.ts

@@ -0,0 +1,224 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, open } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { randomBytes } from 'node:crypto'
+import { ApplicationChannel, applicationScope } from '../src/application-channel.js'
+import { ControlStore } from '../src/control-state.js'
+import { createAiMenu } from '../src/menu.js'
+import { RunStore } from '../src/runs.js'
+
+test('private scope reset and model controls preserve running sessions and shared state', async t => {
+  const root = await mkdtemp(join(tmpdir(),'ez-private-controls-'))
+  const control = new ControlStore(root,1000)
+  await control.requestPairing(42,42); const owner = await control.approveOwner(42)
+  const menu = createAiMenu(control,'codex',async()=>[
+    {cli:'codex',model:'fixture-model',name:'Fixture',efforts:['low','high']},
+    {cli:'opencode',model:'fixture-other',name:'Other',efforts:[]},
+  ],root,join(root,'native-home'),async()=>true)
+  const channel = new ApplicationChannel({controlDir:root,initial:menu.initial,aiControls:menu,wake:()=>{},cancel:async()=>{}})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const token = randomBytes(32).toString('base64url')
+  const binding = (await channel.bindings.register('private',token,owner))!
+  const second = (await channel.bindings.register('second',randomBytes(32).toString('base64url'),owner))!
+  const shared = await control.captureChoice(menu.initial)
+  const run = await channel.submit(binding.bindingId,{requestId:'before-reset',scope:'exercise',text:'still executing'})
+  await control.saveNativeSession(run.execution!.sessionId,'native-private')
+  const selectedBefore = (await control.status()).ai!.selectedId
+  const address = await channel.listen(0) as {port:number}
+  const call = (body?:unknown) => fetch(`http://127.0.0.1:${address.port}/v1/scope-control?scope=exercise`,{
+    method:body===undefined?'GET':'POST',headers:{authorization:`Bearer ${token}`},
+    ...(body===undefined?{}:{body:JSON.stringify(body)}),
+  })
+  const before = await (await call()).json() as any
+  assert.equal(before.activeSessionId,run.execution!.sessionId)
+  assert.equal(JSON.stringify(before).includes('native-private'),false)
+  assert.equal((await channel.scopeControls(second.bindingId,'exercise')).activeSessionId,null)
+  await assert.rejects(channel.changeScopeControls(second.bindingId,'exercise',{action:'new',expectedSession:before.activeSessionId}),/changed/)
+  assert.equal((await call({action:'new',expectedSession:before.activeSessionId})).status,200)
+  const next = await channel.scopeControls(binding.bindingId,'exercise')
+  assert.notEqual(next.activeSessionId,before.activeSessionId)
+  assert.equal(next.ai.selectedId,menu.initial.id)
+  assert.equal((await call({action:'new',expectedSession:before.activeSessionId})).status,400)
+  assert.equal((await control.executionSession(run.execution!)).nativeSessionId,'native-private')
+  assert.equal((await control.getActiveSession())!.sessionId,shared.sessionId)
+  assert.equal((await control.listSessions()).some(item=>item.sessionId===before.activeSessionId || item.sessionId===next.activeSessionId),false)
+  const after = await channel.submit(binding.bindingId,{requestId:'after-reset',scope:'exercise',text:'new context'})
+  assert.equal(after.execution!.sessionId,next.activeSessionId)
+  const presets = (await control.status()).ai!.presets
+  assert.equal((await call({action:'model',expectedSession:before.activeSessionId,cli:'codex',model:'fixture-model',effort:'high'})).status,400)
+  assert.deepEqual((await control.status()).ai!.presets,presets)
+  assert.equal((await call({action:'model',expectedSession:next.activeSessionId,cli:'codex',model:'fixture-model',effort:'high'})).status,200)
+  const updated = await channel.submit(binding.bindingId,{requestId:'updated-model',scope:'exercise',text:'same engine'})
+  assert.equal(updated.execution!.sessionId,next.activeSessionId)
+  assert.equal(updated.execution!.preset.effort,'high')
+  assert.deepEqual((await new RunStore(root).get(after.id))!.execution,after.execution)
+  assert.equal((await control.status()).ai!.selectedId,selectedBefore)
+  for (const scope of ['_detail','.', '..', 'x'.repeat(180)]) {
+    const own = await channel.submit(binding.bindingId,{requestId:`scope-${scope}`,scope,text:'scope contract',ai:{cli:'codex',model:'fixture-model',effort:'low'}})
+    const response = await fetch(`http://127.0.0.1:${address.port}/v1/scope-control?${new URLSearchParams({scope})}`,{headers:{authorization:`Bearer ${token}`}})
+    assert.equal(response.status,200)
+    const state = await response.json() as any
+    assert.equal(state.activeSessionId,own.execution!.sessionId)
+    await channel.changeScopeControls(binding.bindingId,scope,{action:'select',expectedSession:state.activeSessionId,presetId:state.ai.selectedId})
+  }
+  assert.equal((await call({action:'model',expectedSession:next.activeSessionId,cli:'opencode',model:'fixture-other'})).status,200)
+  assert.notEqual((await channel.scopeControls(binding.bindingId,'exercise')).activeSessionId,next.activeSessionId)
+  await channel.bindings.register('private',null,owner)
+  assert.equal((await call()).status,401)
+})
+
+test('application controls share native choices, protect hidden scopes and preserve admitted runs', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-app-controls-'))
+  const control = new ControlStore(root, 1000)
+  await control.requestPairing(42, 42); const owner = await control.approveOwner(42)
+  const menu = createAiMenu(control, 'codex', async () => [
+    {cli:'codex', model:'gpt-6-astra', name:'Fixture model', efforts:['low','high']},
+  ], root, join(root, 'native-home'), async () => true)
+  const channel = new ApplicationChannel({controlDir:root, initial:menu.initial, aiControls:menu, wake:()=>{}, cancel:async()=>{}})
+  t.after(async()=>{await channel.stop(); await rm(root,{recursive:true,force:true})})
+  const token = randomBytes(32).toString('base64url'), privateToken = randomBytes(32).toString('base64url')
+  const shared = (await channel.bindings.register('shared', token, owner, true))!
+  const isolated = (await channel.bindings.register('isolated', privateToken, owner))!
+  const address = await channel.listen(0) as {port:number}
+  const request = (body?:unknown, bearer=token) => fetch(`http://127.0.0.1:${address.port}/v1/control`, {
+    method:body===undefined?'GET':'POST', headers:{authorization:`Bearer ${bearer}`},
+    ...(body===undefined?{}:{body:JSON.stringify(body)}),
+  })
+  assert.equal((await request(undefined, 'invalid')).status,401)
+  assert.equal((await request(undefined, privateToken)).status,403)
+  assert.equal((await request({action:'new',expectedSession:null}, privateToken)).status,403)
+  const initial = await (await request()).json() as any
+  assert.equal(initial.ai.selectedId,menu.initial.id)
+  assert.equal(initial.ai.presets.find((p:any)=>p.id===menu.initial.id).model,undefined)
+  assert.equal((await control.status()).ai,undefined,'reading controls does not initialize or rewrite saved state')
+  const run = await channel.submit(shared.bindingId,{requestId:'queued',scope:'main',followTelegram:true,text:'Keep the admitted native choice'})
+  const old = run.execution!
+  await control.saveNativeSession(old.sessionId,'native-private-id')
+  const hidden = await control.captureApplicationChoice(menu.initial,applicationScope(isolated.bindingId,'private'))
+  const visible = await (await request()).json() as any
+  assert.equal(JSON.stringify(visible).includes('native-private-id'),false)
+  assert.equal(JSON.stringify(visible).includes(hidden.sessionId),false)
+  assert.equal((await request({action:'switch',sessionId:hidden.sessionId,expectedSession:old.sessionId})).status,400)
+  assert.equal((await request({action:'model',cli:'codex',model:'invented',expectedSession:old.sessionId})).status,400)
+  const presetsBefore = (await control.aiState(menu.initial)).presets
+  assert.equal((await request({action:'model',cli:'codex',model:'gpt-6-astra',effort:'high',expectedSession:null})).status,400)
+  assert.deepEqual((await control.aiState(menu.initial)).presets,presetsBefore)
+  const selected = await request({action:'model',cli:'codex',model:'gpt-6-astra',effort:'high',expectedSession:old.sessionId})
+  assert.equal(selected.status,200)
+  assert.equal((await control.captureChoice(menu.initial)).preset.effort,'high')
+  assert.deepEqual((await new RunStore(root).get(run.id))!.execution,old)
+  const reset = await request({action:'new',expectedSession:old.sessionId})
+  assert.equal(reset.status,200)
+  const next = (await control.getActiveSession())!
+  assert.notEqual(next.sessionId,old.sessionId)
+  assert.equal((await request({action:'new',expectedSession:old.sessionId})).status,400)
+  assert.equal((await control.getActiveSession())!.sessionId,next.sessionId)
+  await channel.bindings.register('shared',null,owner)
+  assert.equal((await request()).status,401)
+})
+
+test('atomic control mutations reject a replaced owner even when both active sessions are empty', async t => {
+  const root = await mkdtemp(join(tmpdir(),'ez-control-owner-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const control = new ControlStore(root,1000)
+  await control.requestPairing(42,42); const previous = await control.approveOwner(42)
+  await control.revokeOwner()
+  await control.requestPairing(43,43); await control.approveOwner(43)
+  await assert.rejects(control.resetSession(null,{owner:previous,authorize:async()=>{}}),/owner changed/)
+  assert.equal(await control.getActiveSession(),null)
+})
+
+test('scope control guards reject revocation after waiting for the state lock', async t => {
+  const root = await mkdtemp(join(tmpdir(),'ez-scope-lock-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const control = new ControlStore(root,1000)
+  await control.requestPairing(42,42); const owner = await control.approveOwner(42)
+  const preset = {id:'fixture',name:'Fixture',cli:'codex'}
+  await control.aiState(preset)
+  const scope = applicationScope('binding','private')
+  const guard = {owner,applicationScope:scope,expectedSession:null as string|null,authorize:async()=>{}}
+  const first = await control.changeApplicationSession(scope,guard)
+  assert.equal(await control.getActiveSession(),null)
+  const before = await control.status()
+  let authorized = true
+  const lockPath = join(root,'control-state.lock'), lock = await open(lockPath,'wx',0o600)
+  const pending = control.changeApplicationSession(scope,{...guard,expectedSession:first.sessionId,authorize:async()=>{
+    if (!authorized) throw new Error('Application authority revoked')
+  }})
+  const rejection = assert.rejects(pending,/revoked/)
+  await new Promise(resolve=>setTimeout(resolve,50)); authorized=false
+  await lock.close();await rm(lockPath)
+  await rejection
+  assert.deepEqual(await control.status(),before)
+})
+
+test('revocation while native model validation is pending prevents selection', async t => {
+  const root = await mkdtemp(join(tmpdir(),'ez-control-revoke-'))
+  const control = new ControlStore(root,1000)
+  await control.requestPairing(42,42); const owner = await control.approveOwner(42)
+  let catalogCalls = 0
+  const menu = createAiMenu(control,'codex',async()=>{
+    if (++catalogCalls === 2) await channel.bindings.register('shared',null,owner)
+    return [{cli:'codex',model:'gpt-6-astra',name:'Fixture',efforts:['low']}]
+  },root,join(root,'native-home'),async()=>true)
+  const channel = new ApplicationChannel({controlDir:root,initial:menu.initial,aiControls:menu,wake:()=>{},cancel:async()=>{}})
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const binding = (await channel.bindings.register('shared',randomBytes(32).toString('base64url'),owner,true))!
+  const original = await control.captureChoice(menu.initial)
+  await assert.rejects(channel.changeControls(binding.bindingId,{
+    action:'model',cli:'codex',model:'gpt-6-astra',effort:'low',expectedSession:original.sessionId,
+  }),/authority/)
+  assert.deepEqual(await control.captureChoice(menu.initial),original)
+  assert.equal((await control.aiState(menu.initial)).presets.length,1)
+})
+
+test('revocation during a control-lock wait prevents every guarded mutation', async t => {
+  const root = await mkdtemp(join(tmpdir(),'ez-controls-lock-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const control = new ControlStore(root,1000)
+  await control.requestPairing(42,42); const owner = await control.approveOwner(42)
+  const preset = {id:'fixture',name:'Fixture',cli:'codex'}
+  await control.aiState(preset)
+  const old = await control.captureChoice(preset)
+  const current = await control.resetSession()
+  const before = await control.status()
+  for (const operation of [
+    (guard:any)=>control.resetSession(current.sessionId,guard),
+    (guard:any)=>control.switchSession(old.sessionId,current.sessionId,guard),
+    (guard:any)=>control.savePreset({...preset,id:'new-preset'},guard),
+    (guard:any)=>control.selectPreset(preset.id,current.sessionId,false,guard),
+  ]) {
+    let authorized = true, checks = 0
+    const lockPath = join(root,'control-state.lock'), lock = await open(lockPath,'wx',0o600)
+    const pending = operation({owner,expectedSession:current.sessionId,authorize:async()=>{
+      checks++; if (!authorized) throw new Error('Application authority revoked')
+    }})
+    const rejection = assert.rejects(pending,/revoked/)
+    await new Promise(resolve=>setTimeout(resolve,50))
+    assert.equal(checks,0,'authority is checked inside the acquired lock')
+    authorized = false
+    await lock.close(); await rm(lockPath)
+    await rejection
+    assert.equal(checks,1)
+    assert.deepEqual(await control.status(),before)
+  }
+})
+
+
+test('web control guards survive Telegram linking but reject another owner generation', async t => {
+  const root = await mkdtemp(join(tmpdir(),'ez-owner-channel-controls-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const control = new ControlStore(root,1000)
+  const owner = await control.registerOwner('web-owner')
+  const guard = {owner,authorize:async()=>{}}
+  await control.requestPairing(42,42); await control.approveOwner(42)
+  const session = await control.resetSession(null,guard)
+  await control.unlinkTelegram()
+  const next = await control.resetSession(session.sessionId,guard)
+  await assert.rejects(control.resetSession(next.sessionId,{
+    ...guard,owner:{...owner,generation:'00000000-0000-0000-0000-000000000000'},
+  }),/owner changed/)
+  assert.equal((await control.getActiveSession())!.sessionId,next.sessionId)
+})