@jc_stack/ez-agents 0.1.0-beta.26 → 0.1.0-beta.28

package/test/application-only.test.ts

@@ -0,0 +1,100 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+import { createServer } from 'node:net'
+import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
+import { loadConfig } from '../src/config.js'
+import { createRelay } from '../src/index.js'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { EXECUTOR_REGISTRY } from '../src/executor.js'
+import { ApplicationBindings } from '../src/application-channel.js'
+
+const waitFor = async (condition: () => Promise<boolean>) => {
+  for (let i=0;i<300;i++) { if (await condition()) return; await new Promise(r=>setTimeout(r,10)) }
+  throw new Error('Timed out')
+}
+
+test('application-only mode explicitly requires native listener and ignores bot credentials', () => {
+  assert.throws(()=>loadConfig({}), /TELEGRAM_BOT_TOKEN/)
+  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'false'}), /EZ_APPLICATION_PORT/)
+  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'no'}), /true or false/)
+  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8110',EZ_CHANNEL_BACKEND_URL:'http://backend',EZ_CHANNEL_BACKEND_TOKEN:'secret'}), /native Ez executor/)
+  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8110',TELEGRAM_BOT_TOKEN:'unused-secret'})
+  assert.equal(config.telegramBotToken,'')
+  assert.equal(config.telegramEnabled,false)
+})
+
+test('administrator bootstrap is explicit, local-only and cannot replace identity', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-only-admin-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const token=join(root,'token'); await writeFile(token,'x'.repeat(48),{mode:0o600})
+  const cli=fileURLToPath(new URL('../bin/ezenciel-agents-application.mjs',import.meta.url))
+  const args=[cli,'--id','app','--token-file',token,'--owner','42']
+  const env={...process.env,EZ_CONTROL_DIR:root,EZ_RUN_ID:'',EZ_TELEGRAM_ENABLED:'false'}
+  assert.notEqual(spawnSync(process.execPath,args,{env:{...env,EZ_TELEGRAM_ENABLED:'true'}}).status,0)
+  assert.notEqual(spawnSync(process.execPath,args,{env:{...env,EZ_RUN_ID:'r_agent'}}).status,0)
+  assert.equal((await new ControlStore(root,1000).status()).owner,null)
+  const invalidToken=join(root,'invalid-token');await writeFile(invalidToken,'short')
+  for (const invalidArgs of [
+    [cli,'--id','../bad','--token-file',token,'--owner','42'],
+    [cli,'--id','app','--token-file',invalidToken,'--owner','42'],
+    [cli,'--id','app','--token-file',join(root,'missing'),'--owner','42'],
+  ]) {
+    assert.notEqual(spawnSync(process.execPath,invalidArgs,{env}).status,0)
+    assert.equal((await new ControlStore(root,1000).status()).owner,null)
+  }
+  const good=spawnSync(process.execPath,args,{env,encoding:'utf8'});assert.equal(good.status,0,good.stderr)
+  assert.equal((await new ControlStore(root,1000).status()).owner?.telegramUserId,42)
+  assert.notEqual(spawnSync(process.execPath,args,{env}).status,0)
+  assert.notEqual(spawnSync(process.execPath,[cli,'--id','app','--token-file',token,'--share-telegram'],{env}).status,0)
+  const sharedToken=join(root,'shared-token');await writeFile(sharedToken,'s'.repeat(43),{mode:0o600})
+  const shared=spawnSync(process.execPath,[cli,'--id','shared','--token-file',sharedToken,'--share-active'],{env,encoding:'utf8'})
+  assert.equal(shared.status,0,shared.stderr)
+  assert.equal((await new ApplicationBindings(root).list()).find(binding=>binding.id==='shared')?.shareTelegram,true)
+})
+
+test('botless daemon executes application turn and rejects Telegram-origin work/outbound', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-only-runtime-'))
+  const portServer=createServer();await new Promise<void>(r=>portServer.listen(0,'127.0.0.1',r))
+  const port=(portServer.address() as {port:number}).port;await new Promise<void>(r=>portServer.close(()=>r()))
+  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:String(port),EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'codex'})
+  const native='11111111-1111-1111-1111-111111111111', fixture=join(root,'engine.mjs')
+  await writeFile(fixture,`import {spawnSync} from 'node:child_process';if(process.env.TELEGRAM_BOT_TOKEN)throw Error('secret leak');console.log(JSON.stringify({type:'thread.started',thread_id:${JSON.stringify(native)}}));const r=spawnSync(process.execPath,[${JSON.stringify(fileURLToPath(new URL('../bin/ezenciel-agents-message.mjs',import.meta.url)))},'--text','Application reply'],{env:process.env});process.exit(r.status);`)
+  const original=EXECUTOR_REGISTRY.codex,require=createRequire(import.meta.url)
+  let launches=0
+  EXECUTOR_REGISTRY.codex={...original,command:process.execPath,buildArgs:()=>{launches++;return ['--import',require.resolve('tsx'),fixture]}}
+  const relay=createRelay(config),control=new ControlStore(root,1000),runs=new RunStore(root)
+  assert.equal(relay.bot,null)
+  const owner=await control.bootstrapApplicationOwner(42)
+  const token='x'.repeat(48),binding=(await relay.applicationChannel.bindings.register('app',token,owner))!
+  const running=relay.start()
+  t.after(async()=>{await relay.stop();await running;EXECUTOR_REGISTRY.codex=original;await rm(root,{recursive:true,force:true})})
+  await waitFor(async()=>relay.isRunning())
+  const unauthorized=await fetch(`http://127.0.0.1:${port}/v1/runs`,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({requestId:'bad',scope:'main',text:'bad'})})
+  assert.equal(unauthorized.status,401)
+  await assert.rejects(relay.applicationChannel.submit(binding.bindingId,{requestId:'sandbox-override',scope:'main',text:'Hello',codexSandbox:'external'}), /Invalid application request/)
+  const run=await relay.applicationChannel.submit(binding.bindingId,{requestId:'good',scope:'main',text:'Hello'})
+  await waitFor(async()=> (await runs.get(run.id))?.status==='completed')
+  await waitFor(async()=> (await relay.applicationChannel.snapshot(binding.bindingId,run.id)).messages.length>0)
+  assert.equal((await relay.applicationChannel.snapshot(binding.bindingId,run.id)).messages[0].text,'Application reply')
+  const legacy=await runs.create({chatId:42,telegramUserId:42,texts:['Old Telegram work']})
+  await runs.enqueueMessage(legacy.id,'Never send')
+  await relay.drainSources();await relay.drainOutbox();await relay.drainInbox(true)
+  assert.equal(launches,1)
+  assert.equal((await runs.get(legacy.id))?.status,'queued')
+})
+
+test('Docker health accepts application readiness only with explicit botless configuration', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-only-health-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true}))
+  const command=fileURLToPath(new URL('../docker/healthcheck.mjs',import.meta.url))
+  const env={...process.env,EZ_HEALTH_RELAY_CONTROL_DIR:root,EZ_EXECUTOR_TRANSPORT:'local'}
+  assert.equal(spawnSync(process.execPath,[command],{env:{...env,EZ_TELEGRAM_ENABLED:'false'}}).status,0)
+  assert.notEqual(spawnSync(process.execPath,[command],{env:{...env,EZ_TELEGRAM_ENABLED:'true'}}).status,0)
+})

package/test/busy-reply-relay.test.ts

@@ -10,7 +10,7 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import type { Update } from 'grammy/types'
 const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<150;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
-test('busy owner replies serialize independently of the writer and reject other senders',async()=>{
+test('owner input queues literally without creating a second agent and rejects other senders',async()=>{
  const root=await mkdtemp(join(tmpdir(),'ez-busy-relay-')),runs=new RunStore(root),control=new ControlStore(root,1000),children:ReturnType<typeof spawn>[]=[]
  const relay=createRelay({workspace:root,controlDir:root,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(_texts,opts)=>{
   const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true});children.push(child);await once(child,'spawn')
@@ -24,17 +24,21 @@ test('busy owner replies serialize independently of the writer and reject other
   await relay.bot.handleUpdate(message(1));await relay.drainInbox(true)
   await relay.bot.handleUpdate(message(2));await relay.drainInbox(true)
   await relay.bot.handleUpdate(message(3));await relay.drainInbox(true)
-  assert.equal((await runs.get('tg_2'))?.replyOnly,true)
+  assert.equal((await runs.get('tg_2'))?.replyOnly,undefined)
   assert.equal((await runs.get('tg_3'))?.status,'queued')
-  assert.equal(children.length,2)
+  assert.equal(children.length,1)
   await relay.bot.handleUpdate(message(4,202));await relay.drainInbox(true)
   await relay.bot.handleUpdate(message(5,-42,'group'));await relay.drainInbox(true)
-  assert.equal(children.length,2)
+  assert.equal(children.length,1)
+  children[0].kill()
+  await until(async()=>children.length===2)
+  assert.equal(children[1].exitCode,null)
+  assert.equal(children[1].signalCode,null)
+  assert.equal((await runs.get('tg_2'))?.replyOnly,undefined)
+  assert.deepEqual((await runs.get('tg_2'))?.texts,['status'])
   children[1].kill()
   await until(async()=>children.length===3)
-  assert.equal(children[0].exitCode,null)
-  assert.equal(children[0].signalCode,null)
-  assert.equal((await runs.get('tg_3'))?.replyOnly,true)
+  await until(async()=>(await runs.get('tg_3'))?.status==='running')
   await relay.bot.handleUpdate({...message(6),message:{...message(6).message!,text:'/stop'}} as Update)
   await until(async()=>children.every(c=>c.exitCode!==null || c.signalCode!==null))
  }finally{await relay.stop();for(const c of children)c.kill();await until(async()=>!(await runs.list()).some(r=>r.status==='running'));await rm(root,{recursive:true,force:true})}

package/test/channel-delivery.test.ts

@@ -0,0 +1,63 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import * as fs from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import {createRelay} from '../src/index.js'
+import {ControlStore} from '../src/control-state.js'
+import {RunStore} from '../src/runs.js'
+import {authorizeDeliveryContext,captureDeliveryContext} from '../src/delivery-context.mjs'
+import {nativeTasks,nativeTaskBinding} from '../src/plugins/native-tasks.mjs'
+
+test('authenticated connection sends text and files through ordinary outbox receipts without a native run',async()=>{
+  const root=await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(),'ez-channel-delivery-'))),workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),home=path.join(root,'tools'),hostConfig=path.join(root,'host-executor.json')
+  for(const dir of [workspace,controlDir,home])await fs.mkdir(dir)
+  const relay=createRelay({controlDir,workspace,pairingTtlMs:1000,executorTimeoutMs:1000,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('Must not launch native execution')})
+  const calls:string[]=[];relay.bot.api.config.use(async(_prev,method)=>{calls.push(method);return {ok:true,result:{message_id:42}} as never})
+  try {
+    await fs.writeFile(path.join(home,'config.json'),JSON.stringify({schemaVersion:1,workspace,hostConfig}))
+    await fs.writeFile(hostConfig,JSON.stringify({cli:'grok',agents:[{toolsHome:home,workspace,controlDir}]}))
+    const control=new ControlStore(controlDir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
+    const context=(await captureDeliveryContext(controlDir,'voice','revision'))!,store=new RunStore(controlDir)
+    const env=await nativeTaskBinding(home,{EZ_DELIVERY_CONTEXT:'forged',EZ_RUN_ID:'forged'});assert.equal(env.env.EZ_DELIVERY_CONTEXT,undefined);assert.equal(env.env.EZ_RUN_ID,undefined)
+    const file=path.join(workspace,'scan.pdf');await fs.writeFile(file,'%PDF-fixture')
+    for(const args of [['--text','literal $(not-a-shell)'],['--document',file]]) {
+      const pending=nativeTasks(home,args,{command:'message',deliveryContext:context})
+      const deadline=Date.now()+5000;while(!(await store.pendingOutbox()).length){if(Date.now()>deadline)throw Error('Message was not queued');await new Promise(r=>setTimeout(r,10))}
+      const item=(await store.pendingOutbox())[0]!;assert.equal(item.runId,undefined);if(item.documentPath)assert.equal(item.documentPath,'scan.pdf')
+      await relay.drainOutbox();const result=await pending;assert.equal(result.code,0,result.stderr)
+      const frames=result.stdout.trim().split('\n').map(line=>JSON.parse(line));assert.equal(frames[0].status,'queued');assert.equal(frames.at(-1).status,'delivered');assert.deepEqual(frames.at(-1).receipt.messageIds,[42])
+      const receipt=await nativeTasks(home,['receipt',item.id],{command:'message',deliveryContext:context});assert.equal(JSON.parse(receipt.stdout).status,'delivered')
+    }
+    assert.deepEqual(calls,['sendMessage','sendDocument']);assert.deepEqual(await store.list(),[])
+    await assert.rejects(nativeTasks(home,['--document',hostConfig],{command:'message',deliveryContext:context}),/outside/)
+    await fs.symlink(hostConfig,path.join(workspace,'escape'));await assert.rejects(nativeTasks(home,['--document','escape'],{command:'message',deliveryContext:context}),/outside/)
+    await assert.rejects(nativeTasks(home,['--text-file',hostConfig],{command:'message',deliveryContext:context}),/inline/)
+    const queued=await store.enqueueOwnerDelivery(context,{type:'message',text:'revoked'})
+    await control.revokeOwner();await control.requestPairing(101,101);await control.approveOwner(101)
+    await relay.drainOutbox();assert.equal(calls.length,2);await assert.rejects(store.waitForDelivery(queued.id),/revoked/)
+    await assert.rejects(nativeTasks(home,['--text','denied'],{command:'message',deliveryContext:context}),/revoked/)
+    await assert.rejects(store.ownerDeliveryReceipt(context,queued.id),/revoked/)
+  } finally {await relay.stop();await fs.rm(root,{recursive:true,force:true})}
+})
+test('delivery authority cannot revive after Telegram relink or same-time owner replacement',async t=>{
+  const root=await fs.mkdtemp(path.join(os.tmpdir(),'ez-channel-delivery-epoch-'))
+  t.after(()=>fs.rm(root,{recursive:true,force:true}))
+  const control=new ControlStore(root,60000,()=>Date.parse('2026-09-14T00:00:00Z'))
+  await control.requestPairing(101,101)
+  await control.approveOwner(101)
+  const original=(await captureDeliveryContext(root,'voice','revision'))!
+
+  await control.unlinkTelegram()
+  await control.requestPairing(101,101)
+  await control.approveOwner(101)
+  const relinked=(await control.status()).owner!
+  assert.throws(()=>authorizeDeliveryContext(original,relinked),/revoked/)
+
+  const relinkedContext=(await captureDeliveryContext(root,'voice','revision'))!
+  await control.revokeOwner()
+  await control.requestPairing(101,101)
+  await control.approveOwner(101)
+  const replacement=(await control.status()).owner
+  assert.throws(()=>authorizeDeliveryContext(relinkedContext,replacement),/revoked/)
+})

package/test/channel-owner.test.ts

@@ -0,0 +1,161 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { randomBytes } from 'node:crypto'
+import { spawn } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
+import { ControlStore, ownerId, ownerEpoch, sameOwner } from '../src/control-state.js'
+import { ApplicationChannel } from '../src/application-channel.js'
+import { RunStore } from '../src/runs.js'
+import { Scheduler } from '../src/scheduler.js'
+import { initialPreset } from '../src/ai.js'
+import { ownsRun, isOwner } from '../src/identity.js'
+import { createRelay } from '../src/index.js'
+import { EXECUTOR_REGISTRY } from '../src/executor.js'
+import { loadConfig } from '../src/config.js'
+
+const secret = () => randomBytes(32).toString('base64url')
+const waitFor = async (check: () => Promise<boolean>) => {
+  for (let i=0;i<500;i++) { if (await check()) return; await new Promise(resolve=>setTimeout(resolve,10)) }
+  throw new Error('Timed out waiting for native delivery')
+}
+
+test('one owner links channels, rotates credentials and unlinks Telegram without resetting native continuity', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-channel-owner-'))
+  const control=new ControlStore(root,60000), runs=new RunStore(root)
+  const channel=new ApplicationChannel({controlDir:root,initial:initialPreset('codex'),wake:()=>{},cancel:async()=>{}})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const owner=await control.registerOwner('verified-account')
+  assert.equal(owner.telegramUserId,undefined)
+  assert.deepEqual(await control.registerOwner('verified-account'),owner)
+  await assert.rejects(control.registerOwner('other-account'),/different owner/)
+  const webToken=secret(), phoneToken=secret()
+  const web=(await channel.bindings.register('web',webToken,owner,true))!
+  const phone=(await channel.bindings.register('phone',phoneToken,owner,true))!
+  await assert.rejects(channel.bindings.register('duplicate',webToken,owner),/credential already/)
+  const first=await channel.submit(web.bindingId,{requestId:'one',scope:'main',text:'Remember cobalt',followOwner:true})
+  await control.saveNativeSession(first.execution!.sessionId,'native-owner-session')
+  const second=await channel.submit(phone.bindingId,{requestId:'two',scope:'main',text:'Which word?',followOwner:true})
+  assert.equal(first.execution!.sessionId,second.execution!.sessionId)
+  assert.equal(first.chatId,undefined)
+  assert.equal(first.ownerId,owner.id)
+  assert.equal(ownsRun(owner,first),true)
+  assert.equal(ownsRun({...owner,id:'someone-else'},first),false)
+  const rotated=secret()
+  const after=(await channel.bindings.register('web',rotated,owner,false,true))!
+  assert.equal(after.bindingId,web.bindingId)
+  await assert.rejects(channel.bindings.authenticate(webToken),/Unauthorized/)
+  assert.equal((await channel.bindings.authenticate(rotated)).bindingId,web.bindingId)
+  assert.equal((await channel.submit(web.bindingId,{requestId:'one',scope:'main',text:'Remember cobalt',followOwner:true})).id,first.id)
+  await assert.rejects(control.approveOwner(42),/No active pairing/)
+  await control.requestPairing(42,42)
+  const linked=await control.approveOwner(42)
+  assert.equal(ownerId(linked),owner.id)
+  assert.equal(linked.pairedAt,owner.pairedAt)
+  assert.equal(isOwner({from:{id:42,is_bot:false} as never,chat:{id:42,type:'private'} as never},linked),true)
+  const telegramRun={telegramUserId:42,chatId:42,telegramEpoch:linked.telegramLinkedAt}
+  assert.equal(ownsRun(linked,telegramRun),true)
+  await control.unlinkTelegram()
+  assert.equal(ownsRun((await control.status()).owner,telegramRun),false)
+  assert.equal((await control.executionSession(first.execution!)).nativeSessionId,'native-owner-session')
+  assert.equal((await channel.bindings.authenticate(phoneToken)).id,'phone')
+  await control.requestPairing(42,42);await control.approveOwner(42)
+  assert.equal(ownsRun((await control.status()).owner,telegramRun),false)
+  const address=await channel.listen(0) as {port:number}
+  const registration=await fetch(`http://127.0.0.1:${address.port}/v1/registration`,{headers:{Authorization:`Bearer ${rotated}`}})
+  assert.deepEqual(await registration.json(),{ownerId:'verified-account',bindingId:web.bindingId,channel:'web'})
+  await channel.bindings.register('phone',null,(await control.status()).owner!)
+  await assert.rejects(channel.bindings.authenticate(phoneToken),/Unauthorized/)
+  assert.equal((await channel.bindings.authenticate(rotated)).id,'web')
+  await control.revokeOwner()
+  await assert.rejects(channel.bindings.authenticate(rotated),/Unauthorized/)
+  assert.equal((await runs.list()).length,2)
+})
+
+test('web owner uses the standard schedule CLI, executor and outbox with Telegram disabled',async t=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-channel-schedule-'))
+  const original=EXECUTOR_REGISTRY.grok, require=createRequire(import.meta.url)
+  const fixture=join(root,'engine.mjs')
+  const scheduleCli=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
+  const messageCli=fileURLToPath(new URL('../bin/ezenciel-agents-message.mjs',import.meta.url))
+  await writeFile(fixture,`import {spawnSync} from 'node:child_process';
+    if(process.env.TELEGRAM_BOT_TOKEN)throw Error('secret leak');
+    const scheduled=process.env.EZ_RUN_ID.startsWith('r_schedule_');
+    if(!scheduled){const r=spawnSync(process.execPath,[${JSON.stringify(scheduleCli)},'create','followup','--now','--name','Followup','--text','Finish the requested work'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr)}
+    const r=spawnSync(process.execPath,[${JSON.stringify(messageCli)},'--text',scheduled?'Scheduled reply':'Chat reply'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr);`)
+  EXECUTOR_REGISTRY.grok={...original,command:process.execPath,buildArgs:()=>['--import',require.resolve('tsx'),fixture]}
+  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8787',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'})
+  const relay=createRelay(config), control=new ControlStore(root,60000), runs=new RunStore(root)
+  const owner=await control.registerOwner('web-owner'),token=secret()
+  const binding=(await relay.applicationChannel.bindings.register('web',token,owner))!
+  const address=await relay.applicationChannel.listen(0) as {port:number}
+  const timer=setInterval(()=>{void relay.drainSources();void relay.drainOutbox()},25)
+  t.after(async()=>{clearInterval(timer);await relay.stop();EXECUTOR_REGISTRY.grok=original;await rm(root,{recursive:true,force:true})})
+  const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'chat',scope:'main',text:'Schedule a followup'})
+  await waitFor(async()=> (await runs.get(first.id))?.status==='completed')
+  await waitFor(async()=> (await runs.list()).some(r=>r.scheduled && r.status==='completed'))
+  const scheduled=(await runs.list()).find(r=>r.scheduled)!
+  assert.equal(scheduled.chatId,undefined)
+  assert.equal(scheduled.ownerId,'web-owner')
+  assert.equal(scheduled.delivery?.bindingId,binding.bindingId)
+  await waitFor(async()=> (await relay.applicationChannel.snapshot(binding.bindingId,scheduled.id)).messages.length===1)
+  assert.equal((await relay.applicationChannel.snapshot(binding.bindingId,scheduled.id)).messages[0].text,'Scheduled reply')
+  const inbox=await fetch(`http://127.0.0.1:${address.port}/v1/runs`,{headers:{Authorization:`Bearer ${token}`}})
+  assert.equal((await inbox.json() as {runs:unknown[]}).runs.length,2)
+  const stranger=secret();await relay.applicationChannel.bindings.register('other',stranger,owner)
+  assert.equal((await fetch(`http://127.0.0.1:${address.port}/v1/runs/${scheduled.id}`,{headers:{Authorization:`Bearer ${stranger}`}})).status,404)
+  const scheduler=new Scheduler(root), saved=await scheduler.get('followup')
+  await scheduler.save({...saved,id:'revoked',trigger:{at:new Date(Date.now()+1000).toISOString()}})
+  await relay.applicationChannel.bindings.register('web',null,owner)
+  await scheduler.tick(owner,runs,Date.now()+2000)
+  assert.equal((await runs.list()).some(r=>r.scheduled?.id==='revoked'),false)
+})
+
+test('legacy web runs survive Telegram unlink, but owner revocation invalidates their binding',async t=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-owner-legacy-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const control=new ControlStore(root,60000,()=>Date.parse('2026-01-01T00:00:00Z'))
+  await control.requestPairing(42,42)
+  const owner=await control.approveOwner(42)
+  const channel=new ApplicationChannel({controlDir:root,initial:initialPreset('codex'),wake:()=>{},cancel:async()=>{}})
+  const token=secret(),binding=(await channel.bindings.register('web',token,owner))!
+  const runs=new RunStore(root)
+  const legacy=await runs.create({id:'r_legacy',chatId:42,telegramUserId:42,texts:['legacy'],application:{bindingId:binding.bindingId,scope:'main',requestId:'legacy'}})
+  await control.unlinkTelegram()
+  await channel.bindings.authorize(legacy)
+  assert.equal(ownsRun((await control.status()).owner,legacy),true)
+  await control.revokeOwner()
+  await control.requestPairing(42,42)
+  const replacement=await control.approveOwner(42)
+  assert.equal(owner.pairedAt,replacement.pairedAt)
+  assert.equal(sameOwner(owner,replacement),false,'same timestamp must not revive old authority')
+  await assert.rejects(channel.bindings.authenticate(token),/Unauthorized/)
+  await assert.rejects(channel.bindings.authorize(legacy),/revoked/)
+})
+
+for (const mode of ['owner','web','telegram']) test(`${mode} revocation stops its already running worker`,async t=>{
+  const root=await mkdtemp(join(tmpdir(),'ez-owner-stop-'))
+  const control=new ControlStore(root,60000),runs=new RunStore(root),scheduler=new Scheduler(root)
+  await control.requestPairing(42,42)
+  const owner=await control.approveOwner(42)
+  const relay=createRelay(loadConfig({TELEGRAM_BOT_TOKEN:'synthetic',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'}),async()=>({child:spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'pipe'}),stdout:'',cleanup:async()=>{}}))
+  relay.bot.api.config.use(async()=>({ok:true,result:true}) as never)
+  t.after(async()=>{await relay.stop();await rm(root,{recursive:true,force:true})})
+  if (mode==='telegram') {
+    await runs.create({id:'r_telegram',chatId:42,telegramUserId:42,ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Wait'],execution:await control.captureChoice(initialPreset('grok'))})
+  } else {
+    const binding=(await relay.applicationChannel.bindings.register('web',secret(),owner))!
+    await scheduler.save({id:'wait',name:'Wait',text:'Wait',enabled:true,trigger:{at:new Date(Date.now()+1000).toISOString()},owner,delivery:{bindingId:binding.bindingId,scope:'main'},execution:await control.captureChoice(initialPreset('grok'))})
+    await scheduler.tick(owner,runs,Date.now()+2000)
+  }
+  await relay.drainSources()
+  await waitFor(async()=>(await runs.list()).some(r=>r.status==='running'))
+  if(mode==='owner')await control.revokeOwner()
+  else if(mode==='web')await relay.applicationChannel.bindings.register('web',null,owner)
+  else await control.unlinkTelegram()
+  await relay.drainSources()
+  await waitFor(async()=>(await runs.list()).every(r=>r.status==='cancelled'))
+})

package/test/client-defaults.test.ts

@@ -70,7 +70,7 @@ test('status projects the native client default without pinning the seed', () =>
   assert.deepEqual(statusPreset({ ...initial, id: 'detected_empty' }, [discovered]), discovered)
   const explicit = { ...discovered, id: 'saved', model: 'chosen-codex', effort: 'high' }
   assert.equal(statusPreset(explicit, [discovered]), explicit)
-  assert.equal(statusPreset(initialPreset('codex-gui'), [{ ...discovered, cli: 'codex-gui' }]).model, 'gpt-5.6-luna')
+  assert.equal(statusPreset(initialPreset('codex-gui'), [{ ...discovered, cli: 'codex-gui' }]).model, discovered.model)
 })
 
 test('seed uses the configured executor; repeated refresh preserves current/default and queued snapshots', async () => {

package/test/codex-session.test.ts

@@ -3,7 +3,8 @@ import assert from 'node:assert/strict'
 import { spawn } from 'node:child_process'
 import { runCodexSession } from '../src/codex-session.js'
 
-for(const mode of ['goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal'])test(`native Codex session: ${mode}`,async()=>{
+for(const mode of ['external','goal','long-goal','plain','tool-goal','blocked','disconnect','approval','late-limit','early-limit','early-clear','missing-goal'])test(`native Codex session: ${mode}`,async()=>{
+  const prompt=mode==='long-goal'?'/goal Complete the research.\n'+'Full workflow context.\n'.repeat(400)+'FINAL_COMPLETION_CRITERION':'test'
   const requests:string[]=[],output:string[]=[]
   const program=`
 const rl=require('readline').createInterface({input:process.stdin});
@@ -15,13 +16,15 @@ let reads=0;
 rl.on('line',line=>{const q=JSON.parse(line);if(!q.id)return;
 if(q.method==='initialize')return send({id:q.id,result:{}});
 if(q.method==='thread/start')return send({id:q.id,result:{thread:{id:'native-test'}}});
-if(q.method==='thread/goal/set'||q.method==='turn/start'){
+if(q.method==='thread/goal/set')return send({id:q.id,error:{message:'Transport must not create goals'}});
+if(q.method==='turn/start'){
  send({id:q.id,result:{turn:{id:'one'}}});
  if(${JSON.stringify(mode)}==='early-limit')return event('thread/goal/updated',{goal:{status:'usageLimited'}});
- if(${JSON.stringify(mode)}==='early-clear')return event('thread/goal/cleared',{});
+ if(${JSON.stringify(mode)}==='early-clear'){event('thread/goal/updated',{goal:{status:'active'}});return event('thread/goal/cleared',{});}
  send({method:'turn/completed',params:{threadId:'unrelated',turn:{id:'unrelated',status:'completed'}}});start('one');
  if(${JSON.stringify(mode)}==='disconnect')return process.exit(0);
  if(${JSON.stringify(mode)}==='approval')return send({id:999,method:'item/commandExecution/requestApproval',params:{threadId:'native-test'}});
+ if(${JSON.stringify(mode)}==='missing-goal')event('thread/goal/updated',{goal:{status:'active'}});
  end('one');return;
 }
 if(q.method==='thread/goal/get'){
@@ -33,19 +36,24 @@ if(q.method==='thread/goal/get'){
  }
 }
 });setInterval(()=>{},1000);`
-  let threadConfig:any
+  let threadConfig:any,threadSandbox:string,turnPolicy:any,turnPrompt:string|undefined
   const launch=()=>{
     const child=spawn(process.execPath,['-e',program],{stdio:['pipe','pipe','pipe'],detached:process.platform!=='win32'})
     const write=child.stdin.write.bind(child.stdin)
-    child.stdin.write=((chunk:any,...args:any[])=>{try{requests.push(JSON.parse(String(chunk)).method);if(JSON.parse(String(chunk)).method==='thread/start')threadConfig=JSON.parse(String(chunk)).params.config}catch{};return (write as any)(chunk,...args)}) as typeof child.stdin.write
+    child.stdin.write=((chunk:any,...args:any[])=>{try{const q=JSON.parse(String(chunk));if(q.method==='turn/start'){turnPrompt=q.params.input[0].text;turnPolicy=q.params.sandboxPolicy}requests.push(q.method);if(q.method==='thread/start'){threadConfig=q.params.config;threadSandbox=q.params.sandbox}}catch{};return (write as any)(chunk,...args)}) as typeof child.stdin.write
     return child
   }
-  const plain=['plain','tool-goal'].includes(mode)
-  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',prompt:'test',goal:!plain},{launch,emit:line=>output.push(line)})
+  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',prompt,
+    ...(mode==='external'?{codexSandbox:'external' as const}:{})},{launch,emit:line=>output.push(line)})
+  assert.equal(threadSandbox!,mode==='external'?'danger-full-access':'workspace-write')
+  assert.deepEqual(turnPolicy,mode==='external'?{type:'externalSandbox',networkAccess:'enabled'}:undefined)
+  assert.deepEqual(threadConfig.project_root_markers,['AGENTS.md','.git'])
+  assert.equal(turnPrompt,prompt,'full input reaches the engine without goal admission or truncation')
+  if(mode==='long-goal')assert.ok(prompt.length>4000)
   assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/canonical'))
-  assert.equal(result,['plain','goal','tool-goal'].includes(mode)?0:1)
-  assert.equal(requests.filter(x=>x==='turn/start').length,plain?1:0,'transport must not send goal continuation prompts')
-  assert.equal(requests.filter(x=>x==='thread/goal/set').length,plain?0:1)
+  assert.equal(result,['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
+  assert.equal(requests.filter(x=>x==='turn/start').length,1,'transport must not send goal continuation prompts')
+  assert.equal(requests.filter(x=>x==='thread/goal/set').length,0)
   if(mode==='goal')assert.equal(requests.filter(x=>x==='thread/goal/get').length,2,'must wait for the second turn to complete')
   assert.equal(JSON.parse(output[0]).thread_id,'native-test')
 })

package/test/config.test.ts

@@ -32,7 +32,7 @@ test('loads executor CLI configuration with agy fallback', () => {
 })
 
 test('Codex context limit is configurable and rejects invalid values', () => {
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexAutoCompactTokens,64000)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexAutoCompactTokens,undefined)
   assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
   for(const value of ['0','-1','bad','1.5','9007199254740992'])
     assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
@@ -59,3 +59,18 @@ test('PagerDuty Stocks monitoring requires a routing key and validates its targe
   assert.equal(config.pagerDutyPollMs, 45_000)
   assert.equal(config.pagerDutyFailureThreshold, 4)
 })
+
+test('external Codex isolation requires explicit native local deployment', () => {
+  const env = {EZ_TELEGRAM_ENABLED:'false', EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
+  assert.equal(loadConfig(env).codexSandbox, 'external')
+  assert.equal(loadConfig({...env,EZ_TELEGRAM_ENABLED:'true',TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, 'external')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, undefined)
+  for (const override of [{EZ_EXECUTOR_TRANSPORT:'host'}, {EZ_EXECUTOR_TRANSPORT:''}, {EZ_CODEX_SANDBOX:'danger-full-access'}])
+    assert.throws(() => loadConfig({...env,...override}), /sandbox|SANDBOX/)
+})
+
+test('optional web launcher preserves reserved commands and accepts only HTTPS without secrets', () => {
+  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
+  assert.deepEqual(config({command:'voice',label:'Voice',url:'https://voice.example/'}).webLauncher,{command:'voice',label:'Voice',url:'https://voice.example/'})
+  for (const value of [{command:'stop',label:'Voice',url:'https://voice.example/'},{command:'voice',label:'Voice',url:'http://voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/#secret'},{command:'voice',label:'Voice',url:'https://user:pass@voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/?token=secret'}]) assert.throws(()=>config(value))
+})

package/test/connection-artifacts.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {commandArtifact} from '../src/plugins/connection-artifacts.mjs';
+
+test('CLI attachment output preserves exact binary bytes and excludes them from model output',async()=>{
+  const root=await fs.mkdtemp(path.join(os.tmpdir(),'voice-artifact-'));
+  try {
+    const bytes=Buffer.from([0,255,128,10,13,42]);
+    const result=await commandArtifact(root,'source.pdf',async({onStdout})=>{onStdout(bytes.subarray(0,3));onStdout(bytes.subarray(3));return {code:0,stdout:'',stderr:''};});
+    assert.equal(result.stdout,'');assert.equal(result.artifact.bytes,bytes.length);
+    assert.equal(result.artifact.sha256,createHash('sha256').update(bytes).digest('hex'));
+    assert.deepEqual(await fs.readFile(path.join(root,result.artifact.path)),bytes);
+    assert.equal((await fs.stat(path.join(root,result.artifact.path))).mode&0o777,0o600);
+  }finally{await fs.rm(root,{recursive:true,force:true});}
+});
+test('artifact output rejects escaping paths, symlinks, overflow and cancelled or failed writes',async()=>{
+  const root=await fs.mkdtemp(path.join(os.tmpdir(),'voice-artifact-')),outside=await fs.mkdtemp(path.join(os.tmpdir(),'voice-outside-'));
+  const ok=async()=>({code:0,stdout:'',stderr:''});
+  try {
+    for(const name of ['../secret','/secret','.env','x/y'])await assert.rejects(commandArtifact(root,name,ok),/filename/);
+    await fs.symlink(outside,path.join(root,'artifacts'));await assert.rejects(commandArtifact(root,'x',ok),/symlink/);await fs.unlink(path.join(root,'artifacts'));
+    await assert.rejects(commandArtifact(root,'x',async({onStdout})=>{onStdout(Buffer.alloc(20*1024*1024+1));return ok();}),/20 MiB/);
+    const abort=new AbortController();abort.abort();await assert.rejects(commandArtifact(root,'x',ok,{signal:abort.signal}));
+    assert.equal((await commandArtifact(root,'x',async()=>({code:1,stdout:'',stderr:'failed'}))).code,1);
+    assert.deepEqual(await fs.readdir(path.join(root,'artifacts')),[]);
+    assert.deepEqual(await fs.readdir(outside),[]);
+  }finally{await fs.rm(root,{recursive:true,force:true});await fs.rm(outside,{recursive:true,force:true});}
+});

package/test/conversation-menu.test.ts

@@ -0,0 +1,67 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { Context, InlineKeyboard } from 'grammy'
+import { ControlStore } from '../src/control-state.js'
+import { RunStore } from '../src/runs.js'
+import { createConversationMenu } from '../src/conversation-menu.js'
+import { initialPreset } from '../src/ai.js'
+
+test('empty placeholders stay out of history and Back edits one panel without creating sessions', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-empty-chats-'))
+  try {
+    const control = new ControlStore(dir, 1000)
+    const runs = new RunStore(dir)
+    const choice = await control.captureChoice(initialPreset('grok'), 'Client launch')
+    await control.markSessionStarted(choice.sessionId)
+    for (let n = 0; n < 3; n++) await control.resetSession()
+    const menu = createConversationMenu(control, runs)
+    let sent = 0, edited = 0, text = '', keyboard: InlineKeyboard
+    const ctx = {
+      callbackQuery: undefined,
+      reply: async (value: string, options: {reply_markup: InlineKeyboard}) => { sent++; text = value; keyboard = options.reply_markup },
+      editMessageText: async (value: string, options: {reply_markup: InlineKeyboard}) => { edited++; text = value; keyboard = options.reply_markup },
+      answerCallbackQuery: async () => {},
+    }
+    await menu.list(ctx as unknown as Context)
+    assert.equal(sent, 1)
+    assert.deepEqual(keyboard!.inline_keyboard.flat().filter(b => 'callback_data' in b && b.callback_data.startsWith('chat:open:')).map(b => b.text), ['Client launch'])
+    assert.equal(keyboard!.inline_keyboard.flat().filter(b => b.text.includes('New conversation')).length, 1)
+    assert.ok(keyboard!.inline_keyboard.every(row => row.length))
+    const click = async (data: string) => {
+      await menu.handle({...ctx, callbackQuery:{data, message:{message_id:1}}} as unknown as Context)
+    }
+    await click(`chat:open:${choice.sessionId}`)
+    const before = await control.status()
+    for (let n = 0; n < 5; n++) { await click('chat:list:0:0'); await click(`chat:open:${choice.sessionId}`) }
+    assert.deepEqual(await control.status(), before)
+    assert.equal(sent, 1)
+    assert.equal(edited, 11)
+    await control.archiveSession(choice.sessionId, true)
+    await click('chat:list:0:0')
+    assert.match(text, /No active conversations/)
+    assert.equal(keyboard!.inline_keyboard.flat().filter(b => 'callback_data' in b && b.callback_data.startsWith('chat:open:')).length, 0)
+    // No underlying bindings were deleted: previously accepted work can still resolve them.
+    assert.equal((await control.listSessions()).length, 4)
+    assert.equal((await control.executionSession(choice)).sessionId, choice.sessionId)
+    await click('chat:list:1:0')
+    assert.ok(keyboard!.inline_keyboard.flat().some(b => b.text === 'Client launch'))
+  } finally { await rm(dir, {recursive:true, force:true}) }
+})
+
+test('an identical Back edit does not send another message', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-same-menu-'))
+  try {
+    let sent = 0
+    const menu = createConversationMenu(new ControlStore(dir,1000),new RunStore(dir))
+    await menu.handle({
+      callbackQuery:{data:'chat:list:0:0',message:{message_id:1}},
+      answerCallbackQuery:async()=>{},
+      editMessageText:async()=>{throw {description:'Bad Request: message is not modified'}},
+      reply:async()=>{sent++},
+    } as unknown as Context)
+    assert.equal(sent,0)
+  } finally { await rm(dir,{recursive:true,force:true}) }
+})