@jc_stack/ez-agents 0.1.0-beta.26 → 0.1.0-beta.28

package/test/conversations.test.ts

@@ -0,0 +1,84 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, readFile, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { ControlStore, sessionTitle } from '../src/control-state.js'
+import { initialPreset } from '../src/ai.js'
+import { EXECUTOR_REGISTRY } from '../src/executor.js'
+
+const fixture = async (work: (store: ControlStore, dir: string) => Promise<void>) => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-conversations-'))
+  try { await work(new ControlStore(dir, 1000), dir) }
+  finally { await rm(dir, { recursive: true, force: true }) }
+}
+
+test('switching after restart restores native context and model while queued choices stay pinned', async () => fixture(async (store, dir) => {
+  const first = await store.captureChoice(initialPreset('codex'), 'Client launch')
+  await store.saveNativeSession(first.sessionId, 'native_first')
+  await store.savePreset({ id: 'second', name: 'Second', cli: 'grok', model: 'fixture' })
+  await store.selectPreset('second', first.sessionId, true)
+  const second = await store.captureChoice(initialPreset('grok'), 'Holiday planning')
+  await store.markSessionStarted(second.sessionId)
+  const restarted = new ControlStore(dir, 1000)
+  await restarted.switchSession(first.sessionId)
+  assert.deepEqual(await restarted.captureChoice(initialPreset('grok')), first)
+  const session = await restarted.executionSession(first)
+  const args = EXECUTOR_REGISTRY.codex.buildArgs({ workspace: dir, isResume: session.hasStarted, sessionId: session.nativeSessionId }, '', '')
+  assert.equal(args[args.indexOf('resume') + 1], 'native_first')
+  assert.equal((await restarted.executionSession(second)).sessionId, second.sessionId)
+  await restarted.switchSession(second.sessionId)
+  assert.deepEqual(await restarted.captureChoice(initialPreset('codex')), second)
+  assert.equal((await restarted.listSessions()).length, 2)
+}))
+
+test('archive hides without deleting, late completions keep their binding, restore survives restart', async () => fixture(async (store, dir) => {
+  const first = await store.captureChoice(initialPreset('codex'), 'Topic one')
+  await store.archiveSession(first.sessionId, true)
+  assert.equal(await store.getActiveSession(), null)
+  await store.saveNativeSession(first.sessionId, 'native_late')
+  const second = await store.captureChoice(initialPreset('codex'), 'Topic two')
+  assert.notEqual(second.sessionId, first.sessionId)
+  await assert.rejects(store.switchSession(first.sessionId), /unavailable/)
+  const restarted = new ControlStore(dir, 1000)
+  assert.equal((await restarted.executionSession(first)).nativeSessionId, 'native_late')
+  await restarted.archiveSession(first.sessionId, false)
+  await restarted.switchSession(first.sessionId)
+  assert.equal((await restarted.executionSession(first)).nativeSessionId, 'native_late')
+  assert.equal((await restarted.listSessions()).length, 2)
+}))
+
+test('titles are bounded and rename is durable; malformed IDs and unsupported metadata fail closed', async () => fixture(async (store, dir) => {
+  const first = await store.captureChoice(initialPreset('grok'), '  Topic\n one ')
+  assert.equal(sessionTitle((await store.getActiveSession())!), 'Topic one')
+  await store.captureChoice(initialPreset('grok'), 'second message')
+  assert.equal(sessionTitle((await store.getActiveSession())!), 'Topic one')
+  await store.renameSession('<Client & launch>')
+  assert.equal(sessionTitle((await new ControlStore(dir, 1000).getActiveSession())!), '<Client & launch>')
+  await assert.rejects(store.renameSession('x'.repeat(81)), /1–80/)
+  await assert.rejects(store.switchSession('../escape'), /unavailable/)
+  await assert.rejects(store.archiveSession('../escape', true), /unavailable/)
+  assert.equal((await store.getActiveSession())!.sessionId, first.sessionId)
+  const file = join(dir, 'control-state.json')
+  const state = JSON.parse(await readFile(file, 'utf8'))
+  state.activeSession.preset.cli = 'sh'
+  await writeFile(file, JSON.stringify(state))
+  await assert.rejects(store.listSessions(), /unsupported shape/)
+}))
+
+test('legacy sessions retain IDs; unbound and latest-only engines cannot resume a different context', async () => fixture(async (store, dir) => {
+  const legacy = await store.ensureActiveSession()
+  await store.markSessionStarted(legacy.sessionId)
+  await store.captureChoice(initialPreset('grok'))
+  await store.resetSession()
+  await assert.rejects(store.switchSession(legacy.sessionId), /binding/)
+  assert.match(sessionTitle((await store.listSessions()).find(s => s.sessionId === legacy.sessionId)!), /Conversation /)
+  await store.archiveSession(legacy.sessionId, true)
+  const agy = { id: 'agy-test', name: 'AGY', cli: 'agy' }
+  await store.savePreset(agy)
+  await store.selectPreset(agy.id, (await store.getActiveSession())!.sessionId, true)
+  const old = await store.captureChoice(agy)
+  await store.markSessionStarted(old.sessionId)
+  await store.resetSession()
+  await assert.rejects(store.switchSession(old.sessionId), /latest conversation/)
+}))

package/test/desktop-bridge.test.ts

@@ -5,7 +5,7 @@ import { mkdtemp, rm, mkdir, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { EventEmitter } from 'node:events'
-import { DESKTOP_UNAVAILABLE, desktopJobPrompt, runDesktopTurn, type DesktopClient } from '../src/desktop-bridge.js'
+import { DESKTOP_UNAVAILABLE, runDesktopTurn, type DesktopClient } from '../src/desktop-bridge.js'
 import { executorKey, nativeSessionId, startExecutorJob } from '../src/executor.js'
 import { initialPreset, isPreset, readModels } from '../src/ai.js'
 
@@ -40,16 +40,6 @@ const fakeClient = (script: Array<Record<string, unknown>>): DesktopClient & { c
   return client
 }
 
-test('desktop prompt carries run identity and tool paths, never a bot token', () => {
-  const prompt = desktopJobPrompt('r_gui', ['hello'], undefined, '/tmp/bin', '/tmp/control')
-  assert.match(prompt, /EZ_RUN_ID=r_gui/)
-  assert.match(prompt, /EZ_CONTROL_DIR=\/tmp\/control/)
-  assert.match(prompt, /PATH=\/tmp\/bin:\$PATH/)
-  assert.match(prompt, /ezenciel-agents-message/)
-  assert.ok(!prompt.includes('TELEGRAM_BOT_TOKEN'))
-  assert.ok(!prompt.includes('token'))
-})
-
 test('codex-gui is a distinct preset and catalog entry', async () => {
   assert.equal(executorKey('codex-gui'), 'codex-gui')
   assert.equal(initialPreset('codex-gui').cli, 'codex-gui')
@@ -176,3 +166,19 @@ test('unlimited desktop waits reject on disconnect and do not miss an early comp
  assert.equal((await early.wait(m=>m.method==='turn/completed',0)).method,'turn/completed')
  early.close()
 })
+
+test('desktop fresh and resumed turns bind current run environment without prompt prose',async()=>{
+ for(const isResume of [false,true]) {
+  const text=' /goal audit list of files and give me a simple list with filenames\n'
+  const client=fakeClient([{result:{}},{result:{thread:{id:'native-env'}}},...(!isResume?[{result:{}}]:[]),{result:{turn:{id:'env-turn'}},notify:[{method:'turn/completed',params:{turn:{id:'env-turn',status:'completed'}}}]}])
+  const original=client.request;let nativeConfig:any,submitted:any
+  client.request=async(method,params)=>{if(method===`thread/${isResume?'resume':'start'}`)nativeConfig=(params as any).config;if(method==='turn/start')submitted=params;return original(method,params)}
+  assert.equal(await runDesktopTurn({workspace:'/mind',controlDir:'/control',binDir:'/bin',runId:'r_current',repairEnabled:false,prompt:text,isResume,sessionId:'native-env'},{connect:async()=>client,emit:()=>{}}),0)
+  assert.deepEqual(submitted.input,[{type:'text',text}])
+  assert.equal(nativeConfig['shell_environment_policy.inherit'],'none')
+  assert.equal(nativeConfig['shell_environment_policy.set'].EZ_RUN_ID,'r_current')
+  assert.equal(nativeConfig['shell_environment_policy.set'].EZ_CONTROL_DIR,'/control')
+  assert.equal(nativeConfig['shell_environment_policy.set'].EZ_REPAIR_ENABLED,'false')
+  assert.equal(nativeConfig['shell_environment_policy.set'].TELEGRAM_BOT_TOKEN,undefined)
+ }
+})

package/test/engine-handoff.test.ts

@@ -0,0 +1,73 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { startExecutorJob } from '../src/executor.js'
+import { ownerRun } from './helpers/owner-run.js'
+import { initializeWorkspace } from '../src/workspace.js'
+import { RunStore } from '../src/runs.js'
+
+// Capture the actual subprocess input, not a prompt-building helper.
+test('owner, resumed and native scheduled subprocesses receive literal input and isolated run bindings', async t => {
+ const root=await mkdtemp(path.join(tmpdir(),'ez-literal-'))
+ t.after(()=>rm(root,{recursive:true,force:true}))
+ const bin=path.join(root,'bin'),workspace=path.join(root,'mind'),controlDir=path.join(root,'control')
+ await mkdir(bin);await initializeWorkspace(workspace)
+ const fixture=`#!${process.execPath}
+const fs=require('fs'), args=process.argv.slice(2);
+const capture=prompt=>fs.writeFileSync('capture.json',JSON.stringify({prompt,args,env:{run:process.env.EZ_RUN_ID,control:process.env.EZ_CONTROL_DIR,repair:process.env.EZ_REPAIR_ENABLED,secret:process.env.TELEGRAM_BOT_TOKEN}}));
+if(args[0]==='app-server'){
+ const send=x=>process.stdout.write(JSON.stringify(x)+'\\n');
+ require('readline').createInterface({input:process.stdin}).on('line',line=>{
+ const q=JSON.parse(line);if(!q.id)return;
+ if(q.method==='initialize')send({id:q.id,result:{}});
+ if(q.method==='thread/start')send({id:q.id,result:{thread:{id:'fixture-thread'}}});
+ if(q.method==='turn/start'){
+  capture(q.params.input[0].text);send({id:q.id,result:{turn:{id:'one'}}});
+  send({method:'turn/started',params:{threadId:'fixture-thread',turn:{id:'one'}}});
+  send({method:'turn/completed',params:{threadId:'fixture-thread',turn:{id:'one',status:'completed'}}});
+ }
+ if(q.method==='thread/goal/get')send({id:q.id,result:{goal:null}});
+ });
+}else capture(args.includes('--prompt-file')?fs.readFileSync(args[args.indexOf('--prompt-file')+1],'utf8'):args.some(a=>a.startsWith('--print='))?args.find(a=>a.startsWith('--print=')).slice(8):args.includes('--print')||(args[0]==='exec'&&args.at(-1)==='-')?fs.readFileSync(0,'utf8'):args.at(-1));
+`
+ for(const name of ['codex','grok','agy','claude','opencode'])await writeFile(path.join(bin,name),fixture,{mode:0o700})
+ const previous={PATH:process.env.PATH,TELEGRAM_BOT_TOKEN:process.env.TELEGRAM_BOT_TOKEN,EZ_EXECUTOR_TRANSPORT:process.env.EZ_EXECUTOR_TRANSPORT}
+ process.env.PATH=bin+path.delimiter+process.env.PATH;process.env.TELEGRAM_BOT_TOKEN='do-not-inherit';delete process.env.EZ_EXECUTOR_TRANSPORT
+ try {
+  for(const cli of ['codex','grok','agy','claude','opencode'])for(const isResume of [false,true])for(const text of ['  /goal audit list of files and give me a simple list with filenames\n','--help','-','resume']) {
+   const runId='r_'+cli+'_'+String(isResume)+'_'+Buffer.from(text).toString('hex').slice(0,20)
+   await ownerRun(controlDir,runId)
+   const job=await startExecutorJob([text],{workspace,controlDir,binDir:bin,cli,runId,timeoutMs:5000,isResume,sessionId:'native-existing',repairEnabled:false})
+   const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup();assert.equal(code,0)
+   const captured=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
+   assert.equal(captured.prompt,text)
+   assert.deepEqual(captured.env,{run:runId,control:controlDir,repair:'false'})
+   if(cli==='codex')assert.equal(captured.args.at(-1),'-')
+   if(['codex','claude'].includes(cli))assert.ok(!captured.args.includes('--help'))
+   if(cli==='opencode')assert.equal(captured.args.at(-2),'--')
+   if(cli==='agy')assert.ok(captured.args.includes('--print='+text))
+   if(cli==='claude')assert.ok(!captured.args.includes('--append-system-prompt-file'))
+  }
+  for(const [runId,texts] of [['r_schedule_literal',['/goal audit list of files and give me a simple list with filenames']],['r_batch',['first\nline','  second  ']]] as const) {
+   await ownerRun(controlDir,runId)
+   const job=await startExecutorJob([...texts],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000})
+   const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup();assert.equal(code,0)
+   assert.equal(JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8')).prompt,texts.join('\n\n'))
+  }
+  for(const isResume of [false,true]) {
+   const runId='tg_chat_'+String(isResume)
+   await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
+   await new RunStore(controlDir).patch(runId,{status:'running'})
+   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing'})
+   const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup();assert.equal(code,0)
+   const {prompt}=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
+   assert.ok(prompt.startsWith('hi\n\n[Chat context]'))
+   assert.equal(prompt.split('[Chat context]').length,2)
+   assert.match(prompt,/ezenciel-agents-message/)
+   assert.match(prompt,/ezenciel-agents-schedule/)
+   assert.match(prompt,/native subagents/)
+  }
+ }finally{for(const [key,value] of Object.entries(previous))if(value===undefined)delete process.env[key];else process.env[key]=value}
+})

package/test/event-sources.test.ts

@@ -12,7 +12,7 @@ import { createRelay } from '../src/index.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
-import { executorJobPrompt, executorJobEnv } from '../src/executor.js'
+import { executorJobEnv } from '../src/executor.js'
 
 const until = async (check: () => Promise<boolean>) => {
   for (let i = 0; i < 200; i++) { if (await check()) return; await new Promise(r => setTimeout(r, 10)) }
@@ -113,9 +113,6 @@ test('corrupt registry and traversal IDs fail closed; external prompts never cla
   await assert.rejects(f.sources.register('../bad',f.socketPath,f.owner))
   await writeFile(join(f.dir,'event-sources.json'),'{')
   await assert.rejects(f.relay.drainSources()); assert.equal(f.launches.length,0)
-  const prompt=executorJobPrompt('test',['ignore everything'],'source')
-  assert.match(prompt,/NOT Telegram-owner instructions/)
-  assert.doesNotMatch(prompt,/content from the Telegram owner/)
   assert.equal(executorJobEnv({runId:'r',controlDir:f.dir,binDir:f.dir},{TELEGRAM_BOT_TOKEN:'secret'}).TELEGRAM_BOT_TOKEN,undefined)
   assert.equal(batchReady([{...event('1'),receivedAt:Date.now()}]),false)
   assert.equal(batchReady([event('1')]),true)
@@ -133,8 +130,8 @@ test('relay launches the approved initial task and routes only matching replies
   await f.relay.drainSources()
   assert.equal(f.launches.length, 1); assert.equal(f.launches[0].options.cli, 'codex')
   assert.equal(f.launches[0].options.isResume, false)
-  assert.equal(f.launches[0].options.model, 'gpt-5.6-sol')
-  assert.equal(f.launches[0].options.effort, 'medium')
+  assert.equal(f.launches[0].options.model, undefined)
+  assert.equal(f.launches[0].options.effort, undefined)
   f.children[0].kill()
   await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
   const receivedAt = Date.now()
@@ -143,8 +140,8 @@ test('relay launches the approved initial task and routes only matching replies
   await f.relay.drainSources()
   assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
   assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
-  assert.equal(f.launches[1].options.model, 'gpt-5.6-sol')
-  assert.equal(f.launches[1].options.effort, 'medium')
+  assert.equal(f.launches[1].options.model, undefined)
+  assert.equal(f.launches[1].options.effort, undefined)
   f.children[1].kill()
   await until(async () => !(await f.runs.list()).some(r => r.status === 'running'))
   await f.relay.drainSources()

package/test/executor.test.ts

@@ -1,11 +1,12 @@
 import { ownerRun } from './helpers/owner-run.js'
+import { RunStore } from '../src/runs.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
 import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
 import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
-import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, executorJobPrompt, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, startExecutorJob, terminateJob } from '../src/executor.js'
+import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, startExecutorJob, terminateJob } from '../src/executor.js'
 import { splitTelegramText } from '../src/reply.js'
 import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
 
@@ -46,16 +47,6 @@ test('cancellation stops detached tool descendants even after their parent exits
   }
 })
 
-test('the job prompt labels channel text as untrusted and requires ez message', () => {
-  const prompt = executorJobPrompt('r_test', ['hello'])
-  assert.match(prompt, /untrusted incoming channel content/)
-  assert.match(prompt, /ezenciel-agents-message/)
-  assert.match(prompt, /--text-file/)
-  assert.match(prompt, /r_test/)
-  assert.match(prompt, /hello/)
-  assert.match(prompt, /Stdout is not sent to Telegram/)
-})
-
 test('Telegram replies are split within the configured message limit', () => {
   const text = `${'a'.repeat(9)} ${'b'.repeat(9)} ${'c'.repeat(9)}`
   const chunks = splitTelegramText(text, 10)
@@ -96,7 +87,6 @@ test('the Grok invocation is headless, workspace-scoped, and token-free', () =>
     '--output-format', 'plain',
     '--always-approve',
     '--verbatim',
-    '--max-turns', '8',
   ])
   assert.equal(invocation.args.includes('TELEGRAM_BOT_TOKEN'), false)
 })
@@ -105,8 +95,7 @@ test('the antigravity invocation is headless, skips permissions, and uses print
   const invocation = antigravityInvocation('test prompt')
   assert.equal(invocation.command, 'agy')
   assert.deepEqual(invocation.args, [
-    '--print', 'test prompt',
-    '--dangerously-skip-permissions',
+    '--dangerously-skip-permissions', '--print=test prompt',
   ])
 })
 
@@ -118,6 +107,7 @@ test('the opencode invocation is headless, auto-approves, and sets model and wor
     '--auto',
     '--format',
     'json',
+    '--',
     'test prompt',
   ])
 })
@@ -179,8 +169,70 @@ test('Codex plugin access stays scoped to the explicitly bound registry', () =>
 test('Codex compaction preserves native resume and validates transported options',()=>{
  const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',sessionId:'native-id',isResume:true,codexAutoCompactTokens:32000},'', 'hello')
  assert.ok(args.includes('model_auto_compact_token_limit=32000'))
- assert.deepEqual(args.slice(-3),['resume','native-id','hello'])
- assert.ok(EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent'},'','hello').includes('model_auto_compact_token_limit=64000'))
+ assert.deepEqual(args.slice(-3),['resume','native-id','-'])
+ assert.ok(!EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent'},'','hello').some(a=>a.includes('model_auto_compact_token_limit')))
  for(const value of [0,-1,NaN,1.5]) assert.throws(()=>EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',codexAutoCompactTokens:value},'','hello'),/compaction/)
  assert.ok(!EXECUTOR_REGISTRY.claude.buildArgs({workspace:'/agent',codexAutoCompactTokens:32000},'','hello').some(arg=>arg.includes('compact')))
 })
+
+
+test('adapters do not append instruction files or impose a workflow turn budget', () => {
+ const opts={workspace:'/agent/work/tasks/example'}
+ assert.ok(!EXECUTOR_REGISTRY.claude.buildArgs(opts,'','literal').includes('--append-system-prompt-file'))
+ assert.ok(!EXECUTOR_REGISTRY.grok.buildArgs(opts,'/tmp/prompt','literal').includes('--max-turns'))
+})
+
+test('Codex external isolation changes only explicit sandbox argv and never enters child environment', () => {
+  const args = EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',codexSandbox:'external',sessionId:'native-id',isResume:true},'', 'hello')
+  assert.equal(args[args.indexOf('--sandbox')+1], 'danger-full-access')
+  assert.ok(args.includes('native-id'))
+  assert.equal(executorEnvironment({EZ_CODEX_SANDBOX:'external'}).EZ_CODEX_SANDBOX, undefined)
+})
+
+test('external Codex isolation cannot launch host runs', async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-external-sandbox-'))
+  t.after(() => rm(root,{recursive:true,force:true}))
+  await ownerRun(root,'r_sandbox')
+  const previous = {transport:process.env.EZ_EXECUTOR_TRANSPORT,telegram:process.env.EZ_TELEGRAM_ENABLED}
+  try {
+    process.env.EZ_TELEGRAM_ENABLED='false'
+    for (const transport of ['host','']) {
+      process.env.EZ_EXECUTOR_TRANSPORT=transport
+      await assert.rejects(startExecutorJob(['Hello'],{workspace:root,controlDir:root,binDir:root,runId:'r_sandbox',timeoutMs:0,cli:'codex',codexSandbox:'external'}), /owner-authorized native local/)
+    }
+  } finally {
+    for (const [key,value] of [['EZ_EXECUTOR_TRANSPORT',previous.transport],['EZ_TELEGRAM_ENABLED',previous.telegram]]) {
+      if (value === undefined) delete process.env[key!]; else process.env[key!]=value
+    }
+  }
+})
+
+test('external local owner chat preserves authorization and literal input', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-external-owner-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const prior={path:process.env.PATH,transport:process.env.EZ_EXECUTOR_TRANSPORT}
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'codex'),`#!/usr/bin/env node\nconst fs=require('fs');let text='';process.stdin.on('data',b=>text+=b);process.stdin.on('end',()=>fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),text,secret:process.env.TELEGRAM_BOT_TOKEN})));`,{mode:0o755})
+  await ownerRun(root,'r_owner_external')
+  const opts={workspace:root,controlDir:root,binDir:bin,runId:'r_owner_external',timeoutMs:0,cli:'codex',codexSandbox:'external' as const}
+  try {
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.EZ_EXECUTOR_TRANSPORT='local'
+    const job=await startExecutorJob(['  literal /goal request\n'],opts)
+    const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup()
+    assert.equal(code,0)
+    const observed=JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+    assert.equal(observed.text,'  literal /goal request\n')
+    assert.equal(observed.args[observed.args.indexOf('--sandbox')+1],'danger-full-access')
+    assert.equal(observed.secret,undefined)
+    const runs=new RunStore(root)
+    await runs.create({id:'r_foreign',chatId:999,telegramUserId:999,texts:['no']})
+    await runs.patch('r_foreign',{status:'running'})
+    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_foreign'}),/blocked|owner/i)
+    await runs.create({id:'r_restricted',chatId:101,telegramUserId:101,texts:['no'],taskId:'task_'+'a'.repeat(32)})
+    await runs.patch('r_restricted',{status:'running'})
+    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_restricted'}),/owner-authorized native local/)
+  } finally {
+    if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
+    if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
+  }
+})

package/test/failure.test.ts

@@ -198,6 +198,8 @@ for (const cleanupFails of [false,true]) test(`polling conflict preserves work u
   let finished=false
   const start=relay.start().finally(()=>{finished=true})
   await until(async()=>polls===1)
+  if(!cleanupFails)await new Promise(resolve=>setTimeout(resolve,5200))
+  assert.equal(polls,1,'permanent conflict must not restart after the old five-second retry interval')
   assert.equal(sourceStops,0,'a polling conflict must not stop the relay')
   assert.equal((await runs.get('tg_92'))?.status,'running')
   assert.ok(child && child.exitCode===null && child.signalCode===null)
@@ -280,3 +282,65 @@ test('group members can inspect failures and wake review without exposing other
  assert.equal((await runs.list()).filter(r=>r.scheduled).length,1)
  await assert.rejects(exec(process.execPath,[bin,'run','tg_2'],{env}),/Unknown owner/)
 })
+
+for (const failure of [400,401,503,'programming'] as const) test(`setup failure ${failure} retries only transient errors`,async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-setup-failure-'))
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('No executor expected')})
+ let commands=0,polls=0
+ relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
+ relay.bot.api.config.use(async(_prev,method,_payload,signal)=>{
+  if(method==='setMyCommands' && ++commands===1) {
+   if(failure==='programming')throw Error('Synthetic permanent setup fault')
+   return {ok:false,error_code:failure,description:'Synthetic setup failure'} as any
+  }
+  if(method==='getUpdates'){
+   polls++
+   if(signal && !signal.aborted)await new Promise<void>(resolve=>signal.addEventListener('abort',()=>resolve(),{once:true}))
+   return {ok:true,result:[]} as any
+  }
+  return {ok:true,result:true} as any
+ })
+ const started=relay.start()
+ try {
+  await until(async()=>commands>0)
+  if(failure===503){await until(async()=>polls>0);assert.equal(commands,3)}
+  else {await new Promise(resolve=>setTimeout(resolve,5200));assert.equal(commands,1);assert.equal(polls,0)}
+ }finally{await relay.stop();await started;await rm(dir,{recursive:true,force:true})}
+})
+
+test('shutdown aborts a pending bot initialization without starting polling',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-init-stop-'))
+ const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('No executor expected')})
+ let initSignal:Parameters<typeof relay.bot.init>[0],polls=0
+ relay.bot.api.config.use(async(_prev,method,_payload,signal)=>{
+  if(method==='getMe'){
+   initSignal=signal
+   if(signal && !signal.aborted)await new Promise<void>(resolve=>signal.addEventListener('abort',()=>resolve(),{once:true}))
+   throw Error('Initialization aborted')
+  }
+  if(method==='getUpdates')polls++
+  return {ok:true,result:true} as any
+ })
+ const started=relay.start()
+ try {await until(async()=>Boolean(initSignal));await relay.stop();await started;assert.equal(initSignal?.aborted,true);assert.equal(polls,0)}
+ finally {await relay.stop();await started;await rm(dir,{recursive:true,force:true})}
+})
+
+test('failed reviewer readback exposes its stop through show, list and resume until explicit edit',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-review-stop-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
+ await control.requestPairing(101,101);const owner=await control.approveOwner(101)
+ const execution=await control.captureChoice(initialPreset('grok')),now=Date.now()+1000
+ const s=await scheduler.save({id:'review',name:'Review',text:'Review failures',trigger:{everySeconds:60,start:new Date(now).toISOString()},when:'unreviewed-failures',enabled:true,owner,execution})
+ await runs.create({id:'r_original',chatId:101,telegramUserId:101,texts:['Work'],execution});await runs.patch('r_original',{status:'failed'})
+ await scheduler.tick(owner,runs,now)
+ const reviewer=(await runs.list()).find(r=>r.scheduled)!
+ await runs.patch(reviewer.id,{status:'failed'})
+ const cli=async(args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env:{...process.env,EZ_CONTROL_DIR:dir,EZ_EXECUTOR_CLI:'grok',EZ_RUN_ID:''}})).stdout)
+ for(const action of ['show','resume']){
+  const result=await cli([action,s.id]);assert.equal(result.nextEligibleAt,null);assert.deepEqual(result.failedReviewRunIds,[reviewer.id]);assert.match(result.recovery,/explicitly edit/)
+ }
+ const listed=await cli(['list']);assert.equal(listed[0].nextEligibleAt,null)
+ await scheduler.save({...s,text:'Repaired reviewer'})
+ const result=await cli(['show',s.id]);assert.notEqual(result.nextEligibleAt,null);assert.deepEqual(result.failedReviewRunIds,[])
+})

package/test/host-executor.test.ts

@@ -12,6 +12,29 @@ import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { RunStore } from '../src/runs.js'
 import { packageVersion } from '../src/version.js'
 import { executionDefaults } from '../src/model-policy.js'
+import { workspaceLease } from '../src/plugins/workspace-lease.mjs'
+
+test('host restart clears dead native lease only after proving previous CLI stopped',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-native-recovery-'));
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),toolsHome=path.join(root,'tools'),directory=path.join(controlDir,'host-executor');
+  const abort=new AbortController();let server:Promise<void>|undefined;
+  try {
+    await mkdir(workspace);await mkdir(toolsHome);await mkdir(directory,{recursive:true});
+    await writeFile(path.join(toolsHome,'config.json'),JSON.stringify({schemaVersion:1,workspace:await realpath(workspace)}));
+    const child=spawn(process.execPath,['-e','process.exit(0)']);const deadPid=child.pid;await new Promise(r=>child.once('close',r));
+    await writeFile(path.join(toolsHome,'workspace-writer.lock'),JSON.stringify({pid:deadPid,kind:'native',runId:'r_old'}));
+    await writeFile(path.join(directory,'r_old.running.json'),'{}');
+    await writeFile(path.join(directory,'r_old.process.json'),JSON.stringify({pid:process.pid}));
+    const installation={cli:'grok',agents:[{name:'test',workspace,controlDir,toolsHome,binDir:path.join(root,'bin')}]};
+    await assert.rejects(serveHostExecutor(installation,abort.signal),/Previous host CLI is still running/);
+    await readFile(path.join(toolsHome,'workspace-writer.lock'));
+    await writeFile(path.join(directory,'r_old.process.json'),JSON.stringify({pid:deadPid}));
+    server=serveHostExecutor(installation,abort.signal);
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'heartbeat.json'));
+    await assert.rejects(readFile(path.join(toolsHome,'workspace-writer.lock')),{code:'ENOENT'});
+  }finally{abort.abort();await server;await rm(root,{recursive:true,force:true});}
+});
 
 test('one installed CLI executes two agent bindings with separate minds and sanitized environment', async () => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-'))
@@ -23,12 +46,12 @@ test('one installed CLI executes two agent bindings with separate minds and sani
   let server:Promise<void>|undefined
   try {
     const binary=path.join(root,'cli')
-    await writeFile(binary,`#!${process.execPath}\nif(process.env.EZ_RUN_ID==='r_hold')setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,args:process.argv.slice(2)}));\n`,{mode:0o700})
+    await writeFile(binary,`#!${process.execPath}\nif(process.env.EZ_RUN_ID==='r_hold')setInterval(()=>{},1000);console.log(JSON.stringify({cwd:process.cwd(),home:process.env.HOME,token:process.env.TELEGRAM_BOT_TOKEN,control:process.env.EZ_CONTROL_DIR,run:process.env.EZ_RUN_ID,repair:process.env.EZ_REPAIR_ENABLED,args:process.argv.slice(2)}));\n`,{mode:0o700})
     await writeFile(path.join(root,'claude'),await readFile(binary),{mode:0o700})
     await writeFile(path.join(root,'codex'),await readFile(binary),{mode:0o700})
     process.env.PATH=root+path.delimiter+oldPath
     EXECUTOR_REGISTRY.grok.command=binary
-    EXECUTOR_REGISTRY.grok.buildArgs=EXECUTOR_REGISTRY.codex.buildArgs
+    EXECUTOR_REGISTRY.grok.buildArgs=(opts,file,prompt)=>[...EXECUTOR_REGISTRY.codex.buildArgs(opts,file,prompt).slice(0,-1),prompt]
     process.env.TELEGRAM_BOT_TOKEN='must-not-reach-host-cli'
     const sharedAlias=path.join(root,'shared-alias')
     await symlink(root,sharedAlias)
@@ -44,8 +67,13 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       const dir=path.join(agent.controlDir,'host-executor')
       for(let n=0;n<100;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
       assert.equal(JSON.parse(await readFile(path.join(dir,'heartbeat.json'),'utf8')).version,packageVersion)
+      const release = await workspaceLease(agent.toolsHome)
       await ownerRun(agent.controlDir, `r_${agent.name}`)
       await writeFile(path.join(dir,`r_${agent.name}.request.json`),JSON.stringify({texts:['test'],options:{workspace:'/wrong',controlDir:'/wrong',toolsHome:'/wrong',cli:'grok',timeoutMs:5000}}))
+      await new Promise(r=>setTimeout(r,300))
+      await readFile(path.join(dir,`r_${agent.name}.request.json`))
+      await assert.rejects(readFile(path.join(dir,`r_${agent.name}.process.json`)),{code:'ENOENT'})
+      await release?.()
     }
     for(const agent of agents){
       const file=path.join(agent.controlDir,'host-executor',`r_${agent.name}.events`)
@@ -56,7 +84,8 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       assert.equal(result.cwd,await realpath(agent.workspace))
       assert.equal(result.control,agent.controlDir)
       assert.equal(result.token,undefined)
-      assert.match(result.args.join(' '),/you are its repairer/)
+      assert.equal(result.args.at(-1),'test')
+      assert.equal(result.repair,'true')
       assert.ok(result.args.includes(agent.toolsHome))
       assert.ok(result.args.includes(await realpath(root)))
       assert.ok(!result.args.includes('/wrong'))
@@ -72,8 +101,8 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     client.stdin.end(JSON.stringify({texts:['Telegram message'],options:{cli:'grok',timeoutMs:5000,codexAutoCompactTokens:32000,repairEnabled:false}}))
     assert.equal(await new Promise(resolve=>client.once('close',resolve)),0,stderr)
     assert.equal(JSON.parse(stdout).run,'tg_6293305')
-    assert.match(JSON.parse(stdout).args.join(' '),/Automatic repair is disabled/)
-    assert.doesNotMatch(JSON.parse(stdout).args.join(' '),/you are its repairer/)
+    assert.equal(JSON.parse(stdout).args.at(-1),'Telegram message')
+    assert.equal(JSON.parse(stdout).repair,'false')
     assert.ok(JSON.parse(stdout).args.includes('model_auto_compact_token_limit=32000'))
     const eventId='event_'+'a'.repeat(64)
     await ownerRun(agents[0].controlDir, eventId, {sourceId:'fixture',bindingId:'binding',eventIds:['1']})
@@ -107,8 +136,10 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     assert.ok(JSON.parse(boundOutput).args.includes('agent-only-fixture'))
     await assert.rejects(serveHostExecutor({cli:'grok',agents},new AbortController().signal),/already running/)
     const directory=path.join(agents[0].controlDir,'host-executor')
-    const submit=async(id:string)=>{await ownerRun(agents[0].controlDir,id);await writeFile(path.join(directory,id+'.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok',timeoutMs:5000}}))}
-    await submit('r_hold')
+    const runs=new RunStore(agents[0].controlDir)
+    await runs.create({id:'r_hold',chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'held',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
+    await runs.patch('r_hold',{status:'running'})
+    await writeFile(path.join(directory,'r_hold.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok'}}))
     for(let n=0;n<100;n++){try{await readFile(path.join(directory,'r_hold.process.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
     await new RunStore(agents[0].controlDir).create({id:'r_schedule_queued',chatId:101,telegramUserId:101,texts:['test'],scheduled:{id:'shared',revision:'v1',dueAt:new Date().toISOString(),pairedAt:new Date().toISOString()}})
     await new RunStore(agents[0].controlDir).patch('r_schedule_queued',{status:'running'})
@@ -116,17 +147,27 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     const otherDirectory=path.join(agents[1].controlDir,'host-executor')
     await ownerRun(agents[1].controlDir,'r_other_shared')
     await writeFile(path.join(otherDirectory,'r_other_shared.request.json'),JSON.stringify({texts:['test'],options:{cli:'grok'}}))
-    await new Promise(r=>setTimeout(r,350))
-    await assert.rejects(readFile(path.join(directory,'r_schedule_queued.running.json')),{code:'ENOENT'})
-    await assert.rejects(readFile(path.join(otherDirectory,'r_other_shared.running.json')),{code:'ENOENT'})
-    await assert.rejects(readFile(path.join(otherDirectory,'r_other_shared.events')),{code:'ENOENT'})
+    await runs.create({id:'tg_42',chatId:101,telegramUserId:101,messageId:42,texts:['Chat while scheduled work runs']})
+    await runs.patch('tg_42',{status:'running'})
+    await writeFile(path.join(directory,'tg_42.request.json'),JSON.stringify({texts:['Chat while scheduled work runs'],options:{cli:'grok'}}))
+    const completed=async(dir:string,id:string)=>{
+      let output=''
+      for(let n=0;n<200;n++){try{output=await readFile(path.join(dir,id+'.events'),'utf8');if(output.includes('"stream":"exit"'))break}catch{}await new Promise(r=>setTimeout(r,20))}
+      assert.match(output, /"stream":"exit","code":0/)
+      return output.trim().split('\n').map(line=>JSON.parse(line))
+    }
+    // A running scheduled engine does not reserve either its agent or its
+    // shared workspace, including another binding through a filesystem alias.
+    const [,,chatEvents]=await Promise.all([completed(directory,'r_schedule_queued'),completed(otherDirectory,'r_other_shared'),completed(directory,'tg_42')])
+    const chat=JSON.parse(chatEvents.filter(e=>e.stream==='stdout').map(e=>e.text).join(''))
+    assert.match(chat.args.at(-1),/^Chat while scheduled work runs/)
+    assert.match(chat.args.at(-1),/ezenciel-agents-message/)
+    assert.doesNotMatch(await readFile(path.join(directory,'r_hold.events'),'utf8'),/"stream":"exit"/)
+    await readFile(path.join(directory,'r_hold.running.json'))
     await writeFile(path.join(directory,'r_hold.cancel'),'')
-    let output=''
-    for(let n=0;n<200;n++){try{output=await readFile(path.join(directory,'r_schedule_queued.events'),'utf8');if(output.includes('"stream":"exit"'))break}catch{}await new Promise(r=>setTimeout(r,20))}
-    assert.match(output, /"stream":"exit","code":0/)
-    assert.match(await readFile(path.join(directory,'r_hold.events'),'utf8'), /"stream":"exit","code":1/)
-    for(let n=0;n<200;n++){try{output=await readFile(path.join(otherDirectory,'r_other_shared.events'),'utf8');if(output.includes('"stream":"exit"'))break}catch{}await new Promise(r=>setTimeout(r,20))}
-    assert.match(output, /"stream":"exit","code":0/)
+    let heldOutput=''
+    for(let n=0;n<200;n++){heldOutput=await readFile(path.join(directory,'r_hold.events'),'utf8');if(heldOutput.includes('"stream":"exit"'))break;await new Promise(r=>setTimeout(r,20))}
+    assert.match(heldOutput, /"stream":"exit","code":1/)
   } finally {
     abort.abort();await server
     EXECUTOR_REGISTRY.grok.command=old

package/test/install-config.test.ts

@@ -60,7 +60,7 @@ test('packaged configure accepts token through stdin without echo or extra initi
     const result = spawnSync(process.execPath, [bin, 'configure', 'codex', '--token-stdin'], { cwd: root, input: token, encoding: 'utf8', timeout: 10000 })
     assert.equal(result.status, 0, result.stderr)
     assert.equal((result.stdout + result.stderr).includes(token), false)
-    assert.equal(JSON.parse(result.stdout).created.length, 4)
+    assert.equal(JSON.parse(result.stdout).created.length, 3)
     assert.equal(parseEnv(await readFile(path.join(root, '.env'), 'utf8')).TELEGRAM_BOT_TOKEN, token)
   } finally { await rm(root, { recursive: true, force: true }) }
 })