@jc_stack/ez-agents 0.1.0-beta.27 → 0.1.0-beta.29

package/test/executor.test.ts

@@ -1,4 +1,5 @@
 import { ownerRun } from './helpers/owner-run.js'
+import { RunStore } from '../src/runs.js'
 import assert from 'node:assert/strict'
 import test from 'node:test'
 import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
@@ -180,3 +181,58 @@ test('adapters do not append instruction files or impose a workflow turn budget'
  assert.ok(!EXECUTOR_REGISTRY.claude.buildArgs(opts,'','literal').includes('--append-system-prompt-file'))
  assert.ok(!EXECUTOR_REGISTRY.grok.buildArgs(opts,'/tmp/prompt','literal').includes('--max-turns'))
 })
+
+test('Codex external isolation changes only explicit sandbox argv and never enters child environment', () => {
+  const args = EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',codexSandbox:'external',sessionId:'native-id',isResume:true},'', 'hello')
+  assert.equal(args[args.indexOf('--sandbox')+1], 'danger-full-access')
+  assert.ok(args.includes('native-id'))
+  assert.equal(executorEnvironment({EZ_CODEX_SANDBOX:'external'}).EZ_CODEX_SANDBOX, undefined)
+})
+
+test('external Codex isolation cannot launch host runs', async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-external-sandbox-'))
+  t.after(() => rm(root,{recursive:true,force:true}))
+  await ownerRun(root,'r_sandbox')
+  const previous = {transport:process.env.EZ_EXECUTOR_TRANSPORT,telegram:process.env.EZ_TELEGRAM_ENABLED}
+  try {
+    process.env.EZ_TELEGRAM_ENABLED='false'
+    for (const transport of ['host','']) {
+      process.env.EZ_EXECUTOR_TRANSPORT=transport
+      await assert.rejects(startExecutorJob(['Hello'],{workspace:root,controlDir:root,binDir:root,runId:'r_sandbox',timeoutMs:0,cli:'codex',codexSandbox:'external'}), /owner-authorized native local/)
+    }
+  } finally {
+    for (const [key,value] of [['EZ_EXECUTOR_TRANSPORT',previous.transport],['EZ_TELEGRAM_ENABLED',previous.telegram]]) {
+      if (value === undefined) delete process.env[key!]; else process.env[key!]=value
+    }
+  }
+})
+
+test('external local owner chat preserves authorization and literal input', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-external-owner-'))
+  t.after(()=>rm(root,{recursive:true,force:true}))
+  const prior={path:process.env.PATH,transport:process.env.EZ_EXECUTOR_TRANSPORT}
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'codex'),`#!/usr/bin/env node\nconst fs=require('fs');let text='';process.stdin.on('data',b=>text+=b);process.stdin.on('end',()=>fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),text,secret:process.env.TELEGRAM_BOT_TOKEN})));`,{mode:0o755})
+  await ownerRun(root,'r_owner_external')
+  const opts={workspace:root,controlDir:root,binDir:bin,runId:'r_owner_external',timeoutMs:0,cli:'codex',codexSandbox:'external' as const}
+  try {
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.EZ_EXECUTOR_TRANSPORT='local'
+    const job=await startExecutorJob(['  literal /goal request\n'],opts)
+    const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup()
+    assert.equal(code,0)
+    const observed=JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+    assert.equal(observed.text,'  literal /goal request\n')
+    assert.equal(observed.args[observed.args.indexOf('--sandbox')+1],'danger-full-access')
+    assert.equal(observed.secret,undefined)
+    const runs=new RunStore(root)
+    await runs.create({id:'r_foreign',chatId:999,telegramUserId:999,texts:['no']})
+    await runs.patch('r_foreign',{status:'running'})
+    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_foreign'}),/blocked|owner/i)
+    await runs.create({id:'r_restricted',chatId:101,telegramUserId:101,texts:['no'],taskId:'task_'+'a'.repeat(32)})
+    await runs.patch('r_restricted',{status:'running'})
+    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_restricted'}),/owner-authorized native local/)
+  } finally {
+    if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
+    if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
+  }
+})

package/test/host-executor.test.ts

@@ -12,6 +12,29 @@ import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { RunStore } from '../src/runs.js'
 import { packageVersion } from '../src/version.js'
 import { executionDefaults } from '../src/model-policy.js'
+import { workspaceLease } from '../src/plugins/workspace-lease.mjs'
+
+test('host restart clears dead native lease only after proving previous CLI stopped',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-native-recovery-'));
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),toolsHome=path.join(root,'tools'),directory=path.join(controlDir,'host-executor');
+  const abort=new AbortController();let server:Promise<void>|undefined;
+  try {
+    await mkdir(workspace);await mkdir(toolsHome);await mkdir(directory,{recursive:true});
+    await writeFile(path.join(toolsHome,'config.json'),JSON.stringify({schemaVersion:1,workspace:await realpath(workspace)}));
+    const child=spawn(process.execPath,['-e','process.exit(0)']);const deadPid=child.pid;await new Promise(r=>child.once('close',r));
+    await writeFile(path.join(toolsHome,'workspace-writer.lock'),JSON.stringify({pid:deadPid,kind:'native',runId:'r_old'}));
+    await writeFile(path.join(directory,'r_old.running.json'),'{}');
+    await writeFile(path.join(directory,'r_old.process.json'),JSON.stringify({pid:process.pid}));
+    const installation={cli:'grok',agents:[{name:'test',workspace,controlDir,toolsHome,binDir:path.join(root,'bin')}]};
+    await assert.rejects(serveHostExecutor(installation,abort.signal),/Previous host CLI is still running/);
+    await readFile(path.join(toolsHome,'workspace-writer.lock'));
+    await writeFile(path.join(directory,'r_old.process.json'),JSON.stringify({pid:deadPid}));
+    server=serveHostExecutor(installation,abort.signal);
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'heartbeat.json'));
+    await assert.rejects(readFile(path.join(toolsHome,'workspace-writer.lock')),{code:'ENOENT'});
+  }finally{abort.abort();await server;await rm(root,{recursive:true,force:true});}
+});
 
 test('one installed CLI executes two agent bindings with separate minds and sanitized environment', async () => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-'))
@@ -44,8 +67,13 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       const dir=path.join(agent.controlDir,'host-executor')
       for(let n=0;n<100;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
       assert.equal(JSON.parse(await readFile(path.join(dir,'heartbeat.json'),'utf8')).version,packageVersion)
+      const release = await workspaceLease(agent.toolsHome)
       await ownerRun(agent.controlDir, `r_${agent.name}`)
       await writeFile(path.join(dir,`r_${agent.name}.request.json`),JSON.stringify({texts:['test'],options:{workspace:'/wrong',controlDir:'/wrong',toolsHome:'/wrong',cli:'grok',timeoutMs:5000}}))
+      await new Promise(r=>setTimeout(r,300))
+      await readFile(path.join(dir,`r_${agent.name}.request.json`))
+      await assert.rejects(readFile(path.join(dir,`r_${agent.name}.process.json`)),{code:'ENOENT'})
+      await release?.()
     }
     for(const agent of agents){
       const file=path.join(agent.controlDir,'host-executor',`r_${agent.name}.events`)

package/test/intake-relay.test.ts

@@ -59,7 +59,7 @@ const fixture = async (overrides: Partial<Config> = {}) => {
     } as typeof relay.bot.botInfo
     relay.bot.api.config.use(async (_previous, method, payload) => {
       if (method === 'getChatMember' && members.get((payload as {user_id: number}).user_id) === 'error') throw new Error('Fixture membership unavailable')
-      if (method === 'sendMessage') replies.push((payload as { text: string }).text)
+      if (method === 'sendMessage' || method === 'editMessageText') replies.push((payload as { text: string }).text)
       const keyboard = (payload as { reply_markup?: { inline_keyboard?: { text: string; callback_data: string }[][] } }).reply_markup?.inline_keyboard
       if (keyboard) keyboards.push(keyboard)
       return {
@@ -203,7 +203,7 @@ test('owner group discovery routes only to the private chat and rechecks identit
   } finally { await f.close() }
 })
 
-test('three-item menu is owner-only and removes the retired settings control', async () => {
+test('conversation menu is owner-only and removes the retired settings control', async () => {
   const f = await fixture()
   const callback = (id: number, data: string, user = 101): Update => ({
     update_id: id,
@@ -213,7 +213,7 @@ test('three-item menu is owner-only and removes the retired settings control', a
   try {
     await f.relay.bot.handleUpdate(message(1, '/menu'))
     assert.deepEqual(f.keyboards.at(-1)!.flat().map((b) => b.text),
-      ['New conversation', 'Choose AI', 'Work status'])
+      ['New conversation', 'Conversations', 'Choose AI', 'Work status'])
     await f.relay.bot.handleUpdate(message(2, '/settings'))
     assert.match(f.replies.at(-1)!, /Settings was removed.*Use \/ai/)
     await f.relay.bot.handleUpdate(message(3, '/ai'))
@@ -247,11 +247,11 @@ test('application-backed channels keep AI and retired settings controls in the a
     const store = new ControlStore(f.dir, 1000)
     const before = await store.status()
     let id = 1
-    for (const text of ['/ai', '/settings', '/new']) {
+    for (const text of ['/ai', '/settings', '/new', '/chats', '/rename Example']) {
       await f.relay.bot.handleUpdate(message(id++, text))
       assert.match(f.replies.at(-1)!, /managed in the connected application/)
     }
-    for (const data of ['menu:ai', 'menu:settings', 'menu:new', 'ai:old-button']) {
+    for (const data of ['menu:ai', 'menu:settings', 'menu:new', 'menu:chats', 'chat:list:0:0', 'chat:open:invalid', 'ai:old-button']) {
       await f.relay.bot.handleUpdate({ update_id: id, callback_query: {
         id: String(id), chat_instance: 'fixture', data,
         from: { id: 101, first_name: 'Fixture', is_bot: false }, message: message(id++).message!,
@@ -507,3 +507,124 @@ test('approved family messages enter restricted task runs, never the owner sessi
     await tasks.ownerCall('setup','list',{}).then(()=>assert.fail('completed run cannot change grants'),()=>{})
   } finally {await f.close()}
 })
+
+
+test('Telegram named conversation buttons switch and archive without rerouting accepted messages', async () => {
+  const f = await fixture()
+  try {
+    let id = 1
+    const send = (text: string) => f.relay.bot.handleUpdate(message(id++, text))
+    const click = async (data: string, user = 101) => f.relay.bot.handleUpdate({ update_id: id, callback_query: {
+      id: String(id), chat_instance: 'fixture', data,
+      from: { id: user, first_name: 'Fixture', is_bot: false }, message: message(id++).message!,
+    } })
+    const store = new ControlStore(f.dir, 1000)
+    await send('Client launch')
+    const first = (await store.getActiveSession())!.sessionId
+    await send('/new')
+    await send('Holiday planning')
+    const second = (await store.getActiveSession())!.sessionId
+    await send('/chats')
+    assert.ok(f.keyboards.at(-1)!.flat().some(b => b.text === 'Client launch'))
+    assert.ok(!f.keyboards.at(-1)!.flat().some(b => b.callback_data.startsWith('chat:archive:')))
+    assert.ok(f.keyboards.at(-1)!.every(row => row.filter(b => b.callback_data.startsWith('chat:open:')).length === 0 || row.length === 1))
+    const before = await store.status()
+    await click(`chat:open:${first}`, 202)
+    await click(`chat:archive:${second}`, 202)
+    assert.deepEqual(await store.status(), before)
+    await click(`chat:open:${first}`)
+    assert.equal((await store.getActiveSession())!.sessionId, first)
+    assert.deepEqual(f.keyboards.at(-1)!.flat().filter(b => b.callback_data.startsWith('chat:archive:')), [{text: 'Archive this conversation', callback_data: `chat:archive:${first}`}])
+    await send('/rename@fixture_bot <Client & launch>')
+    assert.equal((await store.getActiveSession())!.title, '<Client & launch>')
+    await click(`chat:archive:${first}`)
+    assert.equal(await store.getActiveSession(), null)
+    await click('chat:list:0:0')
+    assert.ok(!f.keyboards.at(-1)!.flat().some(b => b.callback_data === `chat:open:${first}`))
+    await click('chat:list:1:0')
+    assert.ok(f.keyboards.at(-1)!.flat().some(b => b.text === '<Client & launch>'))
+    await f.restart()
+    await click(`chat:restore:${first}`)
+    await click(`chat:open:${first}`)
+    await send('Continue launch')
+    for (let n = 0; n < 3; n++) await f.relay.drainInbox(true)
+    const runs = await new RunStore(f.dir).list()
+    assert.equal(runs.find(r => r.texts.includes('Holiday planning'))!.execution!.sessionId, second)
+    assert.equal(runs.find(r => r.texts.includes('Continue launch'))!.execution!.sessionId, first)
+    assert.ok(!runs.some(r => r.texts.some(t => t.startsWith('/rename'))))
+    await click('chat:open:../../escape')
+    assert.match(f.replies.at(-1)!, /unavailable/)
+  } finally { await f.close() }
+})
+
+test('conversation menu paginates and stale pages remain usable after archiving', async () => {
+  const f = await fixture()
+  try {
+    const store = new ControlStore(f.dir, 1000)
+    for (let n = 0; n < 10; n++) {
+      await store.captureChoice({ id: 'fixture', name: 'Grok', cli: 'grok' }, `Topic ${n}`)
+      if (n < 9) await store.resetSession()
+    }
+    let id = 1
+    const click = (data: string) => f.relay.bot.handleUpdate({ update_id: id, callback_query: {
+      id: String(id), chat_instance: 'fixture', data,
+      from: { id: 101, first_name: 'Fixture', is_bot: false }, message: message(id++).message!,
+    } })
+    await click('chat:list:0:0')
+    assert.equal(f.keyboards.at(-1)!.flat().filter(b => b.callback_data.startsWith('chat:open:')).length, 8)
+    assert.ok(f.keyboards.at(-1)!.flat().some(b => b.text === 'Next'))
+    await click('chat:list:0:1')
+    assert.equal(f.keyboards.at(-1)!.flat().filter(b => b.callback_data.startsWith('chat:open:')).length, 2)
+    for (const session of await store.listSessions()) await store.archiveSession(session.sessionId, true)
+    await click('chat:list:0:1')
+    assert.equal(f.keyboards.at(-1)!.flat().filter(b => b.callback_data.startsWith('chat:open:')).length, 0)
+  } finally { await f.close() }
+})
+
+
+test('older conversation names come from owner messages and detail keeps archive available when resume fails', async () => {
+  const f = await fixture()
+  try {
+    const store = new ControlStore(f.dir, 1000)
+    const old = await store.ensureActiveSession()
+    await store.markSessionStarted(old.sessionId)
+    const execution = await store.captureChoice({ id: 'grok', name: 'Grok', cli: 'grok' })
+    const runs = new RunStore(f.dir)
+    await runs.create({ chatId: 101, telegramUserId: 101, texts: ['Internal update event'], execution })
+    await runs.create({ chatId: 101, telegramUserId: 101, messageId: 9, texts: [JSON.stringify({event: 'approval_decision', decision: 'approve'})], execution })
+    await runs.create({ chatId: 101, telegramUserId: 101, messageId: 10, texts: ['/start'], execution })
+    await runs.create({ chatId: 101, telegramUserId: 101, messageId: 11, texts: ['Client launch checklist'], execution })
+    await store.captureChoice({ id: 'grok', name: 'Grok', cli: 'grok' }, 'A later message must not relabel old history')
+    assert.equal((await store.getActiveSession())!.title, undefined)
+    await store.resetSession()
+    await f.relay.bot.handleUpdate(message(1, '/chats'))
+    const rows = f.keyboards.at(-1)!
+    assert.ok(rows.flat().some(b => b.text.startsWith('Client launch checklist · ')))
+    assert.ok(!rows.flat().some(b => b.text === '✓ New conversation'))
+    assert.ok(!rows.flat().some(b => b.text.includes(old.sessionId.slice(0, 8))))
+    assert.ok(!rows.flat().some(b => b.callback_data.startsWith('chat:archive:')))
+    await f.relay.bot.handleUpdate({ update_id: 2, callback_query: {
+      id: '2', chat_instance: 'fixture', data: `chat:open:${old.sessionId}`,
+      from: { id: 101, first_name: 'Fixture', is_bot: false }, message: message(2).message!,
+    } })
+    assert.match(f.replies.at(-1)!, /Client launch checklist.*\n.*binding/)
+    assert.deepEqual(f.keyboards.at(-1)![0], [{text: 'Archive this conversation', callback_data: `chat:archive:${old.sessionId}`}])
+  } finally { await f.close() }
+})
+
+
+test('web launcher is private-owner-only and bypasses native intake without replacing controls', async () => {
+  const f=await fixture({webLauncher:{command:'voice',label:'Voice',url:'https://voice.example/'}})
+  try {
+    const stranger=message(1,'/voice');stranger.message!.from!.id=202
+    await f.relay.bot.handleUpdate(stranger)
+    assert.equal(f.keyboards.length,0)
+    await f.relay.bot.handleUpdate(message(2,'/voice'))
+    assert.deepEqual(f.keyboards.at(-1),[[{text:'Voice',web_app:{url:'https://voice.example/'}}]])
+    await f.relay.bot.handleUpdate(message(3,'/menu'))
+    assert.deepEqual(f.keyboards.at(-1)!.flat().map(b=>b.text),['New conversation','Conversations','Choose AI','Work status','Voice'])
+    await f.relay.drainInbox(true);assert.equal(f.launched.length,0)
+    await new ControlStore(f.dir,1000).revokeOwner()
+    const before=f.keyboards.length;await f.relay.bot.handleUpdate(message(4,'/voice'));assert.equal(f.keyboards.length,before)
+  } finally {await f.close()}
+})

package/test/message-history.test.ts

@@ -0,0 +1,127 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, readFile, writeFile, readdir } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+import { execFile } from 'node:child_process'
+import { ownerRun } from './helpers/owner-run.js'
+import { deliveredMessages } from '../src/message-history.js'
+import { RunStore } from '../src/runs.js'
+import { ControlStore } from '../src/control-state.js'
+
+async function fixture(t: test.TestContext) {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-history-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await ownerRun(dir, 'tg_1')
+  const runs = new RunStore(dir)
+  const patchFixture = async (id: string, patch: Record<string, unknown>) => {
+    const file = join(dir, 'runs', id + '.json')
+    await writeFile(file, JSON.stringify({ ...JSON.parse(await readFile(file, 'utf8')), ...patch }))
+  }
+  const send = async (runId: string, text: string, ids: number[]) => {
+    const item = await runs.enqueueMessage(runId, text)
+    await runs.claimOutbox(item.id)
+    await runs.markOutboxSent(item.id, ids)
+    return join(dir, 'outbox', item.id + '.sent.json')
+  }
+  return { dir, runs, send, patchFixture }
+}
+
+test('CLI retrieves Synopsys delivery from another session without changing sessions or sending', async t => {
+  const { dir, runs, send, patchFixture } = await fixture(t)
+  await ownerRun(dir, 'r_schedule_report')
+  const owner = (await new ControlStore(dir, 1000).status()).owner!
+  await patchFixture('r_schedule_report', { nativeSessionId: 'report_session', scheduled: {
+    id: 's_earnings', revision: 1, dueAt: new Date().toISOString(), pairedAt: owner.pairedAt,
+  } })
+  await send('r_schedule_report', 'Synopsys (SNPS): quarterly results', [10, 11])
+  await runs.patch('r_schedule_report', { status: 'completed' })
+  await patchFixture('tg_1', { texts: ['Why now?'] })
+  await send('tg_1', 'Other report', [12])
+  const before = await readdir(join(dir, 'outbox'))
+  const controlBefore = await new ControlStore(dir, 1000).status()
+  const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-message.mjs', 'history', '--message-id', '11'], {
+    env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'tg_1' },
+  })
+  const result = JSON.parse(stdout)
+  assert.equal(result.messages.length, 1)
+  assert.equal(result.messages[0].text, 'Synopsys (SNPS): quarterly results')
+  assert.equal(result.messages[0].nativeSessionId, 'report_session')
+  assert.equal(result.messages[0].scheduleId, 's_earnings')
+  assert.deepEqual(result.messages[0].messageIds, [10, 11])
+  assert.deepEqual(await new ControlStore(dir, 1000).status(), controlBefore)
+  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  const latest = await deliveredMessages(dir, 'tg_1', { limit: 1 })
+  assert.equal(latest.messages[0].text, 'Other report')
+  assert.equal(latest.hasMore, true)
+})
+
+test('only confirmed deliveries in current owner binding are exposed', async t => {
+  const { dir, runs, send, patchFixture } = await fixture(t)
+  await send('tg_1', 'included', [1])
+  await runs.enqueueMessage('tg_1', 'pending')
+  const failed = await runs.enqueueMessage('tg_1', 'uncertain')
+  await runs.claimOutbox(failed.id)
+  await runs.failOutbox(failed.id, 'unknown', true)
+  await writeFile(join(dir, 'outbox', 'corrupt.sent.json'), '{')
+  await writeFile(join(dir, 'outbox', 'null.sent.json'), 'null')
+  const invalid = await send('tg_1', 'invalid receipt', [2])
+  const record = JSON.parse(await readFile(invalid, 'utf8'))
+  record.receipt.messageIds = []
+  await writeFile(invalid, JSON.stringify(record))
+  for (const [id, patch] of [
+    ['r_other_chat', { chatId: 202 }],
+    ['r_other_owner', { telegramUserId: 202 }],
+    ['r_old', { createdAt: '2000-01-01T00:00:00.000Z' }],
+    ['r_external', { external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } }],
+  ] as const) {
+    await ownerRun(dir, id)
+    await patchFixture(id, patch)
+    await send(id, 'excluded', [3])
+  }
+  assert.deepEqual((await deliveredMessages(dir, 'tg_1')).messages.map(m => m.text), ['included'])
+  await writeFile(join(dir, 'runs', 'broken.json'), '{')
+  assert.equal((await deliveredMessages(dir, 'tg_1')).messages.length, 1)
+})
+
+test('unauthorized callers and invalid arguments fail closed', async t => {
+  const { dir, runs, patchFixture } = await fixture(t)
+  for (const limit of [0, 51, NaN, 1.5]) await assert.rejects(deliveredMessages(dir, 'tg_1', { limit }), /Limit/)
+  await assert.rejects(deliveredMessages(dir, 'tg_1', { messageId: -1 }), /Message ID/)
+  await assert.rejects(deliveredMessages(dir, '../tg_1'), /identifier/)
+  await assert.rejects(deliveredMessages(dir, 'missing'), /No active/)
+  await ownerRun(dir, 'r_external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
+  await assert.rejects(deliveredMessages(dir, 'r_external'), /blocked/)
+  await patchFixture('tg_1', { telegramUserId: 202 })
+  await assert.rejects(deliveredMessages(dir, 'tg_1'), /owner-mismatch/)
+  await patchFixture('tg_1', { telegramUserId: 101, status: 'completed' })
+  await assert.rejects(deliveredMessages(dir, 'tg_1'), /No active/)
+  await runs.patch('tg_1', { status: 'running' })
+  await new ControlStore(dir, 1000).revokeOwner()
+  await assert.rejects(deliveredMessages(dir, 'tg_1'), /owner-mismatch/)
+})
+
+test('approval messages retain the content delivered to Telegram', async t => {
+  const { dir, send } = await fixture(t)
+  const file = await send('tg_1', 'placeholder', [20])
+  const item = JSON.parse(await readFile(file, 'utf8'))
+  delete item.text
+  item.type = 'approval'
+  item.approvalPrompt = 'Approve this messaging task?'
+  await writeFile(file, JSON.stringify(item))
+  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, item.approvalPrompt)
+})
+
+test('CLI flushes complete long reports and rejects send options in history mode', async t => {
+  const { dir, send } = await fixture(t)
+  const text = 'Report evidence. '.repeat(8000)
+  await send('tg_1', text, [30])
+  const env = { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'tg_1' }
+  const cli = [ 'bin/ezenciel-agents-message.mjs', 'history' ]
+  const { stdout } = await promisify(execFile)(process.execPath, cli, { env })
+  assert.equal(JSON.parse(stdout).messages[0].text, text)
+  const before = await readdir(join(dir, 'outbox'))
+  await assert.rejects(promisify(execFile)(process.execPath, [...cli, '--text', 'do not send'], { env }), /Unknown option/)
+  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+})

package/test/native-tasks.test.ts

@@ -0,0 +1,36 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import * as fs from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import { nativeTaskBinding,nativeTasks } from '../src/plugins/native-tasks.mjs'
+import { ControlStore } from '../src/control-state.js'
+
+test('native tasks use verified control binding, sanitized environment and unchanged scheduler',async()=>{
+  const root=await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(),'ez-native-tasks-'))),home=path.join(root,'tools'),workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),hostConfig=path.join(root,'host-executor.json')
+  try {
+    for(const dir of [home,workspace,controlDir])await fs.mkdir(dir)
+    await fs.writeFile(path.join(home,'config.json'),JSON.stringify({schemaVersion:1,workspace,hostConfig}))
+    const host={cli:'grok',agents:[{toolsHome:home,workspace,controlDir}]}
+    await fs.writeFile(hostConfig,JSON.stringify(host))
+    const binding=await nativeTaskBinding(home,{HOME:root,PATH:process.env.PATH,TELEGRAM_BOT_TOKEN:'secret',EZ_RUN_ID:'forged',NODE_OPTIONS:'injection',EZ_CONTROL_DIR:'/wrong'})
+    assert.equal(binding.cwd,workspace);assert.equal(binding.env.EZ_CONTROL_DIR,controlDir);assert.equal(binding.env.EZ_EXECUTOR_CLI,'grok')
+    for(const key of ['TELEGRAM_BOT_TOKEN','EZ_RUN_ID','NODE_OPTIONS'])assert.equal(binding.env[key],undefined)
+    assert.match((await nativeTasks(home,['--help'])).stdout,/durable, asynchronous CLI task/)
+    const denied=await nativeTasks(home,['list']);assert.notEqual(denied.code,0);assert.match(denied.stderr,/Pair an owner/)
+    const control=new ControlStore(controlDir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
+    const text='Read scan; $(must-not-run) /goal literal'
+    const saved=await nativeTasks(home,['create','native-fixture','--now','--text',text]);assert.equal(saved.code,0,saved.stderr)
+    const value=JSON.parse(saved.stdout);assert.equal(value.text,text);assert.equal(value.execution.preset.cli,'grok')
+    assert.equal(JSON.parse((await nativeTasks(home,['show','native-fixture'])).stdout).text,text)
+    assert.equal((await nativeTasks(home,['remove','native-fixture'])).code,0)
+    await assert.rejects(nativeTasks(home,['--help'],{signal:AbortSignal.abort()}),/cancelled/)
+    await assert.rejects(nativeTasks(home,['bad\0argument']),/literal/)
+    for(const input of [['--text-file','/private/secret'],['--text-file=/private/secret']])
+      await assert.rejects(nativeTasks(home,['create','--now',...input]),/inline --text/)
+    await fs.writeFile(hostConfig,JSON.stringify({...host,agents:[{...host.agents[0],workspace:root}]}))
+    await assert.rejects(nativeTaskBinding(home),/does not match/)
+    await fs.writeFile(path.join(home,'config.json'),JSON.stringify({schemaVersion:1,workspace}))
+    await assert.rejects(nativeTasks(home,['--help']),/standalone/)
+  }finally{await fs.rm(root,{recursive:true,force:true})}
+})

package/test/plugin-connection.test.mjs

@@ -0,0 +1,124 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { connectionProtocol,jsonLines } from '../src/plugins/connection.mjs';
+import { workspaceLease,invokeLease,recoverNativeLease } from '../src/plugins/workspace-lease.mjs';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const tick=()=>new Promise(resolve=>setImmediate(resolve));
+function fixture(options={}) {
+  const r={commands:{voice:'voice',notes:'notes'},plugins:{voice:{},notes:{revision:'one',manifest:{description:'Notes',skills:[]}}}};
+  const client=[],plugin=[],calls=[];
+  const protocol=connectionProtocol({readRegistry:async()=>r,excludedPlugin:'voice',sendClient:x=>client.push(x),sendPlugin:x=>plugin.push(x),execute:async(...args)=>{calls.push(args);return {code:0,stdout:'ok',stderr:''};},...options});
+  const request=(method,params={},id='r1')=>protocol.plugin({coreRequest:{id,method,params}});
+  return {r,client,plugin,calls,protocol,request};
+}
+test('discovery follows installed registry; self and missing aliases are unavailable',async()=>{
+  const f=fixture();f.request('tools.list');await tick();assert.equal(f.plugin[0].coreResponse.result[0].alias,'notes');
+  delete f.r.commands.notes;f.request('tools.list',{},'r2');await tick();assert.deepEqual(f.plugin[1].coreResponse.result,[]);
+  for(const alias of ['voice','missing','notes']){f.request('tools.help',{alias},alias);await tick();assert.match(f.plugin.at(-1).coreResponse.error,/unavailable/);}
+  assert.equal(f.calls.length,0);
+});
+test('trusted connection invokes literal command once without a permission exchange',async()=>{
+  const f=fixture();await f.request('tools.invoke',{alias:'notes',args:['read','a; $(x)'],stdin:'literal input'});
+  assert.equal(f.calls.length,1);assert.deepEqual(f.calls[0].slice(0,2),['notes',['read','a; $(x)']]);assert.equal(f.calls[0][2].stdin,'literal input');assert.deepEqual(f.client,[]);assert.equal(f.plugin[0].coreResponse.result.code,0);
+  assert.throws(()=>f.request('tools.invoke',{alias:'notes',args:[]}),/Duplicate/);assert.equal(f.calls.length,1);
+  await f.request('tools.invoke',{alias:'notes',args:[{}]},'invalid');assert.match(f.plugin.at(-1).coreResponse.error,/literal/);assert.equal(f.calls.length,1);
+});
+test('native task access uses the separate fixed scheduler adapter',async()=>{
+  const native=[];const f=fixture({executeNative:async(args)=>{native.push(args);return {code:0,stdout:'help',stderr:''};}});
+  await f.request('tools.native',{args:['--help']});assert.deepEqual(native,[['--help']]);assert.equal(f.calls.length,0);assert.equal(f.plugin[0].coreResponse.result.stdout,'help');
+  const unavailable=fixture();await unavailable.request('tools.native',{args:['--help']});assert.match(unavailable.plugin[0].coreResponse.error,/unavailable/);
+  await f.request('tools.native',{args:['--help'],deliveryContext:{owner:'forged'}},'forged');assert.match(f.plugin.at(-1).coreResponse.error,/parameter/);assert.equal(native.length,1);
+});
+test('registry revision change during admission prevents invocation',async()=>{
+  let reads=0;const f=fixture({readRegistry:async()=>({commands:{notes:'notes'},plugins:{notes:{revision:++reads===1?'one':'two'}}})});
+  await f.request('tools.invoke',{alias:'notes',args:[]});assert.match(f.plugin[0].coreResponse.error,/changed/);assert.equal(f.calls.length,0);
+});
+test('reserved frames cannot cross authority directions; cancellation aborts running call',async()=>{
+  let signal;const f=fixture({execute:async(a,args,opts)=>{signal=opts.signal;return new Promise(resolve=>signal.addEventListener('abort',()=>resolve({code:130})));}});
+  for(const key of ['coreRequest','coreResponse','coreApprove','coreApproval','coreApprovalResolved'])assert.throws(()=>f.protocol.client({[key]:{}}),/forged/);
+  for(const key of ['coreResponse','coreApprove','coreApproval','coreApprovalResolved'])assert.throws(()=>f.protocol.plugin({[key]:{}}),/forged/);
+  const first=f.request('tools.invoke',{alias:'notes',args:[]});await tick();assert.equal(signal.aborted,false);f.protocol.plugin({coreCancel:{id:'r1'}});assert.equal(signal.aborted,true);await first;assert.equal(f.plugin[0].coreResponse.result.code,130);assert.deepEqual(f.client,[]);
+  const second=f.request('tools.invoke',{alias:'notes',args:[]},'r2');await tick();f.protocol.close();assert.equal(signal.aborted,true);await second;
+});
+test('declared skill reads are bounded and reject traversal and escaping symlinks',async()=>{
+  const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-skill-'));
+  try {await fs.mkdir(path.join(dir,'plugin'));await fs.writeFile(path.join(dir,'private'),'secret');await fs.writeFile(path.join(dir,'plugin','SKILL.md'),'hello');await fs.symlink(path.join(dir,'private'),path.join(dir,'plugin','link'));
+    const f=fixture();f.r.plugins.notes.source=path.join(dir,'plugin');f.r.plugins.notes.manifest.skills=['SKILL.md','../private','link'];
+    await f.request('tools.skill',{alias:'notes',index:0});assert.equal(f.plugin[0].coreResponse.result.text,'hello');
+    for(const index of [1,2]){await f.request('tools.skill',{alias:'notes',index},'escape'+index);assert.match(f.plugin.at(-1).coreResponse.error,/escapes/);}
+  }finally{await fs.rm(dir,{recursive:true,force:true});}
+});
+test('JSONL rejects malformed and oversized input',()=>{
+  const frames=[],errors=[];const parse=jsonLines(f=>frames.push(f),e=>errors.push(e));parse(Buffer.from('{"ok":true}\n'));assert.equal(frames.length,1);parse(Buffer.from('bad\n'));assert.equal(errors.length,1);parse(Buffer.alloc(1048577,97));assert.equal(errors.length,2);
+});
+test('completed request IDs cannot replay and early cancellation prevents execution',async()=>{
+  const f=fixture();f.request('tools.list');await tick();assert.throws(()=>f.request('tools.list'),/Duplicate/);
+  f.request('tools.invoke',{alias:'notes',args:[]},'early');f.protocol.plugin({coreCancel:{id:'early'}});await tick();assert.match(f.plugin.at(-1).coreResponse.error,/cancelled/);assert.equal(f.client.length,0);assert.equal(f.calls.length,0);
+});
+test('shared workspace lease excludes concurrent writers and refuses queued native work',async()=>{
+  const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-lease-'));
+  try {
+    await fs.writeFile(path.join(dir,'config.json'),'{}');const release=await workspaceLease(dir);assert.equal(await workspaceLease(dir),undefined);await assert.rejects(invokeLease(dir),/busy/);await release();
+    await fs.mkdir(path.join(dir,'host-executor'));await fs.writeFile(path.join(dir,'host.json'),JSON.stringify({agents:[{toolsHome:dir,workspace:dir,controlDir:dir}]}));await fs.writeFile(path.join(dir,'config.json'),JSON.stringify({hostConfig:path.join(dir,'host.json'),workspace:dir}));await fs.writeFile(path.join(dir,'host-executor','r.request.json'),'{}');await assert.rejects(invokeLease(dir),/pending/);await fs.rm(path.join(dir,'host-executor','r.request.json'));const unlock=await invokeLease(dir);await unlock();
+  }finally{await fs.rm(dir,{recursive:true,force:true});}
+});
+test('command output bound and timeout remove exact containers without leaking daemon secrets',async()=>{
+  const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-bound-'));
+  try {
+    await fs.writeFile(path.join(dir,'docker'),`#!${process.execPath}\nif(process.env.TELEGRAM_BOT_TOKEN)process.exit(99);if(process.argv[2]==='container')process.exit(0);if(process.argv[2]==='loud')process.stdout.write('x'.repeat(10000));setInterval(()=>{},1000);`,{mode:0o700});
+    const url=new URL('../src/plugins/manager.mjs',import.meta.url).href;
+    for(const [arg,options,expected] of [['loud',{maxBytes:100},'output limit'],['wait',{timeoutMs:25},'timed out']]){
+      const script=`import {run} from ${JSON.stringify(url)};try{await run([${JSON.stringify(arg)}],{capture:true,container:'bound-test',...${JSON.stringify(options)}});process.exitCode=9}catch(e){console.log(e.message)}`;
+      const result=await promisify(execFile)(process.execPath,['--input-type=module','-e',script],{env:{...process.env,PATH:dir+path.delimiter+process.env.PATH,TELEGRAM_BOT_TOKEN:'private'},timeout:10000});assert.match(result.stdout,new RegExp(expected));
+    }
+  }finally{await fs.rm(dir,{recursive:true,force:true});}
+});
+test('startup recovers dead native leases but preserves live owners and surfaces dead plugin leases',async()=>{
+  const dir=await fs.mkdtemp(path.join(os.tmpdir(),'ez-recover-')),file=path.join(dir,'workspace-writer.lock');
+  try {
+    const result=await promisify(execFile)(process.execPath,['-e','console.log(process.pid)']);const deadPid=Number(result.stdout.trim());
+    await fs.writeFile(file,JSON.stringify({pid:process.pid,kind:'native'}));await recoverNativeLease(dir);await fs.access(file);
+    await fs.writeFile(file,JSON.stringify({pid:deadPid,kind:'native',runId:'r_test'}));await recoverNativeLease(dir);await assert.rejects(fs.access(file),{code:'ENOENT'});
+    await fs.writeFile(file,JSON.stringify({pid:deadPid,kind:'plugin'}));await assert.rejects(recoverNativeLease(dir),/verify command containers stopped/);await fs.access(file);await assert.rejects(workspaceLease(dir),/Stale/);
+    await fs.writeFile(file,'{}');await assert.rejects(recoverNativeLease(dir),/Invalid/);await fs.access(file);
+  }finally{await fs.rm(dir,{recursive:true,force:true});}
+});
+test('owner discovery is read-only, live and rejects caller-selected identity',async()=>{
+  let owner={telegramUserId:42,pairedAt:'epoch'};
+  const f=fixture({readOwner:async()=>owner});
+  await f.request('tools.owner');assert.deepEqual(f.plugin.at(-1).coreResponse.result,owner);
+  owner=null;await f.request('tools.owner',{},'second');assert.equal(f.plugin.at(-1).coreResponse.result,null);
+  await f.request('tools.owner',{telegramUserId:43},'forged');assert.match(f.plugin.at(-1).coreResponse.error,/unavailable/);
+  assert.equal(f.calls.length,0);
+});
+test('web publication accepts only explicit bounded loopback port mapping',async()=>{
+  const {loopbackPublish}=await import('../src/plugins/connection.mjs');
+  assert.equal(loopbackPublish('8791:8080'),'127.0.0.1:8791:8080');
+  for(const value of ['80:8080','8791:0','8791:65536','0.0.0.0:8791:8080','8791:8080/udp','$(x)',''])assert.throws(()=>loopbackPublish(value));
+});
+
+test('channel-neutral owner does not require a Telegram delivery context',async()=>{
+  const {captureDeliveryContext}=await import('../src/delivery-context.mjs');
+  const root=await fs.mkdtemp(path.join(os.tmpdir(),'ez-owner-web-'));
+  try {
+    await fs.writeFile(path.join(root,'control-state.json'),JSON.stringify({version:1,owner:{id:'owner',generation:'epoch',pairedAt:new Date().toISOString()}}));
+    assert.equal(await captureDeliveryContext(root,'voice','revision'),undefined);
+    await fs.writeFile(path.join(root,'control-state.json'),JSON.stringify({version:1,owner:{telegramUserId:42,pairedAt:new Date().toISOString()}}));
+    await assert.rejects(captureDeliveryContext(root,'voice','revision'),/invalid/);
+  }finally{await fs.rm(root,{recursive:true,force:true});}
+});
+
+test('cancellation verifies a container already being removed by Compose',async()=>{
+  const {removeCommandContainer}=await import('../src/plugins/manager.mjs');
+  const calls=[];await removeCommandContainer('fixture',async args=>{
+    calls.push(args);
+    return args[1]==='rm'?{code:1,stderr:'removal of container fixture is already in progress'}:{code:1,stderr:'No such object: fixture'};
+  });
+  assert.deepEqual(calls.map(args=>args[1]),['rm','inspect']);
+  await assert.rejects(removeCommandContainer('fixture',async()=>({code:1,stderr:'permission denied'})),/cleanup failed/);
+  await assert.rejects(removeCommandContainer('fixture',async args=>({code:1,stderr:args[1]==='rm'?'removal of container fixture is already in progress':'daemon unavailable'})),/cleanup failed/);
+});

package/test/plugin-manager.test.mjs

@@ -41,6 +41,16 @@ async function fixture(t) {
  const call=(...args)=>exec(process.execPath,[bin,'--home',home,...args],{env});
  return {root,source,home,deploymentDir,workspace,control,hostConfig,fake,log,manifest,deployment,env,call};
 }
+test('persistent connection reuses one container and releases registry lock between frames',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nif(process.argv[2]==='container')process.exit(0);require('readline').createInterface({input:process.stdin}).on('line',line=>{const f=JSON.parse(line);console.log(JSON.stringify(f.coreResponse?{reply:f.coreResponse}:{coreRequest:{id:f.id,method:'tools.list',params:{}}}));});`,{mode:0o700});
+ const child=spawn(process.execPath,[bin,'--home',f.home,'tools','connect','sample','connect'],{env:f.env,stdio:['pipe','pipe','pipe']});t.after(()=>child.kill('SIGKILL'));
+ const frame=async id=>{const output=once(child.stdout,'data');child.stdin.write(JSON.stringify({id})+'\n');return JSON.parse((await output)[0].toString());};
+ assert.deepEqual((await frame('first')).reply.result,[]);
+ await locked(f.home,async()=>{});
+ assert.deepEqual((await frame('second')).reply.result,[]);
+ child.stdin.end();await once(child,'close');
+});
 test('catalog paths resolve relative to the catalog and pin each new agent independently',async t=>{
  const f=await fixture(t),catalog=path.join(f.root,'defaults.json');
  await fs.writeFile(catalog,JSON.stringify({sample:'./source'}));
@@ -172,6 +182,8 @@ test('host install exposes runnable public commands without source aliases',asyn
  for(const [name,entry] of Object.entries(manifest.bin)) assert.equal(await fs.realpath(path.join(f.home,'bin',name)),await fs.realpath(new URL('../'+entry,import.meta.url)));
  const result=await exec(path.join(f.home,'bin','ezenciel-agents-message'),['--help'],{env:{...process.env,PATH:path.dirname(process.execPath)+path.delimiter+process.env.PATH}});
  assert.match(result.stdout,/Usage: ezenciel-agents-message/);
+ const application=await exec(path.join(f.home,'bin','ezenciel-agents-application'),['--help'],{env:{...process.env,PATH:path.dirname(process.execPath)+path.delimiter+process.env.PATH}});
+ assert.match(application.stdout,/--token-file/);
 });
 test('copying another agent registry is rejected before any Docker operation',async t=>{
  const f=await fixture(t),other=path.join(f.root,'other');await init(f.home,f.workspace);await init(other,f.workspace);
@@ -332,3 +344,25 @@ test('registered calls honor registry lock and regenerate stale Compose from cur
  await fs.writeFile(path.join(f.home,'registry.lock'),'test');
  await assert.rejects(f.call('sample','read'),/busy|EEXIST|locked/i);
 });
+
+
+test('writable folders require an explicit per-folder grant and can be revoked', async t => {
+ const f=await fixture(t);await init(f.home,f.workspace);
+ const p=await snapshot(f.source);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const source=await fs.realpath(f.workspace),binding=['sample','--service','sample','--source',source,'--target','/data/files'];
+ const result=JSON.parse((await f.call('plugins','folder-bind',...binding,'--writable')).stdout);
+ assert.equal(result.readOnly,false);
+ const readConfig=async()=>JSON.parse(await fs.readFile(path.join(f.home,'config.json'),'utf8'));
+ let config=await readConfig();
+ assert.deepEqual(config.folders.sample,[{service:'sample',source,target:'/data/files',writable:true}]);
+ const record={...p,project:'ezp-test-sample'};
+ assert.equal((await compose(config,record)).services.sample.volumes.find(v=>v.target==='/data/files').read_only,false);
+ config.folders.sample[0].writable='true';
+ await assert.rejects(compose(config,record),/writable must be boolean/);
+ await assert.rejects(f.call('plugins','folder-bind',...binding,'--writable','--writable'),/Supply/);
+ await f.call('plugins','folder-bind',...binding);
+ config=await readConfig();
+ assert.equal((await compose(config,record)).services.sample.volumes.find(v=>v.target==='/data/files').read_only,true);
+ await assert.rejects(f.call('plugins','folder-unbind','sample','--service','sample','--target','/data/files','--writable'),/Supply/);
+});