@jc_stack/ez-agents 0.1.0-beta.31 → 0.1.0-beta.33

package/src/task-cli.ts

@@ -3,14 +3,17 @@ import { readFile } from 'node:fs/promises'
 import { taskCall } from './task-rpc.js'
 const { values, positionals } = parseArgs({ allowPositionals: true, options: {
   source: { type: 'string' }, contact: { type: 'string' }, purpose: { type: 'string' },
-  'context-file': { type: 'string' }, hours: { type: 'string' }, id: { type: 'string' }, help: { type: 'boolean' }, 'incoming-only': { type: 'boolean' }, 'until-revoked': { type: 'boolean' },
+  'context-file': { type: 'string' }, 'capability-file': { type: 'string' }, hours: { type: 'string' }, id: { type: 'string' }, help: { type: 'boolean' },
+  'incoming-only': { type: 'boolean' }, 'until-revoked': { type: 'boolean' }, 'any-conversation': { type: 'boolean' },
 } })
-if (values.help) { console.log('ezenciel-agents-task propose --source NAME --contact EXACT_ID --purpose TEXT --context-file FILE --hours 24 [--incoming-only [--until-revoked]] | list | revoke --id TASK_ID'); console.log(await readFile(new URL('../docs/selective-monitoring.md', import.meta.url), 'utf8')) }
+if (values.help) { console.log('ezenciel-agents-task propose --source NAME (--contact EXACT_ID | --any-conversation) --purpose TEXT --context-file FILE [--capability-file FILE] --hours 24 [--incoming-only [--until-revoked]] | list | revoke --id TASK_ID'); console.log(await readFile(new URL('../docs/selective-monitoring.md', import.meta.url), 'utf8')) }
 else {
   if (!process.env.EZ_CONTROL_DIR || !process.env.EZ_RUN_ID) throw new Error('Run from the current owner turn')
+  const anyConversation = values['any-conversation'] === true
   console.log(JSON.stringify(await taskCall(process.env.EZ_CONTROL_DIR, process.env.EZ_RUN_ID, 'owner', positionals[0], {
-    sourceId: values.source, conversationId: values.contact, purpose: values.purpose,
+    sourceId: values.source, conversationId: anyConversation ? '*' : values.contact, purpose: values.purpose,
     context: values['context-file'] ? await readFile(values['context-file'], 'utf8') : undefined,
-    untilRevoked: values['until-revoked'], waitForIncoming: values['incoming-only'], hours: Number(values.hours || 24), taskId: values.id,
+    capabilities: values['capability-file'] ? JSON.parse(await readFile(values['capability-file'], 'utf8')) : undefined,
+    anyConversation, untilRevoked: anyConversation || values['until-revoked'], waitForIncoming: anyConversation || values['incoming-only'], hours: Number(values.hours || 24), taskId: values.id,
   })))
 }

package/src/task-executor.ts

@@ -32,14 +32,18 @@ export function taskArguments(directory: string, broker: string[], prompt: strin
     '-c', 'default_permissions="ez-task"',
     '-c', `permissions.ez-task.filesystem={":root"="deny",":minimal"="read",${JSON.stringify(directory)}="write"}`,
     '-c', 'permissions.ez-task.network.enabled=false',
-    '-c', `mcp_servers.ez={command=${JSON.stringify(broker[0])},args=${JSON.stringify(broker.slice(1))},required=true,enabled_tools=${JSON.stringify(toolNames)}}`,
+    // The trusted broker needs the host's CLI configuration; the model keeps its isolated HOME.
+    '-c', `mcp_servers.ez={command=${JSON.stringify(broker[0])},args=${JSON.stringify(broker.slice(1))},env={HOME=${JSON.stringify(homedir())}},required=true,enabled_tools=${JSON.stringify(toolNames)}}`,
     ...toolNames.flatMap(name => ['-c', `mcp_servers.ez.tools.${name}.approval_mode="approve"`]),
     '-'] // Literal input travels on stdin, including slash commands and leading options.
 }
 export async function startTaskExecutor(options: ExecutorOptions) {
   const run = await new RunStore(options.controlDir).get(options.runId)
   if (!run || run.status !== 'running') throw new Error('No active task run')
-  await new Tasks(options.controlDir).authorize(run, false)
+  const task = await new Tasks(options.controlDir).authorize(run, false)
+  const capabilityNames = (task.capabilities ?? []).map(item => `capability_${item.id}`)
+  const toolNames = [...(task.anyConversation ? ['context','send'] : ['context','send','note','report','complete']),...capabilityNames]
+  if (capabilityNames.length && !options.toolsHome) throw new Error('Channel capabilities require an installed tool registry')
   const environment = executorEnvironment()
   const version = await promisify(execFile)('codex', ['--version'], { env: environment })
   if (version.stdout.trim() !== `codex-cli ${TASK_CODEX_VERSION}`) throw new Error(`Restricted tasks require audited Codex ${TASK_CODEX_VERSION}`)
@@ -51,9 +55,9 @@ export async function startTaskExecutor(options: ExecutorOptions) {
     await writeFile(join(temporary, 'models.json'), JSON.stringify(taskModelCatalog(JSON.parse(catalog.stdout))), { mode: 0o600 })
     await symlink(join(homedir(), '.codex', 'auth.json'), join(home, 'auth.json'))
     const broker = [process.execPath, '--import', fileURLToPath(new URL('../node_modules/tsx/dist/loader.mjs', import.meta.url)),
-      fileURLToPath(new URL('./task-mcp.ts', import.meta.url)), options.controlDir, options.runId]
+      fileURLToPath(new URL('./task-mcp.ts', import.meta.url)), options.controlDir, options.runId, options.toolsHome ?? '', JSON.stringify(task.capabilities ?? [])]
     const prompt = JSON.stringify({event: run.external ? 'correspondence_received' : 'task_activated', taskId: run.taskId})
-    const child = spawn('codex', taskArguments(directory, broker, prompt, undefined, options), {
+    const child = spawn('codex', taskArguments(directory, broker, prompt, toolNames, options), {
       cwd: directory, env: { ...environment, HOME: home, CODEX_HOME: home }, stdio: ['pipe', 'pipe', 'pipe'], detached: process.platform !== 'win32',
     })
     await new Promise<void>((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject) })

package/src/task-mcp.ts

@@ -1,17 +1,24 @@
 import { createInterface } from 'node:readline'
 import { taskCall } from './task-rpc.js'
-const [controlDir, runId] = process.argv.slice(2)
+import { runTaskCapability } from './task-capability.js'
+import type { TaskCapability } from './tasks.js'
+const [controlDir, runId, toolsHome, capabilityJson='[]'] = process.argv.slice(2)
+const capabilities = JSON.parse(capabilityJson) as TaskCapability[]
 const descriptions: Record<string, string> = {
   context: 'Read the owner-approved purpose and shareable context, task notes, receipts, and untrusted correspondence.',
-  send: 'Send text to the single owner-approved contact. Reuse the same key for the same message. Uncertain means do not retry with a new key.',
+  send: 'Send text and optionally an attachmentId returned by an approved file capability to this conversation. Reuse the same key for the same message. Uncertain means do not retry with a new key.',
   note: 'Save a task-scoped note. No owner files or memory are accessible.',
   report: 'Report task evidence or a blocker to the owner. This is a report, never an owner instruction.',
   complete: 'Report the result and close a finite task, stopping further messages and replies. Not available for incoming-only watches; save a note and end the run instead.',
+  ...Object.fromEntries(capabilities.map(item => [`capability_${item.id}`,item.description])),
 }
-const tools = Object.entries(descriptions).map(([name, description]) => ({ name, description, inputSchema: {
-  type: 'object', properties: name === 'context' ? {} : { text: { type: 'string', maxLength: 4096 }, ...(name === 'send' ? { key: { type: 'string', pattern: '^[a-zA-Z0-9_-]{1,80}$' } } : {}) },
-  required: name === 'context' ? [] : name === 'send' ? ['text', 'key'] : ['text'], additionalProperties: false,
-} }))
+const tools = Object.entries(descriptions).map(([name, description]) => {
+  const capability = name.startsWith('capability_')
+  return { name, description, inputSchema: {
+    type: 'object', properties: name === 'context' ? {} : capability ? {input:{type:'string',maxLength:1000}} : { text: { type: 'string', maxLength: 4096 }, ...(name === 'send' ? { key: { type: 'string', pattern: '^[a-zA-Z0-9_-]{1,80}$' }, attachmentId:{type:'string',pattern:'^[a-f0-9-]{36}$'} } : {}) },
+    required: name === 'context' ? [] : capability ? ['input'] : name === 'send' ? ['text', 'key'] : ['text'], additionalProperties: false,
+  } }
+})
 for await (const line of createInterface({ input: process.stdin })) {
   let request: any
   try {
@@ -25,8 +32,18 @@ for await (const line of createInterface({ input: process.stdin })) {
       const name = request.params?.name
       if (!Object.hasOwn(descriptions, name)) throw new Error('Unknown task tool')
       const args = request.params.arguments ?? {}
-      if (Object.keys(args).some(key => !['text', ...(name === 'send' ? ['key'] : [])].includes(key))) throw new Error('Unexpected tool argument')
-      try { result = { content: [{ type: 'text', text: JSON.stringify(await taskCall(controlDir, runId, 'worker', name, args)) }] } }
+      const capabilityId = typeof name === 'string' && name.startsWith('capability_') ? name.slice(11) : undefined
+      if (Object.keys(args).some(key => capabilityId ? key !== 'input' : !['text', ...(name === 'send' ? ['key','attachmentId'] : [])].includes(key))) throw new Error('Unexpected tool argument')
+      try {
+        let data: unknown
+        if (capabilityId) {
+          const begun = await taskCall(controlDir,runId,'worker','capability_begin',{id:capabilityId,input:args.input}) as {capability:TaskCapability;lease:string}
+          const result = await runTaskCapability(toolsHome || undefined,begun.capability,args.input,{controlDir,runId,lease:begun.lease})
+          await taskCall(controlDir,runId,'worker','capability_result',{id:capabilityId,input:args.input,lease:begun.lease,...('attachment' in result?{attachment:result.attachment}:{})})
+          data = result.attachment ? {attachmentId:result.attachment.id,filename:result.attachment.filename,bytes:result.attachment.bytes} : result
+        } else data = await taskCall(controlDir, runId, 'worker', name, args)
+        result = { content: [{ type: 'text', text: JSON.stringify(data) }] }
+      }
       catch (error) { result = { isError: true, content: [{ type: 'text', text: error instanceof Error ? error.message : 'Task tool failed' }] } }
     } else throw new Error('Unsupported MCP method')
     process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result }) + '\n')

package/src/tasks.ts

@@ -1,22 +1,42 @@
 import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { randomUUID, createHash } from 'node:crypto'
-import { ControlStore, type Owner } from './control-state.js'
+import { ControlStore, sameOwner, ownerId, ownerEpoch, type Owner } from './control-state.js'
 import { ApprovalStore } from './approval.js'
 import { EventSources, sourceCall, type SourceEvent } from './event-sources.js'
 import { RunStore, type RunRecord } from './runs.js'
 import { requireOwnerExecution } from './execution-authority.js'
 import { ownsRun } from './identity.js'
+import {readTaskAttachment,type TaskAttachment} from './task-attachments.js'
 
+export type TaskCapability = { id: string; description: string; command: string; args: string[]; output?:'file' }
+type PublicBudget = {windowStartedAt:number;runs:number;responses:number;totalRuns:number;totalResponses:number}
+const validPublicBudget = (value: unknown): value is PublicBudget => {
+  if (!value || typeof value !== 'object') return false
+  const budget = value as Record<string, unknown>
+  return Object.keys(budget).length === 5 && ['windowStartedAt','runs','responses','totalRuns','totalResponses']
+    .every(key => Number.isSafeInteger(budget[key]) && Number(budget[key]) >= 0)
+}
 export type Task = {
-  version: 1 | 2 | 3; waitForIncoming?: true; untilRevoked?: true; unwatchPending?: true; id: string; runId: string; owner: Owner
+  version: 1 | 2 | 3 | 4; waitForIncoming?: true; untilRevoked?: true; anyConversation?: true; capabilities?: TaskCapability[]; unwatchPending?: true; id: string; runId: string; owner: Owner
   sourceId: string; bindingId: string; accountId: string; conversationId: string
   purpose: string; context: string; createdAt: number; expiresAt: number
   state: 'pending' | 'active' | 'revoked' | 'completed'
-  notes: string[]; operations: Record<string, { text: string; state: 'uncertain' | 'accepted'; receipt?: unknown }>
+  notes: string[]; operations: Record<string, { text: string; attachmentId?:string; state: 'uncertain' | 'accepted'; receipt?: unknown }>
+  capabilityOperations?: Record<string, { capabilityId: string; inputHash: string; lease: string; attachment?:TaskAttachment; state: 'authorized' | 'completed' }>
+  publicBudget?: PublicBudget
 }
 const idOK = (v: unknown): v is string => typeof v === 'string' && /^task_[a-f0-9]{32}$/.test(v)
 const bounded = (v: unknown, max: number): v is string => typeof v === 'string' && v.trim().length > 0 && v.length <= max
+const capability = (value: unknown): value is TaskCapability => {
+  const item = value as TaskCapability | undefined
+  return !!item && typeof item === 'object' && Object.keys(item).every(key => ['id','description','command','args','output'].includes(key)) &&
+    (item.output===undefined||item.output==='file') &&
+    typeof item.id === 'string' && /^[a-z][a-z0-9_]{0,31}$/.test(item.id) && bounded(item.description,200) && !/[\x00-\x1f\x7f]/.test(item.description) &&
+    typeof item.command === 'string' && /^[a-zA-Z0-9_-]{1,100}$/.test(item.command) && Array.isArray(item.args) && item.args.length >= 2 && item.args.length <= 20 &&
+    item.args.every(arg => typeof arg === 'string' && arg.length <= 200 && !/[\x00-\x1f\x7f]/.test(arg)) && item.args.at(-2) === '--' && item.args.at(-1) === '{input}' &&
+    item.args.filter(arg => arg === '{input}').length === 1
+}
 export async function atomicTaskFile(file: string, value: unknown) {
   const temporary = `${file}.${randomUUID()}.tmp`
   await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: 'wx' })
@@ -33,11 +53,14 @@ export class Tasks {
     if (!idOK(id)) throw new Error('Invalid task ID')
     try {
       const task: Task = JSON.parse(await readFile(join(this.directory, `${id}.json`), 'utf8'))
-      if (!((task.version === 1 && task.waitForIncoming === undefined && task.untilRevoked === undefined) || (task.version === 2 && task.waitForIncoming === true && task.untilRevoked === undefined) || (task.version === 3 && task.waitForIncoming === true && task.untilRevoked === true && task.expiresAt === 8640000000000000)) || task.id !== id || !bounded(task.sourceId, 100) || !bounded(task.bindingId, 100) ||
+      if (!((task.version === 1 && task.waitForIncoming === undefined && task.untilRevoked === undefined && task.anyConversation === undefined) || (task.version === 2 && task.waitForIncoming === true && task.untilRevoked === undefined && task.anyConversation === undefined) || (task.version === 3 && task.waitForIncoming === true && task.untilRevoked === true && task.anyConversation === undefined && task.expiresAt === 8640000000000000) ||
+        (task.version === 4 && task.waitForIncoming === true && task.untilRevoked === true && task.anyConversation === true && task.conversationId === '*' && task.expiresAt === 8640000000000000)) ||
+        (task.capabilities !== undefined && (!Array.isArray(task.capabilities) || task.capabilities.length < 1 || task.capabilities.length > 8 || new Set(task.capabilities.map(item => item.id)).size !== task.capabilities.length || task.capabilities.some(item => !capability(item)))) || task.id !== id || !bounded(task.sourceId, 100) || !bounded(task.bindingId, 100) ||
         !bounded(task.accountId, 200) || !bounded(task.conversationId, 200) || !bounded(task.purpose, 1000) ||
         !bounded(task.context, 6000) || !Number.isFinite(task.createdAt) || !Number.isFinite(task.expiresAt) ||
         !['pending', 'active', 'revoked', 'completed'].includes(task.state) || !Array.isArray(task.notes) ||
-        !task.operations || typeof task.operations !== 'object' || !task.owner) throw new Error('Invalid task record')
+        !task.operations || typeof task.operations !== 'object' || (task.capabilityOperations !== undefined && (!task.capabilityOperations || typeof task.capabilityOperations !== 'object')) ||
+        (task.anyConversation && !validPublicBudget(task.publicBudget)) || !task.owner) throw new Error('Invalid task record')
       return task
     } catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null; throw error }
   }
@@ -55,8 +78,7 @@ export class Tasks {
   }
   private async source(task: Task) {
     const owner = (await new ControlStore(this.controlDir, 900000).status()).owner
-    if (!owner || owner.telegramUserId !== task.owner.telegramUserId || owner.telegramChatId !== task.owner.telegramChatId)
-      throw new Error('Task owner is no longer paired')
+    if (!owner || !sameOwner(task.owner, owner)) throw new Error('Task owner is no longer paired')
     const source = (await new EventSources(this.controlDir).available(owner)).find(s => s.id === task.sourceId && s.bindingId === task.bindingId)
     if (!source) throw new Error('Task source was removed or replaced')
     const head = await sourceCall(source.socketPath, 'events-head')
@@ -66,27 +88,43 @@ export class Tasks {
   async authorize(run: RunRecord, checkProvider = true): Promise<Task> {
     const task = run.taskId ? await this.get(run.taskId) : null
     if (!task || (task.waitForIncoming && !run.external) || task.state !== 'active' || task.expiresAt <= Date.now() || run.version !== 2 ||
-      run.chatId !== task.owner.telegramChatId || run.telegramUserId !== task.owner.telegramUserId)
+      !ownsRun(task.owner, run))
       throw new Error('Task is inactive or expired')
     const owner = (await new ControlStore(this.controlDir, 900000).status()).owner
     const approval = await new ApprovalStore(this.controlDir).getDecision(task.id)
-    if (!owner || owner.telegramUserId !== task.owner.telegramUserId || owner.telegramChatId !== task.owner.telegramChatId ||
-      approval?.decision !== 'approved' || !ownsRun(owner, {telegramUserId: approval.decidedBy!, chatId: task.owner.telegramChatId}) || approval.runId !== task.runId || approval.prompt !== this.prompt(task))
+    const approvedByOwner = approval?.version === 2
+      ? approval.decidedOwnerId === ownerId(task.owner) && approval.decidedOwnerEpoch === ownerEpoch(task.owner)
+      : !!owner && ownsRun(owner,{telegramUserId:approval?.decidedBy!,chatId:task.owner.telegramChatId})
+    if (!sameOwner(task.owner, owner) || approval?.decision !== 'approved' || !approvedByOwner || approval.runId !== task.runId || approval.prompt !== this.prompt(task))
       throw new Error('Task approval is no longer valid')
     if (checkProvider) await this.source(task)
     if (run.external && checkProvider) {
       if (run.external.sourceId !== task.sourceId || run.external.bindingId !== task.bindingId) throw new Error('Task origin mismatch')
       const events = await new EventSources(this.controlDir).check(run.external, task.owner)
-      if (events.length !== run.external.eventIds.length || events.some(e => e.conversationId !== task.conversationId || e.receivedAt < task.createdAt))
+      if (events.length !== run.external.eventIds.length || new Set(events.map(event => event.conversationId)).size !== 1 || events.some(e =>
+        (!task.anyConversation && e.conversationId !== task.conversationId) || e.receivedAt < task.createdAt))
         throw new Error('Task correspondence no longer matches')
     }
     return task
   }
   async match(sourceId: string, bindingId: string, events: SourceEvent[]) {
+    if (!events.length || new Set(events.map(event => event.conversationId)).size !== 1) return
     const matches = (await this.list()).filter(t => t.state === 'active' && t.expiresAt > Date.now() &&
-      t.sourceId === sourceId && t.bindingId === bindingId && events.every(e => e.conversationId === t.conversationId && e.receivedAt >= t.createdAt))
+      t.sourceId === sourceId && t.bindingId === bindingId && events.every(e =>
+        (t.anyConversation || e.conversationId === t.conversationId) && e.receivedAt >= t.createdAt))
     return matches.length === 1 ? matches[0] : undefined
   }
+  async admitPublic(id:string):Promise<'admitted'|'defer'|'revoked'> {
+    return this.serial(async()=>{
+      const task=await this.get(id)
+      if(!task?.anyConversation||task.state!=='active')return 'revoked'
+      const now=Date.now(),budget=task.publicBudget!
+      if(now-budget.windowStartedAt>=3600000){budget.windowStartedAt=now;budget.runs=0;budget.responses=0}
+      if(budget.totalRuns>=1000||budget.totalResponses>=1000){task.state='revoked';task.unwatchPending=true;await this.save(task);await this.unwatch(task);return 'revoked'}
+      if(budget.runs>=60)return 'defer'
+      budget.runs++;budget.totalRuns++;await this.save(task);return 'admitted'
+    })
+  }
   private async unwatch(task: Task) {
     const source=await this.source(task)
     await sourceCall(source.socketPath,'task-unwatch',{accountId:task.accountId,conversationId:task.conversationId})
@@ -116,7 +154,9 @@ export class Tasks {
     })
   }
   private prompt(task: Task) {
-    return `Allow this messaging task?${task.waitForIncoming ? '\nWait for incoming messages; do not initiate contact.' : ''}\nSource: ${task.sourceId}\nAccount: ${task.accountId}\nContact: ${task.conversationId}\nPurpose: ${task.purpose}\nShared context (all may be disclosed to this contact):\n${task.context}\n${task.untilRevoked ? 'Enabled until owner revocation.' : `Expires: ${new Date(task.expiresAt).toISOString()}`}\nText messages only. No payments, files, other contacts, or settings changes.`
+    const audience = task.anyConversation ? `Any human conversation received by source ${task.sourceId}` : `Contact: ${task.conversationId}`
+    const capabilities = task.capabilities ? `\nApproved capabilities (their output may be disclosed):\n${task.capabilities.map(item => `- ${item.id}: ${item.description}; ez ${item.command} ${item.args.join(' ')}`).join('\n')}` : ''
+    return `Allow this messaging task?${task.waitForIncoming ? '\nWait for incoming messages; do not initiate contact.' : ''}\nSource: ${task.sourceId}\nAccount: ${task.accountId}\nAudience: ${audience}\nPurpose: ${task.purpose}\nShared context (all may be disclosed to this audience):\n${task.context}${capabilities}\n${task.anyConversation ? 'Budget: 60 conversations and 60 responses per hour; 1000 total, then owner review.' : ''}\n${task.untilRevoked ? 'Enabled until owner revocation.' : `Expires: ${new Date(task.expiresAt).toISOString()}`}\n${task.capabilities?.some(item=>item.output==='file') ? 'Text and files returned by the approved file capabilities only. No payments, owner memory, unlisted capabilities, or settings changes.' : 'Text messages only. No payments, files, owner memory, unlisted capabilities, or settings changes.'}`
   }
   async ownerCall(runId: string, command: string, args: Record<string, unknown>) {
     return this.serial(async () => {
@@ -130,12 +170,28 @@ export class Tasks {
         task.state = 'revoked'
         if(task.untilRevoked) task.unwatchPending=true
         await this.save(task)
+        const runStore = new RunStore(this.controlDir)
+        for (const candidate of await runStore.list()) if(candidate.taskId===task.id && candidate.status==='queued') {
+          await runStore.patch(candidate.id,{status:'cancelled',endedAt:new Date().toISOString()})
+          if(candidate.external)try {
+            await new EventSources(this.controlDir).release(candidate.external,task.owner)
+            await runStore.patch(candidate.id,{externalReleased:true})
+          } catch { /* The relay retries unreleased terminal events. */ }
+        }
+        await runStore.pruneTaskHistory(task.id)
         if(task.unwatchPending) await this.unwatch(task)
         return { id: task.id, state: task.state }
       }
       if (command !== 'propose') throw new Error('Unknown owner task command')
       if (args.waitForIncoming !== undefined && typeof args.waitForIncoming !== 'boolean') throw new Error('Invalid incoming-only option')
       if (args.untilRevoked !== undefined && (typeof args.untilRevoked !== 'boolean' || (args.untilRevoked && args.waitForIncoming !== true))) throw new Error('Persistent permission requires incoming-only mode')
+      if (args.anyConversation !== undefined && typeof args.anyConversation !== 'boolean') throw new Error('Invalid any-conversation option')
+      const capabilities = args.capabilities === undefined ? undefined : args.capabilities
+      if (capabilities !== undefined && (!Array.isArray(capabilities) || capabilities.length < 1 || capabilities.length > 8 || new Set(capabilities.map((item: any) => item?.id)).size !== capabilities.length || capabilities.some(item => !capability(item))))
+        throw new Error('Supply one to eight valid channel capabilities')
+      if (capabilities && args.waitForIncoming !== true) throw new Error('Channel capabilities require incoming-only mode')
+      if (args.anyConversation && (args.conversationId !== '*' || args.waitForIncoming !== true || args.untilRevoked !== true))
+        throw new Error('Any-conversation access requires contact *, incoming-only, and until-revoked')
       if (!bounded(args.sourceId, 100) || !bounded(args.conversationId, 200) || !bounded(args.purpose, 1000) || !bounded(args.context, 6000) ||
         typeof args.hours !== 'number' || !Number.isFinite(args.hours) || args.hours <= 0 || args.hours > 72) throw new Error('Invalid task proposal (maximum 72 hours)')
       const owner = (await new ControlStore(this.controlDir, 900000).status()).owner!
@@ -143,10 +199,12 @@ export class Tasks {
       if (!source) throw new Error('Unknown source')
       const head = await sourceCall(source.socketPath, 'events-head')
       if (args.untilRevoked && head.persistentWatch !== true) throw new Error('Source needs persistent-watch support before enabling an ongoing conversation')
+      if (args.anyConversation && head.wildcardWatch !== true) throw new Error('This channel source does not support any-conversation access')
       if (head.taskProtocol !== 'message-v1' || !bounded(head.accountId, 200)) throw new Error('Source does not support task messaging')
-      if ((await this.list()).some(t => ((['active', 'pending'].includes(t.state) && t.expiresAt > Date.now()) || t.unwatchPending) && t.sourceId === source.id && t.conversationId === args.conversationId))
+      if ((await this.list()).some(t => ((['active', 'pending'].includes(t.state) && t.expiresAt > Date.now()) || t.unwatchPending) && t.sourceId === source.id &&
+        (t.conversationId === args.conversationId || t.anyConversation || args.anyConversation)))
         throw new Error('This contact already has a task; complete or revoke it first')
-      const task: Task = { version: args.untilRevoked ? 3 : args.waitForIncoming ? 2 : 1, ...(args.untilRevoked ? {untilRevoked:true as const} : {}), ...(args.waitForIncoming ? { waitForIncoming: true as const } : {}), id: `task_${randomUUID().replaceAll('-', '')}`, runId, owner, sourceId: source.id,
+      const task: Task = { version: args.anyConversation ? 4 : args.untilRevoked ? 3 : args.waitForIncoming ? 2 : 1, ...(args.untilRevoked ? {untilRevoked:true as const} : {}), ...(args.waitForIncoming ? { waitForIncoming: true as const } : {}), ...(args.anyConversation ? {anyConversation:true as const,publicBudget:{windowStartedAt:Date.now(),runs:0,responses:0,totalRuns:0,totalResponses:0}} : {}), ...(capabilities ? {capabilities} : {}), id: `task_${randomUUID().replaceAll('-', '')}`, runId, owner, sourceId: source.id,
         bindingId: source.bindingId, accountId: head.accountId, conversationId: args.conversationId, purpose: args.purpose,
         context: args.context, createdAt: Date.now(), expiresAt: args.untilRevoked ? 8640000000000000 : Date.now() + args.hours * 3600000, state: 'pending', notes: [], operations: {} }
       if (this.prompt(task).length > 3500) throw new Error('Proposal is too long for owner review; shorten the shared context')
@@ -162,46 +220,94 @@ export class Tasks {
       const run = await new RunStore(this.controlDir).get(runId)
       if (!run || run.status !== 'running') throw new Error('No active task run')
       const task = await this.authorize(run)
+      const incoming = run.external ? await new EventSources(this.controlDir).check(run.external, task.owner) : []
+      const contact = task.anyConversation ? incoming[0]?.conversationId : task.conversationId
+      if (!contact || incoming.some(event => event.conversationId !== contact)) throw new Error('Task correspondence changed')
       if (command === 'context') {
-        const incoming = run.external ? await new EventSources(this.controlDir).check(run.external, task.owner) : []
-        if (incoming.some(e => e.conversationId !== task.conversationId || e.receivedAt < task.createdAt)) throw new Error('Task correspondence changed')
-        return { purpose: task.purpose, context: task.context, contact: task.conversationId,
-        waitForIncoming: task.waitForIncoming === true,
+        return { purpose: task.purpose, context: task.context, contact,
+        waitForIncoming: task.waitForIncoming === true, capabilities: task.capabilities?.map(({id,description}) => ({id,description})),
         expiresAt: task.untilRevoked ? null : task.expiresAt, notes: task.notes, operations: task.untilRevoked ? Object.fromEntries(Object.entries(task.operations).filter(([key])=>key.startsWith(`${run.id}_`))) : task.operations,
         incoming }
       }
+      if (command === 'capability_begin' || command === 'capability_result') {
+        const selected = task.capabilities?.find(item => item.id === args.id)
+        if (!selected || !bounded(args.input, 1000)) throw new Error('Channel capability is not authorized or has invalid input')
+        const inputHash = createHash('sha256').update(args.input).digest('hex')
+        const key = `${run.id}_${selected.id}_${inputHash}`
+        const prior = task.capabilityOperations?.[key]
+        if (command === 'capability_result') {
+          if (!prior || prior.lease !== args.lease) throw new Error('Channel capability lease is invalid')
+          if(selected.output==='file') {
+            const file=args.attachment as TaskAttachment
+            if(file?.runId!==run.id||file?.id!==prior.lease)throw Error('Attachment lease mismatch')
+            await readTaskAttachment(this.controlDir,file)
+            prior.attachment=file
+          }else if(args.attachment!==undefined)throw Error('Text capability cannot register an attachment')
+          prior.state = 'completed'; await this.save(task); return {accepted:true}
+        }
+        if (prior) return {capability:selected,lease:prior.lease}
+        const active=(await new RunStore(this.controlDir).list()).filter(item=>item.taskId===task.id&&['queued','running'].includes(item.status)).map(item=>`${item.id}_`)
+        task.capabilityOperations = Object.fromEntries(Object.entries(task.capabilityOperations ?? {}).filter(([item]) => active.some(prefix=>item.startsWith(prefix))))
+        if (Object.keys(task.capabilityOperations ?? {}).filter(item => item.startsWith(`${run.id}_`)).length >= 8) throw new Error('Channel capability limit reached')
+        const operation = {capabilityId:selected.id,inputHash,lease:randomUUID(),state:'authorized' as const}
+        task.capabilityOperations = {...task.capabilityOperations,[key]:operation}
+        await this.save(task)
+        return {capability:selected,lease:operation.lease}
+      }
       if (!bounded(args.text, 4096)) throw new Error('Supply text (maximum 4096 characters)')
       if (command === 'note') {
+        if (task.anyConversation) throw new Error('Any-conversation tasks do not retain cross-conversation notes')
         if (task.untilRevoked) while (task.notes.join('').length + args.text.length > 16000) task.notes.shift()
         if (task.notes.join('').length + args.text.length > 16000) throw new Error('Task notes are full')
         task.notes.push(args.text); await this.save(task); return { saved: true }
       }
       if (command === 'complete' && task.waitForIncoming) throw new Error('This incoming-only watch stays active until expiry or owner revocation. Save a note and end this run; do not close the watch after replying.')
       if (command === 'report' || command === 'complete') {
-        const item = await new RunStore(this.controlDir).enqueueMessage(run.id, `Task ${task.id} (${task.conversationId}) reports:\n${args.text}`)
+        const item = await new RunStore(this.controlDir).enqueueMessage(run.id, `Task ${task.id} (${contact}) reports:\n${args.text}`)
         if (command === 'complete') { task.state = 'completed'; await this.save(task) }
         return { queued: item.id }
       }
       if (command !== 'send' || typeof args.key !== 'string' || !/^[a-zA-Z0-9_-]{1,80}$/.test(args.key)) throw new Error('Invalid task send')
+      let attachment:TaskAttachment|undefined
+      if(args.attachmentId!==undefined) {
+        const operation=Object.entries(task.capabilityOperations??{}).find(([key,value])=>key.startsWith(`${run.id}_`)&&value.lease===args.attachmentId&&value.state==='completed')?.[1]
+        attachment=operation?.attachment
+        if(!attachment||attachment.runId!==run.id)throw Error('Attachment is not authorized for this run')
+      }
       const key = task.untilRevoked ? `${run.id}_${args.key}` : args.key
       const providerKey = `${task.id}_${task.untilRevoked ? createHash('sha256').update(key).digest('hex') : key}`
       const prior = Object.hasOwn(task.operations, key) ? task.operations[key] : undefined
       if (prior) {
-        if (prior.text !== args.text) throw new Error('Message key already used for different text')
+        if (prior.text !== args.text || prior.attachmentId!==args.attachmentId) throw new Error('Message key already used for different text or attachment')
         return prior // Uncertain sends are never blindly retried.
       }
+      const source = await this.source(task)
+      if(attachment) {
+        const head=await sourceCall(source.socketPath,'events-head')
+        if(head.taskAttachments!==true)throw Error('This channel does not support task attachments')
+        if(Number.isSafeInteger(head.attachmentCaptionLimit)&&args.text.length>head.attachmentCaptionLimit)throw Error(`Attachment caption exceeds channel limit of ${head.attachmentCaptionLimit}`)
+        await readTaskAttachment(this.controlDir,attachment)
+      }
+      if(task.anyConversation){const budget=task.publicBudget!,now=Date.now();if(now-budget.windowStartedAt>=3600000){budget.windowStartedAt=now;budget.runs=0;budget.responses=0}
+        if(budget.responses>=60||budget.totalResponses>=1000)throw new Error('Public response budget reached; owner review is required')
+        budget.responses++;budget.totalResponses++;await this.save(task)}
+      if(task.untilRevoked) {
+        const active=(await new RunStore(this.controlDir).list()).filter(item=>item.taskId===task.id&&['queued','running'].includes(item.status)).map(item=>`${item.id}_`)
+        task.operations=Object.fromEntries(Object.entries(task.operations).filter(([item,value])=>active.some(prefix=>item.startsWith(prefix))||value.state==='uncertain'))
+      }
       if (Object.keys(task.operations).filter(k=>!task.untilRevoked || k.startsWith(`${run.id}_`)).length >= 30) throw new Error('Task message limit reached; report to the owner')
-      task.operations = { ...task.operations, [key]: { text: args.text, state: 'uncertain' } }
+      const message={text:args.text,...(attachment?{attachmentId:attachment.id}:{})}
+      task.operations = { ...task.operations, [key]: { ...message, state: 'uncertain' } }
       await this.save(task)
-      const source = await this.source(task)
       try {
         if (task.expiresAt <= Date.now()) throw new Error('Task expired before dispatch')
         const receipt = await sourceCall(source.socketPath, 'task-send', {
-          accountId: task.accountId, conversationId: task.conversationId, text: args.text, key: providerKey,
+          accountId: task.accountId, conversationId: contact, text: args.text, key: providerKey,
+          ...(attachment?{attachment}:{}),
         })
-        if (receipt.accountId !== task.accountId || receipt.conversationId !== task.conversationId || receipt.key !== providerKey || receipt.state !== 'accepted')
+        if (receipt.accountId !== task.accountId || receipt.conversationId !== contact || receipt.key !== providerKey || receipt.state !== 'accepted')
           throw new Error('Uncertain provider receipt')
-        task.operations = { ...task.operations, [key]: { text: args.text, state: 'accepted', receipt } }
+        task.operations = { ...task.operations, [key]: { ...message, state: 'accepted', receipt } }
         await this.save(task)
       } catch { /* Preserve uncertain across timeouts, crashes, and malformed receipts. */ }
       return task.operations[key]

package/src/telegram-source.ts

@@ -7,6 +7,7 @@ import { atomicTaskFile } from './tasks.js'
 import { EventSources, type SourceEvent } from './event-sources.js'
 import type { Owner } from './control-state.js'
 import type { Message, User } from 'grammy/types'
+import {readTaskAttachment,type TaskAttachment} from './task-attachments.js'
 
 // Provider transport only. The existing Tasks grant remains the execution and
 // disclosure authority, exactly as for a registered WhatsApp source.
@@ -15,7 +16,7 @@ export class TelegramSource {
   private server?: Server
   private pending?: Promise<void>
   private serial: Promise<unknown> = Promise.resolve()
-  constructor(private controlDir: string, private accountId: string, private send: (chatId: number, text: string) => Promise<number[]>) {
+  constructor(private controlDir: string, private accountId: string, private send: (chatId: number, text: string) => Promise<number[]>, private sendFile?: (chatId:number,text:string,data:Buffer,filename:string)=>Promise<number[]>) {
     this.socketPath = join(tmpdir(), `ez-tg-${createHash('sha256').update(`${controlDir}:${accountId}`).digest('hex').slice(0,16)}.sock`)
   }
   private get directory() { return join(this.controlDir, 'telegram-source', createHash('sha256').update(this.accountId).digest('hex')) }
@@ -43,15 +44,21 @@ export class TelegramSource {
     await new EventSources(this.controlDir).register('telegram',this.socketPath,owner)
   }
   async stop() { if(this.server) await new Promise<void>(resolve=>this.server!.close(()=>resolve())); await rm(this.socketPath,{force:true}) }
-  capture(updateId: number, message: Message.TextMessage, sender: User): Promise<boolean> {
-    const work=this.serial.then(()=>this.captureMessage(updateId,message,sender));this.serial=work.catch(()=>{});return work
+  capture(updateId: number, message: Message.TextMessage, sender: User, wildcardEligible = true): Promise<boolean> {
+    const work=this.serial.then(()=>this.captureMessage(updateId,message,sender,wildcardEligible));this.serial=work.catch(()=>{});return work
   }
-  private async captureMessage(updateId: number, message: Message.TextMessage, sender: User): Promise<boolean> {
+  private async captureMessage(updateId: number, message: Message.TextMessage, sender: User, wildcardEligible: boolean): Promise<boolean> {
     const watches=await this.read('watches.json',{})
-    if (!(watches[String(message.chat.id)]>Date.now())) return false
+    const now=Date.now(),direct=watches[String(message.chat.id)]>now,wildcard=watches['*']>now
+    if (!direct && !wildcard) return false
+    // The active public watch owns admission; consume ineligible group chatter
+    // without turning an owner's message into legacy group discovery.
+    if (!direct && !wildcardEligible) return true
     const event: SourceEvent={id:`tg_${String(message.chat.id).replace('-','n')}_${message.message_id}`,conversationId:String(message.chat.id),receivedAt:message.date*1000,
       text:JSON.stringify({updateId,senderId:sender.id,senderName:sender.first_name,messageId:message.message_id,text:message.text})}
     if (!await this.read(`${event.id}.json`,null)) {
+      const files=(await readdir(this.directory)).filter(file=>/^tg_(?:n)?\d+_\d+\.json$/.test(file))
+      if(files.length>=100)return true
       const cursor=(await this.read('cursor.json',0))+1
       if(!Number.isSafeInteger(cursor)||cursor<1)throw new Error('Invalid event cursor')
       await atomicTaskFile(join(this.directory,'cursor.json'),cursor)
@@ -60,9 +67,14 @@ export class TelegramSource {
     return true
   }
   async call(command: string,args: Record<string,any>) {
-    if(command==='events-head') return {cursor:0,accountId:this.accountId,taskProtocol:'message-v1',persistentWatch:true}
+    if(command==='events-head') return {cursor:0,accountId:this.accountId,taskProtocol:'message-v1',persistentWatch:true,wildcardWatch:true,releaseEvents:true,...(this.sendFile?{taskAttachments:true,attachmentCaptionLimit:1024}:{})}
+    if(command==='events-release') {
+      if(!Array.isArray(args.ids)||args.ids.length>10||args.ids.some((id:unknown)=>typeof id!=='string'||!/^tg_(?:n)?\d+_\d+$/.test(id)))throw new Error('Invalid IDs')
+      for(const id of args.ids)await rm(join(this.directory,`${id}.json`),{force:true})
+      return {released:true}
+    }
     if(command==='events' || command==='events-check') {
-      const files=(await readdir(this.directory)).filter(f=>/^tg_n\d+_\d+\.json$/.test(f))
+      const files=(await readdir(this.directory)).filter(f=>/^tg_(?:n)?\d+_\d+\.json$/.test(f))
       const events=(await Promise.all(files.map(f=>this.read(f,null)))).sort((a,b)=>a.cursor-b.cursor)
       if(command==='events-check') {
         if(!Array.isArray(args.ids)||args.ids.length>10)throw new Error('Invalid IDs')
@@ -72,7 +84,9 @@ export class TelegramSource {
       const batch=events.filter(e=>e.cursor>args.after).slice(0,10)
       return {events:batch,cursor:batch.at(-1)?.cursor??args.after}
     }
-    if(args.accountId!==this.accountId || typeof args.conversationId!=='string' || !/^-\d+$/.test(args.conversationId) || !Number.isSafeInteger(Number(args.conversationId))) throw new Error('Invalid Telegram binding')
+    const wildcard=args.conversationId==='*'
+    const concrete=typeof args.conversationId==='string' && /^-?[1-9]\d*$/.test(args.conversationId) && Number.isSafeInteger(Number(args.conversationId))
+    if(args.accountId!==this.accountId || (!wildcard && !concrete)) throw new Error('Invalid Telegram binding')
     if(command==='task-unwatch') {
       const watches=await this.read('watches.json',{});delete watches[args.conversationId]
       await atomicTaskFile(join(this.directory,'watches.json'),watches);return {watching:false}
@@ -82,13 +96,20 @@ export class TelegramSource {
       const watches=await this.read('watches.json',{});watches[args.conversationId]=args.expiresAt
       await atomicTaskFile(join(this.directory,'watches.json'),watches);return {watching:true}
     }
-    if(command!=='task-send'||typeof args.text!=='string'||!args.text.trim()||args.text.length>4096||typeof args.key!=='string'||!/^[a-zA-Z0-9_-]{1,240}$/.test(args.key))throw new Error('Invalid send')
-    const watches=await this.read('watches.json',{});if(!(watches[args.conversationId]>Date.now()))throw new Error('Watch expired')
+    if(command!=='task-send'||wildcard||typeof args.text!=='string'||!args.text.trim()||args.text.length>4096||typeof args.key!=='string'||!/^[a-zA-Z0-9_-]{1,240}$/.test(args.key))throw new Error('Invalid send')
+    const watches=await this.read('watches.json',{});if(!(watches[args.conversationId]>Date.now())&&!(watches['*']>Date.now()))throw new Error('Watch expired')
     const file=`send_${args.key}.json`,prior=await this.read(file,null)
-    if(prior) {if(prior.text!==args.text||prior.conversationId!==args.conversationId)throw new Error('Key reused');return prior}
-    const receipt={accountId:this.accountId,conversationId:args.conversationId,key:args.key,text:args.text,state:'uncertain',receiptId:[] as number[]}
+    if(prior) {if(prior.text!==args.text||prior.conversationId!==args.conversationId||JSON.stringify(prior.attachment)!==JSON.stringify(args.attachment))throw new Error('Key reused');return prior}
+    const attachment=args.attachment as TaskAttachment|undefined
+    if(attachment && (!this.sendFile||args.text.length>1024))throw Error('Document delivery requires a supported channel and a caption of at most 1024 characters')
+    const bytes=attachment?await readTaskAttachment(this.controlDir,attachment):undefined
+    const receiptFiles=(await readdir(this.directory)).filter(name=>/^send_[a-zA-Z0-9_-]{1,240}\.json$/.test(name))
+    const accepted=(await Promise.all(receiptFiles.map(async name=>({name,value:await this.read(name,null)})))).filter(item=>item.value?.state==='accepted').sort((a,b)=>(a.value.createdAt??'').localeCompare(b.value.createdAt??''))
+    for(const item of accepted.slice(0,Math.max(0,receiptFiles.length-99)))await rm(join(this.directory,item.name),{force:true})
+    if(receiptFiles.length-accepted.length>=100)throw new Error('Too many uncertain Telegram sends')
+    const receipt={accountId:this.accountId,conversationId:args.conversationId,key:args.key,text:args.text,...(attachment?{attachment}:{}),state:'uncertain',createdAt:new Date().toISOString(),receiptId:[] as number[]}
     await atomicTaskFile(join(this.directory,file),receipt)
-    receipt.receiptId=await this.send(Number(args.conversationId),args.text);receipt.state='accepted'
+    receipt.receiptId=attachment?await this.sendFile!(Number(args.conversationId),args.text,bytes!,attachment.filename):await this.send(Number(args.conversationId),args.text);receipt.state='accepted'
     await atomicTaskFile(join(this.directory,file),receipt);return receipt
   }
 }

package/src/updates/artifact.mjs

@@ -59,8 +59,8 @@ export async function extract(buffer,destination) {
   await fs.mkdir(destination,{recursive:true,mode:0o700});
   for(const f of files) {
     const dest=path.join(destination,f.relative);
-    if(f.type==='5'){await fs.mkdir(dest,{recursive:true,mode:0o755});continue;}
-    await fs.mkdir(path.dirname(dest),{recursive:true,mode:0o755});await fs.writeFile(dest,f.data,{flag:'wx',mode:f.mode});
+    if(f.type==='5'){await fs.mkdir(dest,{recursive:true,mode:0o755});await fs.chmod(dest,0o755);continue;}
+    await fs.mkdir(path.dirname(dest),{recursive:true,mode:0o755});await fs.chmod(path.dirname(dest),0o755);await fs.writeFile(dest,f.data,{flag:'wx',mode:f.mode});await fs.chmod(dest,f.mode);
   }
 }
 export async function registryVersion(name,tag='latest') {

package/src/updates/control.mjs

@@ -44,6 +44,14 @@ export async function check(home) {
   }
   return results;
 }
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const same=(left,right)=>JSON.stringify(canonical(left))===JSON.stringify(canonical(right));
+function additiveCommands(previous,next) {
+  const before={...previous,commands:{}},after={...next,commands:{}};
+  if(!same(before,after))return false;
+  for(const [name,command] of Object.entries(previous.commands||{}))if(!same(next.commands?.[name],command))return false;
+  return Object.values(next.commands||{}).every(command=>next.services?.[command.service]);
+}
 export async function eligibility(home,target,root,automatic) {
   const old=await installed(home,target),pkg=await read(path.join(root,'package.json')),kind=target==='main'?'main':'plugin';
   if(pkg.name!==old.pkg.name)throw Error('Package identity mismatch');
@@ -54,7 +62,9 @@ export async function eligibility(home,target,root,automatic) {
   if(kind==='plugin') {
     const s=await snapshot(root);revision=s.revision;
     if(s.manifest.id!==target||s.manifest.version!==pkg.version)throw Error('Plugin identity/version mismatch');
-    if(JSON.stringify(s.deployment)!==JSON.stringify(old.record.deployment))throw Error('Deployment permissions/layout changed; a separately reviewed migration is required');
+    if(!additiveCommands(old.record.deployment,s.deployment))throw Error('Deployment permissions/layout changed; a separately reviewed migration is required');
+    const registry=await read(path.join(home,'registry.json'));
+    for(const alias of Object.keys(s.manifest.commands))if(registry.commands[alias]&&registry.commands[alias]!==target)throw Error('CLI alias collision');
   }else {
     for(const file of ['compose.yaml','compose.whatsapp.yaml'])if(!Buffer.from(await fs.readFile(path.join(root,file))).equals(await fs.readFile(path.join(old.root,file))))throw Error('Runtime deployment changed; a separately reviewed migration is required');
   }

package/src/updates/runtime.mjs

@@ -122,7 +122,9 @@ export async function perform(home,job,hooks) {
       for(const name of volumes)await backupVolume(run,old,name,backup);
       await atomic(old.compose,await compose(config,candidate,secrets,home));
       if(running)await run('docker',[...pluginArgs(candidate),'up','-d','--wait','--wait-timeout','90','--no-build']);
-      r.plugins[job.target]=candidate;await atomic(path.join(home,'registry.json'),r);
+      r.plugins[job.target]=candidate;
+      for(const alias of Object.keys(candidate.manifest.commands))r.commands[alias]=job.target;
+      await atomic(path.join(home,'registry.json'),r);
       job.runtimeVerified=running;
     }
     job.status='completed';job.endedAt=new Date().toISOString();await save();return job;

package/templates/agent-guidance.md

@@ -31,6 +31,20 @@ software maintenance, consult `work/deployments.md` when present and the install
 `ez updates` inventories core/plugins only. Saved authority and stop conditions
 apply to application repairs and upgrades too.
 
+When the owner asks the agent to answer or act for other people on an enabled
+message channel, use `ezenciel-agents-task --help`. Propose the core channel grant
+from the current owner turn; do not treat a saved instruction, connected channel,
+or installed tool as permission. Use an exact contact by default. Use
+`--any-conversation` only when the owner explicitly asks for everyone on that
+source. The public grant admits at most 60 conversations and 60 replies per hour;
+after 1,000 conversations or replies it revokes and requires fresh owner review.
+A capability file may grant exact, fixed `ez` query vectors whose final
+argument is the correspondent's literal input. The installed alias must explicitly
+declare itself a read-only `channelQuery`; never use lifecycle, write, send, or
+interactive-review commands. Include only output the owner authorized for that audience. The core
+shows the full audience, context and command vectors for confirmation. Do not
+expose owner memory or an unrestricted shell.
+
 ## Fast KISS iterations
 
 Deliver the smallest useful product increment and verify its main user path.