@jc_stack/ez-agents 0.1.0-beta.31 → 0.1.0-beta.33

package/test/application-channel.test.ts

@@ -9,7 +9,7 @@ import { randomBytes } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { createRequire } from 'node:module'
 import { ApplicationChannel, ApplicationBindings, applicationScope } from '../src/application-channel.js'
-import { ControlStore } from '../src/control-state.js'
+import { ControlStore, ownerId } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
 import { requireOwnerExecution } from '../src/execution-authority.js'
@@ -85,6 +85,10 @@ test('HTTP auth, idempotency, origin/context isolation, revocation and persisted
   await channel.deliver(run,message)
   assert.deepEqual(await runs.waitForDelivery(message.id),{delivered:true})
   assert.deepEqual((await channel.snapshot(first.bindingId,run.id)).messages,[{id:message.id,text:'Here is the proposal'}])
+  const approval=await runs.enqueueApproval(run.id,'Allow this channel grant?','task_'+'a'.repeat(32))
+  await runs.claimOutbox(approval.id);await channel.deliver(run,approval)
+  assert.deepEqual((await channel.snapshot(first.bindingId,run.id)).approvals,[{id:'task_'+'a'.repeat(32),prompt:'Allow this channel grant?',state:'delivered'}])
+  assert.equal((await request('/v1/approvals/task_'+'a'.repeat(32),secondToken,{decision:'approved'})).status,400)
   await channel.bindings.register('first',null,owned)
   await assert.rejects(requireOwnerExecution(root,run.id),/revoked/)
   await assert.rejects(channel.deliver(run,message),/revoked/)
@@ -281,3 +285,50 @@ test('following Telegram requires an explicit sharing grant and cannot override
   }
   assert.equal((await new RunStore(root).list()).length, 0)
 })
+
+test('generic attachments stage after auth, preserve literal comments and reject retry/isolation failures', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-attachment-'))
+  const owned=await owner(root), runs=new RunStore(root)
+  const channel=new ApplicationChannel({controlDir:root,workspace:root,initial:initialPreset('codex'),wake:()=>{},cancel:async()=>{}})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const secret=token(), other=token()
+  const binding=(await channel.bindings.register('web',secret,owned,true))!
+  await channel.bindings.register('other',other,owned)
+  const address=await channel.listen(0) as {port:number}
+  const post=(body:unknown,bearer=secret)=>fetch(`http://127.0.0.1:${address.port}/v1/runs`,{method:'POST',headers:{Authorization:`Bearer ${bearer}`},body:JSON.stringify(body)})
+  const input={requestId:'image',scope:'chat',followOwner:true,text:'  /goal literal\n comment  ',attachment:{name:'image.png',data:Buffer.from('89504e470d0a1a0a','hex').toString('base64')}}
+  assert.equal((await post(input,'bad')).status,401)
+  const {readdir,stat}=await import('node:fs/promises')
+  await assert.rejects(readdir(join(root,'inbox')),/ENOENT/)
+  for (const [name,bytes] of [['image.png',Buffer.from('89504e470d0a1a0a','hex')],['file.pdf',Buffer.from('%PDF-1.4\nfixture')],['notes.md',Buffer.from('# Fixture')]] as const) {
+    const body={...input,requestId:name,attachment:{name,data:bytes.toString('base64')}}
+    const response=await post(body);assert.equal(response.status,202)
+    const snapshot=await response.json() as {id:string}
+    const run=(await runs.get(snapshot.id))!
+    assert.equal(run.ownerId,ownerId(owned))
+    assert.equal(run.application?.inputText,input.text)
+    assert.ok(run.texts[0].endsWith(`Caption: ${input.text}`))
+    const path=run.texts[0].match(/staged at (inbox\/[^ ]+)/)![1]
+    assert.deepEqual(await readFile(join(root,path)),bytes)
+    assert.equal((await stat(join(root,path))).mode & 0o777,0o600)
+    const before=(await readdir(join(root,'inbox'))).length
+    assert.equal((await post(body)).status,202)
+    assert.equal((await readdir(join(root,'inbox'))).length,before)
+    assert.equal((await post({...body,text:'changed'})).status,409)
+    assert.equal((await post({...body,attachment:{name,data:Buffer.from('changed').toString('base64')}})).status,409)
+    assert.equal((await fetch(`http://127.0.0.1:${address.port}/v1/runs/${snapshot.id}`,{headers:{Authorization:`Bearer ${other}`}})).status,404)
+  }
+  const control=new ControlStore(root,1000)
+  const priorSession=(await control.status()).activeSession
+  const invalidActivation=await post({...input,requestId:'invalid-activation',followOwner:false,activateTelegram:true,scope:'new-scope',attachment:{name:'x.exe',data:Buffer.from('text').toString('base64')}})
+  assert.equal(invalidActivation.status,400)
+  assert.deepEqual((await control.status()).activeSession,priorSession)
+  const before=(await readdir(join(root,'inbox'))).length
+  for (const attachment of [{name:'x.exe',data:Buffer.from('text').toString('base64')},{name:'x.txt',data:'%%%invalid'},{name:'x.txt',data:Buffer.alloc(10*1024*1024+1,65).toString('base64')}]) {
+    assert.equal((await post({...input,requestId:'bad',attachment})).status,400)
+  }
+  assert.equal((await readdir(join(root,'inbox'))).length,before)
+  await channel.bindings.register('web',null,owned)
+  await assert.rejects(channel.submit(binding.bindingId,{...input,requestId:'revoked'}),/revoked/)
+  assert.equal((await readdir(join(root,'inbox'))).length,before)
+})

package/test/codex-session.test.ts

@@ -43,7 +43,7 @@ if(q.method==='thread/goal/get'){
     child.stdin.write=((chunk:any,...args:any[])=>{try{const q=JSON.parse(String(chunk));if(q.method==='turn/start'){turnPrompt=q.params.input[0].text;turnPolicy=q.params.sandboxPolicy}requests.push(q.method);if(q.method==='thread/start'){threadConfig=q.params.config;threadSandbox=q.params.sandbox}}catch{};return (write as any)(chunk,...args)}) as typeof child.stdin.write
     return child
   }
-  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',prompt,
+  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',additionalWorkspaces:['/agent/mind/work'],prompt,
     ...(mode==='external'?{codexSandbox:'external' as const}:{})},{launch,emit:line=>output.push(line)})
   assert.equal(threadSandbox!,mode==='external'?'danger-full-access':'workspace-write')
   assert.deepEqual(turnPolicy,mode==='external'?{type:'externalSandbox',networkAccess:'enabled'}:undefined)
@@ -51,6 +51,7 @@ if(q.method==='thread/goal/get'){
   assert.equal(turnPrompt,prompt,'full input reaches the engine without goal admission or truncation')
   if(mode==='long-goal')assert.ok(prompt.length>4000)
   assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/canonical'))
+  assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/agent/mind/work'))
   assert.equal(result,['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
   assert.equal(requests.filter(x=>x==='turn/start').length,1,'transport must not send goal continuation prompts')
   assert.equal(requests.filter(x=>x==='thread/goal/set').length,0)

package/test/desktop-bridge.test.ts

@@ -5,7 +5,7 @@ import { mkdtemp, rm, mkdir, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { EventEmitter } from 'node:events'
-import { DESKTOP_UNAVAILABLE, runDesktopTurn, type DesktopClient } from '../src/desktop-bridge.js'
+import { connectManagedDesktop, desktopServerRequestResult, DESKTOP_UNAVAILABLE, runDesktopTurn, type DesktopClient } from '../src/desktop-bridge.js'
 import { executorKey, nativeSessionId, startExecutorJob } from '../src/executor.js'
 import { initialPreset, isPreset, readModels } from '../src/ai.js'
 
@@ -35,6 +35,7 @@ const fakeClient = (script: Array<Record<string, unknown>>): DesktopClient & { c
       }
       events.on('message', onMessage)
     }),
+    setServerRequestContext: () => {},
     close: () => events.removeAllListeners(),
   }
   return client
@@ -73,6 +74,102 @@ test('a dedicated desktop turn emits the thread id and waits for completion', as
   assert.equal(nativeSessionId('codex-gui', lines[0]), 'thr_hello')
 })
 
+test('desktop connection starts the native daemon once when its socket is absent', async () => {
+  const client = fakeClient([])
+  let attempts = 0, starts = 0
+  const connected = await connectManagedDesktop(async () => {
+    attempts++
+    if (attempts === 1) throw new Error(DESKTOP_UNAVAILABLE)
+    return client
+  }, async () => { starts++ })
+  assert.equal(connected, client)
+  assert.equal(attempts, 2)
+  assert.equal(starts, 1)
+})
+
+test('desktop connection fails closed when the native daemon cannot start', async () => {
+  let attempts = 0
+  await assert.rejects(connectManagedDesktop(async () => {
+    attempts++
+    throw new Error(DESKTOP_UNAVAILABLE)
+  }, async () => { throw new Error(DESKTOP_UNAVAILABLE) }), /unavailable/i)
+  assert.equal(attempts, 1)
+})
+
+test('desktop server requests use native response shapes and only accept computer-use elicitations', () => {
+  const context = { threadId: 'thread_1', turnId: 'turn_1' }
+  assert.deepEqual(desktopServerRequestResult({
+    method: 'mcpServer/elicitation/request',
+    params: { ...context, _meta: {
+      connector_id: 'browser-use', codex_approval_kind: 'mcp_tool_call', codex_request_type: 'approval_request',
+      tool_name: 'access_browser_origin', origin: 'https://ae.iherb.com',
+      tool_params: { origin: 'https://ae.iherb.com' },
+    } },
+  }, context), { action: 'accept', content: null, _meta: { persist: 'session' } })
+  assert.deepEqual(desktopServerRequestResult({
+    method: 'mcpServer/elicitation/request',
+    params: { ...context, _meta: {
+      connector_id: 'computer-use', codex_approval_kind: 'mcp_tool_call', tool_name: 'js',
+      tool_params: { app: 'com.google.Chrome' },
+    } },
+  }, context), { action: 'accept', content: null, _meta: { persist: 'session' } })
+  assert.deepEqual(desktopServerRequestResult({
+    method: 'mcpServer/elicitation/request',
+    params: { ...context, _meta: {
+      connector_id: 'computer-use', codex_approval_kind: 'mcp_tool_call', tool_name: 'js',
+      tool_params: { app: 'com.google.Chrome' },
+    } },
+  }, { threadId: context.threadId }), { action: 'accept', content: null, _meta: { persist: 'session' } })
+  assert.deepEqual(desktopServerRequestResult({
+    method: 'mcpServer/elicitation/request',
+    params: { ...context, _meta: {
+      connector_id: 'computer-use', codex_approval_kind: 'mcp_tool_call',
+      codex_request_type: 'approval_request', tool_name: 'start_audio_recording',
+      tool_params: {}, riskLevel: 'high',
+    } },
+  }, context), { action: 'decline', content: null, _meta: null })
+  assert.deepEqual(desktopServerRequestResult({
+    method: 'mcpServer/elicitation/request',
+    params: { ...context, _meta: {
+      connector_id: 'browser-use', codex_approval_kind: 'mcp_tool_call', codex_request_type: 'approval_request',
+      tool_name: 'access_browser_origin', origin: 'file:///tmp/private', tool_params: { origin: 'file:///tmp/private' },
+    } },
+  }, context), { action: 'decline', content: null, _meta: null })
+  assert.deepEqual(desktopServerRequestResult({
+    method: 'mcpServer/elicitation/request',
+    params: { ...context, turnId: 'other', _meta: {
+      connector_id: 'computer-use', codex_approval_kind: 'mcp_tool_call', tool_name: 'js',
+      tool_params: { app: 'com.google.Chrome' },
+    } },
+  }, context), { action: 'decline', content: null, _meta: null })
+  assert.deepEqual(desktopServerRequestResult({ method: 'item/commandExecution/requestApproval' }), { decision: 'decline' })
+  assert.deepEqual(desktopServerRequestResult({ method: 'unknown/request' }), { decision: 'decline' })
+})
+
+test('desktop browser authority is scheduled-only and is installed before turn start', async () => {
+  for (const runId of ['owner_run', 'r_schedule_browser']) {
+    const client = fakeClient([
+      { result: {} }, { result: { thread: { id: 'thread_browser' } } }, { result: {} },
+      { result: { turn: { id: 'turn_browser' } }, notify: [{ method: 'turn/completed', params: { turn: { id: 'turn_browser', status: 'completed' } } }] },
+    ])
+    const calls: Array<[string | undefined, string | undefined]> = []
+    const policies: unknown[] = []
+    const request = client.request
+    client.request = async (method, params) => {
+      if (method === 'thread/start' || method === 'turn/start') policies.push((params as { approvalPolicy?: unknown }).approvalPolicy)
+      return request(method, params)
+    }
+    client.setServerRequestContext = (threadId, turnId) => { calls.push([threadId, turnId]) }
+    assert.equal(await runDesktopTurn({
+      workspace: '/tmp/mind', controlDir: '/tmp/control', binDir: '/tmp/bin', runId, prompt: 'browser test',
+    }, { connect: async () => client, emit: () => {} }), 0)
+    assert.deepEqual(calls, runId.startsWith('r_schedule_')
+      ? [['thread_browser', undefined], ['thread_browser', 'turn_browser']]
+      : [[undefined, undefined]])
+    assert.deepEqual(policies, runId.startsWith('r_schedule_') ? ['on-request', 'on-request'] : ['never', 'never'])
+  }
+})
+
 test('a UUID-shaped desktop thread is resumed instead of starting another task', async () => {
   const threadId = '01a07b96-2681-72f2-ae6c-6f77fe823a8c'
   const client = fakeClient([

package/test/event-sources.test.ts

@@ -2,14 +2,14 @@ import { Tasks } from '../src/tasks.js'
 import { ApprovalStore } from '../src/approval.js'
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { createServer } from 'node:http'
 import { spawn } from 'node:child_process'
 import { once } from 'node:events'
 import { EventSources, eventRunId, batchReady, type SourceEvent } from '../src/event-sources.js'
 import { createRelay } from '../src/index.js'
-import { ControlStore } from '../src/control-state.js'
+import { ControlStore, ownerEpoch, ownerId } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
 import { executorJobEnv } from '../src/executor.js'
@@ -19,38 +19,42 @@ const until = async (check: () => Promise<boolean>) => {
   throw new Error('Test timed out')
 }
 const event = (id: string, conversationId = 'chat-a'): SourceEvent => ({ id, conversationId, text: 'Untrusted correspondence', receivedAt: Date.now() - 3000 })
-async function fixture(t: test.TestContext, taskProtocol = false) {
+async function fixture(t: test.TestContext, taskProtocol = false, applicationOnly = false) {
   const dir = await mkdtemp('/tmp/ez-source-')
   const socketPath = join(dir, 'provider.sock')
   let rows: SourceEvent[] = [], enabled = true, offline = false
+  const releases:string[][]=[]
   const server = createServer(async (req, res) => {
     let body = ''; for await (const c of req) body += c
     const { command, args } = JSON.parse(body)
     if (offline) { res.statusCode = 503; res.end('{}'); return }
-    const data = command === 'events-head' ? { cursor: rows.length, ...(taskProtocol ? { taskProtocol: 'message-v1', accountId: 'test-account' } : {}) }
+    const data = command === 'events-head' ? { cursor: rows.length, releaseEvents:true, ...(taskProtocol ? { taskProtocol: 'message-v1', accountId: 'test-account', persistentWatch:true, wildcardWatch:true } : {}) }
       : command === 'events-check' ? { events: enabled ? rows.filter(e => args.ids.includes(e.id)) : [] }
+      : command === 'events-release' ? (releases.push(args.ids),{released:true})
       : { cursor: rows.length, events: enabled ? rows.filter(e => Number(e.id) > args.after) : [] }
     res.end(JSON.stringify({ ok: true, data }))
   })
   await new Promise<void>(r => server.listen(socketPath, r))
   const control = new ControlStore(dir, 1000), runs = new RunStore(dir), sources = new EventSources(dir)
-  await control.requestPairing(101, 101); await control.approveOwner(101)
+  if (applicationOnly) await control.registerOwner('application:test')
+  else { await control.requestPairing(101, 101); await control.approveOwner(101) }
   const owner = (await control.status()).owner!
   const launches: { texts: string[]; options: any }[] = [], children: ReturnType<typeof spawn>[] = []
-  const relay = createRelay({ controlDir: dir, workspace: dir, telegramBotToken: 'fixture', executorTimeoutMs: 1000, pairingTtlMs: 1000, executorCli: 'grok' }, async (texts, options) => {
+  const relay = createRelay({ controlDir: dir, workspace: dir, telegramBotToken: applicationOnly ? '' : 'fixture', telegramEnabled:!applicationOnly,
+    ...(applicationOnly ? {applicationPort:8110} : {}), executorTimeoutMs: 1000, pairingTtlMs: 1000, executorCli: 'grok' }, async (texts, options) => {
     assert.ok(children.every(c => c.exitCode !== null || c.signalCode !== null), 'Only one writer')
     const child = spawn(process.execPath, ['-e', 'setInterval(()=>{},1000)'], { detached: true }); await once(child, 'spawn')
     launches.push({ texts, options }); children.push(child)
     return { child, cleanup: async () => {}, stdout: '' }
   })
-  relay.bot.api.config.use(async () => ({ ok: true, result: true }) as never)
+  relay.bot?.api.config.use(async () => ({ ok: true, result: true }) as never)
   t.after(async () => {
     await relay.stop()
     await until(async () => children.every(c => c.exitCode !== null || c.signalCode !== null))
     await until(async () => (await runs.list()).every(r => r.status !== 'running' || r.pid === process.pid))
     server.closeAllConnections(); await new Promise<void>(r => server.close(() => r())); await rm(dir, { recursive: true, force: true })
   })
-  return { dir, socketPath, owner, control, runs, sources, relay, launches, children,
+  return { dir, socketPath, owner, control, runs, sources, relay, launches, children, releases,
     setRows: (value: SourceEvent[]) => { rows = value }, setEnabled: (v: boolean) => { enabled = v }, setOffline: (v: boolean) => { offline = v } }
 }
 
@@ -63,6 +67,7 @@ test('registered external events are durably blocked before any executor launch'
   const stored = await f.runs.list()
   assert.equal(stored.length, 1)
   assert.equal(stored[0].status, 'cancelled')
+  assert.deepEqual(f.releases,[['1','2']])
   // Preserve the terminal status understood by previous state-schema-1 releases.
   assert.equal((await new RunStore(f.dir).get(stored[0].id))?.blockReason, 'external-execution-unavailable')
   assert.equal(stored[0].blockReason, 'external-execution-unavailable')
@@ -148,3 +153,58 @@ test('relay launches the approved initial task and routes only matching replies
   assert.equal(f.launches.length, 2)
   assert.equal((await f.runs.list()).find(r => r.external?.eventIds.includes('2'))?.status, 'cancelled')
 })
+
+test('any-conversation intake keeps a bounded public backlog',async t=>{
+  const f=await fixture(t,true);await f.sources.register('fixture',f.socketPath,f.owner)
+  const ownerRun=await f.runs.create({chatId:101,telegramUserId:101,texts:['Serve public questions']});await f.runs.patch(ownerRun.id,{status:'running',pid:process.pid})
+  const tasks=new Tasks(f.dir),proposal:any=await tasks.ownerCall(ownerRun.id,'propose',{sourceId:'fixture',conversationId:'*',purpose:'Answer public questions',context:'Public context',hours:24,waitForIncoming:true,untilRevoked:true,anyConversation:true})
+  await new ApprovalStore(f.dir).recordDecision(proposal.id,'approved',101);await tasks.decide(proposal.id)
+  f.setRows(Array.from({length:9},(_,index)=>({...event(String(index+1),`public-${index+1}`),receivedAt:Date.now()})))
+  await new Promise(resolve=>setTimeout(resolve,2100))
+  await f.relay.drainSources()
+  const taskRuns=(await f.runs.list()).filter(run=>run.taskId===proposal.id)
+  assert.equal(taskRuns.length,8)
+  assert.ok((await f.sources.batch((await f.sources.list())[0])).events.length>0,'unadmitted source batch stays pinned')
+})
+
+test('application-only owner can approve and execute a public channel task',async t=>{
+  const f=await fixture(t,true,true),source=(await f.sources.register('fixture',f.socketPath,f.owner))!
+  const binding=(await f.relay.applicationChannel.bindings.register('app','x'.repeat(48),f.owner))!
+  const ownerRun=await f.runs.create({id:`r_app_${'a'.repeat(64)}`,ownerId:ownerId(f.owner),ownerEpoch:ownerEpoch(f.owner),texts:['Serve public questions'],
+    application:{bindingId:binding.bindingId,requestId:'owner-request',scope:'main'}})
+  await f.runs.patch(ownerRun.id,{status:'running'})
+  const tasks=new Tasks(f.dir),proposal:any=await tasks.ownerCall(ownerRun.id,'propose',{sourceId:source.id,conversationId:'*',purpose:'Answer public questions',context:'Public context',hours:24,waitForIncoming:true,untilRevoked:true,anyConversation:true})
+  await new ApprovalStore(f.dir).recordOwnerDecision(proposal.id,'approved',f.owner);await tasks.decide(proposal.id)
+  await f.runs.patch(ownerRun.id,{status:'completed',endedAt:new Date().toISOString()})
+  f.setRows([{...event('1','visitor'),receivedAt:Date.now()}]);await new Promise(resolve=>setTimeout(resolve,2100));await f.relay.drainSources()
+  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.eventSource,'fixture')
+  const publicRun=(await f.runs.list()).find(run=>run.taskId===proposal.id)
+  assert.equal(publicRun?.ownerId,ownerId(f.owner));assert.equal(publicRun?.chatId,undefined)
+  f.children[0].kill();await until(async()=>!(await f.runs.list()).some(run=>run.status==='running'))
+})
+
+test('application-only public exhaustion cancels and releases without launching',async t=>{
+  const f=await fixture(t,true,true),source=(await f.sources.register('fixture',f.socketPath,f.owner))!
+  const binding=(await f.relay.applicationChannel.bindings.register('app','y'.repeat(48),f.owner))!
+  const ownerRun=await f.runs.create({id:`r_app_${'b'.repeat(64)}`,ownerId:ownerId(f.owner),ownerEpoch:ownerEpoch(f.owner),texts:['Serve public questions'],
+    application:{bindingId:binding.bindingId,requestId:'owner-request',scope:'main'}})
+  await f.runs.patch(ownerRun.id,{status:'running'})
+  const tasks=new Tasks(f.dir),proposal:any=await tasks.ownerCall(ownerRun.id,'propose',{sourceId:source.id,conversationId:'*',purpose:'Answer public questions',context:'Public context',hours:24,waitForIncoming:true,untilRevoked:true,anyConversation:true})
+  await new ApprovalStore(f.dir).recordOwnerDecision(proposal.id,'approved',f.owner);await tasks.decide(proposal.id)
+  const file=join(f.dir,'tasks',`${proposal.id}.json`),task=JSON.parse(await readFile(file,'utf8'));task.publicBudget.totalRuns=1000;await writeFile(file,JSON.stringify(task))
+  await f.runs.patch(ownerRun.id,{status:'completed',endedAt:new Date().toISOString()})
+  f.setRows([{...event('1','visitor'),receivedAt:Date.now()}]);await new Promise(resolve=>setTimeout(resolve,2100));await f.relay.drainSources()
+  assert.equal(f.launches.length,0)
+  const rejected=(await f.runs.list()).find(run=>run.external)
+  assert.equal(rejected?.status,'cancelled');assert.equal(rejected?.blockReason,'external-execution-unavailable');assert.equal(rejected?.externalReleased,true)
+  assert.equal((await tasks.get(proposal.id))?.state,'revoked');assert.deepEqual(f.releases,[['1']])
+})
+
+test('terminal event release persists success and retries a provider outage',async t=>{
+  const f=await fixture(t),source=(await f.sources.register('fixture',f.socketPath,f.owner))!,row=event('1')
+  const run=await f.runs.create({id:'event_release_retry',chatId:101,telegramUserId:101,texts:[],external:{sourceId:source.id,bindingId:source.bindingId,conversationId:row.conversationId,eventIds:[row.id]}})
+  await f.runs.patch(run.id,{status:'cancelled',endedAt:new Date().toISOString()})
+  f.setOffline(true);await f.relay.drainSources();assert.equal((await f.runs.get(run.id))?.externalReleased,undefined)
+  f.setOffline(false);f.setRows([]);await f.relay.drainSources()
+  assert.equal((await f.runs.get(run.id))?.externalReleased,true);assert.deepEqual(f.releases,[['1']])
+})

package/test/executor.test.ts

@@ -159,8 +159,8 @@ test('Codex jobs disable global memory and host skill discovery', () => {
 })
 
 test('Codex plugin access stays scoped to the explicitly bound registry', () => {
-  const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent/mind',controlDir:'/agent/control',toolsHome:'/agent/tools'},'', 'install a plugin')
-  assert.deepEqual(args.flatMap((arg,i)=>arg==='--add-dir'?[args[i+1]]:[]),['/agent/control','/agent/tools'])
+  const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent/mind',controlDir:'/agent/control',toolsHome:'/agent/tools',sharedWorkspace:'/app',additionalWorkspaces:['/agent/mind/work']},'', 'install a plugin')
+  assert.deepEqual(args.flatMap((arg,i)=>arg==='--add-dir'?[args[i+1]]:[]),['/agent/control','/app','/agent/mind/work','/agent/tools'])
   assert.ok(args.includes('sandbox_workspace_write.network_access=true'))
   assert.equal(args[args.indexOf('--sandbox')+1],'workspace-write')
   assert.ok(!EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent/mind'},'','hello').includes('sandbox_workspace_write.network_access=true'))

package/test/host-executor.test.ts

@@ -14,6 +14,33 @@ import { packageVersion } from '../src/version.js'
 import { executionDefaults } from '../src/model-policy.js'
 import { workspaceLease } from '../src/plugins/workspace-lease.mjs'
 
+test('host restart replaces a lock whose PID was reused by another process',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-reused-pid-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  const abort=new AbortController();let server:Promise<void>|undefined
+  try {
+    await mkdir(workspace);await mkdir(directory,{recursive:true})
+    await writeFile(path.join(directory,'worker.lock'),JSON.stringify({pid:process.pid,started:'reused-pid'}))
+    server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal)
+    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    await readFile(path.join(directory,'heartbeat.json'))
+    const lock=JSON.parse(await readFile(path.join(directory,'worker.lock'),'utf8'))
+    assert.equal(lock.pid,process.pid)
+    assert.notEqual(lock.started,'reused-pid')
+  }finally{abort.abort();await server;await rm(root,{recursive:true,force:true})}
+})
+
+test('legacy host lock fails closed while its PID is alive',async()=>{
+  const root=await mkdtemp(path.join(tmpdir(),'ez-host-legacy-lock-'))
+  const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),directory=path.join(controlDir,'host-executor')
+  try {
+    await mkdir(workspace);await mkdir(directory,{recursive:true})
+    await writeFile(path.join(directory,'worker.lock'),JSON.stringify({pid:process.pid}))
+    await assert.rejects(serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},new AbortController().signal),/already running/)
+    assert.deepEqual(JSON.parse(await readFile(path.join(directory,'worker.lock'),'utf8')),{pid:process.pid})
+  }finally{await rm(root,{recursive:true,force:true})}
+})
+
 test('host restart clears dead native lease only after proving previous CLI stopped',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-native-recovery-'));
   const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),toolsHome=path.join(root,'tools'),directory=path.join(controlDir,'host-executor');
@@ -55,12 +82,13 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     process.env.TELEGRAM_BOT_TOKEN='must-not-reach-host-cli'
     const sharedAlias=path.join(root,'shared-alias')
     await symlink(root,sharedAlias)
+    const additionalWorkspace=path.join(root,'additional');await mkdir(additionalWorkspace)
     const agents=await Promise.all(['one','two'].map(async name=>{
       const workspace=path.join(root,name,'mind'),controlDir=path.join(root,name,'control')
       await mkdir(workspace,{recursive:true});await mkdir(controlDir,{recursive:true})
       const toolsHome=path.join(root,name,'tools');await mkdir(toolsHome)
       await writeFile(path.join(toolsHome,'config.json'),JSON.stringify({schemaVersion:1,workspace:await realpath(workspace)}))
-      return {name,workspace,controlDir,binDir:path.join(root,'bin'),toolsHome,sharedWorkspace:name==='two'?sharedAlias:root}
+      return {name,workspace,controlDir,binDir:path.join(root,'bin'),toolsHome,sharedWorkspace:name==='two'?sharedAlias:root,additionalWorkspaces:name==='two'?[additionalWorkspace]:undefined}
     }))
     server=serveHostExecutor({cli:'grok',agents},abort.signal)
     for(const agent of agents){
@@ -88,6 +116,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
       assert.equal(result.repair,'true')
       assert.ok(result.args.includes(agent.toolsHome))
       assert.ok(result.args.includes(await realpath(root)))
+      assert.equal(result.args.includes(await realpath(additionalWorkspace)),agent.name==='two')
       assert.ok(!result.args.includes('/wrong'))
       assert.equal(result.home,process.env.HOME)
     }
@@ -180,8 +209,8 @@ test('one installed CLI executes two agent bindings with separate minds and sani
 
 
 test('host run IDs accept production formats and reject unsafe paths',()=>{
-  for(const id of ['tg_6293305','r_example_123','event_'+'a'.repeat(64)])assert.equal(isHostRunId(id),true)
-  for(const id of ['../tg_1','tg_1/other','tg_abc','event_bad','event_'+'a'.repeat(63),'event_'+'g'.repeat(64),'tg_1\n','r_',''])assert.equal(isHostRunId(id),false)
+  for(const id of ['tg_6293305','tg_replay_702267965_20260916','r_example_123','event_'+'a'.repeat(64)])assert.equal(isHostRunId(id),true)
+  for(const id of ['../tg_1','tg_1/other','tg_abc','tg_replay_702267965','tg_replay_702267965_2026091x','event_bad','event_'+'a'.repeat(63),'event_'+'g'.repeat(64),'tg_1\n','r_',''])assert.equal(isHostRunId(id),false)
 })
 
 test('client tolerates missing heartbeat and consumes completion before checking host health',async()=>{

package/test/intake-relay.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawn } from 'node:child_process'
@@ -11,7 +11,8 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { InboxStore } from '../src/inbox.js'
 import { ApprovalStore } from '../src/approval.js'
-import { Tasks } from '../src/tasks.js'
+import { atomicTaskFile, Tasks } from '../src/tasks.js'
+import { EventSources } from '../src/event-sources.js'
 import { ownerRun } from './helpers/owner-run.js'
 import { packageVersion } from '../src/version.js'
 import type { Config } from '../src/config.js'
@@ -203,6 +204,55 @@ test('owner group discovery routes only to the private chat and rechecks identit
   } finally { await f.close() }
 })
 
+test('an approved any-conversation channel grant admits unknown private and group text through restricted task runs', async () => {
+  const f = await fixture()
+  const external = (id:number,chatId:number,sender:number):Update => ({update_id:id,message:{message_id:id,date:Math.floor(Date.now()/1000),text:chatId>0?'Public question':'@fixture_bot Public question',from:{id:sender,is_bot:false,first_name:'Visitor'},chat:chatId>0?{id:chatId,type:'private',first_name:'Visitor'}:{id:chatId,type:'supergroup',title:'Public'}}})
+  try {
+    // One unbound owner group message initializes the built-in Telegram source.
+    await f.relay.bot.handleUpdate(external(1,-101,101))
+    const owner=await ownerRun(f.dir,'owner_public')
+    const tasks=new Tasks(f.dir),proposal:any=await tasks.ownerCall(owner.id,'propose',{sourceId:'telegram',conversationId:'*',purpose:'Answer public questions',context:'Public answers only',hours:24,waitForIncoming:true,untilRevoked:true,anyConversation:true})
+    await new ApprovalStore(f.dir).recordDecision(proposal.id,'approved',101)
+    await tasks.decide(proposal.id)
+    await new RunStore(f.dir).patch(owner.id,{status:'completed'})
+    await new Promise(resolve=>setTimeout(resolve,1100)) // Telegram timestamps have one-second precision.
+    await f.relay.bot.handleUpdate(external(2,202,202))
+    await f.relay.bot.handleUpdate(external(3,-303,303))
+    const unaddressedOwner=external(4,-404,101)
+    unaddressedOwner.message!.text='Plain owner follow-up'
+    await f.relay.bot.handleUpdate(unaddressedOwner)
+    assert.equal((await new InboxStore(f.dir).status()).pending,1) // Only the owner's discovery message used owner intake.
+    await new Promise(resolve=>setTimeout(resolve,2100))
+    const sources=new EventSources(f.dir),registration=(await sources.list()).find(source=>source.id==='telegram')!
+    const batch=await sources.batch(registration)
+    assert.deepEqual(batch.events.map(event=>event.id).sort(),['tg_202_2','tg_n303_3'])
+    assert.equal((await tasks.match('telegram',registration.bindingId,batch.events.slice(0,1)))?.id,proposal.id)
+    await f.relay.drainSources()
+    await new Promise(resolve=>setTimeout(resolve,80));await f.relay.drainSources()
+    const externalRuns=(await new RunStore(f.dir).list()).filter(run=>run.taskId===proposal.id)
+    assert.deepEqual(externalRuns.map(run=>run.external?.eventIds[0]).sort(),['tg_202_2','tg_n303_3'])
+  } finally { await f.close() }
+})
+
+test('a full public Telegram buffer cannot reroute an addressed owner message to owner intake', async () => {
+  const f = await fixture()
+  const group = (id:number):Update => ({update_id:id,message:{message_id:id,date:Math.floor(Date.now()/1000),text:'@fixture_bot Public question',from:{id:101,is_bot:false,first_name:'Fixture'},chat:{id:-404,type:'supergroup',title:'Public'}}})
+  try {
+    await f.relay.bot.handleUpdate(group(1)) // Initialize the built-in source through legacy discovery.
+    const owner=await ownerRun(f.dir,'owner_public_full')
+    const tasks=new Tasks(f.dir),proposal:any=await tasks.ownerCall(owner.id,'propose',{sourceId:'telegram',conversationId:'*',purpose:'Answer public questions',context:'Public answers only',hours:24,waitForIncoming:true,untilRevoked:true,anyConversation:true})
+    await new ApprovalStore(f.dir).recordDecision(proposal.id,'approved',101)
+    await tasks.decide(proposal.id)
+    const [accountDirectory]=await readdir(join(f.dir,'telegram-source')),sourceDirectory=join(f.dir,'telegram-source',accountDirectory)
+    for(let cursor=1;cursor<=100;cursor++)await atomicTaskFile(join(sourceDirectory,`tg_500_${cursor}.json`),{id:`tg_500_${cursor}`,conversationId:'500',receivedAt:Date.now(),text:'Question',cursor})
+    await f.relay.bot.handleUpdate(group(2))
+    assert.equal((await new InboxStore(f.dir).status()).pending,1)
+    const events=(await readdir(sourceDirectory)).filter(file=>/^tg_(?:n)?\d+_\d+\.json$/.test(file))
+    assert.equal(events.length,100)
+    assert.equal(events.includes('tg_n404_2.json'),false)
+  } finally { await f.close() }
+})
+
 test('conversation menu is owner-only and removes the retired settings control', async () => {
   const f = await fixture()
   const callback = (id: number, data: string, user = 101): Update => ({
@@ -612,6 +662,33 @@ test('older conversation names come from owner messages and detail keeps archive
   } finally { await f.close() }
 })
 
+test('Telegram and application image/PDF/text use identical native attachment metadata and owner session', async () => {
+  const f=await fixture()
+  const originalFetch=globalThis.fetch
+  try {
+    const control=new ControlStore(f.dir,1000)
+    const binding=(await f.relay.applicationChannel.bindings.register('web','a'.repeat(43),(await control.status()).owner!,true))!
+    let updateId=500
+    for (const [name,bytes] of [['image.png',Buffer.from('89504e470d0a1a0a','hex')],['file.pdf',Buffer.from('%PDF-1.4\nfixture')],['notes.md',Buffer.from('# Fixture')]] as const) {
+      globalThis.fetch=async()=>new Response(bytes)
+      const update=message(updateId++)
+      delete update.message!.text
+      update.message!.document={file_id:'fixture',file_unique_id:'fixture',file_name:name}
+      update.message!.caption='  literal /goal\n comment  '
+      await f.relay.bot.handleUpdate(update)
+      await f.relay.drainInbox(true)
+      const telegram=(await new RunStore(f.dir).list()).find(run=>run.messageId===update.message!.message_id)!
+      assert.ok(telegram)
+      const application=await f.relay.applicationChannel.submit(binding.bindingId,{requestId:name,scope:'chat',followOwner:true,text:update.message!.caption,attachment:{name,data:bytes.toString('base64')}})
+      const normalize=(text:string)=>text.replace(/inbox\/[a-f0-9-]+_/,'inbox/ID_')
+      assert.equal(normalize(application.texts[0]),normalize(telegram.texts[0]))
+      assert.equal(application.ownerId,telegram.ownerId)
+      assert.equal(application.execution?.sessionId,telegram.execution?.sessionId)
+      assert.deepEqual(application.execution?.preset,telegram.execution?.preset)
+      await new Promise(resolve=>setTimeout(resolve,200))
+    }
+  } finally {globalThis.fetch=originalFetch;await f.close()}
+})
 
 test('web launcher is private-owner-only and bypasses native intake without replacing controls', async () => {
   const f=await fixture({webLauncher:{command:'voice',label:'Voice',url:'https://voice.example/'}})

package/test/local-qa.test.mjs

@@ -11,16 +11,17 @@ test('local QA staging preserves source and rejects label replacement and dirty
   const root=await fs.mkdtemp(path.join(tmpdir(),'ez-qa-test-'));
   const source=path.join(root,'repo'),catalog=path.join(root,'catalog'),flow=path.join(root,'QA.md');
   await fs.mkdir(source);
-  const pkg={name:'@fixture/main',version:'0.1.0-beta.12',files:['feature.txt'],ezRelease:{kind:'main',protocol:1,stateSchema:1,mainProtocol:1}};
+  const pkg={name:'@fixture/main',version:'0.1.0-beta.12',files:['feature.txt','run.sh'],ezRelease:{kind:'main',protocol:1,stateSchema:1,mainProtocol:1}};
   await fs.writeFile(path.join(source,'package.json'),JSON.stringify(pkg));
   await fs.writeFile(path.join(source,'feature.txt'),'feature source');
+  await fs.writeFile(path.join(source,'run.sh'),'#!/bin/sh\n',{mode:0o755});
   await fs.writeFile(flow,'Ask for the feature. Verify its result.');
   const git=args=>execFileSync('git',args,{cwd:source,stdio:'pipe'}).toString().trim();
-  git(['init']);git(['add','package.json','feature.txt']);
+  git(['init']);git(['add','package.json','feature.txt','run.sh']);
   git(['-c','user.name=QA','-c','user.email=qa@example.invalid','-c','core.hooksPath=/dev/null','-c','commit.gpgsign=false','commit','-m','fixture']);
   const script=fileURLToPath(new URL('../scripts/stage-qa.mjs',import.meta.url));
   const args=[script,'--source',source,'--catalog',catalog,'--label','beta-12','--version','0.1.0-beta.12.qa.1','--flow',flow];
-  const stage=()=>execFileSync(process.execPath,args,{stdio:'pipe'}).toString();
+  const stage=()=>{const prior=process.umask(0o027);try{return execFileSync(process.execPath,args,{stdio:'pipe'}).toString();}finally{process.umask(prior);}};
   try {
     const result=JSON.parse(stage()),data=await fs.readFile(path.join(result.directory,result.file));
     assert.equal(result.sha256,digest(data));assert.equal(result.commit,git(['rev-parse','HEAD']));
@@ -29,6 +30,9 @@ test('local QA staging preserves source and rejects label replacement and dirty
     const built=JSON.parse(await fs.readFile(path.join(root,'unpacked/package.json'),'utf8'));
     assert.equal(built.version,'0.1.0-beta.12.qa.1');assert.equal(built.ezQa.commit,result.commit);
     assert.equal(await fs.readFile(path.join(root,'unpacked/feature.txt'),'utf8'),'feature source');
+    assert.equal((await fs.stat(path.join(root,'unpacked'))).mode&0o777,0o755);
+    assert.equal((await fs.stat(path.join(root,'unpacked/feature.txt'))).mode&0o777,0o644);
+    assert.equal((await fs.stat(path.join(root,'unpacked/run.sh'))).mode&0o777,0o755);
     assert.throws(stage,error=>/QA label already exists/.test(error.stderr.toString()));
     assert.equal(digest(await fs.readFile(path.join(result.directory,result.file))),result.sha256);
     await fs.writeFile(path.join(source,'feature.txt'),'unreviewed edit');

package/test/plugin-manager.test.mjs

@@ -114,6 +114,31 @@ test('bound launcher installs without startup; literal args and exit codes; scop
  lines=(await fs.readFile(f.log,'utf8')).trim().split('\n').map(JSON.parse);assert(lines.every(x=>x.secret===undefined));assert(lines.every(x=>!x.argv.includes('-v')));
  const mode=(await fs.stat(path.join(f.home,'registry.json'))).mode&0o777;assert.equal(mode,0o600);
 });
+test('concurrent registered commands release the registry lock before execution',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const started=path.join(f.root,'started');
+ await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nconst fs=require('fs'),a=process.argv.slice(2);if(a.includes('run')){fs.appendFileSync(${JSON.stringify(started)},JSON.stringify({name:a[a.indexOf('--name')+1]})+'\\n');setTimeout(()=>{console.log(JSON.stringify(a.slice(a.indexOf('/app/client.mjs')+1)))},800)}\n`,{mode:0o700});
+ const first=f.call('sample','first');
+ for(let i=0;i<100&&!await fs.access(started).then(()=>true,()=>false);i++)await new Promise(resolve=>setTimeout(resolve,5));
+ const second=f.call('sample','second');
+ for(let i=0;i<100&&(await fs.readFile(started,'utf8')).trim().split('\n').length<2;i++)await new Promise(resolve=>setTimeout(resolve,5));
+ const names=(await fs.readFile(started,'utf8')).trim().split('\n').map(line=>JSON.parse(line).name);
+ assert.equal(names.length,2);assert.equal(new Set(names).size,2);
+ await assert.rejects(f.call('plugins','uninstall','sample'),/commands are active/);
+ const outputs=await Promise.all([first,second]);
+ assert.deepEqual(outputs.map(result=>JSON.parse(result.stdout)).sort(),[['first'],['second']]);
+ await f.call('plugins','uninstall','sample');
+});
+test('unconfirmed direct-command cancellation retains its lifecycle lease',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nconst a=process.argv.slice(2);if(a[0]==='compose'&&a.includes('run')){console.log('ready');process.on('SIGTERM',()=>{});setInterval(()=>{},1000)}else if(a[0]==='container'&&a[1]==='rm'){console.error('daemon unavailable');process.exit(19)}else if(a[0]==='container'&&a[1]==='inspect'){console.log('still-running')}\n`,{mode:0o700});
+ const child=spawn(path.join(f.home,'bin','ez'),['sample','wait'],{env:f.env,stdio:['ignore','pipe','pipe']});t.after(()=>child.kill('SIGKILL'));
+ let stderr='';child.stderr.on('data',chunk=>stderr+=chunk);
+ await once(child.stdout,'data');child.kill('SIGTERM');
+ const [code]=await once(child,'close');assert.equal(code,1);assert.match(stderr,/cleanup failed/);
+ assert.equal((await fs.readdir(path.join(f.home,'command-invocations'))).length,1);
+ await assert.rejects(f.call('plugins','uninstall','sample'),/Stale command invocation lease/);
+});
 test('changed source, symlinks, reserved aliases, arbitrary Docker fields rejected',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);
  await fs.writeFile(path.join(f.source,'client.mjs'),'changed');await assert.rejects(f.call('plugins','install','sample','--source',f.source,'--revision',p.revision));
@@ -260,6 +285,12 @@ test('exposure is conservative discovery metadata and does not change literal di
   f.manifest.commands.sample.exposure=value;
   assert.throws(()=>validate(f.manifest,f.deployment,after.files),/exposure/);
  }
+ const query=structuredClone(f.manifest);query.commands.sample={...query.commands.sample,channelQuery:true,exposure:{receivesExternalContent:true,sendsExternally:false,changesRecords:false,requiresReview:false}};
+ validate(query,f.deployment,after.files);
+ for(const exposure of [undefined,{receivesExternalContent:true,sendsExternally:false,changesRecords:true,requiresReview:false}]) {
+  const unsafe=structuredClone(query);unsafe.commands.sample.exposure=exposure;
+  assert.throws(()=>validate(unsafe,f.deployment,after.files),/Channel queries/);
+ }
 });
 
 test('standalone CLI has discoverable setup, independent guidance and status without Telegram',async t=>{