@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.34

package/test/agent-install.test.ts

@@ -17,9 +17,15 @@ test('new agents receive independent projects, secrets and plugin bindings; dupl
     await assert.rejects(createAgent({...base,name:'different-cli',cli:'codex'}),/already selected/)
     const host=JSON.parse(await readFile(join(root,'family/host-executor.json'),'utf8'))
     assert.equal(host.cli,'grok')
+    assert.equal(host.isolation,'host-capable')
     assert.equal(host.agents[0].workspace,'/private/agents/family/mind')
     const a=parseEnv(await readFile(join(root,'family/docker.env'),'utf8'))
     const b=parseEnv(await readFile(join(root,'work/docker.env'),'utf8'))
+    assert.equal(a.EZ_ISOLATION,'host-capable')
+    assert.equal(a.EZ_EXECUTOR_TRANSPORT,'host')
+    assert.equal(b.EZ_ISOLATION,'host-capable')
+    assert.equal(b.EZ_EXECUTOR_TRANSPORT,'host')
+    assert.equal(JSON.parse(await readFile(join(root,'family/agent.json'),'utf8')).isolation,'host-capable')
     assert.equal(a.EZ_RELAY_IMAGE,'ezenciel-agents:install-candidate')
     assert.equal(b.EZ_RELAY_IMAGE,'ezenciel-agents:local')
     await assert.rejects(createAgent({...base,name:'bad-image',image:"bad'\nINJECT=yes"}),/Invalid relay image/)
@@ -30,7 +36,17 @@ test('new agents receive independent projects, secrets and plugin bindings; dupl
     await assert.rejects(createAgent({...base,name:'family'}),{code:'EEXIST'})
     assert.equal((await readFile(join(root,'family/relay.env'),'utf8')).includes(base.token),true)
     await assert.rejects(createAgent({...base,name:'../family'}),/agent name/)
+    await assert.rejects(createAgent({...base,name:'bad-class',isolation:'seatbelt'}),/isolated or host-capable/)
+    await assert.rejects(createAgent({...base,name:'unsupported-isolated',isolation:'isolated'}),/unavailable for grok/)
+    const capable=await createAgent({...base,name:'capable',isolation:'host-capable'})
+    assert.equal(capable.isolation,'host-capable')
+    const capableEnv=parseEnv(await readFile(join(root,'capable/docker.env'),'utf8'))
+    assert.equal(capableEnv.EZ_ISOLATION,'host-capable')
+    assert.equal(capableEnv.EZ_EXECUTOR_TRANSPORT,'host')
+    assert.equal(JSON.parse(await readFile(join(root,'capable/host-executor.json'),'utf8')).isolation,'host-capable')
+    assert.equal(a.EZ_CODEX_SANDBOX,undefined)
     await assert.rejects(createAgent({...base,name:'bad',token:'do-not-echo'}),e=>!String(e).includes('do-not-echo'))
+    await assert.rejects(createAgent({...base,name:'verbose',purpose:'x'.repeat(2001)}),/concise purpose/)
   } finally { await rm(root,{recursive:true,force:true}) }
 })
 
@@ -42,7 +58,25 @@ test('package installer records its CLI before any agent exists; creation inheri
     assert.equal(await installationCli(root,'codex'),'codex')
     const agent=await createAgent({root,hostRoot:'/private/agents',composeFile:'/opt/ez/compose.yaml',name:'shopper',purpose:'Family shopping',token:'123456789:'+'a'.repeat(30)})
     assert.equal(agent.executor,'codex')
+    assert.equal(agent.isolation,'isolated')
+    const env=parseEnv(await readFile(join(root,'shopper/docker.env'),'utf8'))
+    assert.equal(env.EZ_ISOLATION,'isolated')
+    assert.equal(env.EZ_EXECUTOR_TRANSPORT,'local')
+    assert.equal(env.EZ_CODEX_SANDBOX,'external')
     assert.equal(await installationCli(root),'codex')
     await assert.rejects(installationCli(root,'grok'),/already selected/)
   } finally { await rm(root,{recursive:true,force:true}) }
 })
+
+test('agent installation records an isolated Codex provider profile without its key', async () => {
+  const root=await mkdtemp(join(tmpdir(),'ez-installer-provider-'))
+  try {
+    const codexProvider={id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1',envKey:'OPENROUTER_API_KEY',models:['google/gemini-3.8-flash','deepseek/deepseek-v4.1-flash']}
+    const agent=await createAgent({root,hostRoot:'/private/agents',composeFile:'/opt/ez/compose.yaml',name:'coach',purpose:'Fitness coach',token:'123456789:'+'a'.repeat(30),cli:'codex',codexProvider})
+    const host=JSON.parse(await readFile(join(root,'coach/host-executor.json'),'utf8'))
+    assert.deepEqual(host.agents[0].codexProviders,[codexProvider])
+    assert.equal(JSON.stringify(agent).includes('OPENROUTER_API_KEY'),false)
+    assert.equal(JSON.stringify(host).includes('sk-'),false)
+    await assert.rejects(createAgent({root,hostRoot:'/private/agents',composeFile:'/opt/ez/compose.yaml',name:'bad-provider',purpose:'x',token:'123456789:'+'b'.repeat(30),codexProvider:{...codexProvider,baseUrl:'http://openrouter.ai/api/v1'}}),/provider URL/)
+  } finally { await rm(root,{recursive:true,force:true}) }
+})

package/test/ai-cli.test.ts

@@ -36,3 +36,21 @@ test('AI help is available without a bound control directory or installed engine
  assert.equal(result.status,0,result.stderr)
  assert.match(result.stdout,/select --cli/)
 })
+
+test('an agent can select a declared provider and model without putting the key in control state',async()=>{
+ const root=await mkdtemp(path.join(tmpdir(),'ez-ai-provider-'))
+ try{
+  const controlDir=path.join(root,'control'),binDir=path.join(root,'bin')
+  await mkdir(path.join(controlDir,'host-executor'),{recursive:true});await mkdir(binDir)
+  await writeFile(path.join(binDir,'codex'),'#!/bin/sh\nexit 0\n',{mode:0o700})
+  await writeFile(path.join(controlDir,'host-executor','models.json'),JSON.stringify([{cli:'codex',provider:'openrouter',model:'google/gemini-3.8-flash',name:'Gemini',efforts:[]}]))
+  const store=new ControlStore(controlDir,900000);await store.aiState(initialPreset('codex'))
+  const env={...process.env,HOME:root,PATH:binDir+path.delimiter+process.env.PATH,EZ_CONTROL_DIR:controlDir,OPENROUTER_API_KEY:'must-not-persist'}
+  const bin=fileURLToPath(new URL('../bin/ezenciel-agents-ai.mjs',import.meta.url))
+  const result=spawnSync(process.execPath,[bin,'select','--cli','codex','--provider','openrouter','--model','google/gemini-3.8-flash'],{env,encoding:'utf8'})
+  assert.equal(result.status,0,result.stderr)
+  const state=await store.status(),selected=state.ai?.presets.find(p=>p.id===state.ai?.selectedId)
+  assert.equal(selected?.provider,'openrouter');assert.equal(selected?.model,'google/gemini-3.8-flash')
+  assert.equal(JSON.stringify(state).includes('must-not-persist'),false)
+ }finally{await rm(root,{recursive:true,force:true})}
+})

package/test/ai.test.ts

@@ -11,6 +11,54 @@ import { InboxStore } from '../src/inbox.js'
 import { executionDefaults } from '../src/model-policy.js'
 import type { Update } from 'grammy/types'
 
+test('same-client model switch does not resume the previous native thread', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-ai-model-switch-'))
+  try {
+    const store = new ControlStore(dir, 1000)
+    const deepseek = { id: 'deepseek', name: 'DeepSeek', cli: 'codex', model: 'deepseek/flash', effort: 'max' }
+    const luna = { id: 'luna', name: 'Luna', cli: 'codex', model: 'gpt-5.6-luna', effort: 'max' }
+    const first = await store.captureChoice(initialPreset('codex'))
+    await store.savePreset(deepseek)
+    await store.selectPreset(deepseek.id, first.sessionId, false)
+    const started = await store.captureChoice(initialPreset('codex'))
+    await store.saveNativeSession(started.sessionId, 'native-deepseek')
+    const same = await store.captureChoice(initialPreset('codex'))
+    assert.equal(same.sessionId, started.sessionId)
+    assert.equal((await store.executionSession(same)).nativeSessionId, 'native-deepseek')
+    await store.savePreset(luna)
+    await store.selectPreset(luna.id, started.sessionId, false)
+    const next = await store.captureChoice(initialPreset('codex'))
+    assert.notEqual(next.sessionId, started.sessionId)
+    assert.equal(next.preset.model, luna.model)
+    assert.equal((await store.executionSession(next)).hasStarted, false)
+    assert.equal((await store.executionSession(next)).nativeSessionId, undefined)
+    assert.equal((await store.executionSession(started)).nativeSessionId, 'native-deepseek')
+    await store.saveNativeSession(next.sessionId, 'native-luna')
+    const clientDefault = initialPreset('codex')
+    await store.savePreset(clientDefault)
+    await store.selectPreset(clientDefault.id, next.sessionId, false)
+    const defaultChoice = await store.captureChoice(clientDefault)
+    assert.notEqual(defaultChoice.sessionId, next.sessionId)
+    assert.equal(defaultChoice.preset.model, undefined)
+    await store.saveNativeSession(defaultChoice.sessionId, 'native-default')
+    await store.selectPreset(deepseek.id, defaultChoice.sessionId, false)
+    const explicitAgain = await store.captureChoice(clientDefault)
+    assert.notEqual(explicitAgain.sessionId, defaultChoice.sessionId)
+    assert.equal(explicitAgain.preset.model, deepseek.model)
+    await store.saveNativeSession(explicitAgain.sessionId, 'native-explicit')
+    const openrouter = { ...deepseek, id: 'openrouter-deepseek', name: 'OpenRouter DeepSeek', provider: 'openrouter' }
+    await store.savePreset(openrouter)
+    await store.selectPreset(openrouter.id, explicitAgain.sessionId, false)
+    const providerChoice = await store.captureChoice(clientDefault)
+    assert.notEqual(providerChoice.sessionId, explicitAgain.sessionId)
+    assert.equal(providerChoice.preset.provider, 'openrouter')
+    const args = EXECUTOR_REGISTRY.codex.buildArgs({
+      workspace: dir, isResume: false, sessionId: next.sessionId,
+    }, '', '')
+    assert.equal(args.includes('resume'), false)
+  } finally { await rm(dir, { recursive: true, force: true }) }
+})
+
 test('AI choices pin model, effort and session; defaults and CLI switches do not reroute old work', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-ai-'))
   try {

package/test/application-channel.test.ts

@@ -84,7 +84,9 @@ test('HTTP auth, idempotency, origin/context isolation, revocation and persisted
   await runs.claimOutbox(message.id)
   await channel.deliver(run,message)
   assert.deepEqual(await runs.waitForDelivery(message.id),{delivered:true})
-  assert.deepEqual((await channel.snapshot(first.bindingId,run.id)).messages,[{id:message.id,text:'Here is the proposal'}])
+  const snapshot=await channel.snapshot(first.bindingId,run.id)
+  assert.deepEqual(snapshot.messages,[{id:message.id,text:'Here is the proposal'}])
+  assert.deepEqual(snapshot.preset,run.execution?.preset)
   const approval=await runs.enqueueApproval(run.id,'Allow this channel grant?','task_'+'a'.repeat(32))
   await runs.claimOutbox(approval.id);await channel.deliver(run,approval)
   assert.deepEqual((await channel.snapshot(first.bindingId,run.id)).approvals,[{id:'task_'+'a'.repeat(32),prompt:'Allow this channel grant?',state:'delivered'}])
@@ -202,8 +204,9 @@ test('application AI choice retains same-engine history and rejects cross-engine
   t.after(() => rm(root, { recursive: true, force: true }))
   const channel = new ApplicationChannel({ controlDir: root, initial: initialPreset('codex'), wake: () => {}, cancel: async () => {} })
   const binding = (await channel.bindings.register('app', token(), await owner(root)))!
-  const input = { requestId: 'one', scope: 'main:codex', text: 'Hello', ai: { cli: 'codex', model: 'gpt-5.6-luna', effort: 'high' } }
+  const input = { requestId: 'one', scope: 'main:codex', text: 'Hello', ai: { cli: 'codex', provider:'openrouter', model: 'gpt-5.6-luna', effort: 'high' } }
   const first = await channel.submit(binding.bindingId, input)
+  assert.equal(first.execution!.preset.provider,'openrouter')
   assert.equal(first.execution!.preset.model, input.ai.model)
   const second = await channel.submit(binding.bindingId, { ...input, requestId: 'two', ai: { ...input.ai, model: 'gpt-5.6-terra' } })
   assert.equal(first.execution!.sessionId, second.execution!.sessionId)

package/test/application-controls.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, open } from 'node:fs/promises'
+import { mkdtemp, rm, open, mkdir, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomBytes } from 'node:crypto'
@@ -9,6 +9,41 @@ import { ControlStore } from '../src/control-state.js'
 import { createAiMenu } from '../src/menu.js'
 import { RunStore } from '../src/runs.js'
 
+test('shared controls validate detected host presets against the host catalog', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-host-controls-'))
+  const previousTransport = process.env.EZ_EXECUTOR_TRANSPORT
+  const previousControl = process.env.EZ_CONTROL_DIR
+  process.env.EZ_EXECUTOR_TRANSPORT = 'host'
+  process.env.EZ_CONTROL_DIR = root
+  t.after(async () => {
+    if (previousTransport === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT
+    else process.env.EZ_EXECUTOR_TRANSPORT = previousTransport
+    if (previousControl === undefined) delete process.env.EZ_CONTROL_DIR
+    else process.env.EZ_CONTROL_DIR = previousControl
+    await rm(root, {recursive:true, force:true})
+  })
+  await mkdir(join(root, 'host-executor'), {recursive:true})
+  await writeFile(join(root, 'host-executor', 'models.json'), JSON.stringify([
+    {cli:'grok', model:'grok-4.6', name:'Grok 4.6', efforts:['high']},
+  ]))
+  const control = new ControlStore(root, 1000)
+  await control.requestPairing(42, 42); const owner = await control.approveOwner(42)
+  const menu = createAiMenu(control, 'codex')
+  const detected = {id:'detected_fixture', name:'Grok 4.6 High', cli:'grok', model:'grok-4.6', effort:'high'}
+  await control.aiState(menu.initial)
+  await control.savePreset(detected)
+  const initial = await control.captureChoice(menu.initial)
+  await control.selectPreset(detected.id, initial.sessionId, true)
+  const current = (await control.getActiveSession())!
+  const channel = new ApplicationChannel({controlDir:root, initial:menu.initial, aiControls:menu, wake:()=>{}, cancel:async()=>{}})
+  const binding = (await channel.bindings.register('shared', randomBytes(32).toString('base64url'), owner, true))!
+
+  const selected = await channel.changeControls(binding.bindingId, {
+    action:'select', presetId:detected.id, expectedSession:current.sessionId,
+  })
+  assert.equal(selected.ai.selectedId, detected.id)
+})
+
 test('private scope reset and model controls preserve running sessions and shared state', async t => {
   const root = await mkdtemp(join(tmpdir(),'ez-private-controls-'))
   const control = new ControlStore(root,1000)
@@ -75,6 +110,7 @@ test('application controls share native choices, protect hidden scopes and prese
   await control.requestPairing(42, 42); const owner = await control.approveOwner(42)
   const menu = createAiMenu(control, 'codex', async () => [
     {cli:'codex', model:'gpt-6-astra', name:'Fixture model', efforts:['low','high']},
+    {cli:'codex', provider:'openrouter', model:'gpt-6-astra', name:'OpenRouter fixture', efforts:['low','high']},
   ], root, join(root, 'native-home'), async () => true)
   const channel = new ApplicationChannel({controlDir:root, initial:menu.initial, aiControls:menu, wake:()=>{}, cancel:async()=>{}})
   t.after(async()=>{await channel.stop(); await rm(root,{recursive:true,force:true})})
@@ -107,9 +143,11 @@ test('application controls share native choices, protect hidden scopes and prese
   assert.deepEqual((await control.aiState(menu.initial)).presets,presetsBefore)
   const selected = await request({action:'model',cli:'codex',model:'gpt-6-astra',effort:'high',expectedSession:old.sessionId})
   assert.equal(selected.status,200)
-  assert.equal((await control.captureChoice(menu.initial)).preset.effort,'high')
+  const modelChoice = await control.captureChoice(menu.initial)
+  assert.equal(modelChoice.preset.effort,'high')
+  assert.notEqual(modelChoice.sessionId,old.sessionId)
   assert.deepEqual((await new RunStore(root).get(run.id))!.execution,old)
-  const reset = await request({action:'new',expectedSession:old.sessionId})
+  const reset = await request({action:'new',expectedSession:modelChoice.sessionId})
   assert.equal(reset.status,200)
   const next = (await control.getActiveSession())!
   assert.notEqual(next.sessionId,old.sessionId)
@@ -119,6 +157,21 @@ test('application controls share native choices, protect hidden scopes and prese
   assert.equal((await request()).status,401)
 })
 
+test('application model controls disambiguate the same model by provider', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-provider-control-')),control=new ControlStore(root,1000)
+  await control.requestPairing(42,42);const owner=await control.approveOwner(42)
+  const menu=createAiMenu(control,'codex',async()=>[
+    {cli:'codex',model:'shared-model',name:'Native',efforts:[]},
+    {cli:'codex',provider:'openrouter',model:'shared-model',name:'OpenRouter',efforts:[]},
+  ],root,join(root,'native-home'),async()=>true)
+  const channel=new ApplicationChannel({controlDir:root,initial:menu.initial,aiControls:menu,wake:()=>{},cancel:async()=>{}})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const binding=(await channel.bindings.register('shared',randomBytes(32).toString('base64url'),owner,true))!
+  const current=await control.captureChoice(menu.initial)
+  await channel.changeControls(binding.bindingId,{action:'model',cli:'codex',provider:'openrouter',model:'shared-model',expectedSession:current.sessionId})
+  assert.equal((await control.captureChoice(menu.initial)).preset.provider,'openrouter')
+})
+
 test('atomic control mutations reject a replaced owner even when both active sessions are empty', async t => {
   const root = await mkdtemp(join(tmpdir(),'ez-control-owner-'))
   t.after(()=>rm(root,{recursive:true,force:true}))

package/test/application-only.test.ts

@@ -13,6 +13,7 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { ApplicationBindings } from '../src/application-channel.js'
+import { initializeWorkspace } from '../src/workspace.js'
 
 const waitFor = async (condition: () => Promise<boolean>) => {
   for (let i=0;i<300;i++) { if (await condition()) return; await new Promise(r=>setTimeout(r,10)) }
@@ -60,6 +61,7 @@ test('administrator bootstrap is explicit, local-only and cannot replace identit
 
 test('botless daemon executes application turn and rejects Telegram-origin work/outbound', async t => {
   const root=await mkdtemp(join(tmpdir(),'ez-app-only-runtime-'))
+  const purpose=join(root,'purpose.md');await writeFile(purpose,'Fixture application agent\n');await initializeWorkspace(root,purpose)
   const portServer=createServer();await new Promise<void>(r=>portServer.listen(0,'127.0.0.1',r))
   const port=(portServer.address() as {port:number}).port;await new Promise<void>(r=>portServer.close(()=>r()))
   const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:String(port),EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'codex'})

package/test/codex-context.test.ts

@@ -6,15 +6,67 @@ import {tmpdir} from 'node:os'
 import path from 'node:path'
 import {startExecutorJob} from '../src/executor.js'
 
+test('a package-bin Codex shim cannot retarget another agent home', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-codex-host-cli-'))
+  const hostBin = path.join(root, 'host-bin')
+  const packageBin = path.join(root, 'package-bin')
+  const controlDir = path.join(root, 'agent')
+  const priorHome = process.env.HOME, priorPath = process.env.PATH
+  try {
+    await mkdir(hostBin); await mkdir(packageBin); await mkdir(path.join(root, '.codex'))
+    await writeFile(path.join(root, '.codex/auth.json'), '{}')
+    await writeFile(path.join(packageBin, 'codex'), `#!${process.execPath}
+require('fs').writeFileSync(require('path').join(process.env.HOME, 'hijacked'), 'yes'); process.exit(2)
+`, { mode: 0o700 })
+    await writeFile(path.join(hostBin, 'codex'), `#!${process.execPath}\nconsole.log(process.env.CODEX_HOME)`, { mode: 0o700 })
+    process.env.HOME = root
+    process.env.PATH = hostBin + path.delimiter + (priorPath ?? '')
+    await ownerRun(controlDir, 'r_test')
+    const job = await startExecutorJob(['hello'], {
+      workspace: root, controlDir, binDir: packageBin, cli: 'codex', runId: 'r_test', timeoutMs: 5000,
+    })
+    let output = ''
+    job.child.stdout?.on('data', chunk => output += chunk)
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0)
+    await job.cleanup()
+    assert.equal(output.trim(), path.join(controlDir, 'cli/codex'))
+    await assert.rejects(readFile(path.join(root, 'hijacked')))
+  } finally {
+    if (priorHome === undefined) delete process.env.HOME; else process.env.HOME = priorHome
+    if (priorPath === undefined) delete process.env.PATH; else process.env.PATH = priorPath
+    await rm(root, { recursive: true, force: true })
+  }
+})
+
+test('a package-bin Codex shim is not a fallback when the host CLI is missing', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-codex-host-cli-missing-'))
+  const packageBin = path.join(root, 'package-bin')
+  const controlDir = path.join(root, 'agent')
+  const priorPath = process.env.PATH
+  try {
+    await mkdir(packageBin)
+    await writeFile(path.join(packageBin, 'codex'), `#!${process.execPath}\nprocess.exit(91)\n`, { mode: 0o700 })
+    process.env.PATH = '/usr/bin:/bin'
+    await ownerRun(controlDir, 'r_test')
+    await assert.rejects(startExecutorJob(['hello'], {
+      workspace: root, controlDir, binDir: packageBin, cli: 'codex', runId: 'r_test', timeoutMs: 5000,
+    }), /Native CLI codex is not executable on the host PATH/)
+  } finally {
+    if (priorPath === undefined) delete process.env.PATH; else process.env.PATH = priorPath
+    await rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Codex shares only auth through a link and keeps each agent runtime state separate',async()=>{
  const root=await mkdtemp(path.join(tmpdir(),'ez-codex-context-'))
- const priorHome=process.env.HOME,priorPath=process.env.PATH
+ const priorHome=process.env.HOME,priorPath=process.env.PATH,priorIsolation=process.env.EZ_ISOLATION
  try{
   await mkdir(path.join(root,'.codex'));await mkdir(path.join(root,'bin'))
   await writeFile(path.join(root,'.codex/auth.json'),'{}')
   await writeFile(path.join(root,'.codex/config.toml'),'# unrelated personal config')
   await writeFile(path.join(root,'bin/codex'),`#!${process.execPath}\nconsole.log(process.env.CODEX_HOME)`,{mode:0o700})
   process.env.HOME=root;process.env.PATH=path.join(root,'bin')+path.delimiter+priorPath
+  delete process.env.EZ_ISOLATION
   for(const agent of ['one','two']){
    const controlDir=path.join(root,agent)
    await ownerRun(controlDir, 'r_test')
@@ -27,9 +79,17 @@ test('Codex shares only auth through a link and keeps each agent runtime state s
    assert.deepEqual(await readdir(home),['auth.json'])
    assert.equal(await readlink(path.join(home,'auth.json')),path.join(root,'.codex/auth.json'))
   }
+  process.env.EZ_ISOLATION='isolated'
+  const isolated=path.join(root,'isolated')
+  await ownerRun(isolated, 'r_test')
+  const isolatedJob=await startExecutorJob(['hello'],{workspace:root,controlDir:isolated,binDir:path.join(root,'bin'),cli:'codex',runId:'r_test',timeoutMs:5000})
+  assert.equal(await new Promise(resolve=>isolatedJob.child.once('close',resolve)),0)
+  await isolatedJob.cleanup()
+  await assert.rejects(readlink(path.join(isolated,'cli/codex/auth.json')),{code:'ENOENT'})
  }finally{
   if(priorHome===undefined)delete process.env.HOME;else process.env.HOME=priorHome
   if(priorPath===undefined)delete process.env.PATH;else process.env.PATH=priorPath
+  if(priorIsolation===undefined)delete process.env.EZ_ISOLATION;else process.env.EZ_ISOLATION=priorIsolation
   await rm(root,{recursive:true,force:true})
  }
 })

package/test/codex-session.test.ts

@@ -43,7 +43,8 @@ if(q.method==='thread/goal/get'){
     child.stdin.write=((chunk:any,...args:any[])=>{try{const q=JSON.parse(String(chunk));if(q.method==='turn/start'){turnPrompt=q.params.input[0].text;turnPolicy=q.params.sandboxPolicy}requests.push(q.method);if(q.method==='thread/start'){threadConfig=q.params.config;threadSandbox=q.params.sandbox}}catch{};return (write as any)(chunk,...args)}) as typeof child.stdin.write
     return child
   }
-  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',additionalWorkspaces:['/agent/mind/work'],prompt,
+  const codexProvider=mode==='tool-goal'?{id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1',envKey:'OPENROUTER_API_KEY',models:['open/model']}:undefined
+  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',additionalWorkspaces:['/agent/mind/work'],prompt,codexProvider,model:codexProvider?'open/model':undefined,
     ...(mode==='external'?{codexSandbox:'external' as const}:{})},{launch,emit:line=>output.push(line)})
   assert.equal(threadSandbox!,mode==='external'?'danger-full-access':'workspace-write')
   assert.deepEqual(turnPolicy,mode==='external'?{type:'externalSandbox',networkAccess:'enabled'}:undefined)
@@ -52,6 +53,10 @@ if(q.method==='thread/goal/get'){
   if(mode==='long-goal')assert.ok(prompt.length>4000)
   assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/canonical'))
   assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/agent/mind/work'))
+  if(codexProvider){
+    assert.equal(threadConfig.model_provider,'openrouter')
+    assert.deepEqual(threadConfig['model_providers.openrouter'],{name:'OpenRouter',base_url:'https://openrouter.ai/api/v1',env_key:'OPENROUTER_API_KEY',wire_api:'responses',supports_websockets:false})
+  }
   assert.equal(result,['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
   assert.equal(requests.filter(x=>x==='turn/start').length,1,'transport must not send goal continuation prompts')
   assert.equal(requests.filter(x=>x==='thread/goal/set').length,0)

package/test/config.test.ts

@@ -65,8 +65,23 @@ test('external Codex isolation requires explicit native local deployment', () =>
   assert.equal(loadConfig(env).codexSandbox, 'external')
   assert.equal(loadConfig({...env,EZ_TELEGRAM_ENABLED:'true',TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, 'external')
   assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, undefined)
-  for (const override of [{EZ_EXECUTOR_TRANSPORT:'host'}, {EZ_EXECUTOR_TRANSPORT:''}, {EZ_CODEX_SANDBOX:'danger-full-access'}])
-    assert.throws(() => loadConfig({...env,...override}), /sandbox|SANDBOX/)
+  assert.equal(loadConfig({...env,EZ_EXECUTOR_TRANSPORT:''}).isolation, 'isolated')
+  assert.throws(() => loadConfig({...env,EZ_EXECUTOR_TRANSPORT:'host'}), /sandbox|SANDBOX|Isolation/)
+  assert.throws(() => loadConfig({...env,EZ_CODEX_SANDBOX:'danger-full-access'}), /sandbox|SANDBOX/)
+})
+
+test('isolation class is isolated by default and rejects host transport mismatch', () => {
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'local'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'host'}), /Isolation isolated requires EZ_EXECUTOR_TRANSPORT=local/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'local'}), /Isolation host-capable requires EZ_EXECUTOR_TRANSPORT=host/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'seatbelt'}), /isolated or host-capable/)
+  assert.throws(() => loadConfig({
+    TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host',
+    EZ_CHANNEL_BACKEND_URL:'https://backend.example',EZ_CHANNEL_BACKEND_TOKEN:'secret',
+  }), /Host-capable isolation requires the host native CLI/)
 })
 
 test('optional web launcher preserves reserved commands and accepts only HTTPS without secrets', () => {

package/test/engine-handoff.test.ts

@@ -13,7 +13,7 @@ test('owner, resumed and native scheduled subprocesses receive literal input and
  const root=await mkdtemp(path.join(tmpdir(),'ez-literal-'))
  t.after(()=>rm(root,{recursive:true,force:true}))
  const bin=path.join(root,'bin'),workspace=path.join(root,'mind'),controlDir=path.join(root,'control')
- await mkdir(bin);await initializeWorkspace(workspace)
+ await mkdir(bin);const purpose=path.join(root,'purpose.md');await writeFile(purpose,'Fixture agent\n');await initializeWorkspace(workspace,purpose)
  const fixture=`#!${process.execPath}
 const fs=require('fs'), args=process.argv.slice(2);
 const capture=prompt=>fs.writeFileSync('capture.json',JSON.stringify({prompt,args,env:{run:process.env.EZ_RUN_ID,control:process.env.EZ_CONTROL_DIR,repair:process.env.EZ_REPAIR_ENABLED,secret:process.env.TELEGRAM_BOT_TOKEN}}));
@@ -44,7 +44,10 @@ if(args[0]==='app-server'){
    const captured=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
    assert.equal(captured.prompt,text)
    assert.deepEqual(captured.env,{run:runId,control:controlDir,repair:'false'})
-   if(cli==='codex')assert.equal(captured.args.at(-1),'-')
+   if(cli==='codex'){
+    assert.equal(captured.args.at(-1),'-')
+    if(process.platform==='darwin')assert.equal(captured.args[captured.args.indexOf('--sandbox')+1],'danger-full-access')
+   }
    if(['codex','claude'].includes(cli))assert.ok(!captured.args.includes('--help'))
    if(cli==='opencode')assert.equal(captured.args.at(-2),'--')
    if(cli==='agy')assert.ok(captured.args.includes('--print='+text))

package/test/executor.test.ts

@@ -6,7 +6,7 @@ import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
 import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
-import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, startExecutorJob, terminateJob } from '../src/executor.js'
+import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
 import { splitTelegramText } from '../src/reply.js'
 import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
 
@@ -54,6 +54,11 @@ test('Telegram replies are split within the configured message limit', () => {
   assert.ok(chunks.every((chunk) => chunk.length <= 10))
 })
 
+test('native CLIs resolve from the host PATH, not a relative package name', () => {
+  assert.equal(resolveHostCommand('/usr/bin/codex'), '/usr/bin/codex')
+  assert.throws(() => resolveHostCommand('missing-cli-xyz', '/usr/bin'), /not executable on the host PATH/)
+})
+
 test('the executor receives a deliberately small environment', () => {
   const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', PAGERDUTY_ROUTING_KEY: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
   assert.deepEqual(environment, { PATH: '/bin', HOME: '/tmp/home' })
@@ -158,6 +163,38 @@ test('Codex jobs disable global memory and host skill discovery', () => {
   assert.equal(args[args.indexOf('skip_host_skill_discovery')-1],'--enable')
 })
 
+test('Codex custom providers use declared runtime state and an environment key reference', () => {
+  const provider=validateCodexProvider({id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1/',envKey:'OPENROUTER_API_KEY',models:['google/gemini-3.8-flash']})
+  const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',model:'google/gemini-3.8-flash',codexProvider:provider},'','hello')
+  assert.ok(args.includes('model_provider="openrouter"'))
+  assert.ok(args.some(value=>value.includes('env_key="OPENROUTER_API_KEY"')))
+  assert.ok(args.includes('google/gemini-3.8-flash'))
+  assert.equal(JSON.stringify(args).includes('provider-secret'),false)
+  assert.throws(()=>validateCodexProvider({...provider,envKey:'TELEGRAM-BOT'}),/environment key/)
+  for (const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN','PAGERDUTY_ROUTING_KEY'])
+    assert.throws(()=>validateCodexProvider({...provider,envKey}),/Reserved/)
+  assert.throws(()=>validateCodexProvider({...provider,models:[]}),/provider models/)
+})
+
+test('a configured Codex provider receives only its declared key and runtime selection', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-codex-provider-'));t.after(()=>rm(root,{recursive:true,force:true}))
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'codex'),`#!${process.execPath}\nconst fs=require('fs');let text='';process.stdin.on('data',b=>text+=b);process.stdin.on('end',()=>fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),key:process.env.OPENROUTER_API_KEY,telegram:process.env.TELEGRAM_BOT_TOKEN,text})));`,{mode:0o755})
+  const prior={path:process.env.PATH,key:process.env.OPENROUTER_API_KEY,telegram:process.env.TELEGRAM_BOT_TOKEN}
+  const provider=validateCodexProvider({id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1',envKey:'OPENROUTER_API_KEY',models:['google/gemini-3.8-flash']})
+  await ownerRun(root,'r_provider')
+  try {
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.OPENROUTER_API_KEY='provider-secret';process.env.TELEGRAM_BOT_TOKEN='relay-secret'
+    const job=await startExecutorJob(['hello'],{workspace:root,controlDir:root,binDir:bin,runId:'r_provider',timeoutMs:0,cli:'codex',provider:'openrouter',model:'google/gemini-3.8-flash',codexProvider:provider})
+    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+    const observed=JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+    assert.equal(observed.key,'provider-secret');assert.equal(observed.telegram,undefined);assert.equal(observed.text,'hello')
+    assert.ok(observed.args.includes('model_provider="openrouter"'));assert.ok(observed.args.includes('google/gemini-3.8-flash'))
+  } finally {
+    for(const [key,value] of [['PATH',prior.path],['OPENROUTER_API_KEY',prior.key],['TELEGRAM_BOT_TOKEN',prior.telegram]]) if(value===undefined)delete process.env[key!];else process.env[key!]=value
+  }
+})
+
 test('Codex plugin access stays scoped to the explicitly bound registry', () => {
   const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent/mind',controlDir:'/agent/control',toolsHome:'/agent/tools',sharedWorkspace:'/app',additionalWorkspaces:['/agent/mind/work']},'', 'install a plugin')
   assert.deepEqual(args.flatMap((arg,i)=>arg==='--add-dir'?[args[i+1]]:[]),['/agent/control','/app','/agent/mind/work','/agent/tools'])

package/test/failure.test.ts

@@ -15,12 +15,14 @@ import { initialPreset } from '../src/ai.js'
 import { createRelay } from '../src/index.js'
 import { TelegramSource } from '../src/telegram-source.js'
 import { packageVersion } from '../src/version.js'
+import { initializeWorkspace } from '../src/workspace.js'
 import type { Update } from 'grammy/types'
 const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
 // This integration test starts subprocesses, persists their receipts, and invokes
 // the schedule CLI. Give a busy CI worker time to settle without changing the
 // production recovery deadline.
 const until=async(check:()=>Promise<boolean>,timeoutMs=15_000)=>{const deadline=Date.now()+timeoutMs;while(!(await check())){if(Date.now()>=deadline)throw new Error(`Timed out after ${timeoutMs}ms`);await new Promise(r=>setTimeout(r,20))}}
+const seedWorkspace=async(dir:string)=>{const purpose=join(dir,'purpose.md');await writeFile(purpose,'Fixture relay agent\n');await initializeWorkspace(dir,purpose)}
 
 test('failure evidence is bounded and redacts configured credentials, headers, tokens, URLs and keys',()=>{
  const token='123456789:abcdefghijklmnopqrstuvwxyz123456789'
@@ -142,6 +144,7 @@ test('relay shutdown waits for executor cleanup and final run state', async () =
 
 test('a fresh relay initializes its bot identity before polling', async () => {
  const dir=await mkdtemp(join(tmpdir(),'ez-cold-start-'))
+ await seedWorkspace(dir)
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw new Error('No executor expected')})
  const methods:string[]=[]
  relay.bot.api.config.use(async(_prev,method,_payload,signal)=>{
@@ -165,6 +168,7 @@ test('a fresh relay initializes its bot identity before polling', async () => {
 
 for (const cleanupFails of [false,true]) test(`polling conflict preserves work until an explicit shutdown (cleanup fails: ${cleanupFails})`, async t => {
  const dir=await mkdtemp(join(tmpdir(),'ez-polling-conflict-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ await seedWorkspace(dir)
  let release!:()=>void,entered!:()=>void,releaseDelivery!:()=>void,sending!:()=>void,child:ReturnType<typeof spawn>|undefined,polls=0
  const gate=new Promise<void>(resolve=>{release=resolve}),cleaning=new Promise<void>(resolve=>{entered=resolve})
  const deliveryGate=new Promise<void>(resolve=>{releaseDelivery=resolve}),deliveryStarted=new Promise<void>(resolve=>{sending=resolve})
@@ -285,6 +289,7 @@ test('group members can inspect failures and wake review without exposing other
 
 for (const failure of [400,401,503,'programming'] as const) test(`setup failure ${failure} retries only transient errors`,async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-setup-failure-'))
+ await seedWorkspace(dir)
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('No executor expected')})
  let commands=0,polls=0
  relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
@@ -310,6 +315,7 @@ for (const failure of [400,401,503,'programming'] as const) test(`setup failure
 
 test('shutdown aborts a pending bot initialization without starting polling',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-init-stop-'))
+ await seedWorkspace(dir)
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('No executor expected')})
  let initSignal:Parameters<typeof relay.bot.init>[0],polls=0
  relay.bot.api.config.use(async(_prev,method,_payload,signal)=>{

package/test/host-executor.test.ts

@@ -41,6 +41,12 @@ test('legacy host lock fails closed while its PID is alive',async()=>{
   }finally{await rm(root,{recursive:true,force:true})}
 })
 
+test('isolated installations cannot start host transport', async () => {
+  const abort=new AbortController()
+  await assert.rejects(serveHostExecutor({cli:'grok',isolation:'isolated',agents:[]},abort.signal),/Isolated agents run the native CLI in the relay/)
+  abort.abort()
+})
+
 test('host restart clears dead native lease only after proving previous CLI stopped',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-native-recovery-'));
   const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),toolsHome=path.join(root,'tools'),directory=path.join(controlDir,'host-executor');

package/test/install-config.test.ts

@@ -14,8 +14,10 @@ test('configure preserves custom paths and unknown settings, keeps token private
   const root = await mkdtemp(path.join(tmpdir(), 'ez-configure-'))
   try {
     await writeFile(path.join(root, '.env'), 'EZ_AGENT_WORKSPACE="my mind"\nEZ_CONTROL_DIR="private control"\nEXTRA="keep me"\n')
+    const purpose = path.join(root, 'purpose.md')
+    await writeFile(purpose, 'Configured assistant\n')
     const token = '123456789:' + 'a'.repeat(30)
-    const result = await configureInstallation(root, 'codex', token)
+    const result = await configureInstallation(root, 'codex', token, purpose)
     assert.equal(result.tokenConfigured, true)
     assert.equal(JSON.stringify(result).includes(token), false)
     const env = parseEnv(await readFile(result.envFile, 'utf8'))
@@ -24,12 +26,12 @@ test('configure preserves custom paths and unknown settings, keeps token private
     assert.equal(env.EZ_AGENT_WORKSPACE, path.join(root, 'my mind'))
     assert.equal((await stat(result.envFile)).mode & 0o777, 0o600)
     assert.equal(await readActiveExecutor(result.envFile), 'codex')
-    const soul = path.join(result.workspace, 'SOUL.md')
-    await writeFile(soul, 'Customized purpose')
+    const agents = path.join(result.workspace, 'AGENTS.md')
+    await writeFile(agents, 'Customized purpose')
     const repeated = await configureInstallation(root, 'codex')
     assert.deepEqual(repeated.created, [])
     assert.equal(repeated.tokenConfigured, true)
-    assert.equal(await readFile(soul, 'utf8'), 'Customized purpose')
+    assert.match(await readFile(agents, 'utf8'), /Customized purpose/)
     await assert.rejects(stat(result.controlDir), { code: 'ENOENT' }) // No control/owner mutation.
   } finally { await rm(root, { recursive: true, force: true }) }
 })
@@ -56,15 +58,24 @@ test('packaged configure accepts token through stdin without echo or extra initi
   const root = await mkdtemp(path.join(tmpdir(), 'ez-configure-cli-'))
   try {
     const token = '123456789:' + 'b'.repeat(30)
+    const purpose = path.join(root, 'purpose.md')
+    await writeFile(purpose, 'Packaged assistant\n')
     const bin = fileURLToPath(new URL('../bin/ezenciel-agents-setup.mjs', import.meta.url))
-    const result = spawnSync(process.execPath, [bin, 'configure', 'codex', '--token-stdin'], { cwd: root, input: token, encoding: 'utf8', timeout: 10000 })
+    const result = spawnSync(process.execPath, [bin, 'configure', 'codex', '--purpose-file', purpose, '--token-stdin'], { cwd: root, input: token, encoding: 'utf8', timeout: 10000 })
     assert.equal(result.status, 0, result.stderr)
     assert.equal((result.stdout + result.stderr).includes(token), false)
-    assert.equal(JSON.parse(result.stdout).created.length, 3)
+    assert.deepEqual(JSON.parse(result.stdout).created, ['AGENTS.md'])
     assert.equal(parseEnv(await readFile(path.join(root, '.env'), 'utf8')).TELEGRAM_BOT_TOKEN, token)
   } finally { await rm(root, { recursive: true, force: true }) }
 })
 
+test('fresh configure refuses to invent a generic purpose', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-configure-purpose-'))
+  try {
+    await assert.rejects(configureInstallation(root, 'codex'), /purpose file is required/)
+  } finally { await rm(root, { recursive: true, force: true }) }
+})
+
 test('Docker startup uses explicit deployment binding and literal paths without secrets or host supervisors', () => {
   const definition = serviceDefinition('/tmp/my agent $literal')
   assert.equal(definition.command, 'docker')