@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.36

package/src/plugins/manager.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createHash, randomUUID, randomBytes } from 'node:crypto';
 import { spawn } from 'node:child_process';
+import { callDeliverySocket } from '../delivery-socket-client.mjs';
 import { readFileSync, realpathSync } from 'node:fs';
 
 const reserved = new Set(['status','updates','plugins','tools','message','owner','approval','react','setup','help','version']);
@@ -21,10 +22,24 @@ export async function atomic(file, value) {
   const tmp = `${file}.${randomUUID()}.tmp`;
   await fs.writeFile(tmp,JSON.stringify(value,null,2)+'\n',{mode:0o600,flag:'wx'});
   await fs.rename(tmp,file);
+  await stewardOwned(file);
+}
+// Files the broker creates as root must stay usable by the agent owner:
+// adopt the owning uid/gid of the containing directory. Off root this is a no-op.
+export async function stewardOwned(file) {
+  if (process.geteuid?.() !== 0) return;
+  const parent = await fs.stat(path.dirname(file));
+  await fs.chown(file, parent.uid, parent.gid);
 }
 // Only a registry locator lives in native instructions. Inventory is generated on read.
 export async function bindToolDiscovery(home,workspace) {
   home=await fs.realpath(home);workspace=await fs.realpath(workspace);
+  let launcher=path.join(home,'bin','ez');
+  const config=await json(path.join(home,'config.json')).catch(error=>{if(error.code==='ENOENT')return undefined;throw error;});
+  if(config?.hostConfig) {
+    const host=await json(config.hostConfig);
+    if(host.isolation==='isolated') launcher='ez';
+  }
   const start='<!-- ez tools: begin -->',end='<!-- ez tools: end -->';
   for(const name of ['AGENTS.md','AGENTS.override.md']) {
     const file=path.join(workspace,name);
@@ -34,7 +49,7 @@ export async function bindToolDiscovery(home,workspace) {
     const prior=stat?await fs.readFile(file,'utf8'):'';
     const from=prior.indexOf(start),to=prior.indexOf(end);
     if((from<0)!==(to<0)||(from>=0&&(to<from||prior.indexOf(start,from+start.length)>=0||prior.indexOf(end,to+end.length)>=0)))throw Error('Malformed tool discovery block');
-    const block=start+'\nInstalled plugin snippets and skills: `'+path.join(home,'bin','ez')+' tools list --details`. Use this bound launcher for plugin commands; read the relevant skill when needed.\n'+end;
+    const block=start+'\nInstalled capabilities: `'+launcher+' --help` and `'+launcher+' tools list --details`. Use this bound launcher; read the matching skill when needed.\n'+end;
     const next=from<0?prior+'\n'+block+'\n':prior.slice(0,from)+block+prior.slice(to+end.length);
     if(next===prior)continue;
     const tmp=file+'.'+randomUUID()+'.tmp';
@@ -48,7 +63,7 @@ async function activeInvocations(home) {
     if(!/^[0-9a-f-]{36}\.json$/.test(file))throw Error('Invalid command invocation lease; inspect before recovery');
     const lease=await json(path.join(directory,file));
     if(!Number.isSafeInteger(lease.pid)||lease.pid<1||typeof lease.container!=='string'||!lease.container)throw Error('Invalid command invocation lease; inspect before recovery');
-    try {process.kill(lease.pid,0);return true;} catch(error) {if(error.code!=='ESRCH')throw error;}
+    try {process.kill(lease.pid,0);return true;} catch(error) {if(error.code!=='ESRCH'&&error.code!=='EPERM')throw error;}
     const state=await run(['container','inspect',lease.container],{capture:true});
     if(state.code===0)throw Error(`Stale command invocation lease; inspect container ${lease.container} before recovery`);
     if(!/No such (?:object|container)/i.test(state.stderr+state.stdout))throw Error('Unable to verify a stale command invocation lease; inspect Docker before recovery');
@@ -59,6 +74,7 @@ async function activeInvocations(home) {
 async function invocationLease(home,container) {
   const directory=invocationDirectory(home);await privateDir(directory);
   const file=path.join(directory,randomUUID()+'.json');await fs.writeFile(file,JSON.stringify({pid:process.pid,container}),{mode:0o600,flag:'wx'});
+  await stewardOwned(file);
   return async()=>{await fs.rm(file,{force:true});};
 }
 export async function locked(home, fn, {allowInvocations=false}={}) {
@@ -188,10 +204,55 @@ export function folderMounts(config, record) {
   }
   return mounts;
 }
-export async function checkFolders(config, record) {
+async function hostFolderRoots(config, record, home) {
+  const configuredHost = config.hostConfig ?? (typeof config.deploymentDir === 'string' && path.isAbsolute(config.deploymentDir) ? path.join(config.deploymentDir, 'host-executor.json') : undefined);
+  if (configuredHost === undefined) return null;
+  if (!home || typeof configuredHost !== 'string' || !path.isAbsolute(configuredHost)) throw Error('Invalid host folder binding');
+  home = realpathSync(home);
+  const hostConfig = realpathSync(configuredHost);
+  if (hostConfig !== configuredHost || path.basename(hostConfig) !== 'host-executor.json' || childOf(hostConfig, home))
+    throw Error('Host folder bindings require an external host config');
+  const host = JSON.parse(readFileSync(hostConfig, 'utf8'));
+  if (!host || typeof host !== 'object' || !Array.isArray(host.agents)) throw Error('Invalid host folder bindings');
+  const candidates = host.agents.filter(agent => agent && typeof agent === 'object' && typeof agent.toolsHome === 'string' && realpathSync(agent.toolsHome) === home);
+  if (candidates.length !== 1) throw Error('Host folder binding does not belong to this registry');
+  const agent = candidates[0], deployment = path.dirname(hostConfig);
+  if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
+      realpathSync(agent.workspace) !== config.workspace ||
+      childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
+    throw Error('Invalid host folder binding deployment');
+  // The isolated broker receives only the exact workspace, control directory,
+  // tools home, and host config mounts. It must not require the host
+  // deployment's convenience mind/control symlinks (or a deployment mount).
+  if (process.env.EZ_DOCKER_COMPOSE !== 'standalone' &&
+      (realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
+       realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir)))
+    throw Error('Invalid host folder binding deployment');
+  const configured = agent.pluginFolderRoots;
+  if (configured !== undefined && (!configured || typeof configured !== 'object' || Array.isArray(configured)))
+    throw Error('Invalid host folder roots');
+  for (const [plugin, roots] of Object.entries(configured || {})) {
+    id(plugin); strings(roots);
+    for (const root of roots) {
+      if (!path.isAbsolute(root) || root === '/' || realpathSync(root) !== root) throw Error('Invalid host folder root');
+      if (!((await fs.stat(root)).isDirectory())) throw Error('Invalid host folder root');
+    }
+  }
+  const roots = [config.workspace];
+  if (agent.sharedWorkspace !== undefined) {
+    if (typeof agent.sharedWorkspace !== 'string' || !path.isAbsolute(agent.sharedWorkspace)) throw Error('Invalid shared workspace folder root');
+    roots.push(realpathSync(agent.sharedWorkspace));
+  }
+  roots.push(...(configured?.[record.manifest.id] || []).map(root => realpathSync(root)));
+  return roots;
+}
+export async function checkFolders(config, record, home) {
+  const allowed = await hostFolderRoots(config, record, home);
   for (const { source } of folderMounts(config, record)) {
     if (await fs.realpath(source) !== source || !(await fs.stat(source)).isDirectory())
       throw Error('Folder source must remain an existing real directory');
+    if (allowed && !allowed.some(root => childOf(source, root)))
+      throw Error('Folder source is not granted to this agent');
   }
 }
 const childOf = (candidate, parent) => candidate === parent || candidate.startsWith(parent + path.sep);
@@ -211,13 +272,19 @@ export async function hostNetworkBindings(config, record, home) {
   if (candidates.length !== 1) throw Error('Host network binding does not belong to this registry');
   const agent = candidates[0], deployment = path.dirname(hostConfig);
   if (typeof agent.workspace !== 'string' || typeof agent.controlDir !== 'string' ||
-      realpathSync(agent.workspace) !== config.workspace || realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
-      realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir) ||
+      realpathSync(agent.workspace) !== config.workspace ||
       childOf(hostConfig, config.workspace) || childOf(hostConfig, realpathSync(agent.controlDir)))
     throw Error('Invalid host network binding deployment');
   const configured = agent.pluginNetworkBindings;
   if (configured !== undefined && (!configured || typeof configured !== 'object' || Array.isArray(configured)))
     throw Error('Invalid host network bindings');
+  if (process.env.EZ_DOCKER_COMPOSE === 'standalone') {
+    if (configured && Object.keys(configured).length) throw Error('Isolated broker cannot use host network bindings');
+    return [];
+  }
+  if (realpathSync(path.join(deployment, 'mind')) !== config.workspace ||
+      realpathSync(path.join(deployment, 'control')) !== realpathSync(agent.controlDir))
+    throw Error('Invalid host network binding deployment');
   const route = configured?.[record.manifest?.id];
   if (route === undefined) return [];
   keys(route, ['revisions', 'bindings']);
@@ -273,14 +340,24 @@ export async function compose(config, record, secrets={}, home) {
         return [key,(value.prefix||'')+secrets[value.secret]+(value.suffix||'')];
       }))}:{}),...(s.command?{command:s.command}:{})};
   }
-  return attachShared({name:record.project,services,volumes,...(Object.keys(networks).length?{networks}:{})}, record);
+  // Keep the persisted descriptor portable between the host supervisor's
+  // Compose v2 and the isolated broker's bundled Compose v1. Project identity
+  // is always supplied with --project-name, so a top-level name is unnecessary.
+  return attachShared({version:'3.8',services,volumes,...(Object.keys(networks).length?{networks}:{})}, record);
+}
+async function refreshRecordCompose(home, config, record) {
+  await checkFolders(config, record, home);
+  const secrets=await json(path.join(home,'packages',record.manifest.id,'secrets.json')).catch(error=>{if(error.code==='ENOENT')return {};throw error;});
+  await atomic(record.compose, await compose(config, record, secrets, home));
 }
 function dockerEnv() {
-  return Object.fromEntries(['HOME','PATH','LANG','LC_ALL','TMPDIR','DOCKER_HOST','DOCKER_CONTEXT','DOCKER_CONFIG','BUILDX_CONFIG'].filter(k=>process.env[k]!==undefined).map(k=>[k,process.env[k]]));
+  return Object.fromEntries(['HOME','PATH','LANG','LC_ALL','TMPDIR','DOCKER_HOST','DOCKER_CONTEXT','DOCKER_CONFIG','BUILDX_CONFIG','EZ_DOCKER_COMPOSE'].filter(k=>process.env[k]!==undefined).map(k=>[k,process.env[k]]));
 }
+const dockerInvocation = argv => process.env.EZ_DOCKER_COMPOSE === 'standalone' && argv[0] === 'compose'
+  ? {command:'docker-compose',args:argv.slice(1)} : {command:'docker',args:argv};
 export function run(argv,{capture=false,container,signal,stdin,onStdout,onStart,timeoutMs=0,maxBytes=Infinity}={}) {
   return new Promise((resolve,reject)=>{
-    const child=spawn('docker',argv,{env:dockerEnv(),stdio:capture?['pipe','pipe','pipe']:['inherit','inherit','inherit']});
+    const invocation=dockerInvocation(argv),child=spawn(invocation.command,invocation.args,{env:dockerEnv(),stdio:capture?['pipe','pipe','pipe']:['inherit','inherit','inherit']});
     let stdout='',stderr='',cancelled=false,killTimer,bytes=0,failure;
     if(capture) {
       const collect=(b,err)=>{bytes+=b.length;if(bytes>maxBytes){failure=Error('Command output limit exceeded');cancel('SIGTERM');return;}if(err)stderr+=b;else stdout+=b;};
@@ -329,6 +406,53 @@ async function checked(args) {
   const r=await run(args,{capture:true});if(r.code) throw Error(r.stderr||r.stdout||`Docker failed (${r.code})`);return r.stdout;
 }
 const composeArgs = record => ['compose','--project-name',record.project,'--file',record.compose];
+// Application context is opaque domain data. A command container receives only
+// the object addressed to its installed plugin ID, never core state or another
+// plugin's context. The current run and binding are re-authorized before it is
+// forwarded to Docker.
+const ownerKey = owner => owner?.id || (Number.isSafeInteger(owner?.telegramUserId) && Number.isSafeInteger(owner?.telegramChatId)
+  ? `telegram:${owner.telegramUserId}:${owner.telegramChatId}` : undefined);
+const ownerEpoch = owner => owner?.generation || owner?.pairedAt;
+const readJson = async file => JSON.parse(await fs.readFile(file,'utf8'));
+// Run records live in relay memory; this manager stays plain Node, so it asks
+// the relay through the shared delivery socket client. A relay that is down
+// reads like a missing run: no context is forwarded.
+const readRun = async (socketPath,runId) => callDeliverySocket(socketPath,{op:'get',payload:{runId}}).catch(error=>{
+  if(/Unknown run/.test(error.message)||/Delivery relay unavailable/.test(error.message))return undefined;
+  throw error;
+});
+// This manager is intentionally runnable as plain Node. Read only the current
+// run and existing application binding rather than importing the TypeScript
+// relay, and fail closed on missing/revoked ownership.
+const authorizedApplicationRun = async (controlDir,runId,socketPath) => {
+  if(!path.isAbsolute(controlDir)||!/^[A-Za-z0-9_-]+$/.test(runId))throw Error('Plugin context requires a bound active run');
+  const run=await readRun(socketPath||path.join(controlDir,'delivery.sock'),runId);
+  const application=run?.application ?? run?.telegramApplication;
+  if(!application?.context||run?.id!==runId||run.status!=='running'||typeof application.bindingId!=='string')return undefined;
+  const state=await readJson(path.join(controlDir,'control-state.json'));
+  const bindings=await readJson(path.join(controlDir,'application-bindings.json'));
+  const binding=Array.isArray(bindings)?bindings.find(candidate=>candidate?.bindingId===application.bindingId):undefined;
+  if(!binding?.owner||!state?.owner||ownerKey(binding.owner)!==ownerKey(state.owner)||ownerEpoch(binding.owner)!==ownerEpoch(state.owner)||
+    run.ownerId!==ownerKey(state.owner)||run.ownerEpoch!==ownerEpoch(state.owner))throw Error('Application authority revoked');
+  return application;
+};
+export async function applicationPluginContext(pluginId, environment=process.env) {
+  const rawDir=environment.EZ_CONTROL_DIR?.trim(),runId=environment.EZ_RUN_ID?.trim();
+  if(!rawDir||!runId)return undefined;
+  if(!path.isAbsolute(rawDir))throw Error('Plugin context requires a bound active run');
+  const controlDir=await fs.realpath(rawDir).catch(()=>undefined);
+  if(!controlDir)return undefined;
+  const application=await authorizedApplicationRun(controlDir,runId,environment.EZ_DELIVERY_SOCKET?.trim()||path.join(rawDir,'delivery.sock'));
+  const contexts=application?.context?.plugins;
+  if(!contexts||typeof contexts!=='object'||Array.isArray(contexts)||!Object.hasOwn(contexts,pluginId))return undefined;
+  const context=contexts[pluginId];
+  if(!context||typeof context!=='object'||Array.isArray(context))throw Error('Plugin application context must be an object');
+  const checkDepth=(value,level=0)=>{if(level>10)throw Error('Plugin application context is too deeply nested');if(value&&typeof value==='object')for(const entry of Object.values(value))checkDepth(entry,level+1);};
+  checkDepth(context);
+  const encoded=JSON.stringify(context);
+  if(Buffer.byteLength(encoded)>16*1024)throw Error('Plugin application context is too large');
+  return encoded;
+}
 export async function registry(home) {
   const r=await json(path.join(home,'registry.json'));
   if(r.schemaVersion!==1 || r.owner!==home || !r.plugins || !r.commands) throw Error('Corrupt registry');
@@ -339,19 +463,36 @@ export async function registry(home) {
   return r;
 }
 // The lock protects admission and compose refresh, never a persistent connection.
-export async function prepareCommand(home,alias,args,{revision,exclude,publish,invocation=false}={}) {
+export async function prepareCommand(home,alias,args,{revision,exclude,publish,invocation=false,environment=process.env}={}) {
   strings(args);
   return locked(home,async()=>{
     const config=await json(path.join(home,'config.json')),r=await registry(home);
     const record=r.plugins[r.commands[alias]],binding=record?.deployment.commands[alias];
     if(!binding||r.commands[alias]===exclude)throw Error('Unknown or unavailable registered CLI');
     if(revision!==undefined&&revision!==record.revision)throw Error('Plugin changed; discover again');
-    await checkFolders(config,record);
+    await checkFolders(config,record,home);
     const secrets=await json(path.join(home,'packages',record.manifest.id,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
     await atomic(record.compose,await compose(config,record,secrets,home));
     const container=`${record.project}-call-${randomUUID()}`;
-    const release=invocation?await invocationLease(home,container):undefined;
-    return {container,plugin:record.manifest.id,revision:record.revision,argv:[...composeArgs(record),'run','--rm','--no-deps','-T','--name',container,...(publish?['--publish',publish]:[]),'--entrypoint',binding.argv[0],binding.service,...binding.argv.slice(1),...record.manifest.commands[alias].args,...args,...(binding.suffix||[])],release};
+    // The application context must reach the command container as an
+    // environment variable. A top-level `compose --env-file` only feeds
+    // variable interpolation in both Compose v1 and v2, so the container never
+    // receives it; a one-shot override file sets the service environment
+    // directly and keeps the value out of the process argument list.
+    const context=await applicationPluginContext(record.manifest.id,environment);
+    let contextFile;
+    if(context!==undefined){
+      await privateDir(path.join(home,'plugin-context'));
+      contextFile=path.join(home,'plugin-context',`${randomUUID()}.json`);
+      // Compose interpolates every file it loads, including this override, so
+      // an opaque `$` in the context must be escaped as `$$` to reach the
+      // container byte-for-byte.
+      const override={services:{[binding.service]:{environment:{EZ_PLUGIN_CONTEXT:context.replaceAll('$',()=> '$$')}}}};
+      await fs.writeFile(contextFile,JSON.stringify(override,null,2)+'\n',{mode:0o600,flag:'wx'});
+    }
+    const invocationRelease=invocation?await invocationLease(home,container):undefined;
+    const release=(invocationRelease||contextFile)?(async()=>{try{if(contextFile)await fs.rm(contextFile,{force:true});}finally{await invocationRelease?.();}}):undefined;
+    return {container,plugin:record.manifest.id,revision:record.revision,contextFile,argv:[...composeArgs(record),...(contextFile?['--file',contextFile]:[]),'run','--rm','--no-deps','-T','--name',container,...(publish?['--publish',publish]:[]),'--entrypoint',binding.argv[0],binding.service,...binding.argv.slice(1),...record.manifest.commands[alias].args,...args,...(binding.suffix||[])],release};
   },{allowInvocations:true});
 }
 export async function init(home,workspace,catalogFile,hostConfig,standalone=false) {
@@ -431,6 +572,10 @@ export async function main(args) {
   home=await fs.realpath(home);
   const config=await json(path.join(home,'config.json'));
   if(config.schemaVersion!==1 || !path.isAbsolute(config.workspace)) throw Error('Invalid binding');
+  if(config.hostConfig || config.deploymentDir) {
+    const cwd=await fs.realpath(process.cwd());
+    if(!childOf(cwd,config.workspace)) throw Error(`Registry belongs to ${config.workspace}; invoke its launcher only from that owning workspace`);
+  }
   const [group,action,...rest]=args;
   if(group==='status'){if(args.length!==1)throw Error('Use status without arguments');await registry(home);return emit(await (await import('../updates/status.mjs')).status(home));}
   if(group==='updates')return emit(await (await import('../updates/control.mjs')).command(home,args.slice(1)));
@@ -439,7 +584,7 @@ export async function main(args) {
     return (await import('./connection.mjs')).connect(home,rest[0],rest.slice(1),{publish:port,serve:true});
   }
   if(group==='tools'&&action==='connect')return (await import('./connection.mjs')).connect(home,rest[0],rest.slice(1));
-  if(group==='--help'||!group) return emit({commands:['status','updates check|policy|prepare|apply|status','plugins available|catalog-add|list|inspect|install|start|stop|status|logs|uninstall|export','tools list [--details]|exposure|connect <alias> <args...>|serve <host-port:container-port> <alias> <args...>','<registered CLI> ...'],scope:home});
+  if(group==='--help'||!group) return emit({commands:['status','updates check|policy|prepare|apply|status','plugins available|catalog-add|list|inspect|install|start|stop|status|logs|uninstall|export','tools list [--details]|exposure|connect <alias> <args...>|serve <host-port:container-port> <alias> <args...>','<registered CLI> ...'],foreignWorkspace:'Relay-bound registries run only from their owning agent workspace',scope:home});
   if(group==='plugins'&&(!action||args.includes('--help'))) return emit({commands:['available','list','inspect <id>','install <id>','start <id>','stop <id>','status <id>','logs <id>','uninstall <id>','catalog-add <id> --source PATH --revision HASH','export <id> <artifact> --output PATH','folder-bind <id> --service NAME --source PATH --target PATH [--writable]','folder-unbind <id> --service NAME --target PATH','folders <id>','shared-enable <id> <service>','shared-disable <id> <service>','shared-status <id> <service>'],uninstall:'Stops and removes containers/network and unregisters aliases; retains all volumes and secrets. No data deletion flag.',scope:home});
   if(group==='plugins'||group==='tools') {
     args=rest;args=args.filter(a=>a!=='--json');
@@ -490,7 +635,7 @@ export async function main(args) {
         const folders=(settings.folders?.[name] || []).filter(f => f.service !== service || f.target !== target);
         if(action === 'folder-bind') folders.push({service,source,target,...(writable ? {writable:true} : {})});
         settings.folders={...settings.folders,[name]:folders};
-        await checkFolders(settings,latest);
+        await checkFolders(settings,latest,home);
         const secrets=await json(path.join(home,'packages',name,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
         const generated=await compose(settings,latest,secrets,home);
         await atomic(path.join(home,'config.json'),settings);
@@ -506,14 +651,14 @@ export async function main(args) {
         const current = await registry(home), latest = current.plugins[name];
         if (latest?.revision !== record.revision) throw Error('Plugin changed during shared service request');
         const currentConfig=await json(path.join(home,'config.json'));
-        await checkFolders(currentConfig, latest);
+        await checkFolders(currentConfig, latest,home);
         const result = action === 'shared-enable' ? await sharedService(latest, key, 'enable', run) : { state: 'detached' };
         latest.sharedEnabled = [...new Set([...(latest.sharedEnabled || []).filter(k => k !== key), ...(action === 'shared-enable' ? [key] : [])])];
         const secrets = await json(path.join(home, 'packages', name, 'secrets.json')).catch(e => { if (e.code === 'ENOENT') return {}; throw e; });
         await atomic(latest.compose, await compose(currentConfig, latest, secrets, home));
         // Persist the binding before recreating clients; start can recover an interrupted recreation.
         await atomic(path.join(home, 'registry.json'), current);
-        await checked([...composeArgs(latest), 'up', '-d', '--wait']);
+        await checked([...composeArgs(latest), 'up', '-d', ...(process.env.EZ_DOCKER_COMPOSE === 'standalone' ? [] : ['--wait'])]);
         return emit({ ok: true, plugin: name, shared: key, ...result });
       });
     }
@@ -527,18 +672,25 @@ export async function main(args) {
       return emit({ok:true,path:dest});
     }
     if(args.length)throw Error('Unknown lifecycle arguments');
-    if(action==='logs') return emit({plugin:name,logs:await checked([...composeArgs(record),'logs','--tail','100','--no-color'])});
-    if(action==='status') {const output=await checked([...composeArgs(record),'ps','--all','--format','json']);return emit({plugin:name,installedVersion:record.manifest.version,containers:output});}
+    if(action==='logs'||action==='status') return locked(home,async()=>{
+      const current=await registry(home),latest=current.plugins[name];
+      if(latest?.revision!==record.revision)throw Error('Plugin changed during lifecycle request');
+      const currentConfig=await json(path.join(home,'config.json'));
+      // A host-side Compose v2 operation may have rewritten this file with
+      // fields that the broker's bundled Compose v1 does not understand.
+      await refreshRecordCompose(home,currentConfig,latest);
+      if(action==='logs')return emit({plugin:name,logs:await checked([...composeArgs(latest),'logs','--tail','100','--no-color'])});
+      const ps = process.env.EZ_DOCKER_COMPOSE === 'standalone' ? ['ps', '--all'] : ['ps', '--all', '--format', 'json'];
+      const output=await checked([...composeArgs(latest),...ps]);
+      return emit({plugin:name,installedVersion:latest.manifest.version,containers:output});
+    });
     if(!['start','stop','uninstall'].includes(action))throw Error('Unknown lifecycle command');
     return locked(home,async()=>{
-      const current=await registry(home);if(current.plugins[name]?.revision!==record.revision)throw Error('Plugin changed during lifecycle request');
-      if(action==='start') {
-        const currentConfig=await json(path.join(home,'config.json'));
-        await checkFolders(currentConfig,current.plugins[name]);
-        const secrets=await json(path.join(home,'packages',name,'secrets.json')).catch(e=>{if(e.code==='ENOENT')return {};throw e;});
-        await atomic(record.compose,await compose(currentConfig,current.plugins[name],secrets,home));
-      }
-      await checked([...composeArgs(record),...(action==='start'?['up','-d','--wait']:action==='stop'?['stop']:['down'])]);
+      const current=await registry(home),latest=current.plugins[name];
+      if(latest?.revision!==record.revision)throw Error('Plugin changed during lifecycle request');
+      const currentConfig=await json(path.join(home,'config.json'));
+      await refreshRecordCompose(home,currentConfig,latest);
+      await checked([...composeArgs(latest),...(action==='start'?['up','-d',...(process.env.EZ_DOCKER_COMPOSE === 'standalone'?[]:['--wait'])]:action==='stop'?['stop']:['down'])]);
       if(action==='uninstall') {delete current.plugins[name];for(const [alias,owner] of Object.entries(current.commands))if(owner===name)delete current.commands[alias];await atomic(path.join(home,'registry.json'),current);}
       emit({ok:true,plugin:name,action,dataPreserved:true});
     });

package/src/plugins/native-tasks.mjs

@@ -20,8 +20,8 @@ export async function nativeTaskBinding(home,environment=process.env) {
   const matches=host.agents.filter(a=>a.toolsHome===home&&a.workspace===workspace);
   if(matches.length!==1||typeof matches[0].controlDir!=='string'||!path.isAbsolute(matches[0].controlDir))throw Error('Native task binding does not match owning agent');
   const controlDir=await fs.realpath(matches[0].controlDir);
-  const env=Object.fromEntries(['HOME','PATH','LANG','LC_ALL','TMPDIR'].filter(k=>environment[k]!==undefined).map(k=>[k,environment[k]]));
-  return {cwd:workspace,env:{...env,EZ_CONTROL_DIR:controlDir,EZ_AGENT_WORKSPACE:workspace,EZ_EXECUTOR_CLI:host.cli}};
+  const env=Object.fromEntries(['HOME','PATH','LANG','LC_ALL','TMPDIR','EZ_DELIVERY_SOCKET'].filter(k=>environment[k]!==undefined).map(k=>[k,environment[k]]));
+  return {cwd:workspace,env:{...env,EZ_CONTROL_DIR:controlDir,EZ_AGENT_WORKSPACE:workspace,EZ_EXECUTOR_CLI:host.cli,EZ_DELIVERY_SOCKET:env.EZ_DELIVERY_SOCKET??path.join(matches[0].controlDir,'delivery.sock')}};
 }
 
 export async function nativeTasks(home,args,{signal,command='schedule',deliveryContext}={}) {

package/src/prompt-suffix.ts

@@ -0,0 +1,12 @@
+import type { RunRecord } from './runs.js'
+
+// Relay/host overhead converts a run's trigger fields into the one slim suffix
+// the core appends to literal input. The core itself never reads the ledger.
+export const runPromptSuffix = (run: RunRecord | null | undefined): string => {
+  if (!run || run.taskId) return ''
+  if (run.messageId === undefined && !run.application && !run.delivery) return ''
+  const scope = run.application?.scope ?? run.delivery?.scope
+  const channel = run.scheduled ? 'schedule' : run.application || run.delivery ? 'application' : run.messageId !== undefined ? 'chat' : 'trigger'
+  const contact = run.messageId !== undefined ? ` message ${run.messageId}` : scope !== undefined ? ` scope ${JSON.stringify(scope)}` : ''
+  return `\n\n[${channel}${contact}] Reply via ezenciel-agents-message --text "..."; stdout is not delivered.`
+}

package/src/react.ts

@@ -1,6 +1,6 @@
 import { loadControlConfig } from './config.js'
 import { normalizeReactionEmoji, TELEGRAM_REACTIONS } from './reaction.js'
-import { RunStore } from './runs.js'
+import { callDeliverySocket, socketPathFor } from './delivery-socket.js'
 
 const runId = process.env.EZ_RUN_ID?.trim()
 const args = process.argv.slice(2).filter((arg) => arg !== '--')
@@ -28,6 +28,8 @@ if (!emoji) {
   process.exit(1)
 }
 
-const store = new RunStore(loadControlConfig().controlDir)
-const item = await store.enqueueReaction(runId, emoji)
-console.log(JSON.stringify({ ok: true, run: runId, outbox_id: item.id, emoji: item.emoji }))
+const controlDir = loadControlConfig().controlDir
+const item = await callDeliverySocket(socketPathFor(controlDir), {
+  op: 'enqueue', payload: { kind: 'reaction', runId, emoji },
+}) as { outbox_id: string; id: string; emoji?: string }
+console.log(JSON.stringify({ ok: true, run: runId, outbox_id: item.id, emoji: item.emoji ?? emoji }))