@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.36

package/test/application-controls.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, open } from 'node:fs/promises'
+import { mkdtemp, rm, open, mkdir, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomBytes } from 'node:crypto'
@@ -9,6 +9,41 @@ import { ControlStore } from '../src/control-state.js'
 import { createAiMenu } from '../src/menu.js'
 import { RunStore } from '../src/runs.js'
 
+test('shared controls validate detected host presets against the host catalog', async t => {
+  const root = await mkdtemp(join(tmpdir(), 'ez-host-controls-'))
+  const previousTransport = process.env.EZ_EXECUTOR_TRANSPORT
+  const previousControl = process.env.EZ_CONTROL_DIR
+  process.env.EZ_EXECUTOR_TRANSPORT = 'host'
+  process.env.EZ_CONTROL_DIR = root
+  t.after(async () => {
+    if (previousTransport === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT
+    else process.env.EZ_EXECUTOR_TRANSPORT = previousTransport
+    if (previousControl === undefined) delete process.env.EZ_CONTROL_DIR
+    else process.env.EZ_CONTROL_DIR = previousControl
+    await rm(root, {recursive:true, force:true})
+  })
+  await mkdir(join(root, 'host-executor'), {recursive:true})
+  await writeFile(join(root, 'host-executor', 'models.json'), JSON.stringify([
+    {cli:'grok', model:'grok-4.6', name:'Grok 4.6', efforts:['high']},
+  ]))
+  const control = new ControlStore(root, 1000)
+  await control.requestPairing(42, 42); const owner = await control.approveOwner(42)
+  const menu = createAiMenu(control, 'codex')
+  const detected = {id:'detected_fixture', name:'Grok 4.6 High', cli:'grok', model:'grok-4.6', effort:'high'}
+  await control.aiState(menu.initial)
+  await control.savePreset(detected)
+  const initial = await control.captureChoice(menu.initial)
+  await control.selectPreset(detected.id, initial.sessionId, true)
+  const current = (await control.getActiveSession())!
+  const channel = new ApplicationChannel({controlDir:root, initial:menu.initial, aiControls:menu, wake:()=>{}, cancel:async()=>{}})
+  const binding = (await channel.bindings.register('shared', randomBytes(32).toString('base64url'), owner, true))!
+
+  const selected = await channel.changeControls(binding.bindingId, {
+    action:'select', presetId:detected.id, expectedSession:current.sessionId,
+  })
+  assert.equal(selected.ai.selectedId, detected.id)
+})
+
 test('private scope reset and model controls preserve running sessions and shared state', async t => {
   const root = await mkdtemp(join(tmpdir(),'ez-private-controls-'))
   const control = new ControlStore(root,1000)
@@ -75,6 +110,7 @@ test('application controls share native choices, protect hidden scopes and prese
   await control.requestPairing(42, 42); const owner = await control.approveOwner(42)
   const menu = createAiMenu(control, 'codex', async () => [
     {cli:'codex', model:'gpt-6-astra', name:'Fixture model', efforts:['low','high']},
+    {cli:'codex', provider:'openrouter', model:'gpt-6-astra', name:'OpenRouter fixture', efforts:['low','high']},
   ], root, join(root, 'native-home'), async () => true)
   const channel = new ApplicationChannel({controlDir:root, initial:menu.initial, aiControls:menu, wake:()=>{}, cancel:async()=>{}})
   t.after(async()=>{await channel.stop(); await rm(root,{recursive:true,force:true})})
@@ -107,9 +143,11 @@ test('application controls share native choices, protect hidden scopes and prese
   assert.deepEqual((await control.aiState(menu.initial)).presets,presetsBefore)
   const selected = await request({action:'model',cli:'codex',model:'gpt-6-astra',effort:'high',expectedSession:old.sessionId})
   assert.equal(selected.status,200)
-  assert.equal((await control.captureChoice(menu.initial)).preset.effort,'high')
+  const modelChoice = await control.captureChoice(menu.initial)
+  assert.equal(modelChoice.preset.effort,'high')
+  assert.notEqual(modelChoice.sessionId,old.sessionId)
   assert.deepEqual((await new RunStore(root).get(run.id))!.execution,old)
-  const reset = await request({action:'new',expectedSession:old.sessionId})
+  const reset = await request({action:'new',expectedSession:modelChoice.sessionId})
   assert.equal(reset.status,200)
   const next = (await control.getActiveSession())!
   assert.notEqual(next.sessionId,old.sessionId)
@@ -119,6 +157,21 @@ test('application controls share native choices, protect hidden scopes and prese
   assert.equal((await request()).status,401)
 })
 
+test('application model controls disambiguate the same model by provider', async t => {
+  const root=await mkdtemp(join(tmpdir(),'ez-app-provider-control-')),control=new ControlStore(root,1000)
+  await control.requestPairing(42,42);const owner=await control.approveOwner(42)
+  const menu=createAiMenu(control,'codex',async()=>[
+    {cli:'codex',model:'shared-model',name:'Native',efforts:[]},
+    {cli:'codex',provider:'openrouter',model:'shared-model',name:'OpenRouter',efforts:[]},
+  ],root,join(root,'native-home'),async()=>true)
+  const channel=new ApplicationChannel({controlDir:root,initial:menu.initial,aiControls:menu,wake:()=>{},cancel:async()=>{}})
+  t.after(async()=>{await channel.stop();await rm(root,{recursive:true,force:true})})
+  const binding=(await channel.bindings.register('shared',randomBytes(32).toString('base64url'),owner,true))!
+  const current=await control.captureChoice(menu.initial)
+  await channel.changeControls(binding.bindingId,{action:'model',cli:'codex',provider:'openrouter',model:'shared-model',expectedSession:current.sessionId})
+  assert.equal((await control.captureChoice(menu.initial)).preset.provider,'openrouter')
+})
+
 test('atomic control mutations reject a replaced owner even when both active sessions are empty', async t => {
   const root = await mkdtemp(join(tmpdir(),'ez-control-owner-'))
   t.after(()=>rm(root,{recursive:true,force:true}))

package/test/application-only.test.ts

@@ -13,18 +13,17 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { ApplicationBindings } from '../src/application-channel.js'
+import { initializeWorkspace } from '../src/workspace.js'
 
 const waitFor = async (condition: () => Promise<boolean>) => {
   for (let i=0;i<300;i++) { if (await condition()) return; await new Promise(r=>setTimeout(r,10)) }
   throw new Error('Timed out')
 }
 
-test('application-only mode explicitly requires native listener and ignores bot credentials', () => {
-  assert.throws(()=>loadConfig({}), /TELEGRAM_BOT_TOKEN/)
-  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'false'}), /EZ_APPLICATION_PORT/)
-  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'no'}), /true or false/)
-  assert.throws(()=>loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8110',EZ_CHANNEL_BACKEND_URL:'http://backend',EZ_CHANNEL_BACKEND_TOKEN:'secret'}), /native Ez executor/)
-  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8110',TELEGRAM_BOT_TOKEN:'unused-secret'})
+test('application-only mode is inferred from the absence of a bot token and requires a native listener', () => {
+  assert.throws(()=>loadConfig({}), /EZ_APPLICATION_PORT/)
+  assert.throws(()=>loadConfig({EZ_APPLICATION_PORT:'8110',EZ_CHANNEL_BACKEND_URL:'http://backend',EZ_CHANNEL_BACKEND_TOKEN:'secret'}), /native Ez executor/)
+  const config=loadConfig({EZ_APPLICATION_PORT:'8110'})
   assert.equal(config.telegramBotToken,'')
   assert.equal(config.telegramEnabled,false)
 })
@@ -35,8 +34,8 @@ test('administrator bootstrap is explicit, local-only and cannot replace identit
   const token=join(root,'token'); await writeFile(token,'x'.repeat(48),{mode:0o600})
   const cli=fileURLToPath(new URL('../bin/ezenciel-agents-application.mjs',import.meta.url))
   const args=[cli,'--id','app','--token-file',token,'--owner','42']
-  const env={...process.env,EZ_CONTROL_DIR:root,EZ_RUN_ID:'',EZ_TELEGRAM_ENABLED:'false'}
-  assert.notEqual(spawnSync(process.execPath,args,{env:{...env,EZ_TELEGRAM_ENABLED:'true'}}).status,0)
+  const env={...process.env,EZ_CONTROL_DIR:root,EZ_RUN_ID:'',TELEGRAM_BOT_TOKEN:''}
+  assert.notEqual(spawnSync(process.execPath,args,{env:{...env,TELEGRAM_BOT_TOKEN:'fixture'}}).status,0)
   assert.notEqual(spawnSync(process.execPath,args,{env:{...env,EZ_RUN_ID:'r_agent'}}).status,0)
   assert.equal((await new ControlStore(root,1000).status()).owner,null)
   const invalidToken=join(root,'invalid-token');await writeFile(invalidToken,'short')
@@ -60,9 +59,10 @@ test('administrator bootstrap is explicit, local-only and cannot replace identit
 
 test('botless daemon executes application turn and rejects Telegram-origin work/outbound', async t => {
   const root=await mkdtemp(join(tmpdir(),'ez-app-only-runtime-'))
+  const purpose=join(root,'purpose.md');await writeFile(purpose,'Fixture application agent\n');await initializeWorkspace(root,purpose)
   const portServer=createServer();await new Promise<void>(r=>portServer.listen(0,'127.0.0.1',r))
   const port=(portServer.address() as {port:number}).port;await new Promise<void>(r=>portServer.close(()=>r()))
-  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:String(port),EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'codex'})
+  const config=loadConfig({EZ_APPLICATION_PORT:String(port),EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'codex'})
   const native='11111111-1111-1111-1111-111111111111', fixture=join(root,'engine.mjs')
   await writeFile(fixture,`import {spawnSync} from 'node:child_process';if(process.env.TELEGRAM_BOT_TOKEN)throw Error('secret leak');console.log(JSON.stringify({type:'thread.started',thread_id:${JSON.stringify(native)}}));const r=spawnSync(process.execPath,[${JSON.stringify(fileURLToPath(new URL('../bin/ezenciel-agents-message.mjs',import.meta.url)))},'--text','Application reply'],{env:process.env});process.exit(r.status);`)
   const original=EXECUTOR_REGISTRY.codex,require=createRequire(import.meta.url)
@@ -89,12 +89,15 @@ test('botless daemon executes application turn and rejects Telegram-origin work/
   assert.equal((await runs.get(legacy.id))?.status,'queued')
 })
 
-test('Docker health accepts application readiness only with explicit botless configuration', async t => {
+test('Docker health accepts application readiness when the agent has no bot', async t => {
   const root=await mkdtemp(join(tmpdir(),'ez-app-only-health-'))
   t.after(()=>rm(root,{recursive:true,force:true}))
-  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true}))
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true,telegramConfigured:false}))
   const command=fileURLToPath(new URL('../docker/healthcheck.mjs',import.meta.url))
   const env={...process.env,EZ_HEALTH_RELAY_CONTROL_DIR:root,EZ_EXECUTOR_TRANSPORT:'local'}
-  assert.equal(spawnSync(process.execPath,[command],{env:{...env,EZ_TELEGRAM_ENABLED:'false'}}).status,0)
-  assert.notEqual(spawnSync(process.execPath,[command],{env:{...env,EZ_TELEGRAM_ENABLED:'true'}}).status,0)
+  assert.equal(spawnSync(process.execPath,[command],{env}).status,0)
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:false,telegramConfigured:false}))
+  assert.notEqual(spawnSync(process.execPath,[command],{env}).status,0)
+  await writeFile(join(root,'heartbeat.json'),JSON.stringify({at:Date.now(),polling:false,applicationOnly:true,telegramConfigured:true}))
+  assert.notEqual(spawnSync(process.execPath,[command],{env}).status,0)
 })

package/test/channel-backend.test.ts

@@ -43,7 +43,6 @@ test('structured photo transport and deterministic reply recovery', async () =>
 test('backend dispatch keeps owner/private gate and never starts a CLI', async () => {
   const { createRelay } = await import('../src/index.js')
   const { ControlStore } = await import('../src/control-state.js')
-  const { recoverInterruptedRuns } = await import('../docker/recovery.js')
   const root = await mkdtemp(join(tmpdir(), 'channel-gate-'))
   const originalFetch = globalThis.fetch
   let calls = 0
@@ -68,16 +67,14 @@ test('backend dispatch keeps owner/private gate and never starts a CLI', async (
     assert.equal(calls, 1)
     const store = new RunStore(root)
     assert.equal((await store.get('tg_3'))?.status, 'completed')
-    await store.patch('tg_3', { status: 'running' })
-    await recoverInterruptedRuns(root, true)
-    assert.equal((await store.get('tg_3'))?.status, 'queued')
+    await store.patch('tg_3', { status: 'running', backendSubmitted: true })
     const cancel = update(4, 42); cancel.message.text = '/cancel'
     await relay.bot.handleUpdate(cancel)
-    assert.equal((await store.get('tg_3'))?.status, 'queued', 'cancel must retain submitted operation polling')
+    assert.equal((await store.get('tg_3'))?.status, 'running', 'cancel must retain submitted operation polling')
   } finally { await relay.stop(); globalThis.fetch = originalFetch; await rm(root, { recursive: true, force: true }) }
 })
 
-test('backend mode cannot dispatch restricted, external, scheduled or update runs', async () => {
+test('backend mode cannot dispatch restricted, external or scheduled runs', async () => {
   const { createRelay } = await import('../src/index.js')
   const { ControlStore } = await import('../src/control-state.js')
   const root = await mkdtemp(join(tmpdir(), 'channel-authority-'))
@@ -92,7 +89,6 @@ test('backend mode cannot dispatch restricted, external, scheduled or update run
     await runs.create({ ...common, id: 'restricted', taskId: `task_${'a'.repeat(32)}` })
     await runs.create({ ...common, id: 'external', external: { sourceId: 'fixture', bindingId: 'binding', eventIds: ['1'] } })
     await runs.create({ ...common, id: 'scheduled', scheduled: { id: 's', revision: 'r', dueAt: new Date().toISOString(), pairedAt: owner.pairedAt } })
-    await runs.create({ ...common, id: 'r_update_fixture' })
     await relay.drainSources()
     assert.equal(calls, 0); assert.equal(launches, 0)
     assert.ok((await runs.list()).every(run => run.status === 'failed'))

package/test/channel-delivery.test.ts

@@ -8,11 +8,14 @@ import {ControlStore} from '../src/control-state.js'
 import {RunStore} from '../src/runs.js'
 import {authorizeDeliveryContext,captureDeliveryContext} from '../src/delivery-context.mjs'
 import {nativeTasks,nativeTaskBinding} from '../src/plugins/native-tasks.mjs'
+import {serveTestLedger} from './helpers/ledger.js'
 
 test('authenticated connection sends text and files through ordinary outbox receipts without a native run',async()=>{
   const root=await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(),'ez-channel-delivery-'))),workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),home=path.join(root,'tools'),hostConfig=path.join(root,'host-executor.json')
   for(const dir of [workspace,controlDir,home])await fs.mkdir(dir)
   const relay=createRelay({controlDir,workspace,pairingTtlMs:1000,executorTimeoutMs:1000,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('Must not launch native execution')})
+  // The message CLI child reaches the relay memory ledger through the delivery socket.
+  const ledger=await serveTestLedger(controlDir)
   const calls:string[]=[];relay.bot.api.config.use(async(_prev,method)=>{calls.push(method);return {ok:true,result:{message_id:42}} as never})
   try {
     await fs.writeFile(path.join(home,'config.json'),JSON.stringify({schemaVersion:1,workspace,hostConfig}))
@@ -38,7 +41,7 @@ test('authenticated connection sends text and files through ordinary outbox rece
     await relay.drainOutbox();assert.equal(calls.length,2);await assert.rejects(store.waitForDelivery(queued.id),/revoked/)
     await assert.rejects(nativeTasks(home,['--text','denied'],{command:'message',deliveryContext:context}),/revoked/)
     await assert.rejects(store.ownerDeliveryReceipt(context,queued.id),/revoked/)
-  } finally {await relay.stop();await fs.rm(root,{recursive:true,force:true})}
+  } finally {await relay.stop();await ledger.stop();await fs.rm(root,{recursive:true,force:true})}
 })
 test('delivery authority cannot revive after Telegram relink or same-time owner replacement',async t=>{
   const root=await fs.mkdtemp(path.join(os.tmpdir(),'ez-channel-delivery-epoch-'))

package/test/channel-owner.test.ts

@@ -16,6 +16,7 @@ import { ownsRun, isOwner } from '../src/identity.js'
 import { createRelay } from '../src/index.js'
 import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { loadConfig } from '../src/config.js'
+import { serveTestLedger } from './helpers/ledger.js'
 
 const secret = () => randomBytes(32).toString('base64url')
 const waitFor = async (check: () => Promise<boolean>) => {
@@ -87,13 +88,15 @@ test('web owner uses the standard schedule CLI, executor and outbox with Telegra
     if(!scheduled){const r=spawnSync(process.execPath,[${JSON.stringify(scheduleCli)},'create','followup','--now','--name','Followup','--text','Finish the requested work'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr)}
     const r=spawnSync(process.execPath,[${JSON.stringify(messageCli)},'--text',scheduled?'Scheduled reply':'Chat reply'],{env:process.env,encoding:'utf8'});if(r.status)throw Error(r.stderr);`)
   EXECUTOR_REGISTRY.grok={...original,command:process.execPath,buildArgs:()=>['--import',require.resolve('tsx'),fixture]}
-  const config=loadConfig({EZ_TELEGRAM_ENABLED:'false',EZ_APPLICATION_PORT:'8787',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'})
+  const config=loadConfig({EZ_APPLICATION_PORT:'8787',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'})
   const relay=createRelay(config), control=new ControlStore(root,60000), runs=new RunStore(root)
+  // Engine children reach the relay memory ledger through the delivery socket.
+  const ledger=await serveTestLedger(root)
   const owner=await control.registerOwner('web-owner'),token=secret()
   const binding=(await relay.applicationChannel.bindings.register('web',token,owner))!
   const address=await relay.applicationChannel.listen(0) as {port:number}
   const timer=setInterval(()=>{void relay.drainSources();void relay.drainOutbox()},25)
-  t.after(async()=>{clearInterval(timer);await relay.stop();EXECUTOR_REGISTRY.grok=original;await rm(root,{recursive:true,force:true})})
+  t.after(async()=>{clearInterval(timer);await relay.stop();EXECUTOR_REGISTRY.grok=original;await ledger.stop();await rm(root,{recursive:true,force:true})})
   const first=await relay.applicationChannel.submit(binding.bindingId,{requestId:'chat',scope:'main',text:'Schedule a followup'})
   await waitFor(async()=> (await runs.get(first.id))?.status==='completed')
   await waitFor(async()=> (await runs.list()).some(r=>r.scheduled && r.status==='completed'))
@@ -141,7 +144,7 @@ for (const mode of ['owner','web','telegram']) test(`${mode} revocation stops it
   const control=new ControlStore(root,60000),runs=new RunStore(root),scheduler=new Scheduler(root)
   await control.requestPairing(42,42)
   const owner=await control.approveOwner(42)
-  const relay=createRelay(loadConfig({TELEGRAM_BOT_TOKEN:'synthetic',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'}),async()=>({child:spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'pipe'}),stdout:'',cleanup:async()=>{}}))
+  const relay=createRelay(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CONTROL_DIR:root,EZ_AGENT_WORKSPACE:root,EZ_EXECUTOR_CLI:'grok'}),async()=>({child:spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{detached:true,stdio:'pipe'}),stdout:'',cleanup:async()=>{}}))
   relay.bot.api.config.use(async()=>({ok:true,result:true}) as never)
   t.after(async()=>{await relay.stop();await rm(root,{recursive:true,force:true})})
   if (mode==='telegram') {

package/test/codex-context.test.ts

@@ -6,15 +6,67 @@ import {tmpdir} from 'node:os'
 import path from 'node:path'
 import {startExecutorJob} from '../src/executor.js'
 
+test('a package-bin Codex shim cannot retarget another agent home', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-codex-host-cli-'))
+  const hostBin = path.join(root, 'host-bin')
+  const packageBin = path.join(root, 'package-bin')
+  const controlDir = path.join(root, 'agent')
+  const priorHome = process.env.HOME, priorPath = process.env.PATH
+  try {
+    await mkdir(hostBin); await mkdir(packageBin); await mkdir(path.join(root, '.codex'))
+    await writeFile(path.join(root, '.codex/auth.json'), '{}')
+    await writeFile(path.join(packageBin, 'codex'), `#!${process.execPath}
+require('fs').writeFileSync(require('path').join(process.env.HOME, 'hijacked'), 'yes'); process.exit(2)
+`, { mode: 0o700 })
+    await writeFile(path.join(hostBin, 'codex'), `#!${process.execPath}\nconsole.log(process.env.CODEX_HOME)`, { mode: 0o700 })
+    process.env.HOME = root
+    process.env.PATH = hostBin + path.delimiter + (priorPath ?? '')
+    await ownerRun(controlDir, 'r_test')
+    const job = await startExecutorJob(['hello'], {
+      workspace: root, controlDir, binDir: packageBin, cli: 'codex', runId: 'r_test', timeoutMs: 5000,
+    })
+    let output = ''
+    job.child.stdout?.on('data', chunk => output += chunk)
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0)
+    await job.cleanup()
+    assert.equal(output.trim(), path.join(controlDir, 'cli/codex'))
+    await assert.rejects(readFile(path.join(root, 'hijacked')))
+  } finally {
+    if (priorHome === undefined) delete process.env.HOME; else process.env.HOME = priorHome
+    if (priorPath === undefined) delete process.env.PATH; else process.env.PATH = priorPath
+    await rm(root, { recursive: true, force: true })
+  }
+})
+
+test('a package-bin Codex shim is not a fallback when the host CLI is missing', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-codex-host-cli-missing-'))
+  const packageBin = path.join(root, 'package-bin')
+  const controlDir = path.join(root, 'agent')
+  const priorPath = process.env.PATH
+  try {
+    await mkdir(packageBin)
+    await writeFile(path.join(packageBin, 'codex'), `#!${process.execPath}\nprocess.exit(91)\n`, { mode: 0o700 })
+    process.env.PATH = '/usr/bin:/bin'
+    await ownerRun(controlDir, 'r_test')
+    await assert.rejects(startExecutorJob(['hello'], {
+      workspace: root, controlDir, binDir: packageBin, cli: 'codex', runId: 'r_test', timeoutMs: 5000,
+    }), /Native CLI codex is not executable on the host PATH/)
+  } finally {
+    if (priorPath === undefined) delete process.env.PATH; else process.env.PATH = priorPath
+    await rm(root, { recursive: true, force: true })
+  }
+})
+
 test('Codex shares only auth through a link and keeps each agent runtime state separate',async()=>{
  const root=await mkdtemp(path.join(tmpdir(),'ez-codex-context-'))
- const priorHome=process.env.HOME,priorPath=process.env.PATH
+ const priorHome=process.env.HOME,priorPath=process.env.PATH,priorIsolation=process.env.EZ_ISOLATION
  try{
   await mkdir(path.join(root,'.codex'));await mkdir(path.join(root,'bin'))
   await writeFile(path.join(root,'.codex/auth.json'),'{}')
   await writeFile(path.join(root,'.codex/config.toml'),'# unrelated personal config')
   await writeFile(path.join(root,'bin/codex'),`#!${process.execPath}\nconsole.log(process.env.CODEX_HOME)`,{mode:0o700})
   process.env.HOME=root;process.env.PATH=path.join(root,'bin')+path.delimiter+priorPath
+  delete process.env.EZ_ISOLATION
   for(const agent of ['one','two']){
    const controlDir=path.join(root,agent)
    await ownerRun(controlDir, 'r_test')
@@ -27,9 +79,17 @@ test('Codex shares only auth through a link and keeps each agent runtime state s
    assert.deepEqual(await readdir(home),['auth.json'])
    assert.equal(await readlink(path.join(home,'auth.json')),path.join(root,'.codex/auth.json'))
   }
+  process.env.EZ_ISOLATION='isolated'
+  const isolated=path.join(root,'isolated')
+  await ownerRun(isolated, 'r_test')
+  const isolatedJob=await startExecutorJob(['hello'],{workspace:root,controlDir:isolated,binDir:path.join(root,'bin'),cli:'codex',runId:'r_test',timeoutMs:5000})
+  assert.equal(await new Promise(resolve=>isolatedJob.child.once('close',resolve)),0)
+  await isolatedJob.cleanup()
+  await assert.rejects(readlink(path.join(isolated,'cli/codex/auth.json')),{code:'ENOENT'})
  }finally{
   if(priorHome===undefined)delete process.env.HOME;else process.env.HOME=priorHome
   if(priorPath===undefined)delete process.env.PATH;else process.env.PATH=priorPath
+  if(priorIsolation===undefined)delete process.env.EZ_ISOLATION;else process.env.EZ_ISOLATION=priorIsolation
   await rm(root,{recursive:true,force:true})
  }
 })
@@ -50,11 +110,11 @@ if(q.method==='turn/start'){send({id:q.id,result:{turn:{id:'one'}}});send({metho
 send({id:q.id,result:q.method==='thread/goal/get'?{goal:null}:{}});});setInterval(()=>{},1000);
 `,{mode:0o700})
   process.env.HOME=root;process.env.PATH=bin+path.delimiter+priorPath
-  await assert.rejects(startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId:'r_schedule_/../../escape',timeoutMs:0}),/Invalid native task run ID/)
+  await assert.rejects(startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId:'r_schedule_/../../escape',timeoutMs:0,nativeSession:true}),/Invalid native task run ID/)
   await ownerRun(controlDir, 'r_pair_fixture')
   await Promise.all(['r_schedule_one','r_schedule_two'].map(async runId=>{
    await ownerRun(controlDir, runId)
-   const job=await startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:0})
+   const job=await startExecutorJob(['test'],{workspace:root,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:0,nativeSession:true})
    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
    const home=path.join(controlDir,'cli/codex/tasks',runId)
    assert.equal(JSON.parse(await readFile(path.join(home,'observed.json'),'utf8')).home,home)

package/test/codex-session.test.ts

@@ -43,7 +43,8 @@ if(q.method==='thread/goal/get'){
     child.stdin.write=((chunk:any,...args:any[])=>{try{const q=JSON.parse(String(chunk));if(q.method==='turn/start'){turnPrompt=q.params.input[0].text;turnPolicy=q.params.sandboxPolicy}requests.push(q.method);if(q.method==='thread/start'){threadConfig=q.params.config;threadSandbox=q.params.sandbox}}catch{};return (write as any)(chunk,...args)}) as typeof child.stdin.write
     return child
   }
-  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',additionalWorkspaces:['/agent/mind/work'],prompt,
+  const codexProvider=mode==='tool-goal'?{id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1',envKey:'OPENROUTER_API_KEY',models:['open/model']}:undefined
+  const result=await runCodexSession({workspace:'/tmp',controlDir:'/tmp/control',sharedWorkspace:'/canonical',additionalWorkspaces:['/agent/mind/work'],prompt,codexProvider,model:codexProvider?'open/model':undefined,
     ...(mode==='external'?{codexSandbox:'external' as const}:{})},{launch,emit:line=>output.push(line)})
   assert.equal(threadSandbox!,mode==='external'?'danger-full-access':'workspace-write')
   assert.deepEqual(turnPolicy,mode==='external'?{type:'externalSandbox',networkAccess:'enabled'}:undefined)
@@ -52,6 +53,10 @@ if(q.method==='thread/goal/get'){
   if(mode==='long-goal')assert.ok(prompt.length>4000)
   assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/canonical'))
   assert.ok(threadConfig['sandbox_workspace_write.writable_roots'].includes('/agent/mind/work'))
+  if(codexProvider){
+    assert.equal(threadConfig.model_provider,'openrouter')
+    assert.deepEqual(threadConfig['model_providers.openrouter'],{name:'OpenRouter',base_url:'https://openrouter.ai/api/v1',env_key:'OPENROUTER_API_KEY',wire_api:'responses',supports_websockets:false})
+  }
   assert.equal(result,['external','plain','goal','long-goal','tool-goal'].includes(mode)?0:1)
   assert.equal(requests.filter(x=>x==='turn/start').length,1,'transport must not send goal continuation prompts')
   assert.equal(requests.filter(x=>x==='thread/goal/set').length,0)

package/test/config.test.ts

@@ -2,13 +2,13 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 import { loadConfig } from '../src/config.js'
 
-test('requires a Telegram token', () => {
-  assert.throws(() => loadConfig({}), /TELEGRAM_BOT_TOKEN is required/)
+test('requires an application listener when no Telegram bot token is present', () => {
+  assert.throws(() => loadConfig({}), /EZ_APPLICATION_PORT/)
 })
 
 test('uses a relative agent workspace and protected control state defaults', () => {
   const config = loadConfig({
-    TELEGRAM_BOT_TOKEN: 'test-token',
+    TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',
     EZ_AGENT_WORKSPACE: './fixture-agent',
     EZ_CONTROL_DIR: './fixture-control',
   })
@@ -19,58 +19,68 @@ test('uses a relative agent workspace and protected control state defaults', ()
 })
 
 test('rejects malformed timeouts', () => {
-  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
-  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
 })
 
 test('loads executor CLI configuration with agy fallback', () => {
-  const defaultConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test' })
+  const defaultConfig = loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY' })
   assert.equal(defaultConfig.executorCli, 'agy')
 
-  const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_CLI: 'claude' })
+  const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_EXECUTOR_CLI: 'claude' })
   assert.equal(customConfig.executorCli, 'claude')
 })
 
 test('Codex context limit is configurable and rejects invalid values', () => {
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexAutoCompactTokens,undefined)
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexAutoCompactTokens,undefined)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
   for(const value of ['0','-1','bad','1.5','9007199254740992'])
-    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
+    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
 })
 
-test('PagerDuty Stocks monitoring requires a routing key and validates its target', () => {
-  assert.throws(
-    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical' }),
-    /PAGERDUTY_ROUTING_KEY is required/,
-  )
-  assert.throws(
-    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', PAGERDUTY_ROUTING_KEY: 'key', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'file:///private/health' }),
-    /absolute HTTP\(S\) URL/,
-  )
-  const config = loadConfig({
-    TELEGRAM_BOT_TOKEN: 'test',
-    PAGERDUTY_ROUTING_KEY: 'pagerduty-key',
-    EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical',
-    EZ_PAGERDUTY_POLL_SECONDS: '45',
-    EZ_PAGERDUTY_FAILURE_THRESHOLD: '4',
-  })
-  assert.equal(config.pagerDutyRoutingKey, 'pagerduty-key')
-  assert.equal(config.pagerDutyStocksHealthUrl, 'http://stocks.test/health/critical')
-  assert.equal(config.pagerDutyPollMs, 45_000)
-  assert.equal(config.pagerDutyFailureThreshold, 4)
-})
 
 test('external Codex isolation requires explicit native local deployment', () => {
-  const env = {EZ_TELEGRAM_ENABLED:'false', EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
+  const env = {EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
   assert.equal(loadConfig(env).codexSandbox, 'external')
-  assert.equal(loadConfig({...env,EZ_TELEGRAM_ENABLED:'true',TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, 'external')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, undefined)
-  for (const override of [{EZ_EXECUTOR_TRANSPORT:'host'}, {EZ_EXECUTOR_TRANSPORT:''}, {EZ_CODEX_SANDBOX:'danger-full-access'}])
-    assert.throws(() => loadConfig({...env,...override}), /sandbox|SANDBOX/)
+  assert.equal(loadConfig({...env,TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexSandbox, 'external')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexSandbox, undefined)
+  assert.equal(loadConfig({...env,EZ_EXECUTOR_TRANSPORT:''}).isolation, 'isolated')
+  assert.throws(() => loadConfig({...env,EZ_EXECUTOR_TRANSPORT:'host'}), /sandbox|SANDBOX|Isolation/)
+  assert.throws(() => loadConfig({...env,EZ_CODEX_SANDBOX:'danger-full-access'}), /sandbox|SANDBOX/)
+})
+
+test('isolation class is isolated by default and rejects host transport mismatch', () => {
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'local'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'host'}), /Isolation isolated requires EZ_EXECUTOR_TRANSPORT=local/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'local'}), /Isolation host-capable requires EZ_EXECUTOR_TRANSPORT=host/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'seatbelt'}), /isolated or host-capable/)
+  assert.throws(() => loadConfig({
+    TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host',
+    EZ_CHANNEL_BACKEND_URL:'https://backend.example',EZ_CHANNEL_BACKEND_TOKEN:'secret',
+  }), /Host-capable isolation requires the host native CLI/)
 })
 
 test('optional web launcher preserves reserved commands and accepts only HTTPS without secrets', () => {
-  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
+  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
   assert.deepEqual(config({command:'voice',label:'Voice',url:'https://voice.example/'}).webLauncher,{command:'voice',label:'Voice',url:'https://voice.example/'})
   for (const value of [{command:'stop',label:'Voice',url:'https://voice.example/'},{command:'voice',label:'Voice',url:'http://voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/#secret'},{command:'voice',label:'Voice',url:'https://user:pass@voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/?token=secret'}]) assert.throws(()=>config(value))
 })
+
+test('Telegram transport is inferred from a valid token; legacy flag contradictions fail closed', () => {
+  const token = '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'
+  const enabled = loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_APPLICATION_PORT: '8110' })
+  assert.equal(enabled.telegramEnabled, true)
+  assert.equal(enabled.telegramBotToken, token)
+  const appOnly = loadConfig({ TELEGRAM_BOT_TOKEN: '   ', EZ_APPLICATION_PORT: '8110' })
+  assert.equal(appOnly.telegramEnabled, false)
+  assert.equal(appOnly.telegramBotToken, '')
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'garbage', EZ_APPLICATION_PORT: '8110' }), /malformed/)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }), /contradicts/)
+  assert.throws(() => loadConfig({ EZ_TELEGRAM_ENABLED: 'true', EZ_APPLICATION_PORT: '8110' }), /contradicts/)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'sometimes' }), /must be true or false/)
+  assert.equal(loadConfig({ EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }).telegramEnabled, false)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'true' }).telegramEnabled, true)
+})