@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.36

package/test/control-state.test.ts

@@ -1,16 +1,16 @@
 import assert from 'node:assert/strict'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import test from 'node:test'
 import { ControlStore } from '../src/control-state.js'
 import { parseOwnerArgs } from '../src/owner-args.js'
 
-const fixture = async (run: (store: ControlStore, advance: (milliseconds: number) => void) => Promise<void>): Promise<void> => {
+const fixture = async (run: (store: ControlStore, advance: (milliseconds: number) => void, directory: string) => Promise<void>): Promise<void> => {
   const directory = await mkdtemp(path.join(tmpdir(), 'ez-control-test-'))
   let now = Date.parse('2026-01-01T00:00:00.000Z')
   try {
-    await run(new ControlStore(directory, 60_000, () => now), (milliseconds) => { now += milliseconds })
+    await run(new ControlStore(directory, 60_000, () => now), (milliseconds) => { now += milliseconds }, directory)
   } finally {
     await rm(directory, { recursive: true, force: true })
   }
@@ -35,7 +35,9 @@ test('cannot approve a telegram id that did not request pairing', async () => fi
   await store.requestPairing(101, 101)
   await assert.rejects(store.approveOwner(202), /No active pairing request/)
   assert.equal((await store.status()).owner, null)
-  assert.equal((await store.status()).pending[0]?.telegramUserId, 101)
+  const request = (await store.status()).pending[0]
+  if (!request || !('telegramUserId' in request)) throw new Error('Telegram pairing request missing')
+  assert.equal(request.telegramUserId, 101)
 }))
 
 test('expires pairing requests before an owner can approve them', async () => fixture(async (store, advance) => {
@@ -51,8 +53,85 @@ test('supports local owner recovery by revocation', async () => fixture(async (s
   assert.equal((await store.status()).owner, null)
 }))
 
+test('application-owned Telegram link is hashed, one-time, and bound to the current owner', async () => fixture(async (store, advance, directory) => {
+  const owner = await store.registerOwner('account:one')
+  const bindingId = '11111111-1111-1111-1111-111111111111'
+  const pairing = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(pairing)
+  assert.doesNotMatch(await readFile(path.join(directory, 'control-state.json'), 'utf8'), new RegExp(pairing.token))
+  const flipped = pairing.token.slice(0, -1) + (pairing.token.endsWith('A') ? 'B' : 'A')
+  assert.equal(await store.claimApplicationTelegramPairing(flipped, 101, 101, async () => true), null)
+  assert.equal(await store.claimApplicationTelegramPairing(pairing.token, 101, 101, async () => false), null)
+  assert.equal((await store.status()).owner?.telegramUserId, undefined)
+
+  const replacement = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(replacement)
+  advance(60_001)
+  assert.equal(await store.claimApplicationTelegramPairing(replacement.token, 101, 101, async () => true), null)
+
+  const active = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(active)
+  const linked = await store.claimApplicationTelegramPairing(active.token, 101, 101, async (requestedBinding, expectedOwner) =>
+    requestedBinding === bindingId && expectedOwner.id === owner.id)
+  assert.equal(linked?.id, owner.id)
+  assert.equal(linked?.telegramUserId, 101)
+  assert.equal(linked?.telegramChatId, 101)
+  assert.ok(linked?.telegramLinkedAt)
+  assert.equal(await store.claimApplicationTelegramPairing(active.token, 101, 101, async () => true), null)
+  assert.equal(await store.createApplicationTelegramPairing(bindingId, linked!), null)
+  await store.unlinkTelegram()
+  const relink = await store.createApplicationTelegramPairing(bindingId, (await store.status()).owner!)
+  assert.ok(relink)
+  assert.equal(await store.claimApplicationTelegramPairing(relink.token, 101, 101, async () => false), null)
+}))
+
 test('owner CLI treats pnpm -- as a separator, not a command', () => {
   assert.deepEqual(parseOwnerArgs(['--', 'status']), { command: 'status', value: undefined })
   assert.deepEqual(parseOwnerArgs(['--', 'approve', '101']), { command: 'approve', value: '101' })
   assert.deepEqual(parseOwnerArgs(['revoke']), { command: 'revoke', value: undefined })
 })
+
+test('provider catalog upgrades a persisted providerless Codex selection', async () => fixture(async (store) => {
+  const model = 'deepseek/deepseek-v4.1-flash'
+  await store.captureChoice({ id: 'deepseek', name: `${model} · max`, cli: 'codex', model, effort: 'max' })
+  const catalog = [{ cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['max'] }]
+
+  assert.equal(await store.normalizeProviderBindings(catalog), true)
+  const state = await store.status()
+  const preset = state.ai!.presets.find((item) => item.id === state.ai!.selectedId)!
+  assert.equal(preset.provider, 'openrouter')
+  assert.equal(preset.name, `${model} · max`)
+  assert.equal(state.activeSession?.preset?.provider, 'openrouter')
+  assert.equal(await store.normalizeProviderBindings(catalog), false)
+}))
+
+test('provider catalog leaves ambiguous and effort-mismatched selections untouched', async () => fixture(async (store) => {
+  const model = 'deepseek/deepseek-v4.1-flash'
+  await store.captureChoice({ id: 'deepseek', name: 'My deepseek', cli: 'codex', model, effort: 'max' })
+  const ambiguous = [
+    { cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['max'] },
+    { cli: 'codex', provider: 'direct', model, name: `Direct · ${model}`, efforts: ['max'] },
+  ]
+  assert.equal(await store.normalizeProviderBindings(ambiguous), false)
+  assert.equal((await store.status()).ai!.presets.find((item) => item.id === 'deepseek')!.provider, undefined)
+  const mismatch = [{ cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['low'] }]
+  assert.equal(await store.normalizeProviderBindings(mismatch), false)
+  assert.equal((await store.status()).ai!.presets.find((item) => item.id === 'deepseek')!.provider, undefined)
+}))
+
+test('steady-state owner checks and session pins write nothing to control/', async () => fixture(async (store, _advance, directory) => {
+  const { stat } = await import('node:fs/promises')
+  const { initialPreset } = await import('../src/ai.js')
+  await store.requestPairing(101, 101)
+  await store.approveOwner(101)
+  await store.aiState(initialPreset('codex'))
+  // First pin may persist the session binding; everything after must be quiet.
+  await store.captureChoice(initialPreset('codex'), 'hello')
+  const before = await stat(path.join(directory, 'control-state.json'))
+  await store.status()
+  await store.captureChoice(initialPreset('codex'), 'hello again')
+  await store.status()
+  const after = await stat(path.join(directory, 'control-state.json'))
+  assert.equal(after.mtimeMs, before.mtimeMs)
+  assert.equal(after.size, before.size)
+}))

package/test/conversation-menu.test.ts

@@ -5,7 +5,6 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type { Context, InlineKeyboard } from 'grammy'
 import { ControlStore } from '../src/control-state.js'
-import { RunStore } from '../src/runs.js'
 import { createConversationMenu } from '../src/conversation-menu.js'
 import { initialPreset } from '../src/ai.js'
 
@@ -13,11 +12,10 @@ test('empty placeholders stay out of history and Back edits one panel without cr
   const dir = await mkdtemp(join(tmpdir(), 'ez-empty-chats-'))
   try {
     const control = new ControlStore(dir, 1000)
-    const runs = new RunStore(dir)
     const choice = await control.captureChoice(initialPreset('grok'), 'Client launch')
     await control.markSessionStarted(choice.sessionId)
     for (let n = 0; n < 3; n++) await control.resetSession()
-    const menu = createConversationMenu(control, runs)
+    const menu = createConversationMenu(control)
     let sent = 0, edited = 0, text = '', keyboard: InlineKeyboard
     const ctx = {
       callbackQuery: undefined,
@@ -55,7 +53,7 @@ test('an identical Back edit does not send another message', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-same-menu-'))
   try {
     let sent = 0
-    const menu = createConversationMenu(new ControlStore(dir,1000),new RunStore(dir))
+    const menu = createConversationMenu(new ControlStore(dir,1000))
     await menu.handle({
       callbackQuery:{data:'chat:list:0:0',message:{message_id:1}},
       answerCallbackQuery:async()=>{},

package/test/delivery-transport.test.ts

@@ -0,0 +1,72 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, unlink } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createConnection } from 'node:net'
+import { createLedgerHandler, deliverySocketPath, serveDeliverySocket } from '../src/delivery-socket.js'
+import { callDeliverySocket } from '../src/delivery-socket-client.mjs'
+
+const status = () => ({ polling: false, applicationOnly: false, telegramConfigured: true, version: 'test' })
+
+const tcpCall = (endpoint: { host: string; port: number }, frame: unknown): Promise<unknown> =>
+  new Promise((resolve, reject) => {
+    const socket = createConnection({ host: endpoint.host, port: endpoint.port })
+    let buffer = ''
+    socket.setEncoding('utf8')
+    socket.once('connect', () => socket.write(`${JSON.stringify(frame)}\n`))
+    socket.on('data', chunk => {
+      buffer += chunk
+      const newline = buffer.indexOf('\n')
+      if (newline < 0) return
+      socket.destroy()
+      resolve(JSON.parse(buffer.slice(0, newline)))
+    })
+    socket.once('close', () => resolve(undefined))
+    socket.once('error', reject)
+  })
+
+test('host processes reach the relay ledger through the loopback endpoint when the Unix socket is unreachable', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-tcp-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const server = await serveDeliverySocket(dir, createLedgerHandler(dir, { wake: () => {}, status }), { tcpPort: 0 })
+  t.after(() => server.stop())
+  const socketPath = deliverySocketPath(dir)
+  assert.equal(server.endpoint?.host, '127.0.0.1')
+  assert.ok(server.endpoint && server.endpoint.port > 0)
+  const endpoint = server.endpoint!
+  // Container-local producers keep using the Unix socket.
+  assert.deepEqual(await callDeliverySocket(socketPath, { op: 'ping' }), { ok: true })
+  // Authenticated loopback frames work with the control-directory token.
+  assert.deepEqual(await tcpCall(endpoint, { id: '1', op: 'ping', token: endpoint.token }), { id: '1', ok: true, result: { ok: true } })
+  // macOS host fallback: the socket file is visible but not connectable.
+  await unlink(socketPath)
+  assert.deepEqual(await callDeliverySocket(socketPath, { op: 'ping' }), { ok: true })
+})
+
+test('loopback frames without the control-directory token are refused', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-token-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const server = await serveDeliverySocket(dir, createLedgerHandler(dir, { wake: () => {}, status }), { tcpPort: 0 })
+  t.after(() => server.stop())
+  const endpoint = server.endpoint!
+  assert.equal(await tcpCall(endpoint, { id: '1', op: 'ping' }), undefined)
+  assert.equal(await tcpCall(endpoint, { id: '1', op: 'ping', token: '0'.repeat(64) }), undefined)
+})
+
+test('the client fails closed when neither the socket nor an endpoint exists', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-missing-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await assert.rejects(callDeliverySocket(deliverySocketPath(dir), { op: 'ping' }, 500), /Delivery relay unavailable/)
+})
+
+test('a response timeout is not replayed over the loopback endpoint', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-timeout-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  let calls = 0
+  const server = await serveDeliverySocket(dir, async () => { calls++; return new Promise(() => {}) }, { tcpPort: 0 })
+  t.after(() => server.stop())
+  assert.ok(server.endpoint)
+  await assert.rejects(callDeliverySocket(deliverySocketPath(dir), { op: 'enqueue' }, 200), /Delivery relay unavailable/)
+  assert.equal(calls, 1)
+})

package/test/docker-runtime.test.ts

@@ -1,23 +1,36 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { createRequire } from 'node:module'
 import { RunStore } from '../src/runs.js'
-import { recoverInterruptedRuns } from '../docker/recovery.js'
 
-test('exclusive Docker restart fails interrupted runs even when a container PID has been reused, without replaying queued work', async () => {
+const exec = promisify(execFile)
+const tsx = createRequire(import.meta.url).resolve('tsx')
+
+test('a relay restart starts from an empty memory ledger and leaves no run files behind', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-container-recovery-'))
   try {
-    const store = new RunStore(dir)
-    const prior = await store.create({ chatId: 1, telegramUserId: 1, texts: ['old'] })
-    const queued = await store.create({ chatId: 1, telegramUserId: 1, texts: ['queued'] })
-    await store.patch(prior.id, { status: 'running', pid: process.pid })
-    await recoverInterruptedRuns(dir)
-    assert.equal((await store.get(prior.id))?.status, 'failed')
-    assert.equal((await store.get(queued.id))?.status, 'queued')
-    const ended = (await store.get(prior.id))?.endedAt
-    await recoverInterruptedRuns(dir)
-    assert.equal((await store.get(prior.id))?.endedAt, ended)
-  } finally { await rm(dir, {recursive:true, force:true}) }
+    // A previous relay process owned runs in its own memory. Nothing is written
+    // to control/, so a fresh process cannot replay or resurrect them.
+    const script = `
+      import { RunStore } from ${JSON.stringify(new URL('../src/runs.ts', import.meta.url).href)};
+      const store = new RunStore(process.argv[1]);
+      const run = await store.create({ chatId: 1, telegramUserId: 1, texts: ['old'] });
+      await store.patch(run.id, { status: 'running', pid: process.pid });
+      const queued = await store.create({ chatId: 1, telegramUserId: 1, texts: ['queued'] });
+      console.log(JSON.stringify({ count: (await store.list()).length }));
+    `
+    const { stdout } = await exec(process.execPath, ['--import', tsx, '--input-type=module', '-e', script, dir])
+    assert.equal(JSON.parse(stdout.trim().split('\n').at(-1)!).count, 2)
+
+    const fresh = new RunStore(dir)
+    assert.equal((await fresh.list()).length, 0, 'restart drops in-flight runs by design')
+    await assert.rejects(stat(join(dir, 'runs')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'outbox')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'inbox.json')), { code: 'ENOENT' })
+  } finally { await rm(dir, { recursive: true, force: true }) }
 })

package/test/engine-handoff.test.ts

@@ -4,6 +4,7 @@ import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { startExecutorJob } from '../src/executor.js'
+import { runPromptSuffix } from '../src/prompt-suffix.js'
 import { ownerRun } from './helpers/owner-run.js'
 import { initializeWorkspace } from '../src/workspace.js'
 import { RunStore } from '../src/runs.js'
@@ -13,7 +14,7 @@ test('owner, resumed and native scheduled subprocesses receive literal input and
  const root=await mkdtemp(path.join(tmpdir(),'ez-literal-'))
  t.after(()=>rm(root,{recursive:true,force:true}))
  const bin=path.join(root,'bin'),workspace=path.join(root,'mind'),controlDir=path.join(root,'control')
- await mkdir(bin);await initializeWorkspace(workspace)
+ await mkdir(bin);const purpose=path.join(root,'purpose.md');await writeFile(purpose,'Fixture agent\n');await initializeWorkspace(workspace,purpose)
  const fixture=`#!${process.execPath}
 const fs=require('fs'), args=process.argv.slice(2);
 const capture=prompt=>fs.writeFileSync('capture.json',JSON.stringify({prompt,args,env:{run:process.env.EZ_RUN_ID,control:process.env.EZ_CONTROL_DIR,repair:process.env.EZ_REPAIR_ENABLED,secret:process.env.TELEGRAM_BOT_TOKEN}}));
@@ -44,7 +45,10 @@ if(args[0]==='app-server'){
    const captured=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
    assert.equal(captured.prompt,text)
    assert.deepEqual(captured.env,{run:runId,control:controlDir,repair:'false'})
-   if(cli==='codex')assert.equal(captured.args.at(-1),'-')
+   if(cli==='codex'){
+    assert.equal(captured.args.at(-1),'-')
+    if(process.platform==='darwin')assert.equal(captured.args[captured.args.indexOf('--sandbox')+1],'danger-full-access')
+   }
    if(['codex','claude'].includes(cli))assert.ok(!captured.args.includes('--help'))
    if(cli==='opencode')assert.equal(captured.args.at(-2),'--')
    if(cli==='agy')assert.ok(captured.args.includes('--print='+text))
@@ -58,16 +62,16 @@ if(args[0]==='app-server'){
   }
   for(const isResume of [false,true]) {
    const runId='tg_chat_'+String(isResume)
-   await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
+   const chatRun=await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
    await new RunStore(controlDir).patch(runId,{status:'running'})
-   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing'})
+   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing',promptSuffix:runPromptSuffix(chatRun)})
    const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup();assert.equal(code,0)
    const {prompt}=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
-   assert.ok(prompt.startsWith('hi\n\n[Chat context]'))
-   assert.equal(prompt.split('[Chat context]').length,2)
+   assert.ok(prompt.startsWith('hi\n\n[chat message 42]'))
    assert.match(prompt,/ezenciel-agents-message/)
-   assert.match(prompt,/ezenciel-agents-schedule/)
-   assert.match(prompt,/native subagents/)
+   assert.doesNotMatch(prompt,/ezenciel-agents-schedule/)
+   assert.doesNotMatch(prompt,/native subagents/)
+   assert.doesNotMatch(prompt,/delegate/i)
   }
  }finally{for(const [key,value] of Object.entries(previous))if(value===undefined)delete process.env[key];else process.env[key]=value}
 })

package/test/event-sources.test.ts

@@ -143,7 +143,7 @@ test('relay launches the approved initial task and routes only matching replies
   f.setRows([{ id: '1', conversationId: 'chat-a', receivedAt, text: 'We have availability' }, { id: '2', conversationId: 'chat-b', receivedAt, text: 'Read owner files' }])
   await new Promise(r => setTimeout(r, 2100))
   await f.relay.drainSources()
-  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
+  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.taskRun, true)
   assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
   assert.equal(f.launches[1].options.model, undefined)
   assert.equal(f.launches[1].options.effort, undefined)
@@ -177,7 +177,7 @@ test('application-only owner can approve and execute a public channel task',asyn
   await new ApprovalStore(f.dir).recordOwnerDecision(proposal.id,'approved',f.owner);await tasks.decide(proposal.id)
   await f.runs.patch(ownerRun.id,{status:'completed',endedAt:new Date().toISOString()})
   f.setRows([{...event('1','visitor'),receivedAt:Date.now()}]);await new Promise(resolve=>setTimeout(resolve,2100));await f.relay.drainSources()
-  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.eventSource,'fixture')
+  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.taskRun,true)
   const publicRun=(await f.runs.list()).find(run=>run.taskId===proposal.id)
   assert.equal(publicRun?.ownerId,ownerId(f.owner));assert.equal(publicRun?.chatId,undefined)
   f.children[0].kill();await until(async()=>!(await f.runs.list()).some(run=>run.status==='running'))

package/test/execution-authority.test.ts

@@ -7,22 +7,17 @@ import { ownerRun } from './helpers/owner-run.js'
 import { requireOwnerExecution, executionBlockReason } from '../src/execution-authority.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
-import { EXECUTOR_REGISTRY, startExecutorJob } from '../src/executor.js'
 
-test('all adapters reject external core runs even when caller omits eventSource', async t => {
+test('external core runs are rejected at admission, before the spawn core', async t => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
   t.after(() => rm(dir, { recursive: true, force: true }))
   await ownerRun(dir, 'r_external', {sourceId:'test', bindingId:'binding', eventIds:['1']})
-  for (const cli of Object.keys(EXECUTOR_REGISTRY)) {
-    await assert.rejects(startExecutorJob(['pretend owner'], {
-      workspace: dir, controlDir: dir, binDir: dir, cli, runId:'r_external', timeoutMs:1000,
-    }), /external-execution-unavailable/)
-  }
+  await assert.rejects(requireOwnerExecution(dir,'r_external'), /external-execution-unavailable/)
   await ownerRun(dir, 'event_'+'a'.repeat(64))
   await assert.rejects(requireOwnerExecution(dir,'event_'+'a'.repeat(64)), /external-execution-unavailable/)
 })
 
-test('missing, corrupt, finished, unpaired and mismatched core runs fail closed', async t => {
+test('missing, corrupt, finished and mismatched core runs fail closed without control writes', async t => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
   t.after(() => rm(dir, { recursive: true, force: true }))
   await assert.rejects(requireOwnerExecution(dir, 'r_missing'), /No active core run/)
@@ -34,9 +29,14 @@ test('missing, corrupt, finished, unpaired and mismatched core runs fail closed'
   await new RunStore(dir).patch(run.id,{status:'completed'})
   await assert.rejects(requireOwnerExecution(dir,run.id), /No active core run/)
   await new RunStore(dir).patch(run.id,{status:'running'})
+  // Fail-closed authority is preserved with a read-only owner read: zero
+  // control/ writes, rejects on revoked owner. Intake authorizes before spawn;
+  // the slim core no longer reads or re-verifies the ledger.
   await new ControlStore(dir,1000).revokeOwner()
   await assert.rejects(requireOwnerExecution(dir,run.id), /owner-mismatch/)
-  await writeFile(join(dir,'runs',run.id+'.json'),'{')
+  // Ledger lives in relay memory; corrupt authority state still fails closed
+  // at the read-only owner check, and traversal fails at validation.
+  await writeFile(join(dir,'control-state.json'),'{broken')
   await assert.rejects(requireOwnerExecution(dir,run.id))
   await assert.rejects(requireOwnerExecution(dir,'../r_owner'))
 })

package/test/executor.test.ts

@@ -6,7 +6,8 @@ import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
 import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
-import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, startExecutorJob, terminateJob } from '../src/executor.js'
+import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
+import { requireOwnerExecution } from '../src/execution-authority.js'
 import { splitTelegramText } from '../src/reply.js'
 import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
 
@@ -54,11 +55,15 @@ test('Telegram replies are split within the configured message limit', () => {
   assert.ok(chunks.every((chunk) => chunk.length <= 10))
 })
 
+test('native CLIs resolve from the host PATH, not a relative package name', () => {
+  assert.equal(resolveHostCommand('/usr/bin/codex'), '/usr/bin/codex')
+  assert.throws(() => resolveHostCommand('missing-cli-xyz', '/usr/bin'), /not executable on the host PATH/)
+})
+
 test('the executor receives a deliberately small environment', () => {
-  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', PAGERDUTY_ROUTING_KEY: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
+  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
   assert.deepEqual(environment, { PATH: '/bin', HOME: '/tmp/home' })
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
-  assert.ok(!('PAGERDUTY_ROUTING_KEY' in environment))
 })
 
 test('the Grok job env binds the run and still strips the bot token', () => {
@@ -68,6 +73,7 @@ test('the Grok job env binds the run and still strips the bot token', () => {
   )
   assert.equal(environment.EZ_RUN_ID, 'r_1')
   assert.equal(environment.EZ_CONTROL_DIR, '/tmp/control')
+  assert.equal(environment.EZ_DELIVERY_SOCKET, '/tmp/control/delivery.sock')
   assert.match(environment.PATH ?? '', /^\/tmp\/bin/)
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
 })
@@ -158,6 +164,38 @@ test('Codex jobs disable global memory and host skill discovery', () => {
   assert.equal(args[args.indexOf('skip_host_skill_discovery')-1],'--enable')
 })
 
+test('Codex custom providers use declared runtime state and an environment key reference', () => {
+  const provider=validateCodexProvider({id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1/',envKey:'OPENROUTER_API_KEY',models:['google/gemini-3.8-flash']})
+  const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent',model:'google/gemini-3.8-flash',codexProvider:provider},'','hello')
+  assert.ok(args.includes('model_provider="openrouter"'))
+  assert.ok(args.some(value=>value.includes('env_key="OPENROUTER_API_KEY"')))
+  assert.ok(args.includes('google/gemini-3.8-flash'))
+  assert.equal(JSON.stringify(args).includes('provider-secret'),false)
+  assert.throws(()=>validateCodexProvider({...provider,envKey:'TELEGRAM-BOT'}),/environment key/)
+  for (const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN'])
+    assert.throws(()=>validateCodexProvider({...provider,envKey}),/Reserved/)
+  assert.throws(()=>validateCodexProvider({...provider,models:[]}),/provider models/)
+})
+
+test('a configured Codex provider receives only its declared key and runtime selection', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-codex-provider-'));t.after(()=>rm(root,{recursive:true,force:true}))
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'codex'),`#!${process.execPath}\nconst fs=require('fs');let text='';process.stdin.on('data',b=>text+=b);process.stdin.on('end',()=>fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),key:process.env.OPENROUTER_API_KEY,telegram:process.env.TELEGRAM_BOT_TOKEN,text})));`,{mode:0o755})
+  const prior={path:process.env.PATH,key:process.env.OPENROUTER_API_KEY,telegram:process.env.TELEGRAM_BOT_TOKEN}
+  const provider=validateCodexProvider({id:'openrouter',name:'OpenRouter',baseUrl:'https://openrouter.ai/api/v1',envKey:'OPENROUTER_API_KEY',models:['google/gemini-3.8-flash']})
+  await ownerRun(root,'r_provider')
+  try {
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.OPENROUTER_API_KEY='provider-secret';process.env.TELEGRAM_BOT_TOKEN='relay-secret'
+    const job=await startExecutorJob(['hello'],{workspace:root,controlDir:root,binDir:bin,runId:'r_provider',timeoutMs:0,cli:'codex',provider:'openrouter',model:'google/gemini-3.8-flash',codexProvider:provider})
+    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+    const observed=JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+    assert.equal(observed.key,'provider-secret');assert.equal(observed.telegram,undefined);assert.equal(observed.text,'hello')
+    assert.ok(observed.args.includes('model_provider="openrouter"'));assert.ok(observed.args.includes('google/gemini-3.8-flash'))
+  } finally {
+    for(const [key,value] of [['PATH',prior.path],['OPENROUTER_API_KEY',prior.key],['TELEGRAM_BOT_TOKEN',prior.telegram]]) if(value===undefined)delete process.env[key!];else process.env[key!]=value
+  }
+})
+
 test('Codex plugin access stays scoped to the explicitly bound registry', () => {
   const args=EXECUTOR_REGISTRY.codex.buildArgs({workspace:'/agent/mind',controlDir:'/agent/control',toolsHome:'/agent/tools',sharedWorkspace:'/app',additionalWorkspaces:['/agent/mind/work']},'', 'install a plugin')
   assert.deepEqual(args.flatMap((arg,i)=>arg==='--add-dir'?[args[i+1]]:[]),['/agent/control','/app','/agent/mind/work','/agent/tools'])
@@ -193,21 +231,19 @@ test('external Codex isolation cannot launch host runs', async t => {
   const root = await mkdtemp(path.join(tmpdir(), 'ez-external-sandbox-'))
   t.after(() => rm(root,{recursive:true,force:true}))
   await ownerRun(root,'r_sandbox')
-  const previous = {transport:process.env.EZ_EXECUTOR_TRANSPORT,telegram:process.env.EZ_TELEGRAM_ENABLED}
+  const previous = process.env.EZ_EXECUTOR_TRANSPORT
   try {
-    process.env.EZ_TELEGRAM_ENABLED='false'
     for (const transport of ['host','']) {
       process.env.EZ_EXECUTOR_TRANSPORT=transport
       await assert.rejects(startExecutorJob(['Hello'],{workspace:root,controlDir:root,binDir:root,runId:'r_sandbox',timeoutMs:0,cli:'codex',codexSandbox:'external'}), /owner-authorized native local/)
     }
   } finally {
-    for (const [key,value] of [['EZ_EXECUTOR_TRANSPORT',previous.transport],['EZ_TELEGRAM_ENABLED',previous.telegram]]) {
-      if (value === undefined) delete process.env[key!]; else process.env[key!]=value
-    }
+    if (previous === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT
+    else process.env.EZ_EXECUTOR_TRANSPORT=previous
   }
 })
 
-test('external local owner chat preserves authorization and literal input', async t => {
+test('external local owner chat preserves literal input and admission rejects foreign or restricted runs', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-external-owner-'))
   t.after(()=>rm(root,{recursive:true,force:true}))
   const prior={path:process.env.PATH,transport:process.env.EZ_EXECUTOR_TRANSPORT}
@@ -227,10 +263,10 @@ test('external local owner chat preserves authorization and literal input', asyn
     const runs=new RunStore(root)
     await runs.create({id:'r_foreign',chatId:999,telegramUserId:999,texts:['no']})
     await runs.patch('r_foreign',{status:'running'})
-    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_foreign'}),/blocked|owner/i)
+    await assert.rejects(requireOwnerExecution(root,'r_foreign'),/blocked: owner-mismatch/i)
     await runs.create({id:'r_restricted',chatId:101,telegramUserId:101,texts:['no'],taskId:'task_'+'a'.repeat(32)})
     await runs.patch('r_restricted',{status:'running'})
-    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_restricted'}),/owner-authorized native local/)
+    await assert.rejects(requireOwnerExecution(root,'r_restricted'),/external-execution-unavailable/)
   } finally {
     if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
     if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport

package/test/failure.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, mkdir, readFile, writeFile, rm } from 'node:fs/promises'
+import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { execFile, spawn } from 'node:child_process'
@@ -8,19 +8,22 @@ import { promisify } from 'node:util'
 import { fileURLToPath } from 'node:url'
 import { once } from 'node:events'
 import { redactFailure, failureStamp, needsFailureReview } from '../src/failure.js'
-import { RunStore } from '../src/runs.js'
+import { RunStore, sentOutbox } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
 import { Scheduler } from '../src/scheduler.js'
 import { initialPreset } from '../src/ai.js'
 import { createRelay } from '../src/index.js'
+import { serveTestLedger } from './helpers/ledger.js'
 import { TelegramSource } from '../src/telegram-source.js'
 import { packageVersion } from '../src/version.js'
+import { initializeWorkspace } from '../src/workspace.js'
 import type { Update } from 'grammy/types'
 const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
 // This integration test starts subprocesses, persists their receipts, and invokes
 // the schedule CLI. Give a busy CI worker time to settle without changing the
 // production recovery deadline.
 const until=async(check:()=>Promise<boolean>,timeoutMs=15_000)=>{const deadline=Date.now()+timeoutMs;while(!(await check())){if(Date.now()>=deadline)throw new Error(`Timed out after ${timeoutMs}ms`);await new Promise(r=>setTimeout(r,20))}}
+const seedWorkspace=async(dir:string)=>{const purpose=join(dir,'purpose.md');await writeFile(purpose,'Fixture relay agent\n');await initializeWorkspace(dir,purpose)}
 
 test('failure evidence is bounded and redacts configured credentials, headers, tokens, URLs and keys',()=>{
  const token='123456789:abcdefghijklmnopqrstuvwxyz123456789'
@@ -31,6 +34,8 @@ test('failure evidence is bounded and redacts configured credentials, headers, t
 
 test('failure review CLI is owner-bound, rejects stale reviews, and keeps failure evidence immutable',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-failure-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ // The schedule CLI child reaches the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,1000)
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_EXECUTOR_CLI:'grok',EZ_RUN_ID:''}
  const cli=(args:string[],overrides={})=>exec(process.execPath,[bin,...args],{env:{...env,...overrides}})
@@ -59,7 +64,7 @@ test('failure review CLI is owner-bound, rejects stale reviews, and keeps failur
   await runs.patch(id,{status:'running',...('replyOnly' in extra?{replyOnly:true}:{})})
   await assert.rejects(cli(review,{EZ_RUN_ID:id}),/owner-authorized/)
  }
- await writeFile(join(dir,'runs','r_bad.json'),'{broken')
+ await assert.rejects(stat(join(dir,'runs')),{code:'ENOENT'})
  assert.equal(JSON.parse((await cli(['failures'])).stdout).total,1)
 })
 
@@ -84,6 +89,8 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
  })
  relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
  relay.bot.api.config.use(async(_p,method,payload)=>{if(method==='sendMessage')replies.push((payload as any).text);return {ok:true,result:{message_id:replies.length}} as any})
+ // The schedule CLI children reach the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir)
  const originalPatch=RunStore.prototype.patch
  t.mock.method(RunStore.prototype,'patch',async function(this:RunStore,...args:Parameters<RunStore['patch']>){
   // Hold the PID write until the fast child has closed, reproducing slow disk
@@ -112,7 +119,7 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
   await relay.bot.handleUpdate({...update,update_id:12,message:{...update.message!,message_id:12,text:'/stop'}})
   await until(async()=>(await runs.get('tg_11'))?.status==='cancelled')
   assert.equal(needsFailureReview((await runs.get('tg_11'))!),false)
- }finally{await relay.stop();for(const child of children)child.kill();await rm(dir,{recursive:true,force:true})}
+ }finally{await relay.stop();for(const child of children)child.kill();await ledger.stop();await rm(dir,{recursive:true,force:true})}
 })
 
 
@@ -142,6 +149,7 @@ test('relay shutdown waits for executor cleanup and final run state', async () =
 
 test('a fresh relay initializes its bot identity before polling', async () => {
  const dir=await mkdtemp(join(tmpdir(),'ez-cold-start-'))
+ await seedWorkspace(dir)
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw new Error('No executor expected')})
  const methods:string[]=[]
  relay.bot.api.config.use(async(_prev,method,_payload,signal)=>{
@@ -165,6 +173,7 @@ test('a fresh relay initializes its bot identity before polling', async () => {
 
 for (const cleanupFails of [false,true]) test(`polling conflict preserves work until an explicit shutdown (cleanup fails: ${cleanupFails})`, async t => {
  const dir=await mkdtemp(join(tmpdir(),'ez-polling-conflict-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ await seedWorkspace(dir)
  let release!:()=>void,entered!:()=>void,releaseDelivery!:()=>void,sending!:()=>void,child:ReturnType<typeof spawn>|undefined,polls=0
  const gate=new Promise<void>(resolve=>{release=resolve}),cleaning=new Promise<void>(resolve=>{entered=resolve})
  const deliveryGate=new Promise<void>(resolve=>{releaseDelivery=resolve}),deliveryStarted=new Promise<void>(resolve=>{sending=resolve})
@@ -216,7 +225,7 @@ for (const cleanupFails of [false,true]) test(`polling conflict preserves work u
   await stopped
   assert.equal(relay.stop(),stopping,'finished shutdown remains idempotent')
   assert.equal(sourceStops,1)
-  assert.deepEqual(JSON.parse(await readFile(join(dir,'outbox',`${item.id}.sent.json`),'utf8')).receipt.messageIds,[1])
+  assert.deepEqual((sentOutbox(dir).find(entry=>entry.id===item.id)?.receipt as {messageIds:number[]}).messageIds,[1])
   assert.equal(polls,1,'a conflict must not start another polling loop before the retry delay')
   assert.equal(relay.bot.isRunning(),false)
   assert.ok(child && (child.exitCode!==null || child.signalCode!==null))
@@ -264,6 +273,7 @@ for (const intake of [true,false]) test(`relay shutdown terminates an in-flight
 
 test('group members can inspect failures and wake review without exposing other chats', async t => {
  const dir=await mkdtemp(join(tmpdir(),'ez-group-failure-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,900000),scheduler=new Scheduler(dir)
  await control.requestPairing(101,-123,'Fixture');const owner=await control.approveOwner(-123,true)
  const execution=await control.captureChoice(initialPreset('grok'))
@@ -285,6 +295,7 @@ test('group members can inspect failures and wake review without exposing other
 
 for (const failure of [400,401,503,'programming'] as const) test(`setup failure ${failure} retries only transient errors`,async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-setup-failure-'))
+ await seedWorkspace(dir)
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('No executor expected')})
  let commands=0,polls=0
  relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
@@ -310,6 +321,7 @@ for (const failure of [400,401,503,'programming'] as const) test(`setup failure
 
 test('shutdown aborts a pending bot initialization without starting polling',async()=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-init-stop-'))
+ await seedWorkspace(dir)
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'grok',telegramBotToken:'fixture'},async()=>{throw Error('No executor expected')})
  let initSignal:Parameters<typeof relay.bot.init>[0],polls=0
  relay.bot.api.config.use(async(_prev,method,_payload,signal)=>{
@@ -328,6 +340,7 @@ test('shutdown aborts a pending bot initialization without starting polling',asy
 
 test('failed reviewer readback exposes its stop through show, list and resume until explicit edit',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-review-stop-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
  await control.requestPairing(101,101);const owner=await control.approveOwner(101)
  const execution=await control.captureChoice(initialPreset('grok')),now=Date.now()+1000