@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.36

package/test/message-history.test.ts

@@ -1,45 +1,42 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, readFile, writeFile, readdir } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
 import { execFile } from 'node:child_process'
 import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
 import { deliveredMessages } from '../src/message-history.js'
 import { RunStore } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
 
 async function fixture(t: test.TestContext) {
   const dir = await mkdtemp(join(tmpdir(), 'ez-history-'))
-  t.after(() => rm(dir, { recursive: true, force: true }))
+  // Child CLI assertions below reach the memory ledger through the socket.
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
   await ownerRun(dir, 'tg_1')
   const runs = new RunStore(dir)
-  const patchFixture = async (id: string, patch: Record<string, unknown>) => {
-    const file = join(dir, 'runs', id + '.json')
-    await writeFile(file, JSON.stringify({ ...JSON.parse(await readFile(file, 'utf8')), ...patch }))
-  }
   const send = async (runId: string, text: string, ids: number[]) => {
     const item = await runs.enqueueMessage(runId, text)
     await runs.claimOutbox(item.id)
     await runs.markOutboxSent(item.id, ids)
-    return join(dir, 'outbox', item.id + '.sent.json')
+    return item
   }
-  return { dir, runs, send, patchFixture }
+  return { dir, runs, send }
 }
 
 test('CLI retrieves Synopsys delivery from another session without changing sessions or sending', async t => {
-  const { dir, runs, send, patchFixture } = await fixture(t)
-  await ownerRun(dir, 'r_schedule_report')
+  const { dir, runs, send } = await fixture(t)
   const owner = (await new ControlStore(dir, 1000).status()).owner!
-  await patchFixture('r_schedule_report', { nativeSessionId: 'report_session', scheduled: {
-    id: 's_earnings', revision: 1, dueAt: new Date().toISOString(), pairedAt: owner.pairedAt,
-  } })
+  const report = await runs.create({ id: 'r_schedule_report', chatId: 101, telegramUserId: 101, texts: ['quarterly results'],
+    execution: { sessionId: 'report_session', preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } },
+    scheduled: { id: 's_earnings', revision: 'rev', dueAt: new Date().toISOString(), pairedAt: owner.pairedAt } })
+  await runs.patch(report.id, { status: 'running', nativeSessionId: 'report_session' })
   await send('r_schedule_report', 'Synopsys (SNPS): quarterly results', [10, 11])
   await runs.patch('r_schedule_report', { status: 'completed' })
-  await patchFixture('tg_1', { texts: ['Why now?'] })
   await send('tg_1', 'Other report', [12])
-  const before = await readdir(join(dir, 'outbox'))
   const controlBefore = await new ControlStore(dir, 1000).status()
   const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-message.mjs', 'history', '--message-id', '11'], {
     env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'tg_1' },
@@ -51,51 +48,49 @@ test('CLI retrieves Synopsys delivery from another session without changing sess
   assert.equal(result.messages[0].scheduleId, 's_earnings')
   assert.deepEqual(result.messages[0].messageIds, [10, 11])
   assert.deepEqual(await new ControlStore(dir, 1000).status(), controlBefore)
-  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  // History reads never create outbox state on disk.
+  await assert.rejects(stat(join(dir, 'outbox')))
   const latest = await deliveredMessages(dir, 'tg_1', { limit: 1 })
   assert.equal(latest.messages[0].text, 'Other report')
   assert.equal(latest.hasMore, true)
 })
 
 test('only confirmed deliveries in current owner binding are exposed', async t => {
-  const { dir, runs, send, patchFixture } = await fixture(t)
+  const { dir, runs, send } = await fixture(t)
   await send('tg_1', 'included', [1])
   await runs.enqueueMessage('tg_1', 'pending')
   const failed = await runs.enqueueMessage('tg_1', 'uncertain')
   await runs.claimOutbox(failed.id)
   await runs.failOutbox(failed.id, 'unknown', true)
-  await writeFile(join(dir, 'outbox', 'corrupt.sent.json'), '{')
-  await writeFile(join(dir, 'outbox', 'null.sent.json'), 'null')
-  const invalid = await send('tg_1', 'invalid receipt', [2])
-  const record = JSON.parse(await readFile(invalid, 'utf8'))
-  record.receipt.messageIds = []
-  await writeFile(invalid, JSON.stringify(record))
-  for (const [id, patch] of [
-    ['r_other_chat', { chatId: 202 }],
-    ['r_other_owner', { telegramUserId: 202 }],
-    ['r_old', { createdAt: '2000-01-01T00:00:00.000Z' }],
-    ['r_external', { external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } }],
-  ] as const) {
-    await ownerRun(dir, id)
-    await patchFixture(id, patch)
-    await send(id, 'excluded', [3])
+  // Receipts without usable message IDs are not delivery evidence.
+  const invalid = await runs.enqueueMessage('tg_1', 'invalid receipt')
+  await runs.claimOutbox(invalid.id)
+  await runs.markOutboxSent(invalid.id, [])
+  for (const input of [
+    { id: 'r_other_chat', chatId: 202, telegramUserId: 101 },
+    { id: 'r_other_owner', chatId: 101, telegramUserId: 202 },
+    { id: 'r_external', chatId: 101, telegramUserId: 101, external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } },
+  ]) {
+    await runs.create({ ...input, texts: ['excluded'] })
+    await runs.patch(input.id, { status: 'running' })
+    await send(input.id, 'excluded', [3])
   }
   assert.deepEqual((await deliveredMessages(dir, 'tg_1')).messages.map(m => m.text), ['included'])
-  await writeFile(join(dir, 'runs', 'broken.json'), '{')
   assert.equal((await deliveredMessages(dir, 'tg_1')).messages.length, 1)
 })
 
 test('unauthorized callers and invalid arguments fail closed', async t => {
-  const { dir, runs, patchFixture } = await fixture(t)
+  const { dir, runs } = await fixture(t)
   for (const limit of [0, 51, NaN, 1.5]) await assert.rejects(deliveredMessages(dir, 'tg_1', { limit }), /Limit/)
   await assert.rejects(deliveredMessages(dir, 'tg_1', { messageId: -1 }), /Message ID/)
   await assert.rejects(deliveredMessages(dir, '../tg_1'), /identifier/)
   await assert.rejects(deliveredMessages(dir, 'missing'), /No active/)
   await ownerRun(dir, 'r_external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
   await assert.rejects(deliveredMessages(dir, 'r_external'), /blocked/)
-  await patchFixture('tg_1', { telegramUserId: 202 })
-  await assert.rejects(deliveredMessages(dir, 'tg_1'), /owner-mismatch/)
-  await patchFixture('tg_1', { telegramUserId: 101, status: 'completed' })
+  await runs.create({ id: 'r_stranger', chatId: 101, telegramUserId: 202, texts: ['other'] })
+  await runs.patch('r_stranger', { status: 'running' })
+  await assert.rejects(deliveredMessages(dir, 'r_stranger'), /owner-mismatch/)
+  await runs.patch('tg_1', { status: 'completed' })
   await assert.rejects(deliveredMessages(dir, 'tg_1'), /No active/)
   await runs.patch('tg_1', { status: 'running' })
   await new ControlStore(dir, 1000).revokeOwner()
@@ -103,14 +98,11 @@ test('unauthorized callers and invalid arguments fail closed', async t => {
 })
 
 test('approval messages retain the content delivered to Telegram', async t => {
-  const { dir, send } = await fixture(t)
-  const file = await send('tg_1', 'placeholder', [20])
-  const item = JSON.parse(await readFile(file, 'utf8'))
-  delete item.text
-  item.type = 'approval'
-  item.approvalPrompt = 'Approve this messaging task?'
-  await writeFile(file, JSON.stringify(item))
-  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, item.approvalPrompt)
+  const { dir, runs } = await fixture(t)
+  const item = await runs.enqueueApproval('tg_1', 'Approve this messaging task?', 'act_history')
+  await runs.claimOutbox(item.id)
+  await runs.markOutboxSent(item.id, [20])
+  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, 'Approve this messaging task?')
 })
 
 test('CLI flushes complete long reports and rejects send options in history mode', async t => {
@@ -121,7 +113,7 @@ test('CLI flushes complete long reports and rejects send options in history mode
   const cli = [ 'bin/ezenciel-agents-message.mjs', 'history' ]
   const { stdout } = await promisify(execFile)(process.execPath, cli, { env })
   assert.equal(JSON.parse(stdout).messages[0].text, text)
-  const before = await readdir(join(dir, 'outbox'))
   await assert.rejects(promisify(execFile)(process.execPath, [...cli, '--text', 'do not send'], { env }), /Unknown option/)
-  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  // History reads never create outbox state on disk.
+  await assert.rejects(stat(join(dir, 'outbox')))
 })

package/test/native-tasks.test.ts

@@ -16,7 +16,7 @@ test('native tasks use verified control binding, sanitized environment and uncha
     const binding=await nativeTaskBinding(home,{HOME:root,PATH:process.env.PATH,TELEGRAM_BOT_TOKEN:'secret',EZ_RUN_ID:'forged',NODE_OPTIONS:'injection',EZ_CONTROL_DIR:'/wrong'})
     assert.equal(binding.cwd,workspace);assert.equal(binding.env.EZ_CONTROL_DIR,controlDir);assert.equal(binding.env.EZ_EXECUTOR_CLI,'grok')
     for(const key of ['TELEGRAM_BOT_TOKEN','EZ_RUN_ID','NODE_OPTIONS'])assert.equal(binding.env[key],undefined)
-    assert.match((await nativeTasks(home,['--help'])).stdout,/durable, asynchronous CLI task/)
+    assert.match((await nativeTasks(home,['--help'])).stdout,/Creates a scheduled task/)
     const denied=await nativeTasks(home,['list']);assert.notEqual(denied.code,0);assert.match(denied.stderr,/Pair an owner/)
     const control=new ControlStore(controlDir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
     const text='Read scan; $(must-not-run) /goal literal'

package/test/plugin-broker.test.mjs

@@ -0,0 +1,172 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import { createConnection } from 'node:net';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { ControlStore, ownerId, ownerEpoch } from '../src/control-state.js';
+import { RunStore } from '../src/runs.js';
+import { loadPluginBrokerBinding, servePluginBroker, validateBrokerRequest } from '../src/plugin-broker.mjs';
+
+const hash = value => createHash('sha256').update(value).digest('hex');
+const revision = 'sha256:' + 'a'.repeat(64);
+
+test('relay compose surface has no broker Docker socket or tools-home mount', async () => {
+  const compose = await fs.readFile(new URL('../compose.yaml', import.meta.url), 'utf8');
+  const relay = compose.slice(0, compose.indexOf('  plugin-broker:'));
+  assert.equal(relay.includes('/var/run/docker.sock'), false);
+  assert.equal(relay.includes('EZ_TOOLS_HOME'), false);
+  assert.equal(compose.slice(compose.indexOf('  plugin-broker:')).includes('/var/run/docker.sock'), true);
+});
+
+async function fixture(t) {
+  const root = await fs.realpath(await fs.mkdtemp(path.join(tmpdir(), 'e-')));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  const home = path.join(root, 'tools');
+  const workspace = path.join(root, 'mind');
+  const controlDir = path.join(root, 'control');
+  const hostConfig = path.join(root, 'host-executor.json');
+  const socket = path.join(controlDir, 'plugin-broker.sock');
+  const source = path.join(home, 'packages', 'sample', revision.slice(7));
+  await Promise.all([home, workspace, controlDir, source].map(directory => fs.mkdir(directory, { recursive: true, mode: 0o700 })));
+  await fs.mkdir(path.join(root, 'bin'), { mode: 0o700 });
+  const host = { cli: 'codex', isolation: 'isolated', agents: [{ name: 'tenant-a', toolsHome: home, workspace, controlDir, binDir: path.join(root, 'bin') }] };
+  await fs.writeFile(hostConfig, JSON.stringify(host) + '\n', { mode: 0o600 });
+  const realHost = await fs.realpath(hostConfig);
+  const realHome = await fs.realpath(home);
+  const realWorkspace = await fs.realpath(workspace);
+  const realControl = await fs.realpath(controlDir);
+  await fs.writeFile(path.join(home, 'config.json'), JSON.stringify({ schemaVersion: 1, workspace: realWorkspace, hostConfig: realHost }) + '\n', { mode: 0o600 });
+  const record = {
+    revision,
+    source,
+    project: `ezp-${hash(realHome).slice(0, 16)}-sample`,
+    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: [] },
+    deployment: { schemaVersion: 1, services: { sample: { buildTarget: 'runtime', volumes: {}, workspace: false, healthcheck: ['node', '--version'] } }, commands: { sample: { service: 'sample', argv: ['node', '/app/client.mjs'], suffix: [] } }, exports: {} },
+    compose: path.join(home, 'packages', 'sample', 'compose.json'),
+  };
+  await fs.writeFile(path.join(home, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: realHome, plugins: { sample: record }, commands: { sample: 'sample' } }) + '\n', { mode: 0o600 });
+  const fake = path.join(root, 'fake');
+  await fs.mkdir(fake, { mode: 0o700 });
+  await fs.writeFile(path.join(fake, 'docker'), `#!${process.execPath}
+const a=process.argv.slice(2);
+if(a.includes('loud'))process.stdout.write('x'.repeat(1024*1024+1));
+else if(a.includes('run'))process.stdout.write('broker-ok');
+`, { mode: 0o700 });
+  const control = new ControlStore(realControl, 1000);
+  await control.requestPairing(42, 42);
+  const owner = await control.approveOwner(42);
+  const run = await new RunStore(realControl).create({ id: 'r_broker', chatId: 42, telegramUserId: 42, texts: ['broker test'], ownerId: ownerId(owner), ownerEpoch: ownerEpoch(owner) });
+  await new RunStore(realControl).patch(run.id, { status: 'running' });
+  return { root, home: realHome, workspace: realWorkspace, controlDir: realControl, hostConfig: realHost, socket, runId: run.id, fake };
+}
+
+async function request(socketPath, payload) {
+  return new Promise((resolve, reject) => {
+    const socket = createConnection(socketPath);
+    let buffer = '';
+    socket.once('error', reject);
+    socket.on('data', chunk => {
+      buffer += chunk.toString();
+      const end = buffer.indexOf('\n');
+      if (end < 0) return;
+      try { resolve(JSON.parse(buffer.slice(0, end))); } catch (error) { reject(error); }
+      socket.destroy();
+    });
+    socket.on('connect', () => socket.end(JSON.stringify(payload) + '\n'));
+  });
+}
+
+async function waitForSocket(socketPath) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    try { if ((await fs.stat(socketPath)).isSocket()) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+  throw new Error('Broker socket did not start');
+}
+
+test('isolated broker authenticates an owned run, pins plugin revision, and writes receipts', async t => {
+  const f = await fixture(t);
+  const binding = await loadPluginBrokerBinding({ home: f.home, workspace: f.workspace, controlDir: f.controlDir, socket: f.socket, hostConfig: f.hostConfig, timeoutMs: 10_000 });
+  const previousPath = process.env.PATH;
+  process.env.PATH = f.fake + path.delimiter + previousPath;
+  const abort = new AbortController();
+  const serving = servePluginBroker(binding, abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    const published = JSON.parse(await fs.readFile(path.join(f.controlDir, 'plugin-broker-plugins.json'), 'utf8'));
+    assert.deepEqual(published.plugins, [{ id: 'sample', version: '1.0.0' }]);
+    const listed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list'] });
+    assert.equal(listed.ok, true);
+    assert.deepEqual(JSON.parse(listed.stdout), { sample: 'sample' });
+    const detailed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list', '--details'] });
+    assert.equal(detailed.ok, true);
+    assert.deepEqual(JSON.parse(detailed.stdout).sample.commands, ['ez sample --help']);
+    const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    assert.equal(resolved.ok, true);
+    assert.equal(resolved.revision, revision);
+    const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: resolved.capability, args: ['literal', '$(not-a-shell)'], stdin: 'input' });
+    assert.equal(invoked.ok, true);
+    assert.equal(invoked.stdout, 'broker-ok');
+    assert.equal(invoked.receipt.status, 'completed');
+    assert.deepEqual(JSON.parse(await fs.readFile(invoked.receiptPath, 'utf8')), invoked.receipt);
+    const replay = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: resolved.capability, args: [] });
+    assert.equal(replay.ok, false);
+    assert.match(replay.error, /capability/);
+    const loudResolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    const loud = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: loudResolved.capability, args: ['loud'] });
+    assert.equal(loud.ok, false);
+    assert.match(loud.error, /output limit/);
+    assert.equal(loud.receipt.status, 'failed');
+    const generated = JSON.parse(await fs.readFile(f.home + '/packages/sample/compose.json', 'utf8'));
+    assert.equal(generated.version, '3.8');
+  } finally {
+    abort.abort();
+    await serving;
+    process.env.PATH = previousPath;
+  }
+});
+
+test('broker rejects foreign agent bindings and unsafe management or request fields', async t => {
+  const f = await fixture(t);
+  const foreign = path.join(f.root, 'foreign');
+  const foreignHome = path.join(foreign, 'tools');
+  const foreignWorkspace = path.join(foreign, 'mind');
+  const foreignControl = path.join(foreign, 'control');
+  await Promise.all([foreignHome, foreignWorkspace, foreignControl].map(directory => fs.mkdir(directory, { recursive: true, mode: 0o700 })));
+  await fs.writeFile(path.join(foreignHome, 'config.json'), JSON.stringify({ schemaVersion: 1, workspace: await fs.realpath(foreignWorkspace), hostConfig: f.hostConfig }));
+  await fs.writeFile(path.join(foreignHome, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: await fs.realpath(foreignHome), plugins: {}, commands: {} }));
+  await assert.rejects(loadPluginBrokerBinding({ home: foreignHome, workspace: foreignWorkspace, controlDir: foreignControl, socket: path.join(foreignControl, 'plugin-broker.sock'), hostConfig: f.hostConfig }), /owned by exactly one isolated agent/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'install', 'sample', '--source', '/tmp/plugin'] }), /not allowed/);
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'uninstall', 'sample'] }, f.workspace));
+  const source = path.join(f.workspace, 'plugin-source');
+  await fs.mkdir(source);
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'catalog-add', 'sample', '--source', source, '--revision', revision] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'catalog-add', 'sample', '--source', '/tmp/plugin', '--revision', revision] }, f.workspace), /agent workspace/);
+  const candidate = path.join(source, 'candidate.tgz');
+  await fs.writeFile(candidate, 'candidate');
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', candidate] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', '/tmp/candidate.tgz'] }, f.workspace), /agent workspace/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--version', '1.0.1'] }, f.workspace), /not allowed/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'short', args: [] }), /capability/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'a'.repeat(48), args: [], stdin: 'x'.repeat(1024 * 1024 + 1) }), /stdin/);
+});
+
+test('broker rejects resolve and invoke for a revoked run', async t => {
+  const f = await fixture(t);
+  const binding = await loadPluginBrokerBinding({ home: f.home, workspace: f.workspace, controlDir: f.controlDir, socket: f.socket, hostConfig: f.hostConfig, timeoutMs: 10_000 });
+  const abort = new AbortController();
+  const serving = servePluginBroker(binding, abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    await new RunStore(f.controlDir).patch(f.runId, { status: 'cancelled' });
+    const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    assert.equal(resolved.ok, false);
+    const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: 'a'.repeat(64), args: [] });
+    assert.equal(invoked.ok, false);
+  } finally {
+    abort.abort();
+    await serving;
+  }
+});

package/test/plugin-manager.test.mjs

@@ -6,7 +6,12 @@ import path from 'node:path';
 import {execFile,spawn} from 'node:child_process';
 import {once} from 'node:events';
 import {promisify} from 'node:util';
-import {snapshot,init as initManager,validate,compose,locked,bindToolDiscovery} from '../src/plugins/manager.mjs';
+import {snapshot,init as initManager,validate,compose,locked,bindToolDiscovery,prepareCommand} from '../src/plugins/manager.mjs';
+import { ControlStore, ownerId, ownerEpoch } from '../src/control-state.js';
+import { ApplicationBindings } from '../src/application-channel.js';
+import { RunStore } from '../src/runs.js';
+import { serveTestLedger } from './helpers/ledger.js';
+import { randomBytes } from 'node:crypto';
 // Synthetic manager tests explicitly opt out of the product's default packages.
 async function init(home,workspace,catalog,hostConfig) {
  const file=path.join(path.dirname(home),'test-catalog.json');
@@ -69,6 +74,7 @@ test('native discovery binding preserves notes and never seeds a tool inventory'
  await init(f.home,f.workspace);
  await assert.rejects(fs.access(notes),{code:'ENOENT'});
  const first=await fs.readFile(instructions,'utf8');assert(first.startsWith('Owner mandate\n'));assert(first.includes(f.home+'/bin/ez'));
+ assert.match(first,/tools list --details/);assert.match(first,/ --help/);assert.doesNotMatch(first,/ezenciel-agents-message|KISS/);
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(instructions,'utf8'),first);
  await fs.writeFile(notes,'Legacy policy');
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(notes,'utf8'),'Legacy policy');
@@ -81,6 +87,12 @@ test('native discovery binding preserves notes and never seeds a tool inventory'
  await assert.rejects(bindToolDiscovery(f.home,f.workspace),/regular file/);
  assert.equal(await fs.readFile(notes,'utf8'),'Legacy policy');
 });
+test('isolated discovery uses the relay-bound ez client without exposing toolsHome',async t=>{
+ const f=await fixture(t);await fs.mkdir(f.home);const workspace=await fs.realpath(f.workspace),controlDir=await fs.realpath(f.control),toolsHome=await fs.realpath(f.home),host={cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir,binDir:path.join(f.root,'bin'),toolsHome}]};
+ await fs.mkdir(path.join(f.root,'bin'));await fs.writeFile(f.hostConfig,JSON.stringify(host));
+ await init(f.home,f.workspace,undefined,f.hostConfig);
+ const instructions=await fs.readFile(path.join(f.workspace,'AGENTS.md'),'utf8');assert.match(instructions,/`ez tools list --details`/);assert.doesNotMatch(instructions,new RegExp(f.home.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')));
+});
 test('installed snippets follow install, upgrade and uninstall without files or Docker reads',async t=>{
  const f=await fixture(t);await init(f.home,f.workspace);
  const details=async()=>JSON.parse((await f.call('tools','list','--details')).stdout);
@@ -98,6 +110,72 @@ test('installed snippets follow install, upgrade and uninstall without files or
  }
  await assert.rejects(fs.access(path.join(f.workspace,'TOOLS.md')),{code:'ENOENT'});
 });
+test('application plugin context is namespaced, authorized, and absent from ordinary commands',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const home=await fs.realpath(f.home);
+ const ledger=await serveTestLedger(f.control);t.after(()=>ledger.stop());
+ const control=new ControlStore(f.control,1000);await control.requestPairing(42,42);const owner=await control.approveOwner(42);
+ const binding=await new ApplicationBindings(f.control).register('app',randomBytes(32).toString('base64url'),owner);
+ assert.ok(binding);
+ const runs=new RunStore(f.control),run=await runs.create({id:'r_app_plugin',ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin'],application:{bindingId:binding.bindingId,requestId:'plugin',scope:'owner-chat',context:{plugins:{sample:{capability:'scoped-value',template:'cost $5 for ${plan} and $HOME'},other:{capability:'must-not-leak'}}}}});
+ await runs.patch(run.id,{status:'running'});
+  const command=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:run.id}});
+  const index=command.argv.lastIndexOf('--file');assert.ok(index>0);
+  assert.equal(command.argv[index+2],'run');
+  const contextFile=command.argv[index+1];
+  assert.match(contextFile,/\/plugin-context\/[0-9a-f-]+\.json$/);
+  assert.equal(command.argv.join(' ').includes('must-not-leak'),false);
+  // The run container receives the slice through the service environment, not
+  // through interpolation-only --env-file. Compose collapses the escaped
+  // `$$` back to `$`, so every context value must survive byte-for-byte.
+  const override=JSON.parse(await fs.readFile(contextFile,'utf8'));
+  const delivered=override.services.sample.environment.EZ_PLUGIN_CONTEXT.replaceAll('$$','$');
+  assert.deepEqual(JSON.parse(delivered),{capability:'scoped-value',template:'cost $5 for ${plan} and $HOME'});
+  assert.ok(override.services.sample.environment.EZ_PLUGIN_CONTEXT.includes('$$5'));
+  assert.ok(override.services.sample.environment.EZ_PLUGIN_CONTEXT.includes('$${plan}'));
+  assert.equal((await fs.stat(contextFile)).mode&0o777,0o600);
+  await command.release();await assert.rejects(fs.access(contextFile),{code:'ENOENT'});
+  const ordinary=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control}});
+  assert.equal(ordinary.argv.includes('--env-file'),false);assert.equal(ordinary.contextFile,undefined);
+});
+test('Telegram-admitted application runs receive the same scoped plugin context',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const home=await fs.realpath(f.home);
+ const ledger=await serveTestLedger(f.control);t.after(()=>ledger.stop());
+ const control=new ControlStore(f.control,1000);await control.requestPairing(42,42);const owner=await control.approveOwner(42);
+ const binding=await new ApplicationBindings(f.control).register('telegram-app',randomBytes(32).toString('base64url'),owner,true);
+ assert.ok(binding);
+ const runs=new RunStore(f.control),run=await runs.create({id:'tg_plugin_context',chatId:42,telegramUserId:42,ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin']});
+ await runs.attachTelegramApplication(run.id,{bindingId:binding.bindingId,requestId:run.id,scope:'telegram',context:{plugins:{sample:{capability:'telegram-scoped-value'}}}});
+ await runs.patch(run.id,{status:'running'});
+  const command=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:run.id}});
+  const index=command.argv.lastIndexOf('--file');assert.ok(index>0);
+  assert.equal(command.argv[index+2],'run');
+  const contextFile=command.argv[index+1];
+  assert.deepEqual(JSON.parse(await fs.readFile(contextFile,'utf8')),{services:{sample:{environment:{EZ_PLUGIN_CONTEXT:'{"capability":"telegram-scoped-value"}'}}}});
+  await command.release();await assert.rejects(fs.access(contextFile),{code:'ENOENT'});
+});
+test('application plugin context fails closed on revoked, cancelled, and oversized runs',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const home=await fs.realpath(f.home);
+ const ledger=await serveTestLedger(f.control);t.after(()=>ledger.stop());
+ const control=new ControlStore(f.control,1000);await control.requestPairing(42,42);const owner=await control.approveOwner(42);
+ const binding=await new ApplicationBindings(f.control).register('app',randomBytes(32).toString('base64url'),owner);
+ const runs=new RunStore(f.control);
+ const run=await runs.create({id:'r_app_ctx',ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin'],application:{bindingId:binding.bindingId,requestId:'plugin',scope:'owner-chat',context:{plugins:{sample:{capability:'scoped-value'}}}}});
+ await runs.patch(run.id,{status:'running'});
+ await control.revokeOwner();
+ await control.requestPairing(43,43);await control.approveOwner(43);
+ await assert.rejects(prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:run.id}}),/revoked/);
+ const stale=await runs.create({id:'r_app_stale',ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin'],application:{bindingId:binding.bindingId,requestId:'stale',scope:'owner-chat',context:{plugins:{sample:{capability:'scoped-value'}}}}});
+  const idle=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:stale.id}});
+  assert.equal(idle.contextFile,undefined);assert.equal(idle.argv.includes('--env-file'),false);
+ const freshOwner=(await control.status()).owner;
+ const binding2=await new ApplicationBindings(f.control).register('app2',randomBytes(32).toString('base64url'),freshOwner);
+ const big=await runs.create({id:'r_app_big',ownerId:ownerId(freshOwner),ownerEpoch:ownerEpoch(freshOwner),texts:['Use the plugin'],application:{bindingId:binding2.bindingId,requestId:'big',scope:'owner-chat',context:{plugins:{sample:{blob:'x'.repeat(17*1024)}}}}});
+ await runs.patch(big.id,{status:'running'});
+ await assert.rejects(prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:big.id}}),/too large/);
+});
 test('bound launcher installs without startup; literal args and exit codes; scopes and secrets',async t=>{
  const f=await fixture(t);const p=await snapshot(f.source);await init(f.home,f.workspace);
  const install=['plugins','install','sample','--source',f.source,'--revision',p.revision];
@@ -139,6 +217,23 @@ test('unconfirmed direct-command cancellation retains its lifecycle lease',async
  assert.equal((await fs.readdir(path.join(f.home,'command-invocations'))).length,1);
  await assert.rejects(f.call('plugins','uninstall','sample'),/Stale command invocation lease/);
 });
+test('an unreadable invocation lease pid falls through to container verification',async t=>{
+ const f=await fixture(t);
+ const directory=path.join(f.home,'command-invocations');await fs.mkdir(directory,{recursive:true});
+ const lease=path.join(directory,'00000000-0000-4000-8000-000000000000.json');
+ await fs.writeFile(lease,JSON.stringify({pid:process.pid,container:'gone-call'}),{mode:0o600});
+ const path0=process.env.PATH,kill0=process.kill;
+ process.env.PATH=f.fake+path.delimiter+path0;
+ process.kill=()=>{const error=new Error('kill EPERM');error.code='EPERM';throw error;};
+ try {
+  await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nconst a=process.argv.slice(2);if(a[0]==='container'&&a[1]==='inspect'){console.error('No such container: gone-call');process.exit(1)}\n`,{mode:0o700});
+  assert.equal(await locked(f.home,async()=>'ok'),'ok');
+  await assert.rejects(fs.access(lease),{code:'ENOENT'});
+  await fs.writeFile(lease,JSON.stringify({pid:process.pid,container:'live-call'}),{mode:0o600});
+  await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nconst a=process.argv.slice(2);if(a[0]==='container'&&a[1]==='inspect'){console.log('live-call');process.exit(0)}\n`,{mode:0o700});
+  await assert.rejects(locked(f.home,async()=>{}),/Stale command invocation lease/);
+ } finally {process.kill=kill0;process.env.PATH=path0;}
+});
 test('changed source, symlinks, reserved aliases, arbitrary Docker fields rejected',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);
  await fs.writeFile(path.join(f.source,'client.mjs'),'changed');await assert.rejects(f.call('plugins','install','sample','--source',f.source,'--revision',p.revision));
@@ -157,7 +252,29 @@ test('registry corruption, active writer lock and alias collision fail closed',a
 test('Compose resources are namespaced, private, and restricted to owning workspace',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);
  const c=await compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:p.deployment});
- assert.equal(c.name,'ezp-synthetic');assert.equal(c.services.sample.ports,undefined);assert.equal(c.services.sample.privileged,undefined);assert.equal(c.services.sample.volumes[1].read_only,true);assert.deepEqual(c.services.sample.cap_drop,['ALL']);
+ assert.equal(c.version,'3.8');assert.equal(c.name,undefined);assert.equal(c.services.sample.ports,undefined);assert.equal(c.services.sample.privileged,undefined);assert.equal(c.services.sample.volumes[1].read_only,true);assert.deepEqual(c.services.sample.cap_drop,['ALL']);
+});
+test('standalone Compose fallback emits a v1-compatible document and keeps project identity in argv',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),previous=process.env.EZ_DOCKER_COMPOSE;
+ process.env.EZ_DOCKER_COMPOSE='standalone';
+ try {
+  const c=await compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:p.deployment});
+  assert.equal(c.version,'3.8');assert.equal(c.name,undefined);assert.ok(c.services.sample.build.target);
+ } finally {
+  if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
+ }
+});
+test('isolated broker host binding validates exact mounts without deployment symlinks',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),isolated=path.join(f.root,'isolated'),workspace=path.join(isolated,'workspace'),control=path.join(isolated,'control'),hostConfig=path.join(isolated,'host-executor.json'),previous=process.env.EZ_DOCKER_COMPOSE;
+ await fs.mkdir(f.home,{recursive:true});await fs.mkdir(workspace,{recursive:true});await fs.mkdir(control,{recursive:true});
+ await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home}]}));
+ process.env.EZ_DOCKER_COMPOSE='standalone';
+ try {
+  const c=await compose({workspace:await fs.realpath(workspace),hostConfig:await fs.realpath(hostConfig)},{source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment},{},f.home);
+  assert.equal(c.version,'3.8');assert.equal(c.services.sample.volumes[1].source,await fs.realpath(workspace));
+ } finally {
+  if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
+ }
 });
 test('host-owned private networks survive registered-call Compose regeneration',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);
@@ -169,7 +286,7 @@ test('host-owned private networks survive registered-call Compose regeneration',
  config.hostConfig=await fs.realpath(f.hostConfig);
  await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify(config));
  const file=path.join(f.home,'packages/sample/compose.json');await fs.writeFile(file,'{}');
- await f.call('sample','read');
+ await exec(path.join(f.home,'bin','ez'),['sample','read'],{cwd:f.workspace,env:f.env});
  const c=JSON.parse(await fs.readFile(file,'utf8'));
  assert.deepEqual(c.networks.default,{});
  const [key,network]=Object.entries(c.networks).find(([name])=>name!=='default');
@@ -323,8 +440,8 @@ test('standalone rejects relay binding and preserves literal plugin arguments ac
  }
  const log=(await fs.readFile(f.log,'utf8')).trim().split('\n').map(JSON.parse);
  assert(log.every(call=>call.secret===undefined));
- await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify({schemaVersion:1,workspace:f.workspace,catalog:{},deploymentDir:'/missing'}));
- await assert.rejects(exec(launcher,['status']),/deployment-bound/); // never hide a broken relay binding
+ await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify({schemaVersion:1,workspace:await fs.realpath(f.workspace),catalog:{},deploymentDir:'/missing'}));
+ await assert.rejects(exec(launcher,['status'],{cwd:f.workspace,env:f.env}),/deployment-bound/); // never hide a broken relay binding
 });
 
 test('existing folders are read-only, persistent and fail closed when missing', async t => {
@@ -349,6 +466,27 @@ test('existing folders are read-only, persistent and fail closed when missing',
  assert.deepEqual(JSON.parse((await f.call('plugins','folders','sample')).stdout),[]);
 });
 
+test('relay registry rejects foreign callers and ungranted host folders', async t => {
+ const f=await fixture(t);await init(f.home,f.workspace);const p=await snapshot(f.source);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ await fs.mkdir(path.join(f.root,'allowed'));await fs.mkdir(path.join(f.root,'denied'));
+ const allowed=await fs.realpath(path.join(f.root,'allowed')),denied=await fs.realpath(path.join(f.root,'denied'));
+ const host={cli:'synthetic',agents:[{name:'sample',workspace:f.workspace,controlDir:f.control,binDir:path.join(f.home,'bin'),toolsHome:f.home,pluginFolderRoots:{sample:[allowed]}}]};
+ await fs.writeFile(f.hostConfig,JSON.stringify(host));
+ const config=JSON.parse(await fs.readFile(path.join(f.home,'config.json'),'utf8'));
+ config.hostConfig=await fs.realpath(f.hostConfig);await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify(config));
+ const launcher=path.join(f.home,'bin','ez'),foreign={cwd:f.source,env:f.env};
+ const before=await fs.readFile(f.log,'utf8');
+ await assert.rejects(exec(launcher,['sample','read'],foreign),/Registry belongs/);
+ await assert.rejects(exec(launcher,['--for-workspace',f.workspace,'sample','read'],foreign),/Registry belongs/);
+ assert.equal(await fs.readFile(f.log,'utf8'),before);
+ assert.deepEqual(JSON.parse((await exec(launcher,['sample','read'],{cwd:f.workspace,env:f.env})).stdout),['read']);
+ await exec(launcher,['plugins','folder-bind','sample','--service','sample','--source',allowed,'--target','/data/files'],{cwd:f.workspace,env:f.env});
+ const saved=await fs.readFile(path.join(f.home,'config.json'),'utf8');
+ await assert.rejects(exec(launcher,['plugins','folder-bind','sample','--service','sample','--source',denied,'--target','/data/files'],{cwd:f.workspace,env:f.env}),/not granted/);
+ assert.equal(await fs.readFile(path.join(f.home,'config.json'),'utf8'),saved);
+});
+
 test('folder bindings survive compatible descriptors and reject incompatible updates',async t=>{
  const f=await fixture(t);const p=await snapshot(f.source);
  const record={...p,project:'ezp-test-sample'};

package/test/reaction.test.ts

@@ -7,15 +7,19 @@ import test from 'node:test'
 import { promisify } from 'node:util'
 import { isSupportedReactionEmoji, normalizeReactionEmoji, TELEGRAM_REACTIONS } from '../src/reaction.js'
 import { RunStore } from '../src/runs.js'
+import { serveTestLedger } from './helpers/ledger.js'
 
 const execFileAsync = promisify(execFile)
 const reactScriptPath = path.resolve('src/react.ts')
 
 const fixture = async (run: (store: RunStore, dir: string) => Promise<void>): Promise<void> => {
   const directory = await mkdtemp(path.join(tmpdir(), 'ez-reactions-'))
+  // The react CLI child reaches the memory ledger through the socket.
+  const ledger = await serveTestLedger(directory)
   try {
     await run(new RunStore(directory), directory)
   } finally {
+    await ledger.stop()
     await rm(directory, { recursive: true, force: true })
   }
 }

package/test/relay.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, readdir, readFile } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawn } from 'node:child_process'
@@ -207,10 +207,8 @@ test('failed delivery is quarantined and never blindly retried', async () => {
     await assert.rejects(runs.waitForDelivery(item.id), /Ambiguous network failure/)
     assert.deepEqual(await runs.deliveryStatus(), { failed: 0, unknown: 1 })
     await assert.rejects(runs.waitForDelivery('missing', 1), /outcome unknown/)
-    assert.equal(
-      (await readdir(join(dir, 'outbox'))).filter((name) => name.endsWith('.failed.json')).length,
-      1,
-    )
+    // Quarantine lives in relay memory; no outbox state touches control/.
+    await assert.rejects(stat(join(dir, 'outbox')))
   } finally {
     await relay.stop()
     await rm(dir, { recursive: true, force: true })
@@ -245,8 +243,8 @@ test('outbox stores provider receipts and does not redeliver sent messages', asy
     assert.equal(sends, 1)
     assert.deepEqual(((await runs.waitForDelivery(item.id)) as { messageIds: number[] }).messageIds, [42])
     assert.deepEqual(await runs.pendingOutbox(), [])
-    const sent = (await readdir(join(dir, 'outbox'))).find((name) => name.endsWith('.sent.json'))!
-    assert.deepEqual(JSON.parse(await readFile(join(dir, 'outbox', sent), 'utf8')).receipt.messageIds, [42])
+    // Receipts live in relay memory; no outbox state touches control/.
+    await assert.rejects(stat(join(dir, 'outbox')))
   } finally {
     await relay.stop()
     await rm(dir, { recursive: true, force: true })