@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.36

package/test/repair-policy.test.ts

@@ -2,10 +2,9 @@ import test from 'node:test'
 import assert from 'node:assert/strict'
 import { loadConfig } from '../src/config.js'
 import { executorJobEnv } from '../src/executor.js'
-import { agentGuidance } from '../src/agent-guidance.js'
 
 test('repair preference is bound in the environment, never rewritten into the request', () => {
- const config = (value?:string) => loadConfig({TELEGRAM_BOT_TOKEN:'fixture', ...(value===undefined ? {} : {EZ_REPAIR_ENABLED:value})})
+ const config = (value?:string) => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', ...(value===undefined ? {} : {EZ_REPAIR_ENABLED:value})})
  assert.equal(config().repairEnabled,true)
  assert.equal(config('false').repairEnabled,false)
  assert.throws(()=>config('disabled'),/EZ_REPAIR_ENABLED/)
@@ -14,6 +13,4 @@ test('repair preference is bound in the environment, never rewritten into the re
   assert.equal(env.EZ_REPAIR_ENABLED,String(enabled))
   assert.equal(env.TELEGRAM_BOT_TOKEN,undefined)
  }
- assert.match(agentGuidance(),/EZ_REPAIR_ENABLED/)
- assert.match(agentGuidance(),/explicit owner request or saved maintenance mandate/)
 })

package/test/schedule-cli.test.ts

@@ -9,9 +9,12 @@ import { fileURLToPath } from 'node:url'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
+import { serveTestLedger } from './helpers/ledger.js'
 const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
 test('public scheduler CLI saves literal text, reads back, edits, pauses, and rejects external or finished callers',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-schedule-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ // The schedule CLI child reaches the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir)
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:'',EZ_EXECUTOR_CLI:'grok'}
  await assert.rejects(exec(process.execPath,[bin,'list'],{env}),/Pair an owner/)
@@ -19,8 +22,8 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
  const execution=await control.captureChoice(initialPreset('grok'))
  const run=await runs.create({chatId:101,telegramUserId:101,texts:['owner request'],execution})
  await runs.patch(run.id,{status:'running'});env.EZ_RUN_ID=run.id
- const context=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
- assert.deepEqual(context.run.texts,['owner request']);assert.deepEqual(context.busyReplies,[])
+  const context=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
+  assert.deepEqual(context.run.texts,['owner request']);assert.equal(context.busyReplies,undefined)
  await assert.rejects(exec(process.execPath,[bin,'context'],{env:{...env,EZ_RUN_ID:''}}),/active owner run/)
  const args=['create','test','--at','2027-09-09T09:00:00+04:00','--text','Literal $(do-not-execute) /goal objective']
  const saved=JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
@@ -59,13 +62,14 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
 
 test('executor PATH exposes the extensionless scheduler command',async()=>{
  const command=fileURLToPath(new URL('../bin/ezenciel-agents-schedule',import.meta.url))
- assert.match((await exec(command,['--help'])).stdout,/durable, asynchronous CLI task/)
+  assert.match((await exec(command,['--help'])).stdout,/Creates a scheduled task/)
 })
 
 
 test('deferred literal input retains owner-scoped conversation through source metadata',async t=>{
  const {Scheduler}=await import('../src/scheduler.js')
  const dir=await mkdtemp(join(tmpdir(),'ez-origin-context-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir)
  await control.requestPairing(101,101);await control.approveOwner(101)
  const execution=await control.captureChoice(initialPreset('codex'))
@@ -76,13 +80,14 @@ test('deferred literal input retains owner-scoped conversation through source me
  await new Scheduler(dir).save({id:'legacy-deferred',name:'Owner request',text:'Do the same for March',originRunId:'tg_2',owner:(await control.status()).owner!,execution,enabled:true,trigger:{at:new Date(Date.now()+1000).toISOString()}},true)
  await new Scheduler(dir).tick((await control.status()).owner!,runs,Date.now()+2000)
  const worker=(await runs.list()).find(r=>r.scheduled)!
- assert.deepEqual(worker.texts,['Do the same for March']);assert.equal(worker.scheduled?.originRunId,'tg_2')
+  assert.match(worker.texts[0],/^\[schedule legacy-deferred due .+\]$/);assert.equal(worker.texts[1],'Do the same for March');assert.equal(worker.scheduled?.originRunId,'tg_2')
  await runs.patch(worker.id,{status:'running'})
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:worker.id}
- const result=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
- assert.ok(result.origin.recent.some((r:any)=>r.texts==='Use the blue ledger'))
+  const result=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
+  assert.equal(result.run.texts[1],'Do the same for March')
+  assert.equal(result.origin.id,'tg_2')
  await runs.create({id:'other',chatId:999,telegramUserId:999,texts:['PRIVATE OTHER OWNER']})
- const {writeFile}=await import('node:fs/promises')
- await writeFile(join(dir,'runs',worker.id+'.json'),JSON.stringify({...worker,status:'running',scheduled:{...worker.scheduled,originRunId:'other'}}))
- await assert.rejects(exec(process.execPath,[bin,'context'],{env}),/outside this owner binding/)
+ const tampered=await runs.create({id:'tg_tampered',chatId:101,telegramUserId:101,texts:worker.texts,execution,scheduled:{...worker.scheduled!,originRunId:'other'}})
+ await runs.patch(tampered.id,{status:'running'})
+ await assert.rejects(exec(process.execPath,[bin,'context'],{env:{...env,EZ_RUN_ID:tampered.id}}),/outside this owner binding/)
 })

package/test/scheduled-tasks.test.ts

@@ -5,7 +5,8 @@ import { randomUUID } from 'node:crypto'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { Scheduler } from '../src/scheduler.js'
-import { scheduledTasksText } from '../src/scheduled-tasks.js'
+import { scheduledTaskDetailText, scheduledTasksText } from '../src/scheduled-tasks.js'
+import { RunStore } from '../src/runs.js'
 
 const owner = { telegramUserId: 101, telegramChatId: 101, pairedAt: '2026-09-11T00:00:00.000Z' }
 const execution = { sessionId: randomUUID(), preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } }
@@ -18,7 +19,7 @@ test('scheduled task view is read-only, owner-bound, and shows active task promp
   assert.deepEqual(await scheduler.listReadOnly(), [])
   await assert.rejects(access(join(dir, 'schedules')), /ENOENT/)
 
-  await scheduler.save({
+  const saved = await scheduler.save({
     id: 'owner-task', name: 'Daily report', text: 'Read the ledger and send the owner a concise report.', owner, execution, enabled: true,
     trigger: { cron: '0 9 * * 1-5', timezone: 'Asia/Dubai', start: '2026-01-01T00:00:00.000Z' },
   })
@@ -30,9 +31,17 @@ test('scheduled task view is read-only, owner-bound, and shows active task promp
   const scheduleDir = join(dir, 'schedules')
   const before = await readFile(join(scheduleDir, 'owner-task.json'), 'utf8')
   const entries = await readdir(scheduleDir)
-  const text = scheduledTasksText(await scheduler.listActiveReadOnly([]), owner)
+  const runs = new RunStore(dir)
+  const run = await runs.create({
+    id: 'owner-task-run', ownerId: 'telegram:101:101', ownerEpoch: owner.pairedAt, chatId: 101, telegramUserId: 101, texts: [],
+    scheduled: { id: saved.id, revision: saved.revision, dueAt: '2026-01-01T05:00:00.000Z', pairedAt: owner.pairedAt },
+  })
+  await runs.patch(run.id, { status: 'completed', endedAt: '2026-01-01T05:04:00.000Z' })
+  const active = await scheduler.listActiveReadOnly(await runs.list())
+  const text = scheduledTasksText(active, owner)
 
-  assert.equal(text, 'Active scheduled tasks\n\n• Daily report\n  codex · client default · default effort\n  Next: 2026-01-01 05:00:00 UTC\n  Read the ledger and send the owner a concise report.')
+  assert.equal(text, '📅 Scheduled tasks · 1 active\n\nAll times UTC. Use /tasks 1 for task details.\n\n1 · Daily report\n  ● Active\n  Next · Thu, Jan 1 · 05:00 UTC\n  Last · ✓ Completed · Thu, Jan 1 · 05:04 UTC\n  codex · client default · default effort\n  Read the ledger and send the owner a concise report.')
+  assert.match(scheduledTaskDetailText(active.find(schedule => schedule.id === saved.id)!, 1), /Last run\n✓ Completed · Thu, Jan 1 · 05:04 UTC/)
   assert.doesNotMatch(text, /Other owner task|This must never be visible/)
   assert.equal(await readFile(join(scheduleDir, 'owner-task.json'), 'utf8'), before)
   assert.deepEqual(await readdir(scheduleDir), entries)
@@ -42,7 +51,6 @@ test('active view follows existing cursor and run state without changing schedul
   const dir = await mkdtemp(join(tmpdir(),'ez-active-schedules-'))
   t.after(()=>rm(dir,{recursive:true,force:true}))
   const scheduler = new Scheduler(dir)
-  const { RunStore } = await import('../src/runs.js')
   const runs = new RunStore(dir)
   const due = Date.now()+60_000
   const common = {text:'/goal List files.',owner,execution,enabled:true}
@@ -88,7 +96,7 @@ test('prompt preview is one bounded Unicode sentence and preserves stored input'
     enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}})
   const output=scheduledTasksText(await scheduler.listActiveReadOnly([]),owner)
   assert.match(output,/gpt-5.6-terra · high/)
-  assert.match(output,/Next: 2027-01-01 00:00:00 UTC/)
+  assert.match(output,/Next · Fri, Jan 1 · 00:00 UTC/)
   assert.equal(Array.from(output.split('\n').at(-1)!.trim()).length,140)
   assert.ok(output.endsWith('…'))
   assert.doesNotMatch(output,/Do not display/)
@@ -112,3 +120,18 @@ test('a legacy invalid selection does not prevent the active menu from rendering
   const active = await scheduler.listActiveReadOnly([])
   assert.match(scheduledTasksText(active,owner),/codex · gpt-5.6-terra · max/)
 })
+
+test('detail view truncates long instructions and tolerates invalid timestamps', async t => {
+  const dir = await mkdtemp(join(tmpdir(),'ez-schedule-detail-bounds-'))
+  t.after(()=>rm(dir,{recursive:true,force:true}))
+  const scheduler = new Scheduler(dir)
+  const saved = await scheduler.save({id:'long',name:'Long task',text:'/goal '+'x'.repeat(5000),owner,
+    execution,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}})
+  const active = await scheduler.listActiveReadOnly([])
+  const detail = scheduledTaskDetailText(active.find(schedule => schedule.id === saved.id)!,1,1)
+  assert.match(detail,/📅 1 of 1 · Long task/)
+  assert.match(detail,/truncated; full text lives in the workspace/)
+  assert.ok(detail.length < 3000)
+  const broken = {...active.find(schedule => schedule.id === saved.id)!,nextAt:'not-a-date',lastRun:{status:'completed',at:'also-bad',currentRevision:true}} as never
+  assert.doesNotMatch(scheduledTaskDetailText(broken,1,1),/NaN/)
+})

package/test/scheduler-host.test.ts

@@ -10,6 +10,7 @@ import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { RunStore } from '../src/runs.js'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<250;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Host probe timed out')}
+const stdout=(events:string) => events.trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)).filter(event=>event.stream==='stdout').map(event=>event.text).join('')
 test('host transport reserves separate task and main lanes, pins directories, and cancels only its target',async()=>{
  const root=await mkdtemp(join(tmpdir(),'ez-scheduler-host-')),workspace=join(root,'agent'),controlDir=join(root,'control')
  await mkdir(workspace);await mkdir(controlDir)
@@ -32,12 +33,11 @@ test('host transport reserves separate task and main lanes, pins directories, an
   await submit('tg_1')
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
-  const scheduled=JSON.parse(JSON.parse((await exists(id+'.events')).trim().split('\n')[0]).text)
-  const main=JSON.parse(JSON.parse((await exists('tg_1.events')).trim().split('\n')[0]).text)
-  assert.equal(scheduled.cwd,await realpath(join(workspace,'work/tasks',id)));assert.equal(main.cwd,await realpath(workspace))
+  const scheduled=JSON.parse(stdout(await exists(id+'.events')))
+  const main=JSON.parse(stdout(await exists('tg_1.events')))
+  assert.equal(scheduled.cwd,await realpath(join(controlDir,'work/tasks',id)));assert.equal(main.cwd,await realpath(workspace))
   assert.equal(scheduled.token,undefined);assert.equal(main.token,undefined)
-  // A malformed scheduled request must not unwind the shared host service.
-  await writeFile(join(controlDir,'runs/r_schedule_corrupt.json'),'{')
+  // An unknown scheduled run must not unwind the shared host service.
   await submit('r_schedule_corrupt')
   await until(async()=>(await exists('r_schedule_corrupt.events')).includes('"stream":"exit","code":1'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))

package/test/scheduler-relay.test.ts

@@ -11,16 +11,18 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { Scheduler } from '../src/scheduler.js'
 import { initialPreset } from '../src/ai.js'
-import { randomUUID } from 'node:crypto'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let i=0;i<200;i++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
 
-test('maintenance wakeups use an independent ephemeral session after a relay restart',async()=>{
- const dir=await mkdtemp(join(tmpdir(),'ez-maintenance-session-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
- let launchSession='',onSessionCalls=0
+// Adversarial: the relay must not reserve wrapper semantics for an
+// update-shaped run id or a stale attention notice.
+test('a wrapper-shaped run id has no maintenance treatment and a stale notice is inert',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-no-maintenance-session-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ let launchSession='',onSessionCalls=0,launches=0
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(_texts,options)=>{
+  launches++
   launchSession=options.sessionId ?? ''
-  if(options.onSession){onSessionCalls++;await options.onSession('native-maintenance')}
+  if(options.onSession){onSessionCalls++;await options.onSession('native-review')}
   const child=spawn(process.execPath,['-e','setTimeout(()=>{},10)'],{detached:process.platform!=='win32'})
   await once(child,'spawn')
   return {child,cleanup:async()=>{},stdout:''}
@@ -29,13 +31,17 @@ test('maintenance wakeups use an independent ephemeral session after a relay res
  relay.bot.api.config.use(async()=>({ok:true,result:{message_id:42}}) as never)
  try{
   await control.requestPairing(101,101);await control.approveOwner(101)
-  const execution={sessionId:randomUUID(),preset:initialPreset('codex')}
+  const execution=await control.captureChoice(initialPreset('codex'))
   await runs.create({id:'r_update_fixture',chatId:101,telegramUserId:101,texts:['maintenance'],execution})
   await relay.drainSources()
   await until(async()=> (await runs.get('r_update_fixture'))?.status==='completed')
-  assert.notEqual(launchSession,execution.sessionId)
-  assert.equal(onSessionCalls,0)
-}finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
+  assert.equal(launchSession,execution.sessionId)
+  assert.equal(onSessionCalls,1)
+  await writeFile(join(dir,'update-attention.json'),JSON.stringify({id:'a'.repeat(64)}))
+  await relay.drainSources()
+  assert.equal(launches,1)
+  assert.equal((await runs.list()).length,1)
+ }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
 test('chat replies through the real ingress/outbox while scheduled CLI remains alive; targeted cancellation',async()=>{

package/test/scheduler.test.ts

@@ -78,10 +78,10 @@ test('pause, edit, removal, owner revocation, corrupt records and traversal fail
 })
 test('task workspaces are distinct and cannot escape through symlinks',async t=>{
  const f=await fixture(t)
- await writeFile(join(f.dir,'SOUL.md'),'Owner context')
+ await writeFile(join(f.dir,'private.md'),'Owner context')
  const first=await taskWorkspace(f.dir,'r_one'),second=await taskWorkspace(f.dir,'r_two')
  assert.notEqual(first,second)
- await assert.rejects(readFile(join(first,'SOUL.md'),'utf8'),{code:'ENOENT'})
+ await assert.rejects(readFile(join(first,'private.md'),'utf8'),{code:'ENOENT'})
  await assert.rejects(readFile(join(first,'AGENTS.md'),'utf8'),{code:'ENOENT'})
  await assert.rejects(taskWorkspace(f.dir,'../escape'))
  const other=join(f.dir,'other');await mkdir(other)

package/test/security.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, symlink, mkdir } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, symlink, mkdir, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { isOwner } from '../src/identity.js'
@@ -26,7 +26,7 @@ test('owner gate denies groups, bots, missing identity, and a different sender o
   assert.equal(isOwner({ from, chat }, null), false)
 })
 
-test('store identifiers reject traversal; corrupt records cannot authorize or block healthy runs', async () => {
+test('store identifiers reject traversal; corrupt control state fails closed and the ledger writes nothing', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-negative-'))
   try {
     const runs = new RunStore(dir)
@@ -34,8 +34,11 @@ test('store identifiers reject traversal; corrupt records cannot authorize or bl
     await assert.rejects(runs.claimOutbox('../control-state'), /Invalid/)
     await assert.rejects(new ApprovalStore(dir).getDecision('../escape'), /Invalid/)
     const run = await runs.create({ chatId: 101, telegramUserId: 101, texts: ['test'] })
-    await writeFile(join(dir, 'runs', 'broken.json'), '{')
     assert.equal((await runs.nextQueued())?.id, run.id)
+    // Run/outbox/inbox bookkeeping is memory-only: no control/ files exist to corrupt.
+    await assert.rejects(stat(join(dir, 'runs')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'outbox')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'inbox.json')), { code: 'ENOENT' })
     await writeFile(join(dir, 'control-state.json'), '{')
     await assert.rejects(new ControlStore(dir, 1000).status())
   } finally {

package/test/software-status.test.ts

@@ -4,7 +4,13 @@ import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { installedPluginVersions, softwareStatus } from '../src/software-status.js'
-import { packageVersion } from '../src/version.js'
+import { formatRelayLabel, packageVersion } from '../src/version.js'
+
+test('relay label shows the running RC tag first', () => {
+  assert.equal(formatRelayLabel('0.1.0-beta.35', 'rc2', 'abc123def4567890'), 'rc2 (v0.1.0-beta.35 · abc123def456)')
+  assert.equal(formatRelayLabel('0.1.0-beta.35', 'rc2'), 'rc2 (v0.1.0-beta.35)')
+  assert.equal(formatRelayLabel('1.0.0'), 'v1.0.0')
+})
 
 test('Telegram software status uses loaded version and only fresh host plugin metadata', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-software-status-'))
@@ -14,9 +20,10 @@ test('Telegram software status uses loaded version and only fresh host plugin me
   const plugins=await installedPluginVersions(root)
   assert.deepEqual(plugins,[{id:'whatsapp',version:'0.1.0-beta.3'}])
   const heartbeat=path.join(root,'host-executor/heartbeat.json')
-  await writeFile(heartbeat,JSON.stringify({at:Date.now(),version:'0.1.0-beta.4',plugins}))
-  const lines=await softwareStatus(root)
+  await writeFile(heartbeat,JSON.stringify({at:Date.now(),version:'0.1.0-beta.4',platform:'darwin',arch:'arm64',plugins}))
+  const lines=await softwareStatus(root,'host-capable')
   assert.equal(lines[0],`Relay: running · v${packageVersion}`)
+  assert(lines.includes('Env: mac (darwin/arm64) · host-capable · host'))
   assert(lines.includes('Host transport: running · v0.1.0-beta.4'))
   assert(lines.includes('Plugins: whatsapp 0.1.0-beta.3'))
   assert(!JSON.stringify(lines).includes('/private'))
@@ -28,4 +35,15 @@ test('Telegram software status uses loaded version and only fresh host plugin me
   assert((await softwareStatus(root)).includes('Host transport: running · version unknown'))
   await writeFile(path.join(root,'registry.json'),'broken')
   assert.equal(await installedPluginVersions(root),null)
+  await rm(heartbeat)
+  assert((await softwareStatus(root)).includes('Host transport: unavailable'))
+  assert((await softwareStatus(root)).includes('Plugins: unknown'))
+  assert((await softwareStatus(root)).some(l => l.startsWith('Env:') && l.includes('unknown · unknown')))
+  assert((await softwareStatus(root,'isolated')).includes('Host transport: n/a · isolated execution'))
+  assert((await softwareStatus(root,'isolated')).some(l => l.startsWith('Env:') && l.includes('isolated · local')))
+  assert((await softwareStatus(root,'isolated')).includes('Plugins: isolated broker · versions via `ez tools list`'))
+  await writeFile(path.join(root,'plugin-broker-plugins.json'),JSON.stringify({version:1,at:new Date().toISOString(),plugins:[{id:'voice',version:'0.2.0'}]}))
+  assert((await softwareStatus(root,'isolated')).includes('Plugins: voice 0.2.0'))
+  await writeFile(path.join(root,'plugin-broker-plugins.json'),'broken')
+  assert((await softwareStatus(root,'isolated')).includes('Plugins: isolated broker · versions via `ez tools list`'))
 })

package/test/telegram-provisioning.test.ts

@@ -0,0 +1,160 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { provisionTelegramBot } from '../src/telegram-provisioning.js'
+
+const token = '123456:abcdefghijklmnopqrstuvwxyz_ABCDEFGHIJKLMN'
+
+const fixture = async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-telegram-provisioning-'))
+  const composeFile = path.join(root, 'compose.yml')
+  const configFile = path.join(root, 'telegram-provisioning.json')
+  const relayEnvFile = path.join(root, 'secrets', 'relay.env')
+  const overrideFile = path.join(root, 'telegram.compose.yml')
+  const deploymentEnvFile = path.join(root, 'docker.env')
+  await writeFile(composeFile, 'services: {}\n')
+  await writeFile(deploymentEnvFile, "EZ_RELAY_IMAGE='ezenciel-agents:0.1.0-beta.36.rc.4'\n", { mode: 0o600 })
+  await writeFile(configFile, JSON.stringify({
+    version: 1,
+    composeFile,
+    projectDirectory: root,
+    projectName: 'tenant-aifit',
+    service: 'relay',
+    relayEnvFile,
+    overrideFile,
+  }), { mode: 0o600 })
+  return { root, composeFile, configFile, relayEnvFile, overrideFile, deploymentEnvFile }
+}
+
+test('Telegram provisioning writes only a private relay secret and restarts the exact relay', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await import('node:fs/promises').then(({ rm }) => rm(value.root, { recursive: true, force: true })) })
+  const calls: string[][] = []
+  const environments: NodeJS.ProcessEnv[] = []
+  const priorImage = process.env.EZ_RELAY_IMAGE
+  process.env.EZ_RELAY_IMAGE = 'stale:shell-export'
+  try {
+    await provisionTelegramBot(value.configFile, token, async (args, environment) => { calls.push(args); environments.push(environment) })
+  } finally {
+    if (priorImage === undefined) delete process.env.EZ_RELAY_IMAGE; else process.env.EZ_RELAY_IMAGE = priorImage
+  }
+
+  // The deployment's docker.env is the only source for its runtime values:
+  // shell exports never override the installed image or mounts.
+  assert.equal('EZ_RELAY_IMAGE' in environments[0], false)
+  assert.equal('TELEGRAM_BOT_TOKEN' in environments[0], false)
+  assert.equal(environments[0].PATH, process.env.PATH)
+  assert.equal(await readFile(value.relayEnvFile, 'utf8'), `TELEGRAM_BOT_TOKEN=${token}\n`)
+  assert.equal((await stat(value.relayEnvFile)).mode & 0o777, 0o600)
+  const override = await readFile(value.overrideFile, 'utf8')
+  // The installed deployment supplies the relay image; the override never sets one.
+  assert.ok(!override.includes('image:'))
+  assert.match(override, /relay_env/)
+  assert.match(override, /EZ_TELEGRAM_ENABLED: "true"/)
+  assert.ok(!override.includes(token))
+  assert.equal((await stat(value.overrideFile)).mode & 0o777, 0o600)
+  assert.deepEqual(calls, [[
+    '--project-directory', value.root,
+    '--project-name', 'tenant-aifit',
+    '--env-file', value.deploymentEnvFile,
+    '-f', value.composeFile,
+    '-f', value.overrideFile,
+    'up', '-d', '--wait', 'relay',
+  ]])
+})
+
+test('provisioning rejects a self-set image and custom deployments without a Docker env file still start', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await rm(value.root, { recursive: true, force: true }) })
+  const configured = JSON.parse(await readFile(value.configFile, 'utf8'))
+  await writeFile(value.configFile, JSON.stringify({ ...configured, image: 'eizenciel-agents:0.1.0-beta.36.rc.3' }))
+  await assert.rejects(provisionTelegramBot(value.configFile, token, async () => {}), /Invalid Telegram provisioning configuration/)
+  await writeFile(value.configFile, JSON.stringify(configured))
+  await rm(value.deploymentEnvFile)
+  const calls: string[][] = []
+  await provisionTelegramBot(value.configFile, token, async (args) => { calls.push(args) })
+  assert.ok(!calls[0].includes('--env-file'))
+})
+
+test('provisioning fails closed when the deployment docker.env has no installed image', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await rm(value.root, { recursive: true, force: true }) })
+  await writeFile(value.deploymentEnvFile, "EZ_AGENT_WORKSPACE='/private/agents/tenant/mind'\n", { mode: 0o600 })
+  await assert.rejects(provisionTelegramBot(value.configFile, token, async () => {}), /must define EZ_RELAY_IMAGE/)
+  await assert.rejects(readFile(value.relayEnvFile, 'utf8'), { code: 'ENOENT' })
+})
+
+test('Telegram provisioning restores the botless relay when startup fails', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await import('node:fs/promises').then(({ rm }) => rm(value.root, { recursive: true, force: true })) })
+  const calls: string[][] = []
+  await assert.rejects(
+    provisionTelegramBot(value.configFile, token, async (args) => {
+      calls.push(args)
+      if (calls.length === 1) throw new Error('Bot rejected')
+    }),
+    /Bot rejected/,
+  )
+  await assert.rejects(readFile(value.relayEnvFile, 'utf8'), { code: 'ENOENT' })
+  await assert.rejects(readFile(value.overrideFile, 'utf8'), { code: 'ENOENT' })
+  assert.equal(calls.length, 2)
+  assert.ok(!calls[1].includes(value.overrideFile))
+})
+
+test('Telegram provisioning rejects invalid tokens and configs before touching the deployment', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await import('node:fs/promises').then(({ rm }) => rm(value.root, { recursive: true, force: true })) })
+  await assert.rejects(provisionTelegramBot(value.configFile, 'not-a-token', async () => {}), /Invalid Telegram bot token/)
+  await assert.rejects(provisionTelegramBot(value.configFile, `${'1'.repeat(600)}:x`, async () => {}), /Invalid Telegram bot token/)
+  await assert.rejects(readFile(value.relayEnvFile, 'utf8'), { code: 'ENOENT' })
+  await writeFile(value.configFile, JSON.stringify({ version: 1 }))
+  await assert.rejects(provisionTelegramBot(value.configFile, token, async () => {}), /Invalid Telegram provisioning configuration/)
+})
+
+test('Telegram rotation failure restores both files and restarts with the previous override', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await import('node:fs/promises').then(({ rm }) => rm(value.root, { recursive: true, force: true })) })
+  const { mkdir } = await import('node:fs/promises')
+  await mkdir(path.dirname(value.relayEnvFile), { recursive: true })
+  await writeFile(value.relayEnvFile, 'TELEGRAM_BOT_TOKEN=111111:old-old-old-old-old-old-old-old\n', { mode: 0o600 })
+  await writeFile(value.overrideFile, 'previous-override\n')
+  const calls: string[][] = []
+  await assert.rejects(
+    provisionTelegramBot(value.configFile, token, async (args) => {
+      calls.push(args)
+      if (calls.length === 1) throw new Error('Bot rejected rotation')
+    }),
+    /Bot rejected rotation/,
+  )
+  assert.equal(await readFile(value.relayEnvFile, 'utf8'), 'TELEGRAM_BOT_TOKEN=111111:old-old-old-old-old-old-old-old\n')
+  assert.equal(await readFile(value.overrideFile, 'utf8'), 'previous-override\n')
+  assert.equal(calls.length, 2)
+  assert.ok(calls[1].includes(value.overrideFile))
+})
+
+test('Telegram provisioning refuses a live lock but recovers a stale one', async (t) => {
+  const value = await fixture()
+  t.after(async () => { await import('node:fs/promises').then(({ rm }) => rm(value.root, { recursive: true, force: true })) })
+  const calls: string[][] = []
+  await writeFile(path.join(value.root, 'telegram-provisioning.lock'), JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }))
+  await assert.rejects(provisionTelegramBot(value.configFile, token, async (args) => { calls.push(args) }), /already in progress/)
+  assert.equal(calls.length, 0)
+  await writeFile(path.join(value.root, 'telegram-provisioning.lock'), JSON.stringify({ pid: 2147483647, startedAt: '2020-01-01T00:00:00.000Z' }))
+  await provisionTelegramBot(value.configFile, token, async (args) => { calls.push(args) })
+  assert.equal(calls.length, 1)
+})
+
+test('Telegram provisioning CLI rejects TTY input and oversized stdin', async () => {
+  const { runTelegramProvisioningCli } = await import('../src/telegram-provisioning-cli.js')
+  await assert.rejects(runTelegramProvisioningCli(['--config', 'x'], { isTTY: true } as never), /stdin/)
+  let destroyed = false
+  const oversized = {
+    isTTY: false,
+    destroy() { destroyed = true },
+    async *[Symbol.asyncIterator]() { yield 'x'.repeat(600) },
+  }
+  await assert.rejects(runTelegramProvisioningCli(['--config', 'x'], oversized as never), /too long/)
+  assert.equal(destroyed, true)
+})