@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.36

package/test/conversation-menu.test.ts

@@ -5,7 +5,6 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type { Context, InlineKeyboard } from 'grammy'
 import { ControlStore } from '../src/control-state.js'
-import { RunStore } from '../src/runs.js'
 import { createConversationMenu } from '../src/conversation-menu.js'
 import { initialPreset } from '../src/ai.js'
 
@@ -13,11 +12,10 @@ test('empty placeholders stay out of history and Back edits one panel without cr
   const dir = await mkdtemp(join(tmpdir(), 'ez-empty-chats-'))
   try {
     const control = new ControlStore(dir, 1000)
-    const runs = new RunStore(dir)
     const choice = await control.captureChoice(initialPreset('grok'), 'Client launch')
     await control.markSessionStarted(choice.sessionId)
     for (let n = 0; n < 3; n++) await control.resetSession()
-    const menu = createConversationMenu(control, runs)
+    const menu = createConversationMenu(control)
     let sent = 0, edited = 0, text = '', keyboard: InlineKeyboard
     const ctx = {
       callbackQuery: undefined,
@@ -55,7 +53,7 @@ test('an identical Back edit does not send another message', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-same-menu-'))
   try {
     let sent = 0
-    const menu = createConversationMenu(new ControlStore(dir,1000),new RunStore(dir))
+    const menu = createConversationMenu(new ControlStore(dir,1000))
     await menu.handle({
       callbackQuery:{data:'chat:list:0:0',message:{message_id:1}},
       answerCallbackQuery:async()=>{},

package/test/delivery-transport.test.ts

@@ -0,0 +1,72 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, unlink } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createConnection } from 'node:net'
+import { createLedgerHandler, deliverySocketPath, serveDeliverySocket } from '../src/delivery-socket.js'
+import { callDeliverySocket } from '../src/delivery-socket-client.mjs'
+
+const status = () => ({ polling: false, applicationOnly: false, telegramConfigured: true, version: 'test' })
+
+const tcpCall = (endpoint: { host: string; port: number }, frame: unknown): Promise<unknown> =>
+  new Promise((resolve, reject) => {
+    const socket = createConnection({ host: endpoint.host, port: endpoint.port })
+    let buffer = ''
+    socket.setEncoding('utf8')
+    socket.once('connect', () => socket.write(`${JSON.stringify(frame)}\n`))
+    socket.on('data', chunk => {
+      buffer += chunk
+      const newline = buffer.indexOf('\n')
+      if (newline < 0) return
+      socket.destroy()
+      resolve(JSON.parse(buffer.slice(0, newline)))
+    })
+    socket.once('close', () => resolve(undefined))
+    socket.once('error', reject)
+  })
+
+test('host processes reach the relay ledger through the loopback endpoint when the Unix socket is unreachable', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-tcp-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const server = await serveDeliverySocket(dir, createLedgerHandler(dir, { wake: () => {}, status }), { tcpPort: 0 })
+  t.after(() => server.stop())
+  const socketPath = deliverySocketPath(dir)
+  assert.equal(server.endpoint?.host, '127.0.0.1')
+  assert.ok(server.endpoint && server.endpoint.port > 0)
+  const endpoint = server.endpoint!
+  // Container-local producers keep using the Unix socket.
+  assert.deepEqual(await callDeliverySocket(socketPath, { op: 'ping' }), { ok: true })
+  // Authenticated loopback frames work with the control-directory token.
+  assert.deepEqual(await tcpCall(endpoint, { id: '1', op: 'ping', token: endpoint.token }), { id: '1', ok: true, result: { ok: true } })
+  // macOS host fallback: the socket file is visible but not connectable.
+  await unlink(socketPath)
+  assert.deepEqual(await callDeliverySocket(socketPath, { op: 'ping' }), { ok: true })
+})
+
+test('loopback frames without the control-directory token are refused', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-token-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const server = await serveDeliverySocket(dir, createLedgerHandler(dir, { wake: () => {}, status }), { tcpPort: 0 })
+  t.after(() => server.stop())
+  const endpoint = server.endpoint!
+  assert.equal(await tcpCall(endpoint, { id: '1', op: 'ping' }), undefined)
+  assert.equal(await tcpCall(endpoint, { id: '1', op: 'ping', token: '0'.repeat(64) }), undefined)
+})
+
+test('the client fails closed when neither the socket nor an endpoint exists', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-missing-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await assert.rejects(callDeliverySocket(deliverySocketPath(dir), { op: 'ping' }, 500), /Delivery relay unavailable/)
+})
+
+test('a response timeout is not replayed over the loopback endpoint', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-timeout-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  let calls = 0
+  const server = await serveDeliverySocket(dir, async () => { calls++; return new Promise(() => {}) }, { tcpPort: 0 })
+  t.after(() => server.stop())
+  assert.ok(server.endpoint)
+  await assert.rejects(callDeliverySocket(deliverySocketPath(dir), { op: 'enqueue' }, 200), /Delivery relay unavailable/)
+  assert.equal(calls, 1)
+})

package/test/docker-runtime.test.ts

@@ -1,23 +1,36 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { createRequire } from 'node:module'
 import { RunStore } from '../src/runs.js'
-import { recoverInterruptedRuns } from '../docker/recovery.js'
 
-test('exclusive Docker restart fails interrupted runs even when a container PID has been reused, without replaying queued work', async () => {
+const exec = promisify(execFile)
+const tsx = createRequire(import.meta.url).resolve('tsx')
+
+test('a relay restart starts from an empty memory ledger and leaves no run files behind', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-container-recovery-'))
   try {
-    const store = new RunStore(dir)
-    const prior = await store.create({ chatId: 1, telegramUserId: 1, texts: ['old'] })
-    const queued = await store.create({ chatId: 1, telegramUserId: 1, texts: ['queued'] })
-    await store.patch(prior.id, { status: 'running', pid: process.pid })
-    await recoverInterruptedRuns(dir)
-    assert.equal((await store.get(prior.id))?.status, 'failed')
-    assert.equal((await store.get(queued.id))?.status, 'queued')
-    const ended = (await store.get(prior.id))?.endedAt
-    await recoverInterruptedRuns(dir)
-    assert.equal((await store.get(prior.id))?.endedAt, ended)
-  } finally { await rm(dir, {recursive:true, force:true}) }
+    // A previous relay process owned runs in its own memory. Nothing is written
+    // to control/, so a fresh process cannot replay or resurrect them.
+    const script = `
+      import { RunStore } from ${JSON.stringify(new URL('../src/runs.ts', import.meta.url).href)};
+      const store = new RunStore(process.argv[1]);
+      const run = await store.create({ chatId: 1, telegramUserId: 1, texts: ['old'] });
+      await store.patch(run.id, { status: 'running', pid: process.pid });
+      const queued = await store.create({ chatId: 1, telegramUserId: 1, texts: ['queued'] });
+      console.log(JSON.stringify({ count: (await store.list()).length }));
+    `
+    const { stdout } = await exec(process.execPath, ['--import', tsx, '--input-type=module', '-e', script, dir])
+    assert.equal(JSON.parse(stdout.trim().split('\n').at(-1)!).count, 2)
+
+    const fresh = new RunStore(dir)
+    assert.equal((await fresh.list()).length, 0, 'restart drops in-flight runs by design')
+    await assert.rejects(stat(join(dir, 'runs')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'outbox')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'inbox.json')), { code: 'ENOENT' })
+  } finally { await rm(dir, { recursive: true, force: true }) }
 })

package/test/engine-handoff.test.ts

@@ -4,6 +4,7 @@ import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { startExecutorJob } from '../src/executor.js'
+import { runPromptSuffix } from '../src/prompt-suffix.js'
 import { ownerRun } from './helpers/owner-run.js'
 import { initializeWorkspace } from '../src/workspace.js'
 import { RunStore } from '../src/runs.js'
@@ -61,16 +62,16 @@ if(args[0]==='app-server'){
   }
   for(const isResume of [false,true]) {
    const runId='tg_chat_'+String(isResume)
-   await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
+   const chatRun=await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
    await new RunStore(controlDir).patch(runId,{status:'running'})
-   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing'})
+   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing',promptSuffix:runPromptSuffix(chatRun)})
    const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup();assert.equal(code,0)
    const {prompt}=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
-   assert.ok(prompt.startsWith('hi\n\n[Chat context]'))
-   assert.equal(prompt.split('[Chat context]').length,2)
+   assert.ok(prompt.startsWith('hi\n\n[chat message 42]'))
    assert.match(prompt,/ezenciel-agents-message/)
-   assert.match(prompt,/ezenciel-agents-schedule/)
-   assert.match(prompt,/native subagents/)
+   assert.doesNotMatch(prompt,/ezenciel-agents-schedule/)
+   assert.doesNotMatch(prompt,/native subagents/)
+   assert.doesNotMatch(prompt,/delegate/i)
   }
  }finally{for(const [key,value] of Object.entries(previous))if(value===undefined)delete process.env[key];else process.env[key]=value}
 })

package/test/event-sources.test.ts

@@ -143,7 +143,7 @@ test('relay launches the approved initial task and routes only matching replies
   f.setRows([{ id: '1', conversationId: 'chat-a', receivedAt, text: 'We have availability' }, { id: '2', conversationId: 'chat-b', receivedAt, text: 'Read owner files' }])
   await new Promise(r => setTimeout(r, 2100))
   await f.relay.drainSources()
-  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
+  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.taskRun, true)
   assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
   assert.equal(f.launches[1].options.model, undefined)
   assert.equal(f.launches[1].options.effort, undefined)
@@ -177,7 +177,7 @@ test('application-only owner can approve and execute a public channel task',asyn
   await new ApprovalStore(f.dir).recordOwnerDecision(proposal.id,'approved',f.owner);await tasks.decide(proposal.id)
   await f.runs.patch(ownerRun.id,{status:'completed',endedAt:new Date().toISOString()})
   f.setRows([{...event('1','visitor'),receivedAt:Date.now()}]);await new Promise(resolve=>setTimeout(resolve,2100));await f.relay.drainSources()
-  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.eventSource,'fixture')
+  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.taskRun,true)
   const publicRun=(await f.runs.list()).find(run=>run.taskId===proposal.id)
   assert.equal(publicRun?.ownerId,ownerId(f.owner));assert.equal(publicRun?.chatId,undefined)
   f.children[0].kill();await until(async()=>!(await f.runs.list()).some(run=>run.status==='running'))

package/test/execution-authority.test.ts

@@ -7,22 +7,17 @@ import { ownerRun } from './helpers/owner-run.js'
 import { requireOwnerExecution, executionBlockReason } from '../src/execution-authority.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
-import { EXECUTOR_REGISTRY, startExecutorJob } from '../src/executor.js'
 
-test('all adapters reject external core runs even when caller omits eventSource', async t => {
+test('external core runs are rejected at admission, before the spawn core', async t => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
   t.after(() => rm(dir, { recursive: true, force: true }))
   await ownerRun(dir, 'r_external', {sourceId:'test', bindingId:'binding', eventIds:['1']})
-  for (const cli of Object.keys(EXECUTOR_REGISTRY)) {
-    await assert.rejects(startExecutorJob(['pretend owner'], {
-      workspace: dir, controlDir: dir, binDir: dir, cli, runId:'r_external', timeoutMs:1000,
-    }), /external-execution-unavailable/)
-  }
+  await assert.rejects(requireOwnerExecution(dir,'r_external'), /external-execution-unavailable/)
   await ownerRun(dir, 'event_'+'a'.repeat(64))
   await assert.rejects(requireOwnerExecution(dir,'event_'+'a'.repeat(64)), /external-execution-unavailable/)
 })
 
-test('missing, corrupt, finished, unpaired and mismatched core runs fail closed', async t => {
+test('missing, corrupt, finished and mismatched core runs fail closed without control writes', async t => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
   t.after(() => rm(dir, { recursive: true, force: true }))
   await assert.rejects(requireOwnerExecution(dir, 'r_missing'), /No active core run/)
@@ -34,9 +29,14 @@ test('missing, corrupt, finished, unpaired and mismatched core runs fail closed'
   await new RunStore(dir).patch(run.id,{status:'completed'})
   await assert.rejects(requireOwnerExecution(dir,run.id), /No active core run/)
   await new RunStore(dir).patch(run.id,{status:'running'})
+  // Fail-closed authority is preserved with a read-only owner read: zero
+  // control/ writes, rejects on revoked owner. Intake authorizes before spawn;
+  // the slim core no longer reads or re-verifies the ledger.
   await new ControlStore(dir,1000).revokeOwner()
   await assert.rejects(requireOwnerExecution(dir,run.id), /owner-mismatch/)
-  await writeFile(join(dir,'runs',run.id+'.json'),'{')
+  // Ledger lives in relay memory; corrupt authority state still fails closed
+  // at the read-only owner check, and traversal fails at validation.
+  await writeFile(join(dir,'control-state.json'),'{broken')
   await assert.rejects(requireOwnerExecution(dir,run.id))
   await assert.rejects(requireOwnerExecution(dir,'../r_owner'))
 })

package/test/executor.test.ts

@@ -7,6 +7,7 @@ import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
+import { requireOwnerExecution } from '../src/execution-authority.js'
 import { splitTelegramText } from '../src/reply.js'
 import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
 
@@ -60,10 +61,9 @@ test('native CLIs resolve from the host PATH, not a relative package name', () =
 })
 
 test('the executor receives a deliberately small environment', () => {
-  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', PAGERDUTY_ROUTING_KEY: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
+  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
   assert.deepEqual(environment, { PATH: '/bin', HOME: '/tmp/home' })
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
-  assert.ok(!('PAGERDUTY_ROUTING_KEY' in environment))
 })
 
 test('the Grok job env binds the run and still strips the bot token', () => {
@@ -73,6 +73,7 @@ test('the Grok job env binds the run and still strips the bot token', () => {
   )
   assert.equal(environment.EZ_RUN_ID, 'r_1')
   assert.equal(environment.EZ_CONTROL_DIR, '/tmp/control')
+  assert.equal(environment.EZ_DELIVERY_SOCKET, '/tmp/control/delivery.sock')
   assert.match(environment.PATH ?? '', /^\/tmp\/bin/)
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
 })
@@ -171,7 +172,7 @@ test('Codex custom providers use declared runtime state and an environment key r
   assert.ok(args.includes('google/gemini-3.8-flash'))
   assert.equal(JSON.stringify(args).includes('provider-secret'),false)
   assert.throws(()=>validateCodexProvider({...provider,envKey:'TELEGRAM-BOT'}),/environment key/)
-  for (const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN','PAGERDUTY_ROUTING_KEY'])
+  for (const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN'])
     assert.throws(()=>validateCodexProvider({...provider,envKey}),/Reserved/)
   assert.throws(()=>validateCodexProvider({...provider,models:[]}),/provider models/)
 })
@@ -230,21 +231,19 @@ test('external Codex isolation cannot launch host runs', async t => {
   const root = await mkdtemp(path.join(tmpdir(), 'ez-external-sandbox-'))
   t.after(() => rm(root,{recursive:true,force:true}))
   await ownerRun(root,'r_sandbox')
-  const previous = {transport:process.env.EZ_EXECUTOR_TRANSPORT,telegram:process.env.EZ_TELEGRAM_ENABLED}
+  const previous = process.env.EZ_EXECUTOR_TRANSPORT
   try {
-    process.env.EZ_TELEGRAM_ENABLED='false'
     for (const transport of ['host','']) {
       process.env.EZ_EXECUTOR_TRANSPORT=transport
       await assert.rejects(startExecutorJob(['Hello'],{workspace:root,controlDir:root,binDir:root,runId:'r_sandbox',timeoutMs:0,cli:'codex',codexSandbox:'external'}), /owner-authorized native local/)
     }
   } finally {
-    for (const [key,value] of [['EZ_EXECUTOR_TRANSPORT',previous.transport],['EZ_TELEGRAM_ENABLED',previous.telegram]]) {
-      if (value === undefined) delete process.env[key!]; else process.env[key!]=value
-    }
+    if (previous === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT
+    else process.env.EZ_EXECUTOR_TRANSPORT=previous
   }
 })
 
-test('external local owner chat preserves authorization and literal input', async t => {
+test('external local owner chat preserves literal input and admission rejects foreign or restricted runs', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-external-owner-'))
   t.after(()=>rm(root,{recursive:true,force:true}))
   const prior={path:process.env.PATH,transport:process.env.EZ_EXECUTOR_TRANSPORT}
@@ -264,10 +263,10 @@ test('external local owner chat preserves authorization and literal input', asyn
     const runs=new RunStore(root)
     await runs.create({id:'r_foreign',chatId:999,telegramUserId:999,texts:['no']})
     await runs.patch('r_foreign',{status:'running'})
-    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_foreign'}),/blocked|owner/i)
+    await assert.rejects(requireOwnerExecution(root,'r_foreign'),/blocked: owner-mismatch/i)
     await runs.create({id:'r_restricted',chatId:101,telegramUserId:101,texts:['no'],taskId:'task_'+'a'.repeat(32)})
     await runs.patch('r_restricted',{status:'running'})
-    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_restricted'}),/owner-authorized native local/)
+    await assert.rejects(requireOwnerExecution(root,'r_restricted'),/external-execution-unavailable/)
   } finally {
     if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
     if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport

package/test/failure.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, mkdir, readFile, writeFile, rm } from 'node:fs/promises'
+import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { execFile, spawn } from 'node:child_process'
@@ -8,11 +8,12 @@ import { promisify } from 'node:util'
 import { fileURLToPath } from 'node:url'
 import { once } from 'node:events'
 import { redactFailure, failureStamp, needsFailureReview } from '../src/failure.js'
-import { RunStore } from '../src/runs.js'
+import { RunStore, sentOutbox } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
 import { Scheduler } from '../src/scheduler.js'
 import { initialPreset } from '../src/ai.js'
 import { createRelay } from '../src/index.js'
+import { serveTestLedger } from './helpers/ledger.js'
 import { TelegramSource } from '../src/telegram-source.js'
 import { packageVersion } from '../src/version.js'
 import { initializeWorkspace } from '../src/workspace.js'
@@ -33,6 +34,8 @@ test('failure evidence is bounded and redacts configured credentials, headers, t
 
 test('failure review CLI is owner-bound, rejects stale reviews, and keeps failure evidence immutable',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-failure-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ // The schedule CLI child reaches the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,1000)
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_EXECUTOR_CLI:'grok',EZ_RUN_ID:''}
  const cli=(args:string[],overrides={})=>exec(process.execPath,[bin,...args],{env:{...env,...overrides}})
@@ -61,7 +64,7 @@ test('failure review CLI is owner-bound, rejects stale reviews, and keeps failur
   await runs.patch(id,{status:'running',...('replyOnly' in extra?{replyOnly:true}:{})})
   await assert.rejects(cli(review,{EZ_RUN_ID:id}),/owner-authorized/)
  }
- await writeFile(join(dir,'runs','r_bad.json'),'{broken')
+ await assert.rejects(stat(join(dir,'runs')),{code:'ENOENT'})
  assert.equal(JSON.parse((await cli(['failures'])).stdout).total,1)
 })
 
@@ -86,6 +89,8 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
  })
  relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
  relay.bot.api.config.use(async(_p,method,payload)=>{if(method==='sendMessage')replies.push((payload as any).text);return {ok:true,result:{message_id:replies.length}} as any})
+ // The schedule CLI children reach the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir)
  const originalPatch=RunStore.prototype.patch
  t.mock.method(RunStore.prototype,'patch',async function(this:RunStore,...args:Parameters<RunStore['patch']>){
   // Hold the PID write until the fast child has closed, reproducing slow disk
@@ -114,7 +119,7 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
   await relay.bot.handleUpdate({...update,update_id:12,message:{...update.message!,message_id:12,text:'/stop'}})
   await until(async()=>(await runs.get('tg_11'))?.status==='cancelled')
   assert.equal(needsFailureReview((await runs.get('tg_11'))!),false)
- }finally{await relay.stop();for(const child of children)child.kill();await rm(dir,{recursive:true,force:true})}
+ }finally{await relay.stop();for(const child of children)child.kill();await ledger.stop();await rm(dir,{recursive:true,force:true})}
 })
 
 
@@ -220,7 +225,7 @@ for (const cleanupFails of [false,true]) test(`polling conflict preserves work u
   await stopped
   assert.equal(relay.stop(),stopping,'finished shutdown remains idempotent')
   assert.equal(sourceStops,1)
-  assert.deepEqual(JSON.parse(await readFile(join(dir,'outbox',`${item.id}.sent.json`),'utf8')).receipt.messageIds,[1])
+  assert.deepEqual((sentOutbox(dir).find(entry=>entry.id===item.id)?.receipt as {messageIds:number[]}).messageIds,[1])
   assert.equal(polls,1,'a conflict must not start another polling loop before the retry delay')
   assert.equal(relay.bot.isRunning(),false)
   assert.ok(child && (child.exitCode!==null || child.signalCode!==null))
@@ -268,6 +273,7 @@ for (const intake of [true,false]) test(`relay shutdown terminates an in-flight
 
 test('group members can inspect failures and wake review without exposing other chats', async t => {
  const dir=await mkdtemp(join(tmpdir(),'ez-group-failure-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,900000),scheduler=new Scheduler(dir)
  await control.requestPairing(101,-123,'Fixture');const owner=await control.approveOwner(-123,true)
  const execution=await control.captureChoice(initialPreset('grok'))
@@ -334,6 +340,7 @@ test('shutdown aborts a pending bot initialization without starting polling',asy
 
 test('failed reviewer readback exposes its stop through show, list and resume until explicit edit',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-review-stop-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
  await control.requestPairing(101,101);const owner=await control.approveOwner(101)
  const execution=await control.captureChoice(initialPreset('grok')),now=Date.now()+1000

package/test/files.test.ts

@@ -35,13 +35,13 @@ test('sanitizes dangerous file names', () => {
   assert.equal(sanitizeFileName('report 2026!@#.pdf'), 'report_2026___.pdf')
 })
 
-test('stages file into workspace inbox cleanly', async () => {
+test('stages file into control attachments, never the workspace', async () => {
   const tmp = await mkdtemp(path.join(tmpdir(), 'ez-files-'))
   try {
     const data = Buffer.from('%PDF-1.4 sample content')
     const staged = await stageIncomingFile(tmp, 'sample.pdf', data)
     assert.equal(staged.fileType, 'pdf')
-    assert.match(staged.relativePath, /^inbox[/\\][a-f0-9-]+_sample\.pdf$/)
+    assert.match(staged.relativePath, /^attachments[/\\][a-f0-9-]+_sample\.pdf$/)
     const read = await readFile(staged.fullPath)
     assert.deepEqual(read, data)
   } finally {

package/test/helpers/ledger.ts

@@ -0,0 +1,18 @@
+import { createLedgerHandler, serveDeliverySocket } from '../../src/delivery-socket.js'
+
+// Serves the relay memory ledger for child-process CLIs (message, react,
+// approval, schedule) in tests that do not start a full relay. Handlers run
+// in this process, so test-created runs are visible to CLI children through
+// the shared-volume socket. Fixtures that start a relay must NOT also serve:
+// the relay serves the same path.
+export const serveTestLedger = async (
+  controlDir: string,
+  status: () => { polling: boolean; applicationOnly: boolean; telegramConfigured: boolean; version: string } =
+    () => ({ polling: false, applicationOnly: false, telegramConfigured: true, version: 'test' }),
+) => {
+  const server = await serveDeliverySocket(
+    controlDir,
+    createLedgerHandler(controlDir, { wake: () => {}, status }),
+  )
+  return server
+}

package/test/host-executor.test.ts

@@ -69,6 +69,80 @@ test('host restart clears dead native lease only after proving previous CLI stop
   }finally{abort.abort();await server;await rm(root,{recursive:true,force:true});}
 });
 
+test('host execution resolves a declared provider from the bound agent, not a launcher wrapper', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-host-provider-'))
+  const workspace = path.join(root, 'mind')
+  const controlDir = path.join(root, 'control')
+  const directory = path.join(controlDir, 'host-executor')
+  const provider = {
+    id: 'openrouter', name: 'OpenRouter', baseUrl: 'https://openrouter.ai/api/v1',
+    envKey: 'OPENROUTER_API_KEY', models: ['deepseek/deepseek-v4.1-flash'],
+  }
+  const installation = {
+    cli: 'codex' as const,
+    agents: [{name: 'test', workspace, controlDir, binDir: path.join(root, 'bin'), codexProviders: [provider]}],
+  }
+  const abort = new AbortController()
+  let server: Promise<void> | undefined
+  let captured: any
+  const previousPath = process.env.PATH
+  try {
+    await mkdir(workspace, {recursive: true})
+    await mkdir(directory, {recursive: true})
+    const fakeBin = path.join(root, 'bin')
+    await mkdir(fakeBin, {recursive: true})
+    await mkdir(path.join(controlDir, 'cli', 'codex'), {recursive: true})
+    await writeFile(path.join(fakeBin, 'codex'), '#!/bin/sh\nexit 0\n', {mode: 0o700})
+    await writeFile(path.join(controlDir, 'cli', 'codex', 'models_cache.json'), JSON.stringify({models: [
+      {slug: provider.models[0], visibility: 'list', display_name: 'DeepSeek V4.1 Flash', supported_reasoning_levels: [{effort: 'max'}]},
+    ]}))
+    process.env.PATH = `${fakeBin}${path.delimiter}${previousPath ?? ''}`
+    await ownerRun(controlDir, 'r_provider')
+    server = serveHostExecutor(installation, abort.signal, async (_texts, options) => {
+      captured = options
+      const child = spawn(process.execPath, ['-e', 'process.exit(0)'])
+      return {child, cleanup: async () => {}, stdout: ''}
+    })
+    for (let n = 0; n < 100; n++) {
+      try { await readFile(path.join(directory, 'heartbeat.json')); break }
+      catch { await new Promise(resolve => setTimeout(resolve, 20)) }
+    }
+    await writeFile(path.join(directory, 'r_provider.request.json'), JSON.stringify({
+      texts: ['hello'], options: {cli: 'codex', provider: 'openrouter', model: provider.models[0], effort: 'max'},
+    }))
+    let events = ''
+    for (let n = 0; n < 100; n++) {
+      try {
+        events = await readFile(path.join(directory, 'r_provider.events'), 'utf8')
+        if (events.includes('"stream":"exit"')) break
+      } catch {}
+      await new Promise(resolve => setTimeout(resolve, 20))
+    }
+    assert.match(events, /"stream":"exit","code":0/)
+    const catalog = JSON.parse(await readFile(path.join(directory, 'models.json'), 'utf8'))
+    assert.deepEqual(catalog.filter((model: any) => model.model === provider.models[0]), [
+      {
+        cli: 'codex-gui', model: provider.models[0],
+        name: 'codex-gui · DeepSeek V4.1 Flash', efforts: ['max'],
+      },
+      {
+        cli: 'codex', provider: 'openrouter', model: provider.models[0],
+        name: `OpenRouter · ${provider.models[0]}`, efforts: ['max'],
+      },
+    ])
+    assert.deepEqual(catalog.filter((model: any) => model.cli === 'codex' && !model.provider), [])
+    assert.equal(captured.provider, 'openrouter')
+    assert.deepEqual(captured.codexProvider, provider)
+    assert.equal(captured.model, provider.models[0])
+  } finally {
+    abort.abort()
+    await server
+    if (previousPath === undefined) delete process.env.PATH
+    else process.env.PATH = previousPath
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
 test('one installed CLI executes two agent bindings with separate minds and sanitized environment', async () => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-'))
   const abort=new AbortController()

package/test/inbox.test.ts

@@ -8,12 +8,11 @@ import { InboxStore } from '../src/inbox.js'
 import { RunStore } from '../src/runs.js'
 
 const update = (id: number): Update => ({ update_id: id })
-test('intake survives restart, deduplicates IDs, seals membership and retains cancellation tombstones', async () => {
+test('intake deduplicates IDs, seals membership and retains cancellation tombstones (memory only)', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-inbox-'))
   try {
-    let inbox = new InboxStore(dir)
+    const inbox = new InboxStore(dir)
     assert.equal(await inbox.accept(update(1)), true)
-    inbox = new InboxStore(dir)
     assert.equal(await inbox.accept(update(1)), false)
     await inbox.accept(update(2))
     assert.equal(await inbox.next(), undefined)
@@ -23,12 +22,11 @@ test('intake survives restart, deduplicates IDs, seals membership and retains ca
       [1, 2],
     )
     await inbox.accept(update(3))
-    inbox = new InboxStore(dir)
     assert.deepEqual(await inbox.next(true), batch)
     const runs = new RunStore(dir)
     const input = { id: batch.id, chatId: 101, telegramUserId: 101, texts: ['hello'] }
     await runs.create(input)
-    // Crash between run creation and inbox completion must not produce a second run.
+    // Retry with the same run ID returns the existing run; no second run.
     await runs.create(input)
     assert.equal((await runs.list()).length, 1)
     await inbox.finish(batch.id)
@@ -36,19 +34,19 @@ test('intake survives restart, deduplicates IDs, seals membership and retains ca
     assert.equal(await inbox.cancel(), 1)
     assert.equal(await inbox.accept(update(3)), false)
     assert.equal(await inbox.next(true), undefined)
-    assert.equal((await stat(join(dir, 'inbox.json'))).mode & 0o777, 0o600)
+    // Stateless pipe: no inbox.json exists on disk; restart drops by design.
+    await assert.rejects(stat(join(dir, 'inbox.json')))
   } finally {
     await rm(dir, { recursive: true, force: true })
   }
 })
 
-test('corrupt intake fails closed without overwriting evidence; invalid identifiers are rejected', async () => {
+test('restart loses nothing by design; invalid identifiers are rejected', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-inbox-corrupt-'))
   try {
-    await writeFile(join(dir, 'inbox.json'), '{broken')
+    // A fresh directory starts empty: no durable journal survives a restart.
     const inbox = new InboxStore(dir)
-    await assert.rejects(inbox.accept(update(4)), /Inbox unreadable/)
-    assert.equal(await readFile(join(dir, 'inbox.json'), 'utf8'), '{broken')
+    assert.deepEqual(await inbox.status(), { pending: 0, failed: 0 })
     assert.throws(() => inbox.accept(update(-1)), /Invalid update ID/)
     await assert.rejects(
       new RunStore(dir).create({ id: '../escape', chatId: 101, telegramUserId: 101, texts: [] }),

package/test/install-config.test.ts

@@ -81,6 +81,7 @@ test('Docker startup uses explicit deployment binding and literal paths without
   assert.equal(definition.command, 'docker')
   assert.ok(definition.args.includes('/tmp/my agent $literal/docker.env'))
   assert.deepEqual(definition.args.slice(-4), ['up', '-d', '--wait', 'relay'])
+  assert.deepEqual(serviceDefinition('/tmp/isolated', true).args.slice(-5), ['up', '-d', '--wait', 'relay', 'plugin-broker'])
   assert.doesNotMatch(JSON.stringify(definition), /TELEGRAM_BOT_TOKEN|launchctl|systemctl/)
   assert.throws(() => serviceDefinition('/tmp/\nbad'), /single-line/)
 })