@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.36

package/test/install-tools.test.mjs

@@ -3,7 +3,10 @@ import assert from 'node:assert/strict';
 import * as fs from 'node:fs/promises';
 import {tmpdir} from 'node:os';
 import path from 'node:path';
-import {preflight,installationStatus,build,hostEnvironment} from '../src/install-tools.mjs';
+import {preflight,installationStatus,build,hostEnvironment,migrateLedger} from '../src/install-tools.mjs';
+import {parseEnv} from 'node:util';
+import {RunStore} from '../src/runs.js';
+import {serveTestLedger} from './helpers/ledger.js';
 
 async function fixture(t){const root=await fs.mkdtemp(path.join(tmpdir(),'ez-install-tools-'));t.after(()=>fs.rm(root,{recursive:true,force:true}));return root;}
 test('preflight checks the selected executable and reports missing prerequisites without credentials',async t=>{
@@ -19,10 +22,12 @@ test('preflight checks the selected executable and reports missing prerequisites
 test('installation status separates files, pairing and current-owner Telegram delivery evidence',async t=>{
   const root=await fixture(t),control=path.join(root,'control');
   assert.equal((await installationStatus(root)).stage,'not-configured');
-  for(const dir of ['host-executor','outbox','runs'])await fs.mkdir(path.join(control,dir),{recursive:true});
+  await fs.mkdir(path.join(control,'host-executor'),{recursive:true});
   for(const name of ['agent.json','host-executor.json','docker.env','relay.env'])await fs.writeFile(path.join(root,name),'private');
   const write=(name,obj)=>fs.writeFile(path.join(control,name),JSON.stringify(obj));
   await write('heartbeat.json',{at:Date.now(),polling:true});await write('host-executor/heartbeat.json',{at:Date.now()});
+  // Delivery evidence comes from the running relay's memory ledger.
+  const ledger=await serveTestLedger(control,()=>({polling:true,applicationOnly:false,telegramConfigured:true,version:'test'}));t.after(()=>ledger.stop());
   assert.equal((await installationStatus(root)).stage,'awaiting-owner');
   await fs.writeFile(path.join(root,'agent.json'),JSON.stringify({isolation:'isolated'}));
   await fs.rm(path.join(control,'host-executor/heartbeat.json'));
@@ -32,15 +37,46 @@ test('installation status separates files, pairing and current-owner Telegram de
   assert.equal((await installationStatus(root)).stage,'awaiting-owner');
   const owner={telegramUserId:123,telegramChatId:123,pairedAt:new Date(Date.now()-10000).toISOString()};await write('control-state.json',{owner});
   assert.equal((await installationStatus(root)).stage,'awaiting-telegram-reply');
-  const item={runId:'tg_12',chatId:123,receipt:{messageIds:[42],deliveredAt:new Date().toISOString()}};
-  await write('outbox/test.sent.json',item);await write('runs/tg_12.json',{status:'completed',chatId:123,telegramUserId:999});
+  const runs=new RunStore(control),deliver=async(id,text,chatId,telegramUserId,ids,status='completed')=>{
+    const run=await runs.create({id,chatId,telegramUserId,texts:[text]});
+    await runs.patch(run.id,{status:'running'});
+    const item=await runs.enqueueMessage(run.id,text);
+    await runs.claimOutbox(item.id);await runs.markOutboxSent(item.id,ids);
+    await runs.patch(run.id,{status});
+  };
+  // Another chat member's completed delivery is not the owner's reply evidence.
+  await deliver('tg_13','other member',123,999,[42]);
   assert.equal((await installationStatus(root)).telegramReplyVerified,false);
-  await write('runs/tg_12.json',{status:'completed',chatId:123,telegramUserId:123});
+  // A failed run never counts, even with a receipt.
+  await deliver('tg_14','failed',123,123,[43],'failed');
+  assert.equal((await installationStatus(root)).telegramReplyVerified,false);
+  await deliver('tg_12','hello',123,123,[42]);
   assert.equal((await installationStatus(root)).stage,'ready-for-telegram-plugin-request');
-  await write('heartbeat.json',{at:0,polling:true});assert.equal((await installationStatus(root)).stage,'runtime-offline');
-  await write('outbox/test.sent.json',{...item,runId:'../../escape'});assert.equal((await installationStatus(root)).telegramReplyVerified,false);
+  // With the relay down, status falls back to the legacy heartbeat file.
+  await ledger.stop();await write('heartbeat.json',{at:0,polling:true});assert.equal((await installationStatus(root)).stage,'runtime-offline');
   await fs.writeFile(path.join(control,'control-state.json'),'{');await assert.rejects(installationStatus(root));
 });
+test('host-capable deployments migrate once to a loopback ledger endpoint',async t=>{
+  const root=await fixture(t),deployment=path.join(root,'agent');await fs.mkdir(deployment);
+  const envFile=path.join(deployment,'docker.env');
+  await fs.writeFile(envFile,"COMPOSE_PROJECT_NAME='ez-agent-canary'\nCOMPOSE_FILE='/opt/ez/compose.yaml:/opt/ez/extra.compose.yaml'\n",{mode:0o600});
+  const first=await migrateLedger({deployment});
+  assert.equal(first.changed,true);assert.ok(Number.isSafeInteger(first.port)&&first.port>=1024);
+  const values=parseEnv(await fs.readFile(envFile,'utf8'));
+  assert.equal(values.EZ_DELIVERY_TCP_PORT,String(first.port));
+  assert.equal(values.COMPOSE_FILE,`/opt/ez/compose.yaml:/opt/ez/extra.compose.yaml:${path.join(deployment,'ledger.compose.yaml')}`);
+  assert.match(await fs.readFile(path.join(deployment,'ledger.compose.yaml'),'utf8'),/127\.0\.0\.1:\$\{EZ_DELIVERY_TCP_PORT:\?\}/);
+  assert.equal((await fs.stat(envFile)).mode&0o777,0o600);
+  const second=await migrateLedger({deployment});
+  assert.equal(second.changed,false);assert.equal(second.port,first.port);
+  await assert.rejects(migrateLedger({deployment:path.join(root,'missing')}),/docker.env not found/);
+});
+test('isolated deployments need no host ledger endpoint',async t=>{
+  const root=await fixture(t),deployment=path.join(root,'isolated');await fs.mkdir(deployment);
+  await fs.writeFile(path.join(deployment,'docker.env'),"COMPOSE_PROJECT_NAME='ez-agent-isolated'\nCOMPOSE_FILE='/opt/ez/compose.yaml'\nEZ_ISOLATION='isolated'\nEZ_EXECUTOR_TRANSPORT='local'\n",{mode:0o600});
+  const result=await migrateLedger({deployment});
+  assert.equal(result.changed,false);assert.match(result.note,/Isolated/);
+});
 test('same-artifact build retries do not spawn a second Docker build and reuse verified completed image',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
   let started,finish,count=0;const running=new Promise(r=>started=r),held=new Promise(r=>finish=r);
@@ -51,6 +87,37 @@ test('same-artifact build retries do not spawn a second Docker build and reuse v
   assert.equal((await build({home,source},invoke)).reused,true);assert.equal(count,1);
   await fs.writeFile(path.join(source,'package.json'),'{"changed":true}');await build({home,source},invoke);assert.equal(count,2);
 });
+test('source checkouts build RCs only: clean reviewed commit plus increasing label',async t=>{
+  const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
+  let inside=true,status='',built=[],toplevel=source;const sha='a'.repeat(40);
+  const invoke=async(cmd,args)=>{
+    if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);
+    if(cmd==='git'){
+      if(!inside)throw Error('not a git repository');
+      if(args[2]==='rev-parse'&&args[3]==='--show-toplevel')return toplevel;
+      if(args[2]==='status')return status;
+      if(args[2]==='rev-parse'&&args[3]==='HEAD')return sha;
+      return '';
+    }
+    if(args[0]==='build'){built.push(args);return 'image';}
+    return 'sha256:fixture';
+  };
+  await assert.rejects(build({home,source},invoke),/requires --label/);
+  await assert.rejects(build({home,source,label:'0.1.0-beta.36'},invoke),/RC label/);
+  status=' M src/executor.ts';
+  await assert.rejects(build({home,source,label:'0.1.0-beta.36.rc.2'},invoke),/Commit the reviewed source/);
+  status='';
+  const result=await build({home,source,label:'0.1.0-beta.36.rc.2'},invoke);
+  assert.equal(result.label,'0.1.0-beta.36.rc.2');assert.equal(result.sha,sha);
+  const args=built.at(-1);
+  assert.ok(args.includes('BUILD_TAG=0.1.0-beta.36.rc.2'));assert.ok(args.includes(`BUILD_SHA=${sha}`));
+  assert.ok(args.includes('ezenciel-agents:0.1.0-beta.36.rc.2'));
+  inside=false;
+  await assert.rejects(build({home,source,label:'0.1.0-beta.36.rc.2'},invoke),/--label requires a git checkout/);
+  // A tarball unpacked inside an unrelated repository is not a source checkout.
+  inside=true;toplevel=home;
+  assert.equal((await build({home,source},invoke)).label,undefined);
+});
 test('a failed build releases its own lock and leaves a failure receipt for diagnosis',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
   const invoke=async(cmd)=>{if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);throw Error('Synthetic build failed');};

package/test/intake-relay.test.ts

@@ -1,5 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
+import { randomBytes } from 'node:crypto'
 import { mkdtemp, readdir, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -8,6 +9,7 @@ import { once } from 'node:events'
 import type { Update } from 'grammy/types'
 import { createRelay } from '../src/index.js'
 import { ControlStore } from '../src/control-state.js'
+import { ApplicationBindings } from '../src/application-channel.js'
 import { RunStore } from '../src/runs.js'
 import { InboxStore } from '../src/inbox.js'
 import { ApprovalStore } from '../src/approval.js'
@@ -113,7 +115,9 @@ test('approved owner group accepts different members, controls and group deliver
     await control.revokeOwner()
     await f.relay.bot.handleUpdate(group(1))
     assert.equal(f.launched.length, 0)
-    assert.equal((await control.status()).pending[0].title, 'Team')
+    const request = (await control.status()).pending[0]
+    if (!request || !('title' in request)) throw new Error('Group pairing request missing')
+    assert.equal(request.title, 'Team')
     await control.approveOwner(-101, true)
     await f.relay.bot.handleUpdate(group(2, 303))
     await f.relay.bot.handleUpdate(group(3, 404))
@@ -263,7 +267,7 @@ test('conversation menu is owner-only and removes the retired settings control',
   try {
     await f.relay.bot.handleUpdate(message(1, '/menu'))
     assert.deepEqual(f.keyboards.at(-1)!.flat().map((b) => b.text),
-      ['New conversation', 'Conversations', 'Choose AI', 'Work status'])
+      ['New conversation', 'Conversations', 'Choose AI', 'Work status', 'Scheduled tasks'])
     await f.relay.bot.handleUpdate(message(2, '/settings'))
     assert.match(f.replies.at(-1)!, /Settings was removed.*Use \/ai/)
     await f.relay.bot.handleUpdate(message(3, '/ai'))
@@ -284,9 +288,11 @@ test('conversation menu is owner-only and removes the retired settings control',
     assert.match(f.replies.at(-1)!, /Menu expired/)
     assert.deepEqual(await store.status(), refreshed)
     await f.relay.bot.handleUpdate(message(8, '/status'))
-    assert.ok(f.keyboards.at(-1)!.flat().some((button) => button.text === 'Scheduled tasks'))
-    await f.relay.bot.handleUpdate(callback(9, 'menu:scheduled-tasks'))
-    assert.match(f.replies.at(-1)!, /No active scheduled tasks for this owner/)
+    assert.ok(!f.keyboards.at(-1)!.flat().some((button) => button.text === 'Scheduled tasks'))
+    await f.relay.bot.handleUpdate(message(9, '/tasks'))
+    assert.match(f.replies.at(-1)!, /📅 Scheduled tasks[\s\S]*No active scheduled tasks/)
+    await f.relay.bot.handleUpdate(message(10, '/tasks 2'))
+    assert.match(f.replies.at(-1)!, /Scheduled task 2 was not found/)
     assert.equal(f.launched.length, 0)
   } finally { await f.close() }
 })
@@ -386,7 +392,7 @@ test('slow voice normalization preserves instruction order and leaves controls r
     release()
     await processing
     assert.equal(f.launched[0][0], 'Use the following voice note')
-    assert.match(f.launched[0][1], /Quoted context/)
+    assert.doesNotMatch(f.launched[0][1], /Quoted context/)
     assert.match(f.launched[0][1], /Fixture voice transcript/)
     assert.equal(f.launched[0].length, 2)
     assert.equal((await new InboxStore(f.dir).status()).pending, 1)
@@ -632,7 +638,7 @@ test('conversation menu paginates and stale pages remain usable after archiving'
 })
 
 
-test('older conversation names come from owner messages and detail keeps archive available when resume fails', async () => {
+test('conversation names never read run history and detail keeps archive available when resume fails', async () => {
   const f = await fixture()
   try {
     const store = new ControlStore(f.dir, 1000)
@@ -649,7 +655,8 @@ test('older conversation names come from owner messages and detail keeps archive
     await store.resetSession()
     await f.relay.bot.handleUpdate(message(1, '/chats'))
     const rows = f.keyboards.at(-1)!
-    assert.ok(rows.flat().some(b => b.text.startsWith('Client launch checklist · ')))
+    assert.ok(rows.flat().some(b => b.text.startsWith('Untitled conversation')))
+    assert.ok(!rows.flat().some(b => b.text.includes('Client launch checklist')))
     assert.ok(!rows.flat().some(b => b.text === '✓ New conversation'))
     assert.ok(!rows.flat().some(b => b.text.includes(old.sessionId.slice(0, 8))))
     assert.ok(!rows.flat().some(b => b.callback_data.startsWith('chat:archive:')))
@@ -657,7 +664,7 @@ test('older conversation names come from owner messages and detail keeps archive
       id: '2', chat_instance: 'fixture', data: `chat:open:${old.sessionId}`,
       from: { id: 101, first_name: 'Fixture', is_bot: false }, message: message(2).message!,
     } })
-    assert.match(f.replies.at(-1)!, /Client launch checklist.*\n.*binding/)
+    assert.match(f.replies.at(-1)!, /Untitled conversation \d+[\s\S]*binding/)
     assert.deepEqual(f.keyboards.at(-1)![0], [{text: 'Archive this conversation', callback_data: `chat:archive:${old.sessionId}`}])
   } finally { await f.close() }
 })
@@ -680,7 +687,7 @@ test('Telegram and application image/PDF/text use identical native attachment me
       const telegram=(await new RunStore(f.dir).list()).find(run=>run.messageId===update.message!.message_id)!
       assert.ok(telegram)
       const application=await f.relay.applicationChannel.submit(binding.bindingId,{requestId:name,scope:'chat',followOwner:true,text:update.message!.caption,attachment:{name,data:bytes.toString('base64')}})
-      const normalize=(text:string)=>text.replace(/inbox\/[a-f0-9-]+_/,'inbox/ID_')
+      const normalize=(text:string)=>text.replace(/attachments\/[a-f0-9-]+_/,'attachments/ID_')
       assert.equal(normalize(application.texts[0]),normalize(telegram.texts[0]))
       assert.equal(application.ownerId,telegram.ownerId)
       assert.equal(application.execution?.sessionId,telegram.execution?.sessionId)
@@ -699,9 +706,49 @@ test('web launcher is private-owner-only and bypasses native intake without repl
     await f.relay.bot.handleUpdate(message(2,'/voice'))
     assert.deepEqual(f.keyboards.at(-1),[[{text:'Voice',web_app:{url:'https://voice.example/'}}]])
     await f.relay.bot.handleUpdate(message(3,'/menu'))
-    assert.deepEqual(f.keyboards.at(-1)!.flat().map(b=>b.text),['New conversation','Conversations','Choose AI','Work status','Voice'])
+    assert.deepEqual(f.keyboards.at(-1)!.flat().map(b=>b.text),['New conversation','Conversations','Choose AI','Work status','Scheduled tasks','Voice'])
     await f.relay.drainInbox(true);assert.equal(f.launched.length,0)
     await new ControlStore(f.dir,1000).revokeOwner()
     const before=f.keyboards.length;await f.relay.bot.handleUpdate(message(4,'/voice'));assert.equal(f.keyboards.length,before)
   } finally {await f.close()}
 })
+
+test('application Telegram link connects without launching work; bad link replies expired', async () => {
+  const f=await fixture()
+  try {
+    const control=new ControlStore(f.dir,1000)
+    await control.revokeOwner()
+    const owner=await control.registerOwner('account:web')
+    const binding=await new ApplicationBindings(f.dir).register('webapp',randomBytes(32).toString('base64url'),owner,true)
+    assert.ok(binding)
+    const pairing=await control.createApplicationTelegramPairing(binding.bindingId,owner)
+    assert.ok(pairing)
+    await f.relay.bot.handleUpdate(message(1,`/start ${'A'.repeat(43)}`))
+    assert.match(f.replies.at(-1)!,/expired|no longer valid/)
+    assert.equal(f.launched.length,0)
+    await f.relay.bot.handleUpdate(message(2,`/start ${pairing.token}`))
+    assert.match(f.replies.at(-1)! ,/connected/)
+    assert.equal(f.launched.length,0)
+    assert.equal((await control.status()).owner?.telegramUserId,101)
+  } finally {await f.close()}
+})
+
+test('tasks command never reaches the executor on invalid input or foreign senders', async () => {
+  const f = await fixture()
+  try {
+    const stranger = message(1, '/tasks');stranger.message!.from!.id = 202
+    await f.relay.bot.handleUpdate(stranger)
+    assert.equal(f.launched.length, 0)
+    assert.ok(!f.replies.join('\n').includes('Scheduled tasks'))
+    const strangerDetail = message(2, '/tasks 1');strangerDetail.message!.from!.id = 202
+    await f.relay.bot.handleUpdate(strangerDetail)
+    assert.equal(f.launched.length, 0)
+    assert.ok(!f.replies.join('\n').includes('Scheduled tasks'))
+    for (const [id, text] of [[3, '/tasks 0'], [4, '/tasks abc'], [5, '/tasks 1.5'], [6, '/tasks 2 extra']] as const) {
+      await f.relay.bot.handleUpdate(message(id, text))
+      assert.match(f.replies.at(-1)!, /Usage: \/tasks \[number\]/)
+    }
+    await f.relay.drainInbox(true)
+    assert.equal(f.launched.length, 0)
+  } finally { await f.close() }
+})

package/test/message-history.test.ts

@@ -1,45 +1,42 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, readFile, writeFile, readdir } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'
 import { execFile } from 'node:child_process'
 import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
 import { deliveredMessages } from '../src/message-history.js'
 import { RunStore } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
 
 async function fixture(t: test.TestContext) {
   const dir = await mkdtemp(join(tmpdir(), 'ez-history-'))
-  t.after(() => rm(dir, { recursive: true, force: true }))
+  // Child CLI assertions below reach the memory ledger through the socket.
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
   await ownerRun(dir, 'tg_1')
   const runs = new RunStore(dir)
-  const patchFixture = async (id: string, patch: Record<string, unknown>) => {
-    const file = join(dir, 'runs', id + '.json')
-    await writeFile(file, JSON.stringify({ ...JSON.parse(await readFile(file, 'utf8')), ...patch }))
-  }
   const send = async (runId: string, text: string, ids: number[]) => {
     const item = await runs.enqueueMessage(runId, text)
     await runs.claimOutbox(item.id)
     await runs.markOutboxSent(item.id, ids)
-    return join(dir, 'outbox', item.id + '.sent.json')
+    return item
   }
-  return { dir, runs, send, patchFixture }
+  return { dir, runs, send }
 }
 
 test('CLI retrieves Synopsys delivery from another session without changing sessions or sending', async t => {
-  const { dir, runs, send, patchFixture } = await fixture(t)
-  await ownerRun(dir, 'r_schedule_report')
+  const { dir, runs, send } = await fixture(t)
   const owner = (await new ControlStore(dir, 1000).status()).owner!
-  await patchFixture('r_schedule_report', { nativeSessionId: 'report_session', scheduled: {
-    id: 's_earnings', revision: 1, dueAt: new Date().toISOString(), pairedAt: owner.pairedAt,
-  } })
+  const report = await runs.create({ id: 'r_schedule_report', chatId: 101, telegramUserId: 101, texts: ['quarterly results'],
+    execution: { sessionId: 'report_session', preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } },
+    scheduled: { id: 's_earnings', revision: 'rev', dueAt: new Date().toISOString(), pairedAt: owner.pairedAt } })
+  await runs.patch(report.id, { status: 'running', nativeSessionId: 'report_session' })
   await send('r_schedule_report', 'Synopsys (SNPS): quarterly results', [10, 11])
   await runs.patch('r_schedule_report', { status: 'completed' })
-  await patchFixture('tg_1', { texts: ['Why now?'] })
   await send('tg_1', 'Other report', [12])
-  const before = await readdir(join(dir, 'outbox'))
   const controlBefore = await new ControlStore(dir, 1000).status()
   const { stdout } = await promisify(execFile)(process.execPath, ['bin/ezenciel-agents-message.mjs', 'history', '--message-id', '11'], {
     env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_RUN_ID: 'tg_1' },
@@ -51,51 +48,49 @@ test('CLI retrieves Synopsys delivery from another session without changing sess
   assert.equal(result.messages[0].scheduleId, 's_earnings')
   assert.deepEqual(result.messages[0].messageIds, [10, 11])
   assert.deepEqual(await new ControlStore(dir, 1000).status(), controlBefore)
-  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  // History reads never create outbox state on disk.
+  await assert.rejects(stat(join(dir, 'outbox')))
   const latest = await deliveredMessages(dir, 'tg_1', { limit: 1 })
   assert.equal(latest.messages[0].text, 'Other report')
   assert.equal(latest.hasMore, true)
 })
 
 test('only confirmed deliveries in current owner binding are exposed', async t => {
-  const { dir, runs, send, patchFixture } = await fixture(t)
+  const { dir, runs, send } = await fixture(t)
   await send('tg_1', 'included', [1])
   await runs.enqueueMessage('tg_1', 'pending')
   const failed = await runs.enqueueMessage('tg_1', 'uncertain')
   await runs.claimOutbox(failed.id)
   await runs.failOutbox(failed.id, 'unknown', true)
-  await writeFile(join(dir, 'outbox', 'corrupt.sent.json'), '{')
-  await writeFile(join(dir, 'outbox', 'null.sent.json'), 'null')
-  const invalid = await send('tg_1', 'invalid receipt', [2])
-  const record = JSON.parse(await readFile(invalid, 'utf8'))
-  record.receipt.messageIds = []
-  await writeFile(invalid, JSON.stringify(record))
-  for (const [id, patch] of [
-    ['r_other_chat', { chatId: 202 }],
-    ['r_other_owner', { telegramUserId: 202 }],
-    ['r_old', { createdAt: '2000-01-01T00:00:00.000Z' }],
-    ['r_external', { external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } }],
-  ] as const) {
-    await ownerRun(dir, id)
-    await patchFixture(id, patch)
-    await send(id, 'excluded', [3])
+  // Receipts without usable message IDs are not delivery evidence.
+  const invalid = await runs.enqueueMessage('tg_1', 'invalid receipt')
+  await runs.claimOutbox(invalid.id)
+  await runs.markOutboxSent(invalid.id, [])
+  for (const input of [
+    { id: 'r_other_chat', chatId: 202, telegramUserId: 101 },
+    { id: 'r_other_owner', chatId: 101, telegramUserId: 202 },
+    { id: 'r_external', chatId: 101, telegramUserId: 101, external: { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] } },
+  ]) {
+    await runs.create({ ...input, texts: ['excluded'] })
+    await runs.patch(input.id, { status: 'running' })
+    await send(input.id, 'excluded', [3])
   }
   assert.deepEqual((await deliveredMessages(dir, 'tg_1')).messages.map(m => m.text), ['included'])
-  await writeFile(join(dir, 'runs', 'broken.json'), '{')
   assert.equal((await deliveredMessages(dir, 'tg_1')).messages.length, 1)
 })
 
 test('unauthorized callers and invalid arguments fail closed', async t => {
-  const { dir, runs, patchFixture } = await fixture(t)
+  const { dir, runs } = await fixture(t)
   for (const limit of [0, 51, NaN, 1.5]) await assert.rejects(deliveredMessages(dir, 'tg_1', { limit }), /Limit/)
   await assert.rejects(deliveredMessages(dir, 'tg_1', { messageId: -1 }), /Message ID/)
   await assert.rejects(deliveredMessages(dir, '../tg_1'), /identifier/)
   await assert.rejects(deliveredMessages(dir, 'missing'), /No active/)
   await ownerRun(dir, 'r_external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
   await assert.rejects(deliveredMessages(dir, 'r_external'), /blocked/)
-  await patchFixture('tg_1', { telegramUserId: 202 })
-  await assert.rejects(deliveredMessages(dir, 'tg_1'), /owner-mismatch/)
-  await patchFixture('tg_1', { telegramUserId: 101, status: 'completed' })
+  await runs.create({ id: 'r_stranger', chatId: 101, telegramUserId: 202, texts: ['other'] })
+  await runs.patch('r_stranger', { status: 'running' })
+  await assert.rejects(deliveredMessages(dir, 'r_stranger'), /owner-mismatch/)
+  await runs.patch('tg_1', { status: 'completed' })
   await assert.rejects(deliveredMessages(dir, 'tg_1'), /No active/)
   await runs.patch('tg_1', { status: 'running' })
   await new ControlStore(dir, 1000).revokeOwner()
@@ -103,14 +98,11 @@ test('unauthorized callers and invalid arguments fail closed', async t => {
 })
 
 test('approval messages retain the content delivered to Telegram', async t => {
-  const { dir, send } = await fixture(t)
-  const file = await send('tg_1', 'placeholder', [20])
-  const item = JSON.parse(await readFile(file, 'utf8'))
-  delete item.text
-  item.type = 'approval'
-  item.approvalPrompt = 'Approve this messaging task?'
-  await writeFile(file, JSON.stringify(item))
-  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, item.approvalPrompt)
+  const { dir, runs } = await fixture(t)
+  const item = await runs.enqueueApproval('tg_1', 'Approve this messaging task?', 'act_history')
+  await runs.claimOutbox(item.id)
+  await runs.markOutboxSent(item.id, [20])
+  assert.equal((await deliveredMessages(dir, 'tg_1')).messages[0].text, 'Approve this messaging task?')
 })
 
 test('CLI flushes complete long reports and rejects send options in history mode', async t => {
@@ -121,7 +113,7 @@ test('CLI flushes complete long reports and rejects send options in history mode
   const cli = [ 'bin/ezenciel-agents-message.mjs', 'history' ]
   const { stdout } = await promisify(execFile)(process.execPath, cli, { env })
   assert.equal(JSON.parse(stdout).messages[0].text, text)
-  const before = await readdir(join(dir, 'outbox'))
   await assert.rejects(promisify(execFile)(process.execPath, [...cli, '--text', 'do not send'], { env }), /Unknown option/)
-  assert.deepEqual(await readdir(join(dir, 'outbox')), before)
+  // History reads never create outbox state on disk.
+  await assert.rejects(stat(join(dir, 'outbox')))
 })

package/test/native-tasks.test.ts

@@ -16,7 +16,7 @@ test('native tasks use verified control binding, sanitized environment and uncha
     const binding=await nativeTaskBinding(home,{HOME:root,PATH:process.env.PATH,TELEGRAM_BOT_TOKEN:'secret',EZ_RUN_ID:'forged',NODE_OPTIONS:'injection',EZ_CONTROL_DIR:'/wrong'})
     assert.equal(binding.cwd,workspace);assert.equal(binding.env.EZ_CONTROL_DIR,controlDir);assert.equal(binding.env.EZ_EXECUTOR_CLI,'grok')
     for(const key of ['TELEGRAM_BOT_TOKEN','EZ_RUN_ID','NODE_OPTIONS'])assert.equal(binding.env[key],undefined)
-    assert.match((await nativeTasks(home,['--help'])).stdout,/durable, asynchronous CLI task/)
+    assert.match((await nativeTasks(home,['--help'])).stdout,/Creates a scheduled task/)
     const denied=await nativeTasks(home,['list']);assert.notEqual(denied.code,0);assert.match(denied.stderr,/Pair an owner/)
     const control=new ControlStore(controlDir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
     const text='Read scan; $(must-not-run) /goal literal'

package/test/plugin-broker.test.mjs

@@ -0,0 +1,172 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as fs from 'node:fs/promises';
+import { createConnection } from 'node:net';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { ControlStore, ownerId, ownerEpoch } from '../src/control-state.js';
+import { RunStore } from '../src/runs.js';
+import { loadPluginBrokerBinding, servePluginBroker, validateBrokerRequest } from '../src/plugin-broker.mjs';
+
+const hash = value => createHash('sha256').update(value).digest('hex');
+const revision = 'sha256:' + 'a'.repeat(64);
+
+test('relay compose surface has no broker Docker socket or tools-home mount', async () => {
+  const compose = await fs.readFile(new URL('../compose.yaml', import.meta.url), 'utf8');
+  const relay = compose.slice(0, compose.indexOf('  plugin-broker:'));
+  assert.equal(relay.includes('/var/run/docker.sock'), false);
+  assert.equal(relay.includes('EZ_TOOLS_HOME'), false);
+  assert.equal(compose.slice(compose.indexOf('  plugin-broker:')).includes('/var/run/docker.sock'), true);
+});
+
+async function fixture(t) {
+  const root = await fs.realpath(await fs.mkdtemp(path.join(tmpdir(), 'e-')));
+  t.after(() => fs.rm(root, { recursive: true, force: true }));
+  const home = path.join(root, 'tools');
+  const workspace = path.join(root, 'mind');
+  const controlDir = path.join(root, 'control');
+  const hostConfig = path.join(root, 'host-executor.json');
+  const socket = path.join(controlDir, 'plugin-broker.sock');
+  const source = path.join(home, 'packages', 'sample', revision.slice(7));
+  await Promise.all([home, workspace, controlDir, source].map(directory => fs.mkdir(directory, { recursive: true, mode: 0o700 })));
+  await fs.mkdir(path.join(root, 'bin'), { mode: 0o700 });
+  const host = { cli: 'codex', isolation: 'isolated', agents: [{ name: 'tenant-a', toolsHome: home, workspace, controlDir, binDir: path.join(root, 'bin') }] };
+  await fs.writeFile(hostConfig, JSON.stringify(host) + '\n', { mode: 0o600 });
+  const realHost = await fs.realpath(hostConfig);
+  const realHome = await fs.realpath(home);
+  const realWorkspace = await fs.realpath(workspace);
+  const realControl = await fs.realpath(controlDir);
+  await fs.writeFile(path.join(home, 'config.json'), JSON.stringify({ schemaVersion: 1, workspace: realWorkspace, hostConfig: realHost }) + '\n', { mode: 0o600 });
+  const record = {
+    revision,
+    source,
+    project: `ezp-${hash(realHome).slice(0, 16)}-sample`,
+    manifest: { schemaVersion: 1, id: 'sample', version: '1.0.0', commands: { sample: { executable: 'client.mjs', args: [] } }, skills: [] },
+    deployment: { schemaVersion: 1, services: { sample: { buildTarget: 'runtime', volumes: {}, workspace: false, healthcheck: ['node', '--version'] } }, commands: { sample: { service: 'sample', argv: ['node', '/app/client.mjs'], suffix: [] } }, exports: {} },
+    compose: path.join(home, 'packages', 'sample', 'compose.json'),
+  };
+  await fs.writeFile(path.join(home, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: realHome, plugins: { sample: record }, commands: { sample: 'sample' } }) + '\n', { mode: 0o600 });
+  const fake = path.join(root, 'fake');
+  await fs.mkdir(fake, { mode: 0o700 });
+  await fs.writeFile(path.join(fake, 'docker'), `#!${process.execPath}
+const a=process.argv.slice(2);
+if(a.includes('loud'))process.stdout.write('x'.repeat(1024*1024+1));
+else if(a.includes('run'))process.stdout.write('broker-ok');
+`, { mode: 0o700 });
+  const control = new ControlStore(realControl, 1000);
+  await control.requestPairing(42, 42);
+  const owner = await control.approveOwner(42);
+  const run = await new RunStore(realControl).create({ id: 'r_broker', chatId: 42, telegramUserId: 42, texts: ['broker test'], ownerId: ownerId(owner), ownerEpoch: ownerEpoch(owner) });
+  await new RunStore(realControl).patch(run.id, { status: 'running' });
+  return { root, home: realHome, workspace: realWorkspace, controlDir: realControl, hostConfig: realHost, socket, runId: run.id, fake };
+}
+
+async function request(socketPath, payload) {
+  return new Promise((resolve, reject) => {
+    const socket = createConnection(socketPath);
+    let buffer = '';
+    socket.once('error', reject);
+    socket.on('data', chunk => {
+      buffer += chunk.toString();
+      const end = buffer.indexOf('\n');
+      if (end < 0) return;
+      try { resolve(JSON.parse(buffer.slice(0, end))); } catch (error) { reject(error); }
+      socket.destroy();
+    });
+    socket.on('connect', () => socket.end(JSON.stringify(payload) + '\n'));
+  });
+}
+
+async function waitForSocket(socketPath) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    try { if ((await fs.stat(socketPath)).isSocket()) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 5));
+  }
+  throw new Error('Broker socket did not start');
+}
+
+test('isolated broker authenticates an owned run, pins plugin revision, and writes receipts', async t => {
+  const f = await fixture(t);
+  const binding = await loadPluginBrokerBinding({ home: f.home, workspace: f.workspace, controlDir: f.controlDir, socket: f.socket, hostConfig: f.hostConfig, timeoutMs: 10_000 });
+  const previousPath = process.env.PATH;
+  process.env.PATH = f.fake + path.delimiter + previousPath;
+  const abort = new AbortController();
+  const serving = servePluginBroker(binding, abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    const published = JSON.parse(await fs.readFile(path.join(f.controlDir, 'plugin-broker-plugins.json'), 'utf8'));
+    assert.deepEqual(published.plugins, [{ id: 'sample', version: '1.0.0' }]);
+    const listed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list'] });
+    assert.equal(listed.ok, true);
+    assert.deepEqual(JSON.parse(listed.stdout), { sample: 'sample' });
+    const detailed = await request(f.socket, { version: 1, id: randomUUID(), operation: 'manager', runId: f.runId, args: ['tools', 'list', '--details'] });
+    assert.equal(detailed.ok, true);
+    assert.deepEqual(JSON.parse(detailed.stdout).sample.commands, ['ez sample --help']);
+    const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    assert.equal(resolved.ok, true);
+    assert.equal(resolved.revision, revision);
+    const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: resolved.capability, args: ['literal', '$(not-a-shell)'], stdin: 'input' });
+    assert.equal(invoked.ok, true);
+    assert.equal(invoked.stdout, 'broker-ok');
+    assert.equal(invoked.receipt.status, 'completed');
+    assert.deepEqual(JSON.parse(await fs.readFile(invoked.receiptPath, 'utf8')), invoked.receipt);
+    const replay = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: resolved.capability, args: [] });
+    assert.equal(replay.ok, false);
+    assert.match(replay.error, /capability/);
+    const loudResolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    const loud = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: loudResolved.capability, args: ['loud'] });
+    assert.equal(loud.ok, false);
+    assert.match(loud.error, /output limit/);
+    assert.equal(loud.receipt.status, 'failed');
+    const generated = JSON.parse(await fs.readFile(f.home + '/packages/sample/compose.json', 'utf8'));
+    assert.equal(generated.version, '3.8');
+  } finally {
+    abort.abort();
+    await serving;
+    process.env.PATH = previousPath;
+  }
+});
+
+test('broker rejects foreign agent bindings and unsafe management or request fields', async t => {
+  const f = await fixture(t);
+  const foreign = path.join(f.root, 'foreign');
+  const foreignHome = path.join(foreign, 'tools');
+  const foreignWorkspace = path.join(foreign, 'mind');
+  const foreignControl = path.join(foreign, 'control');
+  await Promise.all([foreignHome, foreignWorkspace, foreignControl].map(directory => fs.mkdir(directory, { recursive: true, mode: 0o700 })));
+  await fs.writeFile(path.join(foreignHome, 'config.json'), JSON.stringify({ schemaVersion: 1, workspace: await fs.realpath(foreignWorkspace), hostConfig: f.hostConfig }));
+  await fs.writeFile(path.join(foreignHome, 'registry.json'), JSON.stringify({ schemaVersion: 1, owner: await fs.realpath(foreignHome), plugins: {}, commands: {} }));
+  await assert.rejects(loadPluginBrokerBinding({ home: foreignHome, workspace: foreignWorkspace, controlDir: foreignControl, socket: path.join(foreignControl, 'plugin-broker.sock'), hostConfig: f.hostConfig }), /owned by exactly one isolated agent/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'install', 'sample', '--source', '/tmp/plugin'] }), /not allowed/);
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'uninstall', 'sample'] }, f.workspace));
+  const source = path.join(f.workspace, 'plugin-source');
+  await fs.mkdir(source);
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'catalog-add', 'sample', '--source', source, '--revision', revision] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['plugins', 'catalog-add', 'sample', '--source', '/tmp/plugin', '--revision', revision] }, f.workspace), /agent workspace/);
+  const candidate = path.join(source, 'candidate.tgz');
+  await fs.writeFile(candidate, 'candidate');
+  await assert.doesNotReject(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', candidate] }, f.workspace));
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--file', '/tmp/candidate.tgz'] }, f.workspace), /agent workspace/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'manager', runId: 'r_broker', args: ['updates', 'prepare', 'sample', '--version', '1.0.1'] }, f.workspace), /not allowed/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'short', args: [] }), /capability/);
+  await assert.rejects(validateBrokerRequest({ version: 1, id: randomUUID(), operation: 'invoke', runId: 'r_broker', alias: 'sample', revision, capability: 'a'.repeat(48), args: [], stdin: 'x'.repeat(1024 * 1024 + 1) }), /stdin/);
+});
+
+test('broker rejects resolve and invoke for a revoked run', async t => {
+  const f = await fixture(t);
+  const binding = await loadPluginBrokerBinding({ home: f.home, workspace: f.workspace, controlDir: f.controlDir, socket: f.socket, hostConfig: f.hostConfig, timeoutMs: 10_000 });
+  const abort = new AbortController();
+  const serving = servePluginBroker(binding, abort.signal);
+  try {
+    await waitForSocket(f.socket);
+    await new RunStore(f.controlDir).patch(f.runId, { status: 'cancelled' });
+    const resolved = await request(f.socket, { version: 1, id: randomUUID(), operation: 'resolve', runId: f.runId, alias: 'sample' });
+    assert.equal(resolved.ok, false);
+    const invoked = await request(f.socket, { version: 1, id: randomUUID(), operation: 'invoke', runId: f.runId, alias: 'sample', revision, capability: 'a'.repeat(64), args: [] });
+    assert.equal(invoked.ok, false);
+  } finally {
+    abort.abort();
+    await serving;
+  }
+});