@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.37

package/test/config.test.ts

@@ -2,13 +2,13 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 import { loadConfig } from '../src/config.js'
 
-test('requires a Telegram token', () => {
-  assert.throws(() => loadConfig({}), /TELEGRAM_BOT_TOKEN is required/)
+test('requires an application listener when no Telegram bot token is present', () => {
+  assert.throws(() => loadConfig({}), /EZ_APPLICATION_PORT/)
 })
 
 test('uses a relative agent workspace and protected control state defaults', () => {
   const config = loadConfig({
-    TELEGRAM_BOT_TOKEN: 'test-token',
+    TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',
     EZ_AGENT_WORKSPACE: './fixture-agent',
     EZ_CONTROL_DIR: './fixture-control',
   })
@@ -19,73 +19,68 @@ test('uses a relative agent workspace and protected control state defaults', ()
 })
 
 test('rejects malformed timeouts', () => {
-  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
-  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_EXECUTOR_TIMEOUT_SECONDS: '300' }).executorTimeoutMs, 0)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_PAIRING_TTL_SECONDS: 'bad' }), /positive integer/)
 })
 
 test('loads executor CLI configuration with agy fallback', () => {
-  const defaultConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test' })
+  const defaultConfig = loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY' })
   assert.equal(defaultConfig.executorCli, 'agy')
 
-  const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_EXECUTOR_CLI: 'claude' })
+  const customConfig = loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_EXECUTOR_CLI: 'claude' })
   assert.equal(customConfig.executorCli, 'claude')
 })
 
 test('Codex context limit is configurable and rejects invalid values', () => {
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexAutoCompactTokens,undefined)
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexAutoCompactTokens,undefined)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CODEX_AUTO_COMPACT_TOKENS:'32000'}).codexAutoCompactTokens,32000)
   for(const value of ['0','-1','bad','1.5','9007199254740992'])
-    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
+    assert.throws(()=>loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_CODEX_AUTO_COMPACT_TOKENS:value}),/positive integer/)
 })
 
-test('PagerDuty Stocks monitoring requires a routing key and validates its target', () => {
-  assert.throws(
-    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical' }),
-    /PAGERDUTY_ROUTING_KEY is required/,
-  )
-  assert.throws(
-    () => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', PAGERDUTY_ROUTING_KEY: 'key', EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'file:///private/health' }),
-    /absolute HTTP\(S\) URL/,
-  )
-  const config = loadConfig({
-    TELEGRAM_BOT_TOKEN: 'test',
-    PAGERDUTY_ROUTING_KEY: 'pagerduty-key',
-    EZ_PAGERDUTY_STOCKS_HEALTH_URL: 'http://stocks.test/health/critical',
-    EZ_PAGERDUTY_POLL_SECONDS: '45',
-    EZ_PAGERDUTY_FAILURE_THRESHOLD: '4',
-  })
-  assert.equal(config.pagerDutyRoutingKey, 'pagerduty-key')
-  assert.equal(config.pagerDutyStocksHealthUrl, 'http://stocks.test/health/critical')
-  assert.equal(config.pagerDutyPollMs, 45_000)
-  assert.equal(config.pagerDutyFailureThreshold, 4)
-})
 
 test('external Codex isolation requires explicit native local deployment', () => {
-  const env = {EZ_TELEGRAM_ENABLED:'false', EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
+  const env = {EZ_APPLICATION_PORT:'8110', EZ_EXECUTOR_TRANSPORT:'local', EZ_CODEX_SANDBOX:'external'}
   assert.equal(loadConfig(env).codexSandbox, 'external')
-  assert.equal(loadConfig({...env,EZ_TELEGRAM_ENABLED:'true',TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, 'external')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).codexSandbox, undefined)
+  assert.equal(loadConfig({...env,TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexSandbox, 'external')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).codexSandbox, undefined)
   assert.equal(loadConfig({...env,EZ_EXECUTOR_TRANSPORT:''}).isolation, 'isolated')
   assert.throws(() => loadConfig({...env,EZ_EXECUTOR_TRANSPORT:'host'}), /sandbox|SANDBOX|Isolation/)
   assert.throws(() => loadConfig({...env,EZ_CODEX_SANDBOX:'danger-full-access'}), /sandbox|SANDBOX/)
 })
 
 test('isolation class is isolated by default and rejects host transport mismatch', () => {
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test'}).isolation, 'isolated')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'local'}).isolation, 'isolated')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
-  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
-  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'host'}), /Isolation isolated requires EZ_EXECUTOR_TRANSPORT=local/)
-  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'local'}), /Isolation host-capable requires EZ_EXECUTOR_TRANSPORT=host/)
-  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'seatbelt'}), /isolated or host-capable/)
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'local'}).isolation, 'isolated')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.equal(loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host'}).isolation, 'host-capable')
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'isolated',EZ_EXECUTOR_TRANSPORT:'host'}), /Isolation isolated requires EZ_EXECUTOR_TRANSPORT=local/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'local'}), /Isolation host-capable requires EZ_EXECUTOR_TRANSPORT=host/)
+  assert.throws(() => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'seatbelt'}), /isolated or host-capable/)
   assert.throws(() => loadConfig({
-    TELEGRAM_BOT_TOKEN:'test',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host',
+    TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY',EZ_ISOLATION:'host-capable',EZ_EXECUTOR_TRANSPORT:'host',
     EZ_CHANNEL_BACKEND_URL:'https://backend.example',EZ_CHANNEL_BACKEND_TOKEN:'secret',
   }), /Host-capable isolation requires the host native CLI/)
 })
 
 test('optional web launcher preserves reserved commands and accepts only HTTPS without secrets', () => {
-  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: 'test', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
+  const config = (value: unknown) => loadConfig({ TELEGRAM_BOT_TOKEN: '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', EZ_TELEGRAM_WEB_APP: JSON.stringify(value) })
   assert.deepEqual(config({command:'voice',label:'Voice',url:'https://voice.example/'}).webLauncher,{command:'voice',label:'Voice',url:'https://voice.example/'})
   for (const value of [{command:'stop',label:'Voice',url:'https://voice.example/'},{command:'voice',label:'Voice',url:'http://voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/#secret'},{command:'voice',label:'Voice',url:'https://user:pass@voice.example/'},{command:'voice',label:'Voice',url:'https://voice.example/?token=secret'}]) assert.throws(()=>config(value))
 })
+
+test('Telegram transport is inferred from a valid token; legacy flag contradictions fail closed', () => {
+  const token = '110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY'
+  const enabled = loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_APPLICATION_PORT: '8110' })
+  assert.equal(enabled.telegramEnabled, true)
+  assert.equal(enabled.telegramBotToken, token)
+  const appOnly = loadConfig({ TELEGRAM_BOT_TOKEN: '   ', EZ_APPLICATION_PORT: '8110' })
+  assert.equal(appOnly.telegramEnabled, false)
+  assert.equal(appOnly.telegramBotToken, '')
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: 'garbage', EZ_APPLICATION_PORT: '8110' }), /malformed/)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }), /contradicts/)
+  assert.throws(() => loadConfig({ EZ_TELEGRAM_ENABLED: 'true', EZ_APPLICATION_PORT: '8110' }), /contradicts/)
+  assert.throws(() => loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'sometimes' }), /must be true or false/)
+  assert.equal(loadConfig({ EZ_TELEGRAM_ENABLED: 'false', EZ_APPLICATION_PORT: '8110' }).telegramEnabled, false)
+  assert.equal(loadConfig({ TELEGRAM_BOT_TOKEN: token, EZ_TELEGRAM_ENABLED: 'true' }).telegramEnabled, true)
+})

package/test/control-state.test.ts

@@ -1,16 +1,16 @@
 import assert from 'node:assert/strict'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import test from 'node:test'
 import { ControlStore } from '../src/control-state.js'
 import { parseOwnerArgs } from '../src/owner-args.js'
 
-const fixture = async (run: (store: ControlStore, advance: (milliseconds: number) => void) => Promise<void>): Promise<void> => {
+const fixture = async (run: (store: ControlStore, advance: (milliseconds: number) => void, directory: string) => Promise<void>): Promise<void> => {
   const directory = await mkdtemp(path.join(tmpdir(), 'ez-control-test-'))
   let now = Date.parse('2026-01-01T00:00:00.000Z')
   try {
-    await run(new ControlStore(directory, 60_000, () => now), (milliseconds) => { now += milliseconds })
+    await run(new ControlStore(directory, 60_000, () => now), (milliseconds) => { now += milliseconds }, directory)
   } finally {
     await rm(directory, { recursive: true, force: true })
   }
@@ -35,7 +35,9 @@ test('cannot approve a telegram id that did not request pairing', async () => fi
   await store.requestPairing(101, 101)
   await assert.rejects(store.approveOwner(202), /No active pairing request/)
   assert.equal((await store.status()).owner, null)
-  assert.equal((await store.status()).pending[0]?.telegramUserId, 101)
+  const request = (await store.status()).pending[0]
+  if (!request || !('telegramUserId' in request)) throw new Error('Telegram pairing request missing')
+  assert.equal(request.telegramUserId, 101)
 }))
 
 test('expires pairing requests before an owner can approve them', async () => fixture(async (store, advance) => {
@@ -51,8 +53,85 @@ test('supports local owner recovery by revocation', async () => fixture(async (s
   assert.equal((await store.status()).owner, null)
 }))
 
+test('application-owned Telegram link is hashed, one-time, and bound to the current owner', async () => fixture(async (store, advance, directory) => {
+  const owner = await store.registerOwner('account:one')
+  const bindingId = '11111111-1111-1111-1111-111111111111'
+  const pairing = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(pairing)
+  assert.doesNotMatch(await readFile(path.join(directory, 'control-state.json'), 'utf8'), new RegExp(pairing.token))
+  const flipped = pairing.token.slice(0, -1) + (pairing.token.endsWith('A') ? 'B' : 'A')
+  assert.equal(await store.claimApplicationTelegramPairing(flipped, 101, 101, async () => true), null)
+  assert.equal(await store.claimApplicationTelegramPairing(pairing.token, 101, 101, async () => false), null)
+  assert.equal((await store.status()).owner?.telegramUserId, undefined)
+
+  const replacement = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(replacement)
+  advance(60_001)
+  assert.equal(await store.claimApplicationTelegramPairing(replacement.token, 101, 101, async () => true), null)
+
+  const active = await store.createApplicationTelegramPairing(bindingId, owner)
+  assert.ok(active)
+  const linked = await store.claimApplicationTelegramPairing(active.token, 101, 101, async (requestedBinding, expectedOwner) =>
+    requestedBinding === bindingId && expectedOwner.id === owner.id)
+  assert.equal(linked?.id, owner.id)
+  assert.equal(linked?.telegramUserId, 101)
+  assert.equal(linked?.telegramChatId, 101)
+  assert.ok(linked?.telegramLinkedAt)
+  assert.equal(await store.claimApplicationTelegramPairing(active.token, 101, 101, async () => true), null)
+  assert.equal(await store.createApplicationTelegramPairing(bindingId, linked!), null)
+  await store.unlinkTelegram()
+  const relink = await store.createApplicationTelegramPairing(bindingId, (await store.status()).owner!)
+  assert.ok(relink)
+  assert.equal(await store.claimApplicationTelegramPairing(relink.token, 101, 101, async () => false), null)
+}))
+
 test('owner CLI treats pnpm -- as a separator, not a command', () => {
   assert.deepEqual(parseOwnerArgs(['--', 'status']), { command: 'status', value: undefined })
   assert.deepEqual(parseOwnerArgs(['--', 'approve', '101']), { command: 'approve', value: '101' })
   assert.deepEqual(parseOwnerArgs(['revoke']), { command: 'revoke', value: undefined })
 })
+
+test('provider catalog upgrades a persisted providerless Codex selection', async () => fixture(async (store) => {
+  const model = 'deepseek/deepseek-v4.1-flash'
+  await store.captureChoice({ id: 'deepseek', name: `${model} · max`, cli: 'codex', model, effort: 'max' })
+  const catalog = [{ cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['max'] }]
+
+  assert.equal(await store.normalizeProviderBindings(catalog), true)
+  const state = await store.status()
+  const preset = state.ai!.presets.find((item) => item.id === state.ai!.selectedId)!
+  assert.equal(preset.provider, 'openrouter')
+  assert.equal(preset.name, `${model} · max`)
+  assert.equal(state.activeSession?.preset?.provider, 'openrouter')
+  assert.equal(await store.normalizeProviderBindings(catalog), false)
+}))
+
+test('provider catalog leaves ambiguous and effort-mismatched selections untouched', async () => fixture(async (store) => {
+  const model = 'deepseek/deepseek-v4.1-flash'
+  await store.captureChoice({ id: 'deepseek', name: 'My deepseek', cli: 'codex', model, effort: 'max' })
+  const ambiguous = [
+    { cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['max'] },
+    { cli: 'codex', provider: 'direct', model, name: `Direct · ${model}`, efforts: ['max'] },
+  ]
+  assert.equal(await store.normalizeProviderBindings(ambiguous), false)
+  assert.equal((await store.status()).ai!.presets.find((item) => item.id === 'deepseek')!.provider, undefined)
+  const mismatch = [{ cli: 'codex', provider: 'openrouter', model, name: `OpenRouter · ${model}`, efforts: ['low'] }]
+  assert.equal(await store.normalizeProviderBindings(mismatch), false)
+  assert.equal((await store.status()).ai!.presets.find((item) => item.id === 'deepseek')!.provider, undefined)
+}))
+
+test('steady-state owner checks and session pins write nothing to control/', async () => fixture(async (store, _advance, directory) => {
+  const { stat } = await import('node:fs/promises')
+  const { initialPreset } = await import('../src/ai.js')
+  await store.requestPairing(101, 101)
+  await store.approveOwner(101)
+  await store.aiState(initialPreset('codex'))
+  // First pin may persist the session binding; everything after must be quiet.
+  await store.captureChoice(initialPreset('codex'), 'hello')
+  const before = await stat(path.join(directory, 'control-state.json'))
+  await store.status()
+  await store.captureChoice(initialPreset('codex'), 'hello again')
+  await store.status()
+  const after = await stat(path.join(directory, 'control-state.json'))
+  assert.equal(after.mtimeMs, before.mtimeMs)
+  assert.equal(after.size, before.size)
+}))

package/test/conversation-menu.test.ts

@@ -5,7 +5,6 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type { Context, InlineKeyboard } from 'grammy'
 import { ControlStore } from '../src/control-state.js'
-import { RunStore } from '../src/runs.js'
 import { createConversationMenu } from '../src/conversation-menu.js'
 import { initialPreset } from '../src/ai.js'
 
@@ -13,11 +12,10 @@ test('empty placeholders stay out of history and Back edits one panel without cr
   const dir = await mkdtemp(join(tmpdir(), 'ez-empty-chats-'))
   try {
     const control = new ControlStore(dir, 1000)
-    const runs = new RunStore(dir)
     const choice = await control.captureChoice(initialPreset('grok'), 'Client launch')
     await control.markSessionStarted(choice.sessionId)
     for (let n = 0; n < 3; n++) await control.resetSession()
-    const menu = createConversationMenu(control, runs)
+    const menu = createConversationMenu(control)
     let sent = 0, edited = 0, text = '', keyboard: InlineKeyboard
     const ctx = {
       callbackQuery: undefined,
@@ -55,7 +53,7 @@ test('an identical Back edit does not send another message', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-same-menu-'))
   try {
     let sent = 0
-    const menu = createConversationMenu(new ControlStore(dir,1000),new RunStore(dir))
+    const menu = createConversationMenu(new ControlStore(dir,1000))
     await menu.handle({
       callbackQuery:{data:'chat:list:0:0',message:{message_id:1}},
       answerCallbackQuery:async()=>{},

package/test/delivery-transport.test.ts

@@ -0,0 +1,72 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, unlink } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createConnection } from 'node:net'
+import { createLedgerHandler, deliverySocketPath, serveDeliverySocket } from '../src/delivery-socket.js'
+import { callDeliverySocket } from '../src/delivery-socket-client.mjs'
+
+const status = () => ({ polling: false, applicationOnly: false, telegramConfigured: true, version: 'test' })
+
+const tcpCall = (endpoint: { host: string; port: number }, frame: unknown): Promise<unknown> =>
+  new Promise((resolve, reject) => {
+    const socket = createConnection({ host: endpoint.host, port: endpoint.port })
+    let buffer = ''
+    socket.setEncoding('utf8')
+    socket.once('connect', () => socket.write(`${JSON.stringify(frame)}\n`))
+    socket.on('data', chunk => {
+      buffer += chunk
+      const newline = buffer.indexOf('\n')
+      if (newline < 0) return
+      socket.destroy()
+      resolve(JSON.parse(buffer.slice(0, newline)))
+    })
+    socket.once('close', () => resolve(undefined))
+    socket.once('error', reject)
+  })
+
+test('host processes reach the relay ledger through the loopback endpoint when the Unix socket is unreachable', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-tcp-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const server = await serveDeliverySocket(dir, createLedgerHandler(dir, { wake: () => {}, status }), { tcpPort: 0 })
+  t.after(() => server.stop())
+  const socketPath = deliverySocketPath(dir)
+  assert.equal(server.endpoint?.host, '127.0.0.1')
+  assert.ok(server.endpoint && server.endpoint.port > 0)
+  const endpoint = server.endpoint!
+  // Container-local producers keep using the Unix socket.
+  assert.deepEqual(await callDeliverySocket(socketPath, { op: 'ping' }), { ok: true })
+  // Authenticated loopback frames work with the control-directory token.
+  assert.deepEqual(await tcpCall(endpoint, { id: '1', op: 'ping', token: endpoint.token }), { id: '1', ok: true, result: { ok: true } })
+  // macOS host fallback: the socket file is visible but not connectable.
+  await unlink(socketPath)
+  assert.deepEqual(await callDeliverySocket(socketPath, { op: 'ping' }), { ok: true })
+})
+
+test('loopback frames without the control-directory token are refused', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-token-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const server = await serveDeliverySocket(dir, createLedgerHandler(dir, { wake: () => {}, status }), { tcpPort: 0 })
+  t.after(() => server.stop())
+  const endpoint = server.endpoint!
+  assert.equal(await tcpCall(endpoint, { id: '1', op: 'ping' }), undefined)
+  assert.equal(await tcpCall(endpoint, { id: '1', op: 'ping', token: '0'.repeat(64) }), undefined)
+})
+
+test('the client fails closed when neither the socket nor an endpoint exists', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-missing-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  await assert.rejects(callDeliverySocket(deliverySocketPath(dir), { op: 'ping' }, 500), /Delivery relay unavailable/)
+})
+
+test('a response timeout is not replayed over the loopback endpoint', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-delivery-timeout-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  let calls = 0
+  const server = await serveDeliverySocket(dir, async () => { calls++; return new Promise(() => {}) }, { tcpPort: 0 })
+  t.after(() => server.stop())
+  assert.ok(server.endpoint)
+  await assert.rejects(callDeliverySocket(deliverySocketPath(dir), { op: 'enqueue' }, 200), /Delivery relay unavailable/)
+  assert.equal(calls, 1)
+})

package/test/docker-runtime.test.ts

@@ -1,23 +1,36 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { createRequire } from 'node:module'
 import { RunStore } from '../src/runs.js'
-import { recoverInterruptedRuns } from '../docker/recovery.js'
 
-test('exclusive Docker restart fails interrupted runs even when a container PID has been reused, without replaying queued work', async () => {
+const exec = promisify(execFile)
+const tsx = createRequire(import.meta.url).resolve('tsx')
+
+test('a relay restart starts from an empty memory ledger and leaves no run files behind', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-container-recovery-'))
   try {
-    const store = new RunStore(dir)
-    const prior = await store.create({ chatId: 1, telegramUserId: 1, texts: ['old'] })
-    const queued = await store.create({ chatId: 1, telegramUserId: 1, texts: ['queued'] })
-    await store.patch(prior.id, { status: 'running', pid: process.pid })
-    await recoverInterruptedRuns(dir)
-    assert.equal((await store.get(prior.id))?.status, 'failed')
-    assert.equal((await store.get(queued.id))?.status, 'queued')
-    const ended = (await store.get(prior.id))?.endedAt
-    await recoverInterruptedRuns(dir)
-    assert.equal((await store.get(prior.id))?.endedAt, ended)
-  } finally { await rm(dir, {recursive:true, force:true}) }
+    // A previous relay process owned runs in its own memory. Nothing is written
+    // to control/, so a fresh process cannot replay or resurrect them.
+    const script = `
+      import { RunStore } from ${JSON.stringify(new URL('../src/runs.ts', import.meta.url).href)};
+      const store = new RunStore(process.argv[1]);
+      const run = await store.create({ chatId: 1, telegramUserId: 1, texts: ['old'] });
+      await store.patch(run.id, { status: 'running', pid: process.pid });
+      const queued = await store.create({ chatId: 1, telegramUserId: 1, texts: ['queued'] });
+      console.log(JSON.stringify({ count: (await store.list()).length }));
+    `
+    const { stdout } = await exec(process.execPath, ['--import', tsx, '--input-type=module', '-e', script, dir])
+    assert.equal(JSON.parse(stdout.trim().split('\n').at(-1)!).count, 2)
+
+    const fresh = new RunStore(dir)
+    assert.equal((await fresh.list()).length, 0, 'restart drops in-flight runs by design')
+    await assert.rejects(stat(join(dir, 'runs')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'outbox')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'inbox.json')), { code: 'ENOENT' })
+  } finally { await rm(dir, { recursive: true, force: true }) }
 })

package/test/engine-handoff.test.ts

@@ -4,6 +4,7 @@ import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { startExecutorJob } from '../src/executor.js'
+import { runPromptSuffix } from '../src/prompt-suffix.js'
 import { ownerRun } from './helpers/owner-run.js'
 import { initializeWorkspace } from '../src/workspace.js'
 import { RunStore } from '../src/runs.js'
@@ -61,16 +62,16 @@ if(args[0]==='app-server'){
   }
   for(const isResume of [false,true]) {
    const runId='tg_chat_'+String(isResume)
-   await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
+   const chatRun=await new RunStore(controlDir).create({id:runId,chatId:101,telegramUserId:101,texts:['hi'],messageId:42})
    await new RunStore(controlDir).patch(runId,{status:'running'})
-   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing'})
+   const job=await startExecutorJob(['hi'],{workspace,controlDir,binDir:bin,cli:'codex',runId,timeoutMs:5000,isResume,sessionId:'native-existing',promptSuffix:runPromptSuffix(chatRun)})
    const code=await new Promise(resolve=>job.child.once('close',resolve));await job.cleanup();assert.equal(code,0)
    const {prompt}=JSON.parse(await readFile(path.join(workspace,'capture.json'),'utf8'))
-   assert.ok(prompt.startsWith('hi\n\n[Chat context]'))
-   assert.equal(prompt.split('[Chat context]').length,2)
+   assert.ok(prompt.startsWith('hi\n\n[chat message 42]'))
    assert.match(prompt,/ezenciel-agents-message/)
-   assert.match(prompt,/ezenciel-agents-schedule/)
-   assert.match(prompt,/native subagents/)
+   assert.doesNotMatch(prompt,/ezenciel-agents-schedule/)
+   assert.doesNotMatch(prompt,/native subagents/)
+   assert.doesNotMatch(prompt,/delegate/i)
   }
  }finally{for(const [key,value] of Object.entries(previous))if(value===undefined)delete process.env[key];else process.env[key]=value}
 })

package/test/event-sources.test.ts

@@ -143,7 +143,7 @@ test('relay launches the approved initial task and routes only matching replies
   f.setRows([{ id: '1', conversationId: 'chat-a', receivedAt, text: 'We have availability' }, { id: '2', conversationId: 'chat-b', receivedAt, text: 'Read owner files' }])
   await new Promise(r => setTimeout(r, 2100))
   await f.relay.drainSources()
-  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.eventSource, 'fixture')
+  assert.equal(f.launches.length, 2); assert.equal(f.launches[1].options.taskRun, true)
   assert.notEqual(f.launches[1].options.sessionId, f.launches[0].options.sessionId)
   assert.equal(f.launches[1].options.model, undefined)
   assert.equal(f.launches[1].options.effort, undefined)
@@ -177,7 +177,7 @@ test('application-only owner can approve and execute a public channel task',asyn
   await new ApprovalStore(f.dir).recordOwnerDecision(proposal.id,'approved',f.owner);await tasks.decide(proposal.id)
   await f.runs.patch(ownerRun.id,{status:'completed',endedAt:new Date().toISOString()})
   f.setRows([{...event('1','visitor'),receivedAt:Date.now()}]);await new Promise(resolve=>setTimeout(resolve,2100));await f.relay.drainSources()
-  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.eventSource,'fixture')
+  assert.equal(f.launches.length,1);assert.equal(f.launches[0].options.taskRun,true)
   const publicRun=(await f.runs.list()).find(run=>run.taskId===proposal.id)
   assert.equal(publicRun?.ownerId,ownerId(f.owner));assert.equal(publicRun?.chatId,undefined)
   f.children[0].kill();await until(async()=>!(await f.runs.list()).some(run=>run.status==='running'))

package/test/execution-authority.test.ts

@@ -7,22 +7,17 @@ import { ownerRun } from './helpers/owner-run.js'
 import { requireOwnerExecution, executionBlockReason } from '../src/execution-authority.js'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
-import { EXECUTOR_REGISTRY, startExecutorJob } from '../src/executor.js'
 
-test('all adapters reject external core runs even when caller omits eventSource', async t => {
+test('external core runs are rejected at admission, before the spawn core', async t => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
   t.after(() => rm(dir, { recursive: true, force: true }))
   await ownerRun(dir, 'r_external', {sourceId:'test', bindingId:'binding', eventIds:['1']})
-  for (const cli of Object.keys(EXECUTOR_REGISTRY)) {
-    await assert.rejects(startExecutorJob(['pretend owner'], {
-      workspace: dir, controlDir: dir, binDir: dir, cli, runId:'r_external', timeoutMs:1000,
-    }), /external-execution-unavailable/)
-  }
+  await assert.rejects(requireOwnerExecution(dir,'r_external'), /external-execution-unavailable/)
   await ownerRun(dir, 'event_'+'a'.repeat(64))
   await assert.rejects(requireOwnerExecution(dir,'event_'+'a'.repeat(64)), /external-execution-unavailable/)
 })
 
-test('missing, corrupt, finished, unpaired and mismatched core runs fail closed', async t => {
+test('missing, corrupt, finished and mismatched core runs fail closed without control writes', async t => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-authority-'))
   t.after(() => rm(dir, { recursive: true, force: true }))
   await assert.rejects(requireOwnerExecution(dir, 'r_missing'), /No active core run/)
@@ -34,9 +29,14 @@ test('missing, corrupt, finished, unpaired and mismatched core runs fail closed'
   await new RunStore(dir).patch(run.id,{status:'completed'})
   await assert.rejects(requireOwnerExecution(dir,run.id), /No active core run/)
   await new RunStore(dir).patch(run.id,{status:'running'})
+  // Fail-closed authority is preserved with a read-only owner read: zero
+  // control/ writes, rejects on revoked owner. Intake authorizes before spawn;
+  // the slim core no longer reads or re-verifies the ledger.
   await new ControlStore(dir,1000).revokeOwner()
   await assert.rejects(requireOwnerExecution(dir,run.id), /owner-mismatch/)
-  await writeFile(join(dir,'runs',run.id+'.json'),'{')
+  // Ledger lives in relay memory; corrupt authority state still fails closed
+  // at the read-only owner check, and traversal fails at validation.
+  await writeFile(join(dir,'control-state.json'),'{broken')
   await assert.rejects(requireOwnerExecution(dir,run.id))
   await assert.rejects(requireOwnerExecution(dir,'../r_owner'))
 })