@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.37

package/test/executor.test.ts

@@ -6,7 +6,8 @@ import { mkdtemp, mkdir, rm, writeFile, readFile } from 'node:fs/promises'
 import { spawn } from 'node:child_process'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
-import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeInvocation, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
+import { EXECUTOR_REGISTRY, antigravityInvocation, executorEnvironment, grokInvocation, grokJobEnv, opencodeDataHome, opencodeInvocation, piAgentDir, resolveExecutor, resolveHostCommand, startExecutorJob, terminateJob, validateCodexProvider } from '../src/executor.js'
+import { requireOwnerExecution } from '../src/execution-authority.js'
 import { splitTelegramText } from '../src/reply.js'
 import { matchingProcessIds, processSnapshot } from '../src/process-tree.js'
 
@@ -60,10 +61,9 @@ test('native CLIs resolve from the host PATH, not a relative package name', () =
 })
 
 test('the executor receives a deliberately small environment', () => {
-  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', PAGERDUTY_ROUTING_KEY: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
+  const environment = executorEnvironment({ PATH: '/bin', HOME: '/tmp/home', TELEGRAM_BOT_TOKEN: 'secret', AWS_SECRET_ACCESS_KEY: 'secret' })
   assert.deepEqual(environment, { PATH: '/bin', HOME: '/tmp/home' })
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
-  assert.ok(!('PAGERDUTY_ROUTING_KEY' in environment))
 })
 
 test('the Grok job env binds the run and still strips the bot token', () => {
@@ -73,6 +73,7 @@ test('the Grok job env binds the run and still strips the bot token', () => {
   )
   assert.equal(environment.EZ_RUN_ID, 'r_1')
   assert.equal(environment.EZ_CONTROL_DIR, '/tmp/control')
+  assert.equal(environment.EZ_DELIVERY_SOCKET, '/tmp/control/delivery.sock')
   assert.match(environment.PATH ?? '', /^\/tmp\/bin/)
   assert.ok(!('TELEGRAM_BOT_TOKEN' in environment))
 })
@@ -124,6 +125,7 @@ test('resolveExecutor correctly maps keys and aliases', () => {
   assert.equal(resolveExecutor('grok').command, 'grok')
   assert.equal(resolveExecutor('opencode').command, 'opencode')
   assert.equal(resolveExecutor('oc').command, 'opencode')
+  assert.throws(() => resolveExecutor('unreal-agent'), /Unsupported executor CLI/)
   assert.equal(resolveExecutor('codex-gui').name, 'codex-gui')
   assert.notEqual(resolveExecutor('codex-gui').name, resolveExecutor('codex').name)
   assert.equal(resolveExecutor(undefined).command, 'agy')
@@ -171,11 +173,119 @@ test('Codex custom providers use declared runtime state and an environment key r
   assert.ok(args.includes('google/gemini-3.8-flash'))
   assert.equal(JSON.stringify(args).includes('provider-secret'),false)
   assert.throws(()=>validateCodexProvider({...provider,envKey:'TELEGRAM-BOT'}),/environment key/)
-  for (const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN','PAGERDUTY_ROUTING_KEY'])
+  for (const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN'])
     assert.throws(()=>validateCodexProvider({...provider,envKey}),/Reserved/)
   assert.throws(()=>validateCodexProvider({...provider,models:[]}),/provider models/)
 })
 
+test('opencode jobs use the agent-bound data home only when its auth binding exists', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-opencode-auth-'));t.after(()=>rm(root,{recursive:true,force:true}))
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'opencode'),`#!${process.execPath}\nconst fs=require('fs');fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),xdg:process.env.XDG_DATA_HOME,telegram:process.env.TELEGRAM_BOT_TOKEN}));`,{mode:0o755})
+  assert.equal(opencodeDataHome(root),undefined)
+  await mkdir(path.join(root,'cli','opencode'),{recursive:true})
+  assert.equal(opencodeDataHome(root),undefined)
+  await writeFile(path.join(root,'cli','opencode','auth.json'),'{}',{mode:0o600})
+  assert.equal(opencodeDataHome(root),path.join(root,'cli'))
+  const prior={path:process.env.PATH,telegram:process.env.TELEGRAM_BOT_TOKEN,transport:process.env.EZ_EXECUTOR_TRANSPORT}
+  const launch=async(runId:string)=>{
+    await ownerRun(root,runId)
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.TELEGRAM_BOT_TOKEN='relay-secret';delete process.env.EZ_EXECUTOR_TRANSPORT
+    const job=await startExecutorJob(['hello'],{workspace:root,controlDir:root,binDir:bin,runId,timeoutMs:0,cli:'opencode',model:'opencode-go/muse-spark-1.3-contributor',effort:'xhigh'})
+    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+    return JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+  }
+  try {
+    const bound=await launch('r_ocbound')
+    assert.equal(bound.xdg,path.join(root,'cli'))
+    assert.equal(bound.telegram,undefined)
+    assert.equal(bound.args[bound.args.indexOf('-m')+1],'opencode-go/muse-spark-1.3-contributor')
+    assert.equal(bound.args[bound.args.indexOf('--variant')+1],'xhigh')
+    await rm(path.join(root,'cli','opencode','auth.json'))
+    const free=await launch('r_ocfree')
+    assert.equal(free.xdg,undefined)
+    assert.equal(free.telegram,undefined)
+  } finally {
+    if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
+    if(prior.telegram===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=prior.telegram
+    if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
+  }
+})
+
+test('pi jobs use the agent-bound config dir only when its auth binding exists', async t => {
+  const root=await mkdtemp(path.join(tmpdir(),'ez-pi-auth-'));t.after(()=>rm(root,{recursive:true,force:true}))
+  const bin=path.join(root,'bin');await mkdir(bin)
+  await writeFile(path.join(bin,'pi'),`#!${process.execPath}\nconst fs=require('fs');fs.writeFileSync(${JSON.stringify(path.join(root,'observed.json'))},JSON.stringify({args:process.argv.slice(2),agentDir:process.env.PI_CODING_AGENT_DIR,telegram:process.env.TELEGRAM_BOT_TOKEN}));`,{mode:0o755})
+  assert.equal(piAgentDir(root),undefined)
+  await mkdir(path.join(root,'cli','pi','agent'),{recursive:true})
+  assert.equal(piAgentDir(root),undefined)
+  await writeFile(path.join(root,'cli','pi','agent','auth.json'),'{}',{mode:0o600})
+  assert.equal(piAgentDir(root),path.join(root,'cli','pi','agent'))
+  const prior={path:process.env.PATH,telegram:process.env.TELEGRAM_BOT_TOKEN,transport:process.env.EZ_EXECUTOR_TRANSPORT,agentDir:process.env.PI_CODING_AGENT_DIR}
+  const launch=async(runId:string)=>{
+    await ownerRun(root,runId)
+    process.env.PATH=bin+path.delimiter+prior.path;process.env.TELEGRAM_BOT_TOKEN='relay-secret';delete process.env.EZ_EXECUTOR_TRANSPORT;delete process.env.PI_CODING_AGENT_DIR
+    const job=await startExecutorJob(['hello'],{workspace:root,controlDir:root,binDir:bin,runId,timeoutMs:0,cli:'pi',model:'opencode-go/muse-spark-1.3-contributor',effort:'xhigh'})
+    assert.equal(await new Promise(resolve=>job.child.once('close',resolve)),0);await job.cleanup()
+    return JSON.parse(await readFile(path.join(root,'observed.json'),'utf8'))
+  }
+  try {
+    const bound=await launch('r_pibound')
+    assert.equal(bound.agentDir,path.join(root,'cli','pi','agent'))
+    assert.equal(bound.telegram,undefined)
+    assert.equal(bound.args[bound.args.indexOf('--model')+1],'opencode-go/muse-spark-1.3-contributor')
+    assert.equal(bound.args[bound.args.indexOf('--thinking')+1],'xhigh')
+    await rm(path.join(root,'cli','pi','agent','auth.json'))
+    const free=await launch('r_pifree')
+    assert.equal(free.agentDir,undefined)
+    assert.equal(free.telegram,undefined)
+    // Owner-provisioned delivery skill loads by path; absence keeps prior args.
+    assert.ok(!bound.args.includes('--skill'))
+    await mkdir(path.join(root,'cli','pi','skills','ez-delivery'),{recursive:true})
+    await writeFile(path.join(root,'cli','pi','skills','ez-delivery','SKILL.md'),'# delivery',{mode:0o644})
+    const skilled=await launch('r_piskilled')
+    assert.equal(skilled.args[skilled.args.indexOf('--skill')+1],path.join(root,'cli','pi','skills','ez-delivery'))
+  } finally {
+    if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
+    if(prior.telegram===undefined)delete process.env.TELEGRAM_BOT_TOKEN;else process.env.TELEGRAM_BOT_TOKEN=prior.telegram
+    if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport
+    if(prior.agentDir===undefined)delete process.env.PI_CODING_AGENT_DIR;else process.env.PI_CODING_AGENT_DIR=prior.agentDir
+  }
+})
+
+test('the pi invocation pins control sessions, model, and thinking level', () => {
+  assert.equal(resolveExecutor('pi').command, 'pi')
+  const args = EXECUTOR_REGISTRY.pi.buildArgs(
+    { workspace: '/agent/mind', controlDir: '/agent/control', sessionId: 'ez-session', isResume: true, model: 'opencode-go/muse-spark-1.3-contributor', effort: 'xhigh' },
+    '/prompt', 'review CAMT')
+  assert.deepEqual(args, ['-p', '--mode', 'json', '--session-dir', '/agent/control/cli/pi/sessions', '--session-id', 'ez-session',
+    '--model', 'opencode-go/muse-spark-1.3-contributor', '--thinking', 'xhigh', '--', 'review CAMT'])
+  const other = EXECUTOR_REGISTRY.pi.buildArgs({ workspace: '/agent/mind', controlDir: '/agent/control', sessionId: 'other-session', isResume: true }, '/prompt', 'other')
+  assert.equal(other[other.indexOf('--session-id') + 1], 'other-session')
+  assert.ok(!other.includes('--continue'))
+  assert.throws(() => EXECUTOR_REGISTRY.pi.buildArgs({ workspace: '/agent' }, '/prompt', 'hi'), /bound control directory/)
+})
+
+test('pi jobs run with control-bound sessions and no secret leakage', async t => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-pi-auth-')); t.after(() => rm(root, { recursive: true, force: true }))
+  const bin = path.join(root, 'bin'); await mkdir(bin)
+  await writeFile(path.join(bin, 'pi'), `#!${process.execPath}\nconst fs=require('fs');fs.writeFileSync(${JSON.stringify(path.join(root, 'observed.json'))},JSON.stringify({args:process.argv.slice(2),telegram:process.env.TELEGRAM_BOT_TOKEN}));`, { mode: 0o755 })
+  const prior = { path: process.env.PATH, telegram: process.env.TELEGRAM_BOT_TOKEN, transport: process.env.EZ_EXECUTOR_TRANSPORT }
+  try {
+    await ownerRun(root, 'r_pibound')
+    process.env.PATH = bin + path.delimiter + prior.path; process.env.TELEGRAM_BOT_TOKEN = 'relay-secret'; delete process.env.EZ_EXECUTOR_TRANSPORT
+    const job = await startExecutorJob(['review CAMT'], { workspace: root, controlDir: root, binDir: bin, runId: 'r_pibound', timeoutMs: 0, cli: 'pi', model: 'opencode-go/muse-spark-1.3-contributor', effort: 'xhigh' })
+    assert.equal(await new Promise(resolve => job.child.once('close', resolve)), 0); await job.cleanup()
+    const observed = JSON.parse(await readFile(path.join(root, 'observed.json'), 'utf8'))
+    assert.deepEqual(observed.args, ['-p', '--mode', 'json', '--session-dir', path.join(root, 'cli', 'pi', 'sessions'),
+      '--model', 'opencode-go/muse-spark-1.3-contributor', '--thinking', 'xhigh', '--', 'review CAMT'])
+    assert.equal(observed.telegram, undefined)
+  } finally {
+    if (prior.path === undefined) delete process.env.PATH; else process.env.PATH = prior.path
+    if (prior.telegram === undefined) delete process.env.TELEGRAM_BOT_TOKEN; else process.env.TELEGRAM_BOT_TOKEN = prior.telegram
+    if (prior.transport === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT; else process.env.EZ_EXECUTOR_TRANSPORT = prior.transport
+  }
+})
 test('a configured Codex provider receives only its declared key and runtime selection', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-codex-provider-'));t.after(()=>rm(root,{recursive:true,force:true}))
   const bin=path.join(root,'bin');await mkdir(bin)
@@ -230,21 +340,19 @@ test('external Codex isolation cannot launch host runs', async t => {
   const root = await mkdtemp(path.join(tmpdir(), 'ez-external-sandbox-'))
   t.after(() => rm(root,{recursive:true,force:true}))
   await ownerRun(root,'r_sandbox')
-  const previous = {transport:process.env.EZ_EXECUTOR_TRANSPORT,telegram:process.env.EZ_TELEGRAM_ENABLED}
+  const previous = process.env.EZ_EXECUTOR_TRANSPORT
   try {
-    process.env.EZ_TELEGRAM_ENABLED='false'
     for (const transport of ['host','']) {
       process.env.EZ_EXECUTOR_TRANSPORT=transport
       await assert.rejects(startExecutorJob(['Hello'],{workspace:root,controlDir:root,binDir:root,runId:'r_sandbox',timeoutMs:0,cli:'codex',codexSandbox:'external'}), /owner-authorized native local/)
     }
   } finally {
-    for (const [key,value] of [['EZ_EXECUTOR_TRANSPORT',previous.transport],['EZ_TELEGRAM_ENABLED',previous.telegram]]) {
-      if (value === undefined) delete process.env[key!]; else process.env[key!]=value
-    }
+    if (previous === undefined) delete process.env.EZ_EXECUTOR_TRANSPORT
+    else process.env.EZ_EXECUTOR_TRANSPORT=previous
   }
 })
 
-test('external local owner chat preserves authorization and literal input', async t => {
+test('external local owner chat preserves literal input and admission rejects foreign or restricted runs', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-external-owner-'))
   t.after(()=>rm(root,{recursive:true,force:true}))
   const prior={path:process.env.PATH,transport:process.env.EZ_EXECUTOR_TRANSPORT}
@@ -264,10 +372,10 @@ test('external local owner chat preserves authorization and literal input', asyn
     const runs=new RunStore(root)
     await runs.create({id:'r_foreign',chatId:999,telegramUserId:999,texts:['no']})
     await runs.patch('r_foreign',{status:'running'})
-    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_foreign'}),/blocked|owner/i)
+    await assert.rejects(requireOwnerExecution(root,'r_foreign'),/blocked: owner-mismatch/i)
     await runs.create({id:'r_restricted',chatId:101,telegramUserId:101,texts:['no'],taskId:'task_'+'a'.repeat(32)})
     await runs.patch('r_restricted',{status:'running'})
-    await assert.rejects(startExecutorJob(['no'],{...opts,runId:'r_restricted'}),/owner-authorized native local/)
+    await assert.rejects(requireOwnerExecution(root,'r_restricted'),/external-execution-unavailable/)
   } finally {
     if(prior.path===undefined)delete process.env.PATH;else process.env.PATH=prior.path
     if(prior.transport===undefined)delete process.env.EZ_EXECUTOR_TRANSPORT;else process.env.EZ_EXECUTOR_TRANSPORT=prior.transport

package/test/failure.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, mkdir, readFile, writeFile, rm } from 'node:fs/promises'
+import { mkdtemp, mkdir, readFile, writeFile, rm, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { execFile, spawn } from 'node:child_process'
@@ -8,11 +8,12 @@ import { promisify } from 'node:util'
 import { fileURLToPath } from 'node:url'
 import { once } from 'node:events'
 import { redactFailure, failureStamp, needsFailureReview } from '../src/failure.js'
-import { RunStore } from '../src/runs.js'
+import { RunStore, sentOutbox } from '../src/runs.js'
 import { ControlStore } from '../src/control-state.js'
 import { Scheduler } from '../src/scheduler.js'
 import { initialPreset } from '../src/ai.js'
 import { createRelay } from '../src/index.js'
+import { serveTestLedger } from './helpers/ledger.js'
 import { TelegramSource } from '../src/telegram-source.js'
 import { packageVersion } from '../src/version.js'
 import { initializeWorkspace } from '../src/workspace.js'
@@ -33,6 +34,8 @@ test('failure evidence is bounded and redacts configured credentials, headers, t
 
 test('failure review CLI is owner-bound, rejects stale reviews, and keeps failure evidence immutable',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-failure-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ // The schedule CLI child reaches the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,1000)
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_EXECUTOR_CLI:'grok',EZ_RUN_ID:''}
  const cli=(args:string[],overrides={})=>exec(process.execPath,[bin,...args],{env:{...env,...overrides}})
@@ -61,7 +64,7 @@ test('failure review CLI is owner-bound, rejects stale reviews, and keeps failur
   await runs.patch(id,{status:'running',...('replyOnly' in extra?{replyOnly:true}:{})})
   await assert.rejects(cli(review,{EZ_RUN_ID:id}),/owner-authorized/)
  }
- await writeFile(join(dir,'runs','r_bad.json'),'{broken')
+ await assert.rejects(stat(join(dir,'runs')),{code:'ENOENT'})
  assert.equal(JSON.parse((await cli(['failures'])).stdout).total,1)
 })
 
@@ -86,6 +89,8 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
  })
  relay.bot.botInfo={id:999,is_bot:true,first_name:'Fixture',username:'fixture_bot'} as any
  relay.bot.api.config.use(async(_p,method,payload)=>{if(method==='sendMessage')replies.push((payload as any).text);return {ok:true,result:{message_id:replies.length}} as any})
+ // The schedule CLI children reach the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir)
  const originalPatch=RunStore.prototype.patch
  t.mock.method(RunStore.prototype,'patch',async function(this:RunStore,...args:Parameters<RunStore['patch']>){
   // Hold the PID write until the fast child has closed, reproducing slow disk
@@ -114,7 +119,7 @@ test('failure capture, diagnosis, verified recovery and conditional quiet next t
   await relay.bot.handleUpdate({...update,update_id:12,message:{...update.message!,message_id:12,text:'/stop'}})
   await until(async()=>(await runs.get('tg_11'))?.status==='cancelled')
   assert.equal(needsFailureReview((await runs.get('tg_11'))!),false)
- }finally{await relay.stop();for(const child of children)child.kill();await rm(dir,{recursive:true,force:true})}
+ }finally{await relay.stop();for(const child of children)child.kill();await ledger.stop();await rm(dir,{recursive:true,force:true})}
 })
 
 
@@ -220,7 +225,7 @@ for (const cleanupFails of [false,true]) test(`polling conflict preserves work u
   await stopped
   assert.equal(relay.stop(),stopping,'finished shutdown remains idempotent')
   assert.equal(sourceStops,1)
-  assert.deepEqual(JSON.parse(await readFile(join(dir,'outbox',`${item.id}.sent.json`),'utf8')).receipt.messageIds,[1])
+  assert.deepEqual((sentOutbox(dir).find(entry=>entry.id===item.id)?.receipt as {messageIds:number[]}).messageIds,[1])
   assert.equal(polls,1,'a conflict must not start another polling loop before the retry delay')
   assert.equal(relay.bot.isRunning(),false)
   assert.ok(child && (child.exitCode!==null || child.signalCode!==null))
@@ -268,6 +273,7 @@ for (const intake of [true,false]) test(`relay shutdown terminates an in-flight
 
 test('group members can inspect failures and wake review without exposing other chats', async t => {
  const dir=await mkdtemp(join(tmpdir(),'ez-group-failure-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const runs=new RunStore(dir),control=new ControlStore(dir,900000),scheduler=new Scheduler(dir)
  await control.requestPairing(101,-123,'Fixture');const owner=await control.approveOwner(-123,true)
  const execution=await control.captureChoice(initialPreset('grok'))
@@ -334,6 +340,7 @@ test('shutdown aborts a pending bot initialization without starting polling',asy
 
 test('failed reviewer readback exposes its stop through show, list and resume until explicit edit',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-review-stop-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir),scheduler=new Scheduler(dir)
  await control.requestPairing(101,101);const owner=await control.approveOwner(101)
  const execution=await control.captureChoice(initialPreset('grok')),now=Date.now()+1000

package/test/files.test.ts

@@ -35,13 +35,13 @@ test('sanitizes dangerous file names', () => {
   assert.equal(sanitizeFileName('report 2026!@#.pdf'), 'report_2026___.pdf')
 })
 
-test('stages file into workspace inbox cleanly', async () => {
+test('stages file into control attachments, never the workspace', async () => {
   const tmp = await mkdtemp(path.join(tmpdir(), 'ez-files-'))
   try {
     const data = Buffer.from('%PDF-1.4 sample content')
     const staged = await stageIncomingFile(tmp, 'sample.pdf', data)
     assert.equal(staged.fileType, 'pdf')
-    assert.match(staged.relativePath, /^inbox[/\\][a-f0-9-]+_sample\.pdf$/)
+    assert.match(staged.relativePath, /^attachments[/\\][a-f0-9-]+_sample\.pdf$/)
     const read = await readFile(staged.fullPath)
     assert.deepEqual(read, data)
   } finally {

package/test/helpers/ledger.ts

@@ -0,0 +1,18 @@
+import { createLedgerHandler, serveDeliverySocket } from '../../src/delivery-socket.js'
+
+// Serves the relay memory ledger for child-process CLIs (message, react,
+// approval, schedule) in tests that do not start a full relay. Handlers run
+// in this process, so test-created runs are visible to CLI children through
+// the shared-volume socket. Fixtures that start a relay must NOT also serve:
+// the relay serves the same path.
+export const serveTestLedger = async (
+  controlDir: string,
+  status: () => { polling: boolean; applicationOnly: boolean; telegramConfigured: boolean; version: string } =
+    () => ({ polling: false, applicationOnly: false, telegramConfigured: true, version: 'test' }),
+) => {
+  const server = await serveDeliverySocket(
+    controlDir,
+    createLedgerHandler(controlDir, { wake: () => {}, status }),
+  )
+  return server
+}

package/test/host-executor.test.ts

@@ -22,7 +22,7 @@ test('host restart replaces a lock whose PID was reused by another process',asyn
     await mkdir(workspace);await mkdir(directory,{recursive:true})
     await writeFile(path.join(directory,'worker.lock'),JSON.stringify({pid:process.pid,started:'reused-pid'}))
     server=serveHostExecutor({cli:'grok',agents:[{name:'test',workspace,controlDir,binDir:root}]},abort.signal)
-    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
     await readFile(path.join(directory,'heartbeat.json'))
     const lock=JSON.parse(await readFile(path.join(directory,'worker.lock'),'utf8'))
     assert.equal(lock.pid,process.pid)
@@ -47,6 +47,16 @@ test('isolated installations cannot start host transport', async () => {
   abort.abort()
 })
 
+test('host bindings reject invalid opencode provider scopes before touching state', async () => {
+  const abort=new AbortController()
+  for (const opencodeProviders of [['BAD NAME'], [], ['ok', 'ok'], new Array(17).fill('ok')]) {
+    await assert.rejects(serveHostExecutor({cli:'grok',agents:[{
+      name:'t',workspace:'/tmp/ez-scope-x',controlDir:'/tmp/ez-scope-y',binDir:'/tmp/ez-scope-z',opencodeProviders} as never]},abort.signal),
+      /one to sixteen unique provider IDs/)
+  }
+  abort.abort()
+})
+
 test('host restart clears dead native lease only after proving previous CLI stopped',async()=>{
   const root=await mkdtemp(path.join(tmpdir(),'ez-native-recovery-'));
   const workspace=path.join(root,'mind'),controlDir=path.join(root,'control'),toolsHome=path.join(root,'tools'),directory=path.join(controlDir,'host-executor');
@@ -63,12 +73,86 @@ test('host restart clears dead native lease only after proving previous CLI stop
     await readFile(path.join(toolsHome,'workspace-writer.lock'));
     await writeFile(path.join(directory,'r_old.process.json'),JSON.stringify({pid:deadPid}));
     server=serveHostExecutor(installation,abort.signal);
-    for(let n=0;n<100;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+    for(let n=0;n<300;n++){try{await readFile(path.join(directory,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
     await readFile(path.join(directory,'heartbeat.json'));
     await assert.rejects(readFile(path.join(toolsHome,'workspace-writer.lock')),{code:'ENOENT'});
   }finally{abort.abort();await server;await rm(root,{recursive:true,force:true});}
 });
 
+test('host execution resolves a declared provider from the bound agent, not a launcher wrapper', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-host-provider-'))
+  const workspace = path.join(root, 'mind')
+  const controlDir = path.join(root, 'control')
+  const directory = path.join(controlDir, 'host-executor')
+  const provider = {
+    id: 'openrouter', name: 'OpenRouter', baseUrl: 'https://openrouter.ai/api/v1',
+    envKey: 'OPENROUTER_API_KEY', models: ['deepseek/deepseek-v4.1-flash'],
+  }
+  const installation = {
+    cli: 'codex' as const,
+    agents: [{name: 'test', workspace, controlDir, binDir: path.join(root, 'bin'), codexProviders: [provider]}],
+  }
+  const abort = new AbortController()
+  let server: Promise<void> | undefined
+  let captured: any
+  const previousPath = process.env.PATH
+  try {
+    await mkdir(workspace, {recursive: true})
+    await mkdir(directory, {recursive: true})
+    const fakeBin = path.join(root, 'bin')
+    await mkdir(fakeBin, {recursive: true})
+    await mkdir(path.join(controlDir, 'cli', 'codex'), {recursive: true})
+    await writeFile(path.join(fakeBin, 'codex'), '#!/bin/sh\nexit 0\n', {mode: 0o700})
+    await writeFile(path.join(controlDir, 'cli', 'codex', 'models_cache.json'), JSON.stringify({models: [
+      {slug: provider.models[0], visibility: 'list', display_name: 'DeepSeek V4.1 Flash', supported_reasoning_levels: [{effort: 'max'}]},
+    ]}))
+    process.env.PATH = `${fakeBin}${path.delimiter}${previousPath ?? ''}`
+    await ownerRun(controlDir, 'r_provider')
+    server = serveHostExecutor(installation, abort.signal, async (_texts, options) => {
+      captured = options
+      const child = spawn(process.execPath, ['-e', 'process.exit(0)'])
+      return {child, cleanup: async () => {}, stdout: ''}
+    })
+    for (let n = 0; n < 100; n++) {
+      try { await readFile(path.join(directory, 'heartbeat.json')); break }
+      catch { await new Promise(resolve => setTimeout(resolve, 20)) }
+    }
+    await writeFile(path.join(directory, 'r_provider.request.json'), JSON.stringify({
+      texts: ['hello'], options: {cli: 'codex', provider: 'openrouter', model: provider.models[0], effort: 'max'},
+    }))
+    let events = ''
+    for (let n = 0; n < 100; n++) {
+      try {
+        events = await readFile(path.join(directory, 'r_provider.events'), 'utf8')
+        if (events.includes('"stream":"exit"')) break
+      } catch {}
+      await new Promise(resolve => setTimeout(resolve, 20))
+    }
+    assert.match(events, /"stream":"exit","code":0/)
+    const catalog = JSON.parse(await readFile(path.join(directory, 'models.json'), 'utf8'))
+    assert.deepEqual(catalog.filter((model: any) => model.model === provider.models[0]), [
+      {
+        cli: 'codex-gui', model: provider.models[0],
+        name: 'codex-gui · DeepSeek V4.1 Flash', efforts: ['max'],
+      },
+      {
+        cli: 'codex', provider: 'openrouter', model: provider.models[0],
+        name: `OpenRouter · ${provider.models[0]}`, efforts: ['max'],
+      },
+    ])
+    assert.deepEqual(catalog.filter((model: any) => model.cli === 'codex' && !model.provider), [])
+    assert.equal(captured.provider, 'openrouter')
+    assert.deepEqual(captured.codexProvider, provider)
+    assert.equal(captured.model, provider.models[0])
+  } finally {
+    abort.abort()
+    await server
+    if (previousPath === undefined) delete process.env.PATH
+    else process.env.PATH = previousPath
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
 test('one installed CLI executes two agent bindings with separate minds and sanitized environment', async () => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-host-'))
   const abort=new AbortController()
@@ -99,7 +183,7 @@ test('one installed CLI executes two agent bindings with separate minds and sani
     server=serveHostExecutor({cli:'grok',agents},abort.signal)
     for(const agent of agents){
       const dir=path.join(agent.controlDir,'host-executor')
-      for(let n=0;n<100;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
+      for(let n=0;n<300;n++){try{await readFile(path.join(dir,'heartbeat.json'));break}catch{await new Promise(r=>setTimeout(r,20))}}
       assert.equal(JSON.parse(await readFile(path.join(dir,'heartbeat.json'),'utf8')).version,packageVersion)
       const release = await workspaceLease(agent.toolsHome)
       await ownerRun(agent.controlDir, `r_${agent.name}`)

package/test/inbox.test.ts

@@ -8,12 +8,11 @@ import { InboxStore } from '../src/inbox.js'
 import { RunStore } from '../src/runs.js'
 
 const update = (id: number): Update => ({ update_id: id })
-test('intake survives restart, deduplicates IDs, seals membership and retains cancellation tombstones', async () => {
+test('intake deduplicates IDs, seals membership and retains cancellation tombstones (memory only)', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-inbox-'))
   try {
-    let inbox = new InboxStore(dir)
+    const inbox = new InboxStore(dir)
     assert.equal(await inbox.accept(update(1)), true)
-    inbox = new InboxStore(dir)
     assert.equal(await inbox.accept(update(1)), false)
     await inbox.accept(update(2))
     assert.equal(await inbox.next(), undefined)
@@ -23,12 +22,11 @@ test('intake survives restart, deduplicates IDs, seals membership and retains ca
       [1, 2],
     )
     await inbox.accept(update(3))
-    inbox = new InboxStore(dir)
     assert.deepEqual(await inbox.next(true), batch)
     const runs = new RunStore(dir)
     const input = { id: batch.id, chatId: 101, telegramUserId: 101, texts: ['hello'] }
     await runs.create(input)
-    // Crash between run creation and inbox completion must not produce a second run.
+    // Retry with the same run ID returns the existing run; no second run.
     await runs.create(input)
     assert.equal((await runs.list()).length, 1)
     await inbox.finish(batch.id)
@@ -36,19 +34,19 @@ test('intake survives restart, deduplicates IDs, seals membership and retains ca
     assert.equal(await inbox.cancel(), 1)
     assert.equal(await inbox.accept(update(3)), false)
     assert.equal(await inbox.next(true), undefined)
-    assert.equal((await stat(join(dir, 'inbox.json'))).mode & 0o777, 0o600)
+    // Stateless pipe: no inbox.json exists on disk; restart drops by design.
+    await assert.rejects(stat(join(dir, 'inbox.json')))
   } finally {
     await rm(dir, { recursive: true, force: true })
   }
 })
 
-test('corrupt intake fails closed without overwriting evidence; invalid identifiers are rejected', async () => {
+test('restart loses nothing by design; invalid identifiers are rejected', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-inbox-corrupt-'))
   try {
-    await writeFile(join(dir, 'inbox.json'), '{broken')
+    // A fresh directory starts empty: no durable journal survives a restart.
     const inbox = new InboxStore(dir)
-    await assert.rejects(inbox.accept(update(4)), /Inbox unreadable/)
-    assert.equal(await readFile(join(dir, 'inbox.json'), 'utf8'), '{broken')
+    assert.deepEqual(await inbox.status(), { pending: 0, failed: 0 })
     assert.throws(() => inbox.accept(update(-1)), /Invalid update ID/)
     await assert.rejects(
       new RunStore(dir).create({ id: '../escape', chatId: 101, telegramUserId: 101, texts: [] }),

package/test/install-config.test.ts

@@ -81,6 +81,7 @@ test('Docker startup uses explicit deployment binding and literal paths without
   assert.equal(definition.command, 'docker')
   assert.ok(definition.args.includes('/tmp/my agent $literal/docker.env'))
   assert.deepEqual(definition.args.slice(-4), ['up', '-d', '--wait', 'relay'])
+  assert.deepEqual(serviceDefinition('/tmp/isolated', true).args.slice(-5), ['up', '-d', '--wait', 'relay', 'plugin-broker'])
   assert.doesNotMatch(JSON.stringify(definition), /TELEGRAM_BOT_TOKEN|launchctl|systemctl/)
   assert.throws(() => serviceDefinition('/tmp/\nbad'), /single-line/)
 })

package/test/install-tools.test.mjs

@@ -3,7 +3,10 @@ import assert from 'node:assert/strict';
 import * as fs from 'node:fs/promises';
 import {tmpdir} from 'node:os';
 import path from 'node:path';
-import {preflight,installationStatus,build,hostEnvironment} from '../src/install-tools.mjs';
+import {preflight,installationStatus,build,hostEnvironment,migrateLedger} from '../src/install-tools.mjs';
+import {parseEnv} from 'node:util';
+import {RunStore} from '../src/runs.js';
+import {serveTestLedger} from './helpers/ledger.js';
 
 async function fixture(t){const root=await fs.mkdtemp(path.join(tmpdir(),'ez-install-tools-'));t.after(()=>fs.rm(root,{recursive:true,force:true}));return root;}
 test('preflight checks the selected executable and reports missing prerequisites without credentials',async t=>{
@@ -19,10 +22,12 @@ test('preflight checks the selected executable and reports missing prerequisites
 test('installation status separates files, pairing and current-owner Telegram delivery evidence',async t=>{
   const root=await fixture(t),control=path.join(root,'control');
   assert.equal((await installationStatus(root)).stage,'not-configured');
-  for(const dir of ['host-executor','outbox','runs'])await fs.mkdir(path.join(control,dir),{recursive:true});
+  await fs.mkdir(path.join(control,'host-executor'),{recursive:true});
   for(const name of ['agent.json','host-executor.json','docker.env','relay.env'])await fs.writeFile(path.join(root,name),'private');
   const write=(name,obj)=>fs.writeFile(path.join(control,name),JSON.stringify(obj));
   await write('heartbeat.json',{at:Date.now(),polling:true});await write('host-executor/heartbeat.json',{at:Date.now()});
+  // Delivery evidence comes from the running relay's memory ledger.
+  const ledger=await serveTestLedger(control,()=>({polling:true,applicationOnly:false,telegramConfigured:true,version:'test'}));t.after(()=>ledger.stop());
   assert.equal((await installationStatus(root)).stage,'awaiting-owner');
   await fs.writeFile(path.join(root,'agent.json'),JSON.stringify({isolation:'isolated'}));
   await fs.rm(path.join(control,'host-executor/heartbeat.json'));
@@ -32,15 +37,46 @@ test('installation status separates files, pairing and current-owner Telegram de
   assert.equal((await installationStatus(root)).stage,'awaiting-owner');
   const owner={telegramUserId:123,telegramChatId:123,pairedAt:new Date(Date.now()-10000).toISOString()};await write('control-state.json',{owner});
   assert.equal((await installationStatus(root)).stage,'awaiting-telegram-reply');
-  const item={runId:'tg_12',chatId:123,receipt:{messageIds:[42],deliveredAt:new Date().toISOString()}};
-  await write('outbox/test.sent.json',item);await write('runs/tg_12.json',{status:'completed',chatId:123,telegramUserId:999});
+  const runs=new RunStore(control),deliver=async(id,text,chatId,telegramUserId,ids,status='completed')=>{
+    const run=await runs.create({id,chatId,telegramUserId,texts:[text]});
+    await runs.patch(run.id,{status:'running'});
+    const item=await runs.enqueueMessage(run.id,text);
+    await runs.claimOutbox(item.id);await runs.markOutboxSent(item.id,ids);
+    await runs.patch(run.id,{status});
+  };
+  // Another chat member's completed delivery is not the owner's reply evidence.
+  await deliver('tg_13','other member',123,999,[42]);
   assert.equal((await installationStatus(root)).telegramReplyVerified,false);
-  await write('runs/tg_12.json',{status:'completed',chatId:123,telegramUserId:123});
+  // A failed run never counts, even with a receipt.
+  await deliver('tg_14','failed',123,123,[43],'failed');
+  assert.equal((await installationStatus(root)).telegramReplyVerified,false);
+  await deliver('tg_12','hello',123,123,[42]);
   assert.equal((await installationStatus(root)).stage,'ready-for-telegram-plugin-request');
-  await write('heartbeat.json',{at:0,polling:true});assert.equal((await installationStatus(root)).stage,'runtime-offline');
-  await write('outbox/test.sent.json',{...item,runId:'../../escape'});assert.equal((await installationStatus(root)).telegramReplyVerified,false);
+  // With the relay down, status falls back to the legacy heartbeat file.
+  await ledger.stop();await write('heartbeat.json',{at:0,polling:true});assert.equal((await installationStatus(root)).stage,'runtime-offline');
   await fs.writeFile(path.join(control,'control-state.json'),'{');await assert.rejects(installationStatus(root));
 });
+test('host-capable deployments migrate once to a loopback ledger endpoint',async t=>{
+  const root=await fixture(t),deployment=path.join(root,'agent');await fs.mkdir(deployment);
+  const envFile=path.join(deployment,'docker.env');
+  await fs.writeFile(envFile,"COMPOSE_PROJECT_NAME='ez-agent-canary'\nCOMPOSE_FILE='/opt/ez/compose.yaml:/opt/ez/extra.compose.yaml'\n",{mode:0o600});
+  const first=await migrateLedger({deployment});
+  assert.equal(first.changed,true);assert.ok(Number.isSafeInteger(first.port)&&first.port>=1024);
+  const values=parseEnv(await fs.readFile(envFile,'utf8'));
+  assert.equal(values.EZ_DELIVERY_TCP_PORT,String(first.port));
+  assert.equal(values.COMPOSE_FILE,`/opt/ez/compose.yaml:/opt/ez/extra.compose.yaml:${path.join(deployment,'ledger.compose.yaml')}`);
+  assert.match(await fs.readFile(path.join(deployment,'ledger.compose.yaml'),'utf8'),/127\.0\.0\.1:\$\{EZ_DELIVERY_TCP_PORT:\?\}/);
+  assert.equal((await fs.stat(envFile)).mode&0o777,0o600);
+  const second=await migrateLedger({deployment});
+  assert.equal(second.changed,false);assert.equal(second.port,first.port);
+  await assert.rejects(migrateLedger({deployment:path.join(root,'missing')}),/docker.env not found/);
+});
+test('isolated deployments need no host ledger endpoint',async t=>{
+  const root=await fixture(t),deployment=path.join(root,'isolated');await fs.mkdir(deployment);
+  await fs.writeFile(path.join(deployment,'docker.env'),"COMPOSE_PROJECT_NAME='ez-agent-isolated'\nCOMPOSE_FILE='/opt/ez/compose.yaml'\nEZ_ISOLATION='isolated'\nEZ_EXECUTOR_TRANSPORT='local'\n",{mode:0o600});
+  const result=await migrateLedger({deployment});
+  assert.equal(result.changed,false);assert.match(result.note,/Isolated/);
+});
 test('same-artifact build retries do not spawn a second Docker build and reuse verified completed image',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
   let started,finish,count=0;const running=new Promise(r=>started=r),held=new Promise(r=>finish=r);
@@ -51,6 +87,37 @@ test('same-artifact build retries do not spawn a second Docker build and reuse v
   assert.equal((await build({home,source},invoke)).reused,true);assert.equal(count,1);
   await fs.writeFile(path.join(source,'package.json'),'{"changed":true}');await build({home,source},invoke);assert.equal(count,2);
 });
+test('source checkouts build RCs only: clean reviewed commit plus increasing label',async t=>{
+  const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
+  let inside=true,status='',built=[],toplevel=source;const sha='a'.repeat(40);
+  const invoke=async(cmd,args)=>{
+    if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);
+    if(cmd==='git'){
+      if(!inside)throw Error('not a git repository');
+      if(args[2]==='rev-parse'&&args[3]==='--show-toplevel')return toplevel;
+      if(args[2]==='status')return status;
+      if(args[2]==='rev-parse'&&args[3]==='HEAD')return sha;
+      return '';
+    }
+    if(args[0]==='build'){built.push(args);return 'image';}
+    return 'sha256:fixture';
+  };
+  await assert.rejects(build({home,source},invoke),/requires --label/);
+  await assert.rejects(build({home,source,label:'0.1.0-beta.36'},invoke),/RC label/);
+  status=' M src/executor.ts';
+  await assert.rejects(build({home,source,label:'0.1.0-beta.36.rc.2'},invoke),/Commit the reviewed source/);
+  status='';
+  const result=await build({home,source,label:'0.1.0-beta.36.rc.2'},invoke);
+  assert.equal(result.label,'0.1.0-beta.36.rc.2');assert.equal(result.sha,sha);
+  const args=built.at(-1);
+  assert.ok(args.includes('BUILD_TAG=0.1.0-beta.36.rc.2'));assert.ok(args.includes(`BUILD_SHA=${sha}`));
+  assert.ok(args.includes('ezenciel-agents:0.1.0-beta.36.rc.2'));
+  inside=false;
+  await assert.rejects(build({home,source,label:'0.1.0-beta.36.rc.2'},invoke),/--label requires a git checkout/);
+  // A tarball unpacked inside an unrelated repository is not a source checkout.
+  inside=true;toplevel=home;
+  assert.equal((await build({home,source},invoke)).label,undefined);
+});
 test('a failed build releases its own lock and leaves a failure receipt for diagnosis',async t=>{
   const home=await fixture(t),source=path.join(home,'source');await fs.mkdir(source);await fs.writeFile(path.join(source,'package.json'),'{}');
   const invoke=async(cmd)=>{if(cmd==='npm')return JSON.stringify([{files:[{path:'package.json'}]}]);throw Error('Synthetic build failed');};