@jc_stack/ez-agents 0.1.0-beta.34 → 0.1.0-beta.37

package/test/plugin-manager.test.mjs

@@ -6,7 +6,12 @@ import path from 'node:path';
 import {execFile,spawn} from 'node:child_process';
 import {once} from 'node:events';
 import {promisify} from 'node:util';
-import {snapshot,init as initManager,validate,compose,locked,bindToolDiscovery} from '../src/plugins/manager.mjs';
+import {snapshot,init as initManager,validate,compose,locked,bindToolDiscovery,prepareCommand} from '../src/plugins/manager.mjs';
+import { ControlStore, ownerId, ownerEpoch } from '../src/control-state.js';
+import { ApplicationBindings } from '../src/application-channel.js';
+import { RunStore } from '../src/runs.js';
+import { serveTestLedger } from './helpers/ledger.js';
+import { randomBytes } from 'node:crypto';
 // Synthetic manager tests explicitly opt out of the product's default packages.
 async function init(home,workspace,catalog,hostConfig) {
  const file=path.join(path.dirname(home),'test-catalog.json');
@@ -69,6 +74,7 @@ test('native discovery binding preserves notes and never seeds a tool inventory'
  await init(f.home,f.workspace);
  await assert.rejects(fs.access(notes),{code:'ENOENT'});
  const first=await fs.readFile(instructions,'utf8');assert(first.startsWith('Owner mandate\n'));assert(first.includes(f.home+'/bin/ez'));
+ assert.match(first,/tools list --details/);assert.match(first,/ --help/);assert.doesNotMatch(first,/ezenciel-agents-message|KISS/);
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(instructions,'utf8'),first);
  await fs.writeFile(notes,'Legacy policy');
  await bindToolDiscovery(f.home,f.workspace);assert.equal(await fs.readFile(notes,'utf8'),'Legacy policy');
@@ -81,6 +87,12 @@ test('native discovery binding preserves notes and never seeds a tool inventory'
  await assert.rejects(bindToolDiscovery(f.home,f.workspace),/regular file/);
  assert.equal(await fs.readFile(notes,'utf8'),'Legacy policy');
 });
+test('isolated discovery uses the relay-bound ez client without exposing toolsHome',async t=>{
+ const f=await fixture(t);await fs.mkdir(f.home);const workspace=await fs.realpath(f.workspace),controlDir=await fs.realpath(f.control),toolsHome=await fs.realpath(f.home),host={cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir,binDir:path.join(f.root,'bin'),toolsHome}]};
+ await fs.mkdir(path.join(f.root,'bin'));await fs.writeFile(f.hostConfig,JSON.stringify(host));
+ await init(f.home,f.workspace,undefined,f.hostConfig);
+ const instructions=await fs.readFile(path.join(f.workspace,'AGENTS.md'),'utf8');assert.match(instructions,/`ez tools list --details`/);assert.doesNotMatch(instructions,new RegExp(f.home.replace(/[.*+?^${}()|[\]\\]/g,'\\$&')));
+});
 test('installed snippets follow install, upgrade and uninstall without files or Docker reads',async t=>{
  const f=await fixture(t);await init(f.home,f.workspace);
  const details=async()=>JSON.parse((await f.call('tools','list','--details')).stdout);
@@ -98,6 +110,72 @@ test('installed snippets follow install, upgrade and uninstall without files or
  }
  await assert.rejects(fs.access(path.join(f.workspace,'TOOLS.md')),{code:'ENOENT'});
 });
+test('application plugin context is namespaced, authorized, and absent from ordinary commands',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const home=await fs.realpath(f.home);
+ const ledger=await serveTestLedger(f.control);t.after(()=>ledger.stop());
+ const control=new ControlStore(f.control,1000);await control.requestPairing(42,42);const owner=await control.approveOwner(42);
+ const binding=await new ApplicationBindings(f.control).register('app',randomBytes(32).toString('base64url'),owner);
+ assert.ok(binding);
+ const runs=new RunStore(f.control),run=await runs.create({id:'r_app_plugin',ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin'],application:{bindingId:binding.bindingId,requestId:'plugin',scope:'owner-chat',context:{plugins:{sample:{capability:'scoped-value',template:'cost $5 for ${plan} and $HOME'},other:{capability:'must-not-leak'}}}}});
+ await runs.patch(run.id,{status:'running'});
+  const command=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:run.id}});
+  const index=command.argv.lastIndexOf('--file');assert.ok(index>0);
+  assert.equal(command.argv[index+2],'run');
+  const contextFile=command.argv[index+1];
+  assert.match(contextFile,/\/plugin-context\/[0-9a-f-]+\.json$/);
+  assert.equal(command.argv.join(' ').includes('must-not-leak'),false);
+  // The run container receives the slice through the service environment, not
+  // through interpolation-only --env-file. Compose collapses the escaped
+  // `$$` back to `$`, so every context value must survive byte-for-byte.
+  const override=JSON.parse(await fs.readFile(contextFile,'utf8'));
+  const delivered=override.services.sample.environment.EZ_PLUGIN_CONTEXT.replaceAll('$$','$');
+  assert.deepEqual(JSON.parse(delivered),{capability:'scoped-value',template:'cost $5 for ${plan} and $HOME'});
+  assert.ok(override.services.sample.environment.EZ_PLUGIN_CONTEXT.includes('$$5'));
+  assert.ok(override.services.sample.environment.EZ_PLUGIN_CONTEXT.includes('$${plan}'));
+  assert.equal((await fs.stat(contextFile)).mode&0o777,0o600);
+  await command.release();await assert.rejects(fs.access(contextFile),{code:'ENOENT'});
+  const ordinary=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control}});
+  assert.equal(ordinary.argv.includes('--env-file'),false);assert.equal(ordinary.contextFile,undefined);
+});
+test('Telegram-admitted application runs receive the same scoped plugin context',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const home=await fs.realpath(f.home);
+ const ledger=await serveTestLedger(f.control);t.after(()=>ledger.stop());
+ const control=new ControlStore(f.control,1000);await control.requestPairing(42,42);const owner=await control.approveOwner(42);
+ const binding=await new ApplicationBindings(f.control).register('telegram-app',randomBytes(32).toString('base64url'),owner,true);
+ assert.ok(binding);
+ const runs=new RunStore(f.control),run=await runs.create({id:'tg_plugin_context',chatId:42,telegramUserId:42,ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin']});
+ await runs.attachTelegramApplication(run.id,{bindingId:binding.bindingId,requestId:run.id,scope:'telegram',context:{plugins:{sample:{capability:'telegram-scoped-value'}}}});
+ await runs.patch(run.id,{status:'running'});
+  const command=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:run.id}});
+  const index=command.argv.lastIndexOf('--file');assert.ok(index>0);
+  assert.equal(command.argv[index+2],'run');
+  const contextFile=command.argv[index+1];
+  assert.deepEqual(JSON.parse(await fs.readFile(contextFile,'utf8')),{services:{sample:{environment:{EZ_PLUGIN_CONTEXT:'{"capability":"telegram-scoped-value"}'}}}});
+  await command.release();await assert.rejects(fs.access(contextFile),{code:'ENOENT'});
+});
+test('application plugin context fails closed on revoked, cancelled, and oversized runs',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ const home=await fs.realpath(f.home);
+ const ledger=await serveTestLedger(f.control);t.after(()=>ledger.stop());
+ const control=new ControlStore(f.control,1000);await control.requestPairing(42,42);const owner=await control.approveOwner(42);
+ const binding=await new ApplicationBindings(f.control).register('app',randomBytes(32).toString('base64url'),owner);
+ const runs=new RunStore(f.control);
+ const run=await runs.create({id:'r_app_ctx',ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin'],application:{bindingId:binding.bindingId,requestId:'plugin',scope:'owner-chat',context:{plugins:{sample:{capability:'scoped-value'}}}}});
+ await runs.patch(run.id,{status:'running'});
+ await control.revokeOwner();
+ await control.requestPairing(43,43);await control.approveOwner(43);
+ await assert.rejects(prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:run.id}}),/revoked/);
+ const stale=await runs.create({id:'r_app_stale',ownerId:ownerId(owner),ownerEpoch:ownerEpoch(owner),texts:['Use the plugin'],application:{bindingId:binding.bindingId,requestId:'stale',scope:'owner-chat',context:{plugins:{sample:{capability:'scoped-value'}}}}});
+  const idle=await prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:stale.id}});
+  assert.equal(idle.contextFile,undefined);assert.equal(idle.argv.includes('--env-file'),false);
+ const freshOwner=(await control.status()).owner;
+ const binding2=await new ApplicationBindings(f.control).register('app2',randomBytes(32).toString('base64url'),freshOwner);
+ const big=await runs.create({id:'r_app_big',ownerId:ownerId(freshOwner),ownerEpoch:ownerEpoch(freshOwner),texts:['Use the plugin'],application:{bindingId:binding2.bindingId,requestId:'big',scope:'owner-chat',context:{plugins:{sample:{blob:'x'.repeat(17*1024)}}}}});
+ await runs.patch(big.id,{status:'running'});
+ await assert.rejects(prepareCommand(home,'sample',['context'],{environment:{EZ_CONTROL_DIR:f.control,EZ_RUN_ID:big.id}}),/too large/);
+});
 test('bound launcher installs without startup; literal args and exit codes; scopes and secrets',async t=>{
  const f=await fixture(t);const p=await snapshot(f.source);await init(f.home,f.workspace);
  const install=['plugins','install','sample','--source',f.source,'--revision',p.revision];
@@ -139,6 +217,23 @@ test('unconfirmed direct-command cancellation retains its lifecycle lease',async
  assert.equal((await fs.readdir(path.join(f.home,'command-invocations'))).length,1);
  await assert.rejects(f.call('plugins','uninstall','sample'),/Stale command invocation lease/);
 });
+test('an unreadable invocation lease pid falls through to container verification',async t=>{
+ const f=await fixture(t);
+ const directory=path.join(f.home,'command-invocations');await fs.mkdir(directory,{recursive:true});
+ const lease=path.join(directory,'00000000-0000-4000-8000-000000000000.json');
+ await fs.writeFile(lease,JSON.stringify({pid:process.pid,container:'gone-call'}),{mode:0o600});
+ const path0=process.env.PATH,kill0=process.kill;
+ process.env.PATH=f.fake+path.delimiter+path0;
+ process.kill=()=>{const error=new Error('kill EPERM');error.code='EPERM';throw error;};
+ try {
+  await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nconst a=process.argv.slice(2);if(a[0]==='container'&&a[1]==='inspect'){console.error('No such container: gone-call');process.exit(1)}\n`,{mode:0o700});
+  assert.equal(await locked(f.home,async()=>'ok'),'ok');
+  await assert.rejects(fs.access(lease),{code:'ENOENT'});
+  await fs.writeFile(lease,JSON.stringify({pid:process.pid,container:'live-call'}),{mode:0o600});
+  await fs.writeFile(path.join(f.fake,'docker'),`#!${process.execPath}\nconst a=process.argv.slice(2);if(a[0]==='container'&&a[1]==='inspect'){console.log('live-call');process.exit(0)}\n`,{mode:0o700});
+  await assert.rejects(locked(f.home,async()=>{}),/Stale command invocation lease/);
+ } finally {process.kill=kill0;process.env.PATH=path0;}
+});
 test('changed source, symlinks, reserved aliases, arbitrary Docker fields rejected',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);
  await fs.writeFile(path.join(f.source,'client.mjs'),'changed');await assert.rejects(f.call('plugins','install','sample','--source',f.source,'--revision',p.revision));
@@ -157,7 +252,46 @@ test('registry corruption, active writer lock and alias collision fail closed',a
 test('Compose resources are namespaced, private, and restricted to owning workspace',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);
  const c=await compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:p.deployment});
- assert.equal(c.name,'ezp-synthetic');assert.equal(c.services.sample.ports,undefined);assert.equal(c.services.sample.privileged,undefined);assert.equal(c.services.sample.volumes[1].read_only,true);assert.deepEqual(c.services.sample.cap_drop,['ALL']);
+ assert.equal(c.version,'3.8');assert.equal(c.name,undefined);assert.equal(c.services.sample.ports,undefined);assert.equal(c.services.sample.privileged,undefined);assert.equal(c.services.sample.volumes[1].read_only,true);assert.deepEqual(c.services.sample.cap_drop,['ALL']);
+});
+test('standalone Compose fallback emits a v1-compatible document and keeps project identity in argv',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),previous=process.env.EZ_DOCKER_COMPOSE;
+ process.env.EZ_DOCKER_COMPOSE='standalone';
+ try {
+  const c=await compose({workspace:f.workspace},{source:f.source,project:'ezp-synthetic',revision:p.revision,deployment:p.deployment});
+  assert.equal(c.version,'3.8');assert.equal(c.name,undefined);assert.ok(c.services.sample.build.target);
+ } finally {
+  if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
+ }
+});
+test('isolated broker host binding validates exact mounts without deployment symlinks',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),isolated=path.join(f.root,'isolated'),workspace=path.join(isolated,'workspace'),control=path.join(isolated,'control'),hostConfig=path.join(isolated,'host-executor.json'),previous=process.env.EZ_DOCKER_COMPOSE;
+ await fs.mkdir(f.home,{recursive:true});await fs.mkdir(workspace,{recursive:true});await fs.mkdir(control,{recursive:true});
+ await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home}]}));
+ process.env.EZ_DOCKER_COMPOSE='standalone';
+ try {
+  const c=await compose({workspace:await fs.realpath(workspace),hostConfig:await fs.realpath(hostConfig)},{source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment},{},f.home);
+  assert.equal(c.version,'3.8');assert.equal(c.services.sample.volumes[1].source,await fs.realpath(workspace));
+ } finally {
+  if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
+ }
+});
+test('isolated broker allows unbound plugins when another plugin has host binding',async t=>{
+ const f=await fixture(t),p=await snapshot(f.source),isolated=path.join(f.root,'isolated-other'),workspace=path.join(isolated,'workspace'),control=path.join(isolated,'control'),hostConfig=path.join(isolated,'host-executor.json'),previous=process.env.EZ_DOCKER_COMPOSE;
+ await fs.mkdir(f.home,{recursive:true});await fs.mkdir(workspace,{recursive:true});await fs.mkdir(control,{recursive:true});
+ await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home}]}));
+ const record={source:p.source,project:'ezp-synthetic',revision:p.revision,manifest:p.manifest,deployment:p.deployment};
+ const config={workspace:await fs.realpath(workspace),hostConfig:await fs.realpath(hostConfig)};
+ await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{voice:{revisions:[p.revision],bindings:[{service:'sample',network:'voice_default'}]}}}]}));
+ process.env.EZ_DOCKER_COMPOSE='standalone';
+ try {
+  const c=await compose(config,record,{},f.home);
+  assert.equal(c.version,'3.8');assert.equal(c.networks,undefined);
+  await fs.writeFile(hostConfig,JSON.stringify({cli:'codex',isolation:'isolated',agents:[{name:'sample',workspace,controlDir:control,binDir:path.join(f.root,'bin'),toolsHome:f.home,pluginNetworkBindings:{sample:{revisions:[p.revision],bindings:[{service:'sample',network:'sample_default'}]}}}]}));
+  await assert.rejects(compose(config,record,{},f.home),/Isolated broker cannot use host network bindings/);
+ } finally {
+  if(previous===undefined)delete process.env.EZ_DOCKER_COMPOSE;else process.env.EZ_DOCKER_COMPOSE=previous;
+ }
 });
 test('host-owned private networks survive registered-call Compose regeneration',async t=>{
  const f=await fixture(t),p=await snapshot(f.source);await init(f.home,f.workspace);

package/test/reaction.test.ts

@@ -7,15 +7,19 @@ import test from 'node:test'
 import { promisify } from 'node:util'
 import { isSupportedReactionEmoji, normalizeReactionEmoji, TELEGRAM_REACTIONS } from '../src/reaction.js'
 import { RunStore } from '../src/runs.js'
+import { serveTestLedger } from './helpers/ledger.js'
 
 const execFileAsync = promisify(execFile)
 const reactScriptPath = path.resolve('src/react.ts')
 
 const fixture = async (run: (store: RunStore, dir: string) => Promise<void>): Promise<void> => {
   const directory = await mkdtemp(path.join(tmpdir(), 'ez-reactions-'))
+  // The react CLI child reaches the memory ledger through the socket.
+  const ledger = await serveTestLedger(directory)
   try {
     await run(new RunStore(directory), directory)
   } finally {
+    await ledger.stop()
     await rm(directory, { recursive: true, force: true })
   }
 }

package/test/relay.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, readdir, readFile } from 'node:fs/promises'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawn } from 'node:child_process'
@@ -207,10 +207,8 @@ test('failed delivery is quarantined and never blindly retried', async () => {
     await assert.rejects(runs.waitForDelivery(item.id), /Ambiguous network failure/)
     assert.deepEqual(await runs.deliveryStatus(), { failed: 0, unknown: 1 })
     await assert.rejects(runs.waitForDelivery('missing', 1), /outcome unknown/)
-    assert.equal(
-      (await readdir(join(dir, 'outbox'))).filter((name) => name.endsWith('.failed.json')).length,
-      1,
-    )
+    // Quarantine lives in relay memory; no outbox state touches control/.
+    await assert.rejects(stat(join(dir, 'outbox')))
   } finally {
     await relay.stop()
     await rm(dir, { recursive: true, force: true })
@@ -245,8 +243,8 @@ test('outbox stores provider receipts and does not redeliver sent messages', asy
     assert.equal(sends, 1)
     assert.deepEqual(((await runs.waitForDelivery(item.id)) as { messageIds: number[] }).messageIds, [42])
     assert.deepEqual(await runs.pendingOutbox(), [])
-    const sent = (await readdir(join(dir, 'outbox'))).find((name) => name.endsWith('.sent.json'))!
-    assert.deepEqual(JSON.parse(await readFile(join(dir, 'outbox', sent), 'utf8')).receipt.messageIds, [42])
+    // Receipts live in relay memory; no outbox state touches control/.
+    await assert.rejects(stat(join(dir, 'outbox')))
   } finally {
     await relay.stop()
     await rm(dir, { recursive: true, force: true })

package/test/repair-policy.test.ts

@@ -2,10 +2,9 @@ import test from 'node:test'
 import assert from 'node:assert/strict'
 import { loadConfig } from '../src/config.js'
 import { executorJobEnv } from '../src/executor.js'
-import { agentGuidance } from '../src/agent-guidance.js'
 
 test('repair preference is bound in the environment, never rewritten into the request', () => {
- const config = (value?:string) => loadConfig({TELEGRAM_BOT_TOKEN:'fixture', ...(value===undefined ? {} : {EZ_REPAIR_ENABLED:value})})
+ const config = (value?:string) => loadConfig({TELEGRAM_BOT_TOKEN:'110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsY', ...(value===undefined ? {} : {EZ_REPAIR_ENABLED:value})})
  assert.equal(config().repairEnabled,true)
  assert.equal(config('false').repairEnabled,false)
  assert.throws(()=>config('disabled'),/EZ_REPAIR_ENABLED/)
@@ -14,6 +13,4 @@ test('repair preference is bound in the environment, never rewritten into the re
   assert.equal(env.EZ_REPAIR_ENABLED,String(enabled))
   assert.equal(env.TELEGRAM_BOT_TOKEN,undefined)
  }
- assert.match(agentGuidance(),/EZ_REPAIR_ENABLED/)
- assert.match(agentGuidance(),/explicit owner request or saved maintenance mandate/)
 })

package/test/schedule-cli.test.ts

@@ -9,9 +9,12 @@ import { fileURLToPath } from 'node:url'
 import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { initialPreset } from '../src/ai.js'
+import { serveTestLedger } from './helpers/ledger.js'
 const exec=promisify(execFile),bin=fileURLToPath(new URL('../bin/ezenciel-agents-schedule.mjs',import.meta.url))
 test('public scheduler CLI saves literal text, reads back, edits, pauses, and rejects external or finished callers',async t=>{
  const dir=await mkdtemp(join(tmpdir(),'ez-schedule-cli-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ // The schedule CLI child reaches the relay memory ledger through the socket.
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir)
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:'',EZ_EXECUTOR_CLI:'grok'}
  await assert.rejects(exec(process.execPath,[bin,'list'],{env}),/Pair an owner/)
@@ -19,8 +22,8 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
  const execution=await control.captureChoice(initialPreset('grok'))
  const run=await runs.create({chatId:101,telegramUserId:101,texts:['owner request'],execution})
  await runs.patch(run.id,{status:'running'});env.EZ_RUN_ID=run.id
- const context=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
- assert.deepEqual(context.run.texts,['owner request']);assert.deepEqual(context.busyReplies,[])
+  const context=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
+  assert.deepEqual(context.run.texts,['owner request']);assert.equal(context.busyReplies,undefined)
  await assert.rejects(exec(process.execPath,[bin,'context'],{env:{...env,EZ_RUN_ID:''}}),/active owner run/)
  const args=['create','test','--at','2027-09-09T09:00:00+04:00','--text','Literal $(do-not-execute) /goal objective']
  const saved=JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
@@ -59,13 +62,14 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
 
 test('executor PATH exposes the extensionless scheduler command',async()=>{
  const command=fileURLToPath(new URL('../bin/ezenciel-agents-schedule',import.meta.url))
- assert.match((await exec(command,['--help'])).stdout,/durable, asynchronous CLI task/)
+  assert.match((await exec(command,['--help'])).stdout,/Creates a scheduled task/)
 })
 
 
 test('deferred literal input retains owner-scoped conversation through source metadata',async t=>{
  const {Scheduler}=await import('../src/scheduler.js')
  const dir=await mkdtemp(join(tmpdir(),'ez-origin-context-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
  const control=new ControlStore(dir,1000),runs=new RunStore(dir)
  await control.requestPairing(101,101);await control.approveOwner(101)
  const execution=await control.captureChoice(initialPreset('codex'))
@@ -76,13 +80,14 @@ test('deferred literal input retains owner-scoped conversation through source me
  await new Scheduler(dir).save({id:'legacy-deferred',name:'Owner request',text:'Do the same for March',originRunId:'tg_2',owner:(await control.status()).owner!,execution,enabled:true,trigger:{at:new Date(Date.now()+1000).toISOString()}},true)
  await new Scheduler(dir).tick((await control.status()).owner!,runs,Date.now()+2000)
  const worker=(await runs.list()).find(r=>r.scheduled)!
- assert.deepEqual(worker.texts,['Do the same for March']);assert.equal(worker.scheduled?.originRunId,'tg_2')
+  assert.match(worker.texts[0],/^\[schedule legacy-deferred due .+\]$/);assert.equal(worker.texts[1],'Do the same for March');assert.equal(worker.scheduled?.originRunId,'tg_2')
  await runs.patch(worker.id,{status:'running'})
  const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:worker.id}
- const result=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
- assert.ok(result.origin.recent.some((r:any)=>r.texts==='Use the blue ledger'))
+  const result=JSON.parse((await exec(process.execPath,[bin,'context'],{env})).stdout)
+  assert.equal(result.run.texts[1],'Do the same for March')
+  assert.equal(result.origin.id,'tg_2')
  await runs.create({id:'other',chatId:999,telegramUserId:999,texts:['PRIVATE OTHER OWNER']})
- const {writeFile}=await import('node:fs/promises')
- await writeFile(join(dir,'runs',worker.id+'.json'),JSON.stringify({...worker,status:'running',scheduled:{...worker.scheduled,originRunId:'other'}}))
- await assert.rejects(exec(process.execPath,[bin,'context'],{env}),/outside this owner binding/)
+ const tampered=await runs.create({id:'tg_tampered',chatId:101,telegramUserId:101,texts:worker.texts,execution,scheduled:{...worker.scheduled!,originRunId:'other'}})
+ await runs.patch(tampered.id,{status:'running'})
+ await assert.rejects(exec(process.execPath,[bin,'context'],{env:{...env,EZ_RUN_ID:tampered.id}}),/outside this owner binding/)
 })

package/test/scheduled-tasks.test.ts

@@ -5,7 +5,8 @@ import { randomUUID } from 'node:crypto'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { Scheduler } from '../src/scheduler.js'
-import { scheduledTasksText } from '../src/scheduled-tasks.js'
+import { scheduledTaskDetailText, scheduledTasksText } from '../src/scheduled-tasks.js'
+import { RunStore } from '../src/runs.js'
 
 const owner = { telegramUserId: 101, telegramChatId: 101, pairedAt: '2026-09-11T00:00:00.000Z' }
 const execution = { sessionId: randomUUID(), preset: { id: 'fixture', name: 'Fixture', cli: 'codex' } }
@@ -18,7 +19,7 @@ test('scheduled task view is read-only, owner-bound, and shows active task promp
   assert.deepEqual(await scheduler.listReadOnly(), [])
   await assert.rejects(access(join(dir, 'schedules')), /ENOENT/)
 
-  await scheduler.save({
+  const saved = await scheduler.save({
     id: 'owner-task', name: 'Daily report', text: 'Read the ledger and send the owner a concise report.', owner, execution, enabled: true,
     trigger: { cron: '0 9 * * 1-5', timezone: 'Asia/Dubai', start: '2026-01-01T00:00:00.000Z' },
   })
@@ -30,9 +31,17 @@ test('scheduled task view is read-only, owner-bound, and shows active task promp
   const scheduleDir = join(dir, 'schedules')
   const before = await readFile(join(scheduleDir, 'owner-task.json'), 'utf8')
   const entries = await readdir(scheduleDir)
-  const text = scheduledTasksText(await scheduler.listActiveReadOnly([]), owner)
+  const runs = new RunStore(dir)
+  const run = await runs.create({
+    id: 'owner-task-run', ownerId: 'telegram:101:101', ownerEpoch: owner.pairedAt, chatId: 101, telegramUserId: 101, texts: [],
+    scheduled: { id: saved.id, revision: saved.revision, dueAt: '2026-01-01T05:00:00.000Z', pairedAt: owner.pairedAt },
+  })
+  await runs.patch(run.id, { status: 'completed', endedAt: '2026-01-01T05:04:00.000Z' })
+  const active = await scheduler.listActiveReadOnly(await runs.list())
+  const text = scheduledTasksText(active, owner)
 
-  assert.equal(text, 'Active scheduled tasks\n\n• Daily report\n  codex · client default · default effort\n  Next: 2026-01-01 05:00:00 UTC\n  Read the ledger and send the owner a concise report.')
+  assert.equal(text, '📅 Scheduled tasks · 1 active\n\nAll times UTC. Use /tasks 1 for task details.\n\n1 · Daily report\n  ● Active\n  Next · Thu, Jan 1 · 05:00 UTC\n  Last · ✓ Completed · Thu, Jan 1 · 05:04 UTC\n  codex · client default · default effort\n  Read the ledger and send the owner a concise report.')
+  assert.match(scheduledTaskDetailText(active.find(schedule => schedule.id === saved.id)!, 1), /Last run\n✓ Completed · Thu, Jan 1 · 05:04 UTC/)
   assert.doesNotMatch(text, /Other owner task|This must never be visible/)
   assert.equal(await readFile(join(scheduleDir, 'owner-task.json'), 'utf8'), before)
   assert.deepEqual(await readdir(scheduleDir), entries)
@@ -42,7 +51,6 @@ test('active view follows existing cursor and run state without changing schedul
   const dir = await mkdtemp(join(tmpdir(),'ez-active-schedules-'))
   t.after(()=>rm(dir,{recursive:true,force:true}))
   const scheduler = new Scheduler(dir)
-  const { RunStore } = await import('../src/runs.js')
   const runs = new RunStore(dir)
   const due = Date.now()+60_000
   const common = {text:'/goal List files.',owner,execution,enabled:true}
@@ -88,7 +96,7 @@ test('prompt preview is one bounded Unicode sentence and preserves stored input'
     enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}})
   const output=scheduledTasksText(await scheduler.listActiveReadOnly([]),owner)
   assert.match(output,/gpt-5.6-terra · high/)
-  assert.match(output,/Next: 2027-01-01 00:00:00 UTC/)
+  assert.match(output,/Next · Fri, Jan 1 · 00:00 UTC/)
   assert.equal(Array.from(output.split('\n').at(-1)!.trim()).length,140)
   assert.ok(output.endsWith('…'))
   assert.doesNotMatch(output,/Do not display/)
@@ -112,3 +120,18 @@ test('a legacy invalid selection does not prevent the active menu from rendering
   const active = await scheduler.listActiveReadOnly([])
   assert.match(scheduledTasksText(active,owner),/codex · gpt-5.6-terra · max/)
 })
+
+test('detail view truncates long instructions and tolerates invalid timestamps', async t => {
+  const dir = await mkdtemp(join(tmpdir(),'ez-schedule-detail-bounds-'))
+  t.after(()=>rm(dir,{recursive:true,force:true}))
+  const scheduler = new Scheduler(dir)
+  const saved = await scheduler.save({id:'long',name:'Long task',text:'/goal '+'x'.repeat(5000),owner,
+    execution,enabled:true,trigger:{at:'2027-01-01T00:00:00Z'}})
+  const active = await scheduler.listActiveReadOnly([])
+  const detail = scheduledTaskDetailText(active.find(schedule => schedule.id === saved.id)!,1,1)
+  assert.match(detail,/📅 1 of 1 · Long task/)
+  assert.match(detail,/truncated; full text lives in the workspace/)
+  assert.ok(detail.length < 3000)
+  const broken = {...active.find(schedule => schedule.id === saved.id)!,nextAt:'not-a-date',lastRun:{status:'completed',at:'also-bad',currentRevision:true}} as never
+  assert.doesNotMatch(scheduledTaskDetailText(broken,1,1),/NaN/)
+})

package/test/scheduler-host.test.ts

@@ -10,6 +10,7 @@ import { EXECUTOR_REGISTRY } from '../src/executor.js'
 import { RunStore } from '../src/runs.js'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let n=0;n<250;n++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Host probe timed out')}
+const stdout=(events:string) => events.trim().split('\n').filter(Boolean).map(line=>JSON.parse(line)).filter(event=>event.stream==='stdout').map(event=>event.text).join('')
 test('host transport reserves separate task and main lanes, pins directories, and cancels only its target',async()=>{
  const root=await mkdtemp(join(tmpdir(),'ez-scheduler-host-')),workspace=join(root,'agent'),controlDir=join(root,'control')
  await mkdir(workspace);await mkdir(controlDir)
@@ -32,12 +33,11 @@ test('host transport reserves separate task and main lanes, pins directories, an
   await submit('tg_1')
   await until(async()=>(await exists('tg_1.events')).includes('"stream":"exit","code":0'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))
-  const scheduled=JSON.parse(JSON.parse((await exists(id+'.events')).trim().split('\n')[0]).text)
-  const main=JSON.parse(JSON.parse((await exists('tg_1.events')).trim().split('\n')[0]).text)
-  assert.equal(scheduled.cwd,await realpath(join(workspace,'work/tasks',id)));assert.equal(main.cwd,await realpath(workspace))
+  const scheduled=JSON.parse(stdout(await exists(id+'.events')))
+  const main=JSON.parse(stdout(await exists('tg_1.events')))
+  assert.equal(scheduled.cwd,await realpath(join(controlDir,'work/tasks',id)));assert.equal(main.cwd,await realpath(workspace))
   assert.equal(scheduled.token,undefined);assert.equal(main.token,undefined)
-  // A malformed scheduled request must not unwind the shared host service.
-  await writeFile(join(controlDir,'runs/r_schedule_corrupt.json'),'{')
+  // An unknown scheduled run must not unwind the shared host service.
   await submit('r_schedule_corrupt')
   await until(async()=>(await exists('r_schedule_corrupt.events')).includes('"stream":"exit","code":1'))
   assert.ok(!(await exists(id+'.events')).includes('"stream":"exit"'))

package/test/scheduler-relay.test.ts

@@ -11,16 +11,18 @@ import { ControlStore } from '../src/control-state.js'
 import { RunStore } from '../src/runs.js'
 import { Scheduler } from '../src/scheduler.js'
 import { initialPreset } from '../src/ai.js'
-import { randomUUID } from 'node:crypto'
 
 const until=async(check:()=>Promise<boolean>)=>{for(let i=0;i<200;i++){if(await check())return;await new Promise(r=>setTimeout(r,20))}throw new Error('Timed out')}
 
-test('maintenance wakeups use an independent ephemeral session after a relay restart',async()=>{
- const dir=await mkdtemp(join(tmpdir(),'ez-maintenance-session-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
- let launchSession='',onSessionCalls=0
+// Adversarial: the relay must not reserve wrapper semantics for an
+// update-shaped run id or a stale attention notice.
+test('a wrapper-shaped run id has no maintenance treatment and a stale notice is inert',async()=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-no-maintenance-session-')),control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ let launchSession='',onSessionCalls=0,launches=0
  const relay=createRelay({workspace:dir,controlDir:dir,pairingTtlMs:1000,executorTimeoutMs:0,executorCli:'codex',telegramBotToken:'fixture'},async(_texts,options)=>{
+  launches++
   launchSession=options.sessionId ?? ''
-  if(options.onSession){onSessionCalls++;await options.onSession('native-maintenance')}
+  if(options.onSession){onSessionCalls++;await options.onSession('native-review')}
   const child=spawn(process.execPath,['-e','setTimeout(()=>{},10)'],{detached:process.platform!=='win32'})
   await once(child,'spawn')
   return {child,cleanup:async()=>{},stdout:''}
@@ -29,13 +31,17 @@ test('maintenance wakeups use an independent ephemeral session after a relay res
  relay.bot.api.config.use(async()=>({ok:true,result:{message_id:42}}) as never)
  try{
   await control.requestPairing(101,101);await control.approveOwner(101)
-  const execution={sessionId:randomUUID(),preset:initialPreset('codex')}
+  const execution=await control.captureChoice(initialPreset('codex'))
   await runs.create({id:'r_update_fixture',chatId:101,telegramUserId:101,texts:['maintenance'],execution})
   await relay.drainSources()
   await until(async()=> (await runs.get('r_update_fixture'))?.status==='completed')
-  assert.notEqual(launchSession,execution.sessionId)
-  assert.equal(onSessionCalls,0)
-}finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
+  assert.equal(launchSession,execution.sessionId)
+  assert.equal(onSessionCalls,1)
+  await writeFile(join(dir,'update-attention.json'),JSON.stringify({id:'a'.repeat(64)}))
+  await relay.drainSources()
+  assert.equal(launches,1)
+  assert.equal((await runs.list()).length,1)
+ }finally{await relay.stop();await rm(dir,{recursive:true,force:true})}
 })
 
 test('chat replies through the real ingress/outbox while scheduled CLI remains alive; targeted cancellation',async()=>{

package/test/security.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, symlink, mkdir } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, symlink, mkdir, stat } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { isOwner } from '../src/identity.js'
@@ -26,7 +26,7 @@ test('owner gate denies groups, bots, missing identity, and a different sender o
   assert.equal(isOwner({ from, chat }, null), false)
 })
 
-test('store identifiers reject traversal; corrupt records cannot authorize or block healthy runs', async () => {
+test('store identifiers reject traversal; corrupt control state fails closed and the ledger writes nothing', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'ez-negative-'))
   try {
     const runs = new RunStore(dir)
@@ -34,8 +34,11 @@ test('store identifiers reject traversal; corrupt records cannot authorize or bl
     await assert.rejects(runs.claimOutbox('../control-state'), /Invalid/)
     await assert.rejects(new ApprovalStore(dir).getDecision('../escape'), /Invalid/)
     const run = await runs.create({ chatId: 101, telegramUserId: 101, texts: ['test'] })
-    await writeFile(join(dir, 'runs', 'broken.json'), '{')
     assert.equal((await runs.nextQueued())?.id, run.id)
+    // Run/outbox/inbox bookkeeping is memory-only: no control/ files exist to corrupt.
+    await assert.rejects(stat(join(dir, 'runs')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'outbox')), { code: 'ENOENT' })
+    await assert.rejects(stat(join(dir, 'inbox.json')), { code: 'ENOENT' })
     await writeFile(join(dir, 'control-state.json'), '{')
     await assert.rejects(new ControlStore(dir, 1000).status())
   } finally {

package/test/software-status.test.ts

@@ -4,7 +4,13 @@ import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { installedPluginVersions, softwareStatus } from '../src/software-status.js'
-import { packageVersion } from '../src/version.js'
+import { formatRelayLabel, packageVersion } from '../src/version.js'
+
+test('relay label shows the running RC tag first', () => {
+  assert.equal(formatRelayLabel('0.1.0-beta.35', 'rc2', 'abc123def4567890'), 'rc2 (v0.1.0-beta.35 · abc123def456)')
+  assert.equal(formatRelayLabel('0.1.0-beta.35', 'rc2'), 'rc2 (v0.1.0-beta.35)')
+  assert.equal(formatRelayLabel('1.0.0'), 'v1.0.0')
+})
 
 test('Telegram software status uses loaded version and only fresh host plugin metadata', async t => {
   const root=await mkdtemp(path.join(tmpdir(),'ez-software-status-'))
@@ -14,9 +20,10 @@ test('Telegram software status uses loaded version and only fresh host plugin me
   const plugins=await installedPluginVersions(root)
   assert.deepEqual(plugins,[{id:'whatsapp',version:'0.1.0-beta.3'}])
   const heartbeat=path.join(root,'host-executor/heartbeat.json')
-  await writeFile(heartbeat,JSON.stringify({at:Date.now(),version:'0.1.0-beta.4',plugins}))
-  const lines=await softwareStatus(root)
+  await writeFile(heartbeat,JSON.stringify({at:Date.now(),version:'0.1.0-beta.4',platform:'darwin',arch:'arm64',plugins}))
+  const lines=await softwareStatus(root,'host-capable')
   assert.equal(lines[0],`Relay: running · v${packageVersion}`)
+  assert(lines.includes('Env: mac (darwin/arm64) · host-capable · host'))
   assert(lines.includes('Host transport: running · v0.1.0-beta.4'))
   assert(lines.includes('Plugins: whatsapp 0.1.0-beta.3'))
   assert(!JSON.stringify(lines).includes('/private'))
@@ -28,4 +35,15 @@ test('Telegram software status uses loaded version and only fresh host plugin me
   assert((await softwareStatus(root)).includes('Host transport: running · version unknown'))
   await writeFile(path.join(root,'registry.json'),'broken')
   assert.equal(await installedPluginVersions(root),null)
+  await rm(heartbeat)
+  assert((await softwareStatus(root)).includes('Host transport: unavailable'))
+  assert((await softwareStatus(root)).includes('Plugins: unknown'))
+  assert((await softwareStatus(root)).some(l => l.startsWith('Env:') && l.includes('unknown · unknown')))
+  assert((await softwareStatus(root,'isolated')).includes('Host transport: n/a · isolated execution'))
+  assert((await softwareStatus(root,'isolated')).some(l => l.startsWith('Env:') && l.includes('isolated · local')))
+  assert((await softwareStatus(root,'isolated')).includes('Plugins: isolated broker · versions via `ez tools list`'))
+  await writeFile(path.join(root,'plugin-broker-plugins.json'),JSON.stringify({version:1,at:new Date().toISOString(),plugins:[{id:'voice',version:'0.2.0'}]}))
+  assert((await softwareStatus(root,'isolated')).includes('Plugins: voice 0.2.0'))
+  await writeFile(path.join(root,'plugin-broker-plugins.json'),'broken')
+  assert((await softwareStatus(root,'isolated')).includes('Plugins: isolated broker · versions via `ez tools list`'))
 })