@jc_stack/ez-agents 0.1.0-beta.36 → 0.1.0-beta.38

package/.env.example

@@ -13,9 +13,9 @@ EZ_AGENT_WORKSPACE=./agent
 # Optional. Default is 300.
 # Agent execution has no wall-clock timeout. Use /stop or schedule cancel.
 
-# CLI Executor adapter. Supported: agy (default), claude, grok, opencode
+# CLI Executor adapter. Supported: codex (default), codex-gui, claude, grok, opencode, pi
 # Switch easily with: pnpm run setup <executor-name>
-EZ_EXECUTOR_CLI=agy
+EZ_EXECUTOR_CLI=codex
 
 # Optional: Audio transcription (STT) and voice synthesis (TTS)
 # GEMINI_API_KEY=

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 0.1.0-beta.38
+
+- Remove the retired Antigravity CLI integration and its unused engine paths.
+- Add scoped application delivery history readback so an authorized application
+  can retrieve its own messages and delivery receipts.
+- Validate host execution against its advertised model catalog and keep host
+  heartbeats responsive during background catalog refresh.
+
+## 0.1.0-beta.37
+
+- List installed OpenCode models with their provider variants as selectable
+  efforts in Choose AI, chat and scheduled tasks. The relay spawns the
+  installed `opencode` CLI with the whitelisted executor environment, so the
+  menu reflects that CLI's reported catalog; variants pass through verbatim as
+  `run --variant` on every platform. Restricted messaging tasks stay on the
+  audited Codex. The relay image now ships pinned OpenCode 1.18.32 for
+  isolated agents; host-capable agents reuse the host installation.
+- Provision authenticated OpenCode providers per agent through
+  `control/cli/opencode/auth.json`: isolated runs resolve it via an
+  agent-bound data home. Paid models may appear in the catalog; execution
+  depends on valid provider authorization. Host runs keep the installer login
+  and the free tier stays the fallback.
+- Scope selectable OpenCode catalog entries with `EZ_OPENCODE_PROVIDERS` (e.g.
+  Go only): unlisted providers, including the free tier, leave the menu.
+  Isolated relays read it from their environment; host transports take
+  `opencodeProviders` on the agent's host binding instead. An existing
+  model-less default still follows the native client's provider choice.
+  Existing deployments need an installer-owned bootstrap for the new Compose
+  environment field before their automatic main updater accepts this release.
+- Allow unbound plugins to run through the isolated broker when a different
+  installed plugin declares a host network binding; bound plugins still fail
+  closed on an isolated deployment.
+- Add a Pi native executor with the exact conversation session ID. It offers
+  its native default when no provider scope is set. Owner-curated model choices
+  require Pi's own provider credentials and are filtered by scope. The relay
+  image installs pinned Pi 0.87.1.
+
 ## 0.1.0-beta.36
 
 - Move relay run/outbox/inbox bookkeeping into relay memory behind the control

package/Dockerfile

@@ -9,10 +9,21 @@ COPY . .
 FROM dependencies AS test
 RUN pnpm verify
 FROM dependencies AS runtime
-# Keep this pin aligned with TASK_CODEX_VERSION. Isolated agents run this CLI
-# in the relay; do not bind-mount the operator's ~/.codex.
+# Isolated agents run this CLI in the relay; do not bind-mount the
+# operator's ~/.codex. Pin the reviewed CLI for repeatable release images.
 ARG CODEX_CLI_VERSION=0.153.4
 RUN npm install -g @openai/codex@${CODEX_CLI_VERSION} && command -v codex
+# Isolated agents run the selected CLI in the relay; host-capable agents reuse
+# the host installation instead. OpenCode carries no task-runner pin because
+# restricted messaging tasks stay on the audited Codex above.
+# Pin the reviewed CLI for repeatable release images.
+ARG OPENCODE_CLI_VERSION=1.18.32
+RUN npm install -g opencode-ai@${OPENCODE_CLI_VERSION} && command -v opencode && opencode --version
+# Isolated agents select pi from the relay menu; the binary must resolve on
+# the relay PATH just like codex/opencode above.
+# Pin the reviewed CLI for repeatable release images.
+ARG PI_CLI_VERSION=0.87.1
+RUN npm install -g @earendil-works/pi-coding-agent@${PI_CLI_VERSION} && command -v pi
 RUN chmod +x docker/entrypoint.sh bin/ez bin/ezenciel-agents* && mkdir -p /state/control /state/home /workspace && chown node:node /state/control /state/home /workspace
 RUN node -e 'for (const [name, target] of Object.entries(require("./package.json").bin)) require("node:fs").symlinkSync("/app/" + target, "/usr/local/bin/" + name); require("node:fs").symlinkSync("/app/bin/ez", "/usr/local/bin/ez")'
 # Build identity for relay status (package version stays release-owned).

package/README.md

@@ -291,7 +291,6 @@ Existing conversations without a title show their first saved message and date w
 available. Empty routing placeholders are omitted from history; + New conversation
 is the create action. Back updates the current menu without creating a conversation. Use /rename for a custom name. Older
 records without a saved model reuse a known choice for their original CLI.
-Antigravity's latest-only resume cannot switch back to an older conversation.
 The list covers sessions already tracked by this Ez agent; it does not import
 unrelated GUI/CLI history. Application-backed channels keep session controls in
 the connected application. Shared workspace files still persist across topics.

package/THIRD_PARTY_NOTICES.md

@@ -8,7 +8,10 @@ The container is built locally; no bundled third-party binary image is promised.
 
 Direct runtime dependencies: grammy (MIT), tsx (MIT). Development dependencies
 include TypeScript (Apache-2.0) and Node type definitions (MIT). The runtime
-image installs ffmpeg, Debian packages, and pinned `@openai/codex` (Apache-2.0):
-redistributing that image requires review of its exact package build, notices and
-corresponding-source obligations. Docker and a host-capable AI CLI remain
-separately installed products, not covered by this repository's MIT license.
+image installs ffmpeg, Debian packages, and these reviewed CLI versions:
+`@openai/codex` 0.153.4 (Apache-2.0), `opencode-ai` 1.18.32 (MIT), and
+`@earendil-works/pi-coding-agent` 0.87.1 (MIT). Redistributing the image
+requires review of its exact package build, notices and corresponding-source
+obligations. Docker and
+host-capable AI CLIs remain separately installed products, not covered by this
+repository's MIT license.

package/compose.yaml

@@ -28,6 +28,7 @@ services:
       EZ_CONTROL_DIR: ${EZ_CONTROL_DIR:?Set this agent control directory}
       EZ_EXECUTOR_CLI: ${EZ_EXECUTOR_CLI:?Set the host installation CLI}
       EZ_CODEX_SANDBOX: ${EZ_CODEX_SANDBOX:-}
+      EZ_OPENCODE_PROVIDERS: ${EZ_OPENCODE_PROVIDERS:-}
       EZ_CODEX_AUTO_COMPACT_TOKENS: ${EZ_CODEX_AUTO_COMPACT_TOKENS:-64000}
       EZ_EXECUTOR_TIMEOUT_SECONDS: ${EZ_EXECUTOR_TIMEOUT_SECONDS:-300}
     secrets: [relay_env]

package/docs/application-channel.md

@@ -131,6 +131,14 @@ not that a human read it. Failure adds a generic `error`; detailed logs remain
 local to core. Cancellation uses the existing child termination boundary and may
 return `running` until the process exits.
 
+Inside an active native application run, `ezenciel-agents-message history
+--limit 8` reads delivered text from this same inbox for the run's immutable
+application binding and scope, including earlier runs in that scope. It cannot
+read another binding, scope, or Telegram chat. The Telegram numeric
+`--message-id` filter is unavailable for application runs. This reads the same
+bounded relay delivery state as the application inbox; both disappear on relay
+restart and add no persistent message record.
+
 `requestId` and `scope` accept 1–200 ASCII letters, digits, `_:.-`. Text is at most
 16,000 characters. Context is an optional JSON object (48 KiB); the complete HTTP
 body is bounded to 64 KiB. Unknown input fields are rejected. Use a stable job ID:
@@ -155,8 +163,7 @@ application must not infer or auto-submit consent.
 
 Each application binding plus scope gets an existing core session. Its first run
 captures the selected engine/preset; later runs resume that same native session.
-Application sessions are excluded from the Telegram session selector. Engines
-that only resume an implicit latest session (`agy`) cannot serve isolated scopes.
+Application sessions are excluded from the Telegram session selector.
 
 Before cutting over an existing application, stop its old runner, copy its native
 transcripts into the ordinary engine's private state, and import each authoritative

package/docs/architecture/ai-selection.md

@@ -34,8 +34,16 @@ References used for the adapter contract:
 - [OpenCode native run events](https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/cli/cmd/run.ts)
 
 The catalog is local metadata, not an authentication or billing health check.
-Grok/Codex support explicit listed model/effort choices. Other installed clients
-offer their own default only in this slice. Refresh by opening the native client;
+Grok/Codex/OpenCode support explicit listed model/effort choices. Other installed clients
+offer their own default only in this slice. OpenCode lists the installed `opencode models`
+catalog with the whitelisted executor environment, so only models the relay can actually
+run are offered; provider variants become selectable efforts (`--variant`).
+Authenticated providers appear only when the agent-bound
+`control/cli/opencode/auth.json` binding exists (host runs keep the installer
+login); otherwise the free tier lists. `EZ_OPENCODE_PROVIDERS` optionally
+restricts the catalog to named providers (e.g. `opencode-go`); a set
+allowlist that matches nothing offers no OpenCode choice rather than falling
+back outside it. Refresh by opening the native client;
 the relay does not install models, manage subscriptions or guess aliases.
 
 Setup initialization and relay startup seed one default choice per installed client.

package/docs/docker-runtime.md

@@ -239,6 +239,25 @@ workspace (a tenant farm), while allowing explicitly shared and additional
 workspace grants and leaving `$HOME` readable for the host CLI.
 Codex then uses `danger-full-access` so it does not apply a nested Seatbelt.
 
+## OpenCode auth
+
+Isolated agents run the image OpenCode with `XDG_DATA_HOME` set to the
+agent-bound `control/cli` directory only when the owner provisioned
+`control/cli/opencode/auth.json` there (mode `600`, copied once from the host
+`opencode auth login`). Authenticated providers then list and run; otherwise
+only the free tier is offered and paid turns fail closed with the provider
+error. Only the directory path crosses into the executor environment, never a
+secret. Host-capable agents reuse the host login and ignore the binding.
+
+`EZ_OPENCODE_PROVIDERS` optionally restricts the catalog to named providers,
+e.g. `opencode-go` for Go credentials only. Isolated relays read it from
+their environment (`docker.env` through the relay `environment`); the host
+transport is spawned with a scrubbed environment, so host-capable agents set
+`opencodeProviders` on the agent's `host-executor.json` binding instead
+(validated the same way, unknown fields ignored by older releases). Unset or
+absent means unfiltered; a set scope that matches nothing offers no OpenCode
+choice rather than falling back outside it.
+
 ## Chat latency
 
 Interactive Codex CLI turns resume the existing native session and use native

package/docs/upgrades.md

@@ -245,7 +245,7 @@ The package-owned locator is the managed `<!-- ez tools -->` block: the bound
 generated on read. Plugin registry init and update binding refresh that locator.
 Malformed markers and symlinks fail visibly rather than overwriting personal work.
 
-Codex, agy, Grok and OpenCode discover workspace instructions natively. Claude
+Codex, Grok and OpenCode discover workspace instructions natively. Claude
 receives the native `--append-system-prompt-file` binding to `AGENTS.md`, alongside
 its own normal instructions. Fresh and resumed owner input is literal; ez does
 not surround it with policies, tool recipes, repair instructions or history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jc_stack/ez-agents",
-  "version": "0.1.0-beta.36",
+  "version": "0.1.0-beta.38",
   "private": false,
   "type": "module",
   "description": "A lightweight foundation for persistent business AI assistants using existing AI harnesses, workspaces and plugins.",

package/src/ai-cli.ts

@@ -12,7 +12,7 @@ if(values.help){
 }
 if (!process.env.EZ_CONTROL_DIR) throw new Error('Use this agent’s bound control directory')
 const catalog=await readFile(join(process.env.EZ_CONTROL_DIR,'host-executor','models.json'),'utf8')
-  .then(text=>JSON.parse(text)).catch(()=>readModels(undefined,undefined,join(process.env.EZ_CONTROL_DIR!,'cli','codex')))
+  .then(text=>JSON.parse(text)).catch(()=>readModels(undefined,undefined,join(process.env.EZ_CONTROL_DIR!,'cli','codex'),undefined,undefined,undefined,process.env.EZ_CONTROL_DIR))
 if(positionals[0]==='list')console.log(JSON.stringify(catalog))
 else if(positionals[0]==='select'){
   const preset:AiPreset={id:randomBytes(8).toString('hex'),name:[values.provider,values.model||values.cli,values.effort].filter(Boolean).join(' · '),cli:values.cli||'',provider:values.provider,model:values.model,effort:values.effort}

package/src/ai.ts

@@ -1,20 +1,25 @@
 import { assertEffort, allowedEffort } from './model-policy.js'
 import { access, readFile } from 'node:fs/promises'
 import { constants } from 'node:fs'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
 import { homedir } from 'node:os'
 import { join, delimiter } from 'node:path'
-import { executorKey, resolveExecutor } from './executor.js'
+import { executorEnvironment, executorKey, resolveExecutor } from './executor.js'
 import { desktopCodexPath } from './desktop-bridge.js'
 
 export type AiPreset = { id: string; name: string; cli: string; provider?: string; model?: string; effort?: string }
 export type ExecutionChoice = { sessionId: string; preset: AiPreset }
 export type ModelChoice = { cli: string; provider?: string; model?: string; name: string; efforts: string[] }
 const safe = (s: unknown): s is string => typeof s === 'string' && /^[a-zA-Z0-9_./:-]{1,160}$/.test(s)
+const knownClis = ['grok', 'codex', 'codex-gui', 'claude', 'opencode', 'pi']
+const nativeEffort = (cli: string, effort: string) =>
+  cli === 'pi' ? ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].includes(effort) : true
 export const isPreset = (p: unknown): p is AiPreset => {
   if (!p || typeof p !== 'object') return false
   const v = p as AiPreset
   return safe(v.id) && typeof v.name === 'string' && v.name.length > 0 && v.name.length <= 80 &&
-    ['grok', 'codex', 'codex-gui', 'claude', 'opencode', 'agy'].includes(v.cli) &&
+    knownClis.includes(v.cli) &&
     (v.provider === undefined || safe(v.provider)) && (v.model === undefined || safe(v.model)) && (v.effort === undefined || safe(v.effort))
 }
 export const isExecutionChoice = (v: unknown): v is ExecutionChoice => {
@@ -45,7 +50,81 @@ export const installed = async (cli: string): Promise<boolean> => {
 
 // Read only metadata from native client catalogs. Never import prompts, credentials,
 // provider configuration, or model instructions into relay context.
-export const readModels = async (home = homedir(), available = installed, codexHome = join(home, '.codex')): Promise<ModelChoice[]> => {
+// The optional runner injects `opencode models` output in tests; production
+// spawns the installed CLI with the whitelisted executor environment.
+export const readOpencodeModels = async (run?: (args: string[]) => Promise<string>, dataHome?: string): Promise<ModelChoice[]> => {
+  const exec = run ?? (async (args: string[]) =>
+    (await promisify(execFile)('opencode', args, { env: { ...executorEnvironment(), ...(dataHome ? { XDG_DATA_HOME: dataHome } : {}) }, timeout: 8000, maxBuffer: 4 * 1024 * 1024 })).stdout)
+  const record = (value: unknown): Record<string, unknown> =>
+    value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
+  try {
+    const stdout = await exec(['models', '--verbose'])
+    // Verbose output alternates a `provider/model` identifier line with its
+    // pretty-printed JSON metadata (name, variants). Split on identifier lines
+    // so variant keys can be projected as selectable efforts.
+    const segments = stdout.split(/^([A-Za-z0-9_.\-]+\/[A-Za-z0-9_./:~\-]+)$/m)
+    const entries: ModelChoice[] = []
+    for (let index = 1; index + 1 < segments.length; index += 2) {
+      const id = segments[index].trim()
+      if (!safe(id)) continue
+      let meta: Record<string, unknown>
+      try { meta = record(JSON.parse(segments[index + 1])) } catch { continue }
+      const friendly = typeof meta.name === 'string' ? meta.name.trim() : ''
+      const efforts = Object.keys(record(meta.variants))
+        .filter((effort) => safe(effort) && allowedEffort(effort, id, 'opencode'))
+      entries.push({ cli: 'opencode', model: id,
+        name: (friendly ? `${friendly} · ${id}` : id).slice(0, 80), efforts })
+    }
+    if (entries.length) return entries
+  } catch { /* fall through to the plain list, then the client default */ }
+  try {
+    const stdout = await exec(['models'])
+    const entries: ModelChoice[] = []
+    for (const line of stdout.split(/\r?\n/)) {
+      const id = line.trim()
+      if (!id || !safe(id)) continue
+      entries.push({ cli: 'opencode', model: id, name: id.slice(0, 80), efforts: [] })
+    }
+    if (entries.length) return entries
+  } catch { /* unavailable metadata stays client default */ }
+  return []
+}
+
+// User-curated entries live in the agent's own setup (control/ai-models.json),
+// never in the repo. They pin models the native catalogs may not currently
+// serve (e.g. paid tiers) and merge ahead of discovered entries, so selection
+// validation accepts them.
+export const readCuratedModels = async (controlDir?: string): Promise<ModelChoice[]> => {
+  if (!controlDir) return []
+  const curated: ModelChoice[] = []
+  const seen = new Set<string>()
+  try {
+    const raw = JSON.parse(await readFile(join(controlDir, 'ai-models.json'), 'utf8'))
+    if (!Array.isArray(raw)) return []
+    for (const candidate of raw) {
+      if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) continue
+      const entry = candidate as Record<string, unknown>
+      if (typeof entry.cli !== 'string' || !knownClis.includes(entry.cli)) continue
+      if (entry.provider !== undefined && !safe(entry.provider)) continue
+      if (entry.model !== undefined && !safe(entry.model)) continue
+      const key = `${entry.cli}‖${entry.provider ?? ''}‖${entry.model ?? ''}`
+      if (seen.has(key)) continue
+      seen.add(key)
+      curated.push({
+        cli: entry.cli,
+        ...(entry.provider !== undefined ? { provider: entry.provider as string } : {}),
+        ...(entry.model !== undefined ? { model: entry.model as string } : {}),
+        name: (typeof entry.name === 'string' && entry.name ? entry.name : String(entry.model ?? entry.cli)).slice(0, 80),
+        efforts: (Array.isArray(entry.efforts) ? entry.efforts : [])
+          .filter((effort): effort is string => safe(effort))
+          .filter((effort) => allowedEffort(effort, typeof entry.model === 'string' ? entry.model : undefined, entry.cli as string) && nativeEffort(entry.cli as string, effort)),
+      })
+    }
+  } catch { return [] }
+  return curated
+}
+
+export const readModels = async (home = homedir(), available = installed, codexHome = join(home, '.codex'), opencodeRunner?: (args: string[]) => Promise<string>, opencodeDataHome?: string, opencodeAllowlist?: string[], curationDir?: string): Promise<ModelChoice[]> => {
   const models: ModelChoice[] = []
   const record = (value: unknown): Record<string, unknown> =>
     value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
@@ -79,15 +158,61 @@ export const readModels = async (home = homedir(), available = installed, codexH
     models.push(...(desktop.length ? desktop : [{ cli: 'codex-gui', name: 'codex-gui · desktop', efforts: [] }]))
   }
   // Other adapters expose the authenticated client's default, not a guessed catalog.
-  for (const cli of ['claude', 'opencode', 'agy'])
-    if (await available(cli)) models.push({ cli, name: `${cli} · client default`, efforts: [] })
-  return models
+  if (await available('claude')) models.push({ cli: 'claude', name: 'claude · client default', efforts: [] })
+  const allow = opencodeAllowlist ?? opencodeProviderAllowlist()
+  if (await available('opencode')) models.push(...await opencodeCatalogModels(opencodeRunner, opencodeDataHome, allow))
+  // Pi has separate provider configuration. OpenCode's catalog cannot
+  // establish which models Pi can execute.
+  if (!allow && await available('pi')) models.push({ cli: 'pi', name: 'Pi · client default', efforts: [] })
+  const curated = await readCuratedModels(curationDir)
+  if (!curated.length) return models
+  const scoped: ModelChoice[] = []
+  for (const entry of curated) {
+    if (!(await available(entry.cli))) continue
+    if (['opencode', 'pi'].includes(entry.cli) && allow &&
+        (entry.model === undefined || !allow.includes(entry.model.split('/')[0]))) continue
+    scoped.push(entry)
+  }
+  const key = (m: { cli: string; provider?: string; model?: string }) => `${m.cli}‖${m.provider ?? ''}‖${m.model ?? ''}`
+  const curatedKeys = new Set(scoped.map(key))
+  return [...scoped, ...models.filter((m) => !curatedKeys.has(key(m)))]
+}
+export const opencodeCatalogModels = async (
+  opencodeRunner?: (args: string[]) => Promise<string>,
+  opencodeDataHome?: string,
+  opencodeAllowlist?: string[],
+): Promise<ModelChoice[]> => {
+  const discovered = await readOpencodeModels(opencodeRunner, opencodeDataHome)
+  const allow = opencodeAllowlist ?? opencodeProviderAllowlist()
+  const scoped = allow ? discovered.filter((m) => m.model && allow.includes(m.model.split('/')[0])) : discovered
+  if (scoped.length) return scoped
+  // A set allowlist that matches nothing offers no choice rather than falling
+  // back outside the allowed providers.
+  if (allow) return []
+  return [{ cli: 'opencode', name: 'opencode · client default', efforts: [] as string[] }]
+}
+
+// Optional deployment-scoped restriction of the OpenCode catalog to named
+// providers (e.g. EZ_OPENCODE_PROVIDERS=opencode-go). Unset means unfiltered.
+// Reads process env directly like OPENCODE_MODEL; malformed values fail fast
+// so /ai reports the misconfiguration instead of a silently wrong list.
+const providerId = (p: unknown): p is string => typeof p === 'string' && /^[a-z][a-z0-9_-]{0,31}$/.test(p)
+export const validateOpencodeProviders = (value: unknown): string[] | undefined => {
+  if (value === undefined) return undefined
+  if (!Array.isArray(value) || !value.length || value.length > 16 || new Set(value).size !== value.length || value.some((p) => !providerId(p)))
+    throw new Error('opencode provider allowlist must be one to sixteen unique provider IDs')
+  return value as string[]
+}
+export const opencodeProviderAllowlist = (env: NodeJS.ProcessEnv = process.env): string[] | undefined => {
+  const raw = env.EZ_OPENCODE_PROVIDERS?.trim()
+  if (!raw) return undefined
+  return validateOpencodeProviders([...new Set(raw.split(',').map((p) => p.trim()).filter(Boolean))])
 }
 
 export const validateSelection = async (p: AiPreset, catalog: ModelChoice[], available = installed): Promise<void> => {
   assertEffort(p.effort, p.model, p.cli)
   if (!isPreset(p) || !(await available(p.cli))) throw new Error('This CLI is not installed.')
-  if (!p.provider && !p.model && !p.effort && p.cli !== 'agy') return
+  if (!p.provider && !p.model && !p.effort) return
   const model = catalog.find((m) => m.cli === p.cli && m.provider === p.provider && m.model === p.model)
   if (!model || (p.effort && !model.efforts.includes(p.effort)))
     throw new Error('This model/effort is not in the installed client catalog. Refresh the client and try again; no fallback was selected.')

package/src/application-channel.ts

@@ -206,7 +206,7 @@ export class ApplicationChannel {
     }
     if (value.action==='model') {
       const model = (await controls.catalog()).find(item=>item.cli===value.cli && item.provider===value.provider && item.model===value.model)
-      if (!model || model.cli==='agy' || (value.effort!==undefined && (typeof value.effort!=='string' || !model.efforts.includes(value.effort)))) throw new Error('Invalid application model selection')
+      if (!model || (value.effort!==undefined && (typeof value.effort!=='string' || !model.efforts.includes(value.effort)))) throw new Error('Invalid application model selection')
       preset = await controls.saveSelection(model,value.effort as string|undefined,guard)
     }
     await control.changeApplicationSession(hashedScope,guard,preset)

package/src/config.ts

@@ -78,7 +78,7 @@ export const loadConfig = (env: NodeJS.ProcessEnv = process.env): Config => {
     isolation,
     codexSandbox: codexSandbox === 'external' ? 'external' : undefined,
     codexAutoCompactTokens: !env.EZ_CODEX_AUTO_COMPACT_TOKENS?.trim() ? undefined : positiveInteger(env.EZ_CODEX_AUTO_COMPACT_TOKENS, 'EZ_CODEX_AUTO_COMPACT_TOKENS'),
-    executorCli: env.EZ_EXECUTOR_CLI?.trim() || 'agy',
+    executorCli: env.EZ_EXECUTOR_CLI?.trim() || 'codex',
     applicationPort: env.EZ_APPLICATION_PORT ? positiveInteger(env.EZ_APPLICATION_PORT, 'EZ_APPLICATION_PORT') : undefined,
     applicationHost: env.EZ_APPLICATION_HOST?.trim() || '127.0.0.1',
     channelBackendUrl: env.EZ_CHANNEL_BACKEND_URL?.trim(),

package/src/control-state.ts

@@ -483,8 +483,6 @@ export class ControlStore {
       if (state.activeSession?.sessionId === sessionId) return state.activeSession
       const session = state.sessions?.find(s => s.sessionId === sessionId)
       if (!session || session.archived || (session.applicationScope && !session.telegramShared)) throw new Error('Conversation unavailable. Open /chats again.')
-      if (session.cli === 'agy')
-        throw new Error('Antigravity only resumes its latest conversation; selecting an older session is not supported.')
       const ai = state.ai
       // Older sessions did not record their model. Reuse a known preset for the
       // same CLI; never resume an engine ID through a different client.
@@ -684,7 +682,6 @@ export class ControlStore {
         return { sessionId: previous.sessionId, preset: previous.preset }
       }
       const preset = requested ?? state.ai.presets.find(item => item.id === state.ai!.selectedId)!
-      if (preset.cli === 'agy') throw new Error('Application scopes require an engine with explicit session selection')
       const session: SessionState = { sessionId: crypto.randomUUID(), hasStarted: false, cli: preset.cli, preset, applicationScope: scope }
       state.sessions.push(session)
       activate(session)
@@ -707,7 +704,7 @@ export class ControlStore {
       if (previous && (previous.telegramShared || previous === state.activeSession))
         throw new Error('Application scope is shared; use shared controls')
       const nextPreset = preset ?? state.ai?.presets.find(item => item.id === state.ai!.defaultId)
-      if (!nextPreset || !isPreset(nextPreset) || nextPreset.cli === 'agy') throw new Error('Invalid application AI selection')
+      if (!nextPreset || !isPreset(nextPreset)) throw new Error('Invalid application AI selection')
       if (preset && previous?.cli === preset.cli) {
         previous.preset = persistedPreset(preset)
         await this.writeState(state)

package/src/executor.ts

@@ -103,7 +103,6 @@ export const resolveHostCommand = (command: string, pathValue = process.env.PATH
   }
   throw new Error(`Native CLI ${command} is not executable on the host PATH`)
 }
-
 export type CliAdapter = {
   name: string
   command: string
@@ -144,17 +143,6 @@ export const EXECUTOR_REGISTRY: Record<string, CliAdapter> = {
       return args
     },
   },
-  agy: {
-    name: 'antigravity',
-    command: 'agy',
-    description: 'Google Antigravity CLI (default)',
-    buildArgs: (opts, _promptFile, promptText) => {
-      const args: string[] = []
-      if (opts.isResume) args.push('-c')
-      args.push('--dangerously-skip-permissions', `--print=${promptText}`)
-      return args
-    },
-  },
   claude: {
     name: 'claude',
     command: 'claude',
@@ -210,6 +198,30 @@ export const EXECUTOR_REGISTRY: Record<string, CliAdapter> = {
       return args
     },
   },
+  pi: {
+    name: 'pi',
+    command: 'pi',
+    description: 'Pi coding agent',
+    buildArgs: (opts, _promptFile, promptText) => {
+      if (!opts.controlDir) throw new Error('Pi runs require a bound control directory for sessions')
+      if (opts.effort && !['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].includes(opts.effort)) throw new Error('Invalid Pi thinking level')
+      const args = ['-p', '--mode', 'json', '--session-dir', path.join(opts.controlDir, 'cli', 'pi', 'sessions')]
+      // Owner-provisioned delivery skill (control/cli/pi/skills/ez-delivery).
+      // Loaded by path, never by prompt text, so the model cannot miss it.
+      try {
+        const skill = path.join(opts.controlDir, 'cli', 'pi', 'skills', 'ez-delivery', 'SKILL.md')
+        accessSync(skill, fsConstants.R_OK)
+        args.push('--skill', path.dirname(skill))
+      } catch { /* runs without the skill exactly as before */ }
+      // Bind Pi to this conversation, not the most recently used session in
+      // the shared directory. --session-id creates or resumes that exact ID.
+      if (opts.sessionId) args.push('--session-id', opts.sessionId)
+      if (opts.model) args.push('--model', opts.model)
+      if (opts.effort) args.push('--thinking', opts.effort)
+      args.push('--', promptText)
+      return args
+    },
+  },
   'codex-gui': {
     name: 'codex-gui',
     command: 'codex',
@@ -219,13 +231,12 @@ export const EXECUTOR_REGISTRY: Record<string, CliAdapter> = {
 }
 
 export const EXECUTOR_ALIASES: Record<string, string> = {
-  antigravity: 'agy',
   'claude-code': 'claude',
   oc: 'opencode',
 }
 
 export const executorKey = (name?: string): string => {
-  const normalized = (name ?? 'agy').trim().toLowerCase()
+  const normalized = (name ?? 'codex').trim().toLowerCase()
   const resolvedKey = EXECUTOR_ALIASES[normalized] ?? normalized
   if (!EXECUTOR_REGISTRY[resolvedKey]) {
     const supported = [...Object.keys(EXECUTOR_REGISTRY), ...Object.keys(EXECUTOR_ALIASES)].join(', ')
@@ -262,6 +273,27 @@ export const validateCodexProviderEnvironmentKey = (value: unknown): string => {
 
 export const resolveExecutor = (name?: string): CliAdapter => EXECUTOR_REGISTRY[executorKey(name)]
 
+// Agent-bound OpenCode credentials live at cli/opencode/auth.json, mirroring
+// the Codex binding. Returns the XDG data home (cli/) only when that binding
+// exists; otherwise the host login (host transport) or the unauthenticated
+// free tier (isolated relay) applies. Only a path is ever returned, never a
+// secret.
+export const opencodeDataHome = (controlDir: string): string | undefined => {
+  try {
+    accessSync(path.join(controlDir, 'cli', 'opencode', 'auth.json'), fsConstants.R_OK)
+    return path.join(controlDir, 'cli')
+  } catch { return undefined }
+}
+
+// Pi resolves its provider/model catalog from an agent dir (settings.json,
+// auth.json). Only a path is ever returned, never a secret.
+export const piAgentDir = (controlDir: string): string | undefined => {
+  try {
+    accessSync(path.join(controlDir, 'cli', 'pi', 'agent', 'auth.json'), fsConstants.R_OK)
+    return path.join(controlDir, 'cli', 'pi', 'agent')
+  } catch { return undefined }
+}
+
 export const grokInvocation = (
   options: Pick<ExecutorOptions, 'workspace' | 'isResume'>,
   promptFile: string,
@@ -270,14 +302,6 @@ export const grokInvocation = (
   args: EXECUTOR_REGISTRY.grok.buildArgs(options, promptFile, ''),
 })
 
-export const antigravityInvocation = (
-  prompt: string,
-  options: Pick<ExecutorOptions, 'isResume'> = {},
-): { command: string; args: string[] } => ({
-  command: EXECUTOR_REGISTRY.agy.command,
-  args: EXECUTOR_REGISTRY.agy.buildArgs({ workspace: '', ...options }, '', prompt),
-})
-
 export const opencodeInvocation = (
   prompt: string,
   options: Pick<ExecutorOptions, 'workspace' | 'sessionId' | 'isResume'> = { workspace: '' },
@@ -363,6 +387,22 @@ export const startExecutorJob = async (
     }
     environment.CODEX_HOME = home
   }
+  if (!host && !gui && key === 'opencode') {
+    // Point OpenCode at the agent-bound data home (cli/opencode/auth.json)
+    // when the owner provisioned it. Host runs keep the installer login;
+    // without a binding the CLI falls back to its free tier. Fail closed at
+    // runtime with the provider error, never with a guessed credential.
+    const dataHome = opencodeDataHome(options.controlDir)
+    if (dataHome) environment.XDG_DATA_HOME = dataHome
+  }
+  if (!host && !gui && key === 'pi') {
+    // Point Pi at the agent-bound config dir (cli/pi/agent/auth.json) when
+    // the owner provisioned it. Without a binding Pi falls back to the relay
+    // home config. Fail closed at runtime with the provider error, never with
+    // a guessed credential.
+    const agentDir = piAgentDir(options.controlDir)
+    if (agentDir) environment.PI_CODING_AGENT_DIR = agentDir
+  }
   if (denies.length) {
     const profile = path.join(outputDirectory, 'workspace.sb')
     await writeFile(profile, macosWorkspaceProfile(denies, [